fix(tools): check usage limits before running hosted-key tools via the API by waleedlatif1 · Pull Request #8602 · simstudioai/sim

waleedlatif1 · 2026-10-03T19:20:21Z

Summary

Check the workspace's usage limits before running a tool that would use a Sim-hosted key via POST /api/v2/tools/{toolId}/execute, using the same cached execution gate as workflow runs
Return 402 USAGE_LIMIT_EXCEEDED when the limit is exceeded, and document it in the OpenAPI spec

Type of Change

Bug fix

Testing

execute-tool.test.ts and the route test (new cases fail with the fix reverted)
bun run lint, bun run type-check, bun run check:audits, docs-manifest:check, block-registry check
test:scripts: generate-docs.test.ts times out locally, same on clean staging

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

…e API

vercel · 2026-10-03T19:20:27Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 3, 2026 8:18pm UTC

cubic-dev-ai

All reported issues were addressed across 7 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

greptile-apps · 2026-10-03T19:23:13Z

Confidence Score: 5/5

[Critical risk] Adds usage limit checks to the tool execution API.

The PR appears safe to merge; no new actionable issue or outstanding previous finding remains.

Summary

The PR checks workspace usage limits before direct API tool calls that would use a hosted key, returns a documented 402 response when admission is denied, and adds route and use-case tests. The latest changes align admission with the registry’s resolution of user-only environment references, including provider selection.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Authorized tool call] --> B[Resolve user-only references for admission]
  B --> C{Would the tool need an injected key?}
  C -- No --> E[Execute through registry]
  C -- Yes --> D{Usage limit exceeded?}
  D -- Yes --> F[Return 402]
  D -- No --> E
  E --> G[Meter successful hosted-key spend]

_{Reviews (5) · Last reviewed commit: "fix(tools): decide hosted-key admission ..."}

… reference

waleedlatif1 · 2026-10-03T19:28:55Z

@greptile

waleedlatif1 · 2026-10-03T19:28:56Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-03T19:29:01Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 7 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

…wn key

waleedlatif1 · 2026-10-03T19:42:15Z

@greptile

waleedlatif1 · 2026-10-03T19:42:16Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-03T19:42:23Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 7 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

waleedlatif1 · 2026-10-03T19:48:53Z

@greptile

waleedlatif1 · 2026-10-03T19:48:55Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-03T19:49:00Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 7 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

waleedlatif1 · 2026-10-03T20:18:59Z

@greptile

waleedlatif1 · 2026-10-03T20:19:01Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-03T20:19:06Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 7 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

fix(tools): check usage limits before running hosted-key tools via th…

1c9a6b1

…e API

vercel Bot deployed to Preview October 3, 2026 19:22 View deployment

cubic-dev-ai Bot reviewed Oct 3, 2026

View reviewed changes

Comment thread apps/docs/openapi-v2-resources.json Outdated

greptile-apps Bot reviewed Oct 3, 2026

View reviewed changes

Comment thread apps/sim/lib/tool-execution/application/execute-tool.ts Outdated

Comment thread apps/sim/lib/tool-execution/application/execute-tool.test.ts Outdated

fix(tools): gate hosted-key calls whose key is an unresolved variable…

45c027c

… reference

vercel Bot deployed to Preview October 3, 2026 19:30 View deployment

greptile-apps Bot reviewed Oct 3, 2026

View reviewed changes

Comment thread apps/sim/lib/tool-execution/application/execute-tool.ts Outdated

cubic-dev-ai Bot reviewed Oct 3, 2026

View reviewed changes

Comment thread apps/sim/lib/tool-execution/application/execute-tool.ts Outdated

fix(tools): exempt variable references that resolve to the caller's o…

b8aff28

…wn key

vercel Bot temporarily deployed to Preview October 3, 2026 19:41 Inactive

greptile-apps Bot reviewed Oct 3, 2026

View reviewed changes

Comment thread apps/sim/lib/tool-execution/application/execute-tool.ts Outdated

cubic-dev-ai Bot reviewed Oct 3, 2026

View reviewed changes

fix(tools): resolve the key reference with the registry's own resolver

57bf024

vercel Bot temporarily deployed to Preview October 3, 2026 19:48 Inactive

cubic-dev-ai Bot reviewed Oct 3, 2026

View reviewed changes

fix(tools): decide hosted-key admission on registry-resolved params

e9567b6

vercel Bot temporarily deployed to Preview October 3, 2026 20:18 Inactive

cubic-dev-ai Bot reviewed Oct 3, 2026

View reviewed changes

waleedlatif1 merged commit 4c6be10 into staging Oct 3, 2026
33 checks passed

waleedlatif1 deleted the fix/tool-execute-usage-gate branch October 3, 2026 21:16

waleedlatif1 mentioned this pull request Oct 3, 2026

v0.9.13: code hygiene, security hardening #8606

Merged

Conversation

waleedlatif1 commented Oct 3, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 3, 2026

Uh oh!

waleedlatif1 commented Oct 3, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 3, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Oct 3, 2026

Uh oh!

waleedlatif1 commented Oct 3, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 3, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 3, 2026

Uh oh!

waleedlatif1 commented Oct 3, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 3, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 3, 2026

Uh oh!

waleedlatif1 commented Oct 3, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 3, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Oct 3, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 3, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading