fix(workflows): cover legacy workflow-typed tools and retry depth-truncated expansions

- toolInputCallees matches both workflow tool type spellings via
  isWorkflowBlockType and passes the tool's own type as the legacy
  canonicalModes fallback, matching providers/utils resolution
- a depth-capped expansion no longer poisons the expanded set, so a
  shallower path re-expands the node in full (Cursor finding)
- the allowed-but-workspaceless auth branch now returns 403, not the
  authz result's 200
- tests: legacy tool type + per-tool index-scope isolation, diamond
  re-expansion with a real subtree, depth ceiling, shallow-path retry

Author: waleedlatif1

apps/sim/app/api/workflows/[id]/references/route.ts

@@ -28,7 +28,7 @@ export const GET = withRouteHandler(async (request: NextRequest, context: RouteC
   if (!auth.allowed || !auth.workflow?.workspaceId) {
     return NextResponse.json(
       { error: auth.message ?? 'Access denied' },
-      { status: auth.status || 403 }
+      { status: auth.allowed ? 403 : auth.status }
     )
   }
 

apps/sim/lib/workflows/references/operations.test.ts

@@ -101,21 +101,71 @@ describe('resolveWorkflowReferences', () => {
   })
 
   it('bounds converging paths (diamond) instead of re-expanding', () => {
-    // A → B, A → C, B → D, C → D. D reconverges; it must appear under both B and C
-    // but only expand once (here D is a leaf anyway; the guard prevents blow-up).
+    // A → B, A → C, B → D, C → D, D → E. D reconverges; it must appear under both
+    // B and C but expand its subtree (E) only under the first-visited branch.
+    const workflowsWithE = [...workflows, { id: 'e', name: 'E' }]
     const blocks = [
       workflowBlock('a', 'b'),
       workflowBlock('a', 'c'),
       workflowBlock('b', 'd'),
       workflowBlock('c', 'd'),
+      workflowBlock('d', 'e'),
     ]
-    const { callees } = resolveWorkflowReferences('a', workflows, blocks, [])
+    const { callees } = resolveWorkflowReferences('a', workflowsWithE, blocks, [])
     const b = callees.find((n) => n.id === 'b')
     const c = callees.find((n) => n.id === 'c')
-    // D expands under the first-visited branch (B) and is a plain leaf under C.
-    expect(b?.children.map((n) => n.id)).toEqual(['d'])
-    expect(c?.children.map((n) => n.id)).toEqual(['d'])
-    expect(c?.children[0]).toMatchObject({ id: 'd', cycle: false, children: [] })
+    // D expands under the first-visited branch (B) and is a collapsed leaf under C.
+    expect(b?.children).toEqual([
+      {
+        id: 'd',
+        name: 'D',
+        cycle: false,
+        children: [{ id: 'e', name: 'E', cycle: false, children: [] }],
+      },
+    ])
+    expect(c?.children).toEqual([{ id: 'd', name: 'D', cycle: false, children: [] }])
+  })
+
+  it('truncates expansion at the depth ceiling', () => {
+    // A linear chain longer than MAX_REFERENCE_DEPTH (25): w0 → w1 → … → w29.
+    const chain = Array.from({ length: 30 }, (_, i) => ({ id: `w${i}`, name: `W${i}` }))
+    const blocks = Array.from({ length: 29 }, (_, i) => workflowBlock(`w${i}`, `w${i + 1}`))
+    const { callees } = resolveWorkflowReferences('w0', chain, blocks, [])
+    let depth = 0
+    let node = callees[0]
+    while (node) {
+      depth += 1
+      node = node.children[0]
+    }
+    expect(depth).toBe(25)
+  })
+
+  it('re-expands a depth-truncated node when a shallower path reaches it', () => {
+    // Root fans out to a 25-deep chain (visited first by name sort: "A…") whose
+    // tail X gets truncated at the ceiling, and a direct edge (via "Z") to X.
+    // The shallow path must still show X's child Y instead of a collapsed leaf.
+    const nodes = [
+      { id: 'root', name: 'Root' },
+      ...Array.from({ length: 24 }, (_, i) => ({
+        id: `a${i}`,
+        name: `A${String(i).padStart(2, '0')}`,
+      })),
+      { id: 'x', name: 'X' },
+      { id: 'y', name: 'Y' },
+      { id: 'z', name: 'Z' },
+    ]
+    const blocks = [
+      workflowBlock('root', 'a0'),
+      ...Array.from({ length: 23 }, (_, i) => workflowBlock(`a${i}`, `a${i + 1}`)),
+      workflowBlock('a23', 'x'),
+      workflowBlock('root', 'z'),
+      workflowBlock('z', 'x'),
+      workflowBlock('x', 'y'),
+    ]
+    const { callees } = resolveWorkflowReferences('root', nodes, blocks, [])
+    const z = callees.find((n) => n.id === 'z')
+    const xUnderZ = z?.children.find((n) => n.id === 'x')
+    expect(xUnderZ?.children.map((n) => n.id)).toEqual(['y'])
   })
 
   it('drops dangling / out-of-workspace child ids', () => {
@@ -217,6 +267,29 @@ describe('resolveWorkflowReferences', () => {
     expect(callees.map((n) => n.id)).toEqual(['c'])
   })
 
