fix(search): stop asking the model to cite where the chat cannot render one

The `<source>` citation contract shipped with Sim Search in #7385: the tag, the
inline chip, and the sources strip under a reply all arrived together. The tool
that asks for it did not arrive gated. `manage_knowledge_base`'s query result
appends the citation instruction unconditionally, and that tool runs in ordinary
Build turns — so in a workspace without per-member access the model is still told
to emit `<source>` tags and the chat still renders the chips and the sources
popover. An unreleased surface, reachable today without touching Search at all.

Ask for the citation only where per-member access is on. The gate belongs at the
emission rather than at the renderer: a client that merely declined to render the
tag would leave the raw `<source>{...}</source>` JSON sitting in the visible
reply. Resolved alongside the search it accompanies, so the gate costs no round
trip.

Also from the review round:

- `handleSubmit` re-applies the gate where the mode is consumed. `modeOverride`
  is passed straight in and never passes through `useMothershipMode`, so the
  hook alone was not the choke point the last commit claimed.
- the `?q=` effect returns early instead of calling a setter the hook would
  drop, so the gate reads at the call site rather than at a distance.
- `setMode` keeps returning its promise, so the `void` at its three call sites
  still means what it says.
- comments: restore the subject the shortened one-liners had lost, drop a
  duplicated why, and stop the client hook from re-listing the server
  predicate's ingredients.
- drop three hook tests the switcher's own tests already cover through the same
  adapter, and the container one of them leaked.

Kept deliberately, against a reviewer's suggestion to delete them as now
unreachable: the `memberAccessAvailable` guards on the member-connector queries.
`useWorkspaceMemberConnectors` sets `placeholderData: keepPreviousData`, so a
disabled observer can still surface previously cached rows — the render-time
coercion to `EMPTY_MEMBER_CONNECTORS` is what stops rows from a flag-on render
leaking into a flag-off one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014JmUGTitFeoQXVf9T3skEa

Author: Waleed Latif

apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx

@@ -186,9 +186,8 @@ export function KnowledgeSearchResults({
     error,
   } = useWorkspaceKnowledgeSearch(workspaceId, knowledgeBaseIds, query)
   /**
-   * Judged by the workspace, as the server judges it: with per-member access
-   * off, member-scoped documents are hidden, so no source is indexing anything
-   * the viewer will see, and the list is not worth asking for.
+   * With per-member access off, member-scoped documents are hidden, so the
+   * indexing list is not worth asking for.
    */
   const memberAccessAvailable = useMemberAccessAvailable()
   const { data: memberConnectorRows } = useWorkspaceMemberConnectors(workspaceId, {

apps/sim/app/workspace/[workspaceId]/home/components/search-sources/search-sources.tsx

@@ -140,10 +140,7 @@ interface SearchSourcesProps {
  */
 export function SearchSources({ workspaceId }: SearchSourcesProps) {
   const { integrationAvailability } = usePermissionConfig()
-  /**
-   * Judged by the workspace, as the server judges it: with per-member access
-   * off, a connect is refused, so the chips say so instead of offering one.
-   */
+  /** With per-member access off, a connect is refused, so the chips say so instead. */
   const memberAccessAvailable = useMemberAccessAvailable()
   const { data: workspacePermissions } = useWorkspacePermissionsQuery(workspaceId)
   /** The first connect of a source turns it on for the workspace, which takes an admin. */

