Gate Search Assistant integration lookups with AppConfig (#8301)

* Enable read-only integration lookups for Search Assistant

* Preserve inherited tool versions in generated integration docs

* Align provider tests with Search read-only operations

* Gate Search integration tools with AppConfig

* Preserve dev test runner isolation during promotion

Author: Sg312

apps/docs/content/docs/integrations/github.mdx

@@ -3414,6 +3414,46 @@ List users who have starred a repository
 |   ↳ `repos_url` | string | Repos API URL |
 | `count` | number | Number of stargazers returned |
 
+### GitHub List Review Threads
+
+List one page of a pull request's review threads with their comments, plus the newest submitted review.
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `owner` | string | Yes | Repository owner |
+| `repo` | string | Yes | Repository name |
+| `pullNumber` | number | Yes | Pull request number |
+| `threadsPerPage` | number | No | Review threads to fetch in this page \(1-100\) |
+| `commentsPerThread` | number | No | Comments to fetch per thread \(1-100\) |
+| `cursor` | string | No | Cursor from a previous page \(endCursor\) to continue from |
+| `apiKey` | string | Yes | GitHub API token with pull request read access |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `threads` | array | Review threads in this page |
+|   ↳ `id` | string | Review thread node ID |
+|   ↳ `isResolved` | boolean | Whether the thread is resolved |
+|   ↳ `path` | string | Repository-relative file path |
+|   ↳ `line` | number | Line the thread is anchored to |
+|   ↳ `commentsTotalCount` | number | Total comments on the thread; exceeds the fetched count when the thread was truncated |
+|   ↳ `comments` | array | Fetched comments, oldest first |
+|     ↳ `body` | string | Comment body |
+|     ↳ `authorAssociation` | string | Author's association with the repository \(OWNER, MEMBER, ...\) |
+|     ↳ `authorLogin` | string | Author login |
+|     ↳ `authorType` | string | Author GraphQL type \(User, Bot, Organization\) |
+| `totalCount` | number | Total review threads on the pull request |
+| `hasNextPage` | boolean | Whether more thread pages remain |
+| `endCursor` | string | Cursor to pass as `cursor` for the next page |
+| `latestReview` | object | Newest submitted review on the pull request |
+|   ↳ `state` | string | Review state |
+|   ↳ `submittedAt` | string | Submission timestamp |
+|   ↳ `authorLogin` | string | Reviewer login |
+|   ↳ `authorType` | string | Reviewer GraphQL type \(User, Bot\) |
+
 
 
 ## Triggers

apps/docs/content/docs/integrations/gmail.mdx

@@ -300,6 +300,23 @@ Remove label(s) from a Gmail message. Returns API-aligned fields only.
 | `threadId` | string | Gmail thread ID |
 | `labelIds` | array | Updated email labels |
 
+### Gmail List Labels
+
+List all labels in a Gmail account
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `labels` | json | Array of label objects with id, name, type, and visibility settings |
+
+
+
 ## Triggers
 
 A **Trigger** is a block that starts a workflow when an event happens in this service.

apps/sim/blocks/blocks/github.ts

@@ -2443,7 +2443,10 @@ export const GitHubV2Block: BlockConfig = {
   integrationType: IntegrationType.DevOps,
   tools: {
     ...GitHubBlock.tools,
-    access: (GitHubBlock.tools?.access || []).map((toolId) => `${toolId}_v2`),
+    access: [
+      ...(GitHubBlock.tools?.access || []).map((toolId) => `${toolId}_v2`),
+      'github_list_review_threads',
+    ],
     config: {
       ...GitHubBlock.tools?.config,
       tool: createVersionedToolSelector({

apps/sim/blocks/blocks/gmail.ts

@@ -678,6 +678,7 @@ export const GmailV2Block: BlockConfig = {
       'gmail_delete_v2',
       'gmail_add_label_v2',
       'gmail_remove_label_v2',
+      'gmail_list_labels_v2',
     ],
     config: {
       ...GmailBlock.tools?.config,

apps/sim/lib/atlassian/assistant.test.ts

@@ -1,16 +1,11 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { clearAtlassianCloudIdCache } from '@/lib/atlassian/discovery'
 import { createConfluenceClient } from '@/lib/internal/confluence/client'
 import { createJiraClient } from '@/lib/internal/jira/client'
-import {
-  assertAssistantIntegrationCall,
-  isAssistantIntegrationTool,
-} from '@/lib/mothership/assistant/tool-policy'
+import { assertAssistantIntegrationCall } from '@/lib/mothership/assistant/tool-policy'
 import { getToolMetadata } from '@/tools/metadata'
-import { getToolIds } from '@/tools/tool-ids'
 
 vi.unmock('@/tools/metadata')
-vi.unmock('@/tools/tool-ids')
 
 const CLOUD_ID = '12345678-1234-1234-1234-123456789012'
 const OTHER_CLOUD_ID = '12345678-1234-1234-1234-123456789013'
@@ -26,29 +21,23 @@ describe('Atlassian Assistant resource selection', () => {
     vi.stubGlobal('fetch', fetchMock)
   })
 
