fix(settings): gate workspace sections on the deployment the same way the sidebar does

[waleedlatif1]

Summary

• The workspace settings route gate hardcoded the inbox entitlement, so on a self-hosted deployment with the inbox feature off a direct link to /settings/inbox was authorized and rendered an upgrade notice while the sidebar hid the section
• resolveWorkspaceNavigation now takes the server-resolved deployment shape and reads each section's requiresHosted / requiresSelfHosted / selfHostedOverride from the catalog, the same entry the sidebar filters on, so an unavailable section redirects to General
• Drops the hand-rolled self-host and byok rules in favor of that shared gate; byok leaves the entitlement bag since the catalog already says it is hosted-only

Type of Change

• Bug fix

Testing

• Added navigation tests covering inbox on self-hosted with the override off and on, on Sim Cloud, and BYOK on both deployments
• vitest for settings navigation, the section gate, the settings pages, and the settings sidebar: 201 passing
• bun run type-check, bun run lint, bun run check:audits, docs-manifest:check, block-registry check all pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 4, 2026 3:34am UTC

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Greptile Summary

The PR aligns direct workspace-settings route authorization with the deployment gates used by settings navigation.

• Passes the full server-resolved deployment shape into workspace navigation resolution.
• Derives hosted, self-hosted, and override restrictions from the shared settings catalog.
• Removes redundant hand-written BYOK and self-host checks.
• Adds coverage for inbox overrides and BYOK across hosted and self-hosted deployments.

Confidence Score: 5/5

The PR appears safe to merge, with route and sidebar deployment gating aligned across the checked workspace sections.

All resolver callers pass the required deployment shape, the shared catalog projection reproduces the sidebar’s deployment conditions, and no changed-code-triggered failure remains.

Important Files Changed

Filename	Overview
apps/sim/components/settings/navigation.ts	Centralizes workspace deployment availability around shared catalog metadata without leaving stale resolver callers or divergent deployment conditions.
apps/sim/lib/settings/application/workspace-section-access.ts	Supplies the complete deployment shape to route authorization so direct links follow the same deployment restrictions as navigation.
apps/sim/components/settings/navigation.test.ts	Adds focused hosted, self-hosted, override, and BYOK navigation coverage.
apps/sim/lib/settings/application/workspace-section-access.test.ts	Updates route-authorization expectations for the deployment-shape contract.

_{Reviews (1): Last reviewed commit: "fix(settings): gate workspace sections o..." | Re-trigger Greptile}