feat(custom-blocks): add deploy_custom_block copilot tool by TheodoreSpeaks · Pull Request #5532 · simstudioai/sim

TheodoreSpeaks · 2026-07-09T02:58:23Z

Summary

new deploy_custom_block copilot tool handler: the deploy agent can publish a deployed workflow as an org-wide custom block, update it in place (re-deploy upserts), or unpublish with action: undeploy
same gates as the REST routes: workspace admin via ensureWorkflowAccess (denied → clean "requires admin permission" message), deploy-as-block flag, enterprise plan; audit events recorded with source: copilot
iconUrl accepts a workspace file VFS path (files/icon.png) — bytes are copied into the public workspace-logos context (key prefixed so the serve route treats it as public) so the icon renders org-wide; external URLs pass through
entitlements: new computeWorkspaceEntitlements(workspaceId, userId) (flag + enterprise → ['custom-blocks'], 5s promise cache) sent as entitlements in every mothership payload — interactive chat (both branches), /api/mothership/execute (executor block + scheduled tasks), and the inbox executor. The Go side hides the custom-block tool/prompt/skill entirely when absent; fail-closed
eligibleOrgForWorkspace now takes an optional userId so per-user flag targeting matches the REST routes
synced tool catalog from the copilot repo (adds DeployCustomBlock; regen formatting churn in tool-schemas-v1.ts is from the current generator)
new getCustomBlockWithInputsByWorkflowId operation + shared row-hydration helper

Companion PR simstudioai/mothership#346 adds the tool definition, deploy agent wiring, entitlement gating, prompts, and skill — this handler is inert until that ships.

Type of Change

New feature

Testing

Tested manually end-to-end via Chat (published a block with a generated icon, verified render + upsert). 15 handler tests incl. icon ingestion + permission errors, payload pass-through tests. lint, type-check, and check:api-validation:strict pass.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Companion: simstudioai/mothership#346

vercel · 2026-07-09T02:58:28Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 10, 2026 12:54am

cursor · 2026-07-09T02:58:32Z

PR Summary

Medium Risk
Touches deployment and plan-gated copilot capabilities; real authorization depends on sim tool handlers because mothership entitlement gating is advertisement-only until the companion Go PR ships.

Overview
Adds a deploy_custom_block copilot tool so agents can publish a deployed workflow as an org custom block, update it in place, or unpublish via action: undeploy. The sim handler enforces the same rules as REST (workspace admin, deploy-as-block flag, enterprise on first publish), re-validates at execution time, records audit events, and can copy files/... icons into public workspace-logos storage.

Introduces computeWorkspaceEntitlements and threads an optional entitlements array (e.g. custom-blocks) through mothership payloads—interactive chat, /api/mothership/execute, and inbox—so Go can hide tools/prompts when absent; empty arrays omit the field. buildCopilotRequestPayload and custom-block ops gain isCustomBlocksEligible / getCustomBlockWithInputsByWorkflowId with optional userId for flag targeting aligned with REST.

Tool catalog/schemas sync adds DeployCustomBlock; xlsx moves to npm:@e965/xlsx@0.20.3.

^{Reviewed by Cursor Bugbot for commit 1ef3e8d. Bugbot is set up for automated code reviews on this repo. Configure here.}

greptile-apps · 2026-07-09T03:00:25Z

Greptile Summary

This PR adds copilot support for deploying workflows as custom blocks. The main changes are:

New deploy_custom_block tool catalog entry and server handler.
Entitlement propagation in chat, execute, and inbox mothership payloads.
Custom-block workflow lookup and shared hydration helpers.
Workspace-file icon ingestion into public icon storage.
Tests for deployment, undeploy, permissions, entitlement payloads, and validation.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts	Adds the custom-block deploy handler with permission, feature, plan, icon, and persisted-field validation.
apps/sim/lib/copilot/entitlements.ts	Adds cached workspace entitlement evaluation for mothership payloads.
apps/sim/lib/workflows/custom-blocks/operations.ts	Adds custom-block workflow lookup and reuses shared row hydration.
apps/sim/lib/copilot/tool-executor/register-handlers.ts	Registers the new custom-block deployment handler.

