fix(selectors): scope alternate selector caches safely

Author: Bill Leoutsakos

apps/sim/hooks/queries/dynamic-subblock-options.test.tsx

@@ -19,7 +19,10 @@ import {
   dynamicSubBlockOptionKeys,
   useDynamicSubBlockOptionDisplayName,
 } from '@/hooks/queries/dynamic-subblock-options'
-import type { SelectorDefinition, SelectorKey } from '@/hooks/selectors/types'
+import type { SelectorDefinition, SelectorKey, SelectorQueryArgs } from '@/hooks/selectors/types'
+import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
+import { useSubBlockStore } from '@/stores/workflows/subblock/store'
+import { useWorkflowStore } from '@/stores/workflows/workflow/store'
 
 /** Any registered key; the hook only uses it to look the definition up. */
 const SELECTOR_KEY = 'workspace.credentialGroups' as SelectorKey
@@ -30,6 +33,7 @@ function mockDefinition(definition: Partial<SelectorDefinition>) {
 
 interface HookHarness<T> {
   result: () => T
+  queryClient: QueryClient
   unmount: () => void
 }
 
@@ -55,6 +59,7 @@ function renderHookWithClient<T>(useHook: () => T): HookHarness<T> {
 
   return {
     result: () => latest,
+    queryClient,
     unmount: () => act(() => root.unmount()),
   }
 }
@@ -70,6 +75,9 @@ describe('useDynamicSubBlockOptionDisplayName', () => {
 
   afterEach(() => {
     mounted.splice(0).forEach((unmount) => unmount())
+    useWorkflowRegistry.setState({ activeWorkflowId: null })
+    useWorkflowStore.setState({ blocks: {} })
+    useSubBlockStore.setState({ workflowValues: {} })
     vi.clearAllMocks()
   })
 
@@ -147,4 +155,86 @@ describe('useDynamicSubBlockOptionDisplayName', () => {
     expect(keyFor('group-1')).not.toEqual(keyFor('group-2'))
     expect(keyFor('group-1')).toEqual(keyFor('group-1'))
   })
+
+  it('scopes server-resolved detail hydration without keying raw dependencies', async () => {
+    const fetchById = vi.fn(async ({ context, detailId }: SelectorQueryArgs) => {
+      if (context.domain === 'DYNAMIC_PRIVATE_SENTINEL_B') {
+        throw new Error('tenant B is unavailable')
+      }
+      return { id: detailId as string, label: 'Tenant A project' }
+    })
+    mockDefinition({
+      key: SELECTOR_KEY,
+      serverResolvedContextFields: ['domain'],
+      getQueryKey: () => ['selectors', SELECTOR_KEY],
+      fetchById,
+    })
+    const subBlock = {
+      id: 'projectId',
+      title: 'Project',
+      type: 'project-selector',
+      selectorKey: SELECTOR_KEY,
+    } satisfies SubBlockConfig
+
+    useWorkflowRegistry.setState({ activeWorkflowId: 'workflow-1' })
+    useWorkflowStore.setState({
+      blocks: {
+        'block-1': {
+          id: 'block-1',
+          type: 'jira',
+          subBlocks: {},
+          data: {},
+        } as never,
+      },
+    })
+    useSubBlockStore.setState({
+      workflowValues: {
+        'workflow-1': {
+          'block-1': {
+            credential: 'credential-1',
+            domain: 'DYNAMIC_PRIVATE_SENTINEL_A',
+          },
+        },
+      },
+    })
+
+    const hook = renderHookWithClient(() =>
+      useDynamicSubBlockOptionDisplayName({
+        workspaceId: 'workspace-1',
+        blockId: 'block-1',
+        subBlock,
+        value: 'project-1',
+      })
+    )
+    mounted.push(hook.unmount)
+
+    await waitForResult(() => expect(hook.result()).toBe('Tenant A project'))
+
+    act(() => {
+      useSubBlockStore.setState({
+        workflowValues: {
+          'workflow-1': {
+            'block-1': {
+              credential: 'credential-1',
+              domain: 'DYNAMIC_PRIVATE_SENTINEL_B',
+            },
+          },
+        },
+      })
+    })
+
+    await waitForResult(() => expect(fetchById).toHaveBeenCalledTimes(2))
+    await waitForResult(() => expect(hook.result()).toBeNull())
+
+    const contexts = fetchById.mock.calls.map(([args]) => args.context)
+    expect(contexts[0].selectorCacheScope).not.toBe(contexts[1].selectorCacheScope)
+    expect(
+      JSON.stringify(
+        hook.queryClient
+          .getQueryCache()
+          .getAll()
+          .map((query) => query.queryKey)
+      )
+    ).not.toContain('DYNAMIC_PRIVATE_SENTINEL')
+  })
 })

