fix(managed-agents): harden reconnect loop; fix credential-picker regression

- drive completion off terminal events + authoritative session status (drop the fragile busy-clock)
- drain full event history so a long session's tail is never cut off
- skip idless events in catch-up; require an id before replying to custom_tool_use
- gate the shared credential-selector service-account lookup on credentialKind and use the non-throwing helper (was crashing multi-service OAuth pickers)
- audit-log the list route's credential access; refresh stale tool docs

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx

@@ -12,7 +12,7 @@ import {
   type OAuthProvider,
   parseProvider,
 } from '@/lib/oauth'
-import { getMissingRequiredScopes, getServiceByProviderAndId } from '@/lib/oauth/utils'
+import { getMissingRequiredScopes, getServiceConfigByServiceId } from '@/lib/oauth/utils'
 import { ConnectOAuthModal } from '@/app/workspace/[workspaceId]/components/connect-oauth-modal'
 import {
   ConnectServiceAccountModal,
@@ -117,10 +117,11 @@ export function CredentialSelector({
   }, [rawCredentials, isTriggerMode, credentialKind, subBlock.allowServiceAccounts])
 
   // Resolved service-account provider metadata for the token-paste connect
-  // modal (only used when `credentialKind === 'service-account'`).
+  // modal. Gated on `credentialKind` and using the non-throwing lookup so it
+  // never runs (or throws) for the OAuth / custom-bot pickers.
   const serviceAccountService = useMemo(
-    () => (serviceId ? getServiceByProviderAndId(provider, serviceId) : undefined),
-    [provider, serviceId]
+    () => (credentialKind === 'service-account' ? getServiceConfigByServiceId(serviceId) : null),
+    [credentialKind, serviceId]
   )
 
   const selectedCredential = useMemo(

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/hooks/use-drag-drop.test.tsx

@@ -649,21 +649,11 @@ export function useDragDrop(options: UseDragDropOptions = {}) {
       if (target && container.contains(target)) return
       handleDragEnd()
     }
-    /**
-     * `dragend` always fires on the drag source at the end of any drag operation, including
-     * Esc-cancels and drops on non-droppable targets. Without this reset, a non-sidebar drag
-     * that entered the list (flipping `isDragging` on via `initDragOver`) but ended without a
-     * `drop` inside the container would strand `isDragging` at `true` — leaving the absolutely
-     * positioned edge drop zones mounted over the first/last rows and stealing their grab band.
-     */
-    const onWindowDragEnd = () => handleDragEnd()
     container.addEventListener('dragleave', onLeave)
     window.addEventListener('drop', onWindowDrop, true)
-    window.addEventListener('dragend', onWindowDragEnd, true)
     return () => {
       container.removeEventListener('dragleave', onLeave)
       window.removeEventListener('drop', onWindowDrop, true)
-      window.removeEventListener('dragend', onWindowDragEnd, true)
     }
   }, [isDragging, handleDragEnd])
 

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/hooks/use-drag-drop.ts

@@ -11,7 +11,7 @@ const { mocks } = vi.hoisted(() => ({
     sendSessionEvents: vi.fn(),
     openSessionStream: vi.fn(),
     listSessionEvents: vi.fn(),
-    getSessionUsage: vi.fn(),
+    getSession: vi.fn(),
     readSSEEvents: vi.fn(),
     sleep: vi.fn(),
   },
@@ -23,7 +23,7 @@ vi.mock('@/lib/managed-agents/session-client', () => ({
   sendSessionEvents: mocks.sendSessionEvents,
   openSessionStream: mocks.openSessionStream,
   listSessionEvents: mocks.listSessionEvents,
-  getSessionUsage: mocks.getSessionUsage,
+  getSession: mocks.getSession,
 }))
 vi.mock('@/lib/core/utils/sse', () => ({ readSSEEvents: mocks.readSSEEvents }))
 vi.mock('@sim/utils/helpers', () => ({ sleep: mocks.sleep }))
@@ -56,74 +56,84 @@ const msg = (id: string, text: string): AnthropicSessionEvent => ({
   type: 'agent.message',
   content: [{ type: 'text', text }],
 })
+const idle = (id: string, stop: string): AnthropicSessionEvent => ({
+  id,
+  type: 'session.status_idle',
+  stop_reason: { type: stop },
+})
 
 beforeEach(() => {
   vi.clearAllMocks()
   mocks.createSession.mockResolvedValue({ id: 'sess_1' })
   mocks.sendUserMessage.mockResolvedValue(undefined)
   mocks.openSessionStream.mockResolvedValue({})
-  mocks.getSessionUsage.mockResolvedValue(null)
+  mocks.listSessionEvents.mockResolvedValue([])
+  mocks.getSession.mockResolvedValue(null)
 })
 
 describe('runManagedAgentSession', () => {
-  it('accumulates agent.message text and completes on end_turn', async () => {
-    scriptStreamBatches([
-      [
-        msg('e1', 'Hello '),
-        msg('e2', 'world'),
-        { id: 'e3', type: 'session.status_idle', stop_reason: { type: 'end_turn' } },
-      ],
-    ])
+  it('accumulates agent.message text and completes on end_turn (terminal event)', async () => {
+    scriptStreamBatches([[msg('e1', 'Hello '), msg('e2', 'world'), idle('e3', 'end_turn')]])
+    mocks.getSession.mockResolvedValue({
+      status: 'idle',
+      usage: { inputTokens: 12, outputTokens: 3 },
+    })
 
     const result = await runManagedAgentSession({ ...BASE })
 
