fix(queries): close React Query key/fetch-arg drift cache collisions

Several query hooks fetched with an identifier that was absent from their
queryKey, so distinct fetch args shared one cache entry. Thread the missing
args into the key factories and update all callsites/invalidations.

- organization: useOrganization always fetched the ACTIVE org via
  getFullOrganization() while caching under detail(orgId). Pass orgId through
  to the better-auth call (query.organizationId); active-org behavior unchanged.
- logs: logKeys.detail now keys on (workspaceId, logId) to prevent cross-
  workspace collision; updated useLogDetail, useLogByExecutionId, prefetchLogDetail,
  useCancelExecution optimistic path, and external callsites.
- inbox: inboxKeys.taskList now includes cursor/limit (pagination args were sent
  but omitted from the key); keepPreviousData pagination UX preserved.
- a2a: narrow create/update byWorkflows() invalidation to byWorkflow(ws, wf)
  since their responses reliably carry both ids; delete/publish stay broad.

Not bugs (verified, left unchanged):
- kb/connectors update/delete invalidate knowledgeKeys.detail(kbId), which is a
  prefix of connectorKeys.all(kbId) — connector list/detail are invalidated
  transitively by React Query prefix matching.

Harness: add a key-fetch-arg-drift check to check-react-query-patterns.ts that
flags a camelCase identifier the queryFn forwards into the fetch but is absent
from the queryKey (excludes the requestJson contract arg, PascalCase/SCREAMING
constants, and signal/pageParam machinery). Document the rule in sim-queries.md.
tables.useTable annotated rq-lint-allow (tableId globally unique; workspaceId is
only an authz scope).

Author: waleedlatif1

.claude/rules/sim-queries.md

@@ -25,6 +25,8 @@ export const entityKeys = {
 
 Never use inline query keys — always use the factory.
 
