chore(mothership): stop minting delegation tokens on request paths

The worker no longer consumes them (the CLI executes sim-side; the handler
mints its own identity per invocation), so the chat POST, v2 chat, inbox,
and execute senders were one DB roundtrip + a plaintext credential on the
wire for nothing. mintDelegationToken stays — the sim_cli handler is its
one consumer now.

Claude-Session: https://claude.ai/code/session_01CgaxNAaeD3taGdghbXn17w

Author: Sg312

apps/sim/app/api/mothership/execute/route.ts

@@ -14,7 +14,6 @@ import {
   RESOLVED_SECRET_PROVENANCE_METADATA_V1,
   requestsPrivateToolMetadata,
 } from '@/lib/execution/private-tool-metadata'
-import { mintDelegationToken } from '@/lib/mothership/chat/delegation'
 import { buildIntegrationToolSchemas } from '@/lib/mothership/chat/payload'
 import { processContextsServer } from '@/lib/mothership/chat/process-contents'
 import {
@@ -272,7 +271,6 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
         ? { ...m, content: `${contextBlocks.join('\n\n')}\n\n${m.content}` }
         : m
     )
-    const delegationToken = await mintDelegationToken({ workspaceId, userId })
     const requestPayload: Record<string, unknown> = {
       messages: wireMessages,
       ...(responseFormat !== undefined ? { responseFormat } : {}),
@@ -283,7 +281,6 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       messageId,
       ...(integrationTools.length > 0 ? { integrationTools } : {}),
       ...(mothershipTools.length > 0 ? { mothershipTools } : {}),
-      ...(delegationToken ? { delegationToken } : {}),
     }
 
     let allowExplicitAbort = true

apps/sim/app/api/v2/chat/route.ts

@@ -16,7 +16,6 @@ import { resolveBillingAttribution } from '@/lib/billing/core/billing-attributio
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getPersonalAndWorkspaceEnv } from '@/lib/environment/utils'
 import { chatOperations } from '@/lib/mothership/application/operations'
-import { mintDelegationToken } from '@/lib/mothership/chat/delegation'
 import { resolveOrCreateChat } from '@/lib/mothership/chat/lifecycle'
 import { persistCopilotChatTurn } from '@/lib/mothership/chat/messages-store'
 import { buildIntegrationToolSchemas } from '@/lib/mothership/chat/payload'
@@ -232,13 +231,12 @@ export const POST = withRouteHandler(
         })
       }
 
-      const [integrationTools, billingAttribution, delegationToken] = await Promise.all([
+      const [integrationTools, billingAttribution] = await Promise.all([
         buildIntegrationToolSchemas(userId, messageId, undefined, workspaceId),
         // Hosted execution refuses to run without an attribution snapshot;
         // the executor path receives it as a header, this path resolves it
         // from the authenticated actor and asserted workspace.
         resolveBillingAttribution({ actorUserId: userId, workspaceId }),
-        mintDelegationToken({ workspaceId, userId }),
       ])
 
       /**
@@ -255,7 +253,6 @@ export const POST = withRouteHandler(
         chatId,
         messageId,
         ...(integrationTools.length > 0 ? { integrationTools } : {}),
-        ...(delegationToken ? { delegationToken } : {}),
       }
 
