fix(hex): guard JSON.parse on user-supplied array/object params

Wrap JSON.parse calls for memberUserIds, addUserIds, removeUserIds,
inputParams, and notifications in try/catch so malformed input throws
a clear error instead of an opaque parse exception.

Author: waleedlatif1

apps/sim/tools/hex/create_group.ts

@@ -39,11 +39,16 @@ export const createGroupTool: ToolConfig<HexCreateGroupParams, HexCreateGroupRes
     body: (params) => {
       const body: Record<string, unknown> = { name: params.name }
       if (params.memberUserIds) {
-        const userIds =
-          typeof params.memberUserIds === 'string'
-            ? JSON.parse(params.memberUserIds)
-            : params.memberUserIds
-        body.members = { users: (userIds as string[]).map((id) => ({ id })) }
+        let userIds: string[]
+        try {
+          userIds =
+            typeof params.memberUserIds === 'string'
+              ? JSON.parse(params.memberUserIds)
+              : (params.memberUserIds as string[])
+        } catch {
+          throw new Error('memberUserIds must be a valid JSON array of user UUID strings')
+        }
+        body.members = { users: userIds.map((id) => ({ id })) }
       }
       return body
     },

apps/sim/tools/hex/run_project.ts

@@ -78,10 +78,14 @@ export const runProjectTool: ToolConfig<HexRunProjectParams, HexRunProjectRespon
       const body: Record<string, unknown> = {}
 
       if (params.inputParams) {
-        body.inputParams =
-          typeof params.inputParams === 'string'
-            ? JSON.parse(params.inputParams)
-            : params.inputParams
+        try {
+          body.inputParams =
+            typeof params.inputParams === 'string'
+              ? JSON.parse(params.inputParams)
+              : params.inputParams
+        } catch {
+          throw new Error('inputParams must be valid JSON')
+        }
       }
       if (params.dryRun !== undefined) body.dryRun = params.dryRun
       if (params.updateCache !== undefined) body.updateCache = params.updateCache
@@ -91,10 +95,14 @@ export const runProjectTool: ToolConfig<HexRunProjectParams, HexRunProjectRespon
         body.useCachedSqlResults = params.useCachedSqlResults
       if (params.viewId) body.viewId = params.viewId
       if (params.notifications) {
-        body.notifications =
-          typeof params.notifications === 'string'
-            ? JSON.parse(params.notifications)
-            : params.notifications
+        try {
+          body.notifications =
+            typeof params.notifications === 'string'
+              ? JSON.parse(params.notifications)
+              : params.notifications
+        } catch {
+          throw new Error('notifications must be a valid JSON array')
+        }
       }
 
       return body

apps/sim/tools/hex/update_group.ts

@@ -51,8 +51,15 @@ export const updateGroupTool: ToolConfig<HexUpdateGroupParams, HexUpdateGroupRes
       const body: Record<string, unknown> = {}
       if (params.name) body.name = params.name
 
-      const parseIds = (value: unknown) =>
-        (typeof value === 'string' ? JSON.parse(value) : value) as string[]
+      const parseIds = (value: unknown): string[] => {
+        try {
+          return (typeof value === 'string' ? JSON.parse(value) : value) as string[]
+        } catch {
+          throw new Error(
+            'addUserIds/removeUserIds must be a valid JSON array of user UUID strings'
+          )
+        }
+      }
 
       if (params.addUserIds || params.removeUserIds) {
         const members: Record<string, unknown> = {}