fix(agent): gate variable permission mode workflow writes

Author: j15z

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx

@@ -1582,8 +1582,7 @@ export const ToolInput = memo(function ToolInput({
           const hasOperations =
             !isCustomTool && !isMcpFamily && hasMultipleOperations(toolBlock ?? undefined)
           const showToolControl = supportsToolControl && !(isMcpTool && isMcpToolUnavailable(tool))
-          const showCanonicalToolControl =
-            showToolControl && (permissionModeEnabled || toolUsageControlMode === 'advanced')
+          const showCanonicalToolControl = showToolControl && permissionModeEnabled
           const hasToolBody =
             showCanonicalToolControl || hasOperations || displaySubBlocks.length > 0
 

apps/sim/lib/core/config/feature-flags.ts

@@ -48,8 +48,8 @@ interface FeatureFlagDefinition {
 const FEATURE_FLAGS = {
   'agent-tool-permission-mode': {
     description:
-      'Enable the selector/variable Permission Mode editor for new agent tool configurations. ' +
-      'Global on/off only; existing variable configurations remain editable and executable.',
+      'Enable variable agent tool Permission Mode inputs in the editor and workflow writes. ' +
+      'Global on/off only.',
     fallback: 'AGENT_TOOL_PERMISSION_MODE',
   },
   'trigger-eu-region': {

apps/sim/lib/workflows/application/apply-workflow-operations.test.ts

@@ -2,10 +2,11 @@
  * @vitest-environment node
  */
 import { WorkflowLockedError } from '@sim/platform-authz/workflow'
-import { workflowAuthzMockFns } from '@sim/testing'
+import { createAgentBlock, workflowAuthzMockFns } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
+  isFeatureEnabled: vi.fn(),
   recordAudit: vi.fn(),
   resolveContext: vi.fn(),
   resolvePermission: vi.fn(),
@@ -26,6 +27,10 @@ const mocks = vi.hoisted(() => ({
   collectGraphIds: vi.fn(),
 }))
 
+vi.mock('@/lib/core/config/feature-flags', () => ({
+  isFeatureEnabled: mocks.isFeatureEnabled,
+}))
+
 vi.mock('@sim/audit', () => ({
   AuditAction: { WORKFLOW_UPDATED: 'workflow.updated' },
   AuditResourceType: { WORKFLOW: 'workflow' },
@@ -171,6 +176,7 @@ const GRAPH_IDS = { blockIds: ['block-1'], edgeIds: [], subflowIds: [] }
 describe('applyWorkflowOperations', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mocks.isFeatureEnabled.mockResolvedValue(false)
     mocks.resolveContext.mockResolvedValue(context)
     mocks.resolvePermission.mockResolvedValue('write')
     workflowAuthzMockFns.mockAssertWorkflowMutable.mockResolvedValue(undefined)
@@ -194,6 +200,52 @@ describe('applyWorkflowOperations', () => {
     mocks.assertIdsUnclaimed.mockResolvedValue(undefined)
   })
 
+  it.each([
+    {
+      principal: { kind: 'personal_api_key' as const, userId: 'user-1', keyId: 'key-1' },
+      dryRun: false,
+    },
+    {
+      principal: { kind: 'personal_api_key' as const, userId: 'user-1', keyId: 'key-1' },
+      dryRun: true,
+    },
+    { principal: copilotPrincipal, dryRun: false },
+    { principal: copilotPrincipal, dryRun: true },
+  ])(
+    'gates variable mode edits for $principal.kind (dryRun=$dryRun)',
+    async ({ principal, dryRun }) => {
+      const agent = createAgentBlock({
+        id: 'agent',
+        subBlocks: {
+          tools: {
+            id: 'tools',
+            type: 'tool-input',
+            value: [{ type: 'function', usageControlExpression: '<start.toolMode>' }],
+          },
+        },
+        data: { canonicalModes: { '0:agentToolUsageControl': 'advanced' } },
+      })
+      mocks.applyOperations.mockReturnValue({
+        state: graph({ agent }),
+        validationErrors: [],
+        skippedItems: [],
+      })
+      const input = { workflowId: 'workflow-1', operations, layout: 'none' as const, dryRun }
+      await expect(applyWorkflowOperations.execute({ principal, input })).rejects.toMatchObject({
+        code: 'validation',
+        message: 'Variable agent tool permission modes are disabled',
+      })
+      expect(mocks.replace).not.toHaveBeenCalled()
+      expect(mocks.recordAudit).not.toHaveBeenCalled()
+      expect(mocks.notify).not.toHaveBeenCalled()
+
+      mocks.isFeatureEnabled.mockResolvedValue(true)
+      await expect(applyWorkflowOperations.execute({ principal, input })).resolves.toMatchObject({
+        dryRun,
+      })
+    }
+  )
+
   it('writes once, through the shared persistence primitive', async () => {
     const result = await applyWorkflowOperations.execute({
       principal: sessionPrincipal,

