fix(mothership): refuse callerless service writes and organization-scoped CLI writes

Mixed server tools reached through sim_cli services (settings, dashboards,
tests, search_sources, workspaces) write through internal operations that
declare no API scope, so the read grant never bound them. Each tool now
declares which validated arguments write, and the router holds those to
the current delegated grant.

The grant also applies to callerless organization-scoped runs.

Author: waleedlatif1

apps/sim/lib/core/application/oauth-authorization.ts

@@ -41,6 +41,15 @@ export function requireOAuthOperationScope(
   }
 }
 
+/**
+ * Holds a change no scoped operation guards — an internal operation, or one authorized outside the
+ * operation layer — to the current {@link withDelegatedApiScopes} grant. Outside a grant it allows.
+ */
+export function requireDelegatedApiScope(scope: OAuthApiScope): void {
+  const granted = delegatedApiScopes()
+  if (granted && !oauthScopeSatisfies(granted, scope)) throw new InsufficientScopeError(scope)
+}
+
 function grantedApiScopes(principal: Principal): readonly string[] | undefined {
   switch (principal.kind) {
     case 'oauth_access_token':

apps/sim/lib/mothership/agent-cli/index.ts

@@ -23,9 +23,9 @@ export async function executeAgentCliRequest(
   context: AgentCliExecutionContext
 ): Promise<AgentCliRawResult> {
   const execute = () => executeUncountedAgentCliRequest(request, context)
-  // Commands authorize the subject's live role; a callerless run's subject is the workspace owner.
+  // Commands authorize the subject's live role; a callerless inbox run's subject is the owner.
   const { result, withheld } = await countWithheldContent(() =>
-    context.secretActorUserId === null && !context.organizationId
+    context.secretActorUserId === null
       ? withDelegatedApiScopes([OAUTH_API_READ_SCOPE], execute)
       : execute()
   )

apps/sim/lib/mothership/agent-cli/project-file-read.integration.ts

@@ -350,6 +350,48 @@ check('sim_cli for a callerless run holds only the read API scopes', async () =>
   expect(await projectFiles()).toHaveLength(1)
 })
 
+check('sim_cli services for a callerless run refuse the writes they route', async () => {
+  const f = await fixture()
+  const service = (name: string, input: Record<string, unknown>, context: ToolExecutionContext) =>
+    executeSimCli({ request: { invocation: { kind: 'service', name, input } } }, context)
+  const inboxSecretScope = async () =>
+    (
+      await db
+        .select({ scope: workspace.inboxSecretScope })
+        .from(workspace)
+        .where(eq(workspace.id, f.workspaceId))
+    )[0]?.scope
+  const before = await inboxSecretScope()
+  const widen = before === 'all' ? 'selected' : 'all'
+  const writes: Array<[string, Record<string, unknown>]> = [
+    [
+      'settings',
+      { scope: 'workspace', action: 'update', section: 'inbox', changes: { secretScope: widen } },
+    ],
+  ]
+
+  const callerless: ToolExecutionContext = { ...f.context, workflowId: '', secretActorUserId: null }
+  for (const [name, input] of writes) {
+    const refused = await service(name, input, callerless)
+    expect(refused.success).toBe(false)
+    expect(refused.error).toContain('api:write')
+  }
+  expect(await inboxSecretScope()).toBe(before)
+  const read = await service(
+    'settings',
+    { scope: 'workspace', action: 'get', section: 'inbox' },
+    callerless
+  )
+  expect(read.success, read.error).toBe(true)
+
+  const attributed: ToolExecutionContext = { ...f.context, workflowId: '', userPermission: 'admin' }
+  for (const [name, input] of writes) {
+    const written = await service(name, input, attributed)
+    expect(written.success, `${name}: ${written.error}`).toBe(true)
+  }
+  expect(await inboxSecretScope()).toBe(widen)
+})
+
 check('sim_cli for a read-only member keeps what that role allows', async () => {
   const f = await fixture()
   const memberId = await insertUser('Read member')

