Gate Search integration tools with AppConfig

Author: Sg312

apps/sim/lib/core/config/feature-flags.ts

@@ -31,17 +31,17 @@ export type FeatureFlagContext = AppConfigGateContext
 /**
  * The single definition of a feature flag. Everything about a flag lives in one
  * place: its name (the registry key), a human-readable `description`, and the
- * `fallback` secret consulted when AppConfig isn't the source of truth (truthy ⇒ on
- * globally).
+ * optional `fallback` secret consulted when AppConfig is not the source of truth.
+ * A null fallback keeps the flag off outside AppConfig.
  *
  * Gating by workspace/org/user/admin is deliberately NOT part of a definition — it lives only
  * in the hosted AppConfig document, so no environment can grant access from a code
  * literal.
  */
 interface FeatureFlagDefinition {
   description: string
-  /** Env/secret key consulted when AppConfig isn't the source of truth. Truthy ⇒ on. */
-  fallback: keyof typeof env
+  /** Null means AppConfig-only; otherwise a truthy env/secret enables the fallback. */
+  fallback: keyof typeof env | null
 }
 
 /** The single registry of known flags. To add a flag, add one entry here. */
@@ -51,6 +51,12 @@ const FEATURE_FLAGS = {
       'Enable native macOS computer use in Mothership. Global on/off only; each device must also opt in.',
     fallback: 'MSHIP_COMPUTER_USE',
   },
+  'mothership-search-integration-tools': {
+    description:
+      'Give Search Assistant read-only integration discovery, calls, and matching prompt ' +
+      'instructions. Global AppConfig on/off only; disabled by default with no env fallback.',
+    fallback: null,
+  },
   'mothership-model-selector': {
     description:
       'Show the Mothership model selector, model-specific effort levels, and Fast for supported ' +
@@ -143,7 +149,7 @@ const FEATURE_FLAGS = {
 
 /**
  * The closed set of known feature flags. Derived from the registry, so a flag
- * cannot exist — or be checked — without a definition (and its mandatory fallback).
+ * cannot exist — or be checked — without a definition (and its explicit fallback policy).
  */
 export type FeatureFlagName = keyof typeof FEATURE_FLAGS
 
@@ -153,7 +159,7 @@ function fallbackFlags(): FeatureFlagsConfig {
   for (const [name, def] of Object.entries(FEATURE_FLAGS) as Array<
     [string, FeatureFlagDefinition]
   >) {
-    flags[name] = { enabled: isTruthy(env[def.fallback]) }
+    flags[name] = { enabled: def.fallback !== null && isTruthy(env[def.fallback]) }
   }
   return flags
 }

apps/sim/lib/mothership/chat/payload.test.ts

@@ -18,6 +18,7 @@ const {
   mockSearchApprovals,
   mockSecretNames,
   mockComputerUseAvailable,
+  mockSearchIntegrationToolsEnabled,
 } = vi.hoisted(() => ({
   mockComputerUseAvailable: vi.fn(async () => false),
   mockCreateUserToolSchema: vi.fn(() => ({ type: 'object', properties: {} })),
@@ -28,12 +29,19 @@ const {
   mockTrackChatUpload: vi.fn(),
   mockSearchApprovals: vi.fn(async () => new Map<string, boolean>()),
   mockSecretNames: vi.fn(async () => ({ names: [] as string[] })),
+  mockSearchIntegrationToolsEnabled: vi.fn(async () => true),
 }))
 
 vi.mock('@/lib/computer-use/availability.server', () => ({
   isComputerUseAvailable: mockComputerUseAvailable,
 }))
 
+vi.mock('@/lib/mothership/feature-flags', () => ({
+  isSearchIntegrationToolsEnabled: mockSearchIntegrationToolsEnabled,
+}))
+
+beforeEach(() => mockSearchIntegrationToolsEnabled.mockResolvedValue(true))
+
 // The inventory reads nine application worlds; these suites exercise the request shape, not the reads.
 vi.mock('@/lib/mothership/application/execute-organization-secret-use-case', () => ({
   executeOrganizationSecretUseCase: mockSecretNames,
@@ -962,3 +970,29 @@ it('carries only enabled MCP IDs without eager catalog discovery while preservin
   expect(payload).not.toHaveProperty('mothershipTools')
   expect(payload.desktop).toMatchObject({ browser: true, terminal: true })
 })
+
+/** The worker derives both its gateway tools and prompt instructions from this capability. */
+it.each([{ organizationId: 'org-1' }, { workspaceId: 'ws-1' }])(
+  'switches Search integration capability per turn while preserving Build for %j',
+  async (scope) => {
+    for (const enabled of [true, false, true]) {
+      mockSearchIntegrationToolsEnabled.mockResolvedValue(enabled)
+      for (const mode of ['assistant', 'agent', 'plan']) {
+        const payload = await buildCopilotRequestPayload(
+          {
+            message: 'Find a person',
+            userId: 'person',
+            userMessageId: 'message',
+            mode,
+            model: '',
+            ...scope,
+          },
+          { selectedModel: '' }
+        )
+        expect(payload.integrationCatalog).toEqual(
+          mode === 'assistant' && !enabled ? undefined : { mcpServerIds: [] }
+        )
+      }
+    }
+  }
+)

