refactor(serializer): drop tools.config.params invocation; enforce canonical-id contract via audit

The serializer's pre-execution validator no longer runs the block's
`tools.config.params` mapper to discover renamed tool param ids. Instead
it relies on the contract that every required+user-only tool param is
backed by a subBlock whose `id` or `canonicalParamId` equals the tool
param id, and a new audit (`bun run check:block-canonical`) enforces
this. Migrates posthog (`personalApiKey` → canonical `apiKey`) so the
audit passes cleanly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/blocks/blocks/posthog.ts

@@ -156,6 +156,7 @@ export const PostHogBlock: BlockConfig<PostHogResponse> = {
       id: 'personalApiKey',
       title: 'Personal API Key',
       type: 'short-input',
+      canonicalParamId: 'apiKey',
       placeholder: 'Enter your PostHog personal API key',
       password: true,
       condition: {
@@ -1192,9 +1193,6 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
         if (params.operation === 'posthog_get_project' && params.projectIdParam) {
           params.projectId = params.projectIdParam
         }
-        if (params.personalApiKey) {
-          params.apiKey = params.personalApiKey
-        }
 
         const flagOps = [
           'posthog_get_feature_flag',
@@ -1276,7 +1274,7 @@ Return ONLY the timestamp string - no explanations, no quotes, no extra text.`,
     operation: { type: 'string', description: 'Operation to perform' },
     region: { type: 'string', description: 'PostHog region (us or eu)' },
     projectApiKey: { type: 'string', description: 'Project API key for public endpoints' },
-    personalApiKey: { type: 'string', description: 'Personal API key for private endpoints' },
+    apiKey: { type: 'string', description: 'Personal API key for private endpoints' },
     projectId: { type: 'string', description: 'PostHog project ID' },
     // Core Data
     event: { type: 'string', description: 'Event name' },

apps/sim/scripts/check-block-canonical.ts

@@ -0,0 +1,74 @@
+#!/usr/bin/env bun
+
+/**
+ * CI check: enforce the canonical-id contract that the serializer's
+ * pre-execution validator relies on.
+ *
+ * For every (block, tool) pair where the tool param is `required: true` and
+ * `visibility: 'user-only'`, the block must expose a subBlock whose `id` or
+ * `canonicalParamId` equals the tool param id. Otherwise the validator
+ * resolves the value under the wrong key and false-flags the field as missing
+ * at submit time.
+ *
+ * Historically this was patched at runtime by invoking `tools.config.params`
+ * inside try/catch during validation. That swallowed mapper throws on
+ * placeholder values and degraded validation accuracy. This audit lifts the
+ * contract into config so the validator can stay pure.
+ *
+ * Usage:
+ *   bun run apps/sim/scripts/check-block-canonical.ts
+ */
+
+import { getAllBlocks } from '@/blocks/registry'
+import { tools as toolRegistry } from '@/tools/registry'
+
+type Violation = {
+  blockType: string
+  toolId: string
+  paramId: string
+}
+
+const violations: Violation[] = []
+
+for (const block of getAllBlocks()) {
+  const access: string[] = block.tools?.access ?? []
+  if (access.length === 0) continue
+
+  const subBlockKeys = new Set<string>()
+  for (const sb of block.subBlocks ?? []) {
+    if (sb.id) subBlockKeys.add(sb.id)
+    const canonical = (sb as { canonicalParamId?: string }).canonicalParamId
+    if (canonical) subBlockKeys.add(canonical)
+  }
+
+  for (const toolId of access) {
+    const tool = toolRegistry[toolId]
+    if (!tool) continue
+
+    for (const [paramId, paramConfig] of Object.entries(tool.params ?? {})) {
+      if (!paramConfig || typeof paramConfig !== 'object') continue
+      const required = (paramConfig as { required?: boolean }).required === true
+      const userOnly = (paramConfig as { visibility?: string }).visibility === 'user-only'
+      if (!required || !userOnly) continue
+
+      if (!subBlockKeys.has(paramId)) {
+        violations.push({ blockType: block.type, toolId, paramId })
+      }
+    }
+  }
+}
+
+if (violations.length > 0) {
+  console.error(`\nFound ${violations.length} block/tool canonical-id mismatch(es):\n`)
+  for (const v of violations) {
+    console.error(
+      `  - block '${v.blockType}' → tool '${v.toolId}': required user-only param '${v.paramId}' has no subBlock with id or canonicalParamId === '${v.paramId}'`
+    )
+  }
+  console.error(
+    "\nFix: rename the relevant subBlock id or canonicalParamId to match the tool param id,\n     and update the block's inputs + tools.config.params mapper to read from that key.\n"
+  )
+  process.exit(1)
+}
+
+console.log('check:block-canonical — no violations.')

