fix(search): gate every Sim Search surface on the flag that already refuses it (#7523)

* fix(search): gate every Sim Search surface on the flag that already refuses it

Sim Search shipped behind `knowledge-member-access`, and in production that
flag is off: the AppConfig feature-flags document has no entry for it, so the
server refuses every per-member connect and hides every member-scoped
document. The UI never asked. The Search tab, the Search page and its whole
connector catalog, the composer's Search and Assistant modes, and the source
chips all rendered unconditionally, so an unreleased feature was visible to
everyone — and the connect it offered failed with a message that reads like a
plan limit rather than a feature that has not shipped.

The flag was only ever wired to the actions and the data, never to the
surfaces. Wire the surfaces to the same judgement:

- one reader, `useMemberAccessAvailable`, replacing five copies of
  `features?.knowledgeMemberAccess === true`, so no surface can drift
- the Search tab appears only where the page it links to is served
- the Search page authenticates and 404s where the feature is off, so the
  route cannot be typed, linked, or bookmarked into
- `useMothershipMode` is the single choke point for the composer: Search and
  Assistant read as Build and refuse to be written where the feature is off,
  so a stale `?mode=search` link cannot strand a composer whose switcher is
  not rendered to leave it; the switcher itself is hidden through the
  `canSearch` prop the composer already had

The search page's module-graph baseline is re-recorded for the session read
its gate now performs, matching `settings/[section]/page.tsx`. The modules are
already in the route's server bundle through the workspace layout, which reads
the same session.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014JmUGTitFeoQXVf9T3skEa

* fix(search): stop asking the model to cite where the chat cannot render one

The `<source>` citation contract shipped with Sim Search in #7385: the tag, the
inline chip, and the sources strip under a reply all arrived together. The tool
that asks for it did not arrive gated. `manage_knowledge_base`'s query result
appends the citation instruction unconditionally, and that tool runs in ordinary
Build turns — so in a workspace without per-member access the model is still told
to emit `<source>` tags and the chat still renders the chips and the sources
popover. An unreleased surface, reachable today without touching Search at all.

Ask for the citation only where per-member access is on. The gate belongs at the
emission rather than at the renderer: a client that merely declined to render the
tag would leave the raw `<source>{...}</source>` JSON sitting in the visible
reply. Resolved alongside the search it accompanies, so the gate costs no round
trip.

Also from the review round:

- `handleSubmit` re-applies the gate where the mode is consumed. `modeOverride`
  is passed straight in and never passes through `useMothershipMode`, so the
  hook alone was not the choke point the last commit claimed.
- the `?q=` effect returns early instead of calling a setter the hook would
  drop, so the gate reads at the call site rather than at a distance.
- `setMode` keeps returning its promise, so the `void` at its three call sites
  still means what it says.
- comments: restore the subject the shortened one-liners had lost, drop a
  duplicated why, and stop the client hook from re-listing the server
  predicate's ingredients.
- drop three hook tests the switcher's own tests already cover through the same
  adapter, and the container one of them leaked.

Kept deliberately, against a reviewer's suggestion to delete them as now
unreachable: the `memberAccessAvailable` guards on the member-connector queries.
`useWorkspaceMemberConnectors` sets `placeholderData: keepPreviousData`, so a
disabled observer can still surface previously cached rows — the render-time
coercion to `EMPTY_MEMBER_CONNECTORS` is what stops rows from a flag-on render
leaking into a flag-off one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014JmUGTitFeoQXVf9T3skEa

* fix(search): never fail a knowledge query over a citation decision

Whether to ask for a citation is answered by a billing-backed availability
lookup, and it sat in the same `Promise.all` as the search itself — so a
rejection there discarded a search that had already succeeded and returned
"Failed to query knowledge base". A presentation choice could take out the
query it decorates.

