fix(copilot): honor preview availability server-side

TheodoreSpeaks · TheodoreSpeaks · commit 9d6c3171d2b3 · 2026-08-03T18:34:15.000-07:00
diff --git a/apps/sim/lib/copilot/chat/payload.test.ts b/apps/sim/lib/copilot/chat/payload.test.ts
@@ -129,7 +129,7 @@ vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
 }))
 
 vi.mock('@/lib/integrations/availability.server', () => ({
-  isIntegrationDeploymentAvailable: mockIsIntegrationDeploymentAvailable,
+  isIntegrationDeploymentAvailableForVisibility: mockIsIntegrationDeploymentAvailable,
   isOAuthServiceDeploymentAvailable: mockIsOAuthServiceDeploymentAvailable,
 }))
 
diff --git a/apps/sim/lib/copilot/chat/payload.ts b/apps/sim/lib/copilot/chat/payload.ts
@@ -23,7 +23,7 @@ import {
   isHosted,
 } from '@/lib/core/config/env-flags'
 import {
-  isIntegrationDeploymentAvailable,
+  isIntegrationDeploymentAvailableForVisibility,
   isOAuthServiceDeploymentAvailable,
 } from '@/lib/integrations/availability.server'
 import { trackChatUpload } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
@@ -223,7 +223,7 @@ async function buildIntegrationToolSchemasUncached(
       getExposedIntegrationTools(),
       vis,
       (owner) =>
-        isIntegrationDeploymentAvailable(owner.blockType) &&
+        isIntegrationDeploymentAvailableForVisibility(owner.blockType, vis) &&
         (allowedIntegrationTypes === null ||
           allowedIntegrationTypes.has(owner.blockType.toLowerCase()))
     )
diff --git a/apps/sim/lib/copilot/chat/process-contents.test.ts b/apps/sim/lib/copilot/chat/process-contents.test.ts
@@ -19,6 +19,7 @@ const {
   getWorkspaceFile,
   getTableById,
   getRowsByIds,
+  getBlockVisibilityForCopilot,
   isIntegrationDeploymentAvailable,
 } = vi.hoisted(() => ({
   discoverServerTools: vi.fn(),
@@ -29,13 +30,15 @@ const {
   getWorkspaceFile: vi.fn(),
   getTableById: vi.fn(),
   getRowsByIds: vi.fn(),
+  getBlockVisibilityForCopilot: vi.fn(async () => null),
   isIntegrationDeploymentAvailable: vi.fn(() => true),
 }))
 
 vi.mock('@/blocks/registry', () => ({ getBlock, getBlockRegistry }))
+vi.mock('@/lib/copilot/block-visibility', () => ({ getBlockVisibilityForCopilot }))
 vi.mock('@/ee/access-control/utils/permission-check', () => ({ getUserPermissionConfig }))
 vi.mock('@/lib/integrations/availability.server', () => ({
-  isIntegrationDeploymentAvailable,
+  isIntegrationDeploymentAvailableForVisibility: isIntegrationDeploymentAvailable,
 }))
 vi.mock('@/lib/workflows/skills/operations', () => ({ getSkillById }))
 vi.mock('@/lib/mcp/service', () => ({ mcpService: { discoverServerTools } }))
diff --git a/apps/sim/lib/copilot/chat/process-contents.ts b/apps/sim/lib/copilot/chat/process-contents.ts
@@ -6,6 +6,7 @@ import {
   getActiveWorkflowRecord,
 } from '@sim/platform-authz/workflow'
 import { and, eq, isNull, ne } from 'drizzle-orm'
+import { getBlockVisibilityForCopilot } from '@/lib/copilot/block-visibility'
 import {
   MAX_TABLE_SELECTION_CONTENT_LENGTH,
   safeBrowserSelectionUrl,
@@ -25,7 +26,7 @@ import {
 } from '@/lib/copilot/vfs/path-utils'
 import { EnvCapabilityConfigurationError } from '@/lib/core/config/env-capabilities'
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/env-flags'
-import { isIntegrationDeploymentAvailable } from '@/lib/integrations/availability.server'
+import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
 import { toOverview } from '@/lib/logs/log-views'
 import type { TraceSpan } from '@/lib/logs/types'
 import { mcpService } from '@/lib/mcp/service'
@@ -612,11 +613,13 @@ async function processBlockMetadata(
   workspaceId?: string
 ): Promise<AgentContext | null> {
   try {
-    const permissionConfig =
-      userId && workspaceId ? await getUserPermissionConfig(userId, workspaceId) : null
+    const [permissionConfig, visibility] = await Promise.all([
+      userId && workspaceId ? getUserPermissionConfig(userId, workspaceId) : null,
+      userId ? getBlockVisibilityForCopilot(userId, workspaceId) : null,
+    ])
     const allowedIntegrations =
       permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
-    if (!isIntegrationDeploymentAvailable(blockId)) {
+    if (!isIntegrationDeploymentAvailableForVisibility(blockId, visibility)) {
       logger.debug('Block unavailable for this deployment', { blockId })
       return null
     }
diff --git a/apps/sim/lib/copilot/tools/handlers/integration-tools.ts b/apps/sim/lib/copilot/tools/handlers/integration-tools.ts
@@ -5,7 +5,7 @@ import {
 } from '@/lib/copilot/integration-tools'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/env-flags'
-import { isIntegrationDeploymentAvailable } from '@/lib/integrations/availability.server'
+import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
 import { getUserPermissionConfig } from '@/ee/access-control/utils/permission-check'
 import { stripVersionSuffix } from '@/tools/utils'
 
