fix(mothership): clear errors and a working direct path for CLI version, function and grep commands

[waleedlatif1]

Summary

• Version path segments: GET/PATCH /api/v2/workflows/{id}/versions/{version} (and every other route using versionNumberPathSchema) answered a non-numeric segment such as latest or v2 with zod's Invalid input: expected number, received NaN, which names neither the parameter nor what it takes. The CLI validates flags locally but passes positionals straight through, so sim workflows versions get <id> latest surfaced that message verbatim. The shared path schema now says version must be a positive integer, the same wording the body schema already used.
• function_execute through POST /api/v2/tools/{id}/execute: a direct tool call has no workflow run, so there is no executor delegation origin, and the Function operation threw the raw Executor delegation origin is required (it is the one in-process operation whose error skips the identity-fault classifier). It now takes its authority from the authenticated caller the route already passes as callerPrincipal, the way the File operations do. A Mothership invocation is narrowed to the function-execution audience with bindCopilotWorkspaceOperation. Any other principal goes to the function-execution operation policy unchanged, and that policy still admits only delegated executor/Copilot principals, so personal API keys are still refused. Workflow runs and Copilot tool calls keep their existing branches.
• grep --scope knowledge: --in knowledge already redirected to semantic knowledge search, but --scope knowledge (or kb) only returned Unknown scope. Both selectors now share the same redirect.
• Exported TOOL_EXECUTION_DELEGATION_AUDIENCE to replace the inline 'sim:tool-execution' literal, so the Function operation can name the audience it rebinds from.

Investigated and left unchanged:

• tools get <id> answering Tool not found is intentional. A tool that no visible block exposes is a 404, not a 403, so its existence is not leaked.
• The withheld-result wording for run_code: run_code can run authenticated CLI scripts and network calls, and its handler explicitly says it is not a read-only sandbox. Keeping it out of the read-only set is correct.

Type of Change

• Bug fix

Testing

• New regression tests, each confirmed failing before its fix:
  • app/api/v2/workflows/[workflowId]/versions/[version]/route.test.ts (non-numeric version segment)
  • lib/internal/function/execute-direct-call.test.ts (direct calls through the real function-execution policy, only the sandbox stubbed: an admitted Mothership caller runs, a personal API key is still refused)
  • lib/mothership/agent-cli/engines/universal-grep.test.ts (--scope knowledge / kb)
• vitest suites run:
  • apps/sim: lib/api/contracts, lib/internal/function, lib/mothership/agent-cli, lib/tool-execution, lib/workflows/application, app/api/v2/tools, app/api/v2/workflows/.../versions, app/api/v2/files, tools/assistant-execution.test.ts
  • packages/sim-cli
• Gates: bun run lint, bun run type-check, bun run check:audits (58/58), docs-manifest:check, check-block-registry, root bun run test

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 7, 2026 8:05am UTC

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Fixes error messages and adds direct function execution path.

This PR appears safe to merge; no new actionable issues remain.

What we checked:

• Mock calls stay isolated: The shared Vitest config clears mock calls before every test. The refusal check does not see calls from the successful test.

Summary

This PR improves version errors, enables direct Function calls for admitted Mothership callers, and points knowledge grep requests toward semantic search.

• Invalid version segments now say version must be a positive integer.
• Direct Function calls use the caller’s existing authority. Personal API keys remain refused.
• Both knowledge selectors provide the same search guidance.
• The latest commit replaces mock-call tests with checks through the real Function authorization path. The earlier unnumbered testing finding is addressed.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Direct Function tool call] --> B[Bind caller to Function operation]
  B --> C[Real Function authorization]
  C -->|Admitted Copilot caller| D[Run sandbox request]
  C -->|Personal API key| E[Refuse before running code]

Loading

_{Reviews (2) · Last reviewed commit: "test(function): prove direct tool calls ..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}