feat(workflows): expose authenticated run subjects

[TheodoreSpeaks]

Summary

• preserve authenticated principals across synchronous, queued, resumed, and nested workflow execution
• expose normalized Sim user, chat email, and provider subjects through optional Start run metadata
• keep actorless callers identity-free and enforce subject-scoped credential access

Type of Change

• New feature

Testing

• 771 tests across 31 changed test files
• bun run lint
• bun run check:audits (33 audits)

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 27, 2026 2:41am

[greptile-apps]

Greptile Summary

The PR preserves authenticated workflow subjects across chat authentication, execution boundaries, and nested runs, then exposes normalized subject metadata to Start blocks.

• Adds authenticated-email claims to signed deployment cookies and chat execution principals.
• Propagates principals through queued, resumed, and nested workflow execution.
• Exposes normalized Sim-user, authenticated-email, and external-provider subjects in optional Start metadata.
• Enforces subject consistency for delegated credential access.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/api/chat/utils.test.ts	Replaces the previously flagged ad-hoc cookie fixtures with typed NextRequest instances and real Cookie headers, resolving the prior review issue.
apps/sim/lib/core/security/deployment.ts	Extends signed deployment-auth tokens with normalized authenticated-email claims while safely rejecting identity-free legacy email tokens.
apps/sim/lib/workflows/executor/start-run-identity.ts	Normalizes supported principal subjects into the optional Start-block run metadata contract.
apps/sim/executor/handlers/workflow/workflow-handler.ts	Preserves the original execution principal while updating nested-workflow delegation scope.
packages/auth/src/principal.ts	Adds authenticated-email subjects and centralized subject resolution for supported workflow principals.

Sequence Diagram

sequenceDiagram
  participant Caller
  participant Auth as Deployment Auth
  participant Runner as Workflow Runner
  participant Queue as Queue/Snapshot
  participant Child as Nested Workflow
  participant Start as Start Block

  Caller->>Auth: Authenticate request
  Auth-->>Runner: Signed principal and subject
  Runner->>Queue: Serialize execution principal
  Queue-->>Runner: Restore execution principal
  Runner->>Child: Preserve caller principal and workflow scope
  Runner->>Start: Resolve normalized run subject
  Start-->>Caller: Optional trusted run metadata

Loading

_{Reviews (5): Last reviewed commit: "fix(workflows): remove duplicate run ema..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 90 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile