fix(ci): make the utils gate see the wrapped forms of what it bans

`check-utils-enforcement.ts` scanned line by line, and every idiom it bans is a
multi-token expression the formatter wraps at 100 columns. So it printed
`✓ No banned patterns found` while eleven files carried the wrapped form of

    e instanceof Error ? e.message : fallback

which CLAUDE.md mandates `getErrorMessage` for. The same class as the two blind
spots already fixed in check-react-query-patterns.

Patterns now run against the whole file, with match offsets mapped back to line
numbers by binary search over the line-start table — verified against every
offset of a multi-line fixture.

Eight of the eleven are now `getErrorMessage(error, fallback)`.
`auto-layout-utils` collapses a redundant `instanceof ApiClientError` arm on the
way, since that class extends `Error`; `upgrade.ts` keeps its `rawBody ?? message`
arm, which the helper cannot express, and only its tail collapses.

The other three stay, because the helper genuinely does not fit, and they carry a
`// utils-lint-allow: <reason>` annotation — the same escape hatch
check-react-query-patterns already has, which this gate lacked:

- the two auth routes return the message to an unauthenticated caller, so a
  non-Error throw must surface the fixed copy rather than its own text.
  `getErrorMessage` passes a thrown string straight through, which is the
  disclosure shape #7015 closed.
- `e2b.ts` probes E2B's own error shape — a record-like carrying `message` or
  `value` — which has no equivalent.

An annotation with no reason does not suppress, so the hatch cannot be used to
silence a finding without saying why.

Also corrects the header, which claimed Biome's `noRestrictedImports` covers
"crypto named imports". It lists only `nanoid` and `uuid`. Named crypto imports
pass both gates deliberately — server code building cipher IVs wants node's
crypto, not the cross-context wrapper — and the comment asserting otherwise would
mislead the next person auditing this.

Verified the gate can fail in both directions: reintroducing a wrapped ternary
reports it, and emptying an annotation's reason reports it too.

Author: waleedlatif1

apps/sim/app/api/auth/forget-password/route.ts

@@ -97,6 +97,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     return NextResponse.json(
       {
         message:
+          // utils-lint-allow: returned to an unauthenticated caller, so a non-Error throw
+          // must surface the fixed copy rather than its own text — getErrorMessage would
+          // pass a thrown string straight through.
           error instanceof Error
             ? error.message
             : 'Failed to send password reset email. Please try again later.',

apps/sim/app/api/auth/reset-password/route.ts

@@ -60,6 +60,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     return NextResponse.json(
       {
         message:
+          // utils-lint-allow: returned to an unauthenticated caller, so a non-Error throw
+          // must surface the fixed copy rather than its own text — getErrorMessage would
+          // pass a thrown string straight through.
           error instanceof Error
             ? error.message
             : 'Failed to reset password. Please try again or request a new reset link.',

apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx

@@ -274,9 +274,7 @@ export function TeamManagement({
           portalWindow?.close()
           logger.error('Failed to open billing portal from transfer dialog', { error })
           setTransferPortalError(
-            error instanceof Error
-              ? error.message
-              : 'Failed to open Stripe billing portal. Please try again.'
+            getErrorMessage(error, 'Failed to open Stripe billing portal. Please try again.')
           )
         },
       }

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/utils/auto-layout-utils.ts

@@ -1,7 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import type { Edge } from 'reactflow'
-import { ApiClientError } from '@/lib/api/client/errors'
 import { requestJson } from '@/lib/api/client/request'
 import {
   putWorkflowNormalizedStateContract,
@@ -100,12 +99,7 @@ export async function applyAutoLayoutAndUpdateStore(
         },
       })
     } catch (error) {
-      const errorMessage =
-        error instanceof ApiClientError
-          ? error.message
-          : error instanceof Error
-            ? error.message
-            : 'Auto layout failed'
+      const errorMessage = getErrorMessage(error, 'Auto layout failed')
       logger.error('Auto layout API call failed:', { error: errorMessage })
       return { success: false, error: errorMessage }
     }