@@ -30,7 +30,7 @@ export async function executeListIntegrationTools(
     getExposedIntegrationTools(),
     vis,
     (owner) =>
-      isIntegrationDeploymentAvailable(owner.blockType) &&
+      isIntegrationDeploymentAvailableForVisibility(owner.blockType, vis) &&
       (allowedIntegrations === null || allowedIntegrations.includes(owner.blockType.toLowerCase()))
   )
   const service = stripVersionSuffix(raw.toLowerCase())
diff --git a/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.test.ts b/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.test.ts
@@ -14,7 +14,7 @@ vi.mock('@/ee/access-control/utils/permission-check', () => ({
 }))
 
 vi.mock('@/lib/integrations/availability.server', () => ({
-  isIntegrationDeploymentAvailable: mockIsIntegrationDeploymentAvailable,
+  isIntegrationDeploymentAvailableForVisibility: mockIsIntegrationDeploymentAvailable,
 }))
 
 import {
diff --git a/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts b/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts
@@ -6,7 +6,7 @@ import { z } from 'zod'
 import { getCopilotToolDescription } from '@/lib/copilot/tools/descriptions'
 import type { BaseServerTool } from '@/lib/copilot/tools/server/base-tool'
 import { getAllowedIntegrationsFromEnv, isHosted } from '@/lib/core/config/env-flags'
-import { isIntegrationDeploymentAvailable } from '@/lib/integrations/availability.server'
+import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
 import { getServiceAccountProviderForProviderId } from '@/lib/oauth/utils'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
 import { isCustomBlockType } from '@/blocks/custom/build-config'
@@ -128,11 +128,12 @@ export const getBlocksMetadataServerTool: BaseServerTool<
         : null
     const allowedIntegrations =
       permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+    const visibility = overlayVisibility()
 
     const result: Record<string, CopilotBlockMetadata> = {}
     for (const blockId of blockIds || []) {
       const specialBlock = SPECIAL_BLOCKS_METADATA[blockId]
-      if (!isIntegrationDeploymentAvailable(blockId)) {
+      if (!isIntegrationDeploymentAvailableForVisibility(blockId, visibility)) {
         logger.debug('Block unavailable for this deployment', { blockId })
         continue
       }
@@ -181,7 +182,7 @@ export const getBlocksMetadataServerTool: BaseServerTool<
         // explicitly: unrevealed preview blocks and kill-switched types stay
         // out of the agent's metadata (the router wraps this tool in
         // withBlockVisibility).
-        if (isHiddenUnder(overlayVisibility(), blockConfig)) {
+        if (isHiddenUnder(visibility, blockConfig)) {
           logger.debug('Skipping block gated by visibility', { blockId })
           continue
         }
diff --git a/apps/sim/lib/copilot/tools/server/blocks/get-trigger-blocks.test.ts b/apps/sim/lib/copilot/tools/server/blocks/get-trigger-blocks.test.ts
@@ -26,7 +26,7 @@ vi.mock('@/ee/access-control/utils/permission-check', () => ({
 }))
 
 vi.mock('@/lib/integrations/availability.server', () => ({
-  isIntegrationDeploymentAvailable: mockIsIntegrationDeploymentAvailable,
+  isIntegrationDeploymentAvailableForVisibility: mockIsIntegrationDeploymentAvailable,
 }))
 
