fix(tools): refuse a caller-supplied hidden parameter

Declared was being treated as accepted. A `hidden` parameter is Sim's to fill —
a resolved credential's `accessToken`, a hosted key, a block-composed shape —
and `createUserToolSchema` omits it from what this endpoint and Copilot
publish. Accepting it anyway either let a caller pre-empt the executor's value
or silently discarded theirs when the executor overwrote it; either way the
published schema made no such promise.

The accept-set is now exactly the publish-set: a key is taken if and only if
`GET /api/v2/tools/{toolId}` lists it as something the caller may send. This is
the rule the required-input check already followed ("Sim fills it, or the caller
must"), applied to the other direction.

Verified live against a dev server: a forged `accessToken` on `gmail_read_v2`
is refused before dispatch, and the credential-backed read still succeeds.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/tool-execution/application/execute-tool.test.ts

@@ -99,7 +99,10 @@ const TOOL_METADATA: Record<string, Record<string, unknown>> = {
   slack_message: {
     id: 'slack_message',
     name: 'Slack Send Message',
-    params: { text: { type: 'string', required: true, visibility: 'user-or-llm' } },
+    params: {
+      accessToken: { type: 'string', required: true, visibility: 'hidden' },
+      text: { type: 'string', required: true, visibility: 'user-or-llm' },
+    },
     oauth: { required: true, provider: 'slack' },
   },
   firecrawl_scrape: {
@@ -429,6 +432,26 @@ describe('executeToolForCaller', () => {
     expect(mocks.executeRegistryTool).not.toHaveBeenCalled()
   })
 
+  /**
+   * Declared is not accepted. `accessToken` is in the tool's params, but as
+   * `hidden` — the resolved credential fills it. Letting a caller send it either
+   * pre-empts the executor's value or is silently overwritten; either way the
+   * published schema (which omits hidden params) made no such promise.
+   */
+  it('refuses a declared-but-hidden input, saying whose it is', async () => {
+    await expect(
+      run({
+        toolId: 'slack_message',
+        credentialId: 'cred-1',
+        input: { text: 'hi', accessToken: 'xoxb-forged' },
+      })
+    ).rejects.toMatchObject({
+      code: 'validation',
+      message: expect.stringContaining('input.accessToken is supplied by Sim'),
+    })
+    expect(mocks.executeRegistryTool).not.toHaveBeenCalled()
+  })
+
   it('refuses any other undeclared input, naming it', async () => {
     await expect(run({ input: { url: 'https://a.co', nope: 1 } })).rejects.toMatchObject({
       code: 'validation',

apps/sim/lib/tool-execution/application/execute-tool.ts

@@ -77,6 +77,10 @@ function hostedKeyParamFor(
  * parameter list is the actual boundary, and it is what
  * `GET /api/v2/tools/{toolId}` already publishes.
  *
+ * Together with the `hidden` refusal above, the accept-set is exactly the
+ * publish-set: a key is taken if and only if `GET /api/v2/tools/{toolId}`
+ * lists it as something the caller may send.
+ *
  * Also collapses the credential spellings. The executor accepts `credential`,
  * `credentialId` and `oauthCredential` interchangeably, which is fine where one
  * caller writes one of them and wrong on a public contract: three spellings with
@@ -88,7 +92,25 @@ function assertNoUndeclaredInputs(
   toolId: string,
   args: Record<string, unknown>
 ): void {
-  const undeclared = Object.keys(args).filter((key) => !Object.hasOwn(tool.params ?? {}, key))
+  const params = tool.params ?? {}
+
+  /**
+   * Declared is not the same as accepted. A `hidden` parameter is Sim's to fill
+   * — a resolved credential's `accessToken`, a hosted key, a block-composed
+   * shape — and `createUserToolSchema` omits it from what this endpoint and
+   * Copilot publish. Accepting it anyway either lets a caller pre-empt the
+   * executor's value or silently discards theirs when the executor overwrites
+   * it, and both are a contract the published schema does not make.
+   */
+  const hidden = Object.keys(args).filter((key) => params[key]?.visibility === 'hidden')
+  if (hidden.length > 0) {
+    throw new OrchestrationError(
+      'validation',
+      `${hidden.map((key) => `input.${key}`).join(', ')} ${hidden.length === 1 ? 'is' : 'are'} supplied by Sim, not by the caller`
+    )
+  }
+
+  const undeclared = Object.keys(args).filter((key) => !Object.hasOwn(params, key))
   if (undeclared.length === 0) return
 
   const credentialAlias = undeclared.find((key) =>