apps/sim/lib/workflows/application/apply-workflow-operations.ts

@@ -54,6 +54,7 @@ import {
 } from '@/lib/workflows/persistence/replace-normalized-state'
 import { loadWorkflowFromNormalizedTables } from '@/lib/workflows/persistence/utils'
 import { validateWorkflowState } from '@/lib/workflows/sanitization/validation'
+import { assertAgentToolPermissionModeEnabled } from '@/lib/workflows/tool-input/usage-control.server'
 import { withBlockVisibility } from '@/blocks/visibility/server-context'
 import { generateLoopBlocks, generateParallelBlocks } from '@/stores/workflows/workflow/utils'
 import { normalizeWorkflowState } from '@/stores/workflows/workflow/validation'
@@ -347,6 +348,7 @@ export const applyWorkflowOperations = defineAuthorizedWorkflowUseCase({
       loops: generateLoopBlocks(blocks),
       parallels: generateParallelBlocks(blocks),
     }
+    await assertAgentToolPermissionModeEnabled(Object.values(graph.blocks))
 
     /**
      * Linted on the graph that is about to be persisted, so every finding

apps/sim/lib/workflows/application/replace-workflow-state.test.ts

@@ -2,10 +2,11 @@
  * @vitest-environment node
  */
 import { WorkflowLockedError } from '@sim/platform-authz/workflow'
-import { workflowAuthzMockFns } from '@sim/testing'
+import { createAgentBlock, workflowAuthzMockFns } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
+  isFeatureEnabled: vi.fn(),
   recordAudit: vi.fn(),
   resolveContext: vi.fn(),
   resolvePermission: vi.fn(),
@@ -18,6 +19,10 @@ const mocks = vi.hoisted(() => ({
   needsRedeployment: vi.fn(),
 }))
 
+vi.mock('@/lib/core/config/feature-flags', () => ({
+  isFeatureEnabled: mocks.isFeatureEnabled,
+}))
+
 vi.mock('@sim/audit', () => ({
   AuditAction: { WORKFLOW_UPDATED: 'workflow.updated' },
   AuditResourceType: { WORKFLOW: 'workflow' },
@@ -87,6 +92,7 @@ const input = { workflowId: 'workflow-1', blocks: { 'block-1': BLOCK }, edges: [
 describe('replaceWorkflowState', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mocks.isFeatureEnabled.mockResolvedValue(false)
     mocks.resolveContext.mockResolvedValue(context)
     mocks.resolvePermission.mockResolvedValue('write')
     workflowAuthzMockFns.mockAssertWorkflowMutable.mockResolvedValue(undefined)
@@ -104,6 +110,42 @@ describe('replaceWorkflowState', () => {
     mocks.assertIdsUnclaimed.mockResolvedValue(undefined)
   })
 
+  it.each([false, true])(
+    'gates variable tool modes before a replacement (dryRun=%s)',
+    async (dryRun) => {
+      const agent = createAgentBlock({
+        id: 'agent',
+        subBlocks: {
+          tools: {
+            id: 'tools',
+            type: 'tool-input',
+            value: [{ type: 'function', usageControlExpression: '<start.toolMode>' }],
+          },
+        },
+      })
+      await expect(
+        replaceWorkflowState.execute({
+          principal: sessionPrincipal,
+          input: { ...input, blocks: { agent }, dryRun },
+        })
+      ).rejects.toMatchObject({
+        code: 'validation',
+        message: 'Variable agent tool permission modes are disabled',
+      })
+      expect(mocks.replace).not.toHaveBeenCalled()
+      expect(mocks.recordAudit).not.toHaveBeenCalled()
+      expect(mocks.notify).not.toHaveBeenCalled()
+
+      mocks.isFeatureEnabled.mockResolvedValue(true)
+      await expect(
+        replaceWorkflowState.execute({
+          principal: sessionPrincipal,
+          input: { ...input, blocks: { agent }, dryRun },
+        })
+      ).resolves.toMatchObject({ dryRun })
+    }
+  )
+
   /**
    * Two things this pins that a same-shape input and output cannot: the write
    * carries the **sanitized** graph, not the caller's body, and the reported

apps/sim/lib/workflows/application/replace-workflow-state.ts

@@ -27,6 +27,7 @@ import {
   replaceWorkflowNormalizedState,
 } from '@/lib/workflows/persistence/replace-normalized-state'
 import { validateWorkflowState } from '@/lib/workflows/sanitization/validation'
+import { assertAgentToolPermissionModeEnabled } from '@/lib/workflows/tool-input/usage-control.server'
 
 const logger = createLogger('ReplaceWorkflowState')
 
