fix(search): bind meeting pagination and preserve read scopes

Author: waleedlatif1

apps/docs/content/docs/search/google-meet.mdx

@@ -5,7 +5,7 @@ description: Search recent conference transcripts and find generated meeting not
 
 ## Connect
 
-An administrator enables **Google Meet → Member accounts** under **Settings → Sources**. Each person connects Google Meet under **Integrations**. Sim uses the existing Google OAuth client and the connected member's Meet permissions. No service account is required.
+An administrator enables **Google Meet → Member accounts** under **Settings → Sources**. In **Integrations**, click **Connect** beside Google Meet, sign in to your Google account, and approve the requested access. Return to Sim and confirm your account appears on the row. Sim uses the existing Google OAuth client and your Meet permissions. No service account is required.
 
 For self-hosted deployments, enable the **Google Meet REST API** in the Google Cloud project used by Sim, configure `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`, and register:
 
@@ -32,3 +32,13 @@ Reads retrieve complete finalized transcripts within the request, entry and byte
 Connect **Google Drive** to read saved meeting notes and transcripts, including older documents that remain in the organizer's Drive. Use Drive's native query syntax, such as `fullText contains 'rollback' and mimeType = 'application/vnd.google-apps.document'`, then read the result. Drive dates mean file modification time, not the meeting date. Normal document sharing and retention rules apply.
 
 Use **Google Calendar** to search scheduled meetings and invitations. An event on the calendar does not establish that a Meet transcript or recording exists.
+
+## Disconnect and troubleshoot
+
+To disconnect, open **Integrations**, use the **…** menu beside Google Meet, choose **Disconnect** for your account, and confirm. Any workflows using that connection also lose access. This does not delete transcripts or notes from Google Drive.
+
+- **Connect is unavailable or permission is denied:** ask your Sim administrator to enable the source and finish Google OAuth setup. Your Google Workspace administrator may need to approve the app.
+- **Reconnect needed:** use **Reconnect** beside Google Meet and authorize the account again.
+- **No matching transcript:** narrow to the meeting's dates or space, confirm transcription was enabled, and check whether the conference is within the API's 30-day window. Use Google Drive for saved or older documents and the bodies of smart notes.
+
+For help, contact [help@sim.ai](mailto:help@sim.ai).

apps/docs/content/docs/search/index.mdx

@@ -32,19 +32,27 @@ In Sources, open an integration to manage its connection and resource settings.
 
 ## Connector guides
 
-These nine providers support live Search. Google Docs, Sheets, and Slides are accessed through Drive. Other [knowledge-base connectors](/knowledgebase/connectors) do not automatically become Search integrations.
+These providers support live Search. Google Docs, Sheets, and Slides are accessed through Drive. Other [knowledge-base connectors](/knowledgebase/connectors) do not automatically become Search integrations.
 
 | Source | Search path | Modes |
 | --- | --- | --- |
 | [Coda](/search/coda) | Personal Coda MCP; legacy REST connections search document titles | Member or service |
 | [Confluence](/search/confluence) | Confluence Cloud CQL and content APIs | Member or service |
-| [GitHub](/search/github) | GitHub issue, code, and repository search | Member or GitHub App |
+| [Fireflies](/search/fireflies) | Meeting titles and spoken transcripts | Member only |
+| [GitHub](/search/github) | Repositories, code, issues and pull request discussions | Member or GitHub App |
 | [GitLab](/search/gitlab) | Configured self-managed project's search and read APIs | Service only; admin or CSV permissions |
-| [Gmail](/search/gmail) | Gmail message search and message reads | Member or service |
+| [Gmail](/search/gmail) | Message search and conversation reads | Member or service |
 | [Google Calendar](/search/google-calendar) | Calendar lists and event APIs | Member or service |
-| [Google Drive](/search/google-drive) | Drive search plus supported file reads/exports | Member or service |
+| [Google Drive](/search/google-drive) | File search, supported document reads and comments | Member or service |
+| [Google Meet](/search/google-meet) | Recent conference transcripts and generated-note links | Member only |
+| [Granola](/search/granola) | Semantic meeting search with source notes and transcript reads | Member only |
+| [HubSpot](/search/hubspot) | Contacts, companies, deals and tickets | Member only |
 | [Jira](/search/jira) | Jira Cloud JQL and issue APIs | Member only |
+| [Linear](/search/linear) | Issues and their comment discussions | Member only |
+| [Lucid](/search/lucid) | Lucidchart diagrams and Lucidspark boards | Member only |
+| [Notion](/search/notion) | Page and database content through Notion MCP | Member only |
 | [Slack](/search/slack) | Slack real-time search with the member's user token | Member only |
+| [Zoom](/search/zoom) | Past meetings with available transcripts, notes and summaries | Member only |
 
