fix(v2): make the NUL path scan linear, and force a write surface to choose

Two findings from a simplify pass, both in code this branch added.

findNulBytePath copied `[...path, key]` per child, which is O(nodes x depth).
A caller controls that depth directly: v2 row cell values are `z.unknown()`,
so nesting passes Zod untouched and reaches the scan. Measured on Node 22 --
JSON.parse accepts a 200KB body nested 100k deep in 9.8ms, and the scan then
blocked the event loop for 27.7s. Frames now carry a parent link and the path
is materialized once, for the node actually reported: 27.7s -> 5ms, with
byte-identical paths across nested arrays, records, NUL keys and clean input.
The always-run first pass drops Object.entries for Object.keys, which halves
its cost on large bodies by not allocating a pair array per object.

`strictWrite` was optional with the lenient default, so a v2 write route added
tomorrow would silently inherit first-party behavior -- unknown column dropped
under a 201, uncoercible cell stored as null -- defended by nothing but five
copies of a literal. It is now required on the five write-shaped inputs, so
omission is a compile error. The type-checker named every caller: the five v2
routes already passed true, and the three Copilot sites now say false
explicitly, which is the behavior they already had.

Author: waleedlatif1

apps/sim/lib/api/server/nul-bytes.ts

@@ -21,42 +21,63 @@ function containsNulByte(root: unknown): boolean {
       continue
     }
     if (isPlainRecord(value)) {
-      for (const [key, entry] of Object.entries(value)) {
+      for (const key of Object.keys(value)) {
         if (containsNulCharacter(key)) return true
-        stack.push(entry)
+        stack.push(value[key])
       }
     }
   }
   return false
 }
 
+/** A visited node, linked to its parent so a path is only ever built on a hit. */
+interface NulScanFrame {
+  value: unknown
+  key: PropertyKey | null
+  parent: NulScanFrame | null
+}
+
+/** Walks parent links back to the root. Runs once, only for the offending node. */
+function framePath(frame: NulScanFrame): PropertyKey[] {
+  const path: PropertyKey[] = []
+  for (let node: NulScanFrame | null = frame; node?.parent; node = node.parent) {
+    if (node.key !== null) path.push(node.key)
+  }
+  return path.reverse()
+}
+
 /**
- * Second pass, run only once a NUL is known to be present, so the common case
- * never pays for path bookkeeping. Returns the path of the first offending
- * string, matching the shape Zod reports for a failed field.
+ * Second pass, run only once a NUL is known to be present. Returns the path of
+ * the first offending string, matching the shape Zod reports for a failed field.
+ *
+ * Frames carry a parent link rather than a copied path. Copying `[...path, key]`
+ * per child costs O(nodes x depth), which a caller controls directly: v2 row
+ * cell values are `z.unknown()`, so a 200KB body of nested arrays reaches this
+ * scan at depth 100k and blocked the event loop for ~28s. Parent links make it
+ * linear, and the path is materialized once for the node actually reported.
  */
 function findNulBytePath(root: unknown): PropertyKey[] {
-  const stack: { value: unknown; path: PropertyKey[] }[] = [{ value: root, path: [] }]
+  const stack: NulScanFrame[] = [{ value: root, key: null, parent: null }]
   while (stack.length > 0) {
     const frame = stack.pop()
     if (!frame) break
-    const { value, path } = frame
+    const { value } = frame
     if (typeof value === 'string') {
-      if (containsNulCharacter(value)) return path
+      if (containsNulCharacter(value)) return framePath(frame)
       continue
     }
     if (Array.isArray(value)) {
       for (let index = value.length - 1; index >= 0; index -= 1) {
-        stack.push({ value: value[index], path: [...path, index] })
+        stack.push({ value: value[index], key: index, parent: frame })
       }
       continue
     }
     if (isPlainRecord(value)) {
-      const entries = Object.entries(value)
-      for (let index = entries.length - 1; index >= 0; index -= 1) {
-        const [key, entry] = entries[index]
-        if (containsNulCharacter(key)) return [...path, key]
-        stack.push({ value: entry, path: [...path, key] })
+      const keys = Object.keys(value)
+      for (let index = keys.length - 1; index >= 0; index -= 1) {
+        const key = keys[index]
+        if (containsNulCharacter(key)) return [...framePath(frame), key]
+        stack.push({ value: value[key], key, parent: frame })
       }
     }
   }

