fix(permission-groups): validate defaults before seeding agents

Author: waleedlatif1

.agents/skills/ship/SKILL.md

@@ -77,9 +77,9 @@ When the user runs `/ship`:
   }
   # Runs every audit CI runs, concurrently, and replays the output of any that fail.
   # The audit list is derived in scripts/run-audits.ts — do not hand-list audits here.
-  # Run the current "Lint workflows" block from .github/workflows/checks.yml locally too,
-  # using its pinned actionlint version and checksum in a temporary directory. Preserve
-  # its -shellcheck= -pyflakes= flags; lint all workflows and abort ship if it fails.
+  # Install CI's pinned actionlint version for the host OS/architecture and verify its
+  # artifact against the official release checksums in a local mktemp directory.
+  # Preserve CI's -shellcheck= -pyflakes= flags; lint all workflows and abort ship if it fails.
   bun run check:audits || { echo "❌ audit(s) failed — do not ship"; exit 1; }
   bun run type-check || { echo "❌ type-check failed — do not ship"; exit 1; }
   # CI's "Verify docs manifest is in sync" step is not a `check:*` script, so the runner above

apps/docs/openapi-v2-resources.json

@@ -16032,8 +16032,7 @@
                 "anyOf": [
                   {
                     "type": "string",
-                    "minLength": 1,
-                    "maxLength": 255
+                    "minLength": 1
                   },
                   {
                     "type": "null"
@@ -16563,8 +16562,7 @@
                 "anyOf": [
                   {
                     "type": "string",
-                    "minLength": 1,
-                    "maxLength": 255
+                    "minLength": 1
                   },
                   {
                     "type": "null"
@@ -17014,8 +17012,7 @@
                 "anyOf": [
                   {
                     "type": "string",
-                    "minLength": 1,
-                    "maxLength": 255
+                    "minLength": 1
                   },
                   {
                     "type": "null"
@@ -18314,8 +18311,7 @@
                     "anyOf": [
                       {
                         "type": "string",
-                        "minLength": 1,
-                        "maxLength": 255
+                        "minLength": 1
                       },
                       {
                         "type": "null"

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/combobox/combobox.tsx

@@ -3,7 +3,6 @@ import { Combobox, type ComboboxOption, cn } from '@sim/emcn'
 import { Plus } from '@sim/emcn/icons'
 import { useReactFlow } from '@xyflow/react'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
-import { resolveAgentDefaultModel } from '@/lib/permission-groups/model-access'
 import type { SelectorKey } from '@/lib/selectors/manifest'
 import { SEARCH_DEBOUNCE_MS } from '@/lib/url-state'
 import { getDependsOnFields } from '@/lib/workflows/subblocks/dependencies'
@@ -22,7 +21,6 @@ import { useDebounce } from '@/hooks/use-debounce'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
 import { useSubBlockStore } from '@/stores/workflows/subblock/store'
-import { useWorkflowStore } from '@/stores/workflows/workflow/store'
 
 /**
  * Constants for ComboBox component behavior
@@ -108,7 +106,6 @@ export const ComboBox = memo(function ComboBox({
   const activeSearchTarget = useActiveSearchTarget()
   // Hooks and context
   const [storeValue, setStoreValue] = useSubBlockValue<string>(blockId, subBlockId)
-  const blockType = useWorkflowStore((state) => state.blocks[blockId]?.type)
   const accessiblePrefixes = useAccessibleReferencePrefixes(blockId)
   const reactFlowInstance = useReactFlow()
 
@@ -119,11 +116,7 @@ export const ComboBox = memo(function ComboBox({
   const value = isPreview ? previewValue : propValue !== undefined ? propValue : storeValue
 
   // Permission-based filtering for model dropdowns
-  const {
-    config: permissionConfig,
-    isModelUsable,
-    isLoading: isPermissionLoading,
-  } = usePermissionConfig()
+  const { isModelUsable, isLoading: isPermissionLoading } = usePermissionConfig()
 
   // Evaluate static options if provided as a function
   // Derived option lists read the block's own values (a model's valid reasoning efforts);
@@ -303,19 +296,9 @@ export const ComboBox = memo(function ComboBox({
 
