fix(tools): honor a tool's declared credential selector, and refuse its aliases first

Sixty-eight tools — Snowflake among them — declare the credential selector as a
required `user-only` parameter (`oauthCredential` or `credential`) with no
`oauth` block, filled by their block from an `oauth-input` field. The
required-input check ran against the raw body, before the top-level
`credentialId` had been placed anywhere, so a valid credential was rejected as
a missing `oauthCredential`. And the alias refusal ran only over *undeclared*
keys, so `input.oauthCredential` on such a tool passed the declared-key check
and bypassed the top-level field — credential precedence differing per tool.

The credential is still named once, at the top level. It now lands under
whichever selector the tool declares (or `credential`, which the executor reads
for OAuth resolution, when it declares none), and required inputs are validated
against what the executor will actually receive. A declared required selector
also demands `credentialId` up front, the same as an `oauth` block does. The
alias refusal is unconditional and runs first.

Verified live: a Snowflake call with a top-level credential passes the
validator and fails downstream at resolution; `input.oauthCredential` is
refused; omitting the credential names `credentialId` as required.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/tool-execution/application/execute-tool.test.ts

@@ -114,6 +114,14 @@ const TOOL_METADATA: Record<string, Record<string, unknown>> = {
     },
     hosting: { apiKeyParam: 'apiKey' },
   },
+  snowflake_execute_sql: {
+    id: 'snowflake_execute_sql',
+    name: 'Snowflake Execute SQL',
+    params: {
+      oauthCredential: { type: 'string', required: true, visibility: 'user-only' },
+      statement: { type: 'string', required: true, visibility: 'user-or-llm' },
+    },
+  },
   thinking_tool: {
     id: 'thinking_tool',
     name: 'Thinking',
@@ -176,6 +184,7 @@ const previewBlock = block({
 })
 const zendeskBlock = block({ type: 'zendesk', tools: { access: ['zendesk_get_ticket'] } })
 const thinkingBlock = block({ type: 'thinking', tools: { access: ['thinking_tool'] } })
+const snowflakeBlock = block({ type: 'snowflake', tools: { access: ['snowflake_execute_sql'] } })
 const confluenceBlock = block({
   type: 'confluence_v2',
   tools: { access: ['confluence_read_v2'] },
@@ -213,6 +222,7 @@ describe('executeToolForCaller', () => {
       confluenceBlock,
       zendeskBlock,
       thinkingBlock,
+      snowflakeBlock,
     ])
     mocks.executeRegistryTool.mockResolvedValue({ success: true, output: { markdown: '# Hi' } })
     mocks.resolveBillingAttribution.mockResolvedValue({ workspaceId: WORKSPACE_ID })
@@ -391,6 +401,54 @@ describe('executeToolForCaller', () => {
     expect(mocks.executeRegistryTool).not.toHaveBeenCalled()
   })
 
+  /**
+   * Sixty-eight tools declare the selector as a required `user-only` parameter
+   * (`oauthCredential` or `credential`) with no `oauth` block — Snowflake among
+   * them. Validating required inputs against the raw body rejected a valid
+   * top-level `credentialId` as a missing `oauthCredential`.
+   */
+  it('satisfies a declared credential selector with the top-level credentialId', async () => {
+    await expect(
+      run({
+        toolId: 'snowflake_execute_sql',
+        credentialId: 'cred-sf',
+        input: { statement: 'select 1' },
+      })
+    ).resolves.toMatchObject({ status: 'succeeded' })
+
+    const [, params] = mocks.executeRegistryTool.mock.calls[0]
+    expect(params.oauthCredential).toBe('cred-sf')
+    expect(params.credential).toBeUndefined()
+  })
+
+  it('demands credentialId for a declared required selector even without an oauth block', async () => {
+    await expect(
+      run({ toolId: 'snowflake_execute_sql', input: { statement: 'select 1' } })
+    ).rejects.toMatchObject({
+      code: 'validation',
+      message: expect.stringContaining('credentialId is required'),
+    })
+    expect(mocks.executeRegistryTool).not.toHaveBeenCalled()
+  })
+
+  /**
+   * The alias check has to run before the declared-key check, or a tool that
+   * declares `oauthCredential` lets a caller bypass the top-level field and
+   * credential precedence starts differing per tool.
+   */
+  it('refuses input.oauthCredential even where the tool declares it', async () => {
+    await expect(
+      run({
+        toolId: 'snowflake_execute_sql',
+        input: { statement: 'select 1', oauthCredential: 'cred-sf' },
+      })
+    ).rejects.toMatchObject({
+      code: 'validation',
+      message: expect.stringContaining('top-level credentialId'),
+    })
+    expect(mocks.executeRegistryTool).not.toHaveBeenCalled()
+  })
+
   it('passes the named credential through as the tool credential', async () => {
     await run({ toolId: 'slack_message', input: { text: 'hi' }, credentialId: 'cred-1' })
 

apps/sim/lib/tool-execution/application/execute-tool.ts

@@ -64,6 +64,30 @@ function hostedKeyParamFor(
   return tool.hosting.apiKeyParam
 }
 