+  it('resolves legacy workflow-typed tools and isolates index-scoped modes per tool', () => {
+    // Tool 0 is a legacy `workflow`-typed entry (still rendered/executed by the
+    // editor); tool 1 is advanced-mode via its own index-scoped key. Tool 0 must
+    // stay basic (`b`) — tool 1's override must not bleed into it.
+    const blocks: ReferenceBlockRow[] = [
+      {
+        parentId: 'a',
+        type: 'agent',
+        childFromSelector: null,
+        childFromManual: null,
+        canonicalModes: { '1:workflowId': 'advanced' },
+        toolInputValues: [
+          [
+            { type: 'workflow', params: { workflowId: 'b' } },
+            { type: 'workflow_input', params: { workflowId: 'c', manualWorkflowId: 'd' } },
+          ],
+        ],
+      },
+    ]
+    const { callees } = resolveWorkflowReferences('a', workflows, blocks, [])
+    expect(callees.map((n) => n.id)).toEqual(['b', 'd'])
+  })
+
   it('resolves workflow tools from a JSON-stringified tool-input value', () => {
     const blocks: ReferenceBlockRow[] = [
       {

apps/sim/lib/workflows/references/operations.ts

@@ -63,7 +63,8 @@ export interface ReferenceBlockRow {
    * Aggregated `tool-input` sub-block values on this block (agent-style tool
    * lists). Each entry is one sub-block's raw value — an array of tool objects,
    * or that array JSON-stringified. `workflow_input` tools carry the callee id
-   * in `params.workflowId`. Null when the block has no tool-input sub-blocks.
+   * in `params.workflowId` (basic) or `params.manualWorkflowId` (advanced).
+   * Null when the block has no tool-input sub-blocks.
    */
   toolInputValues: unknown[] | null
 }
@@ -85,11 +86,12 @@ interface ReferenceGraph {
 }
 
 /**
- * Callee workflow ids referenced by a block's tool-input values: `workflow_input`
- * tools resolved to their ACTIVE canonical member — the basic `params.workflowId`
- * selector or the advanced `params.manualWorkflowId` input, per the tool's
- * index-scoped `canonicalModes` override ({@link scopeCanonicalModesForTool}) —
- * mirroring how execution picks the live value.
+ * Callee workflow ids referenced by a block's tool-input values: workflow tools
+ * (`workflow_input`, plus legacy stored entries typed `workflow`) resolved to
+ * their ACTIVE canonical member — the basic `params.workflowId` selector or the
+ * advanced `params.manualWorkflowId` input, per the tool's index-scoped
+ * `canonicalModes` override ({@link scopeCanonicalModesForTool}) — mirroring how
+ * execution picks the live value.
  */
 function toolInputCallees(
   toolInputValues: unknown[] | null,
@@ -101,14 +103,15 @@ function toolInputCallees(
     const { array } = coerceObjectArray(value)
     if (!array) continue
     array.forEach((tool, toolIndex) => {
-      if (!isRecord(tool) || tool.type !== BlockType.WORKFLOW_INPUT || !isRecord(tool.params)) {
+      if (
+        !isRecord(tool) ||
+        typeof tool.type !== 'string' ||
+        !isWorkflowBlockType(tool.type) ||
+        !isRecord(tool.params)
+      ) {
         return
       }
-      const scoped = scopeCanonicalModesForTool(
-        canonicalModes ?? undefined,
-        toolIndex,
-        BlockType.WORKFLOW_INPUT
-      )
+      const scoped = scopeCanonicalModesForTool(canonicalModes ?? undefined, toolIndex, tool.type)
       const active = resolveActiveCanonicalValue(
         WORKFLOW_ID_CANONICAL_GROUP,
         {
@@ -232,6 +235,10 @@ function buildTree(
       path.add(childId)
       nodes.push({ id: childId, name, cycle: false, children: expand(childId, depth + 1) })
       path.delete(childId)
+      // A depth-capped expansion is incomplete — allow a shallower path to retry
+      // it in full instead of collapsing to a leaf. Each retry starts strictly
+      // shallower, so this stays bounded.
+      if (depth + 1 >= MAX_REFERENCE_DEPTH) expanded.delete(childId)
     }
     return nodes
   }