lael-labs/executor

assistant/packages/bot/src/commands/ask.tsx+3−2

 import { ConvexProvider } from "convex/react";
 import type { ReacordInstance } from "@openassistant/reacord";
 import { Effect, Runtime } from "effect";
+import type { Id } from "@executor/convex/_generated/dataModel";
 import { TaskMessage } from "../views/task-message";
 interface AskCommandDeps {
   await interaction.deferReply();
   let agentTaskId: string;
-  let workspaceId: string;
+  let workspaceId: Id<"workspaces">;
   try {
     const data = await unwrap(
       deps.api.api.tasks.post({ prompt, requesterId }),
     );
     agentTaskId = data.agentTaskId;
-    workspaceId = data.workspaceId;
+    workspaceId = data.workspaceId as Id<"workspaces">;
   } catch (error) {
     await interaction.editReply({
       content: `\u274c Failed to create task: ${error instanceof Error ? error.message : String(error)}`,

assistant/packages/bot/src/views/task-message.tsx+2−1

 } from "@openassistant/reacord";
 import { useMutation, useQuery } from "convex/react";
 import { api } from "@executor/convex/_generated/api";
+import type { Id } from "@executor/convex/_generated/dataModel";
 // ---------------------------------------------------------------------------
 // Component
 export interface TaskMessageProps {
   readonly agentTaskId: string;
   readonly prompt: string;
-  readonly workspaceId: string;
+  readonly workspaceId: Id<"workspaces">;
 }
 export function TaskMessage({ agentTaskId, prompt, workspaceId }: TaskMessageProps) {

assistant/packages/server/src/index.ts+3−2

 import { createApp } from "./routes";
 import { ConvexHttpClient } from "convex/browser";
 import { api } from "@executor/convex/_generated/api";
+import type { Id } from "@executor/convex/_generated/dataModel";
 const PORT = Number(Bun.env.PORT ?? 3000);
 const CONVEX_URL = Bun.env.CONVEX_URL;
 // Bootstrap anonymous context on executor Convex backend
 const convex = new ConvexHttpClient(CONVEX_URL);
-let ctx: { workspaceId: string; actorId: string; clientId?: string };
+let ctx: { workspaceId: Id<"workspaces">; actorId: string; clientId?: string };
 if (PINNED_WORKSPACE_ID && PINNED_ACTOR_ID) {
   ctx = {
-    workspaceId: PINNED_WORKSPACE_ID,
+    workspaceId: PINNED_WORKSPACE_ID as Id<"workspaces">,
     actorId: PINNED_ACTOR_ID,
     clientId: PINNED_CLIENT_ID,
   };

assistant/packages/server/src/routes.ts+2−1

 import type { TaskEvent } from "@assistant/core";
 import { ConvexHttpClient } from "convex/browser";
 import { api } from "@executor/convex/_generated/api";
+import type { Id } from "@executor/convex/_generated/dataModel";
 // ---------------------------------------------------------------------------
 // Config
 export interface ServerOptions {
   readonly executorUrl: string;
-  readonly workspaceId: string;
+  readonly workspaceId: Id<"workspaces">;
   readonly actorId: string;
   readonly clientId?: string;
   readonly context?: string;

executor/apps/web/src/app/sign-in/route.ts+1−1

@@ -93,7 +93,7 @@ async function resolveOrganizationHint(request: NextRequest): Promise<string \| u · 92 unmodified lines
93	try {	93	try {
94	const workosOrganizationId = await convexClient.query(	94	const workosOrganizationId = await convexClient.query(
95	api.organizations.resolveWorkosOrganizationId,	95	api.organizations.resolveWorkosOrganizationId,
96	{ organizationId: organizationHint as unknown as Id<"organizations"> },	96	{ organizationId: organizationHint as Id<"organizations"> },
97	);	97	);
98	return typeof workosOrganizationId === "string" ? workosOrganizationId : undefined;	98	return typeof workosOrganizationId === "string" ? workosOrganizationId : undefined;
99	} catch {	99	} catch {

executor/apps/web/src/app/sign-up/route.ts+1−1

@@ -93,7 +93,7 @@ async function resolveOrganizationHint(request: NextRequest): Promise<string \| u · 92 unmodified lines
93	try {	93	try {
94	const workosOrganizationId = await convexClient.query(	94	const workosOrganizationId = await convexClient.query(
95	api.organizations.resolveWorkosOrganizationId,	95	api.organizations.resolveWorkosOrganizationId,
96	{ organizationId: organizationHint as unknown as Id<"organizations"> },	96	{ organizationId: organizationHint as Id<"organizations"> },
97	);	97	);
98	return typeof workosOrganizationId === "string" ? workosOrganizationId : undefined;	98	return typeof workosOrganizationId === "string" ? workosOrganizationId : undefined;
99	} catch {	99	} catch {

executor/apps/web/src/lib/session-context.tsx+2−2

@@ -231,7 +231,7 @@ export function SessionProvider({ children }: { children: ReactNode }) { · 230 unmodified lines
231	localStorage.setItem(SESSION_KEY, context.sessionId);	231	localStorage.setItem(SESSION_KEY, context.sessionId);
232	localStorage.setItem(ACTIVE_WORKSPACE_KEY, context.workspaceId);	232	localStorage.setItem(ACTIVE_WORKSPACE_KEY, context.workspaceId);
233	setStoredSessionId(context.sessionId);	233	setStoredSessionId(context.sessionId);
234	setActiveWorkspaceId(context.workspaceId as Id<"workspaces">);	234	setActiveWorkspaceId(context.workspaceId);
235	setManualGuestContext(context);	235	setManualGuestContext(context);
236	} catch (cause) {	236	} catch (cause) {
237	const message = cause instanceof Error ? cause.message : "Failed to create anonymous organization";	237	const message = cause instanceof Error ? cause.message : "Failed to create anonymous organization";
@@ -401,7 +401,7 @@ export function SessionProvider({ children }: { children: ReactNode }) { · 163 unmodified lines
401	if (guestContext) {	401	if (guestContext) {
402	return [	402	return [
403	{	403	{
404	id: guestContext.workspaceId as Id<"workspaces">,	404	id: guestContext.workspaceId,
405	docId: null,	405	docId: null,
406	name: "Anonymous Workspace",	406	name: "Anonymous Workspace",
407	organizationId: null,	407	organizationId: null,

executor/convex/_generated/api.d.ts+15−15

       },
       any
     >;
-    deleteAnonymousSessionsMissingAccountId: FunctionReference<
+    cleanupAccessPolicyEmptyStringSentinels: FunctionReference<
       "mutation",
       "internal",
       {
       },
       any
     >;
-    deleteAnonymousSessionsMissingUserId: FunctionReference<
+    cleanupTaskEmptyStringSentinels: FunctionReference<
+      "mutation",
+      "internal",
+      {
+        batchSize?: number;
+        cursor?: string | null;
+        dryRun?: boolean;
+        fn?: string;
+        next?: Array<string>;
+      },
+      any
+    >;
+    deleteAnonymousSessionsMissingAccountId: FunctionReference<
       "mutation",
       "internal",
       {
       },
       any
     >;
-    deleteInvitesMissingProvider: FunctionReference<
+    deleteAnonymousSessionsMissingUserId: FunctionReference<
       "mutation",
       "internal",
       {
       { maxAgeMs: number; specUrl: string; version: string },
       any
     >;
-    pruneExpired: FunctionReference<
-      "mutation",
-      "internal",
-      { batchSize?: number; maxAgeMs: number },
-      any
-    >;
     putEntry: FunctionReference<
       "mutation",
       "internal",
     >;
   };
   workspaceToolCache: {
-    getDtsStorageIds: FunctionReference<
-      "query",
-      "internal",
-      { workspaceId: Id<"workspaces"> },
-      any
-    >;
     getEntry: FunctionReference<
       "query",
       "internal",

