fix(copilot): unify hosted-key strip resolution across top-level and nested blocks

Greptile flagged that the batch/snapshot state reconstruction was applied only to top-level blocks; nested loop/parallel children still used raw childInputs, so a same-batch provider/model change on a nested child followed by a type-less apiKey edit could leave the key. Route both paths through one collectForBlock helper keyed by the block's own id (incl. nested children), so they share batch accumulation + snapshot enrichment and can't drift. Test added for the nested same-batch case.

Author: TheodoreSpeaks

apps/sim/lib/copilot/tools/server/workflow/edit-workflow/validation.test.ts

@@ -561,6 +561,40 @@ describe('preValidateCredentialInputs (hosted-tool blocks)', () => {
     expect(result.errors[0]).toMatchObject({ blockId: 'custom-1', field: 'serviceKey' })
   })
 
+  it('uses same-batch state for nested children (provider set earlier, apiKey set later)', async () => {
+    const operations = [
+      {
+        operation_type: 'add' as const,
+        block_id: 'loop-1',
+        params: {
+          type: 'loop',
+          inputs: {},
+          nestedNodes: {
+            'video-child': { type: 'video_generator_v3', inputs: { provider: 'falai' } },
+          },
+        },
+      },
+      {
+        operation_type: 'edit' as const,
+        block_id: 'loop-1',
+        params: {
+          nestedNodes: {
+            'video-child': { type: 'video_generator_v3', inputs: { apiKey: 'test-key' } },
+          },
+        },
+      },
+    ]
+
+    const result = await preValidateCredentialInputs(operations, ctx)
+
+    const nested = result.filteredOperations[1]?.params?.nestedNodes as
+      | Record<string, { inputs?: Record<string, unknown> }>
+      | undefined
+    expect(nested?.['video-child']?.inputs?.apiKey).toBeUndefined()
+    expect(result.errors).toHaveLength(1)
+    expect(result.errors[0]).toMatchObject({ blockId: 'video-child', field: 'apiKey' })
+  })
+
   it('uses same-batch state: a type-less apiKey edit after an earlier op makes the block hosted', async () => {
     // op1 switches provider to falai (hosted); op2 (type-less) sets apiKey. op2 must see op1's
     // provider, not the stale snapshot (runway), and strip the key.

apps/sim/lib/copilot/tools/server/workflow/edit-workflow/validation.ts

@@ -1399,80 +1399,78 @@ export async function preValidateCredentialInputs(
   const batchBlockType = new Map<string, string | undefined>()
   const batchBlockValues = new Map<string, Record<string, unknown>>()
 
