fix(agent): keep permission modes with reordered tools across API edits

Apply each agent tool's Permission Mode after the edit batch reindexes tool
canonical modes, so a mode chosen for a tool's final position is not moved
again as if it were keyed by the original tool list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: j15z

apps/sim/lib/workflows/editing/builders.test.ts

@@ -11,10 +11,8 @@ import {
   normalizeSubblockValue,
   normalizeTools,
   resolveBlockRetryUpdate,
-  updateCanonicalModesForInputs,
 } from '@/lib/workflows/editing/builders'
 import type { SkippedItem } from '@/lib/workflows/editing/types'
-import { getBlock } from '@/blocks/registry'
 
 const { mockIsIntegrationDeploymentAvailable } = vi.hoisted(() => ({
   mockIsIntegrationDeploymentAvailable: vi.fn(() => true),
@@ -202,48 +200,6 @@ describe('createBlockFromParams', () => {
   })
 })
 
-describe('agent permission selections from API inputs', () => {
-  it('preserves distinct active modes when an unchanged round trip contains both values', () => {
-    const repeated = Array.from({ length: 2 }, () => ({
-      type: 'custom-tool',
-      customToolId: 'repeated',
-      usageControl: 'force',
-      usageControlExpression: 'none',
-    }))
-    const block = createBlockFromParams('agent', {
-      type: 'agent',
-      name: 'Agent',
-      inputs: { tools: repeated },
-    })
-    const modes = { '1:agentToolUsageControl': 'advanced' as const, model: 'advanced' as const }
-    block.data.canonicalModes = modes
-    block.subBlocks.tools.value = normalizeTools(structuredClone(repeated))
-
-    updateCanonicalModesForInputs(block, ['tools'], getBlock('agent')!)
-
-    expect(block.data.canonicalModes).toEqual(modes)
-  })
-
-  it('returns to the Auto default when an API tool omits both permission fields', () => {
-    const block = createBlockFromParams('agent', {
-      type: 'agent',
-      name: 'Agent',
-      inputs: {
-        tools: [{ type: 'custom-tool', customToolId: 'custom-1', usageControlExpression: 'none' }],
-      },
-    })
-    block.data.canonicalModes.model = 'advanced'
-    block.subBlocks.tools.value = normalizeTools([
-      { type: 'custom-tool', customToolId: 'custom-1' },
-    ])
-
-    updateCanonicalModesForInputs(block, ['tools'], getBlock('agent')!)
-
-    expect(block.data.canonicalModes).toEqual({ model: 'advanced' })
-    expect(block.subBlocks.tools.value[0].usageControl).toBe('auto')
-  })
-})
-
 describe('filterDisallowedTools', () => {
   it('assigns canonical tool modes after removing disallowed tools', () => {
     const block = createBlockFromParams(
@@ -314,6 +270,13 @@ describe('normalizeTools', () => {
       },
     ])
   })
+
+  it('defaults a custom tool reference without either permission field to Auto', () => {
+    expect(normalizeTools([{ type: 'custom-tool', customToolId: 'custom-1' }])[0]).toMatchObject({
+      usageControl: 'auto',
+      usageControlExpression: undefined,
+    })
+  })
 })
 
 describe('normalizeSubblockValue', () => {

apps/sim/lib/workflows/editing/builders.ts

@@ -1,6 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { generateId, isValidUuid } from '@sim/utils/id'
-import { isRecordLike, sortObjectKeysDeep } from '@sim/utils/object'
+import { sortObjectKeysDeep } from '@sim/utils/object'
 import {
   type BlockRetryConfig,
   normalizeBlockRetryTries,
@@ -24,7 +24,7 @@ import {
   buildDefaultCanonicalModes,
   isCanonicalPair,
 } from '@/lib/workflows/subblocks/visibility'
-import { buildAgentToolUsageControlCanonicalKey } from '@/lib/workflows/tool-input/usage-control'
+import { applyAgentToolUsageControlModes } from '@/lib/workflows/tool-input/usage-control'
 import { hasTriggerCapability } from '@/lib/workflows/triggers/trigger-utils'
 import { getBlock } from '@/blocks/registry'
 import type { BlockConfig } from '@/blocks/types'
@@ -252,6 +252,13 @@ export function createBlockFromParams(
 
     if (validatedInputs) {
       updateCanonicalModesForInputs(blockState, Object.keys(validatedInputs), blockConfig)
+      const tools = blockState.subBlocks.tools?.value
+      if (params.type === 'agent' && Array.isArray(tools)) {
+        blockState.data = {
+          ...blockState.data,
+          canonicalModes: applyAgentToolUsageControlModes(tools, blockState.data?.canonicalModes),
+        }
+      }
     }
   }
 