executor/convex/access-controls.test.ts+0−1

@@ -82,7 +82,6 @@ async function seedUser( · 81 unmodified lines
82	organizationId,	82	organizationId,
83	slug: `ws-${subject}`,	83	slug: `ws-${subject}`,
84	name: opts.workspaceName ?? `${name}'s Workspace`,	84	name: opts.workspaceName ?? `${name}'s Workspace`,
85	plan: "free",
86	createdByAccountId: accountId,	85	createdByAccountId: accountId,
87	createdAt: now,	86	createdAt: now,
88	updatedAt: now,	87	updatedAt: now,

executor/convex/auth.ts+0−2

     organizationId,
     slug: `${baseSlug}-${opts.workosUserId.slice(-6)}`,
     name: personalNames.workspaceName,
-    plan: "free",
     createdByAccountId: accountId,
     createdAt: opts.now,
     updatedAt: opts.now,
       organizationId: organization._id,
       slug: "default",
       name: "Default Workspace",
-      plan: "free",
       createdByAccountId: organization.createdByAccountId,
       createdAt: now,
       updatedAt: now,

executor/convex/database.test.ts+0−1

@@ -25,7 +25,6 @@ async function seedWorkspace(t: ReturnType<typeof setup>, name = "test-ws"): Pro · 24 unmodified lines
25	name,	25	name,
26	slug: name,	26	slug: name,
27	organizationId: orgId,	27	organizationId: orgId,
28	plan: "free",
29	createdAt: Date.now(),	28	createdAt: Date.now(),
30	updatedAt: Date.now(),	29	updatedAt: Date.now(),
31	});	30	});

executor/convex/database.ts+14−30

 const toolSourceTypeValidator = v.union(v.literal("mcp"), v.literal("openapi"), v.literal("graphql"));
 const agentTaskStatusValidator = v.union(v.literal("running"), v.literal("completed"), v.literal("failed"));
-function normalizeOptional(value?: string): string {
-  if (typeof value !== "string") {
-    return "";
-  }
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : "";
-}
-function optionalFromNormalized(value?: string): string | undefined {
-  if (!value) {
-    return undefined;
-  }
-  return value;
-}
 function slugify(input: string): string {
   const slug = input
     .toLowerCase()
     timeoutMs: typeof doc.timeoutMs === "number" ? doc.timeoutMs : DEFAULT_TIMEOUT_MS,
     metadata: asRecord(doc.metadata),
     workspaceId: doc.workspaceId,
-    actorId: optionalFromNormalized(doc.actorId),
+    actorId: doc.actorId,
-    clientId: optionalFromNormalized(doc.clientId),
+    clientId: doc.clientId,
     createdAt: doc.createdAt,
     updatedAt: doc.updatedAt,
     startedAt: doc.startedAt,
   return {
     id: doc.policyId,
     workspaceId: doc.workspaceId,
-    actorId: optionalFromNormalized(doc.actorId),
+    actorId: doc.actorId,
-    clientId: optionalFromNormalized(doc.clientId),
+    clientId: doc.clientId,
     toolPathPattern: doc.toolPathPattern,
     decision: doc.decision,
     priority: doc.priority,
     workspaceId: doc.workspaceId,
     sourceKey: doc.sourceKey,
     scope: doc.scope,
-    actorId: optionalFromNormalized(doc.actorId),
+    actorId: doc.actorId || undefined,
     provider: doc.provider ?? "managed",
     secretJson: asRecord(doc.secretJson),
     createdAt: doc.createdAt,
       organizationId,
       slug: `anonymous-${crypto.randomUUID().slice(0, 8)}`,
       name: anonymousWorkspaceName,
-      plan: "free",
       createdByAccountId: account._id,
       createdAt: now,
       updatedAt: now,
       code: args.code,
       runtimeId: args.runtimeId,
       workspaceId: args.workspaceId,
-      actorId: normalizeOptional(args.actorId),
+      actorId: args.actorId?.trim() || undefined,
-      clientId: normalizeOptional(args.clientId),
+      clientId: args.clientId?.trim() || undefined,
       status: "queued",
       timeoutMs: args.timeoutMs ?? DEFAULT_TIMEOUT_MS,
       metadata: asRecord(args.metadata),
   args: { sessionId: v.optional(v.string()) },
   handler: async (ctx, args) => {
     const now = Date.now();
-    const requestedSessionId = normalizeOptional(args.sessionId);
+    const requestedSessionId = args.sessionId?.trim() || "";
     const allowRequestedSessionId = requestedSessionId?.startsWith("mcp_") ?? false;
     if (requestedSessionId) {
     if (existing) {
       await ctx.db.patch(existing._id, {
         workspaceId: args.workspaceId,
-        actorId: normalizeOptional(args.actorId),
+        actorId: args.actorId?.trim() || undefined,
-        clientId: normalizeOptional(args.clientId),
+        clientId: args.clientId?.trim() || undefined,
         toolPathPattern: args.toolPathPattern,
         decision: args.decision,
         priority: args.priority ?? 100,
       await ctx.db.insert("accessPolicies", {
         policyId,
         workspaceId: args.workspaceId,
-        actorId: normalizeOptional(args.actorId),
+        actorId: args.actorId?.trim() || undefined,
-        clientId: normalizeOptional(args.clientId),
+        clientId: args.clientId?.trim() || undefined,
         toolPathPattern: args.toolPathPattern,
         decision: args.decision,
         priority: args.priority ?? 100,
   },
   handler: async (ctx, args) => {
     const now = Date.now();
-    const actorId = args.scope === "actor" ? normalizeOptional(args.actorId) : "";
+    const actorId = args.scope === "actor" ? (args.actorId?.trim() || "") : "";
     const existing = await ctx.db
       .query("sourceCredentials")
   },
   handler: async (ctx, args) => {
     if (args.scope === "actor") {
-      const actorId = normalizeOptional(args.actorId);
+      const actorId = args.actorId?.trim() || "";
       if (!actorId) {
         return null;
       }

executor/convex/executor.ts+1−4

 import type { MutationCtx } from "./_generated/server";
 import { internalMutation } from "./_generated/server";
 import { workspaceMutation } from "../lib/functionBuilders";
+import { actorIdForAccount } from "../lib/identity";
 import type { ApprovalRecord, TaskRecord } from "../lib/types";
 const DEFAULT_TIMEOUT_MS = 300_000;
   await ctx.runMutation(internal.database.createTaskEvent, input);
 }
-function actorIdForAccount(account: { _id: string; provider: string; providerAccountId: string }) {
-  return account.provider === "anonymous" ? account.providerAccountId : account._id;
-}
 async function createTaskRecord(
   ctx: MutationCtx,
   args: {

