refactor(tools): use #7262's strictUrlPathSegment and delete the local copy

#7262 landed d2c74d7, defining strictUrlPathSegment and
strictEncodedUrlPathSegment in url-path.ts to refuse padded identifiers on
state-changing requests. That is the rule this branch introduced locally while
the two PRs were in flight, so the duplication collapses now that the rebase
brings it in: tools/strict-url-path.ts is deleted and its four consumers import
from @/tools/url-path.

Their assertUnpadded is slightly better than the local version — an all-whitespace
value falls through to safeUrlPathSegment and reports "is required" rather than
a padding error, which names the real problem. strictCanonicalBigQueryId now
derives from their guard too, so the body value and the path value share one
rule rather than two.

The error text changed from "cannot have" to "must not have leading or trailing
whitespace", and four assertions failed on the rebase because they pin the exact
text. They are updated to the new wording rather than loosened — that precision
is the property that caught this and two earlier upstream changes.

Author: waleedlatif1

apps/sim/tools/__tests__/path-safety-matcher.test.ts

@@ -14,8 +14,8 @@ import { namesParam } from '@/tools/__tests__/path-safety'
 
 describe('namesParam', () => {
   it.each([
-    ['projectId cannot have leading or trailing whitespace', 'projectId'],
-    ['signRequestId cannot have leading or trailing whitespace', 'signRequestId'],
+    ['projectId must not have leading or trailing whitespace', 'projectId'],
+    ['signRequestId must not have leading or trailing whitespace', 'signRequestId'],
     ['bucket cannot contain a path separator', 'bucket'],
     ['path cannot contain an empty or whitespace-only path segment', 'path'],
     ['tableId cannot be "." (path traversal is not allowed)', 'tableId'],

apps/sim/tools/box_sign/cancel_request.ts

@@ -1,5 +1,5 @@
-import { strictUrlPathSegment } from '@/tools/strict-url-path'
 import type { ToolConfig } from '@/tools/types'
+import { strictUrlPathSegment } from '@/tools/url-path'
 import type { BoxSignCancelRequestParams, BoxSignResponse } from './types'
 import { SIGN_REQUEST_OUTPUT_PROPERTIES } from './types'
 

apps/sim/tools/box_sign/get_request.ts

@@ -1,5 +1,5 @@
-import { strictUrlPathSegment } from '@/tools/strict-url-path'
 import type { ToolConfig } from '@/tools/types'
+import { strictUrlPathSegment } from '@/tools/url-path'
 import type { BoxSignGetRequestParams, BoxSignResponse } from './types'
 import { SIGN_REQUEST_OUTPUT_PROPERTIES } from './types'
 

apps/sim/tools/box_sign/path_safety.test.ts

@@ -110,7 +110,7 @@ describe('a padded signRequestId cannot become a successful cancellation', () =>
         accessToken: 't',
         signRequestId: PADDED,
       })
-    ).toThrow(/signRequestId cannot have leading or trailing whitespace/)
+    ).toThrow(/signRequestId must not have leading or trailing whitespace/)
   })
 
   it.each(STATE_CHANGING)('$name still accepts the unpadded id', ({ tool }) => {

apps/sim/tools/box_sign/resend_request.ts

@@ -1,5 +1,5 @@
-import { strictUrlPathSegment } from '@/tools/strict-url-path'
 import type { ToolConfig, ToolResponse } from '@/tools/types'
+import { strictUrlPathSegment } from '@/tools/url-path'
 import type { BoxSignResendRequestParams } from './types'
 
 export const boxSignResendRequestTool: ToolConfig<BoxSignResendRequestParams, ToolResponse> = {

apps/sim/tools/google_bigquery/path_safety.test.ts

@@ -261,7 +261,7 @@ describe('a padded projectId cannot become a successful destructive request', ()
         datasetId: 'prod_dataset',
         tableId: 'prod_table',
       })
-    ).toThrow(/projectId cannot have leading or trailing whitespace/)
+    ).toThrow(/projectId must not have leading or trailing whitespace/)
   })
 
   it.each(DESTRUCTIVE)('$name still accepts the unpadded id', ({ tool }) => {

apps/sim/tools/google_bigquery/utils.ts

@@ -1,5 +1,4 @@
-import { assertNoSurroundingWhitespace, strictUrlPathSegment } from '@/tools/strict-url-path'
-import { safeUrlPathSegment } from '@/tools/url-path'
+import { safeUrlPathSegment, strictUrlPathSegment } from '@/tools/url-path'
 
 /**
  * Returns the canonical, unencoded form of an identifier that appears in both
@@ -37,8 +36,7 @@ export function strictCanonicalBigQueryId(
   value: string | number | bigint,
   paramName: string
 ): string {
-  assertNoSurroundingWhitespace(value, paramName)
-  return canonicalBigQueryId(value, paramName)
+  return decodeURIComponent(strictUrlPathSegment(value, paramName))
 }
 
 /**