   /**
    * Determines the default option value to use.
-   * Priority: group Agent default > explicit defaultValue > DEFAULT_MODEL > first option.
+   * Priority: explicit defaultValue > DEFAULT_MODEL for model field > first option
    */
   const defaultOptionValue = useMemo(() => {
-    const agentDefault =
-      config.id === 'model' && blockType === 'agent'
-        ? resolveAgentDefaultModel(permissionConfig)
-        : null
-    if (
-      agentDefault &&
-      evaluatedOptions.some((option) => getOptionValue(option) === agentDefault)
-    ) {
-      return agentDefault
-    }
     if (defaultValue !== undefined) {
       // Validate that the default value exists in the available (filtered) options
       const defaultInOptions = evaluatedOptions.find((opt) => getOptionValue(opt) === defaultValue)
@@ -347,16 +330,7 @@ export const ComboBox = memo(function ComboBox({
     }
 
     return undefined
-  }, [
-    defaultValue,
-    evaluatedOptions,
-    subBlockId,
-    getOptionValue,
-    config.emptyIsValid,
-    config.id,
-    blockType,
-    permissionConfig,
-  ])
+  }, [defaultValue, evaluatedOptions, subBlockId, getOptionValue, config.emptyIsValid])
 
   /**
    * Resolve the user-facing text for the current stored value.

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx

@@ -898,7 +898,7 @@ const WorkflowContent = React.memo(
      */
     const pendingFocusBlockIdRef = useRef<string | null>(null)
 
-    const { resolveSeedGate, agentDefaultModel } = useOperationAccess()
+    const { resolveSeedGate, agentDefaultModel, isAgentDefaultReady } = useOperationAccess()
 
     const addBlock = useCallback(
       (
@@ -913,6 +913,10 @@ const WorkflowContent = React.memo(
         triggerMode?: boolean,
         presetSubBlockValues?: Record<string, unknown>
       ) => {
+        if (type === 'agent' && !isAgentDefaultReady) {
+          toast({ message: 'Model settings are not ready. Try again.' })
+          return
+        }
         setPendingSelection([id])
         setSelectedEdges(new Map())
         pendingFocusBlockIdRef.current = id
@@ -983,6 +987,7 @@ const WorkflowContent = React.memo(
         setPendingSelection,
         resolveSeedGate,
         agentDefaultModel,
+        isAgentDefaultReady,
       ]
     )
 

apps/sim/ee/access-control/components/agent-default.tsx

@@ -1,16 +1,21 @@
 'use client'
 
-import { useId, useMemo, useState } from 'react'
+import { useMemo, useState } from 'react'
 import { ChipCombobox, type ComboboxOption } from '@sim/emcn'
+import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import type { PermissionGroupConfig } from '@/lib/permission-groups/fields'
-import { createModelAccessGate } from '@/lib/permission-groups/model-access'
+import {
+  createModelAccessGate,
+  resolveAgentDefaultModel,
+} from '@/lib/permission-groups/model-access'
 import { SettingRow } from '@/ee/components/setting-row'
 import { useProviderModelLists } from '@/hooks/queries/providers'
 import {
   DYNAMIC_MODEL_PROVIDERS,
   getModelSunsetStatus,
   getProviderIcon,
   getProviderModels,
+  SIM_AUTO_MODEL_ID,
 } from '@/providers/models'
 import type { ProviderId } from '@/providers/types'
 
