fix(executor): seed run-wide access key lists and scope exact-key cache grants (#7850)

- Seed largeValueKeys/fileKeys in createExecutionContext so keys a block records on its per-block context copy reach later blocks; child executors get their own lists, never the parent's
- Share one exact-key grant predicate between the async storage check and the sync large-value cache, which previously honored a granted key without checking the key's workspace and workflow
- Correct the executionFilesById TSDoc: the index is built per block from block states

Author: waleedlatif1

apps/sim/executor/execution/executor.test.ts

@@ -2,6 +2,7 @@
  * @vitest-environment node
  */
 import { describe, expect, it, vi } from 'vitest'
+import { mergeFileKeys, mergeLargeValueKeys } from '@/lib/execution/payloads/access-keys'
 import { BlockType } from '@/executor/constants'
 import { DAGBuilder } from '@/executor/dag/builder'
 import { DAGExecutor } from '@/executor/execution/executor'
@@ -10,6 +11,15 @@ import type { ExecutionContext, ExecutionResult } from '@/executor/types'
 import { buildSentinelStartId } from '@/executor/utils/subflow-utils'
 import type { SerializedBlock, SerializedWorkflow } from '@/serializer/types'
 
+/** Reaches the executor's private context factory, which every run's root context comes from. */
+function createExecutionContext(executor: DAGExecutor, workflowId = 'wf-1'): ExecutionContext {
+  return (
+    executor as unknown as {
+      createExecutionContext: (workflowId: string) => { context: ExecutionContext }
+    }
+  ).createExecutionContext(workflowId).context
+}
+
 function createExecutor(): DAGExecutor {
   return new DAGExecutor({
     workflow: {
@@ -404,12 +414,7 @@ describe('DAGExecutor createExecutionContext useDraftState', () => {
             : ({ useDraftState: opts.metadataUseDraftState } as ExecutionContext['metadata']),
       },
     })
-    const { context } = (
-      executor as unknown as {
-        createExecutionContext: (workflowId: string) => { context: ExecutionContext }
-      }
-    ).createExecutionContext('wf-1')
-    return context.metadata.useDraftState
+    return createExecutionContext(executor).metadata.useDraftState
   }
 
   it('honors explicit useDraftState=true even when isDeployedContext is true (table dispatcher)', () => {
@@ -442,33 +447,21 @@ describe('DAGExecutor executor delegation origin', () => {
       contextExtensions: { executorDelegationOrigin },
     })
 
-    const { context } = (
-      executor as unknown as {
-        createExecutionContext: (workflowId: string) => { context: ExecutionContext }
-      }
-    ).createExecutionContext('child-workflow')
+    const context = createExecutionContext(executor, 'child-workflow')
 
     expect(context.workflowId).toBe('child-workflow')
     expect(context.executorDelegationOrigin).toBe(executorDelegationOrigin)
   })
 })
 
 describe('DAGExecutor run-scoped permission config cache', () => {
-  function createContext(executor: DAGExecutor): ExecutionContext {
-    return (
-      executor as unknown as {
-        createExecutionContext: (workflowId: string) => { context: ExecutionContext }
-      }
-    ).createExecutionContext('wf-1').context
-  }
-
   it('seeds one cache per run that survives per-block context copies', () => {
     const executor = new DAGExecutor({
       workflow: { version: '1', blocks: [], connections: [] },
       contextExtensions: { workspaceId: 'ws-1' },
     })
 
-    const context = createContext(executor)
+    const context = createExecutionContext(executor)
     const blockContext = { ...context }
 
     expect(context.permissionConfigCache).toBeInstanceOf(Map)
@@ -477,9 +470,40 @@ describe('DAGExecutor run-scoped permission config cache', () => {
 
   it('never shares the cache between runs', () => {
     const workflow = { version: '1', blocks: [], connections: [] }
-    const parent = createContext(new DAGExecutor({ workflow, contextExtensions: {} }))
-    const child = createContext(new DAGExecutor({ workflow, contextExtensions: {} }))
+    const parent = createExecutionContext(new DAGExecutor({ workflow, contextExtensions: {} }))
+    const child = createExecutionContext(new DAGExecutor({ workflow, contextExtensions: {} }))
 
