fix(copilot): service-account discovery must un-gate after the block GAs

Review round on #5786: describeServiceAccountForOAuthProvider used
`getBlock(...)?.preview ?? true`, which treats a GA'd gating block — one
that dropped its `preview` flag, exactly slack_v2's documented migration —
as still gated, so the custom bot would stay omitted from VFS discovery
forever after GA even though the UI shows it. Reuse the canonical
isHiddenUnder(null, block) predicate instead, so a non-preview block is
visible. Adds service-account-gate.test.ts covering preview → omit, GA →
include, and missing → fail-closed with a mocked getBlock (the block
registry is globally stubbed, so the real slack_v2 preview flag isn't
observable through serializeIntegrationSchema).

Author: TheodoreSpeaks

apps/sim/lib/copilot/vfs/serializers.test.ts

@@ -316,13 +316,10 @@ describe('serializeIntegrationSchema — service-account auth', () => {
     expect(schema.auth.serviceAccount).toBeUndefined()
   })
 
-  it('omits serviceAccount when the flow is gated by a preview block (slack custom bot ↔ slack_v2)', () => {
-    // slack_v2 is preview: true, so the shared schema must not leak the custom
-    // bot — parallel to how preview tools stay out of the shared aggregates.
-    const schema = JSON.parse(serializeIntegrationSchema(oauthTool('slack_send', 'slack')))
-    expect(schema.auth.type).toBe('oauth')
-    expect(schema.auth.serviceAccount).toBeUndefined()
-  })
+  // The preview-gate behavior (slack custom bot ↔ slack_v2) is covered in
+  // service-account-gate.test.ts, which mocks getBlock — the block registry is
+  // globally stubbed here, so slack_v2's real `preview: true` isn't observable
+  // through serializeIntegrationSchema.
 })
 
 describe('serializeCredentials — type distinguishes reconnect flow', () => {

apps/sim/lib/copilot/vfs/serializers.ts

@@ -11,6 +11,7 @@ import { isSubBlockHidden } from '@/lib/workflows/subblocks/visibility'
 import { getBlock } from '@/blocks'
 import { isCustomBlockType } from '@/blocks/custom/build-config'
 import type { BlockConfig, SubBlockConfig } from '@/blocks/types'
+import { isHiddenUnder } from '@/blocks/visibility/context'
 import { DYNAMIC_MODEL_PROVIDERS, PROVIDER_DEFINITIONS } from '@/providers/models'
 import type { ToolConfig, ToolHostingCondition } from '@/tools/types'
 
@@ -57,7 +58,15 @@ export function describeServiceAccountForOAuthProvider(
   const serviceAccountProviderId = getServiceAccountProviderForProviderId(oauthProvider)
   if (!serviceAccountProviderId) return undefined
   const gatingBlockType = getServiceAccountGatingBlockType(serviceAccountProviderId)
-  if (gatingBlockType && (getBlock(gatingBlockType)?.preview ?? true)) return undefined
+  if (gatingBlockType) {
+    const gatingBlock = getBlock(gatingBlockType)
+    // Omit when the gating block is missing (fail-closed) or hidden by the
+    // canonical predicate. Passing `null` vis reduces `isHiddenUnder` to the
+    // static preview check — so once the block GAs and drops `preview`, it is
+    // no longer hidden and discovery includes it again, matching the renderer.
+    // Hand-rolling `?.preview ?? true` would keep it omitted forever after GA.
+    if (!gatingBlock || isHiddenUnder(null, gatingBlock)) return undefined
+  }
   return { connectNoun: getServiceAccountConnectNoun(serviceAccountProviderId) }
 }
 

apps/sim/lib/copilot/vfs/service-account-gate.test.ts

@@ -0,0 +1,45 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockGetBlock } = vi.hoisted(() => ({ mockGetBlock: vi.fn() }))
+vi.mock('@/blocks', () => ({ getBlock: mockGetBlock }))
+
+import { describeServiceAccountForOAuthProvider } from '@/lib/copilot/vfs/serializers'
+
+describe('describeServiceAccountForOAuthProvider — preview gate', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('omits a service account whose gating block is still a preview block', () => {
+    mockGetBlock.mockReturnValue({ type: 'slack_v2', preview: true })
+    expect(describeServiceAccountForOAuthProvider('slack')).toBeUndefined()
+  })
+
+  it('includes it once the gating block GAs and drops preview', () => {
+    // slack_v2's documented GA migration removes `preview`. Discovery must then
+    // surface the custom bot, matching what the UI shows. A hand-rolled
+    // `?.preview ?? true` would keep it omitted forever — the "sticks after GA"
+    // regression; reusing isHiddenUnder(null, block) fixes it.
+    mockGetBlock.mockReturnValue({ type: 'slack_v2' })
+    expect(describeServiceAccountForOAuthProvider('slack')).toEqual({ connectNoun: 'custom bot' })
+  })
+
+  it('fail-closes (omits) when the gating block is missing entirely', () => {
+    mockGetBlock.mockReturnValue(undefined)
+    expect(describeServiceAccountForOAuthProvider('slack')).toBeUndefined()
+  })
+
+  it('includes an ungated provider without consulting the block registry', () => {
+    expect(describeServiceAccountForOAuthProvider('notion')).toEqual({
+      connectNoun: 'integration secret',
+    })
+    expect(mockGetBlock).not.toHaveBeenCalled()
+  })
+
+  it('returns undefined for a provider with no service-account flow', () => {
+    expect(describeServiceAccountForOAuthProvider('github')).toBeUndefined()
+  })
+})