apps/sim/app/workspace/[workspaceId]/home/home.tsx

@@ -190,11 +190,14 @@ export function Home({ chatId, userName, userId }: HomeProps) {
   /**
    * A link that carries a query but no mode opens in Search with the query in
    * the box; the composer follows the live query the same way (below), so the
-   * box and the results never show two different queries.
+   * box and the results never show two different queries. Where per-member
+   * access is off there is no Search to open into, so the query stays a plain
+   * Build draft rather than a mode write `useMothershipMode` would drop.
    */
   useEffect(() => {
+    if (!memberAccessAvailable) return
     if (searchQuery.trim() && composerMode === 'build') void setComposerMode('search')
-  }, [searchQuery, composerMode, setComposerMode])
+  }, [memberAccessAvailable, searchQuery, composerMode, setComposerMode])
   const hasCheckedLandingStorageRef = useRef(false)
   const initialViewInputRef = useRef<HTMLDivElement>(null)
   const initialViewUserInputRef = useRef<UserInputHandle>(null)
@@ -492,8 +495,13 @@ export function Home({ chatId, userName, userId }: HomeProps) {
        * Search lists documents, not a turn of the agent, and only a query can
        * be searched: attachments alone have nothing to search for. Assistant
        * makes the query a turn of the agent grounded in the sources.
+       *
+       * The override skips `useMothershipMode`, so the gate is applied again
+       * where the mode is consumed: both modes answer from the workspace's
+       * indexed sources, and neither is offered where those do not exist.
        */
-      const mode = modeOverride ?? composerMode
+      const requestedMode = modeOverride ?? composerMode
+      const mode = requestedMode !== 'build' && !memberAccessAvailable ? 'build' : requestedMode
       const answering = mode === 'assistant'
       if (mode === 'search') {
         /** A search sends nothing, so an edit in progress is released rather than left waiting. */
@@ -536,6 +544,7 @@ export function Home({ chatId, userName, userId }: HomeProps) {
       workspaceId,
       chatId,
       composerMode,
+      memberAccessAvailable,
       editingQueuedId,
       cancelQueueEdit,
       prepareResourceViewForAgentTurn,

apps/sim/app/workspace/[workspaceId]/home/hooks/use-mothership-mode.test.tsx

@@ -69,16 +69,12 @@ afterEach(() => {
   vi.useRealTimers()
 })
 
+/**
+ * The mode's ordinary read/write behavior is covered through the UI in
+ * `mode-switcher.test.tsx`; one write stands here as the control the
+ * per-member-access cases are read against.
+ */
 describe('useMothershipMode', () => {
-  it('defaults to Build and reads the mode the URL names', () => {
-    mount()
-    expect(mode()).toBe('build')
-
-    act(() => root?.unmount())
-    mount('?mode=search')
-    expect(mode()).toBe('search')
-  })
-
   it('writes the chosen mode to the URL', async () => {
     mount()
     await setMode('search')
@@ -87,13 +83,6 @@ describe('useMothershipMode', () => {
     expect(mockUrlUpdate.mock.lastCall?.[0].searchParams.get('mode')).toBe('search')
   })
 
-  it('drops the query and its filters on every mode but Search', async () => {
-    mount('?mode=search&q=budget&source=upload&updated=7d')
-    await setMode('assistant')
-
-    expect(mockUrlUpdate.mock.lastCall?.[0].searchParams.toString()).toBe('mode=assistant')
-  })
-
   describe('without per-member access', () => {
     beforeEach(() => {
       mockMemberAccessAvailable.mockReturnValue(false)

apps/sim/app/workspace/[workspaceId]/home/hooks/use-mothership-mode.ts

@@ -16,19 +16,17 @@ import { useMemberAccessAvailable } from '@/hooks/use-member-access'
  * separate Search and Assistant routes do. Build is the clean URL.
  *
  * Search and Assistant both answer from the workspace's indexed sources, so
- * both exist only where per-member access is on. This is the one place that
- * decides it: with the feature off the mode reads Build whatever the URL says
- * — a stale link cannot strand the composer in a mode whose switcher is not
- * rendered to leave it — and a write to either mode is dropped rather than
- * putting a mode in the URL that the next read would contradict.
+ * both exist only where per-member access is on. With the feature off the mode
+ * reads Build whatever the URL says, and a write to either is dropped rather
+ * than leaving a mode in the URL that the next read would contradict.
  */
 export function useMothershipMode() {
   const memberAccessAvailable = useMemberAccessAvailable()
   const [{ mode }, setParams] = useQueryStates(composerModeParsers, resourceUrlKeys)
   const setMode = useCallback(
-    (next: MothershipMode) => {
+    async (next: MothershipMode) => {
       if (next !== 'build' && !memberAccessAvailable) return
-      void setParams(
+      await setParams(
         {
           mode: next,
           ...(next === 'search' ? {} : { q: null, ...CLEARED_SEARCH_FILTERS }),