     expect(child.permissionConfigCache).not.toBe(parent.permissionConfigCache)
   })
 })
+
+describe('DAGExecutor exact access key lists', () => {
+  function createContext(contextExtensions: Record<string, unknown>): ExecutionContext {
+    return createExecutionContext(
+      new DAGExecutor({
+        workflow: { version: '1', blocks: [], connections: [] },
+        contextExtensions,
+      })
+    )
+  }
+
+  it('keeps keys a block records on its context copy for later blocks', () => {
+    const context = createContext({})
+
+    mergeLargeValueKeys({ ...context }, ['large-value-key'])
+    mergeFileKeys({ ...context }, ['file-key'])
+
+    expect(context.largeValueKeys).toEqual(['large-value-key'])
+    expect(context.fileKeys).toEqual(['file-key'])
+  })
+
+  it('shares the lists a run passes in rather than copying them', () => {
+    const largeValueKeys = ['inherited-large-value-key']
+    const fileKeys = ['inherited-file-key']
+
+    const context = createContext({ largeValueKeys, fileKeys })
+
+    expect(context.largeValueKeys).toBe(largeValueKeys)
+    expect(context.fileKeys).toBe(fileKeys)
+  })
+})

apps/sim/executor/execution/executor.ts

@@ -418,8 +418,8 @@ export class DAGExecutor {
       workspaceId: this.contextExtensions.workspaceId,
       executionId: this.contextExtensions.executionId,
       largeValueExecutionIds: this.contextExtensions.largeValueExecutionIds,
-      largeValueKeys: this.contextExtensions.largeValueKeys,
-      fileKeys: this.contextExtensions.fileKeys,
+      largeValueKeys: this.contextExtensions.largeValueKeys ?? [],
+      fileKeys: this.contextExtensions.fileKeys ?? [],
       allowLargeValueWorkflowScope: this.contextExtensions.allowLargeValueWorkflowScope,
       userId: this.contextExtensions.userId,
       principal: this.contextExtensions.principal,

apps/sim/executor/types.ts

@@ -405,6 +405,10 @@ export interface ExecutionContext {
   workspaceId?: string
   executionId?: string
   largeValueExecutionIds?: string[]
+  /**
+   * Exact large-value and file keys this run may read. Seeded by the executor so every block's
+   * shallow context copy appends to one run-wide list; an executor not handed lists starts empty.
+   */
   largeValueKeys?: string[]
   fileKeys?: string[]
   allowLargeValueWorkflowScope?: boolean
@@ -447,8 +451,9 @@ export interface ExecutionContext {
    * in any block state or workspace row, so nothing else can resolve it. The
    * index only *selects*; every read is still authorized on its own.
    *
-   * A Map for the same reason as {@link toolBindingLabelCache}: `blockCtx` is a
-   * shallow clone per block execution, so only a shared reference survives.
+   * Built lazily on the block's context from the current block states, so it lives
+   * for one block: shared by that block's agent turns and tool calls, rebuilt by the
+   * next block. Files from earlier blocks reach it through their committed outputs.
    */
   executionFilesById?: Map<string, UserFile>
 

apps/sim/lib/execution/payloads/cache.test.ts

@@ -16,14 +16,15 @@ import {
 const MB = 1024 * 1024
 const SCOPE = { executionId: 'exec-1' }
 
-function makeRef(id: string, size: number): LargeValueRef {
+function makeRef(id: string, size: number, overrides: Partial<LargeValueRef> = {}): LargeValueRef {
   return {
     __simLargeValueRef: true,
     version: LARGE_VALUE_REF_VERSION,
     id,
     kind: 'object',
     size,
     executionId: 'exec-1',
+    ...overrides,
   }
 }
 