Settle it to "do not cite" instead — the same answer the feature being off
gives — and log why, so the lookup failing is visible without being fatal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014JmUGTitFeoQXVf9T3skEa

---------

Co-authored-by: Waleed Latif <waleed@simstudio.ai>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 3 people

apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.test.tsx

@@ -0,0 +1,64 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockMemberAccessAvailable } = vi.hoisted(() => ({
+  mockMemberAccessAvailable: vi.fn(() => true),
+}))
+
+vi.mock('@/hooks/use-member-access', () => ({
+  useMemberAccessAvailable: () => mockMemberAccessAvailable(),
+}))
+
+import { IntegrationTabsHeader } from '@/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header'
+
+let root: Root | null = null
+let container: HTMLDivElement | null = null
+
+function mount(active: 'integrations' | 'skills' | 'search' = 'integrations') {
+  ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+  act(() => root?.render(<IntegrationTabsHeader active={active} workspaceId='workspace-1' />))
+}
+
+function tabs(): string[] {
+  return Array.from(container?.querySelectorAll('a') ?? []).map((node) => node.textContent ?? '')
+}
+
+beforeEach(() => {
+  mockMemberAccessAvailable.mockReturnValue(true)
+})
+
+afterEach(() => {
+  if (root) act(() => root?.unmount())
+  container?.remove()
+  root = null
+  container = null
+})
+
+describe('IntegrationTabsHeader', () => {
+  it('links every tab to its page in the routed workspace', () => {
+    mount()
+
+    expect(tabs()).toEqual(['Integrations', 'Skills', 'Search'])
+    expect(
+      Array.from(container?.querySelectorAll('a') ?? []).map((node) => node.getAttribute('href'))
+    ).toEqual([
+      '/workspace/workspace-1/integrations',
+      '/workspace/workspace-1/skills',
+      '/workspace/workspace-1/search',
+    ])
+  })
+
+  it('omits Search where per-member access is off, matching the page that 404s', () => {
+    mockMemberAccessAvailable.mockReturnValue(false)
+    mount()
+
+    expect(tabs()).toEqual(['Integrations', 'Skills'])
+  })
+})

apps/sim/app/workspace/[workspaceId]/components/integration-tabs-header/integration-tabs-header.tsx

@@ -1,6 +1,9 @@
+'use client'
+
 import type { ReactNode } from 'react'
 import { ChipLink, cn } from '@sim/emcn'
 import { HEADER_ACTION_CLUSTER, PAGE_HEADER_BAR } from '@/components/page-header-bar'
+import { useMemberAccessAvailable } from '@/hooks/use-member-access'
 
 interface IntegrationTabsHeaderProps {
   active: 'integrations' | 'skills' | 'search'
@@ -17,6 +20,11 @@ interface IntegrationTabsHeaderProps {
  * because every page owns it equally; its former home made Skills reach across
  * into a sibling feature for its own chrome.
  *
+ * Search appears only where per-member access is on, matching the page it links
+ * to, which 404s otherwise. A client component so the three pages and their
+ * Suspense fallbacks all read that one judgement from the workspace host
+ * context rather than each resolving it again on the server.
+ *
  * The `gap-1` is explicit because chips carry no outer margin — the parent owns the
  * space between them.
  */
@@ -25,6 +33,8 @@ export function IntegrationTabsHeader({
   workspaceId,
   rightSlot,
 }: IntegrationTabsHeaderProps) {
+  const memberAccessAvailable = useMemberAccessAvailable()
+
   return (
     <div className={cn(PAGE_HEADER_BAR, 'gap-1')}>
       <ChipLink href={`/workspace/${workspaceId}/integrations`} active={active === 'integrations'}>
@@ -33,9 +43,11 @@ export function IntegrationTabsHeader({
       <ChipLink href={`/workspace/${workspaceId}/skills`} active={active === 'skills'}>
         Skills
       </ChipLink>
-      <ChipLink href={`/workspace/${workspaceId}/search`} active={active === 'search'}>
-        Search
-      </ChipLink>
+      {memberAccessAvailable && (
+        <ChipLink href={`/workspace/${workspaceId}/search`} active={active === 'search'}>
+          Search
+        </ChipLink>
+      )}
       {rightSlot && <div className={cn('ml-auto', HEADER_ACTION_CLUSTER)}>{rightSlot}</div>}
     </div>
   )

apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx

@@ -25,12 +25,12 @@ import {
   searchFilterParsers,
   UPDATED_WINDOWS,
 } from '@/app/workspace/[workspaceId]/home/search-params'
-import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
 import {
   useWorkspaceMemberConnectors,
   type WorkspaceMemberConnector,
 } from '@/hooks/queries/kb/connectors'
 import { useKnowledgeBasesQuery, useWorkspaceKnowledgeSearch } from '@/hooks/queries/kb/knowledge'
+import { useMemberAccessAvailable } from '@/hooks/use-member-access'
 
 const EMPTY_MEMBER_CONNECTORS: WorkspaceMemberConnector[] = []
 
