feat(agent): allow variable tool permission modes

[j15z]

Summary

Let an agent tool's Permission Mode use a fixed selector or a variable such as <start.toolMode>. Resolve the active expression before tool filtering and reject invalid values before provider or tool work. Keep the fixed choice and expression separately, add the selector/variable toggle in the expanded tool controls, and support explicit mode selection through API/Copilot edits. Preserve the expression through workflow search and import/export. No feature flag.

Companion: simstudioai/mothership#488.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

411 tests pass across nine focused suites, covering fixed/variable resolution, invalid values, secret tracking, API mode selection and unchanged round trips, import, and search. App and CLI type checks, changed-file lint, the API validation audit, and OpenAPI/CLI generated-artifact checks pass.

Existing limitations remain: API edits that reorder tools do not move their saved selector/variable modes with them, and editor reorders still save the tools and mode map separately. This change does not fix those behaviors. Earlier Chrome/CLI testing covered the feature; browser tests were not repeated for this revision.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

No screenshots attached.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 13, 2026 12:36am UTC

[j15z]

@greptile

[j15z]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previously reported per-subblock ordering race is fixed and no new actionable failures remain.

Summary

• Resolves variable permission expressions before tool filtering and rejects invalid resolved modes.
• Preserves tool permission settings and canonical mode indexes across array edits and workflow transformations.
• Excludes disabled tools from discovery and execution.
• Makes reordered tool arrays and their canonical modes a single collaborative persistence operation.
• Improves realtime save ordering, import error reporting, and interrupted CLI response guidance.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Editor[Workflow editor] --> Stored[Stored tool configuration]
  Stored --> Fixed{Permission mode}
  Fixed -->|Basic| Selector[Fixed auto / force / none]
  Fixed -->|Advanced| Resolver[Resolve variable expression]
  Resolver --> Validate[Validate resolved mode]
  Selector --> Filter[Filter disabled tools]
  Validate --> Filter
  Filter --> Provider[Provider tool request]
  Editor --> Realtime[Realtime collaboration]
  Realtime --> Queue[Per-subblock serialized flush]
  Queue --> DB[(Workflow persistence)]

Loading

_{Reviews (9) · Last reviewed commit: "fix(realtime): keep debounced subblock s..."}

[github-actions]

⚠️ Cross-repo companion check

One or more companion PRs aren't merged into staging yet. Merging this without them will leave copilot and sim out of sync — merge them in lockstep.

• ❌ simstudioai/mothership#488 — OPEN, not merged (targets staging) — feat(workflow): document variable agent tool permissions

[j15z]

@greptile

[j15z]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

[j15z]

@greptile

[j15z]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

[j15z]

@greptile

[j15z]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

[j15z]

@greptile

[j15z]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.