fix(settings): tighten intent and execution boundaries

Author: waleedlatif1

.claude/rules/sim-settings-pages.md

@@ -104,10 +104,11 @@ Adding a new settings page:
 2. Render the component inside the shell's `effectiveSection` switch in
    `settings/[section]/settings.tsx`.
 3. Build the component body inside `<SettingsPanel>` — no shell, no title block.
-4. When the initial body depends on server data, export shared React Query options for both the
-   mounted consumer and the settings intent warmer. Warm only authorized destinations, preserve
-   the current section during the transition, and follow the failure-recovery rules in
-   `sim-react-performance.md`; never render temporary default data that will be replaced after load.
+4. When a real second consumer or server boundary needs it, extract client-safe React Query options;
+   otherwise keep them with the hook. Approved intent warmers reuse those exact options and must keep
+   `check-tool-registry-boundary` green. Warm only authorized destinations, preserve the current
+   section during the transition, and follow `sim-react-performance.md` recovery rules; never render
+   temporary default data that will be replaced after load.
 
 ## Text-scale tokens (no literal pixel sizes)
 

apps/sim/app/workspace/[workspaceId]/settings/components/settings-empty-state/settings-empty-state.tsx

@@ -45,7 +45,6 @@ export function SettingsEmptyState({
   )
 }
 
-/** Canonical recoverable error state for settings queries. */
 export function SettingsQueryErrorState({
   error,
   fallback,

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/hooks/use-workflow-execution.test.tsx

@@ -417,6 +417,7 @@ describe('useWorkflowExecution cancellation', () => {
 describe('useWorkflowExecution attachment uploads', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockEndScopedExecution.mockReset().mockReturnValue(true)
     terminalStoreState._hasHydrated = false
     executionStoreState.workflowExecutions.set('workflow-1', idleExecution)
     executionStoreState.getWorkflowExecution.mockReturnValue(idleExecution)
@@ -562,18 +563,23 @@ describe('useWorkflowExecution attachment uploads', () => {
   it('does not let an overlapping run without lifecycle ownership end the active run', async () => {
     const persistenceExecution = {}
     let resolveActiveRun: (() => void) | undefined
+    let markExecutionStarted: (() => void) | undefined
+    const executionStarted = new Promise<void>((resolve) => {
+      markExecutionStarted = resolve
+    })
     mockBeginScopedExecution.mockReturnValueOnce(persistenceExecution)
-    mockExecute.mockImplementationOnce(
-      () =>
-        new Promise<void>((resolve) => {
-          resolveActiveRun = resolve
-        })
-    )
+    mockExecute.mockImplementationOnce(() => {
+      markExecutionStarted?.()
+      return new Promise<void>((resolve) => {
+        resolveActiveRun = resolve
+      })
+    })
     const { result, unmount } = renderWorkflowExecutionHook()
 
     let activeRun: unknown
     await act(async () => {
       activeRun = await result().handleRunWorkflow({ input: 'active run' })
+      await executionStarted
     })
 
     executionStoreState.getWorkflowExecution.mockReturnValue({
@@ -586,7 +592,11 @@ describe('useWorkflowExecution attachment uploads', () => {
     })
 
     expect(mockBeginScopedExecution).toHaveBeenCalledTimes(1)
+    expect(mockExecute).toHaveBeenCalledTimes(1)
     expect(mockEndScopedExecution).not.toHaveBeenCalled()
+    expect(executionStoreState.setCurrentExecutionId).not.toHaveBeenCalled()
+    expect(executionStoreState.setIsDebugging).not.toHaveBeenCalled()
+    expect(executionStoreState.setActiveBlocks).not.toHaveBeenCalled()
 
     await act(async () => {
       resolveActiveRun?.()
@@ -599,6 +609,35 @@ describe('useWorkflowExecution attachment uploads', () => {
     unmount()
   })
 
