feat(copilot): make service-account setup a direct tag, no tool

The agent now emits the service_account credential tag directly from
intent — like secret_input — instead of round-tripping through a tool.
Removes service_account_get_setup_link (handler, registration, display
title, Go tool def) and restores auth.serviceAccount as the VFS discovery
field so the agent knows which providers support a service account.

The link-vs-tag distinction was the wrong axis: only oauth needs a tool,
because its button carries a minted URL that can't be reconstructed. The
service_account tag carries just a provider name the agent already knows,
so it needs no tool — discovery lives in the VFS (auth.serviceAccount,
GA-only, so slack's preview-gated custom bot is never proactively
offered), and the per-viewer gate lives in the renderer, which renders
nothing when a provider isn't available for the viewer (no OAuth
fallback — a shared credential and a personal one are different intents).

oauth_get_auth_link's service-account-id guard now points at the tag.

Author: TheodoreSpeaks

apps/sim/lib/copilot/generated/tool-catalog-v1.ts

@@ -91,7 +91,6 @@ export interface ToolCatalogEntry {
     | 'search_library_docs'
     | 'search_online'
     | 'search_patterns'
-    | 'service_account_get_setup_link'
     | 'set_block_enabled'
     | 'set_environment_variables'
     | 'set_global_workflow_variables'
@@ -190,7 +189,6 @@ export interface ToolCatalogEntry {
     | 'search_library_docs'
     | 'search_online'
     | 'search_patterns'
-    | 'service_account_get_setup_link'
     | 'set_block_enabled'
     | 'set_environment_variables'
     | 'set_global_workflow_variables'
@@ -3830,24 +3828,6 @@ export const SearchPatterns: ToolCatalogEntry = {
   },
 }
 
-export const ServiceAccountGetSetupLink: ToolCatalogEntry = {
-  id: 'service_account_get_setup_link',
-  name: 'service_account_get_setup_link',
-  route: 'sim',
-  mode: 'async',
-  parameters: {
-    type: 'object',
-    properties: {
-      providerName: {
-        type: 'string',
-        description:
-          'The integration to set up a service account for. Pass the most specific service the user needs (e.g. `google-sheets`, `gmail`, `jira`, `slack`, `notion`); a slug, OAuth provider value, service-account provider id, or display name resolves case-insensitively.',
-      },
-    },
-    required: ['providerName'],
-  },
-}
-
 export const SetBlockEnabled: ToolCatalogEntry = {
   id: 'set_block_enabled',
   name: 'set_block_enabled',
@@ -4952,7 +4932,6 @@ export const TOOL_CATALOG: Record<string, ToolCatalogEntry> = {
   [SearchLibraryDocs.id]: SearchLibraryDocs,
   [SearchOnline.id]: SearchOnline,
   [SearchPatterns.id]: SearchPatterns,
-  [ServiceAccountGetSetupLink.id]: ServiceAccountGetSetupLink,
   [SetBlockEnabled.id]: SetBlockEnabled,
   [SetEnvironmentVariables.id]: SetEnvironmentVariables,
   [SetGlobalWorkflowVariables.id]: SetGlobalWorkflowVariables,

apps/sim/lib/copilot/generated/tool-schemas-v1.ts

@@ -3618,20 +3618,6 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  service_account_get_setup_link: {
-    parameters: {
-      type: 'object',
-      properties: {
-        providerName: {
-          type: 'string',
-          description:
-            'The integration to set up a service account for. Pass the most specific service the user needs (e.g. `google-sheets`, `gmail`, `jira`, `slack`, `notion`); a slug, OAuth provider value, service-account provider id, or display name resolves case-insensitively.',
-        },
-      },
-      required: ['providerName'],
-    },
-    resultSchema: undefined,
-  },
   set_block_enabled: {
     parameters: {
       type: 'object',

apps/sim/lib/copilot/tool-executor/register-handlers.ts

@@ -48,7 +48,6 @@ import {
   RunFromBlock,
   RunWorkflow,
   RunWorkflowUntilBlock,
-  ServiceAccountGetSetupLink,
   SetBlockEnabled,
   SetGlobalWorkflowVariables,
   UpdateDeploymentVersion,
@@ -93,7 +92,6 @@ import { executeGetPlatformActions } from '../tools/handlers/platform'
 import { executeOpenResource } from '../tools/handlers/resources'
 import { executeRestoreResource } from '../tools/handlers/restore-resource'
 import { executeRunCode } from '../tools/handlers/run-code'
-import { executeServiceAccountGetSetupLink } from '../tools/handlers/service-account'
 import { executeVfsGlob, executeVfsGrep, executeVfsRead } from '../tools/handlers/vfs'
 import { executeVfsCp, executeVfsMkdir, executeVfsMv } from '../tools/handlers/vfs-mutate'
 import {
@@ -197,7 +195,6 @@ function buildHandlerMap(): Record<string, ToolHandler> {
     [ManageCredential.id]: h(executeManageCredential),
     [OauthGetAuthLink.id]: h(executeOAuthGetAuthLink),
     [OauthRequestAccess.id]: h(executeOAuthRequestAccess),
-    [ServiceAccountGetSetupLink.id]: h(executeServiceAccountGetSetupLink),
     [OpenResource.id]: h(executeOpenResource),
     [RestoreResource.id]: h(executeRestoreResource),
     [GetPlatformActions.id]: h(executeGetPlatformActions),

apps/sim/lib/copilot/tools/handlers/oauth.test.ts

@@ -229,7 +229,7 @@ describe('executeOAuthGetAuthLink service account rejection', () => {
 
     expect(result.success).toBe(false)
     expect(result.error).toContain('service account')
-    expect(result.error).toContain('service_account_get_setup_link')
+    expect(result.error).toContain('service_account credential tag')
     // The failure output must not carry an authorize URL the agent could
     // surface as a Connect button anyway.
     expect((result.output as { setup_url?: string }).setup_url).toBeUndefined()
@@ -247,7 +247,7 @@ describe('executeOAuthGetAuthLink service account rejection', () => {
   ])('rejects %s', async (providerName) => {
     const result = await executeOAuthGetAuthLink({ providerName }, context)
     expect(result.success).toBe(false)
-    expect(result.error).toContain('service_account_get_setup_link')
+    expect(result.error).toContain('service_account credential tag')
   })
 
   it('still resolves ordinary OAuth providers for integrations that also offer a service account', async () => {

apps/sim/lib/copilot/tools/handlers/oauth.ts

@@ -115,8 +115,8 @@ async function generateOAuthLink(
   if (isServiceAccountProviderId(normalizedInput)) {
     throw new Error(
       `"${providerName}" is a service account, not an OAuth provider. ` +
-        `Call service_account_get_setup_link with this provider instead — ` +
-        `it returns a link that opens the service account setup form.`
+        `Emit a service_account credential tag with the service's OAuth provider ` +
+        `value instead (e.g. "slack") — it opens the service account setup form in chat.`
     )
   }
 

apps/sim/lib/copilot/tools/handlers/service-account.test.ts

@@ -467,7 +467,6 @@ const TOOL_TITLES: Record<string, string> = {
   run_block: 'Running block',
   search_documentation: 'Searching documentation',
   search_patterns: 'Searching patterns',
-  service_account_get_setup_link: 'Getting service account setup link',
   set_block_enabled: 'Toggling block',
   set_environment_variables: 'Setting environment variables',
   set_global_workflow_variables: 'Setting workflow variables',