+**Every identifier the `queryFn` uses MUST appear in the `queryKey`.** If the fetch is scoped by `workspaceId`, `cursor`, `limit`, an org id, etc., those values must be part of the key — otherwise distinct fetch args share one cache entry (a cross-tenant / per-param cache collision). The lone exception is a globally-unique id used as the key while a second fetch arg is only an authz scope that cannot collide; annotate those with `// rq-lint-allow: <reason>`. Enforced by the `key-fetch-arg-drift` check in `scripts/check-react-query-patterns.ts`.
+
 ## File Structure
 
 ```typescript
@@ -142,4 +144,4 @@ const handler = useCallback(() => {
 
 ## Enforcement
 
-`scripts/check-react-query-patterns.ts` (`bun run check:react-query`, run in CI) statically enforces these conventions: every `useQuery`/`useInfiniteQuery`/`useSuspenseQuery` declares an explicit `staleTime`, inline `queryFn`s destructure `signal`, `queryKey`s reference a colocated factory rather than an inline literal, and every `*Keys` factory in `hooks/queries/**` exposes an `all` root key. `hooks/queries/**` is a zero-tolerance zone; the rest of `apps/sim/**` is ratcheted against `scripts/check-react-query-patterns.baseline.json`. For a genuine exception, put `// rq-lint-allow: <reason>` on the line directly above the flagged construct.
+`scripts/check-react-query-patterns.ts` (`bun run check:react-query`, run in CI) statically enforces these conventions: every `useQuery`/`useInfiniteQuery`/`useSuspenseQuery` declares an explicit `staleTime`, inline `queryFn`s destructure `signal`, `queryKey`s reference a colocated factory rather than an inline literal, every `*Keys` factory in `hooks/queries/**` exposes an `all` root key, and every identifier the `queryFn` forwards into the fetch also appears in the `queryKey` (`key-fetch-arg-drift`). `hooks/queries/**` is a zero-tolerance zone; the rest of `apps/sim/**` is ratcheted against `scripts/check-react-query-patterns.baseline.json`. For a genuine exception, put `// rq-lint-allow: <reason>` on the line directly above the flagged construct.

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-registry/resource-registry.tsx

@@ -255,9 +255,9 @@ const RESOURCE_INVALIDATORS: Record<
   scheduledtask: (qc, wId) => {
     qc.invalidateQueries({ queryKey: scheduleKeys.list(wId) })
   },
-  log: (qc, _wId, id) => {
+  log: (qc, wId, id) => {
     qc.invalidateQueries({ queryKey: logKeys.details() })
-    qc.invalidateQueries({ queryKey: logKeys.detail(id) })
+    qc.invalidateQueries({ queryKey: logKeys.detail(wId, id) })
   },
   /**
    * Integrations are sourced from the static integration catalog

apps/sim/app/workspace/[workspaceId]/logs/logs.tsx

@@ -525,7 +525,7 @@ export default function Logs() {
 
       try {
         const detailLog = await queryClient.fetchQuery({
-          queryKey: logKeys.detail(logId),
+          queryKey: logKeys.detail(workspaceId, logId),
           queryFn: ({ signal }) => fetchLogDetail(logId, workspaceId, signal),
           staleTime: 30 * 1000,
         })

apps/sim/hooks/queries/a2a/agents.ts

@@ -101,13 +101,19 @@ export function useCreateA2AAgent() {
 
   return useMutation({
     mutationFn: createA2AAgent,
-    onSettled: () => {
+    onSettled: (data) => {
       queryClient.invalidateQueries({
         queryKey: a2aAgentKeys.lists(),
       })
-      queryClient.invalidateQueries({
-        queryKey: a2aAgentKeys.byWorkflows(),
-      })
+      if (data) {
+        queryClient.invalidateQueries({
+          queryKey: a2aAgentKeys.byWorkflow(data.workspaceId, data.workflowId),
+        })
+      } else {
+        queryClient.invalidateQueries({
+          queryKey: a2aAgentKeys.byWorkflows(),
+        })
+      }
     },
   })
 }
@@ -136,16 +142,22 @@ export function useUpdateA2AAgent() {
 
   return useMutation({
     mutationFn: updateA2AAgent,
-    onSettled: (_data, _error, variables) => {
+    onSettled: (data, _error, variables) => {
       queryClient.invalidateQueries({
         queryKey: a2aAgentKeys.lists(),
       })
       queryClient.invalidateQueries({
         queryKey: a2aAgentKeys.detail(variables.agentId),
       })
-      queryClient.invalidateQueries({
-        queryKey: a2aAgentKeys.byWorkflows(),
-      })
+      if (data) {
+        queryClient.invalidateQueries({
+          queryKey: a2aAgentKeys.byWorkflow(data.workspaceId, data.workflowId),
+        })
+      } else {
+        queryClient.invalidateQueries({
+          queryKey: a2aAgentKeys.byWorkflows(),
+        })
+      }
     },
   })
 }

apps/sim/hooks/queries/inbox.ts

@@ -26,8 +26,8 @@ export const inboxKeys = {
   senders: () => [...inboxKeys.all, 'sender'] as const,
   senderList: (workspaceId: string) => [...inboxKeys.senders(), workspaceId] as const,
   tasks: () => [...inboxKeys.all, 'task'] as const,
-  taskList: (workspaceId: string, status?: string) =>
-    [...inboxKeys.tasks(), workspaceId, status ?? 'all'] as const,
+  taskList: (workspaceId: string, status?: string, cursor?: string, limit?: number) =>
+    [...inboxKeys.tasks(), workspaceId, status ?? 'all', cursor ?? '', limit ?? ''] as const,
 }
 
 type InboxTaskStatusFilter = InboxTaskStatus
@@ -88,7 +88,7 @@ export function useInboxTasks(
   opts: { status?: InboxTaskStatusFilter; cursor?: string; limit?: number } = {}
 ) {
   return useQuery({
-    queryKey: inboxKeys.taskList(workspaceId, opts.status),
+    queryKey: inboxKeys.taskList(workspaceId, opts.status, opts.cursor, opts.limit),
     queryFn: ({ signal }) => fetchInboxTasks(workspaceId, opts, signal),
     enabled: Boolean(workspaceId),
     staleTime: 15 * 1000,

apps/sim/hooks/queries/logs.ts

@@ -37,7 +37,8 @@ export const logKeys = {
   list: (workspaceId: string | undefined, filters: LogFilters) =>
     [...logKeys.lists(), workspaceId ?? '', filters] as const,
