refactor(copilot): align manage_sandbox handler with the manage_* family

- Gate writes with copilotToolCanAdmin(context.userPermission), the admin
  sibling of the copilotToolCanWrite helper manage_custom_tool and manage_skill
  already use, instead of a second DB permission read. The tool now declares
  RequiredPermission "write", so the executor has already resolved the caller's
  permission by the time the handler runs.
- Trim comments that restated the code, per the family's near-zero density.

Author: waleedlatif1

apps/sim/app/api/workspaces/[id]/sandboxes/authorize.ts

@@ -17,10 +17,6 @@ export interface SandboxMutationActor {
 }
 
 /**
- * Maps a refused write onto the status code the editor expects. Shared by both
- * route files so the create path and the edit/delete path cannot describe the
- * same failure differently.
- *
  * `invalid_dependencies` carries a line number per rejected row, which the
  * generic validation error does not — the editor marks those inline.
  */

apps/sim/lib/copilot/generated/tool-catalog-v1.ts

@@ -3646,6 +3646,7 @@ export const ManageSandbox: ToolCatalogEntry = {
     },
     required: ['operation'],
   },
+  requiredPermission: 'write',
 }
 
 export const ManageScheduledTask: ToolCatalogEntry = {

apps/sim/lib/copilot/tools/handlers/management/manage-sandbox.test.ts

@@ -6,15 +6,13 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ExecutionContext } from '@/lib/copilot/request/types'
 
 const {
-  getUserEntityPermissionsMock,
   hasWorkspaceSandboxAccessMock,
   enforceWorkspaceRateLimitMock,
   createWorkspaceSandboxMock,
   updateWorkspaceSandboxMock,
   deleteWorkspaceSandboxMock,
   listWorkspaceSandboxesMock,
 } = vi.hoisted(() => ({
-  getUserEntityPermissionsMock: vi.fn(),
   hasWorkspaceSandboxAccessMock: vi.fn(),
   enforceWorkspaceRateLimitMock: vi.fn(),
   createWorkspaceSandboxMock: vi.fn(),
@@ -23,10 +21,6 @@ const {
   listWorkspaceSandboxesMock: vi.fn(),
 }))
 
-vi.mock('@/lib/workspaces/permissions/utils', () => ({
-  getUserEntityPermissions: getUserEntityPermissionsMock,
-}))
-
 vi.mock('@/lib/billing/core/subscription', () => ({
   hasWorkspaceSandboxAccess: hasWorkspaceSandboxAccessMock,
 }))
@@ -48,7 +42,12 @@ vi.mock('@/lib/execution/remote-sandbox/workspace-sandboxes', () => ({
 
 import { executeManageSandbox } from '@/lib/copilot/tools/handlers/management/manage-sandbox'
 
-const context = { userId: 'user-1', workflowId: 'wf-1', workspaceId: 'ws-1' } as ExecutionContext
+const context = {
+  userId: 'user-1',
+  workflowId: 'wf-1',
+  workspaceId: 'ws-1',
+  userPermission: 'admin',
+} as ExecutionContext
 
 const sandbox = {
   id: 'sb-1',
@@ -67,7 +66,6 @@ const sandbox = {
 describe('manage_sandbox', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    getUserEntityPermissionsMock.mockResolvedValue('admin')
     hasWorkspaceSandboxAccessMock.mockResolvedValue(true)
     enforceWorkspaceRateLimitMock.mockResolvedValue(null)
     listWorkspaceSandboxesMock.mockResolvedValue([sandbox])
@@ -84,14 +82,14 @@ describe('manage_sandbox', () => {
 
   it('ignores a model-supplied workspaceId and uses the server context', async () => {
     await executeManageSandbox({ operation: 'list', workspaceId: 'other-ws' }, context)
-    expect(getUserEntityPermissionsMock).toHaveBeenCalledWith('user-1', 'workspace', 'ws-1')
     expect(listWorkspaceSandboxesMock).toHaveBeenCalledWith('ws-1')
   })
 
-  it('lists with only read access, and does not spend the mutation budget', async () => {
-    getUserEntityPermissionsMock.mockResolvedValue('read')
-
-    const result = await executeManageSandbox({ operation: 'list' }, context)
+  it('lists without spending the mutation budget or the plan check', async () => {
+    const result = await executeManageSandbox({ operation: 'list' }, {
+      ...context,
+      userPermission: 'write',
+    } as ExecutionContext)
     expect(result.success).toBe(true)
     expect(result.output).toMatchObject({ count: 1, strategy: 'prebuilt' })
     const [listed] = (result.output as { sandboxes: Record<string, unknown>[] }).sandboxes
@@ -102,11 +100,9 @@ describe('manage_sandbox', () => {
   })
 
   it.each(['add', 'edit', 'delete'])('requires workspace admin to %s', async (operation) => {
-    getUserEntityPermissionsMock.mockResolvedValue('write')
-
     const result = await executeManageSandbox(
       { operation, name: 'x', language: 'python', sandboxId: 'sb-1' },
-      context
+      { ...context, userPermission: 'write' } as ExecutionContext
     )
 
     expect(result.success).toBe(false)

apps/sim/lib/copilot/tools/handlers/management/manage-sandbox.ts

@@ -2,6 +2,7 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { hasWorkspaceSandboxAccess } from '@/lib/billing/core/subscription'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
+import { copilotToolCanAdmin } from '@/lib/copilot/tools/permissions'
 import { enforceWorkspaceRateLimit } from '@/lib/core/rate-limiter/route-helpers'
 import {
   isSandboxLanguage,
@@ -19,7 +20,6 @@ import {
   type SandboxWriteFailure,
   updateWorkspaceSandbox,
 } from '@/lib/execution/remote-sandbox/workspace-sandboxes'
-import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('CopilotToolExecutor')
 