@@ -25,7 +30,7 @@ interface AgentDefaultProps {
 
 /** Selects an allowed default for new Agent blocks governed by this group. */
 export function AgentDefault({ config, providerIds, workspaceId, onChange }: AgentDefaultProps) {
-  const id = useId()
+  const { hosted } = useDeploymentShape()
   const [open, setOpen] = useState(false)
   const dynamicModels = useProviderModelLists(
     DYNAMIC_MODEL_PROVIDERS.filter((provider) => providerIds.includes(provider)),
@@ -38,8 +43,11 @@ export function AgentDefault({ config, providerIds, workspaceId, onChange }: Age
       ...providerIds.flatMap((provider) => getProviderModels(provider)),
       ...dynamicModels,
     ])
-    return [
+    const modelOptions: ComboboxOption[] = [
       { label: 'Platform default', value: PLATFORM_DEFAULT },
+      ...(hosted && isAllowed(SIM_AUTO_MODEL_ID)
+        ? [{ label: 'Auto', value: SIM_AUTO_MODEL_ID }]
+        : []),
       ...[...models]
         .filter((model) => isAllowed(model) && getModelSunsetStatus(model) !== 'deprecated')
         .map((model) => ({
@@ -48,17 +56,28 @@ export function AgentDefault({ config, providerIds, workspaceId, onChange }: Age
           icon: getProviderIcon(model) ?? undefined,
         })),
     ]
-  }, [config, providerIds, dynamicModels])
+    const savedModel = config.defaultAgentModel
+    if (savedModel && !modelOptions.some((option) => option.value === savedModel)) {
+      modelOptions.push({
+        label: savedModel,
+        value: savedModel,
+        icon: getProviderIcon(savedModel) ?? undefined,
+        hidden: true,
+      })
+    }
+    return modelOptions
+  }, [config, providerIds, dynamicModels, hosted])
 
   const error =
-    config.defaultAgentModel && !createModelAccessGate(config)(config.defaultAgentModel)
-      ? 'Agent default must be an allowed model'
+    config.defaultAgentModel &&
+    !resolveAgentDefaultModel(config, { allowAuto: hosted, availableProviderIds: providerIds })
+      ? 'Agent default must be an available, allowed model'
       : undefined
 
   return (
-    <SettingRow label='Agent default' htmlFor={id} error={error}>
+    <SettingRow label='Agent default' error={error}>
       <ChipCombobox
-        id={id}
+        aria-label='Agent default'
         options={options}
         value={config.defaultAgentModel ?? PLATFORM_DEFAULT}
         onChange={(model) => onChange(model === PLATFORM_DEFAULT ? null : model)}

apps/sim/ee/access-control/components/group-detail.tsx

@@ -32,6 +32,7 @@ import { useQueryState } from 'nuqs'
 import { saveDiscardActions } from '@/components/settings/save-discard-actions'
 import { useSettingsUnsavedGuard } from '@/components/settings/use-settings-unsaved-guard'
 import type { ShareAuthType } from '@/lib/api/contracts/public-shares'
+import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { isAccessControlAllowlistRow } from '@/lib/permission-groups/block-access'
 import {
   isFeatureInertForGroup,
@@ -720,6 +721,7 @@ export function GroupDetail({
   onBack,
   onDeleted,
 }: GroupDetailProps) {
+  const { hosted } = useDeploymentShape()
   const updatePermissionGroup = useUpdatePermissionGroup()
   const deletePermissionGroup = useDeletePermissionGroup()
   const removeMember = useRemovePermissionGroupMember()
@@ -824,6 +826,12 @@ export function GroupDetail({
     const blacklist = blacklistedProviders.data.blacklistedProviders
     return getAllProviderIds().filter((id) => !blacklist.includes(id.toLowerCase()))
   }, [blacklistedProviders.data, blacklistedProviders.isSuccess])
+  const isAgentDefaultValid =
+    !editingConfig.defaultAgentModel ||
+    !!resolveAgentDefaultModel(editingConfig, {
+      allowAuto: hosted,
+      availableProviderIds: allProviderIds,
+    })
 
   /** Maps every tool id to ALL block types that expose it (some tools are shared across blocks). */
   const toolBlockTypes = useMemo(() => {
@@ -1281,11 +1289,7 @@ export function GroupDetail({
 
   /** Persists the editing buffer — name/description are only sent when they changed. */
   const handleSaveConfig = async () => {
-    if (
-      !trimmedName ||
-      (editingConfig.defaultAgentModel && !resolveAgentDefaultModel(editingConfig))
-    )
-      return
+    if (!trimmedName || !isAgentDefaultValid) return
     try {
       const result = await updatePermissionGroup.mutateAsync({
         id: viewingGroup.id,
@@ -1483,9 +1487,7 @@ export function GroupDetail({
             saving: updatePermissionGroup.isPending,
             onSave: handleSaveConfig,
             onDiscard: handleDiscardConfig,
-            saveDisabled:
-              !trimmedName ||
-              !!(editingConfig.defaultAgentModel && !resolveAgentDefaultModel(editingConfig)),
+            saveDisabled: !trimmedName || !isAgentDefaultValid,
           }),
           {
             id: 'delete',

