fix(copilot): gate materialize_file writes and enforce the deploy mutation lock

materialize_file's save/extract/import all create workspace resources, but
the handler-map path has no central permission check, so a read-only member
could create files and workflows through the agent. Gate on write access
after param validation.

assertWorkflowMutable moves into performFullDeploy / performFullUndeploy /
performActivateVersion, where performRevertToVersion already had it. The
check previously lived only in the deploy routes, so the copilot deploy
tools — which call the orchestration functions directly — could deploy,
undeploy, and activate versions of a locked workflow.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: TheodoreSpeaks

apps/sim/lib/copilot/tools/handlers/materialize-file.test.ts

@@ -28,6 +28,10 @@ const {
   mockResolveStorageBillingContext: vi.fn(),
 }))
 
+vi.mock('@/lib/copilot/tools/handlers/access', () => ({
+  ensureWorkspaceAccess: vi.fn(),
+}))
+
 vi.mock('@/lib/copilot/tools/handlers/upload-file-reader', () => ({
   findMothershipUploadRowByChatAndName: mockFindUpload,
 }))
@@ -128,6 +132,36 @@ const mothershipRow = {
   updatedAt: new Date('2026-01-01'),
 }
 
+describe('executeMaterializeFile - workspace write gate', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+  })
+
+  it.each(['save', 'import', 'extract'])(
+    'refuses %s without workspace write access and touches no upload',
+    async (operation) => {
+      const { ensureWorkspaceAccess } = await import('@/lib/copilot/tools/handlers/access')
+      vi.mocked(ensureWorkspaceAccess).mockRejectedValueOnce(
+        new Error('Write access required for this workspace')
+      )
+
+      const result = await executeMaterializeFile({ fileNames: ['a.json'], operation }, context)
+
+      expect(result.success).toBe(false)
+      expect(result.error).toContain('Write access required')
+      expect(mockFindUpload).not.toHaveBeenCalled()
+    }
+  )
+
+  it('requires write, not merely read, access', async () => {
+    const { ensureWorkspaceAccess } = await import('@/lib/copilot/tools/handlers/access')
+    await executeMaterializeFile({ fileNames: ['a.json'], operation: 'save' }, context)
+
+    expect(ensureWorkspaceAccess).toHaveBeenCalledWith(context.workspaceId, context.userId, 'write')
+  })
+})
+
 describe('executeMaterializeFile - unsupported operation', () => {
   beforeEach(() => {
     vi.clearAllMocks()

apps/sim/lib/copilot/tools/handlers/materialize-file.ts

@@ -12,6 +12,7 @@ import {
   resolveStorageBillingContext,
 } from '@/lib/billing/storage'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
+import { ensureWorkspaceAccess } from '@/lib/copilot/tools/handlers/access'
 import { findMothershipUploadRowByChatAndName } from '@/lib/copilot/tools/handlers/upload-file-reader'
 import { canonicalWorkspaceFilePath, encodeVfsPathSegments } from '@/lib/copilot/vfs/path-utils'
 import { getServePathPrefix } from '@/lib/uploads'
@@ -504,6 +505,15 @@ export async function executeMaterializeFile(
       error: `Unsupported materialize_file operation "${operation}". Use "save", "import", or "extract". For CSV/TSV/JSON → use the table subagent; for documents → use the knowledge subagent.`,
     }
   }
+
+  // Every operation writes: save/extract create files, import creates a workflow.
+  // The handler-map path has no central permission gate.
+  try {
+    await ensureWorkspaceAccess(context.workspaceId, context.userId, 'write')
+  } catch (error) {
+    return { success: false, error: getErrorMessage(error, 'Workspace write access required') }
+  }
+
   const succeeded: string[] = []
   const failed: Array<{ fileName: string; error: string }> = []
   const resources: NonNullable<ToolCallResult['resources']> = []

apps/sim/lib/copilot/tools/permissions.test.ts

@@ -6,10 +6,6 @@ import { copilotToolCanWrite, copilotWriteDeniedMessage } from '@/lib/copilot/to
 
 describe('copilotToolCanWrite', () => {
   it('fails closed when the permission is absent', () => {
-    // The regression this exists for: the previous `perm && perm !== 'write' &&
-    // perm !== 'admin'` ladders skipped the check entirely for these values,
-    // letting an ungated write through. userPermission is optional on the
-    // execution context, so every one of these is reachable.
     expect(copilotToolCanWrite(undefined)).toBe(false)
     expect(copilotToolCanWrite(null)).toBe(false)
     expect(copilotToolCanWrite('')).toBe(false)

apps/sim/lib/copilot/tools/permissions.ts

@@ -1,15 +1,9 @@
 import { type PermissionType, permissionSatisfies } from '@sim/platform-authz/workspace'
 
 /**
- * Whether a copilot tool call may perform a write, given the workspace
- * permission resolved for the request.
- *
- * **Fails closed.** `ExecutionContext.userPermission` is optional, so an absent
- * value must deny — the hand-written `perm && perm !== 'write' && perm !==
- * 'admin'` ladders this replaces skipped the check entirely when the field was
- * undefined, letting a write through unguarded. Shared by the server-tool
- * router and the handler-map tools so the two copilot execution paths cannot
- * disagree about what "write access" means.
+ * Whether a copilot tool call may write. Fails closed: `userPermission` is
+ * optional on the execution context, and absent must deny. Shared by the
+ * server-tool router and the handler-map tools.
  */
 export function copilotToolCanWrite(userPermission: string | null | undefined): boolean {
   return permissionSatisfies((userPermission ?? null) as PermissionType | null, 'write')

apps/sim/lib/workflows/orchestration/deploy.ts

@@ -119,6 +119,10 @@ export async function performFullDeploy(
   const actorId = params.actorId ?? userId
   const requestId = params.requestId ?? generateRequestId()
 
+  // Backstop for every caller — routes may assert first to render their own 423,
+  // but the copilot deploy tools call this directly.
+  await assertWorkflowMutable(workflowId)
+
   const [workflowRecord] = await db
     .select()
     .from(workflowTable)
@@ -458,6 +462,8 @@ export async function performFullUndeploy(
   const actorId = params.actorId ?? userId
   const requestId = params.requestId ?? generateRequestId()
 
+  await assertWorkflowMutable(workflowId)
+
   const [workflowRecord] = await db
     .select()
     .from(workflowTable)
@@ -568,6 +574,8 @@ export async function performActivateVersion(
   const actorId = params.actorId ?? userId
   const requestId = params.requestId ?? generateRequestId()
 
+  await assertWorkflowMutable(workflowId)
+
   const [versionRow] = await db
     .select({
       id: workflowDeploymentVersion.id,