executor/convex/executorNode.ts+63−35

@@ -2,10 +2,13 @@ · 1 unmodified line
2		2
3	import { v } from "convex/values";	3	import { v } from "convex/values";
4	import { internal } from "./_generated/api";	4	import { internal } from "./_generated/api";
		5	import type { Id } from "./_generated/dataModel";
5	import { action, internalAction } from "./_generated/server";	6	import { action, internalAction } from "./_generated/server";
		7	import type { ActionCtx } from "./_generated/server";
6	import { InProcessExecutionAdapter } from "../lib/adapters/in_process_execution_adapter";	8	import { InProcessExecutionAdapter } from "../lib/adapters/in_process_execution_adapter";
7	import { resolveCredentialPayload } from "../lib/credential_providers";	9	import { resolveCredentialPayload } from "../lib/credential_providers";
8	import { APPROVAL_DENIED_PREFIX } from "../lib/execution_constants";	10	import { APPROVAL_DENIED_PREFIX } from "../lib/execution_constants";
		11	import { actorIdForAccount } from "../lib/identity";
9	import { runCodeWithAdapter } from "../lib/runtimes/runtime_core";	12	import { runCodeWithAdapter } from "../lib/runtimes/runtime_core";
10	import { createDiscoverTool } from "../lib/tool_discovery";	13	import { createDiscoverTool } from "../lib/tool_discovery";
11	import {	14	import {
@@ -17,6 +20,9 @@ import { · 5 unmodified lines
17	serializeTools,	20	serializeTools,
18	type PreparedOpenApiSpec,	21	type PreparedOpenApiSpec,
19	type ExternalToolSourceConfig,	22	type ExternalToolSourceConfig,
		23	type McpToolSourceConfig,
		24	type OpenApiToolSourceConfig,
		25	type GraphqlToolSourceConfig,
20	type WorkspaceToolSnapshot,	26	type WorkspaceToolSnapshot,
21	} from "../lib/tool_sources";	27	} from "../lib/tool_sources";
22	import { DEFAULT_TOOLS } from "../lib/tools";	28	import { DEFAULT_TOOLS } from "../lib/tools";
@@ -173,27 +179,23 @@ function normalizeExternalToolSource(raw: { · 150 unmodified lines
173	name: string;	179	name: string;
174	config: Record<string, unknown>;	180	config: Record<string, unknown>;
175	}): ExternalToolSourceConfig {	181	}): ExternalToolSourceConfig {
176	const merged = {	182	const config = raw.config;
177	type: raw.type,
178	name: raw.name,
179	...raw.config,
180	} as Record<string, unknown>;
181		183
182	if (raw.type === "mcp") {	184	if (raw.type === "mcp") {
183	if (typeof merged.url !== "string" \|\| merged.url.trim().length === 0) {	185	if (typeof config.url !== "string" \|\| config.url.trim().length === 0) {
184	throw new Error(`MCP source '${raw.name}' missing url`);	186	throw new Error(`MCP source '${raw.name}' missing url`);
185	}	187	}
186		188
187	if (	189	if (
188	merged.transport !== undefined	190	config.transport !== undefined
189	&& merged.transport !== "sse"	191	&& config.transport !== "sse"
190	&& merged.transport !== "streamable-http"	192	&& config.transport !== "streamable-http"
191	) {	193	) {
192	throw new Error(`MCP source '${raw.name}' has invalid transport`);	194	throw new Error(`MCP source '${raw.name}' has invalid transport`);
193	}	195	}
194		196
195	if (merged.queryParams !== undefined) {	197	if (config.queryParams !== undefined) {
196	const queryParams = merged.queryParams;	198	const queryParams = config.queryParams;
197	if (!queryParams \|\| typeof queryParams !== "object" \|\| Array.isArray(queryParams)) {	199	if (!queryParams \|\| typeof queryParams !== "object" \|\| Array.isArray(queryParams)) {
198	throw new Error(`MCP source '${raw.name}' queryParams must be an object`);	200	throw new Error(`MCP source '${raw.name}' queryParams must be an object`);
199	}	201	}
@@ -205,22 +207,52 @@ function normalizeExternalToolSource(raw: { · 5 unmodified lines
205	}	207	}
206	}	208	}
207		209
208	return merged as unknown as ExternalToolSourceConfig;	210	const result: McpToolSourceConfig = {
		211	type: "mcp",
		212	name: raw.name,
		213	url: config.url,
		214	transport: config.transport as McpToolSourceConfig["transport"],
		215	queryParams: config.queryParams as McpToolSourceConfig["queryParams"],
		216	defaultApproval: config.defaultApproval as McpToolSourceConfig["defaultApproval"],
		217	overrides: config.overrides as McpToolSourceConfig["overrides"],
		218	};
		219	return result;
209	}	220	}
210		221
211	if (raw.type === "graphql") {	222	if (raw.type === "graphql") {
212	if (typeof merged.endpoint !== "string" \|\| merged.endpoint.trim().length === 0) {	223	if (typeof config.endpoint !== "string" \|\| config.endpoint.trim().length === 0) {
213	throw new Error(`GraphQL source '${raw.name}' missing endpoint`);	224	throw new Error(`GraphQL source '${raw.name}' missing endpoint`);
214	}	225	}
215	return merged as unknown as ExternalToolSourceConfig;	226
		227	const result: GraphqlToolSourceConfig = {
		228	type: "graphql",
		229	name: raw.name,
		230	endpoint: config.endpoint,
		231	schema: config.schema as GraphqlToolSourceConfig["schema"],
		232	auth: config.auth as GraphqlToolSourceConfig["auth"],
		233	defaultQueryApproval: config.defaultQueryApproval as GraphqlToolSourceConfig["defaultQueryApproval"],
		234	defaultMutationApproval: config.defaultMutationApproval as GraphqlToolSourceConfig["defaultMutationApproval"],
		235	overrides: config.overrides as GraphqlToolSourceConfig["overrides"],
		236	};
		237	return result;
216	}	238	}
217		239
218	const spec = merged.spec;	240	const spec = config.spec;
219	if (typeof spec !== "string" && typeof spec !== "object") {	241	if (typeof spec !== "string" && (typeof spec !== "object" \|\| spec === null)) {
220	throw new Error(`OpenAPI source '${raw.name}' missing spec`);	242	throw new Error(`OpenAPI source '${raw.name}' missing spec`);
221	}	243	}
222		244
223	return merged as unknown as ExternalToolSourceConfig;	245	const result: OpenApiToolSourceConfig = {
		246	type: "openapi",
		247	name: raw.name,
		248	spec: spec as OpenApiToolSourceConfig["spec"],
		249	baseUrl: config.baseUrl as OpenApiToolSourceConfig["baseUrl"],
		250	auth: config.auth as OpenApiToolSourceConfig["auth"],
		251	defaultReadApproval: config.defaultReadApproval as OpenApiToolSourceConfig["defaultReadApproval"],
		252	defaultWriteApproval: config.defaultWriteApproval as OpenApiToolSourceConfig["defaultWriteApproval"],
		253	overrides: config.overrides as OpenApiToolSourceConfig["overrides"],
		254	};
		255	return result;
224	}	256	}
225		257
226	async function sleep(ms: number): Promise<void> {	258	async function sleep(ms: number): Promise<void> {
@@ -230,7 +262,7 @@ async function sleep(ms: number): Promise<void> { · 3 unmodified lines
230	const baseTools = new Map<string, ToolDefinition>(DEFAULT_TOOLS.map((tool) => [tool.path, tool]));	262	const baseTools = new Map<string, ToolDefinition>(DEFAULT_TOOLS.map((tool) => [tool.path, tool]));
231	interface DtsStorageEntry {	263	interface DtsStorageEntry {
232	sourceKey: string;	264	sourceKey: string;
233	storageId: string;	265	storageId: Id<"_storage">;
234	}	266	}
235		267
236	const OPENAPI_SPEC_CACHE_TTL_MS = 5 * 60 * 60_000;	268	const OPENAPI_SPEC_CACHE_TTL_MS = 5 * 60 * 60_000;
@@ -239,7 +271,7 @@ const OPENAPI_SPEC_CACHE_TTL_MS = 5 * 60 * 60_000; · 2 unmodified lines