@@ -278,10 +285,7 @@ export function createBlockFromParams(
 }
 
 export function updateCanonicalModesForInputs(
-  block: {
-    data?: { canonicalModes?: Record<string, 'basic' | 'advanced'> }
-    subBlocks?: Record<string, { value?: unknown }>
-  },
+  block: { data?: { canonicalModes?: Record<string, 'basic' | 'advanced'> } },
   inputKeys: string[],
   blockConfig: BlockConfig
 ): void {
@@ -312,27 +316,6 @@ export function updateCanonicalModesForInputs(
     if (!block.data.canonicalModes) block.data.canonicalModes = {}
     Object.assign(block.data.canonicalModes, canonicalModeUpdates)
   }
-  if (blockConfig.type === 'agent' && inputKeys.includes('tools')) {
-    const tools = block.subBlocks?.tools?.value
-    if (Array.isArray(tools)) {
-      const canonicalModes = { ...block.data?.canonicalModes }
-      tools.forEach((tool, index) => {
-        if (!isRecordLike(tool)) return
-        const hasFixedPermission = tool.usageControl !== undefined
-        const hasPermissionExpression = tool.usageControlExpression !== undefined
-        /** A round trip can include both the active value and the dormant alternative. */
-        if (hasFixedPermission && hasPermissionExpression) return
-
-        const key = buildAgentToolUsageControlCanonicalKey(index)
-        if (hasPermissionExpression) {
-          canonicalModes[key] = 'advanced'
-        } else {
-          delete canonicalModes[key]
-        }
-      })
-      block.data = { ...block.data, canonicalModes }
-    }
-  }
 }
 
 /**

apps/sim/lib/workflows/editing/engine.ts

@@ -5,6 +5,7 @@ import type { PermissionGroupConfig } from '@/lib/permission-groups/fields'
 import { coerceObjectArray } from '@/lib/workflows/persistence/remap-internal-ids'
 import { isValidKey } from '@/lib/workflows/sanitization/key-validation'
 import { reindexRewrittenToolCanonicalModes } from '@/lib/workflows/subblocks/visibility'
+import { applyAgentToolUsageControlModes } from '@/lib/workflows/tool-input/usage-control'
 import { getBlock } from '@/blocks/registry'
 import { validateEdges } from '@/stores/workflows/workflow/edge-validation'
 import { generateLoopBlocks, generateParallelBlocks } from '@/stores/workflows/workflow/utils'
@@ -265,6 +266,10 @@ export function applyOperationsToWorkflowState(
     workflowState.blocks as Record<string, BlockState> | undefined,
     modifiedState.blocks as Record<string, BlockState> | undefined
   )
+  applyAgentToolUsageControlModesAfterEdits(
+    workflowState.blocks as Record<string, BlockState> | undefined,
+    modifiedState.blocks as Record<string, BlockState> | undefined
+  )
 
   // Regenerate loops and parallels after modifications
   ;(modifiedState as any).loops = generateLoopBlocks((modifiedState as any).blocks)
@@ -336,6 +341,31 @@ function reindexToolCanonicalModesAfterEdits(
   }
 }
 
+/**
+ * An agent tool's Permission Mode follows the fields its rewritten entry supplies. Runs after
+ * {@link reindexToolCanonicalModesAfterEdits} so each choice lands on its tool's final position
+ * rather than being moved again as if it were keyed by the original list.
+ */
+function applyAgentToolUsageControlModesAfterEdits(
+  originalBlocks: Record<string, BlockState> | undefined,
+  blocks: Record<string, BlockState> | undefined
+): void {
+  for (const [blockId, block] of Object.entries(blocks ?? {})) {
+    if (block.type !== 'agent') continue
+    const tools = coerceObjectArray(block.subBlocks?.tools?.value).array
+    if (!tools) continue
+    const originalTools = coerceObjectArray(
+      originalBlocks?.[blockId]?.subBlocks?.tools?.value
+    ).array
+    if (originalTools && isEqual(originalTools, tools)) continue
+
+    block.data = {
+      ...block.data,
+      canonicalModes: applyAgentToolUsageControlModes(tools, block.data?.canonicalModes),
+    }
+  }
+}
+
 /**
  * Resolves pending forward-reference connections recorded on block.data.
  *

