fix(copilot): gate service account tool on the same preview flag as the UI

The in-chat connect button hides itself when the provider's gating block
is preview-hidden (a custom Slack bot needs slack_v2). The tool didn't
check this, so it returned success for slack-custom-bot even when slack_v2
was preview-gated off — the agent said "here's the setup form" and the
button silently rendered nothing, leaving the user with no form at all.

Adds getServiceAccountGatingBlockType as the single source for the
provider→gating-block mapping, consumed by both the tool (server-side, via
getBlockVisibilityForCopilot) and the connect hook (client overlay). When
the gating block is hidden the tool now fails with a fall-back-to-OAuth
message instead of promising an invisible form.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Phx1MLjf8Ui3M3VpwisZds

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/use-service-account-connect.ts

@@ -2,6 +2,7 @@
 
 import { type ComponentType, useMemo } from 'react'
 import { getClientCredentialAccountDescriptor } from '@/lib/credentials/client-credential-accounts/descriptors'
+import { getServiceAccountGatingBlockType } from '@/lib/credentials/service-account-provider-ids'
 import { getTokenServiceAccountDescriptor } from '@/lib/credentials/token-service-accounts/descriptors'
 import { SLACK_CUSTOM_BOT_PROVIDER_ID } from '@/lib/oauth/types'
 import type { ServiceAccountProviderId } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal'
@@ -53,10 +54,14 @@ export function useServiceAccountConnectTarget({
   const isSlackBot = serviceAccountProviderId === SLACK_CUSTOM_BOT_PROVIDER_ID
 
   const hidden = useMemo(() => {
-    if (!isSlackBot) return false
-    const v2 = getBlock('slack_v2')
-    return !v2 || isHiddenUnder(overlayVisibility(), v2)
-  }, [isSlackBot, blockOverlayVersion])
+    const gatingBlockType = serviceAccountProviderId
+      ? getServiceAccountGatingBlockType(serviceAccountProviderId)
+      : null
+    if (!gatingBlockType) return false
+    const gatingBlock = getBlock(gatingBlockType)
+    return !gatingBlock || isHiddenUnder(overlayVisibility(), gatingBlock)
+    // blockOverlayVersion is read to re-evaluate when the overlay changes.
+  }, [serviceAccountProviderId, blockOverlayVersion])
 
   return useMemo(() => {
     if (!serviceAccountProviderId || !serviceName || !serviceIcon) return null

apps/sim/lib/copilot/tools/handlers/service-account.test.ts

@@ -0,0 +1,112 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockEnsureWorkspaceAccess, mockGetBlockVisibility, mockGetBlock } = vi.hoisted(() => ({
+  mockEnsureWorkspaceAccess: vi.fn(),
+  mockGetBlockVisibility: vi.fn(),
+  mockGetBlock: vi.fn(),
+}))
+
+vi.mock('@/lib/copilot/tools/handlers/access', () => ({
+  ensureWorkspaceAccess: mockEnsureWorkspaceAccess,
+}))
+
+vi.mock('@/lib/copilot/block-visibility', () => ({
+  getBlockVisibilityForCopilot: mockGetBlockVisibility,
+}))
+
+vi.mock('@/blocks', () => ({
+  getBlock: mockGetBlock,
+}))
+
+import type { ExecutionContext } from '@/lib/copilot/request/types'
+import { executeServiceAccountGetSetupLink } from '@/lib/copilot/tools/handlers/service-account'
+
+const BASE_URL = 'https://sim.test'
+const context = {
+  workspaceId: 'ws-1',
+  userId: 'user-1',
+  chatId: 'chat-1',
+} as unknown as ExecutionContext
+
+/** slack_v2 revealed → visible. Empty → preview-hidden (fail-closed). */
+function visibility(revealed: string[] = []) {
+  return {
+    revealed: new Set(revealed),
+    disabled: new Set<string>(),
+    previewTagged: new Set<string>(),
+  }
+}
+
+interface Output {
+  setup_url?: string
+  provider?: string
+  providerId?: string
+  serviceAccountProviderId?: string
+  instructions?: string
+}
+
+describe('executeServiceAccountGetSetupLink', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    process.env.NEXT_PUBLIC_APP_URL = BASE_URL
+    mockEnsureWorkspaceAccess.mockResolvedValue({ canWrite: true })
+    mockGetBlockVisibility.mockResolvedValue(visibility())
+    mockGetBlock.mockReturnValue({ type: 'slack_v2', preview: true })
+  })
+
+  it('resolves an ungated provider to an in-chat setup tag, not a bare link', async () => {
+    const result = await executeServiceAccountGetSetupLink({ providerName: 'notion' }, context)
+
+    expect(result.success).toBe(true)
+    const output = result.output as Output
+    // The provider on the tag is the OAuth provider value so the button label
+    // resolves; the service-account id rides alongside.
+    expect(output.providerId).toBe('notion')
+    expect(output.serviceAccountProviderId).toBe('notion-service-account')
+    expect(output.setup_url).toContain('/integrations/notion?connect=service-account')
+    // The agent is steered to emit the tag, not surface the URL as a link.
+    expect(output.instructions).toContain('service_account')
+    // An ungated provider never consults block visibility.
+    expect(mockGetBlockVisibility).not.toHaveBeenCalled()
+  })
+
+  it('rejects an unsupported provider', async () => {
+    const result = await executeServiceAccountGetSetupLink({ providerName: 'github' }, context)
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('no service account flow')
+  })
+
+  describe('preview gating (slack custom bot ↔ slack_v2)', () => {
+    it('rejects slack-custom-bot when slack_v2 is preview-hidden, so the agent falls back to OAuth', async () => {
+      // This is the exact production symptom: the tool used to return success,
+      // the agent said "here's the setup form", and the in-chat button hid
+      // itself because slack_v2 is preview-gated — leaving no form at all.
+      mockGetBlockVisibility.mockResolvedValue(visibility([]))
+
+      const result = await executeServiceAccountGetSetupLink({ providerName: 'slack' }, context)
+
+      expect(result.success).toBe(false)
+      expect(result.error).toContain('OAuth')
+      expect((result.output as Output).setup_url).toContain('/integrations')
+      // Crucially no service-account setup surface is offered.
+      expect((result.output as Output).instructions).toBeUndefined()
+    })
+
+    it('offers slack-custom-bot once slack_v2 is revealed for the viewer', async () => {
+      mockGetBlockVisibility.mockResolvedValue(visibility(['slack_v2']))
+
+      const result = await executeServiceAccountGetSetupLink({ providerName: 'slack' }, context)
+
+      expect(result.success).toBe(true)
+      expect((result.output as Output).serviceAccountProviderId).toBe('slack-custom-bot')
+    })
+
+    it('does not consult visibility for a non-slack provider', async () => {
+      await executeServiceAccountGetSetupLink({ providerName: 'google-sheets' }, context)
+      expect(mockGetBlockVisibility).not.toHaveBeenCalled()
+    })
+  })
+})