apps/sim/lib/mothership/chat/payload.ts

@@ -30,6 +30,7 @@ import {
 import type { AssistantImageContent } from '@/lib/mothership/chat/assistant-images'
 import { buildUploadedFileContext } from '@/lib/mothership/chat/upload-context'
 import { buildWorkspaceInventory } from '@/lib/mothership/chat/workspace-inventory'
+import { isSearchIntegrationToolsEnabled } from '@/lib/mothership/feature-flags'
 import type { AssistantSearchLevel } from '@/lib/mothership/generated/assistant'
 import type { ChatRequest, ModelSelection } from '@/lib/mothership/generated/protocol'
 import type { VfsSnapshotV1 } from '@/lib/mothership/generated/vfs-snapshot-v1'
@@ -326,6 +327,7 @@ export async function buildCopilotRequestPayload(
   const isAssistant = effectiveMode === 'assistant'
   const computerUse =
     !isAssistant && params.computerUse === true && (await isComputerUseAvailable())
+  const integrationGateway = !isAssistant || (await isSearchIntegrationToolsEnabled())
 
   // Track uploaded files in the DB and build context tags instead of base64 inlining.
   // Tracking writes `workspace_files` rows, so it needs the same write grant the
@@ -468,9 +470,13 @@ export async function buildCopilotRequestPayload(
     messageId: userMessageId,
     ...(chatId ? { chatId } : {}),
     ...(allContexts.length > 0 ? { context: allContexts } : {}),
-    integrationCatalog: {
-      mcpServerIds: isAssistant ? [] : [...new Set(params.mcpServerIds ?? [])],
-    },
+    ...(integrationGateway
+      ? {
+          integrationCatalog: {
+            mcpServerIds: isAssistant ? [] : [...new Set(params.mcpServerIds ?? [])],
+          },
+        }
+      : {}),
     ...(params.userTimezone ? { userTimezone: params.userTimezone } : {}),
     ...(params.effort ? { effort: params.effort } : {}),
     ...(params.modelSelection ? { modelSelection: params.modelSelection } : {}),

apps/sim/lib/mothership/feature-flags.ts

@@ -9,3 +9,8 @@ export function isMothershipModelSelectorEnabled(): Promise<boolean> {
 export function isPlanModeEnabled(): Promise<boolean> {
   return isFeatureEnabled('mothership-plan-mode')
 }
+
+/** One AppConfig gate controls Search integration discovery, execution, and prompt capability. */
+export function isSearchIntegrationToolsEnabled(): Promise<boolean> {
+  return isFeatureEnabled('mothership-search-integration-tools')
+}

apps/sim/lib/mothership/integrations/application/catalog.test.ts

@@ -15,13 +15,15 @@ import {
 
 const mocks = vi.hoisted(() => ({
   build: vi.fn(),
+  flag: vi.fn(async () => true),
   mcp: vi.fn(),
   config: vi.fn(),
   banned: vi.fn(),
   target: vi.fn(),
   workspace: vi.fn(),
   listServers: vi.fn(),
 }))
+vi.mock('@/lib/mothership/feature-flags', () => ({ isSearchIntegrationToolsEnabled: mocks.flag }))
 vi.mock('@/lib/mcp/application/use-cases', () => ({
   listMcpServersUseCase: { execute: mocks.listServers },
 }))
@@ -68,6 +70,7 @@ function queueChat(mode = 'assistant', role = 'member') {
 beforeEach(() => {
   vi.clearAllMocks()
   resetDbChainMock()
+  mocks.flag.mockResolvedValue(true)
   mocks.banned.mockResolvedValue([])
   mocks.config.mockResolvedValue(null)
   mocks.build.mockResolvedValue([...tools])
@@ -372,3 +375,14 @@ it('filters organization enabled servers to the authorized target before broad M
   })
   expect(mocks.mcp).toHaveBeenCalledWith('actor', 'workspace-1', ['mcp-abc'], undefined)
 })
+
+it('removes previously discoverable Search operations when the runtime flag turns off', async () => {
+  for (const enabled of [true, false, true]) {
+    mocks.flag.mockResolvedValue(enabled)
+    queueChat()
+    const result = await readIntegrationCatalog.execute({ principal: principal(), input })
+    expect(result.operations.map((operation) => operation.toolId)).toEqual(
+      enabled ? ['gmail_send', 'slack_send'] : []
+    )
+  }
+})