 import { getTriggerBlocksServerTool } from '@/lib/copilot/tools/server/blocks/get-trigger-blocks'
diff --git a/apps/sim/lib/copilot/tools/server/blocks/get-trigger-blocks.ts b/apps/sim/lib/copilot/tools/server/blocks/get-trigger-blocks.ts
@@ -2,9 +2,10 @@ import { createLogger } from '@sim/logger'
 import { z } from 'zod'
 import type { BaseServerTool } from '@/lib/copilot/tools/server/base-tool'
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/env-flags'
-import { isIntegrationDeploymentAvailable } from '@/lib/integrations/availability.server'
+import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
 import { getAllBlocks } from '@/blocks/registry'
+import { overlayVisibility } from '@/blocks/visibility/context'
 import { getUserPermissionConfig } from '@/ee/access-control/utils/permission-check'
 
 export const GetTriggerBlocksInput = z.object({})
@@ -29,13 +30,14 @@ export const getTriggerBlocksServerTool: BaseServerTool<
         : null
     const allowedIntegrations =
       permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+    const visibility = overlayVisibility()
 
     const triggerBlockIds: string[] = []
 
     for (const blockConfig of getAllBlocks()) {
       const blockType = blockConfig.type
       if (blockConfig.hideFromToolbar) continue
-      if (!isIntegrationDeploymentAvailable(blockType)) continue
+      if (!isIntegrationDeploymentAvailableForVisibility(blockType, visibility)) continue
       if (
         allowedIntegrations != null &&
         !isBlockTypeAccessControlExempt(blockType) &&
diff --git a/apps/sim/lib/copilot/tools/server/router.ts b/apps/sim/lib/copilot/tools/server/router.ts
@@ -74,14 +74,16 @@ const logger = createLogger('ServerToolRouter')
 const CUSTOM_BLOCK_OVERLAY_TOOLS = new Set(['edit_workflow', 'get_blocks_metadata'])
 
 /**
- * DISCOVERY tools that must run inside the viewer's block-visibility context so
- * gated (preview / kill-switched) blocks disappear from what the agent can
- * list. Deliberately a DIFFERENT set from {@link CUSTOM_BLOCK_OVERLAY_TOOLS}:
- * `edit_workflow` is excluded because its registry use is functional
- * (find-by-type over clones, never a discovery listing) and gating it would
- * only risk leaking display projections into persisted state.
+ * Discovery tools that consume the viewer's block-visibility context to hide
+ * gated blocks and credentials. `edit_workflow` establishes a narrower scope
+ * around operation validation after it resolves the workflow's actual
+ * workspace.
  */
-const VISIBILITY_GATED_TOOLS = new Set(['get_blocks_metadata', 'get_trigger_blocks'])
+const VISIBILITY_GATED_TOOLS = new Set([
+  'get_blocks_metadata',
+  'get_credentials',
+  'get_trigger_blocks',
+])
 
 const WRITE_ACTIONS: Record<string, string[]> = {
   [KnowledgeBase.id]: [
diff --git a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.test.ts b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.test.ts
@@ -14,7 +14,7 @@ const { mockIsIntegrationDeploymentAvailable } = vi.hoisted(() => ({
 }))
 
 vi.mock('@/lib/integrations/availability.server', () => ({
-  isIntegrationDeploymentAvailable: mockIsIntegrationDeploymentAvailable,
+  isIntegrationDeploymentAvailableForVisibility: mockIsIntegrationDeploymentAvailable,
 }))
 
 const agentBlockConfig = {
diff --git a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.ts b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/builders.ts
@@ -1,7 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { generateId, isValidUuid } from '@sim/utils/id'
 import { sortObjectKeysDeep } from '@sim/utils/object'
-import { isIntegrationDeploymentAvailable } from '@/lib/integrations/availability.server'
+import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
 import type { PermissionGroupConfig } from '@/lib/permission-groups/types'
 import { getEffectiveBlockOutputs } from '@/lib/workflows/blocks/block-outputs'
 import {
@@ -10,8 +10,9 @@ import {
   isCanonicalPair,
 } from '@/lib/workflows/subblocks/visibility'
 import { hasTriggerCapability } from '@/lib/workflows/triggers/trigger-utils'
-import { getAllBlocks, getBlock } from '@/blocks/registry'
+import { getBlock } from '@/blocks/registry'
 import type { BlockConfig } from '@/blocks/types'
+import { overlayVisibility } from '@/blocks/visibility/context'
 import { TRIGGER_RUNTIME_SUBBLOCK_IDS } from '@/triggers/constants'
 import type { EditWorkflowOperation, SkippedItem, ValidationError } from './types'
 import { logSkippedItem } from './types'
@@ -32,7 +33,7 @@ export function createBlockFromParams(
   permissionConfig?: PermissionGroupConfig | null,
   skippedItems?: SkippedItem[]
 ): any {
-  const blockConfig = getAllBlocks().find((b) => b.type === params.type)
+  const blockConfig = getBlock(params.type)
 