239	const OPENAPI_CACHE_VERSION = "v14";	271	const OPENAPI_CACHE_VERSION = "v14";
240		272
241	async function publish(	273	async function publish(
242	ctx: any,	274	ctx: ActionCtx,
243	taskId: string,	275	taskId: string,
244	eventName: "task" \| "approval",	276	eventName: "task" \| "approval",
245	type: string,	277	type: string,
@@ -253,7 +285,7 @@ async function publish( · 7 unmodified lines
253	});	285	});
254	}	286	}
255		287
256	async function waitForApproval(ctx: any, approvalId: string): Promise<"approved" \| "denied"> {	288	async function waitForApproval(ctx: ActionCtx, approvalId: string): Promise<"approved" \| "denied"> {
257	while (true) {	289	while (true) {
258	const approval = await ctx.runQuery(internal.database.getApproval, { approvalId });	290	const approval = await ctx.runQuery(internal.database.getApproval, { approvalId });
259	if (!approval) {	291	if (!approval) {
@@ -278,7 +310,7 @@ async function waitForApproval(ctx: any, approvalId: string): Promise<"approved" · 18 unmodified lines
278	* No size limits — Convex file storage handles multi-MB specs without issue.	310	* No size limits — Convex file storage handles multi-MB specs without issue.
279	*/	311	*/
280	async function loadCachedOpenApiSpec(	312	async function loadCachedOpenApiSpec(
281	ctx: any,	313	ctx: ActionCtx,
282	specUrl: string,	314	specUrl: string,
283	sourceName: string,	315	sourceName: string,
284	): Promise<PreparedOpenApiSpec> {	316	): Promise<PreparedOpenApiSpec> {
@@ -327,7 +359,7 @@ async function loadCachedOpenApiSpec( · 42 unmodified lines
327	}	359	}
328		360
329	async function loadSourceTools(	361	async function loadSourceTools(
330	ctx: any,	362	ctx: ActionCtx,
331	source: ExternalToolSourceConfig,	363	source: ExternalToolSourceConfig,
332	): Promise<{ tools: ToolDefinition[]; warnings: string[] }> {	364	): Promise<{ tools: ToolDefinition[]; warnings: string[] }> {
333	if (source.type === "openapi" && typeof source.spec === "string") {	365	if (source.type === "openapi" && typeof source.spec === "string") {
@@ -356,7 +388,7 @@ interface WorkspaceToolsResult { · 22 unmodified lines
356	dtsStorageIds: DtsStorageEntry[];	388	dtsStorageIds: DtsStorageEntry[];
357	}	389	}
358		390
359	async function getWorkspaceTools(ctx: any, workspaceId: string): Promise<WorkspaceToolsResult> {	391	async function getWorkspaceTools(ctx: ActionCtx, workspaceId: Id<"workspaces">): Promise<WorkspaceToolsResult> {
360	const sources = (await ctx.runQuery(internal.database.listToolSources, { workspaceId }))	392	const sources = (await ctx.runQuery(internal.database.listToolSources, { workspaceId }))
361	.filter((source: { enabled: boolean }) => source.enabled);	393	.filter((source: { enabled: boolean }) => source.enabled);
362	const signature = sourceSignature(workspaceId, sources);	394	const signature = sourceSignature(workspaceId, sources);
@@ -440,7 +472,7 @@ async function getWorkspaceTools(ctx: any, workspaceId: string): Promise<Workspa · 77 unmodified lines
440	dtsEntries.map(async (entry) => {	472	dtsEntries.map(async (entry) => {
441	const dtsBlob = new Blob([entry.content], { type: "text/plain" });	473	const dtsBlob = new Blob([entry.content], { type: "text/plain" });
442	const sid = await ctx.storage.store(dtsBlob);	474	const sid = await ctx.storage.store(dtsBlob);
443	return { sourceKey: entry.sourceKey, storageId: String(sid) };	475	return { sourceKey: entry.sourceKey, storageId: sid };
444	}),	476	}),
445	);	477	);
446	dtsStorageIds = storedDts;	478	dtsStorageIds = storedDts;
@@ -463,7 +495,7 @@ async function getWorkspaceTools(ctx: any, workspaceId: string): Promise<Workspa · 16 unmodified lines
463	workspaceId,	495	workspaceId,
464	signature,	496	signature,
465	storageId,	497	storageId,
466	dtsStorageIds: storedDts.map((e) => ({ sourceKey: e.sourceKey, storageId: e.storageId as any })),	498	dtsStorageIds: storedDts.map((e) => ({ sourceKey: e.sourceKey, storageId: e.storageId })),
467	toolCount: allTools.length,	499	toolCount: allTools.length,
468	sizeBytes: json.length,	500	sizeBytes: json.length,
469	});	501	});
@@ -608,8 +640,8 @@ function listVisibleToolDescriptors( · 138 unmodified lines
608	}	640	}
609		641
610	async function listToolsForContext(	642	async function listToolsForContext(
611	ctx: any,	643	ctx: ActionCtx,
612	context: { workspaceId: string; actorId?: string; clientId?: string },	644	context: { workspaceId: Id<"workspaces">; actorId?: string; clientId?: string },
613	): Promise<ToolDescriptor[]> {	645	): Promise<ToolDescriptor[]> {
614	const [result, policies] = await Promise.all([	646	const [result, policies] = await Promise.all([
615	getWorkspaceTools(ctx, context.workspaceId),	647	getWorkspaceTools(ctx, context.workspaceId),
@@ -621,8 +653,8 @@ async function listToolsForContext( · 5 unmodified lines
621	}	653	}
622		654
623	async function listToolsWithWarningsForContext(	655	async function listToolsWithWarningsForContext(
624	ctx: any,	656	ctx: ActionCtx,
625	context: { workspaceId: string; actorId?: string; clientId?: string },	657	context: { workspaceId: Id<"workspaces">; actorId?: string; clientId?: string },
626	): Promise<{	658	): Promise<{
627	tools: ToolDescriptor[];	659	tools: ToolDescriptor[];
628	warnings: string[];	660	warnings: string[];
@@ -656,10 +688,6 @@ async function listToolsWithWarningsForContext( · 27 unmodified lines
656	};	688	};
657	}	689	}
658		690
659	function actorIdForAccount(account: { _id: string; provider: string; providerAccountId: string }): string {
660	return account.provider === "anonymous" ? account.providerAccountId : account._id;
661	}
662
663	function isToolAllowedForTask(	691	function isToolAllowedForTask(
664	task: TaskRecord,	692	task: TaskRecord,
665	toolPath: string,	693	toolPath: string,
@@ -672,7 +700,7 @@ function isToolAllowedForTask( · 6 unmodified lines
672	}	700	}
673		701
674	async function resolveCredentialHeaders(	702	async function resolveCredentialHeaders(
675	ctx: any,	703	ctx: ActionCtx,
676	spec: ToolCredentialSpec,	704	spec: ToolCredentialSpec,
677	task: TaskRecord,	705	task: TaskRecord,
678	): Promise<ResolvedToolCredential \| null> {	706	): Promise<ResolvedToolCredential \| null> {
@@ -774,7 +802,7 @@ function getGraphqlDecision( · 95 unmodified lines
774	return { decision: worstDecision, effectivePaths: fieldPaths };	802	return { decision: worstDecision, effectivePaths: fieldPaths };
775	}	803	}
776		804
777	async function invokeTool(ctx: any, task: TaskRecord, call: ToolCallRequest): Promise<unknown> {	805	async function invokeTool(ctx: ActionCtx, task: TaskRecord, call: ToolCallRequest): Promise<unknown> {
778	const { toolPath, input, callId } = call;	806	const { toolPath, input, callId } = call;
779	const policies = await ctx.runQuery(internal.database.listAccessPolicies, { workspaceId: task.workspaceId });	807	const policies = await ctx.runQuery(internal.database.listAccessPolicies, { workspaceId: task.workspaceId });
780	const typedPolicies = policies as AccessPolicyRecord[];	808	const typedPolicies = policies as AccessPolicyRecord[];

