feat(copilot): make the tool own service-account discovery

Removes the VFS auth-metadata exposure and returns connectNoun from the
service_account_get_setup_link result instead. The VFS aggregate was a
second, viewer-independent source of truth that couldn't agree with the
per-viewer preview gate (it always hid slack-custom-bot, even for viewers
with slack_v2 revealed, while the tool accepts it for them). The tool now
resolves the provider, applies the per-viewer gate, and returns either the
in-chat button + connectNoun or a fall-back-to-oauth error — one source of
truth. connectNoun stays DRY via getServiceAccountConnectNoun, shared with
the connect-button label.

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/use-service-account-connect.ts

@@ -1,9 +1,10 @@
 'use client'
 
 import { type ComponentType, useMemo } from 'react'
-import { getClientCredentialAccountDescriptor } from '@/lib/credentials/client-credential-accounts/descriptors'
-import { getServiceAccountGatingBlockType } from '@/lib/credentials/service-account-provider-ids'
-import { getTokenServiceAccountDescriptor } from '@/lib/credentials/token-service-accounts/descriptors'
+import {
+  getServiceAccountConnectNoun,
+  getServiceAccountGatingBlockType,
+} from '@/lib/credentials/service-account-provider-ids'
 import { SLACK_CUSTOM_BOT_PROVIDER_ID } from '@/lib/oauth/types'
 import type { ServiceAccountProviderId } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal'
 import { getBlock } from '@/blocks'
@@ -66,15 +67,9 @@ export function useServiceAccountConnectTarget({
   return useMemo(() => {
     if (!serviceAccountProviderId || !serviceName || !serviceIcon) return null
 
-    const nounDescriptor =
-      getTokenServiceAccountDescriptor(serviceAccountProviderId) ??
-      getClientCredentialAccountDescriptor(serviceAccountProviderId)
-
     const label = isSlackBot
       ? 'Set up a custom bot'
-      : nounDescriptor
-        ? `Add ${nounDescriptor.connectNoun}`
-        : 'Add service account'
+      : `Add ${getServiceAccountConnectNoun(serviceAccountProviderId)}`
 
     return { serviceAccountProviderId, serviceName, serviceIcon, label, hidden }
   }, [serviceAccountProviderId, serviceName, serviceIcon, isSlackBot, hidden])

apps/sim/lib/copilot/tools/handlers/service-account.test.ts

@@ -45,6 +45,7 @@ interface Output {
   provider?: string
   providerId?: string
   serviceAccountProviderId?: string
+  connectNoun?: string
   instructions?: string
 }
 
@@ -69,6 +70,10 @@ describe('executeServiceAccountGetSetupLink', () => {
     expect(output.setup_url).toContain('/integrations/notion?connect=service-account')
     // The agent is steered to emit the tag, not surface the URL as a link.
     expect(output.instructions).toContain('service_account')
+    // The tool carries the secret's noun so the agent can tell the user what to
+    // prepare — this is the discovery surface, replacing the reverted VFS field.
+    expect(output.connectNoun).toBe('integration secret')
+    expect(output.instructions).toContain('integration secret')
     // An ungated provider never consults block visibility.
     expect(mockGetBlockVisibility).not.toHaveBeenCalled()
   })

apps/sim/lib/copilot/tools/handlers/service-account.ts

@@ -3,7 +3,10 @@ import { getBlockVisibilityForCopilot } from '@/lib/copilot/block-visibility'
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
 import { ensureWorkspaceAccess } from '@/lib/copilot/tools/handlers/access'
 import { getBaseUrl } from '@/lib/core/utils/urls'
-import { getServiceAccountGatingBlockType } from '@/lib/credentials/service-account-provider-ids'
+import {
+  getServiceAccountConnectNoun,
+  getServiceAccountGatingBlockType,
+} from '@/lib/credentials/service-account-provider-ids'
 import {
   listServiceAccountIntegrationNames,
   resolveServiceAccountIntegration,
@@ -65,22 +68,28 @@ export async function executeServiceAccountGetSetupLink(
     const url = new URL(`${baseUrl}/workspace/${context.workspaceId}/integrations/${match.slug}`)
     url.searchParams.set(CONNECT_QUERY_PARAM, CONNECT_MODE.serviceAccount)
 
+    const connectNoun = getServiceAccountConnectNoun(match.serviceAccountProviderId)
+
     return {
       success: true,
       output: {
         message: `Service account setup available for ${match.serviceName}.`,
         instructions:
           `Emit <credential>{"type":"service_account","provider":"${match.providerId}"}</credential> ` +
           `to open the ${match.serviceName} setup form directly in this chat. Only fall back to ` +
-          `setup_url when you cannot render a tag (headless/MCP). The form collects the ` +
-          `credential — never ask the user to paste key material into chat.`,
+          `setup_url when you cannot render a tag (headless/MCP). Before or alongside the tag, tell ` +
+          `the user they'll need a ${connectNoun} — the form collects it, so never ask them to paste ` +
+          `key material into chat.`,
         provider: match.serviceName,
         // The OAuth provider value, NOT the service-account provider id — both
         // the tag renderer and the link renderer resolve display metadata from
         // this, and a service-account id resolves to whichever family member is
         // registered first: `google-service-account` labels Google Sheets "Gmail".
         providerId: match.providerId,
         serviceAccountProviderId: match.serviceAccountProviderId,
+        // The vendor noun for the secret the form collects ("private app token",
+        // "server-to-server app"), so the agent can tell the user what to prepare.
+        connectNoun,
         /** Headless fallback only; interactive chat should emit the tag. */
         setup_url: url.toString(),
       },