apps/sim/lib/mothership/tools/server/base-tool.ts

@@ -68,4 +68,6 @@ export interface BaseServerTool<TArgs = unknown, TResult = unknown> {
   inputSchema?: z.ZodType<TArgs>
   /** Optional Zod schema for output validation */
   outputSchema?: z.ZodType<TResult>
+  /** Whether these validated arguments change stored data; a delegated read grant refuses them. */
+  writes?(args: TArgs): boolean
 }

apps/sim/lib/mothership/tools/server/dashboards.ts

@@ -24,6 +24,7 @@ function workspaceFor(input: { workspaceId?: string }, context?: ServerToolConte
 export const dashboardsServerTool: BaseServerTool = {
   name: 'dashboards',
   inputSchema: mothershipDashboardsInputSchema,
+  writes: (args) => mothershipDashboardsInputSchema.parse(args).action === 'set',
   async execute(raw, context) {
     const input = mothershipDashboardsInputSchema.parse(raw)
     const workspaceId = workspaceFor(input, context)

apps/sim/lib/mothership/tools/server/router.ts

@@ -2,6 +2,8 @@ import { createLogger } from '@sim/logger'
 import { isRecordLike } from '@sim/utils/object'
 import { z } from 'zod'
 import { getValidationErrorMessage, isZodError } from '@/lib/api/server/validation'
+import { OAUTH_API_WRITE_SCOPE } from '@/lib/auth/oauth-provider'
+import { requireDelegatedApiScope } from '@/lib/core/application/oauth-authorization'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   Ffmpeg,
@@ -156,6 +158,7 @@ export async function routeExecution(
   }
 
   assertServerToolNotAborted(context, `User stop signal aborted ${toolName} after validation`)
+  if (tool.writes?.(args)) requireDelegatedApiScope(OAUTH_API_WRITE_SCOPE)
 
   // Execute. None of the remaining tools resolve blocks or gate discovery, so the old
   // custom-block-overlay / block-visibility ALS scopes are gone with the tools that

apps/sim/lib/mothership/tools/server/search-sources.ts

@@ -33,6 +33,7 @@ export const organizationSearchSourcesServerTool: BaseServerTool<
   name: 'search_sources',
   inputSchema: organizationSearchSourcesInputSchema,
   outputSchema: organizationSearchSourcesOutputSchema,
+  writes: (args) => args.action === 'approve',
   async execute(args, context) {
     if (context?.requestMode !== 'agent' && context?.requestMode !== 'plan')
       throw new OrchestrationError('forbidden', 'Search source controls require Mothership')

apps/sim/lib/mothership/tools/server/settings.ts

@@ -356,6 +356,10 @@ function settingsRefresh(context: SettingsContext, section: string): ResourceCha
 export const settingsServerTool: BaseServerTool<MothershipSettingsInput> = {
   name: 'settings',
   inputSchema: mothershipSettingsInputSchema,
+  writes: (input) =>
+    input.action === 'update' ||
+    (input.action === 'execute' &&
+      settingsOperations[`${input.scope}/${input.section}`]?.[input.operation]?.effect === 'write'),
   async execute(raw, context) {
     const input = mothershipSettingsInputSchema.parse(raw)
     const target = await resolveSettingsContext(input.scope, context, input.workspaceId)

apps/sim/lib/mothership/tools/server/tests.ts

@@ -46,9 +46,12 @@ function failures(report: TestReport | null) {
     })
 }
 
+const TEST_READ_ACTIONS = new Set(['list', 'get'])
+
 export const testsServerTool: BaseServerTool = {
   name: 'tests',
   inputSchema: mothershipTestsInputSchema,
+  writes: (args) => !TEST_READ_ACTIONS.has(mothershipTestsInputSchema.parse(args).action),
   async execute(raw, context) {
     const input = mothershipTestsInputSchema.parse(raw)
     const workspaceId = workspaceFor(input, context)

apps/sim/lib/mothership/tools/server/workspaces.ts

@@ -8,6 +8,7 @@ import { createOrganizationWorkspace } from '@/lib/workspaces/application/create
 export const workspacesServerTool: BaseServerTool = {
   name: 'workspaces',
   inputSchema: mothershipWorkspacesInputSchema,
+  writes: () => true,
   async execute(raw, context) {
     try {
       const { action: _action, ...input } = mothershipWorkspacesInputSchema.parse(raw)