@@ -185,13 +185,11 @@ export function KnowledgeSearchResults({
     isPlaceholderData,
     error,
   } = useWorkspaceKnowledgeSearch(workspaceId, knowledgeBaseIds, query)
-  const { features } = useWorkspaceHostContext()
   /**
-   * Judged by the workspace, as the server judges it: with per-member access
-   * off, member-scoped documents are hidden, so no source is indexing anything
-   * the viewer will see, and the list is not worth asking for.
+   * With per-member access off, member-scoped documents are hidden, so the
+   * indexing list is not worth asking for.
    */
-  const memberAccessAvailable = features?.knowledgeMemberAccess === true
+  const memberAccessAvailable = useMemberAccessAvailable()
   const { data: memberConnectorRows } = useWorkspaceMemberConnectors(workspaceId, {
     enabled: memberAccessAvailable,
   })

apps/sim/app/workspace/[workspaceId]/home/components/search-sources/search-sources.tsx

@@ -11,14 +11,14 @@ import {
   searchConnectorUnavailableReason,
 } from '@/lib/sim-search/connectors'
 import { SourceSetupModal } from '@/app/workspace/[workspaceId]/home/components/search-sources/source-setup-modal'
-import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
 import { BrandIcon } from '@/blocks/brand-icon'
 import {
   memberConnectorKeys,
   useWorkspaceMemberConnectors,
   type WorkspaceMemberConnector,
 } from '@/hooks/queries/kb/connectors'
 import { useWorkspacePermissionsQuery } from '@/hooks/queries/workspace'
+import { useMemberAccessAvailable } from '@/hooks/use-member-access'
 import { CONNECTABLE_MEMBERSHIPS, useMemberEnrollment } from '@/hooks/use-member-enrollment'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
 
@@ -140,12 +140,8 @@ interface SearchSourcesProps {
  */
 export function SearchSources({ workspaceId }: SearchSourcesProps) {
   const { integrationAvailability } = usePermissionConfig()
-  const { features } = useWorkspaceHostContext()
-  /**
-   * Judged by the workspace, as the server judges it: with per-member access
-   * off, a connect is refused, so the chips say so instead of offering one.
-   */
-  const memberAccessAvailable = features?.knowledgeMemberAccess === true
+  /** With per-member access off, a connect is refused, so the chips say so instead. */
+  const memberAccessAvailable = useMemberAccessAvailable()
   const { data: workspacePermissions } = useWorkspacePermissionsQuery(workspaceId)
   /** The first connect of a source turns it on for the workspace, which takes an admin. */
   const canCreate = workspacePermissions?.viewer?.isAdmin ?? false

apps/sim/app/workspace/[workspaceId]/home/components/user-input/components/mode-switcher/mode-switcher.test.tsx

@@ -15,6 +15,8 @@ const mockUrlUpdate = vi.fn<(event: UrlUpdateEvent) => void>()
 vi.mock('next/navigation', () => ({
   useParams: () => ({ workspaceId: 'workspace-1' }),
 }))
+/** The switcher renders only where Search mode exists, so these tests are that workspace. */
+vi.mock('@/hooks/use-member-access', () => ({ useMemberAccessAvailable: () => true }))
 vi.mock('posthog-js/react', () => ({ usePostHog: () => null }))
 vi.mock('@/lib/posthog/client', () => ({ captureEvent: mockCaptureEvent }))
 

apps/sim/app/workspace/[workspaceId]/home/components/user-input/user-input.test.tsx

@@ -9,14 +9,19 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { PromptEditorInstance } from '@/app/workspace/[workspaceId]/home/components/user-input/components/prompt-editor'
 import type { QueuedMessage } from '@/app/workspace/[workspaceId]/home/types'
 