       let allowExplicitAbort = true

apps/sim/lib/mothership/chat/post.ts

@@ -12,7 +12,6 @@ import { getSession } from '@/lib/auth'
 import { resolveBillingAttribution } from '@/lib/billing/core/billing-attribution'
 import type { AtomicClaimResult } from '@/lib/core/idempotency'
 import { chatSendIdempotency } from '@/lib/core/idempotency'
-import { mintDelegationToken } from '@/lib/mothership/chat/delegation'
 import {
   DESKTOP_TERMINAL_HINT_ID_MAX_LENGTH,
   DESKTOP_TERMINAL_HINT_TEXT_MAX_LENGTH,
@@ -1248,9 +1247,6 @@ export async function handleUnifiedChatPost(req: NextRequest) {
        * queries and ~900ms p95 per message). Its prep slot now mints the run-scoped
        * delegation credential the worker presents on v2 calls (revamp D23).
        */
-      const delegationTokenPromise = workspaceId
-        ? mintDelegationToken({ workspaceId, userId: authenticatedUserId })
-        : Promise.resolve(null)
       const executionContextPromise = withCopilotSpan(
         TraceSpan.CopilotChatBuildExecutionContext,
         { [TraceAttr.CopilotBranchKind]: branch.kind },
@@ -1294,14 +1290,12 @@ export async function handleUnifiedChatPost(req: NextRequest) {
         notifyWorkspaceStatus: branch.notifyWorkspaceStatus,
         parentOtelContext: activeOtelRoot.context,
       })
-      const [agentContexts, userPermission, delegationToken, , executionContext] =
-        await Promise.all([
-          agentContextsPromise,
-          userPermissionPromise,
-          delegationTokenPromise,
-          persistUserMessagePromise,
-          executionContextPromise,
-        ])
+      const [agentContexts, userPermission, , executionContext] = await Promise.all([
+        agentContextsPromise,
+        userPermissionPromise,
+        persistUserMessagePromise,
+        executionContextPromise,
+      ])
 
       executionContext.userPermission = userPermission ?? undefined
 
@@ -1375,7 +1369,6 @@ export async function handleUnifiedChatPost(req: NextRequest) {
         requestPayload: {
           ...requestPayload,
           protocolVersion: PROTOCOL_VERSION,
-          ...(delegationToken ? { delegationToken } : {}),
         },
         userId: authenticatedUserId,
         streamId: userMessageId,

apps/sim/lib/mothership/inbox/executor.ts

@@ -5,7 +5,6 @@ import { generateId } from '@sim/utils/id'
 import { and, eq, sql } from 'drizzle-orm'
 import { getActivelyBannedUserIds, isEmailBlocked } from '@/lib/auth/ban'
 import { resolveBillingAttribution } from '@/lib/billing/core/billing-attribution'
-import { mintDelegationToken } from '@/lib/mothership/chat/delegation'
 import { resolveOrCreateChat } from '@/lib/mothership/chat/lifecycle'
 import { appendCopilotChatMessages } from '@/lib/mothership/chat/messages-store'
 import { buildIntegrationToolSchemas } from '@/lib/mothership/chat/payload'
@@ -225,15 +224,11 @@ export async function executeInboxTask(taskId: string): Promise<void> {
       secretScope: ws.inboxSecretScope,
       mountedSecrets: ws.inboxMountedSecrets,
     })
-    const [attachmentResult, integrationTools, billingAttribution, delegationToken] =
-      await Promise.all([
-        fetchAttachments(),
-        buildIntegrationToolSchemas(userId, undefined, undefined, ws.id),
-        resolveBillingAttribution({ actorUserId: userId, workspaceId: ws.id }),
-        // Trigger-runtime caveat (see docs/revamp/06-cutover.md): a failed mint falls
-        // back to null and the turn proceeds without CLI-backed capabilities.
-        mintDelegationToken({ workspaceId: ws.id, userId }),
-      ])
+    const [attachmentResult, integrationTools, billingAttribution] = await Promise.all([
+      fetchAttachments(),
+      buildIntegrationToolSchemas(userId, undefined, undefined, ws.id),
+      resolveBillingAttribution({ actorUserId: userId, workspaceId: ws.id }),
+    ])
     const { attachments, fileAttachments, storedAttachments } = attachmentResult
 
     const truncatedTask = {
@@ -254,7 +249,6 @@ export async function executeInboxTask(taskId: string): Promise<void> {
       chatId,
       messageId: userMessageId,
       ...(integrationTools.length > 0 ? { integrationTools } : {}),
-      ...(delegationToken ? { delegationToken } : {}),
     }
 
     const result = await runHeadlessCopilotLifecycle(requestPayload, {