fix(workflows): skip dynamically bound selectors in id validation

[mzxchandra]

Summary

Tier-2 selector validation (collectSelectorFields → validateSelectorIds) is a static id-existence check against the workspace. It cannot evaluate a value whose id only arrives at execution time, so a <block.output> or {{ENV_VAR}} binding written into a selector field was reported as a resource that does not exist — on every graph write.

Two commits:

fix(workflows): split multi-select values without tearing references
A reference token may legitimately contain a comma (<start.pick(a,b)>), and its fragments read as plain literals once split, so the existing .split(',') turned one dynamic value into several bogus ids. Adds splitOutsideReferences, which treats only commas outside every reference token as separators.

fix(workflows): skip dynamically bound selectors in id validation
collectSelectorFields now skips dynamically bound values via the existing containsReference, and splits with splitOutsideReferences. Filtering is per entry, not on the whole string: a multi-select can mix literal ids with dynamic ones, and testing <a.b>,kb_real,<c.d> as a whole would drop kb_real along with the references.

Behaviour is unchanged for literal ids — one that does not resolve is still reported.

Performance

Token spans are marked once into a lookup rather than rescanned per comma. A per-comma tokens.some() is O(commas × tokens):

value size	per-comma scan	marked once
30KB	42ms	3ms
120KB	425ms	5ms
240KB	2512ms	12ms

This runs synchronously on the graph-write paths, which admit bodies up to MAX_IMPORT_BODY_BYTES (10MB), so the quadratic form was worth avoiding. A regression test asserts the 240KB case stays under 1s.

Test Coverage

lib/workflows/sanitization/references.ts  (NEW splitOutsideReferences)
├── splits on separator commas ............................. ★★★
├── trims entries, drops empties ........................... ★★★
├── comma inside <workflow.reference> is not a separator .... ★★★
├── comma inside {{ENV,VAR}} is not a separator ............. ★★★
├── stays linear on a 240KB value .......................... ★★★
└── nested env-var inside a reference (known limitation) .... ★★★

lib/workflows/editing/validation.ts  (collectSelectorFields)
├── scalar reference / env-var / partial template -> skip ... ★★★
├── scalar literal -> still validated ...................... ★★★
├── multi-select: some references -> filter, keep the rest .. ★★★
├── multi-select: all references -> skip, no empty DB call .. ★★★
├── multi-select opening AND closing with a reference ....... ★★★
├── native array value (second entry into the filter) ....... ★★★
├── non-string entries ..................................... ★★★
├── unbalanced delimiters are not references -> validated ... ★★★
├── runs after the canonical active-member check ........... ★★
├── consumer: collectUnresolvedReferences ................... ★★★
├── consumer: validateWorkflowSelectorIds ................... ★★★
└── against the real block registry (no fixture drift) ...... ★★

Legend: ★★★ behaviour + edge + error · ★★ happy path

245 tests pass across lib/workflows/editing/ and lib/workflows/sanitization/. Full apps/sim suite green.

Known limitations (characterized by tests, not fixed here)

• A reference that nests an env-var placeholder still splits. findWorkflowReferenceTokens collects {{...}} first and suppresses any workflow token overlapping one, so the outer <...> span is never recorded and its commas are unprotected: <start.body.pick({{A}},b)> → ['<start.body.pick({{A}}', 'b)>']. This is byte-identical to the .split(',') it replaces — not a regression — and the root cause is the overlap rule in the shared @sim/utils/workflow-references tokenizer, so fixing it belongs there.
• A near-miss reference still tears. Anything failing isLikelyWorkflowReferenceSegment (<a.b+c,d>, unbalanced <a.b,kb_x) gets no span and splits. Loud rather than silent.
• Follow-up worth considering: when every selector in a graph is reference-bound, the lint now emits no findings and no note, which reads the same as "checked, all clean". A "N dynamic bindings not statically checked" note would fix that, but buildWorkflowLintReport iterates its collectors as a homogeneous pair, so surfacing a skip count means changing both signatures and that loop. Left out of this PR deliberately.

Review

Reviewed against the repo checklist plus testing, maintainability, and security passes, and two independent adversarial passes.

• Security: no findings. The lint is advisory (lint-report.ts: "Findings never block a write"), and credentials are re-authorized at execution time by authorizeCredentialUseForAuth independently of anything the editor recorded, so a more lenient editor check cannot grant access.
• Fixed during review: the first draft reimplemented containsReference with a substring test (which wrongly matched value <limit && value>max), used an unanchored whole-value check that let <start.a>,kb_real,<start.b> skip kb_real, and scanned tokens per comma.

Test plan

• bun run test in apps/sim — full suite green
• bun run type-check clean
• biome check clean on all changed files
• bun run check:api-validation passes
• End-to-end against a local dev server: the three reference forms drop from one unresolved-reference finding each to zero; a literal id that does not resolve still reports one

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 13, 2026 2:03am UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previous findings are resolved and no new actionable defects remain.

Summary

• Adds reference-aware comma splitting that protects workflow and environment-reference regions, including overlapping nested placeholders.
• Filters dynamic selector entries individually while continuing to validate literal entries in mixed selections.
• Replaces the oversized-list fallback with linear splitting while retaining a per-entry classification limit.
• Adds unit and integration coverage for reference forms, mixed lists, oversized inputs, malformed delimiters, and the real block registry.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Selector field value] --> B{Comma-separated string?}
    B -- Yes --> C[Split only on commas outside reference regions]
    B -- No --> D[Keep scalar or native array]
    C --> E[Classify each entry]
    D --> E
    E --> F{Oversized or dynamically bound?}
    F -- Yes --> G[Skip static ID validation]
    F -- No --> H[Validate literal selector ID]
    H --> I[Report unresolved literal resources]

Loading

_{Reviews (4) · Last reviewed commit: "fix(workflows): split references without..."}

[mzxchandra]

@cubic review

[cubic-dev-ai]

@cubic review

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

[mzxchandra]

@greptile

[mzxchandra]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

[mzxchandra]

@greptile

[mzxchandra]

@greptile