fix(bigquery): derive body identifiers from the path guard, not a bare trim

safeUrlPathSegment deliberately accepts a finite number or a bigint, because an
LLM tool call can serialize a numeric-looking id as a JSON number. The .trim()
this replaces did not, so a numeric projectId built the path fine and then threw
a raw TypeError while building the body — the request died after passing its own
guard.

Adds canonicalBigQueryId, which round-trips through safeUrlPathSegment and undoes
only the percent-encoding, so the body reuses the path guard's accepted input
kinds, trimming and dot-segment rejection instead of restating them. Applied to
all six body identifiers, including the five .trim() sites that predate this
branch and shared the same fragility.

Pinned with a numeric-projectId test verified red against the bare trim.

Author: waleedlatif1

apps/sim/tools/google_bigquery/create_dataset.ts

@@ -2,6 +2,7 @@ import type {
   GoogleBigQueryCreateDatasetParams,
   GoogleBigQueryCreateDatasetResponse,
 } from '@/tools/google_bigquery/types'
+import { canonicalBigQueryId } from '@/tools/google_bigquery/utils'
 import type { ToolConfig } from '@/tools/types'
 import { safeUrlPathSegment } from '@/tools/url-path'
 
@@ -69,8 +70,8 @@ export const googleBigQueryCreateDatasetTool: ToolConfig<
     body: (params) => {
       const body: Record<string, unknown> = {
         datasetReference: {
-          projectId: params.projectId.trim(),
-          datasetId: params.datasetId.trim(),
+          projectId: canonicalBigQueryId(params.projectId, 'projectId'),
+          datasetId: canonicalBigQueryId(params.datasetId, 'datasetId'),
         },
       }
       if (params.location) body.location = params.location

apps/sim/tools/google_bigquery/create_table.ts

@@ -2,6 +2,7 @@ import type {
   GoogleBigQueryCreateTableParams,
   GoogleBigQueryCreateTableResponse,
 } from '@/tools/google_bigquery/types'
+import { canonicalBigQueryId } from '@/tools/google_bigquery/utils'
 import type { ToolConfig } from '@/tools/types'
 import { safeUrlPathSegment } from '@/tools/url-path'
 
@@ -94,9 +95,9 @@ export const googleBigQueryCreateTableTool: ToolConfig<
 
       const body: Record<string, unknown> = {
         tableReference: {
-          projectId: params.projectId.trim(),
-          datasetId: params.datasetId.trim(),
-          tableId: params.tableId.trim(),
+          projectId: canonicalBigQueryId(params.projectId, 'projectId'),
+          datasetId: canonicalBigQueryId(params.datasetId, 'datasetId'),
+          tableId: canonicalBigQueryId(params.tableId, 'tableId'),
         },
         schema: { fields },
       }

apps/sim/tools/google_bigquery/path_safety.test.ts

@@ -17,6 +17,7 @@ import {
   toolsWithoutPathParams,
 } from '@/tools/__tests__/path-safety'
 import * as bigQueryTools from '@/tools/google_bigquery/index'
+import { canonicalBigQueryId } from '@/tools/google_bigquery/utils'
 
 const ORIGIN = 'https://bigquery.googleapis.com'
 
@@ -97,6 +98,33 @@ describe('projectId agrees between URL and body', () => {
     { name: 'google_bigquery_create_dataset', tool: bigQueryTools.googleBigQueryCreateDatasetTool },
   ]
 