 [Generic Secrets](/search/generic-secrets) is also available as a source, but does not add searchable documents. Organization mode makes its secrets available across the organization; Member mode lets each person manage their own secrets in Integrations. Build and Plan can use these secrets for requests; Search cannot mount them.
 

apps/docs/content/docs/search/zoom.mdx

@@ -5,7 +5,13 @@ description: Search past meetings, transcripts, personal notes and AI summaries
 
 ## Connect
 
-An administrator enables **Zoom → Member accounts** under **Settings → Sources**. Each person connects Zoom under **Integrations**, using their own Zoom account. Their Zoom administrator may need to approve the app first. Current Zoom permissions determine which meetings and artifacts they can read.
+An administrator enables **Zoom → Member accounts** under **Settings → Sources**. Then each person connects their own account:
+
+1. Open **Integrations** in Sim and click **Connect** beside Zoom.
+2. Sign in to Zoom, review the requested read permissions, and authorize the app. Your Zoom administrator may need to approve it first.
+3. Return to Sim and confirm your account appears on the Zoom row. Current Zoom permissions determine which meetings and artifacts you can read.
+
+If connection fails, see [Troubleshooting](#troubleshooting).
 
 Sim uses the official [Zoom Meetings MCP server](https://developers.zoom.us/docs/mcp/zoom-meetings-mcp-server/). Search uses a separate General OAuth app registration from workflow actions. Zoom reauthorization can replace or narrow an existing user/app grant, so sharing the workflow client would risk disconnecting existing workflows. A Zoom workflow connection does not authorize Search.
 
@@ -21,10 +27,29 @@ The OAuth exchange uses PKCE and `client_secret_basic`. Search requests only tho
 
 ## Search and read
 
+On **Home**, ask a question such as “What did we decide about deployment rollback last week? Search Zoom and cite the transcript.” Follow a result’s source link to open it in Zoom.
+
 Use short plain keywords such as `deployment rollback`. Zoom matches meeting topics, agendas and available meeting content. Results identify past meeting occurrences by UUID, rather than the recurring meeting number. Use `kind: meeting` when sending multiple native queries to one account.
 
 `startDate` and `endDate` filter actual meeting start time. The end is exclusive. Continue with `nextCursor` using the same account, query and filters; Zoom's page token expires after 15 minutes. Each page verifies at most 10 candidates. Sorting the returned candidates does not establish the globally newest or oldest match.
 
 Read a result for available timestamped transcripts, personal notes and separately labeled AI-generated summaries. Generated summaries and notes are not verbatim speech. Sim does not download recordings or transcribe audio. Recording, transcription and AI Companion settings, licenses, processing state and sharing permissions determine which artifacts exist.
 
 Boolean/field operators, project selection, ownership filters and modification-date filters are unsupported. An absent artifact does not prove a meeting had no discussion. Oversized or malformed reads fail explicitly; provider failures do not appear as a successful search with no matches.
+
+## Disconnect
+
+In Sim **Integrations**, open the **…** menu beside Zoom, choose **Disconnect** for your account, and confirm. This stops that connection from being used in this organization. Any workflows using the same connection also lose access; other people's connections are unaffected.
+
+To remove the authorization from Zoom too, open **Zoom App Marketplace → My Library**, find the Sim app you authorized for Search, open its **More** menu, and choose **Remove**, then confirm. See [Zoom's removal instructions](https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0062865); your Zoom administrator may control app removal.
+
+Disconnecting does not delete meetings or recordings in Zoom or erase existing Sim conversations. See [Sim's Privacy Policy](https://www.sim.ai/privacy) for data handling and deletion requests.
+
+## Troubleshooting
+
+- **Connect is unavailable:** ask your Sim administrator to enable the source and finish the Zoom app configuration. Ask your Zoom administrator about app approval if authorization is blocked.
+- **Reconnect needed:** use **Reconnect** on the Zoom row in Integrations and authorize the same account again.
+- **Missing meeting or text:** confirm you can open it in Zoom, try a distinctive topic and date range, and check whether recording, transcription or AI summary processing has finished. Available content depends on the meeting's settings and your permissions.
+- **Expired cursor or changed content:** run the search again before continuing the result. Zoom page tokens expire after 15 minutes.
+
+For help, contact [help@sim.ai](mailto:help@sim.ai).

