fix(workflows): split multi-select values without tearing references

A `<block.path>` or `{{ENV_VAR}}` token may legitimately contain a comma
(`<start.pick(a,b)>`), and its fragments read as plain literals once split, so a
naive `.split(',')` turns one dynamically bound value into several bogus ids.

Adds `splitOutsideReferences`, which treats only commas outside every reference
token as separators. Token spans are marked once into a lookup rather than
rescanned per comma: a per-comma `tokens.some()` is O(commas x tokens) and took
~2.5s on a 240KB value of repeated `{{A}},`, which is reachable on the 10MB
graph-write paths.

Known limitation, unchanged from the `.split(',')` this replaces and covered by a
characterization test: the tokenizer suppresses a workflow span that overlaps an
environment token, so `<start.body.pick({{A}},b)>` still splits.

Author: mzxchandra

apps/sim/lib/workflows/sanitization/references.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
   containsReference,
   isLikelyReferenceSegment,
+  splitOutsideReferences,
   splitReferenceSegment,
 } from '@/lib/workflows/sanitization/references'
 
@@ -90,3 +91,56 @@ describe('containsReference', () => {
     expect(containsReference('a<b<c>d')).toBe(false)
   })
 })
+
+describe('splitOutsideReferences', () => {
+  it('splits on separator commas', () => {
+    expect(splitOutsideReferences('kb_a,kb_b')).toEqual(['kb_a', 'kb_b'])
+  })
+
+  it('trims entries and drops empties', () => {
+    expect(splitOutsideReferences(' kb_a , , kb_b ')).toEqual(['kb_a', 'kb_b'])
+  })
+
+  it('keeps a comma that sits inside a workflow reference', () => {
+    expect(splitOutsideReferences('<start.pick(a,b)>')).toEqual(['<start.pick(a,b)>'])
+  })
+
+  it('keeps a comma inside a reference while still splitting around it', () => {
+    expect(splitOutsideReferences('kb_a,<start.pick(x,y)>,kb_b')).toEqual([
+      'kb_a',
+      '<start.pick(x,y)>',
+      'kb_b',
+    ])
+  })
+
+  it('keeps a comma inside an env-var placeholder', () => {
+    expect(splitOutsideReferences('{{A,B}},kb_a')).toEqual(['{{A,B}}', 'kb_a'])
+  })
+
+  it('returns a single entry when there is no separator', () => {
+    expect(splitOutsideReferences('kb_a')).toEqual(['kb_a'])
+  })
+
+  it('stays linear on a large value instead of rescanning tokens per comma', () => {
+    // A per-comma `tokens.some()` is O(commas x tokens) and took ~2.5s on this input.
+    const value = '{{A}},'.repeat(40000)
+    const startedAt = performance.now()
+    const parts = splitOutsideReferences(value)
+    const elapsedMs = performance.now() - startedAt
+
+    expect(parts).toHaveLength(40000)
+    expect(elapsedMs).toBeLessThan(1000)
+  })
+
+  it('does not yet protect a comma inside a reference that nests an env-var placeholder', () => {
+    // Known limitation, unchanged from the plain `.split(',')` this replaced: the tokenizer
+    // reports the inner `{{A}}` and suppresses the outer `<...>` span, so the comma reads as a
+    // separator. Characterized rather than fixed - the suppression lives in the shared
+    // `@sim/utils/workflow-references` tokenizer.
+    expect(splitOutsideReferences('<start.body.pick({{A}},b)>,kb_literal')).toEqual([
+      '<start.body.pick({{A}}',
+      'b)>',
+      'kb_literal',
+    ])
+  })
+})

apps/sim/lib/workflows/sanitization/references.ts

@@ -23,6 +23,45 @@ export function containsReference(value: unknown): boolean {
   return findWorkflowReferenceTokens(value).length > 0
 }
 
+/**
+ * Split a comma-separated multi-select value without tearing a reference apart.
+ *
+ * A `<block.path>` or `{{ENV_VAR}}` token may legitimately contain a comma (`<start.pick(a,b)>`),
+ * and its fragments read as plain literals once split, so a naive `.split(',')` turns one dynamic
+ * value into several bogus ones. Only commas outside every reference token are separators.
+ */
+export function splitOutsideReferences(value: string): string[] {
+  const tokens = findWorkflowReferenceTokens(value)
+  if (tokens.length === 0) {
+    return value
+      .split(',')
+      .map((part) => part.trim())
+      .filter(Boolean)
+  }
+
+  // Marked once up front rather than scanned per comma: a per-comma `tokens.some()` is
+  // O(commas x tokens), which reached ~2.5s on a 240KB value of repeated `{{A}},`.
+  const insideReference = new Uint8Array(value.length)
+  for (const token of tokens) {
+    const end = Math.min(token.end, value.length)
+    for (let index = Math.max(token.start, 0); index < end; index += 1) {
+      insideReference[index] = 1
+    }
+  }
+
+  const parts: string[] = []
+  let partStart = 0
+  for (let index = 0; index < value.length; index += 1) {
+    if (value[index] === ',' && !insideReference[index]) {
+      parts.push(value.slice(partStart, index))
+      partStart = index + 1
+    }
+  }
+  parts.push(value.slice(partStart))
+
+  return parts.map((part) => part.trim()).filter(Boolean)
+}
+
 export function extractReferencePrefixes(value: string): Array<{ raw: string; prefix: string }> {
   if (!value || typeof value !== 'string') {
     return []