feat(managed-agents): environment-type selector; hide cloud-only fields on self-hosted

Collapse what #5769 split into two blocks into one, natively:
- Add an Environment type selector (Cloud / Self-hosted) that filters the
  environment list to the matching type and gates cloud-only fields
- Memory store, memory access/instructions, and files are cloud-only (self-
  hosted rejects the resources[] attach — verified live, 400) and are now hidden
  on self-hosted instead of silently dropped. A self-hosted worker that uses a
  memory store reads its id from a Metadata key the author sets explicitly
- Expose each environment's config.type on the list options so the picker can
  filter by mode; pass the selected type as a routing hint (server still re-
  resolves the authoritative type via getEnvironmentType)

Author: waleedlatif1

apps/sim/app/api/tools/managed-agent/list/route.ts

@@ -46,7 +46,7 @@ function toOption(
   if (resource === 'environments') {
     const type = row.config?.type
     const suffix = type ? ` (${type})` : ''
-    return { id: row.id, label: `${name || row.id}${suffix}` }
+    return { id: row.id, label: `${name || row.id}${suffix}`, ...(type ? { type } : {}) }
   }
   if (resource === 'vaults') {
     return { id: row.id, label: name || row.id }

apps/sim/blocks/blocks/managed_agent.ts

@@ -11,10 +11,11 @@ import { AuthMode, IntegrationType } from '@/blocks/types'
 /**
  * Claude Managed Agents block.
  *
- * Invokes a Claude Platform Managed Agent (cloud or self-hosted) as a
- * workflow node and returns the assistant's final text. Memory and metadata
- * route automatically, so one block covers both cloud and self-hosted
- * environments.
+ * Invokes a Claude Platform Managed Agent (cloud or self-hosted) as a workflow
+ * node and returns the assistant's final text. One block covers both models:
+ * the Environment type selector filters the environment list and shows only the
+ * fields that apply — memory stores and files are cloud-only (self-hosted
+ * rejects the `resources` attach), while session metadata works for both.
  *
  * Authentication is a selectable Claude Platform credential (an Anthropic
  * workspace API key). The credential's key is resolved server-side at run
@@ -43,6 +44,19 @@ export const ManagedAgentBlock: BlockConfig = {
       required: true,
       placeholder: 'Select a Claude Platform credential',
     },
+    {
+      id: 'environmentType',
+      title: 'Environment type',
+      type: 'dropdown',
+      required: true,
+      options: [
+        { label: 'Cloud', id: 'cloud' },
+        { label: 'Self-hosted', id: 'self_hosted' },
+      ],
+      value: () => 'cloud',
+      description:
+        'Self-hosted environments run on your own infrastructure and route memory via session metadata; file attachments are cloud-only.',
+    },
     {
       id: 'agent',
       title: 'Agent',
@@ -62,7 +76,7 @@ export const ManagedAgentBlock: BlockConfig = {
       placeholder: 'Select an environment…',
       commandSearchable: true,
       options: [],
-      dependsOn: ['credential'],
+      dependsOn: ['credential', 'environmentType'],
       fetchOptions: fetchManagedAgentEnvironmentOptions,
     },
     {
@@ -104,6 +118,10 @@ export const ManagedAgentBlock: BlockConfig = {
       commandSearchable: true,
       options: [],
       dependsOn: ['credential'],
+      // Cloud only: memory stores attach as `resources[]`, which self-hosted
+      // rejects. A self-hosted worker that uses a store reads its id from a
+      // Metadata key the author sets explicitly.
+      condition: { field: 'environmentType', value: 'cloud' },
       fetchOptions: fetchManagedAgentMemoryStoreOptions,
     },
     {
@@ -117,7 +135,12 @@ export const ManagedAgentBlock: BlockConfig = {
         { label: 'Read only', id: 'read_only' },
       ],
       value: () => 'read_write',
-      condition: { field: 'memoryStoreId', value: '', not: true },
+      condition: {
+        field: 'memoryStoreId',
+        value: '',
+        not: true,
+        and: { field: 'environmentType', value: 'cloud' },
+      },
       description: 'read_write pushes changes back on session exit; read_only never writes.',
     },
     {
@@ -127,7 +150,14 @@ export const ManagedAgentBlock: BlockConfig = {
       required: false,
       mode: 'advanced',
       placeholder: 'Optional — how the agent should use this memory store',
-      condition: { field: 'memoryStoreId', value: '', not: true },
+      // Cloud only: instructions are a `resources[]` memory-attach concept the
+      // API renders into the system prompt; self-hosted has no resource attach.
+      condition: {
+        field: 'memoryStoreId',
+        value: '',
+        not: true,
+        and: { field: 'environmentType', value: 'cloud' },
+      },
       description: 'Per-attachment guidance rendered into the memory section of the system prompt.',
     },
     {
@@ -136,9 +166,11 @@ export const ManagedAgentBlock: BlockConfig = {
       type: 'table',
       required: false,
       mode: 'advanced',
+      // Cloud only: files attach as `resources[]`, which self-hosted rejects.
+      condition: { field: 'environmentType', value: 'cloud' },
       columns: ['File ID', 'Mount path'],
       description:
-        'Files-API file ids (file_...) to attach as file resources (cloud environments). Mount path is optional.',
+        'Files-API file ids (file_...) to attach as file resources. Mount path is optional.',
     },
     {
       id: 'sessionParameters',
@@ -156,6 +188,11 @@ export const ManagedAgentBlock: BlockConfig = {
   },
   inputs: {
     credential: { type: 'string', description: 'Claude Platform credential id.' },
+    environmentType: {
+      type: 'string',
+      description:
+        "Environment execution model — 'cloud' or 'self_hosted'. Filters the environment picker and gates cloud-only fields; the actual type is re-resolved server-side for routing.",
+    },
     agent: { type: 'string', description: 'Managed-agent id inside the linked Claude workspace.' },
     environment: {
       type: 'string',