   // Validate inputs against block configuration
   let validatedInputs: Record<string, any> | undefined
@@ -655,7 +656,7 @@ export function filterDisallowedTools(
     if (
       typeof tool?.type === 'string' &&
       getBlock(tool.type) &&
-      !isIntegrationDeploymentAvailable(tool.type)
+      !isIntegrationDeploymentAvailableForVisibility(tool.type, overlayVisibility())
     ) {
       logSkippedItem(skippedItems, {
         type: 'tool_not_allowed',
diff --git a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/index.ts b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/index.ts
@@ -7,6 +7,7 @@ import {
 } from '@sim/platform-authz/workflow'
 import { toError } from '@sim/utils/errors'
 import { eq } from 'drizzle-orm'
+import { getBlockVisibilityForCopilot } from '@/lib/copilot/block-visibility'
 import { EditWorkflow } from '@/lib/copilot/generated/tool-catalog-v1'
 import {
   assertServerToolNotAborted,
@@ -30,6 +31,7 @@ import {
   saveWorkflowToNormalizedTables,
 } from '@/lib/workflows/persistence/utils'
 import { validateWorkflowState } from '@/lib/workflows/sanitization/validation'
+import { withBlockVisibility } from '@/blocks/visibility/server-context'
 import { getUserPermissionConfig } from '@/ee/access-control/utils/permission-check'
 import { generateLoopBlocks, generateParallelBlocks } from '@/stores/workflows/workflow/utils'
 import { normalizeWorkflowState } from '@/stores/workflows/workflow/validation'
@@ -137,10 +139,10 @@ export const editWorkflowServerTool: BaseServerTool<EditWorkflowParams, unknown>
       workflowState = fromDb.workflowState
     }
 
-    const permissionConfig =
-      context?.userId && workspaceId
-        ? await getUserPermissionConfig(context.userId, workspaceId)
-        : null
+    const [permissionConfig, blockVisibility] = await Promise.all([
+      workspaceId ? getUserPermissionConfig(context.userId, workspaceId) : null,
+      getBlockVisibilityForCopilot(context.userId, workspaceId),
+    ])
 
     // Pre-validate credential and apiKey inputs before applying operations
     // This filters out invalid credentials and apiKeys for hosted models
@@ -161,7 +163,9 @@ export const editWorkflowServerTool: BaseServerTool<EditWorkflowParams, unknown>
       state: modifiedWorkflowState,
       validationErrors,
       skippedItems,
-    } = applyOperationsToWorkflowState(workflowState, operationsToApply, permissionConfig)
+    } = await withBlockVisibility(blockVisibility, async () =>
+      applyOperationsToWorkflowState(workflowState, operationsToApply, permissionConfig)
+    )
 
     // Add credential validation errors
     validationErrors.push(...credentialErrors)
diff --git a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/operations.test.ts b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/operations.test.ts
@@ -57,7 +57,7 @@ vi.mock('@/blocks/registry', () => ({
 }))
 
 vi.mock('@/lib/integrations/availability.server', () => ({
-  isIntegrationDeploymentAvailable: () => true,
+  isIntegrationDeploymentAvailableForVisibility: () => true,
 }))
 
 function makeLoopWorkflow() {
diff --git a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/validation.test.ts b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/validation.test.ts
@@ -249,7 +249,7 @@ vi.mock('@/providers/utils', () => ({
 }))
 
 vi.mock('@/lib/integrations/availability.server', () => ({
-  isIntegrationDeploymentAvailable: mockIsIntegrationDeploymentAvailable,
+  isIntegrationDeploymentAvailableForVisibility: mockIsIntegrationDeploymentAvailable,
 }))
 