+  /**
+   * `safeUrlPathSegment` accepts a finite number or a bigint, because an LLM
+   * tool call can serialize a numeric-looking id as a JSON **number**. A bare
+   * `.trim()` in the body does not, so the path built fine while the body threw
+   * a raw `TypeError` — the request died after passing its own guard.
+   */
+  it.each(BODY_TOOLS)('$name builds from a numeric project id', ({ tool }) => {
+    const params = {
+      accessToken: 't',
+      projectId: 123456,
+      datasetId: 'my_dataset',
+      defaultDatasetId: 'my_dataset',
+      tableId: 'my_table',
+      query: 'SELECT 1',
+      schema: '[{"name":"id","type":"STRING"}]',
+    }
+
+    const url = new URL((tool.request?.url as (p: typeof params) => string)(params))
+    const body = (tool.request?.body as ((p: typeof params) => unknown) | undefined)?.(params)
+
+    expect(url.pathname).toContain('/projects/123456')
+    const serialized = JSON.stringify(body)
+    if (serialized?.includes('projectId')) {
+      expect(serialized).toContain('"projectId":"123456"')
+    }
+  })
+
   it.each(BODY_TOOLS)('$name sends one project id', ({ tool }) => {
     const params = {
       accessToken: 't',
@@ -119,3 +147,35 @@ describe('projectId agrees between URL and body', () => {
     }
   })
 })
+
+/**
+ * `canonicalBigQueryId` round-trips through the path guard and undoes only the
+ * percent-encoding. These assertions pin the two properties that makes it safe
+ * to use for a JSON body: the round-trip is **exact identity** even for values
+ * containing `%` or `+`, and every rejection is inherited from the guard rather
+ * than restated here.
+ */
+describe('canonicalBigQueryId', () => {
+  it.each(['a%2Fb', 'a+b', 'a b', 'проект', 'a-b_c.d', 'bigquery-public-data'])(
+    'returns %j unchanged',
+    (value) => {
+      expect(canonicalBigQueryId(value, 'projectId')).toBe(value)
+    }
+  )
+
+  it('trims the way the path guard does', () => {
+    expect(canonicalBigQueryId('  my-project  ', 'projectId')).toBe('my-project')
+  })
+
+  it('accepts a numeric id, which a bare trim would throw on', () => {
+    expect(canonicalBigQueryId(123456, 'projectId')).toBe('123456')
+  })
+
+  it('accepts a bigint id, which a bare trim would throw on', () => {
+    expect(canonicalBigQueryId(9007199254740991n, 'projectId')).toBe('9007199254740991')
+  })
+
+  it.each(['..', '.', 'a/b', 'a\\b'])('inherits the guard rejection of %j', (value) => {
+    expect(() => canonicalBigQueryId(value, 'projectId')).toThrow(/projectId/)
+  })
+})

apps/sim/tools/google_bigquery/query.ts

@@ -2,6 +2,7 @@ import type {
   GoogleBigQueryQueryParams,
   GoogleBigQueryQueryResponse,
 } from '@/tools/google_bigquery/types'
+import { canonicalBigQueryId } from '@/tools/google_bigquery/utils'
 import type { ToolConfig } from '@/tools/types'
 import { safeUrlPathSegment } from '@/tools/url-path'
 
@@ -80,7 +81,7 @@ export const googleBigQueryQueryTool: ToolConfig<
       if (params.maxResults !== undefined) body.maxResults = Number(params.maxResults)
       if (params.defaultDatasetId) {
         body.defaultDataset = {
-          projectId: params.projectId.trim(),
+          projectId: canonicalBigQueryId(params.projectId, 'projectId'),
           datasetId: params.defaultDatasetId,
         }
       }

apps/sim/tools/google_bigquery/utils.ts

@@ -0,0 +1,28 @@
+import { safeUrlPathSegment } from '@/tools/url-path'
+
+/**
+ * Returns the canonical, unencoded form of an identifier that appears in both
+ * the request path and the request body.
+ *
+ * BigQuery names the same project, dataset and table twice per request — once
+ * in the URL and once in `datasetReference` / `tableReference` /
+ * `defaultDataset` — and the two must agree. Deriving the body's value from the
+ * *path guard* rather than trimming independently is what keeps them in step:
+ * a second normalization rule is a second thing to drift.
+ *
+ * Round-tripping through `safeUrlPathSegment` reuses that guard exactly — its
+ * accepted input kinds, its trimming, and its rejection of dot segments — and
+ * then undoes only the percent-encoding, which a JSON body must not carry.
+ * `encodeURIComponent` and `decodeURIComponent` are exact inverses, so the
+ * value is the guard's own output rather than an approximation of it.
+ *
+ * A bare `params.projectId.trim()` is what this replaces, and it was wrong in a
+ * way the URL could not reveal: `safeUrlPathSegment` deliberately accepts a
+ * finite number or a bigint, because an LLM tool call can serialize a
+ * numeric-looking id as a JSON **number**. The path built fine from `123456`
+ * while the body threw a bare `TypeError: params.projectId.trim is not a
+ * function`, so the request died after passing its own guard.
+ */
+export function canonicalBigQueryId(value: string | number | bigint, paramName: string): string {
+  return decodeURIComponent(safeUrlPathSegment(value, paramName))
+}