fix(workflow): keep a saved connection in its workspace

[huyplb]

Membership is required to save, run, or inspect a workflow that uses one, including rows a run already fetched. The designer keeps fields it does not edit, and the engine refuses to listen off loopback without a token.

---

Note

High Risk
Changes authentication (engine listen binding, service token guards), authorization (workspace-scoped connection checks on save/run/read), and workflow trust (origin); proxy allowlist and run snapshot behavior affect who can reach engine data.

Overview
Keeps saved FoxSchema connections scoped to their workspace when workflows are saved, run, or inspected through the proxy: it walks linked credentialIds, checks workspace membership via notUsableBy, and for runs uses GET /runs/:id/snapshot so edits/deletes to the live workflow cannot hide connections already used.

Fixes workflow designer data loss on load/save by carrying through fields the UI does not edit (name, version, origin, errorHandler, pipe timeoutMs, HTTP token-refresh headers/body) and adding compile-time engineShapes checks so local editor types cannot drift from @foxschema/workflow-engine/definitions. The engine refuses to promote origin on PUT for non-authored workflows; duplicate drops shared webhook paths.

Hardens engine exposure and proxy surface: workflow-server won't bind off loopback without WORKFLOW_ENGINE_TOKEN; internal mounts use a shared engineTokenGuard; run steering endpoints are removed from the allowlist until UI exists; settings PUT validates known engine enums. Run/event streaming pushes on append (with fallback poll), and the Runs panel / debug hook resume SSE after the last loaded seq and poll only when the stream is down.

Smaller fixes: trigger dialog drops dead Save/Test buttons and placeholder sections; CSV parser performance + formula-safe file sink; query API keys redacted in reported HTTP URLs; workflow list avoids loading full run history; E2E workflow-designer-roundtrip added.

^{Reviewed by Cursor Bugbot for commit 3129834. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: dc4bdc6d-ecab-4850-bdb8-8e7da1aca628)

[github-actions]

Test IDs

Added (6)

• workflow-designer-id
• workflow-designer-load
• workflow-designer-save
• workflow-designer-triggers
• workflow-trigger-config
• workflow-trigger-config-note

{…} is a part filled in at run time. The full tree: docs/testing/TEST_IDS.md.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 3c8b3b2c-02f0-42e5-b915-50f50a38e4d6)