apps/sim/lib/api/contracts/mothership-assistant-tools.ts

@@ -61,13 +61,15 @@ export const nativeSearchQuerySchema = z
   })
   .strict()
   .superRefine((input, context) => {
-    if (input.kind && hasSearchKinds(input.provider)) {
-      const kinds = PROVIDER_KIND_SCHEMAS[input.provider]
-      if (!kinds.safeParse(input.kind).success)
+    if (input.kind) {
+      const kinds = hasSearchKinds(input.provider) ? PROVIDER_KIND_SCHEMAS[input.provider] : null
+      if (!kinds?.safeParse(input.kind).success)
         context.addIssue({
           code: 'custom',
           path: ['kind'],
-          message: `${input.provider} kind must be one of: ${kinds.options.join(', ')}.`,
+          message: kinds
+            ? `${input.provider} kind must be one of: ${kinds.options.join(', ')}.`
+            : `${input.provider} does not support kind selection.`,
         })
     }
     if ((input.provider === 'notion' || input.provider === 'lucid') && !input.query)

apps/sim/lib/credential-groups/__integration__/hubspot-mcp.integration.ts

@@ -30,7 +30,11 @@ import {
 import { createManagedMcpAuthProvider } from '@/lib/mcp/application/managed-auth-provider'
 import * as oauth from '@/lib/mcp/oauth/auth'
 import { createCoordinatedMcpOauthFetch } from '@/lib/mcp/oauth/coordinated-fetch'
-import { loadPreregisteredClient, McpOauthRedirectRequired } from '@/lib/mcp/oauth/provider'
+import {
+  loadPreregisteredClient,
+  McpOauthRedirectRequired,
+  SimMcpOauthProvider,
+} from '@/lib/mcp/oauth/provider'
 import { getOrCreateOauthRow, saveClientInformation } from '@/lib/mcp/oauth/storage'
 import { mcpService } from '@/lib/mcp/service'
 
@@ -248,6 +252,75 @@ describe.each(SHARED_CLIENTS)('$name shared member connector', (connector) => {
     Object.assign(env, { [connector.clientSecretKey]: 'rotated-secret' })
     await expect(runtime(id)).rejects.toThrow(/authorization/)
   })
+  if (connector.id === 'zoom') {
+    it.each(['initial consent', 'runtime scope challenge'] as const)(
+      'restricts generic OAuth %s to registered read permissions',
+      async (phase) => {
+        const { mcpServer } = await create()
+        const issuer = 'https://oauth.fixture.test'
+        const loadProvider = async () =>
+          new SimMcpOauthProvider({
+            row: await getOrCreateOauthRow({ mcpServerId: mcpServer.id, organizationId: org }),
+            preregistered: await loadPreregisteredClient(mcpServer.id),
+          })
+        const provider = await loadProvider()
+        const fetchFn: typeof fetch = async (request) => {
+          const url = new URL(
+            typeof request === 'string' ? request : request instanceof URL ? request : request.url
+          )
+          if (url.href === connector.url)
+            return new Response(null, {
+              status: 403,
+              headers: {
+                'www-authenticate':
+                  'Bearer error="insufficient_scope", scope="meeting:write:meeting"',
+              },
+            })
+          if (url.pathname.includes('oauth-protected-resource'))
+            return Response.json({
+              resource: connector.url,
+              authorization_servers: [issuer],
+              scopes_supported: [...connector.scope.split(' '), 'meeting:write:meeting'],
+            })
+          if (
+            url.pathname.includes('oauth-authorization-server') ||
+            url.pathname.includes('openid-configuration')
+          )
+            return Response.json({
+              issuer,
+              authorization_endpoint: `${issuer}/authorize`,
+              token_endpoint: `${issuer}/token`,
+              response_types_supported: ['code'],
+              code_challenge_methods_supported: ['S256'],
+              token_endpoint_auth_methods_supported: [connector.tokenAuthMethod],
+            })
+          throw new Error(`Unexpected OAuth fixture request: ${url.origin}${url.pathname}`)
+        }
+        try {
+          if (phase === 'initial consent') {
+            await oauth.mcpAuthGuarded(provider, { serverUrl: connector.url, fetchFn })
+          } else {
+            await provider.saveTokens({ access_token: 'fixture-access', token_type: 'Bearer' })
+            const request = createCoordinatedMcpOauthFetch(
+              { credentialId: mcpServer.id, loadProvider, initialProvider: provider },
+              { serverUrl: connector.url, fetch: fetchFn }
+            )
+            await request(connector.url, { method: 'POST' })
+          }
+          throw new Error('Expected authorization to require consent')
+        } catch (error) {
+          if (!(error instanceof McpOauthRedirectRequired)) throw error
+          const authorization = new URL(error.authorizationUrl)
+          expect(authorization.searchParams.get('scope')).toBe(connector.scope)
+          expect(authorization.searchParams.get('code_challenge_method')).toBe('S256')
+          const storedProvider = await loadProvider()
+          expect(
+            Buffer.from(sha256Hex(await storedProvider.codeVerifier()), 'hex').toString('base64url')
+          ).toBe(authorization.searchParams.get('code_challenge'))
+        }
+      }
+    )
+  }
   it('binds the public OAuth round trip to the shared client and rejects rotation before exchange', async () => {
     const { mcpServer } = await create()
     const token = generateId()