apps/sim/lib/copilot/tools/server/table/user-table.ts

@@ -285,6 +285,7 @@ export const userTableServerTool: BaseServerTool<UserTableArgs, UserTableResult>
               kind: 'single',
               tableId: args.tableId,
               assertedWorkspaceId: workspaceId,
+              strictWrite: false,
               data: args.data,
               position: args.position as number | undefined,
               secretProvenance: createExactEmptyTableRowSecretProvenance(args.data),
@@ -327,6 +328,7 @@ export const userTableServerTool: BaseServerTool<UserTableArgs, UserTableResult>
               kind: 'batch',
               tableId: args.tableId,
               assertedWorkspaceId: workspaceId,
+              strictWrite: false,
               rows: sourceRows,
               secretProvenance: sourceRows.map(createExactEmptyTableRowSecretProvenance),
             },
@@ -473,6 +475,7 @@ export const userTableServerTool: BaseServerTool<UserTableArgs, UserTableResult>
             {
               tableId: args.tableId,
               assertedWorkspaceId: workspaceId,
+              strictWrite: false,
               rowId: args.rowId,
               data: args.data,
               secretProvenance: createExactEmptyTableRowSecretProvenance(args.data),

apps/sim/lib/table/application/rows.ts

@@ -92,11 +92,10 @@ interface TableScopedInput {
    * the Copilot table tools, and the executor's Table block all drop the
    * unknown key and blank the uncoercible cell. Read-only use cases ignore it.
    */
-  strictWrite?: boolean
 }
 
 /** The write policy `strictWrite` selects, for the row-service primitives. */
-function rowWriteOptions(input: TableScopedInput): RowWriteOptions {
+function rowWriteOptions(input: { strictWrite: boolean }): RowWriteOptions {
   return input.strictWrite ? { uncoercibleValues: 'reject' } : {}
 }
 
@@ -419,6 +418,8 @@ export const readTableRow = defineAuthorizedTableUseCase({
 })
 
 interface CreateSingleTableRowInput extends TableScopedInput {
+  /** See {@link rowWriteOptions}. Required so a new write surface must choose. */
+  strictWrite: boolean
   kind: 'single'
   data: RowData
   position?: number
@@ -428,6 +429,8 @@ interface CreateSingleTableRowInput extends TableScopedInput {
 }
 
 interface CreateBatchTableRowsInput extends TableScopedInput {
+  /** See {@link rowWriteOptions}. Required so a new write surface must choose. */
+  strictWrite: boolean
   kind: 'batch'
   rows: RowData[]
   orderKeys?: string[]
@@ -527,6 +530,8 @@ export const createTableRows = defineAuthorizedTableUseCase({
 const MAX_REPLACE_TABLE_ROWS = 10_000
 
 export interface ReplaceTableRowsInput extends TableScopedInput {
+  /** See {@link rowWriteOptions}. Required so a new write surface must choose. */
+  strictWrite: boolean
   rows: RowData[]
   secretProvenance?: Array<TableRowSecretProvenanceWrite | undefined>
 }
@@ -735,6 +740,8 @@ export const replaceProjectedWireRows = defineAuthorizedTableUseCase({
 })
 
 export interface UpdateTableRowInput extends TableScopedInput {
+  /** See {@link rowWriteOptions}. Required so a new write surface must choose. */
+  strictWrite: boolean
   rowId: string
   data: RowData
   secretProvenance?: TableRowSecretProvenanceWrite
@@ -784,6 +791,8 @@ export const updateTableRow = defineAuthorizedTableUseCase({
 })
 
 export interface UpdateTableRowsInput extends TableScopedInput {
+  /** See {@link rowWriteOptions}. Required so a new write surface must choose. */
+  strictWrite: boolean
   filter: TablePredicate
   data: RowData
   limit?: number
@@ -907,6 +916,8 @@ export const deleteTableRows = defineAuthorizedTableUseCase({
 })
 
 export interface UpsertTableRowInput extends TableScopedInput {
+  /** See {@link rowWriteOptions}. Required so a new write surface must choose. */
+  strictWrite: boolean
   data: RowData
   conflictTarget?: string
   secretProvenance?: TableRowSecretProvenanceWrite