apps/sim/lib/api/contracts/managed-agents.ts

@@ -12,6 +12,8 @@ import { type ContractJsonResponse, defineRouteContract } from '@/lib/api/contra
 export const managedAgentOptionSchema = z.object({
   id: z.string(),
   label: z.string(),
+  /** Environment execution model — only set for the `environments` resource, used to filter by mode. */
+  type: z.enum(['cloud', 'self_hosted']).optional(),
 })
 export type ManagedAgentOption = z.output<typeof managedAgentOptionSchema>
 

apps/sim/lib/managed-agents/run-session.ts

@@ -6,6 +6,7 @@ import {
   type AnthropicSessionEvent,
   type CreateSessionInput,
   createSession,
+  type EnvironmentType,
   getEnvironmentType,
   getSession,
   interruptSession,
@@ -40,6 +41,8 @@ export interface RunManagedAgentInput {
   apiKey: string
   agentId: string
   environmentId: string
+  /** Env-type hint from the block; used only if server-side resolution fails. */
+  environmentType?: EnvironmentType
   userMessage: string
   title?: string
   vaultIds?: string[]
@@ -106,12 +109,11 @@ export async function runManagedAgentSession(
 
   // Resolve the environment type up front so the payload routes correctly:
   // self-hosted environments reject `resources`, so memory must go via metadata
-  // there. Best-effort — an undefined result falls back to cloud behavior.
-  const environmentType = await getEnvironmentType({
-    apiKey,
-    environmentId: input.environmentId,
-    signal,
-  })
+  // there. The authoritative source is the API; the block's hint is only a
+  // fallback if that lookup fails.
+  const environmentType =
+    (await getEnvironmentType({ apiKey, environmentId: input.environmentId, signal })) ??
+    input.environmentType
 