@@ -69,7 +69,7 @@ function isStringArray(value: unknown): value is string[] {
 /**
  * Reproduces the REST routes' gate — workspace admin, plan entitlement, then the
  * shared mutation budget — so chat cannot create a sandbox the same user could
- * not create in Settings > Sandboxes. `list` needs only read, matching GET.
+ * not create in Settings > Sandboxes.
  */
 export async function executeManageSandbox(
   rawParams: Record<string, unknown>,
@@ -91,13 +91,8 @@ export async function executeManageSandbox(
   const isWrite = WRITE_OPERATIONS.includes(operation)
 
   try {
-    const permission = await getUserEntityPermissions(context.userId, 'workspace', workspaceId)
-    if (!permission) {
-      return { success: false, error: 'You do not have access to this workspace' }
-    }
-
     if (isWrite) {
-      if (permission !== 'admin') {
+      if (!copilotToolCanAdmin(context.userPermission)) {
         return { success: false, error: SANDBOX_ADMIN_REQUIRED }
       }
       if (!(await hasWorkspaceSandboxAccess(workspaceId))) {

apps/sim/lib/copilot/tools/permissions.ts

@@ -9,6 +9,14 @@ export function copilotToolCanWrite(userPermission: string | null | undefined):
   return permissionSatisfies((userPermission ?? null) as PermissionType | null, 'write')
 }
 
+/**
+ * Whether a copilot tool call may perform an admin-only action. Same fail-closed
+ * contract as {@link copilotToolCanWrite}.
+ */
+export function copilotToolCanAdmin(userPermission: string | null | undefined): boolean {
+  return permissionSatisfies((userPermission ?? null) as PermissionType | null, 'admin')
+}
+
 /** Renders the denial message shared by both copilot execution paths. */
 export function copilotWriteDeniedMessage(
   toolName: string,

apps/sim/lib/execution/remote-sandbox/workspace-sandboxes.test.ts

@@ -80,12 +80,6 @@ describe('workspace sandbox operations', () => {
       )
     })
 
-    /**
-     * The regression this guards: `nextName = name ?? existing.name` treated a
-     * whitespace-only name as "supplied", so it trimmed to empty, skipped the
-     * conflict pre-check (falsy), and wrote an unnamed sandbox the UI cannot
-     * create and the user cannot select.
-     */
     it('refuses a whitespace-only name on edit instead of writing it', async () => {
       queueTableRows(workspaceSandbox, [existingRow])
 

apps/sim/lib/execution/remote-sandbox/workspace-sandboxes.ts

@@ -228,7 +228,6 @@ function isSandboxNameConflictError(error: unknown): boolean {
   return message.includes(WORKSPACE_SANDBOX_NAME_INDEX) || message.includes('23505')
 }
 
-/** Why a write was refused, rendered by each caller for its own surface. */
 export type SandboxWriteFailure =
   | { code: 'invalid_name'; message: string }
   | { code: 'name_conflict'; name: string }
@@ -267,17 +266,15 @@ async function readBackOrFail(workspaceId: string, sandboxId: string): Promise<S
 
 export interface CreateWorkspaceSandboxParams {
   workspaceId: string
-  /** Attributed as `createdBy`; the caller has already authorized this actor. */
   userId: string
   name: string
   language: SandboxLanguage
-  /** Raw submitted lines — comments and blanks are stripped during validation. */
   dependencies: readonly string[]
 }
 
 /**
- * Creates a sandbox and enqueues its build. Authorization, entitlement, and rate
- * limiting are the caller's job — the route and the copilot tool differ there.
+ * Authorization, entitlement, and rate limiting are the caller's job — the route
+ * and the copilot tool differ there.
  */
 export async function createWorkspaceSandbox(
   params: CreateWorkspaceSandboxParams
@@ -328,8 +325,6 @@ export interface UpdateWorkspaceSandboxParams {
 }
 
 /**
- * Applies a partial edit and re-enqueues the build.
- *
  * The build is scheduled unconditionally, because the registry decides what a
  * save costs: a `ready` or in-flight row is left alone, so renaming or re-saving
  * an unchanged spec enqueues nothing, while a failed one gets the immediate
@@ -413,9 +408,9 @@ export async function updateWorkspaceSandbox(
 }
 
 /**
- * Deletes a sandbox and releases its build. A block may still reference it;
- * that execution fails closed naming the missing sandbox, rather than silently
- * falling back to an image without its dependencies.
+ * A block may still reference the deleted sandbox; that execution fails closed
+ * naming the missing sandbox, rather than silently falling back to an image
+ * without its dependencies.
  */
 export async function deleteWorkspaceSandbox(
   workspaceId: string,