-const { mockSubmit, mockResetTranscript } = vi.hoisted(() => ({
+const { mockSubmit, mockResetTranscript, mockMemberAccessAvailable } = vi.hoisted(() => ({
   mockSubmit: vi.fn(),
   mockResetTranscript: vi.fn(),
+  /** Search mode exists only where per-member access is on; these tests are that workspace. */
+  mockMemberAccessAvailable: vi.fn(() => true),
 }))
 
 vi.mock('next/navigation', () => ({ useParams: () => ({ workspaceId: 'workspace-1' }) }))
 vi.mock('posthog-js/react', () => ({ usePostHog: () => null }))
 vi.mock('@/lib/posthog/client', () => ({ captureEvent: vi.fn() }))
+vi.mock('@/hooks/use-member-access', () => ({
+  useMemberAccessAvailable: () => mockMemberAccessAvailable(),
+}))
 vi.mock('@/hooks/use-settings-navigation', () => ({
   useSettingsNavigation: () => ({ navigateToSettings: vi.fn() }),
 }))

apps/sim/app/workspace/[workspaceId]/home/home.tsx

@@ -68,6 +68,7 @@ import { useMarkMothershipChatRead } from '@/hooks/queries/mothership-chats'
 import { KNOWLEDGE_BASE_LIST_STALE_TIME, knowledgeKeys } from '@/hooks/queries/utils/knowledge-keys'
 import { useWorkflows } from '@/hooks/queries/workflows'
 import { getWorkspaceFilesQueryOptions, useWorkspaceFiles } from '@/hooks/queries/workspace-files'
+import { useMemberAccessAvailable } from '@/hooks/use-member-access'
 import { useOAuthReturnRouter } from '@/hooks/use-oauth-return'
 import type { ChatContext } from '@/stores/panel'
 import {
@@ -184,15 +185,19 @@ export function Home({ chatId, userName, userId }: HomeProps) {
     },
     [setSearchQueryParam, setSearchFilters]
   )
+  const memberAccessAvailable = useMemberAccessAvailable()
   const [composerMode, setComposerMode] = useMothershipMode()
   /**
    * A link that carries a query but no mode opens in Search with the query in
    * the box; the composer follows the live query the same way (below), so the
-   * box and the results never show two different queries.
+   * box and the results never show two different queries. Where per-member
+   * access is off there is no Search to open into, so the query stays a plain
+   * Build draft rather than a mode write `useMothershipMode` would drop.
    */
   useEffect(() => {
+    if (!memberAccessAvailable) return
     if (searchQuery.trim() && composerMode === 'build') void setComposerMode('search')
-  }, [searchQuery, composerMode, setComposerMode])
+  }, [memberAccessAvailable, searchQuery, composerMode, setComposerMode])
   const hasCheckedLandingStorageRef = useRef(false)
   const initialViewInputRef = useRef<HTMLDivElement>(null)
   const initialViewUserInputRef = useRef<UserInputHandle>(null)
@@ -490,8 +495,13 @@ export function Home({ chatId, userName, userId }: HomeProps) {
        * Search lists documents, not a turn of the agent, and only a query can
        * be searched: attachments alone have nothing to search for. Assistant
        * makes the query a turn of the agent grounded in the sources.
+       *
+       * The override skips `useMothershipMode`, so the gate is applied again
+       * where the mode is consumed: both modes answer from the workspace's
+       * indexed sources, and neither is offered where those do not exist.
        */
-      const mode = modeOverride ?? composerMode
+      const requestedMode = modeOverride ?? composerMode
+      const mode = requestedMode !== 'build' && !memberAccessAvailable ? 'build' : requestedMode
       const answering = mode === 'assistant'
       if (mode === 'search') {
         /** A search sends nothing, so an edit in progress is released rather than left waiting. */
@@ -534,6 +544,7 @@ export function Home({ chatId, userName, userId }: HomeProps) {
       workspaceId,
       chatId,
       composerMode,
+      memberAccessAvailable,
       editingQueuedId,
       cancelQueueEdit,
       prepareResourceViewForAgentTurn,
@@ -803,7 +814,7 @@ export function Home({ chatId, userName, userId }: HomeProps) {
                     defaultValue={initialPrompt || searchQuery}
                     draftScopeKey={draftScopeKey}
                     onSubmit={handleSubmit}
-                    canSearch
+                    canSearch={memberAccessAvailable}
                     clearOnSubmit={composerMode !== 'search'}
                     onCleared={clearSearch}
                     isSending={isSending}
@@ -835,7 +846,7 @@ export function Home({ chatId, userName, userId }: HomeProps) {
             isReconnecting={isReconnecting}
             isLoading={showChatSkeleton}
             onSubmit={handleSubmit}
-            canSearch
+            canSearch={memberAccessAvailable}
             clearOnSubmit={composerMode !== 'search'}
             onCleared={clearSearch}
             onStopGeneration={handleStopGeneration}