-  operations.forEach((op, opIndex) => {
-    const inputs = asRecord(op.params?.inputs)
-
-    // Effective block type: this op's type, else the type left by an earlier batch op, else the
+  // Resolve a single block (top-level or nested) against batch + snapshot state and run the
+  // collectors. `stateKey` keys the batch/snapshot lookup (the block's own id, including nested
+  // children); `reportBlockId`/`nestedBlockId` are how the strip surfaces it to the agent. Both
+  // paths route through here so they can't drift (the source of the earlier nested-vs-main gap).
+  const collectForBlock = (
+    opIndex: number,
+    stateKey: string,
+    reportBlockId: string,
+    rawType: string | undefined,
+    inputs: Record<string, unknown> | undefined,
+    nestedBlockId?: string
+  ) => {
+    // Effective type: this op's type, else the type left by an earlier batch op, else the
     // snapshot. Edit ops omit `type`, so without this an apiKey-only edit would skip stripping.
-    const priorType = batchBlockType.has(op.block_id)
-      ? batchBlockType.get(op.block_id)
-      : (snapshotBlock(op.block_id)?.type as string | undefined)
-    const opBlockType = (op.params?.type as string | undefined) ?? priorType
-    batchBlockType.set(op.block_id, opBlockType)
-
-    // Process main block inputs
-    if (inputs && opBlockType) {
-      const blockConfig = getBlock(opBlockType)
-      if (blockConfig) {
-        collectCredentialInputs(blockConfig, inputs, opIndex, op.block_id, opBlockType)
-
-        // Both hosted collectors no-op off hosted Sim, so only reconstruct the effective inputs
-        // (prior batch/snapshot values overlaid with this op's delta) when it can matter.
-        if (isHosted) {
-          const priorValues =
-            batchBlockValues.get(op.block_id) ??
-            buildSubBlockValues(
-              (snapshotBlock(op.block_id)?.subBlocks as Record<string, { value?: unknown }>) ?? {}
-            )
-          const toolParams = { ...priorValues, ...inputs }
-          batchBlockValues.set(op.block_id, toolParams)
-          const modelValue = toolParams.model as string | undefined
-          collectHostedApiKeyInput(inputs, modelValue, opIndex, op.block_id, opBlockType)
-          collectHostedToolApiKeyInput(
-            blockConfig,
-            inputs,
-            toolParams,
-            opIndex,
-            op.block_id,
-            opBlockType
-          )
-        }
-      }
+    const priorType = batchBlockType.has(stateKey)
+      ? batchBlockType.get(stateKey)
+      : (snapshotBlock(stateKey)?.type as string | undefined)
+    const blockType = rawType ?? priorType
+    batchBlockType.set(stateKey, blockType)
+
+    if (!inputs || !blockType) return
+    const blockConfig = getBlock(blockType)
+    if (!blockConfig) return
+
+    collectCredentialInputs(blockConfig, inputs, opIndex, reportBlockId, blockType, nestedBlockId)
+
+    // Both hosted collectors no-op off hosted Sim, so only reconstruct the effective inputs
+    // (prior batch/snapshot values overlaid with this op's delta) when it can matter.
+    if (isHosted) {
+      const priorValues =
+        batchBlockValues.get(stateKey) ??
+        buildSubBlockValues(
+          (snapshotBlock(stateKey)?.subBlocks as Record<string, { value?: unknown }>) ?? {}
+        )
+      const toolParams = { ...priorValues, ...inputs }
+      batchBlockValues.set(stateKey, toolParams)
+      const modelValue = toolParams.model as string | undefined
+      collectHostedApiKeyInput(inputs, modelValue, opIndex, reportBlockId, blockType, nestedBlockId)
+      collectHostedToolApiKeyInput(
+        blockConfig,
+        inputs,
+        toolParams,
+        opIndex,
+        reportBlockId,
+        blockType,
+        nestedBlockId
+      )
     }
+  }
+
+  operations.forEach((op, opIndex) => {
+    collectForBlock(
+      opIndex,
+      op.block_id,
+      op.block_id,
+      op.params?.type as string | undefined,
+      asRecord(op.params?.inputs)
+    )
 
-    // Process nested nodes (blocks inside loop/parallel containers)
+    // Nested nodes (blocks inside loop/parallel containers) — keyed by their own child id so they
+    // get the same batch/snapshot resolution as top-level blocks.
     const nestedNodes = op.params?.nestedNodes as
       | Record<string, Record<string, unknown>>
       | undefined
     if (nestedNodes) {
       Object.entries(nestedNodes).forEach(([childId, childBlock]) => {
-        const childType = childBlock.type as string | undefined
-        const childInputs = childBlock.inputs as Record<string, unknown> | undefined
-        if (!childType || !childInputs) return
-
-        const childBlockConfig = getBlock(childType)
-        if (!childBlockConfig) return
-
-        // Collect credentials from nested block
-        collectCredentialInputs(
-          childBlockConfig,
-          childInputs,
-          opIndex,
-          op.block_id,
-          childType,
-          childId
-        )
-
-        // Check for apiKey inputs on hosted models in nested block
-        const modelValue = childInputs.model as string | undefined
-        collectHostedApiKeyInput(childInputs, modelValue, opIndex, op.block_id, childType, childId)
-        collectHostedToolApiKeyInput(
-          childBlockConfig,
-          childInputs,
-          childInputs,
+        collectForBlock(
           opIndex,
+          childId,
           op.block_id,
-          childType,
+          childBlock.type as string | undefined,
+          asRecord(childBlock.inputs),
           childId
         )
       })