apps/sim/lib/copilot/tools/handlers/service-account.ts

@@ -1,7 +1,9 @@
 import { toError } from '@sim/utils/errors'
+import { getBlockVisibilityForCopilot } from '@/lib/copilot/block-visibility'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
 import { ensureWorkspaceAccess } from '@/lib/copilot/tools/handlers/access'
 import { getBaseUrl } from '@/lib/core/utils/urls'
+import { getServiceAccountGatingBlockType } from '@/lib/credentials/service-account-provider-ids'
 import {
   listServiceAccountIntegrationNames,
   resolveServiceAccountIntegration,
@@ -10,6 +12,8 @@ import {
   CONNECT_MODE,
   CONNECT_QUERY_PARAM,
 } from '@/app/workspace/[workspaceId]/integrations/connect-route'
+import { getBlock } from '@/blocks'
+import { isHiddenUnder } from '@/blocks/visibility/context'
 
 /**
  * Returns a link that opens the integration detail page with the
@@ -41,6 +45,23 @@ export async function executeServiceAccountGetSetupLink(
       )
     }
 
+    // The in-chat button hides itself when the provider's gating block is
+    // preview-hidden for the viewer (a custom Slack bot needs slack_v2). Reject
+    // here on the same predicate so the tool never reports success for a form
+    // the UI will silently drop — the agent would promise a form that never
+    // appears. Fall the agent back to OAuth instead.
+    const gatingBlockType = getServiceAccountGatingBlockType(match.serviceAccountProviderId)
+    if (gatingBlockType) {
+      const visibility = await getBlockVisibilityForCopilot(context.userId, context.workspaceId)
+      const gatingBlock = getBlock(gatingBlockType)
+      if (!gatingBlock || isHiddenUnder(visibility, gatingBlock)) {
+        throw new Error(
+          `${match.serviceName} service account setup isn't available in this workspace yet. ` +
+            `Use oauth_get_auth_link to connect ${match.serviceName} via OAuth instead.`
+        )
+      }
+    }
+
     const url = new URL(`${baseUrl}/workspace/${context.workspaceId}/integrations/${match.slug}`)
     url.searchParams.set(CONNECT_QUERY_PARAM, CONNECT_MODE.serviceAccount)
 

apps/sim/lib/credentials/service-account-provider-ids.ts

@@ -43,3 +43,14 @@ export function asServiceAccountProviderId(
 export function isServiceAccountProviderId(value: string): boolean {
   return asServiceAccountProviderId(value.toLowerCase().trim()) !== undefined
 }
+
+/**
+ * The block type whose preview gate governs a service-account provider's setup
+ * surface, or `null` when the provider is ungated. A custom Slack bot is only
+ * usable through `slack_v2`, so its setup form must stay hidden wherever that
+ * block is preview-hidden — both the in-chat connect button and the tool that
+ * offers it read this so they can't disagree on availability.
+ */
+export function getServiceAccountGatingBlockType(providerId: string): string | null {
+  return providerId === SLACK_CUSTOM_BOT_PROVIDER_ID ? 'slack_v2' : null
+}