apps/sim/lib/workflows/editing/operations.test.ts

@@ -1344,4 +1344,42 @@ describe('tool canonical-mode reindexing', () => {
     expect(editTools(workflow, [selectorTool])).toEqual({ '0:projectId': 'basic' })
     expect(editTools(workflow, [])).toEqual({})
   })
+
+  it('selects a Permission Mode at the final position of a tool the edit also moves', () => {
+    const fixedTool = { ...selectorTool, usageControl: 'force' }
+    const expressionTool = {
+      type: 'jira',
+      operation: 'jira_get_issue',
+      title: 'Variable',
+      params: { manualProjectId: '{{PROJECT}}' },
+      usageControlExpression: '<start.toolMode>',
+      isExpanded: false,
+    }
+    const workflow = agentWithTools([expressionTool, fixedTool], {
+      '0:agentToolUsageControl': 'advanced',
+    })
+
+    expect(editTools(workflow, [fixedTool, expressionTool])).toEqual({
+      '1:agentToolUsageControl': 'advanced',
+    })
+  })
+
+  it('keeps a round-tripped Permission Mode with its tool when an explicit choice moves past it', () => {
+    const roundTripTool = { ...selectorTool, usageControlExpression: '<start.dormant>' }
+    const expressionTool = {
+      type: 'jira',
+      operation: 'jira_get_issue',
+      title: 'Variable',
+      params: { manualProjectId: '{{PROJECT}}' },
+      usageControlExpression: '<start.toolMode>',
+      isExpanded: false,
+    }
+    const workflow = agentWithTools([roundTripTool, expressionTool], {
+      '1:agentToolUsageControl': 'advanced',
+    })
+
+    expect(editTools(workflow, [expressionTool, roundTripTool])).toEqual({
+      '0:agentToolUsageControl': 'advanced',
+    })
+  })
 })

apps/sim/lib/workflows/tool-input/usage-control.test.ts

@@ -4,11 +4,38 @@
 import { describe, expect, it } from 'vitest'
 import { parseStoredToolInputValue } from '@/lib/workflows/tool-input/types'
 import {
+  applyAgentToolUsageControlModes,
   buildAgentToolUsageControlCanonicalKey,
   getAgentToolUsageControlMode,
   resolveAgentToolUsageControl,
 } from '@/lib/workflows/tool-input/usage-control'
 
+describe('applyAgentToolUsageControlModes', () => {
+  it('selects Variable for an expression alone and Selector for a fixed value alone', () => {
+    expect(
+      applyAgentToolUsageControlModes(
+        [{ usageControl: 'force' }, { usageControlExpression: '<start.toolMode>' }],
+        { '0:agentToolUsageControl': 'advanced', model: 'advanced' }
+      )
+    ).toEqual({ '1:agentToolUsageControl': 'advanced', model: 'advanced' })
+  })
+
+  it('keeps the current mode of a tool that carries both values', () => {
+    const modes = { '1:agentToolUsageControl': 'advanced', model: 'advanced' } as const
+    const repeated = { usageControl: 'force', usageControlExpression: 'none' }
+
+    expect(applyAgentToolUsageControlModes([repeated, repeated], modes)).toEqual(modes)
+  })
+
+  it('returns to Selector when a tool omits both values', () => {
+    expect(
+      applyAgentToolUsageControlModes([{ type: 'custom-tool' }], {
+        '0:agentToolUsageControl': 'advanced',
+      })
+    ).toEqual({})
+  })
+})
+
 describe('agent tool usage control', () => {
   it('defaults legacy tools to Auto in basic mode', () => {
     expect(resolveAgentToolUsageControl({}, 0)).toBe('auto')

apps/sim/lib/workflows/tool-input/usage-control.ts

@@ -1,3 +1,4 @@
+import { isRecordLike } from '@sim/utils/object'
 import type { CanonicalMode, CanonicalModeOverrides } from '@/lib/workflows/subblocks/visibility'
 import type { ToolUsageControl } from '@/providers/types'
 
@@ -22,6 +23,36 @@ export function getAgentToolUsageControlMode(
     : 'basic'
 }
 
+/**
+ * Selects each agent tool's Permission Mode from the fields a serialized tool array supplies: an
+ * expression alone selects Variable, and a fixed value alone (or neither) selects Selector. A tool
+ * carrying both keeps its current mode, since a round trip includes the dormant alternative.
+ * `canonicalModes` must already be keyed by the tools' final positions.
+ */
+export function applyAgentToolUsageControlModes(
+  tools: readonly unknown[],
+  canonicalModes: CanonicalModeOverrides | undefined
+): Record<string, CanonicalMode> {
+  const result: Record<string, CanonicalMode> = {}
+  for (const [key, mode] of Object.entries(canonicalModes ?? {})) {
+    if (mode) result[key] = mode
+  }
+  tools.forEach((tool, index) => {
+    if (!isRecordLike(tool)) return
+    const hasFixedValue = tool.usageControl !== undefined
+    const hasExpression = tool.usageControlExpression !== undefined
+    if (hasFixedValue && hasExpression) return
+
+    const key = buildAgentToolUsageControlCanonicalKey(index)
+    if (hasExpression) {
+      result[key] = 'advanced'
+    } else {
+      delete result[key]
+    }
+  })
+  return result
+}
+
 export function resolveAgentToolUsageControl(
   tool: AgentToolUsageControlInput,
   toolIndex: number,