apps/sim/hooks/queries/dynamic-subblock-options.ts

@@ -3,8 +3,13 @@ import { useQueries } from '@tanstack/react-query'
 import { buildSelectorContextFromBlock } from '@/lib/workflows/subblocks/context'
 import { summarizeNames } from '@/lib/workflows/subblocks/display'
 import type { SubBlockConfig } from '@/blocks/types'
+import {
+  createSelectorCacheScopeRegistry,
+  scopeServerResolvedSelectorContext,
+} from '@/hooks/selectors/context-resolution'
 import { getSelectorDefinition } from '@/hooks/selectors/registry'
 import type { SelectorContext } from '@/hooks/selectors/types'
+import { getScopedSelectorQueryKey } from '@/hooks/selectors/use-selector-query'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
 import { useSubBlockStore } from '@/stores/workflows/subblock/store'
 import { useWorkflowStore } from '@/stores/workflows/workflow/store'
@@ -62,6 +67,7 @@ export function useDynamicSubBlockOptionDisplayName({
   subBlock,
   value,
 }: UseDynamicSubBlockOptionDisplayNameArgs): string | null {
+  const selectorCacheScopes = useMemo(() => createSelectorCacheScopeRegistry(), [])
   const optionIds = useMemo(() => getResolvableOptionIds(value), [value])
   // Label resolution follows the option source: a selector's own `fetchById`. There is no
   // per-block resolver any more, so a selector without one simply renders the raw id.
@@ -93,15 +99,28 @@ export function useDynamicSubBlockOptionDisplayName({
     })
   }, [block, liveValues, activeWorkflowId, workspaceId])
 
+  const scopedResolverContext = useMemo(
+    () =>
+      definition
+        ? scopeServerResolvedSelectorContext(definition, resolverContext, selectorCacheScopes)
+        : resolverContext,
+    [definition, resolverContext, selectorCacheScopes]
+  )
+
   /**
    * The selector's own key for this context. Reusing it means the cache is scoped by exactly
    * what the selector reads — no second list of context fields to keep in step, and it stays
    * correct when a selector's dependencies change.
    */
   const selectorScope = useMemo(
     () =>
-      definition ? definition.getQueryKey({ key: definition.key, context: resolverContext }) : [],
-    [definition, resolverContext]
+      definition
+        ? getScopedSelectorQueryKey(definition, {
+            key: definition.key,
+            context: scopedResolverContext,
+          })
+        : [],
+    [definition, scopedResolverContext]
   )
   const canResolve = Boolean(blockId && fetchById && optionIds.length > 0)
 
@@ -121,7 +140,7 @@ export function useDynamicSubBlockOptionDisplayName({
             }
             return fetchById({
               key: definition.key,
-              context: resolverContext,
+              context: scopedResolverContext,
               detailId: optionId,
               signal,
             })

apps/sim/hooks/queries/workflow-search-replace.test.ts

@@ -5,9 +5,12 @@ import { describe, expect, it } from 'vitest'
 import type { WorkflowSearchMatch } from '@/lib/workflows/search-replace/types'
 import {
   buildWorkflowSearchMcpToolReplacementOptions,
+  buildWorkflowSearchSelectorScope,
   flattenWorkflowSearchReplacementOptions,
   workflowSearchReplaceKeys,
 } from '@/hooks/queries/workflow-search-replace'
+import { createSelectorCacheScopeRegistry } from '@/hooks/selectors/context-resolution'
+import type { SelectorDefinition, SelectorKey } from '@/hooks/selectors/types'
 
