refactor(managed-agent): move its four pickers onto registered selectors

All four read one route distinguished only by `resource`, with the credential
pulled from the store by name. They are now `managedAgent.agents` / `.vaults` /
`.memoryStores` / `.environments`, and `lib/managed-agents/subblock-options.ts`
is deleted entirely.

The environment filter (cloud vs self_hosted expose different fields, so mixing
them offers choices the rest of the form cannot honour) moves into the selector
with `environmentType` on the context.

Also decouples two things `canonicalParamId` was conflating. It is both a
block's serialized PARAM NAME and the key `buildSelectorContextFromBlock` reads,
so making this block's pickers resolvable appeared to require renaming its
shipped `credential` param to `oauthCredential` — a rename that would change the
serialized shape of every existing managed_agent block, and one that
`blocks.test.ts` correctly refused. A picker should not be able to force a param
rename, so the context now reads a credential off the subblock TYPE when no
canonical id supplied one. It only fills a gap: a block that declares
`canonicalParamId: 'oauthCredential'` has already resolved it, including the
basic/advanced active-member logic the type check cannot express.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/blocks/blocks/managed_agent.ts

@@ -1,10 +1,4 @@
 import { ClaudeIcon } from '@/components/icons'
-import {
-  fetchManagedAgentAgentOptions,
-  fetchManagedAgentEnvironmentOptions,
-  fetchManagedAgentMemoryStoreOptions,
-  fetchManagedAgentVaultOptions,
-} from '@/lib/managed-agents/subblock-options'
 import type { BlockConfig, BlockMeta } from '@/blocks/types'
 import { AuthMode, IntegrationType } from '@/blocks/types'
 
@@ -264,6 +258,7 @@ export const ManagedAgentBlock: BlockConfig = {
       id: 'environmentType',
       title: 'Environment type',
       type: 'dropdown',
+      canonicalParamId: 'environmentType',
       required: true,
       condition: forOperations(SESSION_STARTING_OPERATIONS),
       options: [
@@ -278,25 +273,23 @@ export const ManagedAgentBlock: BlockConfig = {
       id: 'agent',
       title: 'Agent',
       type: 'combobox',
+      selectorKey: 'managedAgent.agents',
       required: true,
       placeholder: 'Select an agent from your Claude workspace…',
       commandSearchable: true,
-      options: [],
       dependsOn: ['credential'],
       condition: forOperations(SESSION_STARTING_OPERATIONS),
-      fetchOptions: fetchManagedAgentAgentOptions,
     },
     {
       id: 'environment',
       title: 'Environment',
       type: 'combobox',
+      selectorKey: 'managedAgent.environments',
       required: true,
       placeholder: 'Select an environment…',
       commandSearchable: true,
-      options: [],
       dependsOn: ['credential', 'environmentType'],
       condition: forOperations(SESSION_STARTING_OPERATIONS),
-      fetchOptions: fetchManagedAgentEnvironmentOptions,
     },
     {
       id: 'userMessage',
@@ -407,15 +400,14 @@ export const ManagedAgentBlock: BlockConfig = {
       id: 'vaults',
       title: 'Credential vaults',
       type: 'dropdown',
+      selectorKey: 'managedAgent.vaults',
       required: false,
       mode: 'advanced',
       placeholder: 'Optional — pick zero or more OAuth vaults',
       searchable: true,
       multiSelect: true,
-      options: [],
       dependsOn: ['credential'],
       condition: forOperations(SESSION_STARTING_OPERATIONS),
-      fetchOptions: fetchManagedAgentVaultOptions,
     },
     {
       id: 'vaultsAck',
@@ -431,11 +423,11 @@ export const ManagedAgentBlock: BlockConfig = {
       id: 'memoryStoreId',
       title: 'Memory store',
       type: 'combobox',
+      selectorKey: 'managedAgent.memoryStores',
       required: false,
       mode: 'advanced',
       placeholder: 'Optional — pick a memory store',
       commandSearchable: true,
-      options: [],
       dependsOn: ['credential'],
       // Cloud only: memory stores attach as `resources[]`, which self-hosted
       // rejects. A self-hosted worker that uses a store reads its id from a
@@ -444,7 +436,6 @@ export const ManagedAgentBlock: BlockConfig = {
         field: 'environmentType',
         value: 'cloud',
       }),
-      fetchOptions: fetchManagedAgentMemoryStoreOptions,
     },
     {
       id: 'memoryAccess',

