feat(workflows): expose authenticated run subjects

[TheodoreSpeaks]

Summary

• preserve authenticated principals across synchronous, queued, resumed, and nested workflow execution
• expose normalized Sim user, chat email, and provider subjects through optional Start run metadata
• keep actorless callers identity-free and enforce subject-scoped credential access

Type of Change

• New feature

Testing

• 771 tests across 31 changed test files
• bun run lint
• bun run check:audits (33 audits)

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 26, 2026 12:43am

[greptile-apps]

Greptile Summary

The PR propagates authenticated subjects through workflow execution and exposes normalized identity metadata to Start blocks while keeping actorless runs identity-free.

• Adds signed authenticated-email claims to deployment cookies and recovers them during chat and public-file authentication.
• Carries Sim-user, authenticated-email, and provider subjects through synchronous, queued, resumed, and nested workflow execution.
• Enforces subject-scoped credential access and adds coverage across authentication and execution paths.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported untyped authentication fixture now uses a typed NextRequest helper and real Cookie headers.

Important Files Changed

Filename	Overview
apps/sim/app/api/chat/utils.test.ts	Replaces ad-hoc authentication request casts with typed NextRequest fixtures using real Cookie headers, resolving the prior review concern.
apps/sim/lib/core/security/deployment.ts	Extends signed deployment authentication tokens to preserve normalized authenticated-email subjects.
apps/sim/lib/workflows/executor/start-run-identity.ts	Normalizes trusted execution principals into optional Start-block subject metadata.
apps/sim/lib/workflows/executor/execution-core.ts	Propagates authenticated principal identity into workflow execution and Start metadata.
apps/sim/executor/handlers/workflow/workflow-handler.ts	Preserves principal subjects across nested workflow execution boundaries.
apps/sim/lib/credential-groups/credentials.ts	Applies subject-aware constraints when resolving credentials for authenticated workflow runs.
packages/auth/src/principal.ts	Defines the shared principal-subject contract used across authentication and execution layers.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Authenticated caller] --> B[Normalized principal subject]
  B --> C[Workflow execution context]
  C --> D{Execution path}
  D --> E[Synchronous run]
  D --> F[Queued or resumed run]
  D --> G[Nested workflow]
  E --> H[Start run metadata]
  F --> H
  G --> H
  H --> I[Subject-scoped credential access]
  J[Actorless caller] --> K[Identity-free execution]

Loading

_{Reviews (2): Last reviewed commit: "fix(auth): harden subject delegation and..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 90 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.