   const createInput: CreateSessionInput = {
     apiKey,

apps/sim/lib/managed-agents/session-client.test.ts

@@ -124,26 +124,26 @@ describe('buildSessionCreatePayload — metadata', () => {
 })
 
 describe('buildSessionCreatePayload — self-hosted routing', () => {
-  it('routes memory to metadata and never sends resources (self-hosted rejects resources)', () => {
+  it('never sends resources on self-hosted and does not auto-route memory (no native support)', () => {
     const payload = buildSessionCreatePayload({
       ...BASE,
       environmentType: 'self_hosted',
       memoryStoreId: 'memstore_01',
       memoryAccess: 'read_only',
+      memoryInstructions: 'use it',
+      files: [{ fileId: 'file_1' }],
       sessionParameters: { SOURCE_TYPE: 'git' },
     })
     expect(payload.resources).toBeUndefined()
-    expect(payload.metadata).toEqual({
-      SOURCE_TYPE: 'git',
-      memory_store_ids: 'memstore_01',
-      memory_access: 'read_only',
-    })
+    // Only the author's explicit metadata is forwarded — memory is NOT injected.
+    expect(payload.metadata).toEqual({ SOURCE_TYPE: 'git' })
   })
 
-  it('drops file attachments on self-hosted (not supported as resources)', () => {
+  it('sends no metadata on self-hosted when the author set none', () => {
     const payload = buildSessionCreatePayload({
       ...BASE,
       environmentType: 'self_hosted',
+      memoryStoreId: 'memstore_01',
       files: [{ fileId: 'file_1' }],
     })
     expect(payload.resources).toBeUndefined()

apps/sim/lib/managed-agents/session-client.ts

@@ -118,10 +118,11 @@ function managedAgentsHeaders(
  *
  * Cloud environments attach memory stores and files via the `resources[]`
  * array. Self-hosted environments REJECT `resources` (a documented 400 —
- * "resources are not supported with self-hosted environments"), so there the
- * memory store is surfaced to the worker via `metadata.memory_store_ids` /
- * `metadata.memory_access` and files are dropped. Session parameters always go
- * on `metadata` for both.
+ * "resources are not supported with self-hosted environments") and have no
+ * native memory/file attach, so those are omitted there; the block hides the
+ * fields accordingly. Session parameters always go on `metadata` for both — a
+ * self-hosted worker that consumes a memory store reads it from a metadata key
+ * the author sets explicitly.
  */
 export function buildSessionCreatePayload(input: CreateSessionInput): Record<string, unknown> {
   const payload: Record<string, unknown> = {
@@ -131,16 +132,8 @@ export function buildSessionCreatePayload(input: CreateSessionInput): Record<str
   if (input.title) payload.title = input.title
   if (input.vaultIds && input.vaultIds.length > 0) payload.vault_ids = input.vaultIds
 
-  const metadata: Record<string, string> = { ...(input.sessionParameters ?? {}) }
-
-  if (input.environmentType === 'self_hosted') {
-    // No `resources` on self-hosted — route memory through metadata (the
-    // worker consumes these keys) and drop file attachments.
-    if (input.memoryStoreId) {
-      metadata.memory_store_ids = input.memoryStoreId
-      metadata.memory_access = input.memoryAccess ?? 'read_write'
-    }
-  } else {
+  // `resources` (memory stores + files) are cloud-only. Self-hosted rejects them.
+  if (input.environmentType !== 'self_hosted') {
     const resources: Array<Record<string, unknown>> = []
     if (input.memoryStoreId) {
       const memory: Record<string, unknown> = {
@@ -162,7 +155,9 @@ export function buildSessionCreatePayload(input: CreateSessionInput): Record<str
     if (resources.length > 0) payload.resources = resources
   }
 
-  if (Object.keys(metadata).length > 0) payload.metadata = metadata
+  if (input.sessionParameters && Object.keys(input.sessionParameters).length > 0) {
+    payload.metadata = { ...input.sessionParameters }
+  }
   return payload
 }
 

apps/sim/lib/managed-agents/subblock-options.ts

@@ -14,18 +14,18 @@ import { useSubBlockStore } from '@/stores/workflows/subblock/store'
  * the browser.
  */
 