apps/sim/hooks/selectors/providers/managed-agent/selectors.ts

@@ -0,0 +1,77 @@
+import { requestJson } from '@/lib/api/client/request'
+import {
+  listManagedAgentOptionsContract,
+  type ManagedAgentResource,
+} from '@/lib/api/contracts/managed-agents'
+import { ensureCredential, SELECTOR_STALE } from '@/hooks/selectors/providers/shared'
+import type {
+  SelectorDefinition,
+  SelectorKey,
+  SelectorOption,
+  SelectorQueryArgs,
+} from '@/hooks/selectors/types'
+
+/**
+ * All four Managed Agent pickers read one route, distinguished only by `resource`. The route
+ * decrypts the selected Claude Platform credential server-side, so the API key never reaches
+ * the browser — which is why these cannot fall back to a plain client fetch.
+ */
+async function listResource(
+  key: SelectorKey,
+  resource: ManagedAgentResource,
+  { context, signal }: SelectorQueryArgs
+): Promise<SelectorOption[]> {
+  const credentialId = ensureCredential(context, key)
+  const { options } = await requestJson(listManagedAgentOptionsContract, {
+    query: { credentialId, resource },
+    signal,
+  })
+  return options
+}
+
+function resourceSelector(key: SelectorKey, resource: ManagedAgentResource): SelectorDefinition {
+  return {
+    key,
+    contracts: [listManagedAgentOptionsContract],
+    staleTime: SELECTOR_STALE,
+    getQueryKey: ({ context }: SelectorQueryArgs) => [
+      'selectors',
+      key,
+      context.oauthCredential ?? 'none',
+    ],
+    enabled: ({ context }) => Boolean(context.oauthCredential),
+    fetchList: (args: SelectorQueryArgs) => listResource(key, resource, args),
+  }
+}
+
+export const managedAgentSelectors = {
+  'managedAgent.agents': resourceSelector('managedAgent.agents', 'agents'),
+  'managedAgent.vaults': resourceSelector('managedAgent.vaults', 'vaults'),
+  'managedAgent.memoryStores': resourceSelector('managedAgent.memoryStores', 'memory-stores'),
+  /**
+   * Environments are filtered to the selected deployment mode: cloud and self-hosted expose
+   * different fields (self-hosted rejects `resources`), so mixing them offers choices the rest
+   * of the form cannot honour. An option whose type the API leaves unset is kept either way.
+   */
+  'managedAgent.environments': {
+    key: 'managedAgent.environments',
+    contracts: [listManagedAgentOptionsContract],
+    staleTime: SELECTOR_STALE,
+    getQueryKey: ({ context }: SelectorQueryArgs) => [
+      'selectors',
+      'managedAgent.environments',
+      context.oauthCredential ?? 'none',
+      context.environmentType ?? 'any',
+    ],
+    enabled: ({ context }) => Boolean(context.oauthCredential),
+    fetchList: async (args: SelectorQueryArgs) => {
+      const options = await listResource('managedAgent.environments', 'environments', args)
+      const mode = args.context.environmentType
+      if (mode !== 'cloud' && mode !== 'self_hosted') return options
+      return options.filter((option) => {
+        const type = (option as { type?: string }).type
+        return type === undefined || type === mode
+      })
+    },
+  },
+} satisfies Partial<Record<SelectorKey, SelectorDefinition>>

apps/sim/hooks/selectors/registry.ts

@@ -13,6 +13,7 @@ import { jiraSelectors } from '@/hooks/selectors/providers/jira/selectors'
 import { jsmSelectors } from '@/hooks/selectors/providers/jsm/selectors'
 import { knowledgeSelectors } from '@/hooks/selectors/providers/knowledge/selectors'
 import { linearSelectors } from '@/hooks/selectors/providers/linear/selectors'
+import { managedAgentSelectors } from '@/hooks/selectors/providers/managed-agent/selectors'
 import { microsoftSelectors } from '@/hooks/selectors/providers/microsoft/selectors'
 import { mondaySelectors } from '@/hooks/selectors/providers/monday/selectors'
 import { netsuiteSelectors } from '@/hooks/selectors/providers/netsuite/selectors'
@@ -45,6 +46,7 @@ export const selectorRegistry = {
   ...jsmSelectors,
   ...googleSelectors,
   ...hubspotSelectors,
+  ...managedAgentSelectors,
   ...microsoftSelectors,
   ...notionSelectors,
   ...pipedriveSelectors,

apps/sim/hooks/selectors/types.ts

@@ -20,6 +20,10 @@ export type SelectorKey =
   | 'clickup.lists'
   | 'confluence.spaces'
   | 'google.tasks.lists'
+  | 'managedAgent.agents'
+  | 'managedAgent.environments'
+  | 'managedAgent.vaults'
+  | 'managedAgent.memoryStores'
   | 'hubspot.lists'
   | 'hubspot.owners'
   | 'hubspot.pipelines'
@@ -140,6 +144,11 @@ export interface SelectorContext {
   customObjectTypeId?: string
   /** HubSpot pipeline whose stages a stage picker enumerates. */
   pipelineId?: string
+  /**
+   * Managed Agent deployment mode (`cloud` | `self_hosted`). The two expose different fields,
+   * so an environment list is filtered to the selected mode rather than mixing them.
+   */
+  environmentType?: string
 }
 
 export interface SelectorQueryArgs {

apps/sim/lib/managed-agents/subblock-options.ts

@@ -45,6 +45,7 @@ export const SELECTOR_CONTEXT_FIELDS = new Set<keyof SelectorContext>([
   'objectType',
   'customObjectTypeId',
   'pipelineId',
+  'environmentType',
 ])
 
 /**
@@ -94,5 +95,26 @@ export function buildSelectorContextFromBlock(
     setField(subBlockId, subBlock?.value)
   }
 
+  // A credential field IS the oauth credential, whatever the block calls its subblock. Most
+  // blocks say so with `canonicalParamId: 'oauthCredential'`, but that id is also the block's
+  // serialized param name — so requiring it would mean renaming a shipped block's param just
+  // to make its pickers resolvable, which is not a rename any picker should be able to force.
+  // Reading it off the subblock TYPE keeps the two decisions independent.
+  //
+  // Only fills a gap: a block that does declare the canonical id has already set it above,
+  // including the basic/advanced active-member resolution this loop cannot express.
+  if (!context.oauthCredential) {
+    for (const [subBlockId, subBlock] of Object.entries(subBlocks)) {
+      if (blockConfig.subBlocks.find((cfg) => cfg.id === subBlockId)?.type !== 'oauth-input') {
+        continue
+      }
+      const value = subBlock?.value
+      if (typeof value === 'string' && value) {
+        context.oauthCredential = value
+        break
+      }
+    }
+  }
+
   return context
 }