executor/convex/http.ts+25−17

   }
 }
+/**
+ * Validated boundary for external workspace ID strings.
+ * Convex IDs are opaque strings at runtime; this cast is the single
+ * validated entry point so downstream code never needs ad-hoc casts.
+ */
+function parseWorkspaceId(raw: string): Id<"workspaces"> {
+  return raw as Id<"workspaces">;
+}
 function parseMcpContext(url: URL): {
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   clientId?: string;
   sessionId?: string;
 } | undefined {
-  const workspaceId = url.searchParams.get("workspaceId");
+  const raw = url.searchParams.get("workspaceId");
-  if (!workspaceId) return undefined;
+  if (!raw) return undefined;
+  const workspaceId = parseWorkspaceId(raw);
   const clientId = url.searchParams.get("clientId") ?? undefined;
   const sessionId = url.searchParams.get("sessionId") ?? undefined;
   return { workspaceId, clientId, sessionId };
     try {
       if (mcpAuthConfig.enabled && auth?.subject) {
         const access = await ctx.runQuery(internal.workspaceAuthInternal.getWorkspaceAccessForWorkosSubject, {
-          workspaceId: requestedContext.workspaceId as Id<"workspaces">,
+          workspaceId: requestedContext.workspaceId,
           subject: auth.subject,
         });
         }
         const access = await ctx.runQuery(internal.workspaceAuthInternal.getWorkspaceAccessForRequest, {
-          workspaceId: requestedContext.workspaceId as Id<"workspaces">,
+          workspaceId: requestedContext.workspaceId,
           sessionId: requestedContext.sessionId,
         });
       timeoutMs?: number;
       runtimeId?: string;
       metadata?: Record<string, unknown>;
-      workspaceId: string;
+      workspaceId: Id<"workspaces">;
       actorId: string;
       clientId?: string;
     }) => {
       return (await ctx.runMutation(internal.executor.createTaskInternal, {
         ...input,
-        workspaceId: input.workspaceId as Id<"workspaces">,
       })) as { task: TaskRecord };
     },
-    getTask: async (taskId: string, workspaceId?: string) => {
+    getTask: async (taskId: string, workspaceId?: Id<"workspaces">) => {
       if (workspaceId) {
-        return (await ctx.runQuery(internal.database.getTaskInWorkspace, { taskId, workspaceId: workspaceId as Id<"workspaces"> })) as TaskRecord | null;
+        return (await ctx.runQuery(internal.database.getTaskInWorkspace, { taskId, workspaceId })) as TaskRecord | null;
       }
       return null;
     },
     bootstrapAnonymousContext: async (sessionId?: string) => {
       return (await ctx.runMutation(internal.database.bootstrapAnonymousSession, { sessionId })) as AnonymousContext;
     },
-    listTools: async (toolContext?: { workspaceId: string; actorId?: string; clientId?: string }) => {
+    listTools: async (toolContext?: { workspaceId: Id<"workspaces">; actorId?: string; clientId?: string }) => {
       if (!toolContext) {
         return [];
       }
-      return (await ctx.runAction(internal.executorNode.listToolsInternal, { ...toolContext, workspaceId: toolContext.workspaceId as Id<"workspaces"> })) as ToolDescriptor[];
+      return (await ctx.runAction(internal.executorNode.listToolsInternal, { ...toolContext })) as ToolDescriptor[];
     },
-    listToolsForTypecheck: async (toolContext: { workspaceId: string; actorId?: string; clientId?: string }) => {
+    listToolsForTypecheck: async (toolContext: { workspaceId: Id<"workspaces">; actorId?: string; clientId?: string }) => {
-      const result = await ctx.runAction(internal.executorNode.listToolsWithWarningsInternal, { ...toolContext, workspaceId: toolContext.workspaceId as Id<"workspaces"> }) as {
+      const result = await ctx.runAction(internal.executorNode.listToolsWithWarningsInternal, { ...toolContext }) as {
         tools: ToolDescriptor[];
         dtsUrls?: Record<string, string>;
       };
         dtsUrls: result.dtsUrls ?? {},
       };
     },
-    listPendingApprovals: async (workspaceId: string) => {
+    listPendingApprovals: async (workspaceId: Id<"workspaces">) => {
-      return (await ctx.runQuery(internal.database.listPendingApprovals, { workspaceId: workspaceId as Id<"workspaces"> })) as PendingApprovalRecord[];
+      return (await ctx.runQuery(internal.database.listPendingApprovals, { workspaceId })) as PendingApprovalRecord[];
     },
     resolveApproval: async (input: {
-      workspaceId: string;
+      workspaceId: Id<"workspaces">;
       approvalId: string;
       decision: "approved" | "denied";
       reviewerId?: string;
     }) => {
       return await ctx.runMutation(internal.executor.resolveApprovalInternal, {
         ...input,
-        workspaceId: input.workspaceId as Id<"workspaces">,
       });
     },
   };

executor/convex/invites.ts+0−4

     }
     const inviterWorkosUserId = ctx.account.providerAccountId;
-    const provider = "workos";
     const inviteId = await ctx.db.insert("invites", {
       organizationId: ctx.organizationId,
       workspaceId: args.workspaceId,
       email: normalizedEmail,
       role: args.role,
       status: "pending",
-      provider,
       invitedByAccountId: ctx.account._id,
       expiresAt,
       createdAt: now,
         expiresAt: invite.expiresAt,
       },
       delivery: {
-        provider,
         providerInviteId: invite.providerInviteId ?? null,
         state: "queued",
       },

executor/convex/migrations.ts+20−11

   },
 });
-export const deleteInvitesMissingProvider = migrations.define({
-  table: "invites",
-  migrateOne: async (ctx, invite) => {
-    if (invite.provider) {
-      return;
-    }
-    await ctx.db.delete(invite._id);
-  },
-});
 export const deleteAnonymousSessionsMissingUserId = migrations.define({
   table: "anonymousSessions",
   migrateOne: async (ctx, session) => {
   },
 });
+export const cleanupTaskEmptyStringSentinels = migrations.define({
+  table: "tasks",
+  migrateOne: async (_ctx, task) => {
+    const patch: Record<string, undefined> = {};
+    if (task.actorId === "") patch.actorId = undefined;
+    if (task.clientId === "") patch.clientId = undefined;
+    if (Object.keys(patch).length > 0) return patch;
+  },
+});
+export const cleanupAccessPolicyEmptyStringSentinels = migrations.define({
+  table: "accessPolicies",
+  migrateOne: async (_ctx, policy) => {
+    const patch: Record<string, undefined> = {};
+    if (policy.actorId === "") patch.actorId = undefined;
+    if (policy.clientId === "") patch.clientId = undefined;
+    if (Object.keys(patch).length > 0) return patch;
+  },
+});
 export const run = migrations.runner();