apps/sim/serializer/index.ts

@@ -433,29 +433,18 @@ export class Serializer {
     const currentToolId = toolAccess?.length > 0 ? this.selectToolId(blockConfig, params) : null
     const currentTool = currentToolId ? getTool(currentToolId) : null
 
-    // Validate tool parameters (for blocks with tools)
+    // Validate tool parameters (for blocks with tools).
+    // Lookup contract: a tool param's value lives under its own paramId in `params`.
+    // Block subBlocks must align via either `id === paramId` or `canonicalParamId === paramId`
+    // (enforced by `bun run check:block-canonical`), so this validator never has to invoke
+    // the block's `tools.config.params` mapper.
     if (currentTool) {
-      // Apply the block's tools.config.params transform to mirror execution-time
-      // canonical → tool-param renaming (e.g. canonical `document` → tool param `file`).
-      // Without this, validation looks up the pre-rename name and incorrectly reports
-      // a missing field for blocks that rename inputs in tools.config.params.
-      let mappedParams: Record<string, any> = params
-      try {
-        const paramsMapper = blockConfig.tools?.config?.params
-        if (typeof paramsMapper === 'function') {
-          const result = paramsMapper({ ...params })
-          if (result && typeof result === 'object' && !Array.isArray(result)) {
-            mappedParams = { ...params, ...result }
-          }
-        }
-      } catch {
-        // Mapper may throw on placeholder/runtime values — fall back to raw params.
-      }
-
       Object.entries(currentTool.params || {}).forEach(([paramId, paramConfig]) => {
         if (paramConfig.required && paramConfig.visibility === 'user-only') {
           const matchingConfigs =
-            blockConfig.subBlocks?.filter((sb: any) => sb.id === paramId) || []
+            blockConfig.subBlocks?.filter(
+              (sb: any) => sb.id === paramId || sb.canonicalParamId === paramId
+            ) || []
 
           let shouldValidateParam = true
 
@@ -485,7 +474,7 @@ export class Serializer {
             return
           }
 
-          const fieldValue = mappedParams[paramId]
+          const fieldValue = params[paramId]
           if (fieldValue === undefined || fieldValue === null || fieldValue === '') {
             const activeConfig = matchingConfigs.find((config: any) =>
               shouldSerializeSubBlock(
@@ -509,10 +498,13 @@ export class Serializer {
     const validatedByTool = new Set(currentTool ? Object.keys(currentTool.params || {}) : [])
 
     blockConfig.subBlocks?.forEach((subBlockConfig: SubBlockConfig) => {
-      // Skip if already validated via tool params
+      // Skip if already validated via tool params (either by id or canonical bridge)
       if (validatedByTool.has(subBlockConfig.id)) {
         return
       }
+      if (subBlockConfig.canonicalParamId && validatedByTool.has(subBlockConfig.canonicalParamId)) {
+        return
+      }
 
       // Check if subBlock is visible
       const isVisible = shouldSerializeSubBlock(

package.json

@@ -24,6 +24,7 @@
     "check:boundaries": "bun run scripts/check-monorepo-boundaries.ts",
     "check:api-validation": "bun run scripts/check-api-validation-contracts.ts --check",
     "check:api-validation:strict": "bun run scripts/check-api-validation-contracts.ts --check --enforce-boundary-baseline",
+    "check:block-canonical": "bun run apps/sim/scripts/check-block-canonical.ts",
     "check:realtime-prune": "bun run scripts/check-realtime-prune-graph.ts",
     "mship-contracts:generate": "bun run scripts/sync-mothership-stream-contract.ts",
     "mship-contracts:check": "bun run scripts/sync-mothership-stream-contract.ts --check",