-    expect(result).toEqual({ ok: true, content: 'Hello world', sessionId: 'sess_1' })
+    expect(result).toEqual({
+      ok: true,
+      content: 'Hello world',
+      sessionId: 'sess_1',
+      inputTokens: 12,
+      outputTokens: 3,
+    })
     expect(mocks.listSessionEvents).not.toHaveBeenCalled()
   })
 
-  it('surfaces cumulative token usage on success (best-effort)', async () => {
-    scriptStreamBatches([
-      [
-        msg('e1', 'ok'),
-        { id: 'e2', type: 'session.status_idle', stop_reason: { type: 'end_turn' } },
-      ],
-    ])
-    mocks.getSessionUsage.mockResolvedValue({ inputTokens: 120, outputTokens: 45 })
+  it('completes via authoritative status when the stream goes quiet after progress', async () => {
+    // Stream: some text, no terminal, then closes. Reconnect: nothing new.
+    scriptStreamBatches([[msg('e1', 'partial')], []])
+    // First getSession (quiet-reconnect check) → idle; final getSession → usage.
+    mocks.getSession
+      .mockResolvedValueOnce({ status: 'idle' })
+      .mockResolvedValue({ status: 'idle', usage: { inputTokens: 5 } })
 
     const result = await runManagedAgentSession({ ...BASE })
 
-    expect(result).toEqual({
-      ok: true,
-      content: 'ok',
-      sessionId: 'sess_1',
-      inputTokens: 120,
-      outputTokens: 45,
-    })
+    expect(result.ok).toBe(true)
+    expect(result.content).toBe('partial')
+    expect(result.inputTokens).toBe(5)
+  })
+
+  it('keeps waiting while status is running, then completes on a later terminal event', async () => {
+    // Stream 1: text, closes (no terminal). Reconnect: nothing new, status running → backoff.
+    // Stream 2: end_turn → complete.
+    scriptStreamBatches([[msg('e1', 'thinking')], [idle('e2', 'end_turn')]])
+    mocks.getSession
+      .mockResolvedValueOnce({ status: 'running' })
+      .mockResolvedValue({ status: 'idle' })
+
+    const result = await runManagedAgentSession({ ...BASE })
+
+    expect(result.ok).toBe(true)
+    expect(result.content).toBe('thinking')
+    expect(mocks.sleep).toHaveBeenCalled() // backed off while running
   })
 
-  it('does NOT false-timeout after requires_action followed by progress then a quiet reconnect', async () => {
-    // Stream 1: only a requires_action idle (busy), then the stream closes.
-    // Stream 2: closes immediately with nothing new.
-    scriptStreamBatches([
-      [{ id: 'r1', type: 'session.status_idle', stop_reason: { type: 'requires_action' } }],
-      [],
-    ])
-    // Catch-up 1 surfaces real progress (m2); catch-up 2 has nothing unseen.
-    mocks.listSessionEvents
-      .mockResolvedValueOnce([
-        { id: 'r1', type: 'session.status_idle', stop_reason: { type: 'requires_action' } },
-        msg('m2', 'progress'),
-      ])
-      .mockResolvedValueOnce([
-        { id: 'r1', type: 'session.status_idle', stop_reason: { type: 'requires_action' } },
-        msg('m2', 'progress'),
-      ])
+  it('does not complete on a fresh idle before the agent has started', async () => {
+    // Stream closes immediately with nothing; catch-up empty; status idle but no
+    // activity yet → must NOT complete. Then it starts and finishes.
+    scriptStreamBatches([[], [idle('e1', 'end_turn')]])
+    mocks.getSession
+      .mockResolvedValueOnce({ status: 'idle' }) // pre-start idle — must be ignored
+      .mockResolvedValue({ status: 'idle' })
 
     const result = await runManagedAgentSession({ ...BASE })
 
-    expect(result).toEqual({ ok: true, content: 'progress', sessionId: 'sess_1' })
-    // A false timeout would have slept on backoff and returned an error.
-    expect(mocks.sleep).not.toHaveBeenCalled()
+    expect(result.ok).toBe(true)
+    // Completed via the real end_turn on reopen, not the premature idle.
+    expect(mocks.openSessionStream).toHaveBeenCalledTimes(2)
   })
 
   it('surfaces a session.error as a failure with the error message', async () => {
@@ -138,7 +148,6 @@ describe('runManagedAgentSession', () => {
 
   it('rejects an empty user message before creating a session', async () => {
     const result = await runManagedAgentSession({ ...BASE, userMessage: '   ' })
-
     expect(result.ok).toBe(false)
     expect(mocks.createSession).not.toHaveBeenCalled()
   })