fix(copilot): sanitize edit_workflow result state before returning it to the agent

[j15z]

Summary

• edit_workflow returned the raw post-layout workflow state in its result, so the agent saw every block's position, height, layout, and outputs and could quote canvas coordinates back to the user
• route the returned workflowState through sanitizeForCopilot — the same projection state.json already uses — so the agent gets the same shape in both places (block ids, inputs, connections, nested subflows) and no UI-only fields
• drop the redundant raw workflowState from set_block_enabled, which already returned the sanitized copy alongside it
• no consumer reads the raw contents: the canvas re-fetches state from the DB after an edit, the Go side only checks for the key's presence, and edit_workflow declares no result schema

Type of Change

• Bug fix

Testing

Tested manually. type-check, lint, check:audits, and the edit-workflow / workflow-handler test suites pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 20, 2026 9:42pm

[cursor]

PR Summary

Low Risk
Narrow Copilot tool-result shaping; persistence and canvas refresh are unchanged. Main risk is agent behavior if it previously relied on layout fields.

Overview
Stops Copilot from receiving canvas-only workflow fields after edits.

edit_workflow now runs the persisted state through sanitizeForCopilot before returning it, matching the projection used elsewhere (block ids, inputs, connections, nested subflows — no position/height/layout/outputs). set_block_enabled drops the extra raw workflowState and keeps only the already-sanitized copy.

^{Reviewed by Cursor Bugbot for commit be80833. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR prevents raw workflow state from being exposed in Copilot mutation results and aligns edit_workflow with the existing agent-facing state projection.

• Sanitizes the returned edit_workflow state using sanitizeForCopilot.
• Removes the redundant raw state from set_block_enabled while retaining its sanitized copy.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete regressions identified in the changed result contracts.

The sanitized edit result matches the established agent-facing workflow representation, subsequent edits reload persisted state, and no consumer requires the removed raw state field.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/tools/handlers/workflow/mutations.ts	Removes an unused raw workflow-state field while preserving the existing sanitized result.
apps/sim/lib/copilot/tools/server/workflow/edit-workflow/index.ts	Returns the persisted workflow through the same sanitization projection already used for Copilot state.json.

_{Reviews (1): Last reviewed commit: "fix(copilot): sanitize edit_workflow res..." | Re-trigger Greptile}