+  it('rejects overlapping block runs before starting another execution', async () => {
+    executionStoreState.getWorkflowExecution.mockReturnValue({
+      ...idleExecution,
+      isExecuting: true,
+    })
+    const startCandidate = {
+      blockId: 'start',
+      block: workflowBlocks.start,
+      path: 'legacy-starter',
+    }
+    mockResolveStartCandidates.mockReturnValue([startCandidate])
+
+    const { result, unmount } = renderWorkflowExecutionHook()
+
+    await act(async () => {
+      await result().handleRunUntilBlock('start', 'workflow-1')
+      await result().handleRunFromBlock('start', 'workflow-1')
+    })
+
+    expect(mockBeginScopedExecution).not.toHaveBeenCalled()
+    expect(mockExecute).not.toHaveBeenCalled()
+    expect(mockExecuteFromBlock).not.toHaveBeenCalled()
+    expect(executionStoreState.setCurrentExecutionId).not.toHaveBeenCalled()
+    expect(executionStoreState.setIsDebugging).not.toHaveBeenCalled()
+    expect(executionStoreState.setActiveBlocks).not.toHaveBeenCalled()
+
+    unmount()
+  })
+
   it('adopts and finishes persistence ownership created before the hook mounted', async () => {
     const persistenceExecution = {}
     terminalStoreState._hasHydrated = true

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/hooks/use-workflow-execution.ts

@@ -443,7 +443,7 @@ export function useWorkflowExecution() {
   const getCurrentExecutionId = useExecutionStore((s) => s.getCurrentExecutionId)
   const rawSetIsExecuting = useExecutionStore((s) => s.setIsExecuting)
 
-  const startExecution = useCallback(
+  const tryStartExecution = useCallback(
     (workflowId: string): ConsolePersistenceExecution | undefined => {
       const wasExecuting = useExecutionStore.getState().getWorkflowExecution(workflowId).isExecuting
       if (wasExecuting) return undefined
@@ -753,9 +753,11 @@ export function useWorkflowExecution() {
         return
       }
 
+      const persistenceExecution = tryStartExecution(activeWorkflowId)
+      if (!persistenceExecution) return
+
       // Reset execution result and set execution state
       setExecutionResult(null)
-      const persistenceExecution = startExecution(activeWorkflowId)
 
       // Set debug mode only if explicitly requested
       if (enableDebug) {
@@ -1060,7 +1062,7 @@ export function useWorkflowExecution() {
       currentWorkflow,
       toggleConsole,
       getVariablesByWorkflowId,
-      startExecution,
+      tryStartExecution,
       finishOwnedExecution,
       setIsDebugging,
       setDebugContext,
@@ -2079,7 +2081,9 @@ export function useWorkflowExecution() {
         }
       }
 
-      const persistenceExecution = startExecution(workflowId)
+      const persistenceExecution = tryStartExecution(workflowId)
+      if (!persistenceExecution) return
+
       const runOwnerId = generateId()
       runFromBlockOwnerRef.current = runOwnerId
       const executionIdRef = { current: '' }
@@ -2330,7 +2334,7 @@ export function useWorkflowExecution() {
       clearLastExecutionSnapshot,
       getCurrentExecutionId,
       setCurrentExecutionId,
-      startExecution,
+      tryStartExecution,
       finishOwnedExecution,
       setActiveBlocks,
       setBlockRunStatus,
@@ -2356,10 +2360,11 @@ export function useWorkflowExecution() {
         return
       }
 
-      logger.info('Starting run-until-block execution', { workflowId, stopAfterBlockId: blockId })
+      const persistenceExecution = tryStartExecution(workflowId)
+      if (!persistenceExecution) return
 
+      logger.info('Starting run-until-block execution', { workflowId, stopAfterBlockId: blockId })
       setExecutionResult(null)
-      const persistenceExecution = startExecution(workflowId)
 
       const executionId = generateId()
       try {
@@ -2378,7 +2383,7 @@ export function useWorkflowExecution() {
         return errorResult
       }
     },
-    [activeWorkflowId, setExecutionResult, startExecution]
+    [activeWorkflowId, setExecutionResult, tryStartExecution]
   )
 
   useEffect(() => {
@@ -2543,7 +2548,7 @@ export function useWorkflowExecution() {
           activated = true
           setCurrentExecutionId(reconnectWorkflowId, capturedExecutionId)
           reconnectPersistenceExecution =
-            startExecution(reconnectWorkflowId) ??
+            tryStartExecution(reconnectWorkflowId) ??
             consolePersistence.adoptScopedExecution(reconnectWorkflowId)
           activationOwnsPersistence = Boolean(reconnectPersistenceExecution)
           if (fromEventId === 0) {

