fix(copilot): surface classified tool access errors

Author: Sg312

apps/sim/lib/copilot/tools/handlers/access.ts

@@ -1,4 +1,5 @@
 import { authorizeWorkflowByWorkspacePermission } from '@sim/platform-authz/workflow'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { getWorkflowById } from '@/lib/workflows/utils'
 import { checkWorkspaceAccess, type WorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 import { listAccessibleWorkspaceRowsForUser } from '@/lib/workspaces/utils'
@@ -19,12 +20,21 @@ export async function ensureWorkflowAccess(
     action,
   })
 
+  // Classified, not bare Errors: the copilot error projection passes a
+  // classified message through to the model verbatim, while an unclassified
+  // throw collapses into the generic "system error, please retry".
   if (!result.workflow) {
-    throw new Error(`Workflow ${workflowId} not found`)
+    throw new OrchestrationError(
+      'not_found',
+      `Workflow not found: ${workflowId}. Pass the workflow's canonical id (copy it from workflows/**/meta.json or the tool result that created it) — a workflow name or @-mention is not an id.`
+    )
   }
 
   if (!result.allowed) {
-    throw new Error(result.message || 'Unauthorized workflow access')
+    throw new OrchestrationError(
+      result.status === 404 ? 'not_found' : 'forbidden',
+      result.message || 'Unauthorized workflow access'
+    )
   }
 
   return { workflow: result.workflow, workspaceId: result.workflow.workspaceId }

apps/sim/lib/copilot/tools/server/files/file-folders.ts

@@ -14,7 +14,7 @@ import {
   requireCopilotWorkspace,
 } from '@/lib/copilot/tools/server/files/file-folder-application'
 import { decodeVfsPathSegments } from '@/lib/copilot/vfs/path-utils'
-import { asOrchestrationError } from '@/lib/core/orchestration/types'
+import { asOrchestrationError, OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   findWorkspaceFileFolderIdByPath,
   getWorkspaceFileFolder,
@@ -119,9 +119,11 @@ async function resolveFolderIdFromPath(
   label = 'Folder'
 ): Promise<string> {
   const segments = decodeFileFolderPath(path)
-  if (!segments) throw new Error(`${label} path must identify a folder under files/`)
+  if (!segments)
+    throw new OrchestrationError('validation', `${label} path must identify a folder under files/`)
   const folderId = await findWorkspaceFileFolderIdByPath(workspaceId, segments)
-  if (!folderId) throw new Error(`${label} not found at files/${segments.join('/')}`)
+  if (!folderId)
+    throw new OrchestrationError('not_found', `${label} not found at files/${segments.join('/')}`)
   return folderId
 }
 
@@ -135,7 +137,11 @@ async function resolveOptionalFolderId(
   const segments = decodeFileFolderPath(raw)
   if (!segments) return null
   const folderId = await findWorkspaceFileFolderIdByPath(workspaceId, segments)
-  if (!folderId) throw new Error(`Target folder not found at files/${segments.join('/')}`)
+  if (!folderId)
+    throw new OrchestrationError(
+      'not_found',
+      `Target folder not found at files/${segments.join('/')}`
+    )
   return folderId
 }
 

apps/sim/lib/copilot/tools/server/workflow/edit-workflow/index.ts

@@ -17,6 +17,7 @@ import {
   type ServerToolContext,
 } from '@/lib/copilot/tools/server/base-tool'
 import { env } from '@/lib/core/config/env'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { getSocketServerUrl } from '@/lib/core/utils/urls'
 import { MAX_PLAN_REQUIRED } from '@/lib/execution/remote-sandbox/workspace-sandboxes'
 import {
@@ -64,7 +65,8 @@ async function getCurrentWorkflowStateFromDb(
     .from(workflowTable)
     .where(eq(workflowTable.id, workflowId))
     .limit(1)
-  if (!workflowRecord) throw new Error(`Workflow ${workflowId} not found in database`)
+  if (!workflowRecord)
+    throw new OrchestrationError('not_found', `Workflow ${workflowId} not found in database`)
   const normalized = await loadWorkflowFromNormalizedTables(workflowId)
   if (!normalized) throw new Error('Workflow has no normalized data')
 
@@ -112,7 +114,16 @@ export const editWorkflowServerTool: BaseServerTool<EditWorkflowParams, unknown>
       action: 'write',
     })
     if (!authorization.allowed) {
-      throw new Error(authorization.message || 'Unauthorized workflow access')
+      // Classified, not a bare Error: the copilot error projection passes a
+      // classified message through to the model verbatim, while an
+      // unclassified throw collapses into "system error, please retry" —
+      // which invites blind retries of a call that can never succeed.
+      throw new OrchestrationError(
+        authorization.status === 404 ? 'not_found' : 'forbidden',
+        authorization.status === 404
+          ? `Workflow not found: ${workflowId}. Pass the workflow's canonical id (copy it from workflows/**/meta.json or the tool result that created it) — a workflow name or @-mention is not an id.`
+          : authorization.message || 'Unauthorized workflow access'
+      )
     }
 
     await assertWorkflowMutable(workflowId)