fix(chat): conceal a missing deployment the way an unreachable one is

[waleedlatif1]

Summary

From the v0.8.12 release review (#7090). The internal chat error policy documents that a missing deployment and one in an unreachable workspace "must stay indistinguishable" — and they were not.

• The policy rewrites a cross-tenant authorization failure to Chat not found or access denied, but the domain answers an absent deployment with its own Chat deployment not found, which the projection passed straight through. Two 404s a caller can tell apart is exactly the existence oracle the concealment exists to close.
• The legacy code is derived from the message (legacyCode), so the difference leaked on both the error and code fields.
• Every not_found reachable through this policy means the same thing — the deployment is not available to this caller — so all of them now render as the concealed message. None of the alternatives (context.ts, update-chat-deployment.ts, the two undeploy paths) carries a distinction worth preserving at the cost of the one they must not make.

Type of Change

• Bug fix

Testing

• The two existing 404 tests asserted only response.status, which is how the bodies drifted apart unnoticed. The new test compares the two responses directly and asserts the concealed wording; it goes red against the unfixed policy.
• Full apps/sim suite green: 34,539 tests.
• bun run lint, all 33 audits (check:audits), and type-check pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 26, 2026 4:13am

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Greptile Summary

This PR closes an existence oracle in internal chat deployment routes by giving missing and unauthorized deployments the same response body and legacy error code.

• Normalizes every classified internal-chat not_found response to Chat not found or access denied.
• Adds a regression test comparing missing and unreachable deployment responses directly.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

The policy consistently conceals all internal chat deployment not-found outcomes, and the regression test exercises both missing and unauthorized paths through the same response projection.

Important Files Changed

Filename	Overview
apps/sim/app/api/chat/error-policy.ts	Normalizes classified not-found errors before producing both the message and message-derived legacy code.
apps/sim/app/api/chat/manage/[id]/route.test.ts	Adds coverage proving missing and unauthorized deployments produce identical concealed 404 responses.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Internal chat request] --> B{Deployment available to caller?}
  B -->|Missing| C[Classified not_found]
  B -->|Unauthorized workspace| C
  C --> D[Concealed message]
  D --> E[Identical 404 error and legacy code]

Loading

_{Reviews (1): Last reviewed commit: "fix(chat): conceal a missing deployment ..." | Re-trigger Greptile}