 function createMcpToolMatch(serverId?: string): WorkflowSearchMatch {
   return {
@@ -107,6 +110,59 @@ describe('workflowSearchReplaceKeys', () => {
       '{"oauthCredential":"credential-1","workspaceId":"workspace-1"}',
     ])
   })
+
+  it('uses opaque scoped identities for server-resolved selectors', () => {
+    const revisions = ['revision-a', 'revision-b'][Symbol.iterator]()
+    const registry = createSelectorCacheScopeRegistry(() => revisions.next().value ?? 'unexpected')
+    const definition = {
+      key: 'jira.projects' as SelectorKey,
+      serverResolvedContextFields: ['domain'],
+      getQueryKey: () => ['selectors', 'jira.projects', 'credential-1'],
+    } as SelectorDefinition
+
+    const first = buildWorkflowSearchSelectorScope(
+      definition,
+      {
+        workspaceId: 'workspace-1',
+        workflowId: 'workflow-1',
+        domain: 'WORKFLOW_SEARCH_PRIVATE_SENTINEL_A',
+      },
+      registry
+    )
+    const changed = buildWorkflowSearchSelectorScope(
+      definition,
+      {
+        workspaceId: 'workspace-1',
+        workflowId: 'workflow-1',
+        domain: 'WORKFLOW_SEARCH_PRIVATE_SENTINEL_B',
+      },
+      registry
+    )
+
+    expect(first.identity).not.toEqual(changed.identity)
+    expect(JSON.stringify(first.identity)).not.toContain('WORKFLOW_SEARCH_PRIVATE_SENTINEL')
+    expect(first.context).toMatchObject({
+      domain: 'WORKFLOW_SEARCH_PRIVATE_SENTINEL_A',
+      selectorCacheScope: 'revision-a',
+    })
+  })
+
+  it('retains serialized context identity for legacy selectors', () => {
+    const definition = {
+      key: 'gmail.labels' as SelectorKey,
+      getQueryKey: () => ['selectors', 'gmail.labels'],
+    } as SelectorDefinition
+    const context = { oauthCredential: 'credential-1', workspaceId: 'workspace-1' }
+
+    const scoped = buildWorkflowSearchSelectorScope(
+      definition,
+      context,
+      createSelectorCacheScopeRegistry(() => 'unused')
+    )
+
+    expect(scoped.context).toBe(context)
+    expect(scoped.identity).toBe('{"oauthCredential":"credential-1","workspaceId":"workspace-1"}')
+  })
 })
 
 describe('flattenWorkflowSearchReplacementOptions', () => {

apps/sim/hooks/queries/workflow-search-replace.ts

@@ -35,8 +35,19 @@ import {
   fetchOAuthCredentials,
 } from '@/hooks/queries/oauth/oauth-credentials'
 import { collectDuplicateNames, disambiguateLabelByFolder } from '@/hooks/queries/utils/folder-tree'
+import {
+  createSelectorCacheScopeRegistry,
+  type SelectorCacheScopeRegistry,
+  scopeServerResolvedSelectorContext,
+} from '@/hooks/selectors/context-resolution'
 import { getSelectorDefinition, loadAllSelectorOptions } from '@/hooks/selectors/registry'
-import type { SelectorKey, SelectorOption } from '@/hooks/selectors/types'
+import type {
+  SelectorContext,
+  SelectorDefinition,
+  SelectorKey,
+  SelectorOption,
+} from '@/hooks/selectors/types'
+import { getScopedSelectorQueryKey } from '@/hooks/selectors/use-selector-query'
 import type { WorkflowFolder } from '@/stores/folders/types'
 
 /** Stable identity while a folder list loads, so `select` isn't re-keyed on it. */
@@ -92,19 +103,26 @@ export const workflowSearchReplaceKeys = {
   knowledgeReplacementOptions: (workspaceId?: string) =>
     [...workflowSearchReplaceKeys.replacementOptions(), 'knowledge', workspaceId ?? ''] as const,
   selectorDetails: () => [...workflowSearchReplaceKeys.resourceDetails(), 'selector'] as const,
-  selectorDetail: (selectorKey?: string, contextKey?: string, value?: string) =>
+  selectorDetail: (
+    selectorKey?: string,
+    contextIdentity?: string | readonly unknown[],
+    value?: string
+  ) =>
     [
       ...workflowSearchReplaceKeys.selectorDetails(),
       selectorKey ?? '',
-      contextKey ?? '',
+      contextIdentity ?? '',
       value ?? '',
     ] as const,
-  selectorReplacementOptions: (selectorKey?: string, contextKey?: string) =>
+  selectorReplacementOptions: (
+    selectorKey?: string,
+    contextIdentity?: string | readonly unknown[]
+  ) =>
     [
       ...workflowSearchReplaceKeys.replacementOptions(),
       'selector',
       selectorKey ?? '',
-      contextKey ?? '',
+      contextIdentity ?? '',
     ] as const,
 }
 