   details: () => [...logKeys.all, 'detail'] as const,
-  detail: (logId: string | undefined) => [...logKeys.details(), logId ?? ''] as const,
+  detail: (workspaceId: string | undefined, logId: string | undefined) =>
+    [...logKeys.details(), workspaceId ?? '', logId ?? ''] as const,
   byExecutionAll: () => [...logKeys.all, 'byExecution'] as const,
   byExecution: (workspaceId: string | undefined, executionId: string | undefined) =>
     [...logKeys.byExecutionAll(), workspaceId ?? '', executionId ?? ''] as const,
@@ -189,7 +190,7 @@ export function useLogDetail(
   options?: UseLogDetailOptions
 ) {
   return useQuery({
-    queryKey: logKeys.detail(logId),
+    queryKey: logKeys.detail(workspaceId, logId),
     queryFn: ({ signal }) => fetchLogDetail(logId as string, workspaceId as string, signal),
     enabled: Boolean(logId) && Boolean(workspaceId) && (options?.enabled ?? true),
     refetchInterval: options?.refetchInterval ?? false,
@@ -212,7 +213,7 @@ export function useLogByExecutionId(
         query: { workspaceId: workspaceId as string },
         signal,
       })
-      queryClient.setQueryData(logKeys.detail(data.id), data)
+      queryClient.setQueryData(logKeys.detail(workspaceId, data.id), data)
       return data
     },
     enabled: Boolean(workspaceId) && Boolean(executionId),
@@ -222,7 +223,7 @@ export function useLogByExecutionId(
 
 export function prefetchLogDetail(queryClient: QueryClient, logId: string, workspaceId: string) {
   queryClient.prefetchQuery({
-    queryKey: logKeys.detail(logId),
+    queryKey: logKeys.detail(workspaceId, logId),
     queryFn: ({ signal }) => fetchLogDetail(logId, workspaceId, signal),
     staleTime: 30 * 1000,
   })
@@ -315,6 +316,7 @@ export function useCancelExecution() {
       })
 
       let affectedLogId: string | null = null
+      let affectedWorkspaceId: string | undefined
       queryClient.setQueriesData<InfiniteData<LogsPage>>({ queryKey: logKeys.lists() }, (old) => {
         if (!old) return old
         return {
@@ -324,6 +326,7 @@ export function useCancelExecution() {
             logs: page.logs.map((log) => {
               if (log.executionId !== executionId) return log
               affectedLogId = log.id
+              affectedWorkspaceId = log.workflow?.workspaceId ?? undefined
               return { ...log, status: 'cancelling' }
             }),
           })),
@@ -332,23 +335,31 @@ export function useCancelExecution() {
 
       let previousDetail: WorkflowLogDetail | undefined
       if (affectedLogId) {
-        previousDetail = queryClient.getQueryData<WorkflowLogDetail>(logKeys.detail(affectedLogId))
+        previousDetail = queryClient.getQueryData<WorkflowLogDetail>(
+          logKeys.detail(affectedWorkspaceId, affectedLogId)
+        )
         if (previousDetail) {
-          queryClient.setQueryData<WorkflowLogDetail>(logKeys.detail(affectedLogId), {
-            ...previousDetail,
-            status: 'cancelling',
-          })
+          queryClient.setQueryData<WorkflowLogDetail>(
+            logKeys.detail(affectedWorkspaceId, affectedLogId),
+            {
+              ...previousDetail,
+              status: 'cancelling',
+            }
+          )
         }
       }
 
-      return { previousQueries, affectedLogId, previousDetail }
+      return { previousQueries, affectedLogId, affectedWorkspaceId, previousDetail }
     },
     onError: (_err, _variables, context) => {
       for (const [queryKey, data] of context?.previousQueries ?? []) {
         queryClient.setQueryData(queryKey, data)
       }
       if (context?.affectedLogId && context.previousDetail !== undefined) {
-        queryClient.setQueryData(logKeys.detail(context.affectedLogId), context.previousDetail)
+        queryClient.setQueryData(
+          logKeys.detail(context.affectedWorkspaceId, context.affectedLogId),
+          context.previousDetail
+        )
       }
     },
     onSettled: () => {

apps/sim/hooks/queries/organization.ts

@@ -174,10 +174,18 @@ export function useOrganizations() {
 }
 
 /**
- * Fetch a specific organization by ID
+ * Fetch a specific organization by ID.
+ *
+ * `getFullOrganization` defaults to the active organization when no
+ * `organizationId` is supplied; passing `orgId` through scopes the result to the
+ * requested org so it is cached under the correct `organizationKeys.detail(orgId)`
+ * (no cross-org cache collision). The active-org caller passes the active org's
+ * id, so its behavior is unchanged.
  */
-async function fetchOrganization(_signal?: AbortSignal) {
-  const response = await client.organization.getFullOrganization()
+async function fetchOrganization(orgId: string, _signal?: AbortSignal) {
+  const response = await client.organization.getFullOrganization({
+    query: { organizationId: orgId },
+  })
   return response.data
 }
 
@@ -187,7 +195,7 @@ async function fetchOrganization(_signal?: AbortSignal) {
 export function useOrganization(orgId: string) {
   return useQuery({
     queryKey: organizationKeys.detail(orgId),
-    queryFn: ({ signal }) => fetchOrganization(signal),
+    queryFn: ({ signal }) => fetchOrganization(orgId, signal),
     enabled: !!orgId,
     staleTime: 30 * 1000,
     placeholderData: keepPreviousData,

apps/sim/hooks/queries/tables.ts

@@ -265,6 +265,7 @@ export function useTablesList(
  * Fetch a single table by id.
  */
 export function useTable(workspaceId: string | undefined, tableId: string | undefined) {
+  // rq-lint-allow: tableId is a globally-unique id; workspaceId is only an authz scope on the fetch and cannot collide across workspaces
   return useQuery({
     queryKey: tableKeys.detail(tableId ?? ''),
     queryFn: ({ signal }) => fetchTable(workspaceId as string, tableId as string, signal),