apps/sim/app/workspace/[workspaceId]/search/search.tsx

@@ -124,9 +124,8 @@ export function Search() {
   const workspaceId = (params?.workspaceId as string) || ''
   const { integrationAvailability } = usePermissionConfig()
   /**
-   * Judged by the workspace, as the server judges it: with per-member access
-   * off, every connect is refused, so the rows say so instead of offering
-   * one and the memberships are not fetched.
+   * With per-member access off, every connect is refused, so the rows say so
+   * and the memberships are not fetched.
    */
   const memberAccessAvailable = useMemberAccessAvailable()
   const { data: workspacePermissions } = useWorkspacePermissionsQuery(workspaceId)

apps/sim/hooks/use-member-access.ts

@@ -3,13 +3,11 @@
 import { useOptionalWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
 
 /**
- * Whether per-member knowledge access is on for the routed workspace, as the
- * server judged it: the `knowledge-member-access` flag and Credential Groups,
- * resolved once into the workspace host context.
+ * Whether per-member knowledge access is on for the routed workspace, as
+ * `isKnowledgeMemberAccessAvailable` judged it, resolved once into the
+ * workspace host context.
  *
- * The single client-side reading of that judgement, so every Sim Search
- * surface — the tab, the page, the composer's Search mode, the source rows,
- * and the connector modals — appears and behaves together, and none can drift
+ * The single client-side reading of that judgement, so no surface can drift
  * into offering a feature the server refuses. Outside a workspace route there
  * is no workspace to judge, so it reads false.
  */

apps/sim/lib/copilot/tools/server/knowledge/knowledge-base.test.ts

@@ -25,6 +25,7 @@ const {
   mockCreateKnowledgeConnector,
   mockCreateKnowledgeTag,
   mockListKnowledgeTags,
+  mockIsKnowledgeMemberAccessAvailable,
   knowledgeOperations,
 } = vi.hoisted(() => {
   const defineOperation = (id: string, minimumRole: 'read' | 'write') =>
@@ -58,6 +59,7 @@ const {
     mockCreateKnowledgeConnector: vi.fn(),
     mockCreateKnowledgeTag: vi.fn(),
     mockListKnowledgeTags: vi.fn(),
+    mockIsKnowledgeMemberAccessAvailable: vi.fn(),
     knowledgeOperations: {
       addWorkspaceFiles: defineOperation('knowledge.documents.add_workspace_files', 'write'),
       bulkDelete: defineOperation('knowledge.bulk_delete', 'write'),
@@ -98,6 +100,9 @@ vi.mock('@/lib/core/telemetry', () => ({
 }))
 vi.mock('@/lib/posthog/server', () => ({ captureServerEvent: mockCaptureServerEvent }))
 vi.mock('@/lib/knowledge/application/operations', () => ({ knowledgeOperations }))
+vi.mock('@/lib/knowledge/access/availability', () => ({
+  isKnowledgeMemberAccessAvailable: mockIsKnowledgeMemberAccessAvailable,
+}))
 vi.mock('@/lib/knowledge/application/add-workspace-files', () => ({
   addWorkspaceFilesToKnowledgeBase: {
     operation: knowledgeOperations.addWorkspaceFiles,
@@ -260,6 +265,7 @@ describe('manage_knowledge_base trusted application delegation', () => {
       ],
       failed: [],
     })
+    mockIsKnowledgeMemberAccessAvailable.mockResolvedValue(true)
     mockSearchKnowledge.mockResolvedValue({
       results: [],
       query: 'query',
@@ -407,6 +413,30 @@ describe('manage_knowledge_base trusted application delegation', () => {
     expect(mockReadKnowledgeBase).not.toHaveBeenCalled()
   })
 
