Sweep fixes: guarded sandbox writes, canonical token grammars

writeSessionSandboxFile degrades on failure instead of throwing — the
CLI invocation it follows already ran, possibly a mutation, and an
escaping error reported that success as failure and invited a
repeating retry (sim-cli maps the new error outcome to the inline
fallback). The deps and lint agent commands now use the executor's own
createReferencePattern/createEnvVarPattern with trimmed keys, so what
they classify is exactly what the runtime resolves — three private
regex re-inventions deleted.

Claude-Session: https://claude.ai/code/session_01CgaxNAaeD3taGdghbXn17w

Author: Sg312

apps/sim/lib/execution/remote-sandbox/session-files.ts

@@ -58,7 +58,10 @@ export async function readSessionSandboxFile(
   }
 }
 
-export type SessionFileWrite = { outcome: 'written'; path: string } | { outcome: 'no-session' }
+export type SessionFileWrite =
+  | { outcome: 'written'; path: string }
+  | { outcome: 'no-session' }
+  | { outcome: 'error'; detail: string }
 
 export async function writeSessionSandboxFile(
   sessionKey: string,
@@ -79,6 +82,18 @@ export async function writeSessionSandboxFile(
   }
   if (!sandbox) return { outcome: 'no-session' }
   const resolved = resolveSessionPath(path)
-  await sandbox.writeFile(resolved, content)
+  try {
+    await sandbox.writeFile(resolved, content)
+  } catch (error) {
+    // A failed write must degrade, never throw: the CLI invocation it follows
+    // already ran — possibly a mutation — and an escaping error here would
+    // report that successful call as failed and invite a repeating retry.
+    logger.warn('Session sandbox file write failed', {
+      sessionKey,
+      path: resolved,
+      error: getErrorMessage(error),
+    })
+    return { outcome: 'error', detail: getErrorMessage(error) }
+  }
   return { outcome: 'written', path: resolved }
 }

apps/sim/lib/mothership/tools/handlers/agent-cli/commands/deps.ts

@@ -5,6 +5,7 @@ import {
   agentCliOk,
 } from '@/lib/mothership/tools/handlers/agent-cli/types'
 import { normalizeName, SPECIAL_REFERENCE_PREFIXES } from '@/executor/constants'
+import { createEnvVarPattern, createReferencePattern } from '@/executor/utils/reference-validation'
 
 /**
  * `workflow deps <workflowId> <blockId>` — everything one block consumes, so the
@@ -15,8 +16,10 @@ import { normalizeName, SPECIAL_REFERENCE_PREFIXES } from '@/executor/constants'
  * never re-invent resolution semantics.
  */
 
-const TEMPLATE_REF = /<([^<>]+)>/g
-const ENV_REF = /\{\{\s*([A-Za-z0-9_-]+)\s*\}\}/g
+// The executor's own token grammars — this command must classify exactly what
+// the runtime resolves, never a private re-invention of the syntax.
+const TEMPLATE_REF = createReferencePattern()
+const ENV_REF = createEnvVarPattern()
 
 interface DepView {
   token: string
@@ -93,7 +96,8 @@ export const workflowDepsCommand: AgentCliCommand = {
         }
       }
       for (const match of leaf.matchAll(ENV_REF)) {
-        if (match[1]) envs.add(match[1])
+        const key = match[1]?.trim()
+        if (key) envs.add(key)
       }
     }
 

apps/sim/lib/mothership/tools/handlers/agent-cli/commands/lint.ts

@@ -8,6 +8,7 @@ import {
 } from '@/lib/mothership/tools/handlers/agent-cli/types'
 import { formatWorkflowLintMessage, hasWorkflowLintIssues } from '@/lib/workflows/editing/lint'
 import { buildWorkflowLintReport } from '@/lib/workflows/editing/lint-report'
+import { createEnvVarPattern } from '@/executor/utils/reference-validation'
 
 /**
  * The Go copilot served this as the virtual `workflows/{path}/lint.json` VFS
@@ -42,15 +43,17 @@ export const workflowLintCommand: AgentCliCommand = {
   },
 }
 
-const ENV_TOKEN = /\{\{\s*([A-Za-z0-9_]+)\s*\}\}/g
+// The executor's own env-token grammar (keys trimmed to match its resolution).
+const ENV_TOKEN = createEnvVarPattern()
 
 function envTokenNames(value: unknown, out: Map<string, Set<string>>, blockName: string): void {
   if (typeof value === 'string') {
     for (const match of value.matchAll(ENV_TOKEN)) {
-      if (!match[1]) continue
-      const blocks = out.get(match[1]) ?? new Set<string>()
+      const key = match[1]?.trim()
+      if (!key) continue
+      const blocks = out.get(key) ?? new Set<string>()
       blocks.add(blockName)
-      out.set(match[1], blocks)
+      out.set(key, blocks)
     }
   } else if (Array.isArray(value)) {
     for (const item of value) envTokenNames(item, out, blockName)

apps/sim/lib/mothership/tools/handlers/sim-cli.ts

@@ -121,9 +121,11 @@ export async function executeSimCli(
       const written = await writeSessionSandboxFile(sessionKey, outputFile, result.stdout)
       if (written.outcome === 'written') {
         result.stdout = `[stdout written to ${outputFile} on your machine: ${result.stdout.length} chars. Read or process it with run_code, or pass it back as @${outputFile}.]`
-      } else {
+      } else if (written.outcome === 'no-session') {
         result.stdout +=
           '\n[outputFile not written: your machine is not booted yet — run any run_code first. Output returned inline instead]'
+      } else {
+        result.stdout += '\n[outputFile write failed — output returned inline instead]'
       }
     }
   }