Gate Search Assistant integration lookups with AppConfig

[Sg312]

Summary

Search Assistant can resolve people/resource IDs and read structured details through 39 existing read-only integration operations. The AppConfig flag mothership-search-integration-tools controls gateway discovery, calls, and the corresponding worker prompt instructions. It defaults off and has no environment-variable fallback.

When disabled, new Search requests omit the integration capability; discovery and execution also recheck the flag so an existing conversation cannot keep using it after the updated configuration is observed. The flag uses the shared AppConfig polling/cache behavior, including last-known-good values during AppConfig outages; it is a rollout toggle, while credential and authorization checks remain independent. Build and Plan retain their current integration tools. When enabled, Search uses the person's existing connected account and credential/visibility rules. Native results return normally; no OAuth scopes or additional Search result filtering are introduced. Writes and arbitrary MCP calls remain unavailable.

Sources: Slack, Gmail, Calendar, Drive, Sheets, Jira, Confluence, GitHub, GitLab, and Coda. GitLab personal-token operations retain the existing workspace-only restriction. Gmail labels and GitHub review threads are exposed through their existing shared tool catalogs. Generated-doc discovery now handles inherited version-mapped lists with appended operations.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other

Testing

• 492 focused and CI-regression tests passed after rebasing onto dev; includes on/off/on capability changes, revoked discovery/calls, and unchanged Build/Plan behavior.
• New flag regressions failed before the guards were implemented, then passed.
• Preserved dev's existing test-runner configuration; removing the inherited global mock-clearing override fixed the eight CI failures in older dev suites.
• Sim typecheck, all 49 repository audits (including generated docs), lint, and diff checks passed.
• Existing durable worker coverage verifies both catalog-free Search prompts and native integration call/checkpoint handling.
• Live provider accounts have not been exercised; this rollout enables that testing in dev.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Companion PR

Companion: https://github.com/simstudioai/mothership/pull/530

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 25, 2026 6:23pm UTC

[github-actions]

⚠️ Cross-repo companion check

One or more companion PRs aren't merged into staging yet. Merging this without them will leave copilot and sim out of sync — merge them in lockstep.

• ❌ simstudioai/mothership#530 — OPEN, not merged (targets staging) — Enable Search Assistant integration lookups

[cubic-dev-ai]

No issues found across 13 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 3/5

[Medium risk] Gates Search Assistant integration lookups with a feature flag.

The PR is not yet safe to merge because Search integration access may remain available after flag revocation during an AppConfig outage.

Findings

1.   Revoked access can persist ▶

Summary

The PR makes selected read-only integration lookups available to Search Assistant behind an AppConfig-only flag, with separate payload, discovery, and execution checks. It also updates shared tool exposure and generated integration documentation.

• Search sends the integration capability only while the flag is enabled; Build and Plan keep their existing catalog behavior.
• Discovery and execution apply the Search allowlist and connected-account restrictions, but their flag checks can retain an enabled AppConfig value after revocation during refresh failures.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Search request] --> B{AppConfig flag}
  B -->|enabled| C[Integration capability in payload]
  B -->|disabled| D[No integration capability]
  C --> E[Catalog discovery checks flag]
  E --> F[Allowed read-only operation]
  F --> G[Executor checks flag]
  G --> H[Connected-account tool call]

Loading

_{Reviews (2) · Last reviewed commit: "Gate Search integration tools with AppCo..."}

[Sg312]

@greptile-apps please re-review the latest head d8a7eeb. Search integration capability is now gated by an AppConfig-only flag, with runtime discovery/execution revocation and regression coverage. The PR now targets dev; prior resolved findings and credential-scope limitations are documented in the description.