_{Reviews (5): Last reviewed commit: "fix(custom-blocks): enterprise gate appl..." | Re-trigger Greptile}

The dependency was pinned to a direct tarball on cdn.sheetjs.com, which now returns 403 (Cloudflare bot-challenge) to automated clients, breaking bun install in CI. npm's own xlsx is frozen at 0.18.5, so switch to the @e965/xlsx mirror which republishes the identical 0.20.3 CDN build to the npm registry. No code changes needed — all imports use bare 'xlsx'.

…ent recipe

github-actions · 2026-07-10T00:37:11Z

⚠️ Cross-repo companion check

One or more companion PRs aren't merged into staging yet. Merging this without them will leave copilot and sim out of sync — merge them in lockstep.

❌ simstudioai/mothership#346 — OPEN, not merged (targets staging) — feat(deploy): add deploy_custom_block tool, skill, and prompts

TheodoreSpeaks · 2026-07-10T00:40:07Z

@greptile review

… bounds, whitespace name

TheodoreSpeaks · 2026-07-10T00:46:07Z

@greptile review

TheodoreSpeaks · 2026-07-10T00:49:31Z

@greptile review

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0b2184b. Configure here.}

cursor · 2026-07-10T00:52:14Z

+        description: `Updated custom block "${updated.name}"`,
+        metadata: { organizationId, type: updated.type, workflowId, source: 'copilot' },
+      })
+      return { success: true, output: { ...customBlockOutput(updated, 'deploy'), updated: true } }


Enterprise gate blocks republish

Medium Severity

The copilot handler requires an enterprise plan for every deploy action, including updates to an already-published block. The REST PATCH /api/custom-blocks/[id] route only checks the deploy-as-block flag and workspace admin, so admins can still edit existing blocks after the org leaves enterprise while deploy_custom_block republish fails with an enterprise error.

^{Reviewed by Cursor Bugbot for commit 0b2184b. Configure here.}

…tching REST

TheodoreSpeaks · 2026-07-10T00:54:23Z

@greptile review

TheodoreSpeaks requested a review from a team as a code owner July 9, 2026 02:58

greptile-apps Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts

cursor Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts

vercel Bot temporarily deployed to Preview July 9, 2026 21:26 Inactive

TheodoreSpeaks added 3 commits July 9, 2026 14:27

feat(custom-blocks): add deploy_custom_block copilot tool

880d042

feat(copilot): send workspace entitlements to the mothership

0239a78

TheodoreSpeaks force-pushed the feat/custom-block-mothership branch from 2f03767 to 0239a78 Compare July 9, 2026 21:30

vercel Bot deployed to Preview July 9, 2026 21:35 View deployment

chore(copilot): sync tool catalog — plan-neutral deploy trigger text

c0942df

vercel Bot temporarily deployed to Preview July 10, 2026 00:30 Inactive

refactor(copilot): extract entitlements registry with add-an-entitlem…

ae18687

…ent recipe

vercel Bot temporarily deployed to Preview July 10, 2026 00:35 Inactive

cursor Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts

github-actions Bot added the requires-mothership-merge Has a companion PR on the mothership/copilot side — merge in lockstep label Jul 10, 2026

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts

fix(custom-blocks): review fixes — undeploy without enterprise, array…

26dd031

… bounds, whitespace name

vercel Bot temporarily deployed to Preview July 10, 2026 00:46 Inactive

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts

fix(custom-blocks): enforce per-item field limits from the REST contract

0b2184b

vercel Bot temporarily deployed to Preview July 10, 2026 00:49 Inactive

cursor Bot reviewed Jul 10, 2026

View reviewed changes

fix(custom-blocks): enterprise gate applies to first publish only, ma…

1ef3e8d

…tching REST

vercel Bot temporarily deployed to Preview July 10, 2026 00:54 Inactive

Uh oh!

Conversation

TheodoreSpeaks commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026

⚠️ Cross-repo companion check

Uh oh!

TheodoreSpeaks commented Jul 10, 2026

Uh oh!

Uh oh!

TheodoreSpeaks commented Jul 10, 2026

Uh oh!

Uh oh!

TheodoreSpeaks commented Jul 10, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 10, 2026

Choose a reason for hiding this comment

Enterprise gate blocks republish

Uh oh!

TheodoreSpeaks commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

TheodoreSpeaks commented Jul 9, 2026 •

edited

Loading

vercel Bot commented Jul 9, 2026 •

edited

Loading

cursor Bot commented Jul 9, 2026 •

edited

Loading

greptile-apps Bot commented Jul 9, 2026 •

edited

Loading