+  it('asks for citations where per-member access is on', async () => {
+    const result = await knowledgeBaseServerTool.execute(
+      { operation: 'query', args: { knowledgeBaseId: KNOWLEDGE_BASE.id, query: 'query' } },
+      { ...CONTEXT, resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry() }
+    )
+
+    expect(result.message).toContain('<source>')
+    expect(mockIsKnowledgeMemberAccessAvailable).toHaveBeenCalledWith({
+      workspaceId: 'workspace-paid',
+    })
+  })
+
+  it('asks for no citation where the workspace cannot render one', async () => {
+    mockIsKnowledgeMemberAccessAvailable.mockResolvedValue(false)
+
+    const result = await knowledgeBaseServerTool.execute(
+      { operation: 'query', args: { knowledgeBaseId: KNOWLEDGE_BASE.id, query: 'query' } },
+      { ...CONTEXT, resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry() }
+    )
+
+    expect(result).toMatchObject({ success: true })
+    expect(result.message).toBe('Found 0 result(s) for query "query".')
+  })
+
   it('returns a safe model result for search infrastructure failures', async () => {
     mockSearchKnowledge.mockRejectedValueOnce(new Error('database unavailable'))
 

apps/sim/lib/copilot/tools/server/knowledge/knowledge-base.ts

@@ -20,6 +20,7 @@ import {
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { PlatformEvents } from '@/lib/core/telemetry'
 import { getEffectiveDecryptedEnv } from '@/lib/environment/utils'
+import { isKnowledgeMemberAccessAvailable } from '@/lib/knowledge/access/availability'
 import { addWorkspaceFilesToKnowledgeBase } from '@/lib/knowledge/application/add-workspace-files'
 import { KnowledgeUsageLimitExceededError } from '@/lib/knowledge/application/billing'
 import {
@@ -64,6 +65,12 @@ const DEFAULT_QUERY_TOP_K = 5
  * How the model cites a knowledge result in its reply. The `<source>` tag is
  * what the chat renders as a link back to the document, so a result without
  * a source URL is quoted by name instead.
+ *
+ * Asked for only where per-member access is on. The chip and the sources strip
+ * that render the tag arrived with Sim Search, so a workspace without the
+ * feature must not be told to emit one: the gate belongs here, at the emission,
+ * because a client that merely declined to render the tag would leave the raw
+ * `<source>{...}</source>` JSON sitting in the visible reply.
  */
 const KNOWLEDGE_CITATION_INSTRUCTION =
   'Cite each result you use inline, right after the sentence it supports, as <source>{"url":"<sourceUrl>","title":"<documentName>","siteName":"<knowledgeBaseName>","connectorType":"<connectorType>","snippet":"<the sentence or two of content you relied on>","updatedAt":"<sourceModifiedAt>","author":"<author>"}</source> with every value JSON-escaped; leave out any optional field whose value is null or unknown, and omit the tag for a result whose sourceUrl is null and name the document instead.'
@@ -436,13 +443,16 @@ export const knowledgeBaseServerTool: BaseServerTool<KnowledgeBaseArgs, Knowledg
                 'Failed to query knowledge base: Knowledge result secret provenance is unavailable',
             }
           }
-          const searchResult = await executeCopilotKnowledgeUseCase(context, searchKnowledge, {
-            workspaceId,
-            knowledgeBaseIds: [args.knowledgeBaseId],
-            query: modelQuery,
-            topK,
-            resultSecretRegistry: context.resolvedSecretTraceRegistry,
-          })
+          const [searchResult, citable] = await Promise.all([
+            executeCopilotKnowledgeUseCase(context, searchKnowledge, {
+              workspaceId,
+              knowledgeBaseIds: [args.knowledgeBaseId],
+              query: modelQuery,
+              topK,
+              resultSecretRegistry: context.resolvedSecretTraceRegistry,
+            }),
+            isKnowledgeMemberAccessAvailable({ workspaceId }),
+          ])
           const results = searchResult.results
           const knowledgeBase = searchResult.knowledgeBases[0]
           if (!knowledgeBase)
@@ -455,9 +465,11 @@ export const knowledgeBaseServerTool: BaseServerTool<KnowledgeBaseArgs, Knowledg
             userId: context.userId,
           })
 
+          const foundMessage = `Found ${results.length} result(s) for query "${truncate(args.query, 50)}".`
+
           return {
             success: true,
-            message: `Found ${results.length} result(s) for query "${truncate(args.query, 50)}". ${KNOWLEDGE_CITATION_INSTRUCTION}`,
+            message: citable ? `${foundMessage} ${KNOWLEDGE_CITATION_INSTRUCTION}` : foundMessage,
             data: {
               knowledgeBaseId: args.knowledgeBaseId,
               knowledgeBaseName: knowledgeBase.name,