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-query-warmers.test.ts

@@ -13,7 +13,6 @@ vi.mock('@/lib/api/client/request', () => ({
 }))
 
 import { warmSettingsSectionQuery } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-query-warmers'
-import { apiKeysQueryOptions } from '@/hooks/queries/api-key-list'
 import { workspaceCredentialListQueryOptions } from '@/hooks/queries/utils/fetch-workspace-credentials'
 
 let queryClient: QueryClient
@@ -25,16 +24,16 @@ describe('settings query warmers', () => {
       defaultOptions: { queries: { retry: false, retryOnMount: false } },
     })
     mockRequestJson.mockImplementation((contract: { path: string }) => {
-      if (contract.path === '/api/mcp/servers' || contract.path === '/api/mcp/workflow-servers') {
-        return Promise.resolve({ data: { servers: [] } })
-      }
-      if (contract.path === '/api/workspaces/[id]/sandboxes') {
-        return Promise.resolve({ sandboxes: [], entitled: true, strategy: 'prebuilt' })
-      }
       if (contract.path === '/api/credentials') {
         return Promise.resolve({ credentials: [] })
       }
-      return Promise.resolve({ keys: [] })
+      if (
+        contract.path === '/api/billing' ||
+        contract.path === '/api/organizations/[id]/billing-summary'
+      ) {
+        return Promise.resolve({})
+      }
+      throw new Error(`Unexpected settings warmer contract: ${contract.path}`)
     })
   })
 
@@ -43,28 +42,11 @@ describe('settings query warmers', () => {
     vi.clearAllMocks()
   })
 
-  it('warms only the approved first-content list for each section', async () => {
-    expect(warmSettingsSectionQuery(queryClient, personalContext, 'apikeys')).toBe(true)
-    expect(warmSettingsSectionQuery(queryClient, personalContext, 'sandboxes')).toBe(true)
-    expect(warmSettingsSectionQuery(queryClient, personalContext, 'byok')).toBe(true)
-    expect(warmSettingsSectionQuery(queryClient, personalContext, 'mcp')).toBe(true)
+  it('warms only first-content data already present in the shared sidebar graph', async () => {
     expect(warmSettingsSectionQuery(queryClient, personalContext, 'secrets')).toBe(true)
-    expect(warmSettingsSectionQuery(queryClient, personalContext, 'workflow-mcp-servers')).toBe(
-      true
-    )
 
-    await vi.waitFor(() => expect(mockRequestJson).toHaveBeenCalledTimes(7))
-    expect(mockRequestJson.mock.calls.map(([contract]) => contract.path)).toEqual(
-      expect.arrayContaining([
-        '/api/workspaces/[id]/api-keys',
-        '/api/users/me/api-keys',
-        '/api/workspaces/[id]/sandboxes',
-        '/api/workspaces/[id]/byok-keys',
-        '/api/mcp/servers',
-        '/api/mcp/workflow-servers',
-        '/api/credentials',
-      ])
-    )
+    await vi.waitFor(() => expect(mockRequestJson).toHaveBeenCalledTimes(1))
+    expect(mockRequestJson.mock.calls[0][0].path).toBe('/api/credentials')
     expect(
       mockRequestJson.mock.calls.find(([contract]) => contract.path === '/api/credentials')?.[1]
     ).toEqual(
@@ -73,6 +55,13 @@ describe('settings query warmers', () => {
   })
 
   it('does not warm broad settings data', () => {
+    expect(warmSettingsSectionQuery(queryClient, personalContext, 'apikeys')).toBe(false)
+    expect(warmSettingsSectionQuery(queryClient, personalContext, 'sandboxes')).toBe(false)
+    expect(warmSettingsSectionQuery(queryClient, personalContext, 'byok')).toBe(false)
+    expect(warmSettingsSectionQuery(queryClient, personalContext, 'mcp')).toBe(false)
+    expect(warmSettingsSectionQuery(queryClient, personalContext, 'workflow-mcp-servers')).toBe(
+      false
+    )
     expect(warmSettingsSectionQuery(queryClient, personalContext, 'custom-tools')).toBe(false)
 
     expect(mockRequestJson).not.toHaveBeenCalled()
@@ -100,15 +89,6 @@ describe('settings query warmers', () => {
     )
   })
 
