refactor(credentials): route the editor SA picker through the canonical connect hook

The workflow-editor credential selector (from #5800's merged picker) resolved
its service-account setup surface inline and mounted the modal with NO preview
gate — so a `credentialKind: 'service-account'` picker would offer a custom-bot
setup even when slack_v2 is preview-gated off, the leak the integrations page
and chat already guard against.

Route it through the shared useServiceAccountConnectTarget hook (the same
resolver chat and the integrations page use): suppress the setup action when
`hidden`, and use the hook's vendor-accurate label ("Add private app token",
"Set up a custom bot") as the default connect-row copy. Existing service
accounts stay selectable; the per-block `credentialLabels.serviceAccountConnect`
override still wins. One resolver now backs all three SA connect surfaces.

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx

@@ -17,6 +17,7 @@ import { ConnectOAuthModal } from '@/app/workspace/[workspaceId]/components/conn
 import {
   ConnectServiceAccountModal,
   type ServiceAccountProviderId,
+  useServiceAccountConnectTarget,
 } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal'
 import { formatDisplayText } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/formatted-text'
 import { getWorkflowSearchLabelHighlight } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/workflow-search-highlight'
@@ -130,6 +131,20 @@ export function CredentialSelector({
     [credentialKind, isMergedKinds, serviceId]
   )
 
+  // Canonical resolver for the service-account connect control: the vendor-
+  // accurate label and — critically — the per-viewer preview gate (a custom
+  // Slack bot rides `slack_v2`). Shared with the integrations page and chat so
+  // the gate can't be bypassed here. When `hidden`, the setup action is
+  // suppressed; existing service-account credentials stay selectable.
+  const serviceAccountTarget = useServiceAccountConnectTarget({
+    serviceAccountProviderId: serviceAccountService?.serviceAccountProviderId as
+      | ServiceAccountProviderId
+      | undefined,
+    serviceName: serviceAccountService?.name,
+    serviceIcon: serviceAccountService?.icon,
+  })
+  const serviceAccountConnectHidden = Boolean(serviceAccountTarget?.hidden)
+
   const selectedCredential = useMemo(
     () => credentials.find((cred) => cred.id === selectedId),
     [credentials, selectedId]
@@ -249,19 +264,23 @@ export function CredentialSelector({
       iconElement: getProviderIcon((cred.provider ?? provider) as OAuthProvider),
     }))
 
-    options.push({
-      label:
-        credentialKind === 'service-account'
-          ? (subBlock.credentialLabels?.serviceAccountConnect ??
-            (credentials.length > 0
-              ? `Add another ${getProviderName(provider)} key`
-              : `Add ${getProviderName(provider)} key`))
-          : credentials.length > 0
-            ? `Connect another ${getProviderName(provider)} account`
-            : `Connect ${getProviderName(provider)} account`,
-      value: '__connect_account__',
-      iconElement: <ExternalLink className='size-3' />,
-    })
+    // Suppress the setup action when the service-account flow is preview-gated
+    // for this viewer (a custom Slack bot needs slack_v2) — existing accounts
+    // above stay selectable.
+    if (credentialKind !== 'service-account' || !serviceAccountConnectHidden) {
+      options.push({
+        label:
+          credentialKind === 'service-account'
+            ? (subBlock.credentialLabels?.serviceAccountConnect ??
+              serviceAccountTarget?.label ??
+              `Add ${getProviderName(provider)} key`)
+            : credentials.length > 0
+              ? `Connect another ${getProviderName(provider)} account`
+              : `Connect ${getProviderName(provider)} account`,
+        value: '__connect_account__',
+        iconElement: <ExternalLink className='size-3' />,
+      })
+    }
 
     return options
   }, [
@@ -271,6 +290,8 @@ export function CredentialSelector({
     credentials,
     credentialKind,
     subBlock.credentialLabels,
+    serviceAccountConnectHidden,
+    serviceAccountTarget,
     provider,
     getProviderIcon,
     getProviderName,
@@ -302,18 +323,28 @@ export function CredentialSelector({
         section: labels?.serviceAccountGroup ?? 'Service accounts',
         items: [
           ...credentials.filter((c) => c.type === 'service_account').map(toOption),
-          {
-            label: labels?.serviceAccountConnect ?? `Add ${getProviderName(provider)} key`,
-            value: '__connect_service_account__',
-            iconElement: <ExternalLink className='size-3' />,
-          },
+          // Drop the setup action when the flow is preview-gated for this viewer.
+          ...(serviceAccountConnectHidden
+            ? []
+            : [
+                {
+                  label:
+                    labels?.serviceAccountConnect ??
+                    serviceAccountTarget?.label ??
+                    `Add ${getProviderName(provider)} key`,
+                  value: '__connect_service_account__',
+                  iconElement: <ExternalLink className='size-3' />,
+                },
+              ]),
         ],
       },
     ]
   }, [
     isMergedKinds,
     subBlock.credentialLabels,
     credentials,
+    serviceAccountConnectHidden,
+    serviceAccountTarget,
     provider,
     getProviderIcon,
     getProviderName,