fix(cloudwatch): resolve selector credentials server-side

[BillLeoutsakosvl346]

Stacked on #7095. Review the diff against the PR1 branch. Do not merge until #7095 lands and this PR is rebased and retargeted to staging.

Summary

• Add dedicated CloudWatch Log Group and Log Stream selector routes using PR1's authorized server-side context resolver.
• Extract reusable AWS listing functions while preserving runtime-route response metadata and behavior.
• Accept literals or exact references on the wire, validate resolved AWS values, and return strict name-only selector responses.
• Keep CloudWatch routes, contracts, provider-local registry map, selector wiring, and tests isolated in this PR.

Security behavior

• Successful personal/workspace environment mutations invalidate mounted selector, canvas-label, and workflow-search caches through PR1, so an unchanged {{KEY}} refetches without exposing its value.
• AWS access key, secret key, region, and selector dependencies remain literals or opaque references in the browser.
• Resolved values exist only in server code after workflow authorization.
• Inaccessible references short-circuit before AWS client construction.
• Selector responses expose names only; runtime routes retain their existing metadata contract.
• Query keys contain opaque dependency revisions rather than credential plaintext.

Focused coverage

• Wire/resolved validation separation and strict name-only responses.
• Both selector routes, pagination utilities, client destruction, and runtime-route compatibility.
• Literal/reference inputs, inaccessible-reference short-circuiting, and option mapping.
• Raw client transport and concise base-key privacy.

Verification

• Provider-focused Vitest: 4 files, 14 tests passed.
• App type-check passed.
• Root lint/format, strict API validation, client-boundary, React Query, and git diff --check passed on the combined stack.
• Combined full repository tests passed: 19/19 tasks; app 2,365 files passed, 3 skipped; 34,824 tests passed, 46 skipped.
• Combined focused selector suite: 28 files, 153 tests passed.
• All ten pairwise child diff intersections are empty; this child extends only the CloudWatch-owned selector contract map.

Browser verification

• After the freshness restack, a combined Jira smoke confirmed exact raw references still reach dedicated selector routes and provider/authorization failures stay sanitized. The exact mounted same-reference mutation is covered by PR1's real QueryClient regression because this local account cannot edit Secrets through the UI.
• A disposable CloudWatch workflow selector preserved literal, personal-reference, and shared-reference AWS inputs across the browser boundary.
• Deterministic invalid literals reached the dedicated selector route; personal/shared references returned sanitized unresolved-configuration failures.
• Responses and server logs exposed neither credential plaintext nor unnecessary runtime metadata.
• The disposable workflow was deleted afterward.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 27, 2026 12:31am

[greptile-apps]

Greptile Summary

The PR adds dedicated authenticated CloudWatch selector routes that resolve AWS configuration server-side and return name-only responses while preserving the existing runtime route contract.

• Extracts bounded CloudWatch log-group listing into a reusable utility.
• Adds strict wire and response contracts for log-group and log-stream selectors.
• Updates client selector registration, workflow scoping, cache privacy, and response mapping.
• Adds focused coverage for authorization short-circuiting, validation, pagination, client cleanup, and contract compatibility.

Confidence Score: 5/5

The PR appears safe to merge after its documented prerequisite branch is landed and the stack is rebased.

The new selector paths authenticate and authorize workflow scope before resolving AWS configuration, validate resolved values before provider access, isolate caches through shared workflow and opaque dependency scopes, return only names, and preserve existing runtime pagination and response behavior.

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/cloudwatch/selector-log-groups/route.ts	Adds an authenticated, workflow-authorized selector endpoint that validates resolved AWS configuration, lists groups, returns names only, and destroys the client.
apps/sim/app/api/tools/cloudwatch/selector-log-streams/route.ts	Adds the corresponding scoped log-stream selector endpoint with strict output mapping and client cleanup.
apps/sim/app/api/tools/cloudwatch/utils.ts	Extracts the existing bounded log-group pagination and normalization behavior without changing the runtime response contract.
apps/sim/hooks/selectors/providers/cloudwatch/selectors.ts	Moves both selectors to server-resolved contracts and privacy-preserving scoped cache keys while requiring workflow context.
apps/sim/lib/api/contracts/selectors/cloudwatch.ts	Separates reference-friendly selector request schemas from resolved AWS validation and introduces strict name-only response contracts.

Sequence Diagram

sequenceDiagram
    participant UI as CloudWatch selector
    participant Route as Selector API route
    participant Auth as Authorized context resolver
    participant AWS as CloudWatch Logs
    UI->>Route: workflowId + literals/opaque references
    Route->>Auth: principal + workflow scope + context
    Auth-->>Route: authorized resolved AWS configuration
    Route->>AWS: Describe log groups/streams
    AWS-->>Route: provider records
    Route-->>UI: strict name-only options

Loading

_{Reviews (1): Last reviewed commit: "fix(cloudwatch): resolve selector creden..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}