-  it('deduplicates a successful API-key warm with the eventual consumer', async () => {
-    warmSettingsSectionQuery(queryClient, personalContext, 'apikeys')
-    await vi.waitFor(() => expect(mockRequestJson).toHaveBeenCalledTimes(2))
-
-    await queryClient.fetchQuery(apiKeysQueryOptions('workspace-1', 'combined'))
-
-    expect(mockRequestJson).toHaveBeenCalledTimes(2)
-  })
-
   it('keeps the Secrets warmer and consumer on mount-recoverable shared options', () => {
     const options = workspaceCredentialListQueryOptions('workspace-1', 'env_workspace')
 

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-query-warmers.ts

@@ -1,14 +1,9 @@
 import type { QueryClient } from '@tanstack/react-query'
 import type { SettingsSection } from '@/app/workspace/[workspaceId]/settings/navigation'
-import { apiKeysQueryOptions } from '@/hooks/queries/api-key-list'
-import { byokKeysQueryOptions } from '@/hooks/queries/byok-key-list'
-import { mcpServersQueryOptions } from '@/hooks/queries/mcp-server-list'
 import { organizationBillingSummaryOptions } from '@/hooks/queries/organization-billing-summary'
-import { getSandboxListQueryOptions } from '@/hooks/queries/sandbox-list'
 import { subscriptionDataQueryOptions } from '@/hooks/queries/subscription-data'
 import { workspaceCredentialListQueryOptions } from '@/hooks/queries/utils/fetch-workspace-credentials'
 import { prefetchQueryOnIntent } from '@/hooks/queries/utils/prefetch-query-on-intent'
-import { workflowMcpServersQueryOptions } from '@/hooks/queries/workflow-mcp-server-list'
 
 const SETTINGS_QUERY_WARMERS: Partial<
   Record<SettingsSection, (queryClient: QueryClient, context: SettingsQueryWarmContext) => void>
@@ -18,16 +13,6 @@ const SETTINGS_QUERY_WARMERS: Partial<
       queryClient,
       workspaceCredentialListQueryOptions(workspaceId, 'env_workspace')
     ),
-  apikeys: (queryClient, { workspaceId }) =>
-    prefetchQueryOnIntent(queryClient, apiKeysQueryOptions(workspaceId, 'combined')),
-  sandboxes: (queryClient, { workspaceId }) =>
-    prefetchQueryOnIntent(queryClient, getSandboxListQueryOptions(workspaceId)),
-  byok: (queryClient, { workspaceId }) =>
-    prefetchQueryOnIntent(queryClient, byokKeysQueryOptions(workspaceId)),
-  mcp: (queryClient, { workspaceId }) =>
-    prefetchQueryOnIntent(queryClient, mcpServersQueryOptions(workspaceId)),
-  'workflow-mcp-servers': (queryClient, { workspaceId }) =>
-    prefetchQueryOnIntent(queryClient, workflowMcpServersQueryOptions(workspaceId)),
   billing: (queryClient, { billingOrganizationId }) => {
     if (billingOrganizationId) {
       prefetchQueryOnIntent(queryClient, organizationBillingSummaryOptions(billingOrganizationId))
@@ -42,7 +27,7 @@ export interface SettingsQueryWarmContext {
   billingOrganizationId: string | null
 }
 
-/** Starts only the first-content query explicitly approved for a settings section. */
+/** Starts approved first-content data within the workspace graph's enforced module budget. */
 export function warmSettingsSectionQuery(
   queryClient: QueryClient,
   context: SettingsQueryWarmContext,