-  it.each(['jira', 'confluence'])(
-    'offers %s operations with a site selector and personal credential',
-    (service) => {
-      const tools = getToolIds()
-        .filter((id) => id.startsWith(`${service}_`))
-        .map((id) => getToolMetadata(id))
-        .filter((tool) => tool?.params.domain)
-      expect(tools.length).toBeGreaterThan(0)
-      for (const tool of tools) {
-        expect(tool?.params.domain.visibility, tool?.id).toBe('user-or-llm')
-        expect(isAssistantIntegrationTool(tool), tool?.id).toBe(true)
+  afterEach(() => vi.unstubAllGlobals())
+
+  it.each(['jira_get_project', 'confluence_list_spaces'])(
+    'allows site selection for %s without accepting credential overrides',
+    (toolId) => {
+      const tool = getToolMetadata(toolId)
+      expect(() =>
+        assertAssistantIntegrationCall(tool, { credentialId: 'mine', domain: DOMAIN })
+      ).not.toThrow()
+      for (const name of ['cloudId', 'accessToken', '_context']) {
         expect(() =>
-          assertAssistantIntegrationCall(tool, { credentialId: 'mine', domain: DOMAIN })
-        ).not.toThrow()
-        for (const name of ['cloudId', 'accessToken', '_context']) {
-          expect(() =>
-            assertAssistantIntegrationCall(tool, {
-              credentialId: 'mine',
-              domain: DOMAIN,
-              [name]: 'override',
-            })
-          ).toThrow()
-        }
+          assertAssistantIntegrationCall(tool, {
+            credentialId: 'mine',
+            domain: DOMAIN,
+            [name]: 'override',
+          })
+        ).toThrow()
       }
     }
   )

apps/sim/lib/core/config/feature-flags.ts

@@ -31,17 +31,17 @@ export type FeatureFlagContext = AppConfigGateContext
 /**
  * The single definition of a feature flag. Everything about a flag lives in one
  * place: its name (the registry key), a human-readable `description`, and the
- * `fallback` secret consulted when AppConfig isn't the source of truth (truthy ⇒ on
- * globally).
+ * optional `fallback` secret consulted when AppConfig is not the source of truth.
+ * A null fallback keeps the flag off outside AppConfig.
  *
  * Gating by workspace/org/user/admin is deliberately NOT part of a definition — it lives only
  * in the hosted AppConfig document, so no environment can grant access from a code
  * literal.
  */
 interface FeatureFlagDefinition {
   description: string
-  /** Env/secret key consulted when AppConfig isn't the source of truth. Truthy ⇒ on. */
-  fallback: keyof typeof env
+  /** Null means AppConfig-only; otherwise a truthy env/secret enables the fallback. */
+  fallback: keyof typeof env | null
 }
 
 /** The single registry of known flags. To add a flag, add one entry here. */
@@ -56,6 +56,12 @@ const FEATURE_FLAGS = {
       'Enable native macOS computer use in Mothership. Global on/off only; each device must also opt in.',
     fallback: 'MSHIP_COMPUTER_USE',
   },
+  'mothership-search-integration-tools': {
+    description:
+      'Give Search Assistant read-only integration discovery, calls, and matching prompt ' +
+      'instructions. Global AppConfig on/off only; disabled by default with no env fallback.',
+    fallback: null,
+  },
   'mothership-model-selector': {
     description:
       'Show the Mothership model selector, model-specific effort levels, and Fast for supported ' +
@@ -145,7 +151,7 @@ const FEATURE_FLAGS = {
 
 /**
  * The closed set of known feature flags. Derived from the registry, so a flag
- * cannot exist — or be checked — without a definition (and its mandatory fallback).
+ * cannot exist — or be checked — without a definition (and its explicit fallback policy).
  */
 export type FeatureFlagName = keyof typeof FEATURE_FLAGS
 