apps/sim/lib/billing/client/upgrade.ts

@@ -211,9 +211,7 @@ export function useSubscriptionUpgrade() {
                 error:
                   transferError instanceof ApiClientError
                     ? (transferError.rawBody ?? transferError.message)
-                    : transferError instanceof Error
-                      ? transferError.message
-                      : 'Unknown error',
+                    : getErrorMessage(transferError, 'Unknown error'),
               })
             }
           } catch (error) {

apps/sim/lib/execution/remote-sandbox/e2b.ts

@@ -109,6 +109,8 @@ function isE2BExecutionTimeout(error: unknown): boolean {
         ? error.name
         : ''
   const message =
+    // utils-lint-allow: probes E2B's own error shape — a record-like carrying `message`
+    // or `value` — which getErrorMessage cannot express.
     error instanceof Error
       ? error.message
       : isRecordLike(error)

apps/sim/lib/webhooks/providers/microsoft-teams.ts

@@ -3,7 +3,7 @@ import { account } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { safeCompare } from '@sim/security/compare'
 import { hmacSha256Base64 } from '@sim/security/hmac'
-import { toError } from '@sim/utils/errors'
+import { getErrorMessage, toError } from '@sim/utils/errors'
 import { isRecordLike } from '@sim/utils/object'
 import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
@@ -733,9 +733,7 @@ export const microsoftTeamsHandler: WebhookProviderHandler = {
         error
       )
       throw new Error(
-        error instanceof Error
-          ? error.message
-          : 'Failed to create Teams subscription. Please try again.'
+        getErrorMessage(error, 'Failed to create Teams subscription. Please try again.')
       )
     }
   },

apps/sim/lib/webhooks/providers/telegram.ts

@@ -1,5 +1,6 @@
 import { db, webhook, workflowDeploymentVersion } from '@sim/db'
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import { and, eq, isNull, ne } from 'drizzle-orm'
 import { getNotificationUrl, getProviderConfig } from '@/lib/webhooks/provider-subscription-utils'
 import type {
@@ -170,9 +171,7 @@ export const telegramHandler: WebhookProviderHandler = {
         error
       )
       throw new Error(
-        error instanceof Error
-          ? error.message
-          : 'Failed to create Telegram webhook. Please try again.'
+        getErrorMessage(error, 'Failed to create Telegram webhook. Please try again.')
       )
     }
   },

apps/sim/lib/webhooks/providers/typeform.ts

@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { safeCompare } from '@sim/security/compare'
 import { hmacSha256Base64 } from '@sim/security/hmac'
+import { getErrorMessage } from '@sim/utils/errors'
 import { getNotificationUrl, getProviderConfig } from '@/lib/webhooks/provider-subscription-utils'
 import type {
   DeleteSubscriptionContext,
@@ -168,9 +169,7 @@ export const typeformHandler: WebhookProviderHandler = {
         error
       )
       throw new Error(
-        error instanceof Error
-          ? error.message
-          : 'Failed to create Typeform webhook. Please try again.'
+        getErrorMessage(error, 'Failed to create Typeform webhook. Please try again.')
       )
     }
   },

apps/sim/lib/workspace-files/orchestration/file-folder-lifecycle.ts

@@ -1,6 +1,6 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { createLogger } from '@sim/logger'
-import { getPostgresErrorCode, toError } from '@sim/utils/errors'
+import { getErrorMessage, getPostgresErrorCode, toError } from '@sim/utils/errors'
 import { asOrchestrationError, type OrchestrationErrorCode } from '@/lib/core/orchestration/types'
 import { FolderPathError } from '@/lib/folders/paths'
 import { notifyWorkspaceFilesChanged } from '@/lib/realtime/notify'
@@ -385,10 +385,10 @@ export async function performMoveWorkspaceFileItems(
     ) {
       return {
         success: false,
-        error:
-          error instanceof Error
-            ? error.message
-            : 'A file or folder with this name already exists in the destination folder',
+        error: getErrorMessage(
+          error,
+          'A file or folder with this name already exists in the destination folder'
+        ),
         errorCode: 'conflict',
       }
     }