apps/sim/lib/mothership/integrations/application/catalog.ts

@@ -25,6 +25,7 @@ import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-de
 import { defineAuthorizedChatUseCase } from '@/lib/mothership/chat/application/authorized-chat-use-case'
 import { resolveOwnedChatContext } from '@/lib/mothership/chat/application/context'
 import { buildIntegrationToolSchemas, type ToolSchema } from '@/lib/mothership/chat/payload'
+import { isSearchIntegrationToolsEnabled } from '@/lib/mothership/feature-flags'
 import type {
   IntegrationCatalogRequest,
   IntegrationCatalogResponse,
@@ -166,6 +167,8 @@ const catalogUseCase = defineAuthorizedChatUseCase({
     delegation: { audience: INTEGRATION_CATALOG_AUDIENCE, isWithinScope: () => true },
   },
   async execute({ input, context }) {
+    if (context.mode === 'assistant' && !(await isSearchIntegrationToolsEnabled()))
+      return { total: 0, truncated: false, operations: [] }
     if (input.mcpExecution && context.organizationId)
       throw new OrchestrationError('forbidden', 'Executor catalogs require workspace agent scope')
     let workspaceId = context.workspaceId

apps/sim/lib/mothership/tool-executor/executor.test.ts

@@ -5,6 +5,7 @@
 import { createLogger } from '@sim/logger'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import { slackGetUserTool } from '@/tools/slack/get_user'
 
 const { getToolEntry, isKnownTool, isSimExecuted, isClientExecuted } = vi.hoisted(() => ({
   getToolEntry: vi.fn(),
@@ -13,8 +14,9 @@ const { getToolEntry, isKnownTool, isSimExecuted, isClientExecuted } = vi.hoiste
   isClientExecuted: vi.fn(),
 }))
 
-const { executeAppTool, recordSecretUsage } = vi.hoisted(() => ({
+const { executeAppTool, recordSecretUsage, searchIntegrationToolsEnabled } = vi.hoisted(() => ({
   executeAppTool: vi.fn(),
+  searchIntegrationToolsEnabled: vi.fn(async () => true),
   recordSecretUsage: vi.fn(),
 }))
 
@@ -32,6 +34,15 @@ vi.mock('./router', () => ({
   isClientExecuted,
 }))
 
+vi.mock('@/lib/mothership/feature-flags', () => ({
+  isSearchIntegrationToolsEnabled: searchIntegrationToolsEnabled,
+}))
+beforeEach(() => searchIntegrationToolsEnabled.mockResolvedValue(true))
+
+vi.mock('@/tools/metadata', () => ({
+  getToolMetadata: (id: string) => (id === slackGetUserTool.id ? slackGetUserTool : undefined),
+}))
+
 vi.mock('@/tools', () => ({
   executeTool: executeAppTool,
 }))
@@ -772,3 +783,29 @@ describe('organization direct tool targets', () => {
     expect(targets.environment).not.toHaveBeenCalled()
   })
 })
+
+it.each([{ organizationId: 'org-1' }, { workspaceId: 'ws-1' }])(
+  'stops a previously admitted Search integration call after flag revocation for %j',
+  async (scope) => {
+    isKnownTool.mockReturnValue(false)
+    isClientExecuted.mockReturnValue(false)
+    executeAppTool.mockResolvedValue({ success: true, output: { user: { id: 'U123' } } })
+    for (const enabled of [true, false, true]) {
+      searchIntegrationToolsEnabled.mockResolvedValue(enabled)
+      const result = await executeTool(
+        'slack_get_user',
+        { credentialId: 'own', userId: 'U123' },
+        {
+          userId: 'person',
+          requestMode: 'assistant',
+          ...scope,
+        }
+      )
+      expect(result).toEqual(
+        enabled
+          ? { success: true, output: { user: { id: 'U123' } } }
+          : { success: false, error: 'This operation is not available in Search Assistant.' }
+      )
+    }
+  }
+)

apps/sim/lib/mothership/tool-executor/executor.ts

@@ -6,6 +6,7 @@ import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.ser
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
 import { ASSISTANT_TOOLS, isAssistantIntegrationTool } from '@/lib/mothership/assistant/tool-policy'
 import { prepareCopilotEnvironmentContext } from '@/lib/mothership/environment-context'
+import { isSearchIntegrationToolsEnabled } from '@/lib/mothership/feature-flags'
 import { projectToolErrorMessageForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
 import { recordSecretUsage } from '@/lib/secrets/usage/record'
 import { executeTool as executeAppTool } from '@/tools'
@@ -136,7 +137,8 @@ async function executeBoundTool(
   if (
     context.requestMode === 'assistant' &&
     !ASSISTANT_TOOLS.has(toolId) &&
-    !isAssistantIntegrationTool(getToolMetadata(toolId))
+    (!isAssistantIntegrationTool(getToolMetadata(toolId)) ||
+      !(await isSearchIntegrationToolsEnabled()))
   ) {
     return {
       success: false,