apps/sim/lib/credentials/service-account-provider-ids.test.ts

@@ -0,0 +1,65 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  getServiceAccountConnectNoun,
+  getServiceAccountGatingBlockType,
+  isServiceAccountProviderId,
+} from '@/lib/credentials/service-account-provider-ids'
+
+describe('isServiceAccountProviderId', () => {
+  it('recognizes every family of service-account id', () => {
+    expect(isServiceAccountProviderId('google-service-account')).toBe(true)
+    expect(isServiceAccountProviderId('atlassian-service-account')).toBe(true)
+    expect(isServiceAccountProviderId('slack-custom-bot')).toBe(true)
+    expect(isServiceAccountProviderId('notion-service-account')).toBe(true)
+    expect(isServiceAccountProviderId('salesforce-service-account')).toBe(true)
+  })
+
+  it('is case- and whitespace-insensitive', () => {
+    expect(isServiceAccountProviderId('  SLACK-CUSTOM-BOT ')).toBe(true)
+  })
+
+  it('rejects OAuth provider values and unknowns', () => {
+    // The distinction the oauth_get_auth_link guard depends on: `slack` is an
+    // OAuth provider value, not a service-account id, even though Slack offers a
+    // custom bot.
+    expect(isServiceAccountProviderId('slack')).toBe(false)
+    expect(isServiceAccountProviderId('google-email')).toBe(false)
+    expect(isServiceAccountProviderId('github')).toBe(false)
+    expect(isServiceAccountProviderId('')).toBe(false)
+  })
+})
+
+describe('getServiceAccountGatingBlockType', () => {
+  it('maps the custom Slack bot to slack_v2 and leaves everything else ungated', () => {
+    expect(getServiceAccountGatingBlockType('slack-custom-bot')).toBe('slack_v2')
+    expect(getServiceAccountGatingBlockType('notion-service-account')).toBeNull()
+    expect(getServiceAccountGatingBlockType('google-service-account')).toBeNull()
+    expect(getServiceAccountGatingBlockType('salesforce-service-account')).toBeNull()
+  })
+})
+
+describe('getServiceAccountConnectNoun', () => {
+  it('names the token-paste secret each provider actually collects', () => {
+    expect(getServiceAccountConnectNoun('notion-service-account')).toBe('integration secret')
+    expect(getServiceAccountConnectNoun('hubspot-service-account')).toBe('private app token')
+    expect(getServiceAccountConnectNoun('linear-service-account')).toBe('API key')
+  })
+
+  it('names the client-credential secret', () => {
+    expect(getServiceAccountConnectNoun('zoom-service-account')).toBe('server-to-server app')
+  })
+
+  it('calls a custom Slack bot a custom bot', () => {
+    expect(getServiceAccountConnectNoun('slack-custom-bot')).toBe('custom bot')
+  })
+
+  it('falls back to the generic noun for bespoke providers with no descriptor', () => {
+    // Google (paste a JSON key) and Atlassian (token + domain) have no
+    // token/client descriptor, so they read as a plain "service account".
+    expect(getServiceAccountConnectNoun('google-service-account')).toBe('service account')
+    expect(getServiceAccountConnectNoun('atlassian-service-account')).toBe('service account')
+  })
+})

apps/sim/lib/credentials/service-account-provider-ids.ts

@@ -1,5 +1,11 @@
-import { isClientCredentialAccountProviderId } from '@/lib/credentials/client-credential-accounts/descriptors'
-import { isTokenServiceAccountProviderId } from '@/lib/credentials/token-service-accounts/descriptors'
+import {
+  getClientCredentialAccountDescriptor,
+  isClientCredentialAccountProviderId,
+} from '@/lib/credentials/client-credential-accounts/descriptors'
+import {
+  getTokenServiceAccountDescriptor,
+  isTokenServiceAccountProviderId,
+} from '@/lib/credentials/token-service-accounts/descriptors'
 import {
   ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID,
   GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID,
@@ -54,3 +60,18 @@ export function isServiceAccountProviderId(value: string): boolean {
 export function getServiceAccountGatingBlockType(providerId: string): string | null {
   return providerId === SLACK_CUSTOM_BOT_PROVIDER_ID ? 'slack_v2' : null
 }
+
+/**
+ * Vendor-accurate noun for the credential a service-account provider collects
+ * ("private app token", "server-to-server app", …), for connect-control labels
+ * and agent-facing discovery. Token-paste and client-credential providers name
+ * their own; bespoke providers (Google JSON key, Atlassian token) fall back to
+ * the generic "service account". Single source shared by the connect hook and
+ * the VFS catalog so the wording can't drift.
+ */
+export function getServiceAccountConnectNoun(providerId: string): string {
+  if (providerId === SLACK_CUSTOM_BOT_PROVIDER_ID) return 'custom bot'
+  const descriptor =
+    getTokenServiceAccountDescriptor(providerId) ?? getClientCredentialAccountDescriptor(providerId)
+  return descriptor?.connectNoun ?? 'service account'
+}