-function credentialIdForBlock(blockId: string): string | null {
+function readSubBlockValue(blockId: string, key: string): string | null {
   const activeWorkflowId = useWorkflowRegistry.getState().activeWorkflowId
   if (!activeWorkflowId) return null
-  const value = useSubBlockStore.getState().workflowValues[activeWorkflowId]?.[blockId]?.credential
+  const value = useSubBlockStore.getState().workflowValues[activeWorkflowId]?.[blockId]?.[key]
   return typeof value === 'string' && value.length > 0 ? value : null
 }
 
 async function fetchOptions(
   blockId: string,
   resource: ManagedAgentResource
 ): Promise<ManagedAgentOption[]> {
-  const credentialId = credentialIdForBlock(blockId)
+  const credentialId = readSubBlockValue(blockId, 'credential')
   if (!credentialId) return []
   try {
     const { options } = await requestJson(listManagedAgentOptionsContract, {
@@ -41,10 +41,16 @@ export function fetchManagedAgentAgentOptions(blockId: string): Promise<ManagedA
   return fetchOptions(blockId, 'agents')
 }
 
-export function fetchManagedAgentEnvironmentOptions(
+export async function fetchManagedAgentEnvironmentOptions(
   blockId: string
 ): Promise<ManagedAgentOption[]> {
-  return fetchOptions(blockId, 'environments')
+  const options = await fetchOptions(blockId, 'environments')
+  // Filter to the selected environment type so cloud/self-hosted stay separate
+  // (self-hosted rejects `resources`, so the two modes expose different fields).
+  // Options with an unknown type are kept as a safety net.
+  const mode = readSubBlockValue(blockId, 'environmentType')
+  if (mode !== 'cloud' && mode !== 'self_hosted') return options
+  return options.filter((option) => option.type === undefined || option.type === mode)
 }
 
 export function fetchManagedAgentVaultOptions(blockId: string): Promise<ManagedAgentOption[]> {

apps/sim/tools/managed_agent/run_session.ts

@@ -58,6 +58,13 @@ export const managedAgentRunSessionTool: ToolConfig<
       visibility: 'user-only',
       description: 'Environment id inside the linked Claude workspace.',
     },
+    environmentType: {
+      type: 'string',
+      required: false,
+      visibility: 'user-only',
+      description:
+        "Environment execution model hint ('cloud' | 'self_hosted'); the actual type is re-resolved server-side for routing.",
+    },
     userMessage: {
       type: 'string',
       required: true,
@@ -158,11 +165,17 @@ export const managedAgentRunSessionTool: ToolConfig<
     const workflowId = params._context?.workflowId?.trim()
     const title = workflowId ? `Sim workflow ${workflowId}` : undefined
 
+    const environmentType =
+      params.environmentType === 'self_hosted' || params.environmentType === 'cloud'
+        ? params.environmentType
+        : undefined
+
     const result = await runManagedAgentSession({
       apiKey,
       agentId,
       environmentId,
       userMessage: (params.userMessage ?? '').toString(),
+      ...(environmentType ? { environmentType } : {}),
       ...(title ? { title } : {}),
       ...(vaultIds.length > 0 ? { vaultIds } : {}),
       ...(memoryStoreId ? { memoryStoreId } : {}),

apps/sim/tools/managed_agent/types.ts

@@ -15,6 +15,8 @@ export interface ManagedAgentRunSessionParams {
   agent: string
   /** Environment id from the linked Claude workspace. */
   environment: string
+  /** Env-type hint ('cloud' | 'self_hosted') from the block; re-resolved server-side. */
+  environmentType?: string
   /** The user's turn as plain text. Resolved by the executor. */
   userMessage: string
   /** Zero or more vault ids for MCP auth (array, json string, or comma-list). */