executor/convex/openApiSpecCache.ts+0−32

@@ -66,35 +66,3 @@ export const putEntry = internalMutation({ · 65 unmodified lines
66	});	66	});
67	},	67	},
68	});	68	});
69
70	/**
71	* Remove all cache entries older than the given timestamp.
72	* Returns the number of entries removed.
73	*/
74	export const pruneExpired = internalMutation({
75	args: {
76	maxAgeMs: v.number(),
77	batchSize: v.optional(v.number()),
78	},
79	handler: async (ctx, args) => {
80	const cutoff = Date.now() - args.maxAgeMs;
81	const limit = args.batchSize ?? 50;
82
83	// Scan all entries (the table should be small — one row per unique spec URL)
84	const entries = await ctx.db
85	.query("openApiSpecCache")
86	.collect();
87
88	let removed = 0;
89	for (const entry of entries) {
90	if (removed >= limit) break;
91	if (entry.createdAt < cutoff) {
92	await ctx.storage.delete(entry.storageId).catch(() => {});
93	await ctx.db.delete(entry._id);
94	removed++;
95	}
96	}
97
98	return removed;
99	},
100	});

executor/convex/organizations.ts+0−1

@@ -75,7 +75,6 @@ export const create = authedMutation({ · 74 unmodified lines
75	organizationId,	75	organizationId,
76	slug: "default",	76	slug: "default",
77	name: "Default Workspace",	77	name: "Default Workspace",
78	plan: "free",
79	createdByAccountId: account._id,	78	createdByAccountId: account._id,
80	createdAt: now,	79	createdAt: now,
81	updatedAt: now,	80	updatedAt: now,

executor/convex/schema.ts+7−20

   v.literal("revoked"),
   v.literal("failed"),
 );
-const inviteProvider = v.literal("workos");
 const taskStatus = v.union(
   v.literal("queued"),
   v.literal("running"),
     updatedAt: v.number(),
     lastLoginAt: v.optional(v.number()),
   })
-    .index("by_provider", ["provider", "providerAccountId"])
+    .index("by_provider", ["provider", "providerAccountId"]),
-    .index("by_email", ["email"]),
   workspaces: defineTable({
     workosOrgId: v.optional(v.string()),
     slug: v.string(),
     name: v.string(),
     iconStorageId: v.optional(v.id("_storage")),
-    plan: v.string(),
     createdByAccountId: v.optional(v.id("accounts")),
     createdAt: v.number(),
     updatedAt: v.number(),
     .index("by_workos_org_id", ["workosOrgId"])
     .index("by_organization_created", ["organizationId", "createdAt"])
     .index("by_organization_slug", ["organizationId", "slug"])
-    .index("by_creator_created", ["createdByAccountId", "createdAt"])
     .index("by_slug", ["slug"]),
   organizations: defineTable({
     .index("by_org", ["organizationId"])
     .index("by_org_account", ["organizationId", "accountId"])
     .index("by_account", ["accountId"])
-    .index("by_org_status", ["organizationId", "status"])
     .index("by_org_billable_status", ["organizationId", "billable", "status"]),
   workspaceMembers: defineTable({
     .index("by_workspace", ["workspaceId"])
     .index("by_workspace_account", ["workspaceId", "accountId"])
     .index("by_account", ["accountId"])
-    .index("by_workspace_status", ["workspaceId", "status"])
     .index("by_workos_membership_id", ["workosOrgMembershipId"]),
   invites: defineTable({
     email: v.string(),
     role: orgRole,
     status: inviteStatus,
-    provider: inviteProvider,
     providerInviteId: v.optional(v.string()),
     invitedByAccountId: v.id("accounts"),
     expiresAt: v.number(),
     updatedAt: v.number(),
   })
     .index("by_org", ["organizationId"])
-    .index("by_org_status_created", ["organizationId", "status", "createdAt"])
     .index("by_org_email_status", ["organizationId", "email", "status"]),
   billingCustomers: defineTable({
     code: v.string(),
     runtimeId: v.string(),
     workspaceId: v.id("workspaces"),
-    actorId: v.string(),
+    actorId: v.optional(v.string()),
-    clientId: v.string(),
+    clientId: v.optional(v.string()),
     status: taskStatus,
     timeoutMs: v.number(),
     metadata: v.any(),
     resolvedAt: v.optional(v.number()),
   })
     .index("by_approval_id", ["approvalId"])
-    .index("by_task", ["taskId"])
     .index("by_workspace_created", ["workspaceId", "createdAt"])
     .index("by_workspace_status_created", ["workspaceId", "status", "createdAt"]),
     payload: v.any(),
     createdAt: v.number(),
   })
-    .index("by_sequence", ["sequence"])
     .index("by_task_sequence", ["taskId", "sequence"]),
   accessPolicies: defineTable({
     policyId: v.string(),
     workspaceId: v.id("workspaces"),
-    actorId: v.string(),
+    actorId: v.optional(v.string()),
-    clientId: v.string(),
+    clientId: v.optional(v.string()),
     toolPathPattern: v.string(),
     decision: policyDecision,
     priority: v.number(),
     createdAt: v.number(),
     updatedAt: v.number(),
   })
-    .index("by_credential_id", ["credentialId"])
     .index("by_workspace_created", ["workspaceId", "createdAt"])
     .index("by_workspace_source_scope_actor", ["workspaceId", "sourceKey", "scope", "actorId"]),
   })
     .index("by_source_id", ["sourceId"])
     .index("by_workspace_updated", ["workspaceId", "updatedAt"])
-    .index("by_workspace_name", ["workspaceId", "name"])
+    .index("by_workspace_name", ["workspaceId", "name"]),
-    .index("by_workspace_enabled_updated", ["workspaceId", "enabled", "updatedAt"]),
   agentTasks: defineTable({
     agentTaskId: v.string(),
     updatedAt: v.number(),
   })
     .index("by_agent_task_id", ["agentTaskId"])
-    .index("by_workspace_created", ["workspaceId", "createdAt"])
+    .index("by_workspace_created", ["workspaceId", "createdAt"]),
-    .index("by_requester_created", ["requesterId", "createdAt"]),
   openApiSpecCache: defineTable({
     specUrl: v.string(),

executor/convex/workspace.ts+1−4

 import { internal } from "./_generated/api";
 import { mutation, query } from "./_generated/server";
 import { workspaceMutation, workspaceQuery } from "../lib/functionBuilders";
+import { actorIdForAccount } from "../lib/identity";
 const approvalStatusValidator = v.union(v.literal("pending"), v.literal("approved"), v.literal("denied"));
 const policyDecisionValidator = v.union(v.literal("allow"), v.literal("require_approval"), v.literal("deny"));
 const credentialProviderValidator = v.union(v.literal("managed"), v.literal("workos-vault"));
 const toolSourceTypeValidator = v.union(v.literal("mcp"), v.literal("openapi"), v.literal("graphql"));
-function actorIdForAccount(account: { _id: string; provider: string; providerAccountId: string }): string {
-  return account.provider === "anonymous" ? account.providerAccountId : account._id;
-}
 function redactCredential<T extends { secretJson: Record<string, unknown> }>(credential: T): T {
   return {
     ...credential,

executor/convex/workspaceAuthInternal.ts+1−4

 import { v } from "convex/values";
 import { internalQuery } from "./_generated/server";
 import {
+  actorIdForAccount,
   requireWorkspaceAccessForAccount,
   resolveAccountForRequest,
   resolveWorkosAccountBySubject,
 } from "../lib/identity";
-function actorIdForAccount(account: { _id: string; provider: string; providerAccountId: string }): string {
-  return account.provider === "anonymous" ? account.providerAccountId : account._id;
-}
 export const getWorkspaceAccessForRequest = internalQuery({
   args: {
     workspaceId: v.id("workspaces"),