 import {
diff --git a/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/validation.ts b/apps/sim/lib/copilot/tools/server/workflow/edit-workflow/validation.ts
@@ -3,7 +3,7 @@ import { toError } from '@sim/utils/errors'
 import { omit } from '@sim/utils/object'
 import { validateSelectorIds } from '@/lib/copilot/validation/selector-validator'
 import { isHosted as isHostedDeployment } from '@/lib/core/config/env-flags'
-import { isIntegrationDeploymentAvailable } from '@/lib/integrations/availability.server'
+import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
 import type { PermissionGroupConfig } from '@/lib/permission-groups/types'
 import { getCustomToolById } from '@/lib/workflows/custom-tools/operations'
@@ -17,6 +17,7 @@ import {
 import { getBlock } from '@/blocks/registry'
 import type { SubBlockConfig } from '@/blocks/types'
 import { getModelOptions } from '@/blocks/utils'
+import { overlayVisibility } from '@/blocks/visibility/context'
 import { BlockType, EDGE, normalizeName } from '@/executor/constants'
 import { isAutoModel, isKnownModelId, suggestModelIdsForUnknownModel } from '@/providers/models'
 import { isPiByokOnlyMode } from '@/providers/pi-providers'
@@ -244,7 +245,7 @@ function validateAgentToolEntry(item: any, index: number): string | null {
     if (!Array.isArray(block.tools?.access) || block.tools.access.length === 0) {
       return `${where} block type "${type}" cannot be attached as an agent tool (it exposes no callable tools)`
     }
-    if (!isIntegrationDeploymentAvailable(type)) {
+    if (!isIntegrationDeploymentAvailableForVisibility(type, overlayVisibility())) {
       return `${where} block type "${type}" is unavailable in this deployment`
     }
   }
@@ -928,7 +929,7 @@ export function isBlockTypeAllowed(
   blockType: string,
   permissionConfig: PermissionGroupConfig | null
 ): boolean {
-  if (!isIntegrationDeploymentAvailable(blockType)) return false
+  if (!isIntegrationDeploymentAvailableForVisibility(blockType, overlayVisibility())) return false
   if (isBlockTypeAccessControlExempt(blockType)) {
     return true
   }
diff --git a/apps/sim/lib/copilot/vfs/workspace-vfs.ts b/apps/sim/lib/copilot/vfs/workspace-vfs.ts
@@ -103,7 +103,7 @@ import { getPersonalAndWorkspaceEnv } from '@/lib/environment/utils'
 import { BINARY_DOC_TASKS, MAX_DOCUMENT_PREVIEW_CODE_BYTES } from '@/lib/execution/constants'
 import { runSandboxTask, SandboxUserCodeError } from '@/lib/execution/sandbox/run-task'
 import {
-  isIntegrationDeploymentAvailable,
+  isIntegrationDeploymentAvailableForVisibility,
   isOAuthServiceDeploymentAvailable,
 } from '@/lib/integrations/availability.server'
 import { createIntegrationCredentialVisibility } from '@/lib/integrations/credential-visibility.server'
@@ -193,7 +193,7 @@ function isBlockOwnerHidden(
 ): boolean {
   const config = BLOCK_REGISTRY[owner.type]
   if (config?.hideFromToolbar) return true
-  if (!isIntegrationDeploymentAvailable(owner.type)) return true
+  if (!isIntegrationDeploymentAvailableForVisibility(owner.type, vis)) return true
   if (
     allowedIntegrationTypes !== null &&
     !isBlockTypeAccessControlExempt(owner.type) &&
@@ -343,12 +343,8 @@ function getStaticComponentFiles(): Map<string, string> {
   // universe. Preview blocks get schema files here and are filtered per viewer
   // at stamp time. Viewer-specific aggregate files are built during materialization.
   const allBlocks = Object.values(BLOCK_REGISTRY)
-  const visibleBlocks = allBlocks.filter(
-    (block) => !block.hideFromToolbar && isIntegrationDeploymentAvailable(block.type)
-  )
-  const exposedTools = getExposedIntegrationTools().filter((tool) =>
-    tool.owners.some((owner) => isIntegrationDeploymentAvailable(owner.blockType))
-  )
+  const visibleBlocks = allBlocks.filter((block) => !block.hideFromToolbar)
+  const exposedTools = getExposedIntegrationTools()
   const toolConfigs = new Map<string, ToolConfig>()
   for (const { toolId, config } of exposedTools) {
     toolConfigs.set(toolId, config)
@@ -830,7 +826,7 @@ export class WorkspaceVFS {
               getExposedIntegrationTools(),
               blockVisibility,
               (owner) =>
-                isIntegrationDeploymentAvailable(owner.blockType) &&
+                isIntegrationDeploymentAvailableForVisibility(owner.blockType, blockVisibility) &&
                 (allowedIntegrationTypes === null ||
                   allowedIntegrationTypes.has(owner.blockType.toLowerCase()))
             )
diff --git a/apps/sim/lib/integrations/availability.server.test.ts b/apps/sim/lib/integrations/availability.server.test.ts
diff --git a/apps/sim/lib/integrations/availability.server.ts b/apps/sim/lib/integrations/availability.server.ts