+/**
+ * The three spellings the executor accepts for "which credential".
+ *
+ * Inside the executor they are interchangeable: `normalizeCopilotCredentialParams`
+ * folds `credentialId` into `credential`, and `oauthCredential` is copied onto
+ * `credential` before resolution. On a public contract the credential is named
+ * once, at the top level, and mapped onto whichever of these the tool declares.
+ */
+const CREDENTIAL_SELECTORS = ['credential', 'credentialId', 'oauthCredential'] as const
+
+/**
+ * The credential-selector parameter a tool declares, if it declares one.
+ *
+ * Two shapes exist. A tool with an `oauth` block hides `accessToken` and lets
+ * resolution fill it, declaring no selector at all. Sixty-eight others —
+ * Snowflake among them — declare the selector itself as a required `user-only`
+ * parameter (`oauthCredential` or `credential`) that their block fills from an
+ * `oauth-input` field. Both are the same contract to a caller: a top-level
+ * `credentialId`, placed where the tool expects it.
+ */
+function declaredCredentialSelector(tool: ExecutableToolConfig): string | undefined {
+  return CREDENTIAL_SELECTORS.find((name) => tool.params?.[name] !== undefined)
+}
+
 /**
  * Refuses an input key the tool does not declare.
  *
@@ -94,6 +118,22 @@ function assertNoUndeclaredInputs(
 ): void {
   const params = tool.params ?? {}
 
+  /**
+   * Unconditional, and first: a tool may *declare* `oauthCredential` as a
+   * parameter, and it would otherwise pass the declared-key check below and
+   * bypass the top-level `credentialId` — giving credential precedence that
+   * differs from one tool to the next.
+   */
+  const credentialAlias = Object.keys(args).find((key) =>
+    (CREDENTIAL_SELECTORS as readonly string[]).includes(key)
+  )
+  if (credentialAlias) {
+    throw new OrchestrationError(
+      'validation',
+      `input.${credentialAlias} is not accepted; pass the credential as the top-level credentialId field`
+    )
+  }
+
   /**
    * Declared is not the same as accepted. A `hidden` parameter is Sim's to fill
    * — a resolved credential's `accessToken`, a hosted key, a block-composed
@@ -113,16 +153,6 @@ function assertNoUndeclaredInputs(
   const undeclared = Object.keys(args).filter((key) => !Object.hasOwn(params, key))
   if (undeclared.length === 0) return
 
-  const credentialAlias = undeclared.find((key) =>
-    ['credential', 'credentialId', 'oauthCredential'].includes(key)
-  )
-  if (credentialAlias) {
-    throw new OrchestrationError(
-      'validation',
-      `input.${credentialAlias} is not accepted; pass the credential as the top-level credentialId field`
-    )
-  }
-
   throw new OrchestrationError(
     'validation',
     `${toolId} does not accept ${undeclared.map((key) => `input.${key}`).join(', ')}`
@@ -234,14 +264,30 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
 
     const tool = getTool(toolId)
     if (!tool) throw new OrchestrationError('not_found', 'Tool not found')
-    if (tool.oauth?.required && !input.credentialId) {
+    assertNoUndeclaredInputs(tool, toolId, input.input)
+
+    const selector = declaredCredentialSelector(tool)
+    const requiresCredential =
+      tool.oauth?.required === true || (selector !== undefined && tool.params[selector]?.required)
+    if (requiresCredential && !input.credentialId) {
       throw new OrchestrationError(
         'validation',
-        `credentialId is required: ${toolId} authenticates with a ${tool.oauth.provider} credential`
+        `credentialId is required: ${toolId} authenticates with a ${tool.oauth?.provider ?? 'connected'} credential`
       )
     }
-    assertNoUndeclaredInputs(tool, toolId, input.input)
-    assertRequiredCallerInputsPresent(tool, toolId, input.input)
+
+    /**
+     * What the executor will receive, minus `_context`. The credential lands
+     * under the selector the tool declares, so a declared required
+     * `oauthCredential` is satisfied by the top-level `credentialId` rather than
+     * rejected as missing; a tool that declares none gets `credential`, which the
+     * executor reads for OAuth resolution.
+     */
+    const callerParams: Record<string, unknown> = {
+      ...input.input,
+      ...(input.credentialId ? { [selector ?? 'credential']: input.credentialId } : {}),
+    }
+    assertRequiredCallerInputsPresent(tool, toolId, callerParams)
 
     const userId = principalUserId(principal)
     if (!userId) {
@@ -254,8 +300,7 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
     })
 
     const params: Record<string, unknown> = {
-      ...input.input,
-      ...(input.credentialId ? { credential: input.credentialId } : {}),
+      ...callerParams,
       _context: {
         userId,
         workspaceId: context.workspaceId,