@@ -131,3 +132,48 @@ describe('large value cache retention policy', () => {
     expect(getLargeValueCacheStats()).toEqual({ entries: 1, trackedBytes: 200 * MB })
   })
 })
+
+describe('exact-key access to a cached large value', () => {
+  const key = 'execution/ws-1/wf-1/exec-source/large-value-lv_keyed.json'
+  const keyedRef = makeRef('lv_keyed', 16, { key, executionId: 'exec-source' })
+
+  beforeEach(() => {
+    clearLargeValueCacheForTests()
+    cacheLargeValue('lv_keyed', { secret: 'value' }, 16, {
+      workspaceId: 'ws-1',
+      workflowId: 'wf-1',
+      executionId: 'exec-source',
+    })
+  })
+
+  afterEach(() => {
+    clearLargeValueCacheForTests()
+  })
+
+  it('serves a key granted to another execution of the same workflow', () => {
+    expect(
+      materializeLargeValueRefSync(keyedRef, {
+        workspaceId: 'ws-1',
+        workflowId: 'wf-1',
+        executionId: 'exec-reader',
+        largeValueKeys: [key],
+      })
+    ).toEqual({ secret: 'value' })
+  })
+
+  it('refuses a granted key that belongs to another workspace or workflow', () => {
+    for (const scope of [
+      { workspaceId: 'ws-2', workflowId: 'wf-1' },
+      { workspaceId: 'ws-1', workflowId: 'wf-2' },
+      { workspaceId: undefined, workflowId: undefined },
+    ]) {
+      expect(
+        materializeLargeValueRefSync(keyedRef, {
+          ...scope,
+          executionId: 'exec-reader',
+          largeValueKeys: [key],
+        })
+      ).toBeUndefined()
+    }
+  })
+})

apps/sim/lib/execution/payloads/cache.ts

@@ -1,5 +1,6 @@
 import {
   getLargeValueMaterializationError,
+  isGrantedLargeValueKey,
   isLargeValueRef,
   type LargeValueRef,
 } from '@/lib/execution/payloads/large-value-ref'
@@ -167,7 +168,7 @@ function scopeMatchesRef(
     callerScope.executionId,
     ...(callerScope.largeValueExecutionIds ?? []),
   ])
-  if (ref.key && callerScope.largeValueKeys?.includes(ref.key)) {
+  if (ref.key && isGrantedLargeValueKey(ref.key, callerScope)) {
     return true
   }
   const workflowScopeAllowed =

apps/sim/lib/execution/payloads/large-value-ref.ts

@@ -20,6 +20,22 @@ export interface LargeValueRef {
 
 const LARGE_VALUE_ID_PATTERN = /^lv_[A-Za-z0-9_-]{12}$/
 
+/**
+ * Whether `key` is an exact large-value grant in `scope`. A grant only reaches values stored under
+ * the scope's own workspace and workflow, so a key recorded for another tenant never unlocks one.
+ */
+export function isGrantedLargeValueKey(
+  key: string,
+  scope: { workspaceId?: string; workflowId?: string; largeValueKeys?: readonly string[] }
+): boolean {
+  return Boolean(
+    scope.workspaceId &&
+      scope.workflowId &&
+      key.startsWith(`execution/${scope.workspaceId}/${scope.workflowId}/`) &&
+      scope.largeValueKeys?.includes(key)
+  )
+}
+
 export function isLargeValueStorageKey(key: string, id: string, executionId?: string): boolean {
   if (!key.startsWith('execution/')) return false
   if (!key.endsWith(`/large-value-${id}.json`)) return false

apps/sim/lib/execution/payloads/materialization.server.ts

@@ -6,6 +6,7 @@ import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { isUserFileWithMetadata } from '@/lib/core/utils/user-file'
 import {
   getLargeValueMaterializationError,
+  isGrantedLargeValueKey,
   isLargeValueRef,
   isLargeValueStorageKey,
   type LargeValueRef,
@@ -107,7 +108,6 @@ export function assertLargeValueRefAccess(
     context.executionId,
     ...(context.largeValueExecutionIds ?? []),
   ])
-  const allowedKeys = new Set(context.largeValueKeys ?? [])
 
   const parts = ref.key?.split('/') ?? []
   const [, workspaceId, workflowId, executionId] = parts
@@ -131,7 +131,7 @@ export function assertLargeValueRefAccess(
   if (context.workflowId && workflowId !== context.workflowId) {
     throw new Error('Large execution value is not available in this execution.')
   }
-  if (allowedKeys.has(ref.key)) {
+  if (isGrantedLargeValueKey(ref.key, context)) {
     return
   }
   if (ref.executionId && !allowedExecutionIds.has(ref.executionId) && !workflowScopeAllowed) {