apps/sim/hooks/use-operation-access.ts

@@ -1,6 +1,7 @@
 'use client'
 
 import { useMemo } from 'react'
+import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { resolveAgentDefaultModel } from '@/lib/permission-groups/model-access'
 import {
   collectDeniedOperationIds,
@@ -12,10 +13,13 @@ import {
   pickDefaultOperation,
   type SeedValueGate,
 } from '@/lib/permission-groups/operation-access'
+import { useBlacklistedProviders } from '@/hooks/queries/allowed-providers'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
+import { PROVIDER_DEFINITIONS } from '@/providers/models'
 
 export interface OperationAccess {
   agentDefaultModel: string | null
+  isAgentDefaultReady: boolean
   /**
    * Whether the permission config is still loading. Every list this module
    * filters reads as unrestricted until it resolves, so a surface that
@@ -73,12 +77,24 @@ export interface OperationAccess {
  * canvas search, block creation — agrees.
  */
 export function useOperationAccess(): OperationAccess {
-  const { config, isToolAllowed, isModelUsable, isLoading } = usePermissionConfig()
+  const { hosted } = useDeploymentShape()
+  const { config, isToolAllowed, isModelUsable, isLoading, isPermissionFetching } =
+    usePermissionConfig()
+  const blacklistedProviders = useBlacklistedProviders()
 
   return useMemo(() => {
     const isReady = !isLoading
+    const isAgentDefaultReady = isReady && !isPermissionFetching && blacklistedProviders.isSuccess
     return {
-      agentDefaultModel: isReady ? resolveAgentDefaultModel(config) : null,
+      isAgentDefaultReady,
+      agentDefaultModel: isAgentDefaultReady
+        ? resolveAgentDefaultModel(config, {
+            allowAuto: hosted,
+            availableProviderIds: Object.keys(PROVIDER_DEFINITIONS).filter(
+              (provider) => !blacklistedProviders.data.blacklistedProviders.includes(provider)
+            ),
+          })
+        : null,
       isPermissionLoading: isLoading,
       getDeniedOperations: (block, operationIds) =>
         isReady
@@ -98,5 +114,14 @@ export function useOperationAccess(): OperationAccess {
           : isModelUsable(value)
       },
     }
-  }, [config, isToolAllowed, isModelUsable, isLoading])
+  }, [
+    config,
+    isToolAllowed,
+    isModelUsable,
+    isLoading,
+    isPermissionFetching,
+    hosted,
+    blacklistedProviders.isSuccess,
+    blacklistedProviders.data,
+  ])
 }

apps/sim/hooks/use-permission-config.ts

@@ -28,6 +28,7 @@ import { useIntegrationAvailability } from '@/hooks/queries/integration-availabi
 export interface PermissionConfigResult {
   config: PermissionGroupConfig
   isLoading: boolean
+  isPermissionFetching: boolean
   isInPermissionGroup: boolean
   filterBlocks: <T extends { type: string }>(blocks: T[]) => T[]
   filterProviders: (providerIds: string[]) => string[]
@@ -58,8 +59,11 @@ export function usePermissionConfig(): PermissionConfigResult {
   const blockOverlayVersion = useCustomBlockOverlayVersion()
   const hostContext = useOptionalWorkspaceHostContext()
 
-  const { data: permissionData, isLoading: isPermissionLoading } =
-    useUserPermissionConfig(workspaceId)
+  const {
+    data: permissionData,
+    isLoading: isPermissionLoading,
+    isFetching: isPermissionFetching,
+  } = useUserPermissionConfig(workspaceId)
   const {
     data: envAllowlistData,
     isLoading: isEnvAllowlistLoading,
@@ -226,6 +230,7 @@ export function usePermissionConfig(): PermissionConfigResult {
     () => ({
       config: mergedConfig,
       isLoading,
+      isPermissionFetching,
       isInPermissionGroup,
       filterBlocks,
       filterProviders,
@@ -246,6 +251,7 @@ export function usePermissionConfig(): PermissionConfigResult {
     [
       mergedConfig,
       isLoading,
+      isPermissionFetching,
       isInPermissionGroup,
       filterBlocks,
       filterProviders,