improvement(execute): reuse the resolved workspace access and dedupe export failures

[waleedlatif1]

Summary

• Route the remaining sandbox-export failure responses through the existing exportFailure helper so the two export helpers build their bodies one way instead of two — body and status unchanged in every case
• Pass the already-resolved workspace access into the workspace file writer from the two copilot callers that were discarding it, removing a redundant permission lookup per write

Type of Change

• Improvement

Testing

Type-check, lint, and the API validation audit pass. 1310 tests pass across the touched areas.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 8:49pm

[cursor]

PR Summary

Low Risk
Refactoring and passing pre-resolved workspace access; the execute route change only tightens denial for non-existent workspaces alongside existing access checks.

Overview
Sandbox export error paths in the function execute route now return through exportFailure instead of hand-built NextResponse.json blocks, so single- and multi-file export helpers share one failure shape without changing status codes or response bodies.

The execute handler also denies function runs when the body workspaceId refers to a missing workspace or the caller lacks access (!exists || !hasAccess), not only when access is false.

Copilot create_file and download_to_workspace_file keep the WorkspaceAccess from ensureWorkspaceAccess and pass it into writeWorkspaceFileByPath, avoiding a second permission lookup on each write.

^{Reviewed by Cursor Bugbot for commit e78cdff. Configure here.}

[greptile-apps]

Greptile Summary

The PR consolidates sandbox-export error responses, rejects nonexistent workspaces during execution authorization, and avoids a redundant permission lookup for immediate copilot file creation. The follow-up revision preserves a fresh write-time authorization check after long-running downloads.

• Routes sandbox-export failures through the shared exportFailure helper.
• Reuses resolved workspace access when creating a file without an intervening asynchronous operation.
• Re-resolves workspace access after downloading remote content so mid-download revocation blocks the write.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/api/function/execute/route.ts	Consolidates export failure construction and explicitly denies execution when the requested workspace does not exist.
apps/sim/lib/copilot/tools/server/files/create-file.ts	Passes freshly resolved workspace access directly to the file writer with no asynchronous authorization gap.
apps/sim/lib/copilot/tools/server/files/download-to-workspace-file.ts	Fixes the prior stale-authorization issue by withholding pre-download access from the writer, forcing permission revalidation after the download.

_{Reviews (2): Last reviewed commit: "fix(copilot): re-resolve workspace acces..." | Re-trigger Greptile}

[waleedlatif1]

@greptile