apps/sim/lib/mcp/oauth/auth.ts

@@ -1,5 +1,6 @@
 import { auth, type OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js'
 import { ManagedMcpOauthProvider } from '@/lib/mcp/oauth/managed-provider'
+import { SimMcpOauthProvider } from '@/lib/mcp/oauth/provider'
 import { createSsrfGuardedMcpFetch } from '@/lib/mcp/pinned-fetch'
 
 type McpAuthOptions = Parameters<typeof auth>[1]
@@ -18,7 +19,8 @@ export function mcpAuthGuarded(
 ): ReturnType<typeof auth> {
   return auth(provider, {
     ...options,
-    ...(provider instanceof ManagedMcpOauthProvider && provider.authorizationScope
+    ...((provider instanceof ManagedMcpOauthProvider || provider instanceof SimMcpOauthProvider) &&
+    provider.authorizationScope
       ? { scope: provider.authorizationScope }
       : {}),
     fetchFn: options.fetchFn ?? createSsrfGuardedMcpFetch({ serverUrl: String(options.serverUrl) }),

apps/sim/lib/mcp/oauth/provider.ts

@@ -64,6 +64,11 @@ export class SimMcpOauthProvider implements OAuthClientProvider {
     this.preregistered = preregistered
   }
 
+  /** Deployment registrations may restrict consent even when discovery advertises more tools. */
+  get authorizationScope(): string | undefined {
+    return this.preregistered?.scope
+  }
+
   get redirectUrl(): string {
     return `${getBaseUrl().replace(/\/$/, '')}/api/mcp/oauth/callback`
   }

apps/sim/lib/mothership/generated/sim-assistant-tools.generated.ts

@@ -81,13 +81,15 @@ export const nativeSearchQuerySchema = z
   })
   .strict()
   .superRefine((input, context) => {
-    if (input.kind && hasSearchKinds(input.provider)) {
-      const kinds = PROVIDER_KIND_SCHEMAS[input.provider]
-      if (!kinds.safeParse(input.kind).success)
+    if (input.kind) {
+      const kinds = hasSearchKinds(input.provider) ? PROVIDER_KIND_SCHEMAS[input.provider] : null
+      if (!kinds?.safeParse(input.kind).success)
         context.addIssue({
           code: 'custom',
           path: ['kind'],
-          message: `${input.provider} kind must be one of: ${kinds.options.join(', ')}.`,
+          message: kinds
+            ? `${input.provider} kind must be one of: ${kinds.options.join(', ')}.`
+            : `${input.provider} does not support kind selection.`,
         })
     }
     if ((input.provider === 'notion' || input.provider === 'lucid') && !input.query)