fix(tools): align private provenance with wire payloads

[icecrasher321]

Summary

Align private provenance with wire payloads to fix table tools errors with json structures. Edit ownership/signing to align with platform policy.

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 6, 2026 10:48am

[cursor]

PR Summary

Medium Risk
Changes admission rules for encrypted secret provenance on workspace resources (security-sensitive), though bounded to same-workspace scope and covered by new tests. Tool error sanitization also alters how failed internal calls surface to the executor.

Overview
Private secret provenance no longer requires the provenance scope.userId to match the authenticated actor. Workspace writes now admit provenance from any user in the same workspace (e.g. workflow owner vs billing actor), while personal destinations still require matching user and reject workspace-scoped sources. Table, file, knowledge, and memory paths share this via isPrivateSecretProvenanceScopeCompatible and durableSecretProvenanceFromPrivateBundle.

Table row provenance skips undefined cell values when building selection keys so keys stay aligned with the JSON-serialized request body (avoids mismatches when rows include omitted/undefined fields).

Internal tool transport rebuilds unsafe private responses by preserving the upstream HTTP 4xx–5xx status with a generic failure message (no leaked route bodies/headers); other statuses become 502 with a metadata verification error. Tests cover table/memory error paths and registry behavior when provenance crosses workspace but not user.

^{Reviewed by Cursor Bugbot for commit 6ab405d. Configure here.}

[greptile-apps]

Greptile Summary

The PR aligns table-row secret provenance selections with JSON wire serialization and hardens handling of unverifiable private tool responses.

• Omits top-level undefined row properties from table provenance selections.
• Preserves valid HTTP error statuses while replacing unverified response bodies and headers with safe metadata.
• Adds focused tests for serialized table rows and private-response containment.

Confidence Score: 5/5

The PR appears safe to merge with no concrete blocking or independently actionable non-blocking issues identified.

The table provenance keys now follow the serialized payload, and unverifiable private responses retain useful error status information without exposing their original bodies or headers.

Important Files Changed

Filename	Overview
apps/sim/lib/table/secret-provenance-selection.ts	Filters undefined top-level row properties so provenance selection keys match properties retained by JSON serialization.
apps/sim/lib/table/secret-provenance-selection.test.ts	Covers direct undefined filtering and end-to-end alignment with the prepared request body.
apps/sim/tools/index.ts	Rebuilds unverifiable private responses with a contained JSON error while retaining only valid HTTP error statuses.
apps/sim/tools/index.test.ts	Verifies status preservation, body and header containment, and fallback handling for non-error statuses.

_{Reviews (1): Last reviewed commit: "fix(tools): align private provenance wit..." | Re-trigger Greptile}

[icecrasher321]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6ab405d. Configure here.}