@@ -155,7 +161,7 @@ function fallbackFlags(): FeatureFlagsConfig {
   for (const [name, def] of Object.entries(FEATURE_FLAGS) as Array<
     [string, FeatureFlagDefinition]
   >) {
-    flags[name] = { enabled: isTruthy(env[def.fallback]) }
+    flags[name] = { enabled: def.fallback !== null && isTruthy(env[def.fallback]) }
   }
   return flags
 }

apps/sim/lib/mothership/assistant/tool-policy.test.ts

@@ -6,7 +6,7 @@ import {
 import type { ToolMetadata } from '@/tools/metadata'
 
 const tool: ToolMetadata = {
-  id: 'service_write',
+  id: 'google_drive_get_file',
   oauth: { required: true, provider: 'google-drive', authoritativeParams: ['instanceUrl'] },
   params: {
     credential: { type: 'string', visibility: 'user-only' },
@@ -19,7 +19,7 @@ const tool: ToolMetadata = {
 
 describe('Assistant integration policy', () => {
   const tokenTool: ToolMetadata = {
-    id: 'gitlab_get_project',
+    id: 'gitlab_list_projects',
     personalToken: { provider: 'gitlab', tokenParam: 'accessToken', hostParam: 'host' },
     params: {
       accessToken: { type: 'string', required: true, visibility: 'user-only' },
@@ -41,12 +41,22 @@ describe('Assistant integration policy', () => {
     expect(isAssistantIntegrationTool({ ...tokenTool, params: {} })).toBe(false)
   })
 
-  it('allows writes with one explicit connected account', () => {
+  it('allows selected reads with one explicit connected account', () => {
     expect(() =>
       assertAssistantIntegrationCall(tool, { credential: 'mine', body: 'updated content' })
     ).not.toThrow()
   })
 
+  it.each(['gmail_send', 'google_drive_create_file', 'new_provider_operation'])(
+    'rejects unapproved operation %s even with a personal account',
+    (id) => {
+      expect(isAssistantIntegrationTool({ ...tool, id })).toBe(false)
+      expect(() =>
+        assertAssistantIntegrationCall({ ...tool, id }, { credential: 'mine' })
+      ).toThrow()
+    }
+  )
+
   it.each(['accessToken', 'apiKey', 'headers', '_context', 'impersonateUserEmail', 'instanceUrl'])(
     'rejects model-supplied %s before execution',
     (name) =>

apps/sim/lib/mothership/assistant/tool-policy.ts

@@ -10,9 +10,52 @@ export const ASSISTANT_TOOLS = new Set([
 
 const CREDENTIAL_PARAMS = new Set(['credential', 'credentialId', 'oauthCredential'])
 
-/** Assistant uses the regular integration registry, with authentication supplied by the caller's account. */
+/** Read-only lookups complement search_workspace without exposing provider writes. */
+const ASSISTANT_INTEGRATION_TOOLS = new Set([
+  'slack_list_users',
+  'slack_get_user',
+  'slack_list_channels',
+  'slack_list_user_conversations',
+  'slack_get_channel_info',
+  'slack_list_members',
+  'gmail_list_labels_v2',
+  'google_calendar_list_calendars_v2',
+  'google_calendar_get_v2',
+  'google_calendar_instances_v2',
+  'google_calendar_freebusy_v2',
+  'google_drive_get_file',
+  'google_drive_list_comments',
+  'google_sheets_get_spreadsheet_v2',
+  'google_sheets_read_v2',
+  'jira_search_users',
+  'jira_list_projects',
+  'jira_get_project',
+  'jira_get_fields',
+  'jira_get_comments',
+  'confluence_list_spaces',
+  'confluence_get_user',
+  'confluence_get_page_children',
+  'confluence_get_page_ancestors',
+  'confluence_list_comments',
+  'github_search_users_v2',
+  'github_repo_info_v2',
+  'github_get_tree_v2',
+  'github_list_review_threads',
+  'github_get_pr_files_v2',
+  'gitlab_search_users',
+  'gitlab_list_members',
+  'gitlab_list_projects',
+  'gitlab_get_merge_request_changes',
+  'coda_resolve_browser_link',
+  'coda_list_pages',
+  'coda_list_tables',
+  'coda_list_columns',
+  'coda_list_rows',
+])
+
+/** Discovery and execution share the same operations and personal-account requirements. */
 export function isAssistantIntegrationTool(tool: ToolMetadata | undefined): boolean {
-  if (!tool) return false
+  if (!tool || !ASSISTANT_INTEGRATION_TOOLS.has(tool.id)) return false
   tool = projectAssistantConnectedAccountTool(tool)
   const tokenBinding = tool.personalToken
   const supportsToken =