executor/convex/workspaceToolCache.ts+0−18

@@ -72,21 +72,3 @@ export const putEntry = internalMutation({ · 71 unmodified lines
72	});	72	});
73	},	73	},
74	});	74	});
75
76	/**
77	* Look up .d.ts storage IDs for a workspace (used to generate download URLs).
78	*/
79	export const getDtsStorageIds = internalQuery({
80	args: {
81	workspaceId: v.id("workspaces"),
82	},
83	handler: async (ctx, args) => {
84	const entry = await ctx.db
85	.query("workspaceToolCache")
86	.withIndex("by_workspace", (q) => q.eq("workspaceId", args.workspaceId))
87	.unique();
88
89	if (!entry) return [];
90	return entry.dtsStorageIds;
91	},
92	});

executor/convex/workspaces.ts+0−1

@@ -193,7 +193,6 @@ export const create = authedMutation({ · 192 unmodified lines
193	slug,	193	slug,
194	name,	194	name,
195	iconStorageId: args.iconStorageId,	195	iconStorageId: args.iconStorageId,
196	plan: "free",
197	createdByAccountId: account._id,	196	createdByAccountId: account._id,
198	createdAt: now,	197	createdAt: now,
199	updatedAt: now,	198	updatedAt: now,

executor/lib/identity.ts+4−0

@@ -158,3 +158,7 @@ export function isAdminRole(role: string): boolean { · 157 unmodified lines
158	export function canManageBilling(role: string): boolean {	158	export function canManageBilling(role: string): boolean {
159	return role === "owner" \|\| role === "billing_admin";	159	return role === "owner" \|\| role === "billing_admin";
160	}	160	}
		161
		162	export function actorIdForAccount(account: { _id: string; provider: string; providerAccountId: string }): string {
		163	return account.provider === "anonymous" ? account.providerAccountId : account._id;
		164	}

executor/lib/mcp-server.test.ts+2−1

 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { handleMcpRequest } from "./mcp_server";
 import type { LiveTaskEvent } from "./events";
+import type { Id } from "../convex/_generated/dataModel";
 import type { AnonymousContext, CreateTaskInput, TaskRecord, ToolDescriptor } from "./types";
 class FakeMcpService {
     const now = Date.now();
     const context: AnonymousContext = {
       sessionId: sessionId ?? `anon_session_${crypto.randomUUID()}`,
-      workspaceId: `ws_${crypto.randomUUID()}`,
+      workspaceId: `ws_${crypto.randomUUID()}` as Id<"workspaces">,
       actorId: `anon_${crypto.randomUUID()}`,
       clientId: "mcp",
       accountId: `account_${crypto.randomUUID()}`,

executor/lib/mcp_server.ts+10−9

   TaskRecord,
   ToolDescriptor,
 } from "./types";
+import type { Id } from "../convex/_generated/dataModel";
 function getTaskTerminalState(status: string): boolean {
   return status === "completed" || status === "failed" || status === "timed_out" || status === "denied";
 interface McpExecutorService {
   createTask(input: CreateTaskInput): Promise<{ task: TaskRecord }>;
-  getTask(taskId: string, workspaceId?: string): Promise<TaskRecord | null>;
+  getTask(taskId: string, workspaceId?: Id<"workspaces">): Promise<TaskRecord | null>;
   subscribe(taskId: string, listener: (event: LiveTaskEvent) => void): () => void;
   bootstrapAnonymousContext(sessionId?: string): Promise<AnonymousContext>;
-  listTools(context?: { workspaceId: string; actorId?: string; clientId?: string }): Promise<ToolDescriptor[]>;
+  listTools(context?: { workspaceId: Id<"workspaces">; actorId?: string; clientId?: string }): Promise<ToolDescriptor[]>;
   listToolsForTypecheck?(
-    context: { workspaceId: string; actorId?: string; clientId?: string },
+    context: { workspaceId: Id<"workspaces">; actorId?: string; clientId?: string },
   ): Promise<{ tools: ToolDescriptor[]; dtsUrls: Record<string, string> }>;
-  listPendingApprovals?(workspaceId: string): Promise<PendingApprovalRecord[]>;
+  listPendingApprovals?(workspaceId: Id<"workspaces">): Promise<PendingApprovalRecord[]>;
   resolveApproval?(input: {
-    workspaceId: string;
+    workspaceId: Id<"workspaces">;
     approvalId: string;
     decision: "approved" | "denied";
     reviewerId?: string;
 }
 interface ApprovalPromptContext {
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   actorId: string;
 }
 // ---------------------------------------------------------------------------
 export interface McpWorkspaceContext {
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   actorId: string;
   clientId?: string;
   sessionId?: string;
 function waitForTerminalTask(
   service: McpExecutorService,
   taskId: string,
-  workspaceId: string,
+  workspaceId: Id<"workspaces">,
   waitTimeoutMs: number,
   onApprovalPrompt?: ApprovalPrompt,
   approvalContext?: ApprovalPromptContext,
     const requestedTimeoutMs = input.timeoutMs ?? 300_000;
     // Resolve context: bound context takes priority, then input, then anonymous
-    let context: { workspaceId: string; actorId: string; clientId?: string; sessionId?: string };
+    let context: { workspaceId: Id<"workspaces">; actorId: string; clientId?: string; sessionId?: string };
     if (boundContext) {
       context = { ...boundContext, sessionId: input.sessionId ?? boundContext.sessionId };

executor/lib/runtimes/runtime-core.test.ts+2−1

 import { expect, test } from "bun:test";
 import { runCodeWithAdapter } from "./runtime_core";
 import { loadExternalTools } from "../tool_sources";
+import type { Id } from "../../convex/_generated/dataModel";
 import type {
   ExecutionAdapter,
   RuntimeOutputEvent,
       try {
         const context: ToolRunContext = {
           taskId: call.runId,
-          workspaceId: "ws_test",
+          workspaceId: "ws_test" as Id<"workspaces">,
           actorId: "actor_test",
           clientId: "web",
           isToolAllowed: () => true,

executor/lib/tool-discovery.test.ts+10−7

 import { expect, test } from "bun:test";
+import type { Id } from "../convex/_generated/dataModel";
 import { createDiscoverTool } from "./tool_discovery";
 import type { ToolDefinition } from "./types";
+const TEST_WORKSPACE_ID = "w" as Id<"workspaces">;
 test("discover returns aliases and example calls", async () => {
   const tool = createDiscoverTool([
     {
   const result = await tool.run(
     { query: "addnumbers", depth: 2 },
-    { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+    { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
   ) as {
     bestPath: string | null;
     results: Array<{
   const result = await tool.run(
     { query: "issuecreate", depth: 2 },
-    { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+    { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
   ) as {
     bestPath: string | null;
     results: Array<{ exampleCall: string }>;
   const compactResult = await tool.run(
     { query: "linear teams", depth: 2 },
-    { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+    { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
   ) as {
     bestPath: string | null;
     results: Array<{ description: string; signature: string }>;
   const fullResult = await tool.run(
     { query: "linear teams", depth: 2, compact: false },
-    { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+    { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
   ) as {
     bestPath: string | null;
     results: Array<{ description: string; signature: string }>;
   const result = await tool.run(
     { query: "totally_unrelated_keyword" },
-    { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+    { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
   ) as { bestPath: string | null; results: Array<unknown>; total: number };
   expect(result.bestPath).toBeNull();
   const result = await tool.run(
     { query: "linear issue create", depth: 2 },
-    { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+    { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
   ) as { bestPath: string | null; results: Array<{ path: string }> };
   expect(result.bestPath).toBe("linear.mutation.issuecreate");
   const result = await tool.run(
     { query: "linear teams list", depth: 2 },
-    { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+    { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
   ) as { bestPath: string | null; results: Array<{ path: string }> };
   expect(result.bestPath).toBe("linear.query.teams");