apps/sim/app/workspace/[workspaceId]/home/hooks/use-mothership-mode.test.tsx

@@ -0,0 +1,113 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { act } from 'react'
+import { NuqsTestingAdapter, type UrlUpdateEvent } from 'nuqs/adapters/testing'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { MothershipMode } from '@/app/workspace/[workspaceId]/home/search-params'
+
+const { mockMemberAccessAvailable } = vi.hoisted(() => ({
+  mockMemberAccessAvailable: vi.fn(() => true),
+}))
+const mockUrlUpdate = vi.fn<(event: UrlUpdateEvent) => void>()
+
+vi.mock('@/hooks/use-member-access', () => ({
+  useMemberAccessAvailable: () => mockMemberAccessAvailable(),
+}))
+
+import { useMothershipMode } from '@/app/workspace/[workspaceId]/home/hooks/use-mothership-mode'
+
+let root: Root | null = null
+let container: HTMLDivElement | null = null
+let current: ReturnType<typeof useMothershipMode> | null = null
+
+function Probe() {
+  current = useMothershipMode()
+  return null
+}
+
+function mount(searchParams = '') {
+  ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+  act(() =>
+    root?.render(
+      <NuqsTestingAdapter hasMemory searchParams={searchParams} onUrlUpdate={mockUrlUpdate}>
+        <Probe />
+      </NuqsTestingAdapter>
+    )
+  )
+}
+
+function mode(): MothershipMode {
+  if (!current) throw new Error('Probe did not render')
+  return current[0]
+}
+
+/** nuqs batches its URL write onto a timeout, so a write is read back after the tick. */
+async function setMode(next: MothershipMode) {
+  await act(async () => {
+    current?.[1](next)
+    await vi.advanceTimersByTimeAsync(1)
+  })
+}
+
+beforeEach(() => {
+  vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] })
+  mockMemberAccessAvailable.mockReturnValue(true)
+  mockUrlUpdate.mockClear()
+})
+
+afterEach(() => {
+  if (root) act(() => root?.unmount())
+  container?.remove()
+  root = null
+  container = null
+  current = null
+  vi.useRealTimers()
+})
+
+/**
+ * The mode's ordinary read/write behavior is covered through the UI in
+ * `mode-switcher.test.tsx`; one write stands here as the control the
+ * per-member-access cases are read against.
+ */
+describe('useMothershipMode', () => {
+  it('writes the chosen mode to the URL', async () => {
+    mount()
+    await setMode('search')
+
+    expect(mode()).toBe('search')
+    expect(mockUrlUpdate.mock.lastCall?.[0].searchParams.get('mode')).toBe('search')
+  })
+
+  describe('without per-member access', () => {
+    beforeEach(() => {
+      mockMemberAccessAvailable.mockReturnValue(false)
+    })
+
+    it('reads Build from a link naming a mode the workspace does not have', () => {
+      mount('?mode=search')
+
+      expect(mode()).toBe('build')
+    })
+
+    it('writes no mode the workspace does not have', async () => {
+      mount()
+      await setMode('search')
+
+      expect(mode()).toBe('build')
+      expect(mockUrlUpdate).not.toHaveBeenCalled()
+    })
+
+    it('still returns to Build, so a stale link can be left', async () => {
+      mount('?mode=search&q=budget')
+      await setMode('build')
+
+      expect(mode()).toBe('build')
+      expect(mockUrlUpdate.mock.lastCall?.[0].searchParams.toString()).toBe('')
+    })
+  })
+})