@@ -139,6 +157,25 @@ function selectorContextKey(match: WorkflowSearchMatch): string {
   return stableStringifyWorkflowSearchValue(match.resource?.selectorContext ?? {})
 }
 
+export function buildWorkflowSearchSelectorScope(
+  definition: SelectorDefinition,
+  context: SelectorContext,
+  registry: SelectorCacheScopeRegistry
+): { context: SelectorContext; identity: string | readonly unknown[] } {
+  if (!definition.serverResolvedContextFields?.length) {
+    return { context, identity: stableStringifyWorkflowSearchValue(context) }
+  }
+
+  const scopedContext = scopeServerResolvedSelectorContext(definition, context, registry)
+  return {
+    context: scopedContext,
+    identity: getScopedSelectorQueryKey(definition, {
+      key: definition.key,
+      context: scopedContext,
+    }),
+  }
+}
+
 function uniqueSelectorDetailMatches(matches: WorkflowSearchMatch[]): WorkflowSearchMatch[] {
   const seen = new Set<string>()
   return matches.filter((match) => {
@@ -378,18 +415,22 @@ export function useWorkflowSearchMcpToolDetails(
 
 export function useWorkflowSearchSelectorDetails(matches: WorkflowSearchMatch[]) {
   const selectorMatches = useMemo(() => uniqueSelectorDetailMatches(matches), [matches])
+  const cacheScopes = useMemo(() => createSelectorCacheScopeRegistry(), [])
 
   return useQueries({
     queries: selectorMatches.map((match) => {
       const selectorKey = match.resource?.selectorKey as SelectorKey
-      const context = match.resource?.selectorContext ?? {}
-      const contextKey = selectorContextKey(match)
       const definition = getSelectorDefinition(selectorKey)
+      const { context, identity } = buildWorkflowSearchSelectorScope(
+        definition,
+        match.resource?.selectorContext ?? {},
+        cacheScopes
+      )
       const queryArgs = { key: selectorKey, context, detailId: match.rawValue }
       const baseEnabled = definition.enabled ? definition.enabled(queryArgs) : true
 
       return {
-        queryKey: workflowSearchReplaceKeys.selectorDetail(selectorKey, contextKey, match.rawValue),
+        queryKey: workflowSearchReplaceKeys.selectorDetail(selectorKey, identity, match.rawValue),
         queryFn: async ({ signal }: { signal: AbortSignal }): Promise<SelectorOption | null> => {
           if (definition.fetchById) {
             return definition.fetchById({ ...queryArgs, signal })
@@ -652,18 +693,22 @@ export function useWorkflowSearchMcpToolReplacementOptions(
 
 export function useWorkflowSearchSelectorReplacementOptions(matches: WorkflowSearchMatch[]) {
   const selectorGroups = useMemo(() => uniqueSelectorOptionGroups(matches), [matches])
+  const cacheScopes = useMemo(() => createSelectorCacheScopeRegistry(), [])
 
   return useQueries({
     queries: selectorGroups.map((match) => {
       const selectorKey = match.resource?.selectorKey as SelectorKey
-      const context = match.resource?.selectorContext ?? {}
-      const contextKey = selectorContextKey(match)
       const definition = getSelectorDefinition(selectorKey)
+      const { context, identity } = buildWorkflowSearchSelectorScope(
+        definition,
+        match.resource?.selectorContext ?? {},
+        cacheScopes
+      )
       const queryArgs = { key: selectorKey, context }
       const baseEnabled = definition.enabled ? definition.enabled(queryArgs) : true
 
       return {
-        queryKey: workflowSearchReplaceKeys.selectorReplacementOptions(selectorKey, contextKey),
+        queryKey: workflowSearchReplaceKeys.selectorReplacementOptions(selectorKey, identity),
         queryFn: ({ signal }: { signal: AbortSignal }) =>
           loadAllSelectorOptions(definition, { ...queryArgs, signal }),
         enabled: Boolean(selectorKey && baseEnabled),