executor/lib/tool-sources.test.ts+4−1

 import { expect, test } from "bun:test";
+import type { Id } from "../convex/_generated/dataModel";
 import { loadExternalTools } from "./tool_sources";
 import type { ExternalToolSourceConfig } from "./tool_sources";
+const TEST_WORKSPACE_ID = "w" as Id<"workspaces">;
 function makeInlineSpec(tag: string, operationId: string): Record<string, unknown> {
   return {
     openapi: "3.0.3",
     expect(batchTool).toBeDefined();
     expect(rawTool).toBeDefined();
-    const context = { taskId: "t", workspaceId: "w", isToolAllowed: () => true };
+    const context = { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true };
     const teamsResult = await teamsTool!.run({}, context);
     const batchResult = await batchTool!.run({ input: { issues: ["one"] } }, context);

executor/lib/types.ts+9−7

 // ── Shared types (inlined from @executor/contracts) ──────────────────────────
+import type { Id } from "../convex/_generated/dataModel";
 export type TaskStatus = "queued" | "running" | "completed" | "failed" | "timed_out" | "denied";
 export type ApprovalStatus = "pending" | "approved" | "denied";
 export type PolicyDecision = "allow" | "require_approval" | "deny";
   status: TaskStatus;
   timeoutMs: number;
   metadata: Record<string, unknown>;
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   actorId?: string;
   clientId?: string;
   createdAt: number;
 export interface AccessPolicyRecord {
   id: string;
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   actorId?: string;
   clientId?: string;
   toolPathPattern: string;
 export interface CredentialRecord {
   id: string;
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   sourceKey: string;
   scope: CredentialScope;
   actorId?: string;
 export interface ToolSourceRecord {
   id: string;
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   name: string;
   type: ToolSourceType;
   config: Record<string, unknown>;
 export interface AnonymousContext {
   sessionId: string;
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   actorId: string;
   clientId: string;
   accountId: string;
   timeoutMs?: number;
   runtimeId?: string;
   metadata?: Record<string, unknown>;
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   actorId: string;
   clientId?: string;
 }
 export interface ToolRunContext {
   taskId: string;
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   actorId?: string;
   clientId?: string;
   credential?: ResolvedToolCredential;

executor/lib/workspace-tool-cache.test.ts+6−5

 } from "./tool_sources";
 import type { ToolDefinition } from "./types";
+const TEST_WORKSPACE_ID = "w" as Id<"workspaces">;
 function makeBaseTools(): Map<string, ToolDefinition> {
   return new Map([
     [
     // The rehydrated run should work
     const result = await rehydrated[0]!.run(
       { message: "hello" },
-      { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+      { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
     );
     expect(result).toBe("hello");
   });
     try {
       const rawResult = await rawTool!.run(
         { query: "query viewer { viewer { id } }" },
-        { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+        { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
       );
       const teamsResult = await teamsTool!.run(
         {},
-        { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+        { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
       );
       expect(rawResult).toEqual({ data: { viewer: { id: "user_1" } }, errors: [] });
     const echoTool = rehydrated.find((t) => t.path === "echo")!;
     const result = await echoTool.run(
       { message: "round-trip" },
-      { taskId: "t", workspaceId: "w", isToolAllowed: () => true },
+      { taskId: "t", workspaceId: TEST_WORKSPACE_ID, isToolAllowed: () => true },
     );
     expect(result).toBe("round-trip");
         name: "test-ws",
         slug: "test-ws",
         organizationId: orgId,
-        plan: "free",
         createdAt: Date.now(),
         updatedAt: Date.now(),
       });

executor/mcp-gateway.ts+24−14

   return payload.sub;
 }
+/**
+ * Validated boundary for external workspace ID strings.
+ * Convex IDs are opaque strings at runtime; this cast is the single
+ * validated entry point so downstream code never needs ad-hoc casts.
+ */
+function parseWorkspaceId(raw: string): Id<"workspaces"> {
+  return raw as Id<"workspaces">;
+}
 function parseRequestedContext(url: URL): {
-  workspaceId?: string;
+  workspaceId?: Id<"workspaces">;
   actorId?: string;
   clientId?: string;
   sessionId?: string;
 } {
-  const workspaceId = url.searchParams.get("workspaceId") ?? undefined;
+  const rawWorkspaceId = url.searchParams.get("workspaceId");
+  const workspaceId = rawWorkspaceId ? parseWorkspaceId(rawWorkspaceId) : undefined;
   const actorId = url.searchParams.get("actorId") ?? undefined;
   const clientId = url.searchParams.get("clientId") ?? undefined;
   const sessionId = url.searchParams.get("sessionId") ?? undefined;
       timeoutMs?: number;
       runtimeId?: string;
       metadata?: Record<string, unknown>;
-      workspaceId: string;
+      workspaceId: Id<"workspaces">;
       actorId: string;
       clientId?: string;
     }) => {
       const created = await convex.mutation(api.executor.createTask, {
-        workspaceId: input.workspaceId as Id<"workspaces">,
+        workspaceId: input.workspaceId,
         sessionId,
         code: input.code,
         timeoutMs: input.timeoutMs,
       return created as { task: TaskRecord };
     },
-    getTask: async (taskId: string, workspace?: string) => {
+    getTask: async (taskId: string, workspace?: Id<"workspaces">) => {
       const effectiveWorkspaceId = workspace ?? workspaceId;
       if (!effectiveWorkspaceId) {
         return null;
       }
       const task = await convex.query(api.workspace.getTaskInWorkspace, {
-        workspaceId: effectiveWorkspaceId as Id<"workspaces">,
+        workspaceId: effectiveWorkspaceId,
         sessionId,
         taskId,
       });
       return bootstrap as AnonymousContext;
     },
-    listTools: async (toolContext?: { workspaceId: string; actorId?: string; clientId?: string }) => {
+    listTools: async (toolContext?: { workspaceId: Id<"workspaces">; actorId?: string; clientId?: string }) => {
       if (!toolContext) {
         return [];
       }
       const tools = await convex.action(api.executorNode.listTools, {
-        workspaceId: toolContext.workspaceId as Id<"workspaces">,
+        workspaceId: toolContext.workspaceId,
         sessionId,
         actorId: toolContext.actorId,
         clientId: toolContext.clientId,
       return tools as ToolDescriptor[];
     },
-    listPendingApprovals: async (approvalWorkspaceId: string) => {
+    listPendingApprovals: async (approvalWorkspaceId: Id<"workspaces">) => {
       const approvals = await convex.query(api.workspace.listPendingApprovals, {
-        workspaceId: approvalWorkspaceId as Id<"workspaces">,
+        workspaceId: approvalWorkspaceId,
         sessionId,
       });
       return approvals as PendingApprovalRecord[];
     },
     resolveApproval: async (input: {
-      workspaceId: string;
+      workspaceId: Id<"workspaces">;
       approvalId: string;
       decision: "approved" | "denied";
       reviewerId?: string;
       reason?: string;
     }) => {
       return await convex.mutation(api.executor.resolveApproval, {
-        workspaceId: input.workspaceId as Id<"workspaces">,
+        workspaceId: input.workspaceId,
         sessionId,
         approvalId: input.approvalId,
         decision: input.decision,
 async function resolveContext(
   requested: {
-    workspaceId?: string;
+    workspaceId?: Id<"workspaces">;
     actorId?: string;
     clientId?: string;
     sessionId?: string;
   }
   const requestContext = await convex.query(api.workspace.getRequestContext, {
-    workspaceId: requested.workspaceId as Id<"workspaces">,
+    workspaceId: requested.workspaceId,
     sessionId: requested.sessionId,
   });