@@ -127,6 +128,7 @@ export const replaceWorkflowState = defineAuthorizedWorkflowUseCase({
       blocks: sanitized.blocks as Record<string, BlockState>,
       edges: sanitized.edges as WorkflowState['edges'],
     }
+    await assertAgentToolPermissionModeEnabled(Object.values(graph.blocks))
 
     /**
      * Linted before the write so a dry run and a committed write report the

apps/sim/lib/workflows/operations/import-workflow.test.ts

@@ -1,17 +1,22 @@
 /**
  * @vitest-environment node
  */
-import { queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
+import { createAgentBlock, queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
+  isFeatureEnabled: vi.fn(),
   getUserPermissionConfig: vi.fn(),
   performCreateWorkflow: vi.fn(),
   performCreateWorkflowTransition: vi.fn(),
   saveWorkflowToNormalizedTables: vi.fn(),
   extractAndPersistCustomTools: vi.fn(),
 }))
 
+vi.mock('@/lib/core/config/feature-flags', () => ({
+  isFeatureEnabled: mocks.isFeatureEnabled,
+}))
+
 vi.mock('@/lib/permission-groups/resolve.server', () => ({
   getUserPermissionConfig: mocks.getUserPermissionConfig,
 }))
@@ -62,6 +67,7 @@ function params(workflowPayload: Record<string, unknown>) {
 describe('importWorkflowIntoWorkspace block access', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mocks.isFeatureEnabled.mockResolvedValue(false)
     resetDbChainMock()
     queueTableRows(schemaMock.workspace, [{ id: 'workspace-1' }])
     mocks.getUserPermissionConfig.mockResolvedValue(null)
@@ -81,6 +87,35 @@ describe('importWorkflowIntoWorkspace block access', () => {
     mocks.extractAndPersistCustomTools.mockResolvedValue({ saved: 0, errors: [] })
   })
 
+  it.each([false, true])(
+    'gates variable modes before creating an import (enabled=%s)',
+    async (enabled) => {
+      mocks.isFeatureEnabled.mockResolvedValue(enabled)
+      const agent = createAgentBlock({
+        id: 'agent',
+        subBlocks: {
+          tools: {
+            id: 'tools',
+            type: 'tool-input',
+            value: [{ type: 'function', usageControlExpression: '<start.toolMode>' }],
+          },
+        },
+      })
+      const result = importWorkflowIntoWorkspace(params(payload(agent)))
+      if (enabled) {
+        await expect(result).resolves.toMatchObject({ success: true })
+        expect(mocks.performCreateWorkflow).toHaveBeenCalledOnce()
+      } else {
+        await expect(result).rejects.toMatchObject({
+          code: 'validation',
+          message: 'Variable agent tool permission modes are disabled',
+        })
+        expect(mocks.performCreateWorkflow).not.toHaveBeenCalled()
+        expect(mocks.saveWorkflowToNormalizedTables).not.toHaveBeenCalled()
+      }
+    }
+  )
+
   /**
    * The bypass this closes: import never went through the editing operations,
    * so a denied integration reached the normalized tables and was refused only

apps/sim/lib/workflows/operations/import-workflow.ts

@@ -30,6 +30,7 @@ import {
 import { extractAndPersistCustomTools } from '@/lib/workflows/persistence/custom-tools-persistence'
 import { prepareWorkflowStateForPersistence } from '@/lib/workflows/persistence/prepare-state'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
+import { assertAgentToolPermissionModeEnabled } from '@/lib/workflows/tool-input/usage-control.server'
 import { normalizeImportedVariables } from '@/lib/workflows/variables/parse'
 import type { WorkflowState } from '@/stores/workflows/workflow/types'
 
@@ -273,6 +274,7 @@ async function executeImportWorkflowIntoWorkspace(
   }
 
   const workflowState: WorkflowState = { ...parsedState, ...preparedState }
+  await assertAgentToolPermissionModeEnabled(Object.values(workflowState.blocks))
 
   /**
    * Nothing has been written yet, which is why the check sits here: an import