fix(selectors): resolve shared environment references server-side

[BillLeoutsakosvl346]

Summary

Resolves exact {{KEY}} selector dependencies on the server after authorization, so users can use permitted workspace/shared secrets without exposing plaintext to browser state, query keys, responses, or logs.

This hardening follow-up makes selector resolution a Principal-based application operation and supports two canonical scopes:

• Workflow selectors require an active, readable workflow; credential-backed requests also authorize the credential and require the same workspace.
• Workflowless knowledge connectors are session-only and credential-backed; the authorized credential supplies the canonical workspace. Direct-secret selectors still require a workflow.

Credential providers are bound before token/service-account secret access (Jira/JSM, Confluence, and Slack). Server-resolved selector caches are partitioned by workspace, workflow, and an opaque raw-dependency revision, then cleared with all user data. Atlassian selector failures expose only stable status classes, and provider response bodies cannot enter selector responses or retry logs.

Migrated selector families:

• Jira Project and Issue
• Confluence Page and Space
• Jira Service Management Service Desk and Request Type
• CloudWatch Log Group and Log Stream
• Slack Channel and User, including direct bot-token mode
• IMAP Mailbox

Runtime tool routes, block definitions, database schemas, runtime environment resolution, and unrelated chained resource-ID selectors remain unchanged. Embedded interpolation remains out of scope.

Slack report: https://sim-ai.slack.com/archives/C093DF8MA21/p1786822370070229

Security invariant

• Route adapters authenticate before parsing and reuse the authenticated session or executor principal.
• Workflow scope comes from an active workflow that the principal may read; workflowless scope comes only from an authorized credential and session principal.
• Credential-backed selectors use existing credential-use authorization and enforce workflow/credential workspace agreement.
• Credential provider compatibility is checked before reading service-account secrets or refreshing OAuth tokens.
• getEffectiveDecryptedEnv preserves accessible-secret filtering and workspace-over-personal precedence.
• Only exact references are resolved; missing and inaccessible references return the same sanitized error.
• The browser sends literals or opaque raw references only. Resolved values stay server-side, and opaque cache revisions never contain dependency plaintext.
• Atlassian provider bodies are not returned or logged by selector discovery, including inside retries.
• Provider access is not attempted after authorization, provider-binding, or reference-resolution failure.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

Automated verification on the latest origin/staging:

• Final focused selector/security suite: 13 files, 91 tests passed
• Full apps/sim suite: 2,347 files passed, 3 skipped; 34,612 tests passed, 46 skipped
• Root suite: 19/19 tasks passed, including the full app suite and boundary audits
• App TypeScript check passed again after the final rebase and sanitization change
• Root TypeScript check passed: 26/26 tasks
• lint:check passed (one pre-existing unused-suppression warning in lib/workspace-files/shell-layout.test.ts)
• format:check passed
• Strict API validation passed: 1,213/1,213 routes Zod-backed
• Client-boundary and React Query audits passed
• git diff --check passed

Focused coverage includes:

• literal, personal, accessible shared, inaccessible, and workspace-over-personal reference behavior
• active/archived workflow authorization, delegated scope, workflowless credential scope, and workspace mismatch
• provider mismatch before token/secret/provider access
• real QueryClient cache separation for raw dependency, workflow, workspace, and Slack literal-token changes
• absence of secret plaintext from query keys, serialized errors, and selector responses
• selector-cache removal during user-data reset
• workflowless Jira, Confluence, JSM, and Slack connector enablement/request/option mapping
• Slack runtime block references issuing no request
• strict name-only CloudWatch selector responses
• unauthenticated malformed requests returning 401 before parsing
• Atlassian provider markers excluded from selector responses, thrown discovery errors, and retry logging paths

The full suite emits the repository's existing JSDOM canvas warnings; no new test warnings were introduced.

Browser verification

• The original disposable IMAP pass exercised literal host, personal {{KEY}}, and workspace/shared {{KEY}} inputs. Each reached selector/provider validation while network payloads retained literals/raw references and responses did not echo resolved values. The workflow and variables were deleted and verified absent.
• The hardening pass used an existing local Slack OAuth workflow. Opening Channel issued the authenticated selector request, mapped 85 live channels, and preserved the existing installing-user private-channel scope.
• No new disposable records were created during the hardening pass, so no additional cleanup was required. The local dev server was stopped and browser test tabs were closed.
• The local environment had no safe connected Jira, Confluence, JSM, AWS, or direct-token Slack accounts. Those successful/denied provider paths and workflowless connector paths are covered by deterministic route/client mocks instead of claiming live coverage.
• No selector-specific console errors or warnings appeared. A Microsoft Teams availability hydration warning seen while navigating the integration gallery is unrelated to the changed selector code.

Reviewer focus

• Principal/scope rules in lib/selectors/application/resolve-authorized-context.ts
• Provider binding in lib/selectors/application/credential-provider.ts and credential adapters
• Browser cache scoping in hooks/selectors/use-selector-query.ts
• Workflowless connector context in connector-selector-field.tsx
• Atlassian status/body sanitization and selector-only discovery mode
• Dedicated CloudWatch selector responses versus unchanged runtime metadata

Intentional remaining scope

• Exact whole-value references only; embedded interpolation is unchanged.
• Chained project/space/service-desk/log-group references are not opted in yet, but the shared resolver supports future fields without redesign.
• Credential-denial wording and Jira field visibility are unchanged.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

Not included. Browser verification was behavior/network focused and used existing or disposable local data only.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 26, 2026 5:50pm