fix(trigger_dev): guard the path params the timeout sweep left behind

42 user-or-llm path params were on bare encodeURIComponent, which leaves a
dot segment intact. The shared env-var URL builder covers 15 of them,
including the DELETE and PUT shapes.

queueName and taskIdentifier stay separator-tolerant: the Trigger.dev SDK
special-cases a slash inside a queue parameter, so rejecting one would
refuse a value the provider treats as legal. No exploitable consequence was
demonstrated -- every collapsed route probed returns 404.

Author: waleedlatif1

apps/sim/tools/trigger_dev/activate_schedule.ts

@@ -9,6 +9,7 @@ import {
   TRIGGER_DEV_SCHEDULE_OUTPUTS,
 } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const triggerDevActivateScheduleTool: ToolConfig<
   TriggerDevScheduleIdParams,
@@ -36,7 +37,7 @@ export const triggerDevActivateScheduleTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v1/schedules/${encodeURIComponent(params.scheduleId.trim())}/activate`,
+      `${TRIGGER_DEV_API_BASE}/api/v1/schedules/${safeUrlPathSegment(params.scheduleId, 'scheduleId')}/activate`,
     method: 'POST',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
   },

apps/sim/tools/trigger_dev/add_run_tags.ts

@@ -8,6 +8,7 @@ import {
   TRIGGER_DEV_API_BASE,
 } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const triggerDevAddRunTagsTool: ToolConfig<
   TriggerDevAddRunTagsParams,
@@ -42,7 +43,7 @@ export const triggerDevAddRunTagsTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v1/runs/${encodeURIComponent(params.runId.trim())}/tags`,
+      `${TRIGGER_DEV_API_BASE}/api/v1/runs/${safeUrlPathSegment(params.runId, 'runId')}/tags`,
     method: 'POST',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
     body: (params) => ({ tags: splitCommaSeparated(params.tags) }),

apps/sim/tools/trigger_dev/batch_trigger_task.ts

@@ -5,6 +5,7 @@ import type {
 import {
   buildTriggerDevHeaders,
   parseJsonInput,
+  safeTriggerDevPathSegment,
   TRIGGER_DEV_API_BASE,
 } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
@@ -43,7 +44,7 @@ export const triggerDevBatchTriggerTaskTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v1/tasks/${encodeURIComponent(params.taskIdentifier.trim())}/batch`,
+      `${TRIGGER_DEV_API_BASE}/api/v1/tasks/${safeTriggerDevPathSegment(params.taskIdentifier, 'taskIdentifier')}/batch`,
     method: 'POST',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
     body: (params) => {

apps/sim/tools/trigger_dev/cancel_run.ts

@@ -1,6 +1,7 @@
 import type { TriggerDevRunActionResponse, TriggerDevRunIdParams } from '@/tools/trigger_dev/types'
 import { buildTriggerDevHeaders, TRIGGER_DEV_API_BASE } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const triggerDevCancelRunTool: ToolConfig<
   TriggerDevRunIdParams,
@@ -29,7 +30,7 @@ export const triggerDevCancelRunTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v2/runs/${encodeURIComponent(params.runId.trim())}/cancel`,
+      `${TRIGGER_DEV_API_BASE}/api/v2/runs/${safeUrlPathSegment(params.runId, 'runId')}/cancel`,
     method: 'POST',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
   },

apps/sim/tools/trigger_dev/complete_waitpoint_token.ts

@@ -8,6 +8,7 @@ import {
   TRIGGER_DEV_API_BASE,
 } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const triggerDevCompleteWaitpointTokenTool: ToolConfig<
   TriggerDevCompleteWaitpointTokenParams,
@@ -43,7 +44,7 @@ export const triggerDevCompleteWaitpointTokenTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v1/waitpoints/tokens/${encodeURIComponent(params.waitpointId.trim())}/complete`,
+      `${TRIGGER_DEV_API_BASE}/api/v1/waitpoints/tokens/${safeUrlPathSegment(params.waitpointId, 'waitpointId')}/complete`,
     method: 'POST',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
     body: (params) => {

apps/sim/tools/trigger_dev/deactivate_schedule.ts

@@ -9,6 +9,7 @@ import {
   TRIGGER_DEV_SCHEDULE_OUTPUTS,
 } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const triggerDevDeactivateScheduleTool: ToolConfig<
   TriggerDevScheduleIdParams,
@@ -36,7 +37,7 @@ export const triggerDevDeactivateScheduleTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v1/schedules/${encodeURIComponent(params.scheduleId.trim())}/deactivate`,
+      `${TRIGGER_DEV_API_BASE}/api/v1/schedules/${safeUrlPathSegment(params.scheduleId, 'scheduleId')}/deactivate`,
     method: 'POST',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
   },

apps/sim/tools/trigger_dev/delete_schedule.ts

@@ -8,6 +8,7 @@ import {
   TRIGGER_DEV_API_BASE,
 } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const triggerDevDeleteScheduleTool: ToolConfig<
   TriggerDevScheduleIdParams,
@@ -35,7 +36,7 @@ export const triggerDevDeleteScheduleTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v1/schedules/${encodeURIComponent(params.scheduleId.trim())}`,
+      `${TRIGGER_DEV_API_BASE}/api/v1/schedules/${safeUrlPathSegment(params.scheduleId, 'scheduleId')}`,
     method: 'DELETE',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
   },

apps/sim/tools/trigger_dev/get_batch.ts

@@ -1,6 +1,7 @@
 import type { TriggerDevBatchIdParams, TriggerDevGetBatchResponse } from '@/tools/trigger_dev/types'
 import { buildTriggerDevHeaders, TRIGGER_DEV_API_BASE } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const triggerDevGetBatchTool: ToolConfig<
   TriggerDevBatchIdParams,
@@ -29,7 +30,7 @@ export const triggerDevGetBatchTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v1/batches/${encodeURIComponent(params.batchId.trim())}`,
+      `${TRIGGER_DEV_API_BASE}/api/v1/batches/${safeUrlPathSegment(params.batchId, 'batchId')}`,
     method: 'GET',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
   },

apps/sim/tools/trigger_dev/get_batch_results.ts

@@ -9,6 +9,7 @@ import {
   TRIGGER_DEV_RUN_RESULT_PROPERTIES,
 } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const triggerDevGetBatchResultsTool: ToolConfig<
   TriggerDevBatchIdParams,
@@ -37,7 +38,7 @@ export const triggerDevGetBatchResultsTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v1/batches/${encodeURIComponent(params.batchId.trim())}/results`,
+      `${TRIGGER_DEV_API_BASE}/api/v1/batches/${safeUrlPathSegment(params.batchId, 'batchId')}/results`,
     method: 'GET',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
   },

apps/sim/tools/trigger_dev/get_deployment.ts

@@ -9,6 +9,7 @@ import {
   TRIGGER_DEV_DEPLOYMENT_PROPERTIES,
 } from '@/tools/trigger_dev/utils'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const triggerDevGetDeploymentTool: ToolConfig<
   TriggerDevGetDeploymentParams,
@@ -37,7 +38,7 @@ export const triggerDevGetDeploymentTool: ToolConfig<
 
   request: {
     url: (params) =>
-      `${TRIGGER_DEV_API_BASE}/api/v1/deployments/${encodeURIComponent(params.deploymentId.trim())}`,
+      `${TRIGGER_DEV_API_BASE}/api/v1/deployments/${safeUrlPathSegment(params.deploymentId, 'deploymentId')}`,
     method: 'GET',
     headers: (params) => buildTriggerDevHeaders(params.apiKey),
   },