refactor(mothership): last sweep-debt — session-key constructor, shared leaf walker

chatSandboxSessionKey is the one constructor for the per-chat sandbox
identity (the key doubles as the E2B lease and the workbench file-bridge
scope; two hand-built literals drifting apart would split a chat across
machines). collectStringLeaves moves into the executor's
reference-validation module — lint and the deps augmentation each carried
an identical copy of the walk.

Claude-Session: https://claude.ai/code/session_01CgaxNAaeD3taGdghbXn17w

Author: Sg312

apps/sim/executor/utils/reference-validation.ts

@@ -144,3 +144,14 @@ export function createCombinedPattern(): RegExp {
     'g'
   )
 }
+
+/**
+ * Collects every string leaf in a nested value — the shared walk for reference/env-token
+ * audits over block inputs (lint, deps, and the agent-cli mirrors each carried a copy).
+ */
+export function collectStringLeaves(value: unknown, out: string[]): void {
+  if (typeof value === 'string') out.push(value)
+  else if (Array.isArray(value)) for (const item of value) collectStringLeaves(item, out)
+  else if (typeof value === 'object' && value !== null)
+    for (const item of Object.values(value)) collectStringLeaves(item, out)
+}

apps/sim/lib/mothership/tools/handlers/agent-cli/commands/deps.ts

@@ -5,7 +5,11 @@ import {
   agentCliOk,
 } from '@/lib/mothership/tools/handlers/agent-cli/types'
 import { normalizeName, SPECIAL_REFERENCE_PREFIXES } from '@/executor/constants'
-import { createEnvVarPattern, createReferencePattern } from '@/executor/utils/reference-validation'
+import {
+  collectStringLeaves,
+  createEnvVarPattern,
+  createReferencePattern,
+} from '@/executor/utils/reference-validation'
 
 /**
  * `workflow deps <workflowId> <blockId>` — everything one block consumes, so the
@@ -29,13 +33,6 @@ interface DepView {
   paths?: string[]
 }
 
-function stringLeaves(value: unknown, out: string[]): void {
-  if (typeof value === 'string') out.push(value)
-  else if (Array.isArray(value)) for (const item of value) stringLeaves(item, out)
-  else if (typeof value === 'object' && value !== null)
-    for (const item of Object.values(value)) stringLeaves(item, out)
-}
-
 export const workflowDepsCommand: AgentCliCommand = {
   path: ['workflow', 'deps'],
   summary:
@@ -61,7 +58,7 @@ export const workflowDepsCommand: AgentCliCommand = {
     }
 
     const leaves: string[] = []
-    stringLeaves(block.subBlocks ?? block, leaves)
+    collectStringLeaves(block.subBlocks ?? block, leaves)
 
     const byToken = new Map<string, DepView>()
     const envs = new Set<string>()

apps/sim/lib/mothership/tools/handlers/function-execute.ts

@@ -25,6 +25,7 @@ import type {
   ToolExecutionContext,
   ToolExecutionResult,
 } from '@/lib/mothership/tool-executor/types'
+import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session'
 import {
   CopilotCodeSecretAccessError,
   type MaterializedCopilotCodeSecrets,
@@ -515,7 +516,7 @@ export async function executeFunctionExecute(
   // bootstrapped into it. Chat-less executions (one-shot, headless) stay
   // ephemeral.
   if (context.chatId) {
-    enrichedParams.sandboxSessionKey = `mothership-chat:${context.chatId}`
+    enrichedParams.sandboxSessionKey = chatSandboxSessionKey(context.chatId)
   }
   // The copilot tool doc promises `timeout` in SECONDS ("Sim converts to
   // milliseconds", default 10, cap 300); the underlying function tool takes

apps/sim/lib/mothership/tools/handlers/sim-cli.ts

@@ -17,6 +17,7 @@ import {
   matchAgentCliCommand,
 } from '@/lib/mothership/tools/handlers/agent-cli'
 import { applyPipeline, splitPipeline } from '@/lib/mothership/tools/handlers/sim-cli-pipe'
+import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session'
 
 const logger = createLogger('MothershipSimCli')
 
@@ -61,7 +62,7 @@ export async function executeSimCli(
   // `--text @channel` stays literal), and the server's filesystem is never
   // readable from model argv. A token that names no sandbox file is simply
   // absent from the map; the resolver's refusal then says so.
-  const sessionKey = context.chatId ? `mothership-chat:${context.chatId}` : null
+  const sessionKey = context.chatId ? chatSandboxSessionKey(context.chatId) : null
   const fileArguments: Record<string, string> = {}
   if (sessionKey) {
     for (const token of args) {

apps/sim/lib/mothership/tools/sandbox-session.ts

@@ -7,6 +7,15 @@ import { mintDelegationToken } from '@/lib/mothership/chat/delegation'
 
 const logger = createLogger('MothershipSandboxSession')
 
+/**
+ * The per-chat sandbox identity. One constructor: the key doubles as the E2B lease key
+ * AND the workbench file-bridge scope, so two hand-built copies drifting apart would
+ * silently split a chat across two machines.
+ */
+export function chatSandboxSessionKey(chatId: string): string {
+  return `mothership-chat:${chatId}`
+}
+
 /**
  * Installed once per fresh session sandbox until the mothership images bake the
  * CLI in. `command -v` keeps the install one-time: a sandbox that already has

apps/sim/lib/workflows/editing/lint.ts

@@ -1,5 +1,6 @@
 import { getBlock } from '@/blocks'
 import { isTriggerBlockType, normalizeName, SPECIAL_REFERENCE_PREFIXES } from '@/executor/constants'
+import { collectStringLeaves } from '@/executor/utils/reference-validation'
 import {
   collectBlockFieldIssues,
   extractBlockParams,
@@ -388,13 +389,6 @@ export function formatWorkflowLintMessage(lint: WorkflowLintIssueView) {
 const BLOCK_REF_TOKEN = /<([^<>]+)>/g
 const REF_TOKEN_SHAPE = /^[A-Za-z_][\w-]*(?:[\w\s-]*[\w-])?\.[A-Za-z0-9_.[\]]+$/
 
-function stringLeavesForLint(value: unknown, out: string[]): void {
-  if (typeof value === 'string') out.push(value)
-  else if (Array.isArray(value)) for (const item of value) stringLeavesForLint(item, out)
-  else if (typeof value === 'object' && value !== null)
-    for (const item of Object.values(value)) stringLeavesForLint(item, out)
-}
-
 export function collectDanglingBlockOutputReferences(
   workflowState: Pick<WorkflowState, 'blocks'>
 ): WorkflowLintUnresolvedReference[] {
@@ -409,7 +403,7 @@ export function collectDanglingBlockOutputReferences(
     for (const [subBlockId, subBlock] of Object.entries(block.subBlocks ?? {})) {
       if (subBlockId === 'code') continue
       const leaves: string[] = []
-      stringLeavesForLint((subBlock as { value?: unknown })?.value, leaves)
+      collectStringLeaves((subBlock as { value?: unknown })?.value, leaves)
       const dangling = new Set<string>()
       for (const leaf of leaves) {
         for (const match of leaf.matchAll(BLOCK_REF_TOKEN)) {