fix(knowledge): validate tag slots and share the tag-name length limit

[waleedlatif1]

Summary

• Validate the tag slot on write. It reached the DB unchecked: the contract types it as a plain string, the column is text (its Drizzle enum is types-only, so there is no DB constraint), and the service casts before inserting — so an unknown slot inserted a row nothing can ever read
• The create route checks the slot against its declared field type via the existing isValidSlotForFieldType, which also rejects a slot/field-type mismatch
• The bulk document route checks slot validity only. That route also renames existing definitions, which resend whatever pair is already stored, so a row that already holds a mismatched pair stays fixable
• Promote the tag display-name cap to a shared constant and apply it on every write path: both contracts, both modals, and the copilot create/update tools, whose names are model-generated and bypassed the contract entirely
• Drop two local copies of FIELD_TYPE_LABELS in favour of the shared one that two other components already import

Notes

• The cap was already 100 on the bulk document route; this shares that number rather than inventing one. The internal create route previously had no cap, so a >100-char name posted there now returns 400
• No new helper — the slot checks reuse isValidSlotForFieldType / getFieldTypeForSlot from lib/knowledge/constants
• Supersedes fix(knowledge): validate tag slots and share the tag-name length limit #6438, which was comment-only

Type of Change

• Bug fix

Testing

Added route tests for an unknown slot, a slot/field-type mismatch, an unsupported field type, and the display-name cap; verified each fails without its guard. app/api/knowledge, tools, copilot-knowledge, webhooks, and inbox suites pass; type-check, lint:check, and check:api-validation:strict clean.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 8:56pm

[cursor]

PR Summary

Low Risk
Additive validation and input limits on knowledge tag metadata writes; no auth or core data-model changes. Slightly stricter create API behavior for overlong names is intentional.

Overview
Adds defense-in-depth validation so invalid tag slots and oversized display names cannot reach the DB on paths where contracts only accept plain strings and the slot column has no real enum constraint.

Tag slot checks: The knowledge-base create route now rejects unknown slots and slot/field-type mismatches via isValidSlotForFieldType. The bulk document tag-definitions route validates that each slot is known (getFieldTypeForSlot) but does not require slot/field-type agreement, so renames can resend existing stored pairs.

Display name cap: Introduces shared KNOWLEDGE_TAG_DISPLAY_NAME_MAX_LENGTH (100) and applies it on Zod contracts, both tag modals (maxLength on inputs), and copilot create_tag / update_tag (model-generated names that bypass contracts). The create API previously had no max length there; over-100 names now return 400.

Cleanup: document-tags-modal and base-tags-modal import shared FIELD_TYPE_LABELS instead of local duplicates. Route tests cover invalid slot, mismatch, bad field type, and length.

^{Reviewed by Cursor Bugbot for commit 1ca4b55. Configure here.}

[greptile-apps]

Greptile Summary

The PR prevents invalid knowledge-tag slots and overlength display names from reaching persistence while consolidating shared tag metadata.

• Validates slot/type compatibility on direct tag creation and slot existence on document-level bulk writes.
• Shares the 100-character display-name limit across API contracts, workspace forms, and copilot write operations.
• Reuses centralized field-type labels and adds focused route validation tests.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified.

The new guards consistently reject invalid slot data and overlength display names before persistence, and the shared constants introduce no import cycle or conflicting validation behavior.

Important Files Changed

Filename	Overview
apps/sim/app/api/knowledge/[id]/documents/[documentId]/tag-definitions/route.ts	Adds slot-existence validation while intentionally preserving legacy slot/type pairs during rename operations.
apps/sim/app/api/knowledge/[id]/tag-definitions/route.ts	Replaces field-type-only validation with validation of the complete slot/type pairing before persistence.
apps/sim/lib/api/contracts/knowledge/tags.ts	Applies the shared 100-character display-name limit consistently to both tag-definition request schemas.
apps/sim/lib/copilot/tools/server/knowledge/knowledge-base.ts	Rejects overlength model-generated tag names before direct service writes that bypass HTTP contracts.
apps/sim/lib/knowledge/constants.ts	Introduces the shared tag display-name limit alongside existing centralized tag configuration.
apps/sim/app/api/knowledge/[id]/tag-definitions/route.test.ts	Covers unknown slots, mismatched slot/type pairs, unsupported field types, and overlength names.

_{Reviews (1): Last reviewed commit: "fix(knowledge): validate tag slots and s..." | Re-trigger Greptile}