improvement(tools): decide pinned fields by subblock condition, not param name

The membership check asked a proxy question — "does this subblock's id match a
declared tool param?" — when the real one is "is this field part of the
operation the tool was selected for". 41 blocks rename a field on its way to the
tool inside `tools.config.params`, so their pinned values failed the name match
and were never stated. Datadog's `listMonitorName` feeds the tool param `name`;
it is now stated as Filter by Name "CPU" instead of dropped.

`evaluateSubBlockCondition` answers the real question directly and survives a
rename, because it never looks at tool param names. It also still excludes the
stale-field case the name match was introduced for: Gmail's to/subject/body are
gated to the send operations, so a block switched to Read drops them.

The operation selector and trigger-mode subblocks are excluded explicitly — they
carry values but do not constrain the call.

Trigger mode is skipped per subblock rather than blocking its canonical group.
Gmail puts `triggerCredentials` in the same group as `credential`, and blocking
the group dropped the account from every Gmail tool. Only value-level
disqualifiers — password, hidden, unstateable type — block a whole group, since
a canonical group shares one value.

Author: waleedlatif1

apps/sim/providers/tool-binding.test.ts

@@ -29,6 +29,7 @@ const collect = (over: Partial<CollectInput>) =>
     subBlocks: [],
     userProvidedParams: {},
     resolvedResourceParams: {},
+    conditionValues: {},
     ...sourceOptions,
     ...over,
   } as CollectInput)
@@ -127,18 +128,101 @@ describe('collectToolPinnedFields', () => {
   it('omits a field left over from a different operation on the same block', () => {
     const fields = collect({
       subBlocks: [
-        sub({ id: 'folder', title: 'Label', type: 'folder-selector' }),
-        sub({ id: 'to', title: 'To', type: 'short-input' }),
-        sub({ id: 'body', title: 'Body', type: 'long-input' }),
+        sub({
+          id: 'folder',
+          title: 'Label',
+          type: 'folder-selector',
+          condition: { field: 'operation', value: 'read_gmail' },
+        }),
+        sub({
+          id: 'to',
+          title: 'To',
+          type: 'short-input',
+          condition: { field: 'operation', value: ['send_gmail', 'draft_gmail'] },
+        }),
+        sub({
+          id: 'body',
+          title: 'Body',
+          type: 'long-input',
+          condition: { field: 'operation', value: ['send_gmail', 'draft_gmail'] },
+        }),
       ],
       // A block switched from Send to Read keeps the send fields in its params.
       userProvidedParams: { folder: 'INBOX', to: 'someone@example.com', body: 'stale draft' },
-      toolParams: toolParams('folder', 'unreadOnly', 'maxResults'),
+      toolParams: toolParams('folder'),
+      conditionValues: { operation: 'read_gmail', folder: 'INBOX' },
     })
 
     expect(fields).toEqual([{ title: 'Label', value: 'INBOX' }])
   })
 
+  it('states a field the block renames on its way to the tool', () => {
+    // Datadog's `listMonitorName` subblock feeds the tool param `name`. Matching against the
+    // tool's declared params would drop it; the subblock's own condition does not.
+    const fields = collect({
+      subBlocks: [
+        sub({
+          id: 'listMonitorName',
+          title: 'Filter by Name',
+          type: 'short-input',
+          condition: { field: 'operation', value: 'datadog_list_monitors' },
+        }),
+      ],
+      userProvidedParams: { listMonitorName: 'CPU' },
+      toolParams: toolParams('name', 'tags', 'page'),
+      conditionValues: { operation: 'datadog_list_monitors', listMonitorName: 'CPU' },
+    })
+
+    expect(fields).toEqual([{ title: 'Filter by Name', value: 'CPU' }])
+  })
+
+  it('never states the operation selector itself', () => {
+    expect(
+      collect({
+        subBlocks: [sub({ id: 'operation', title: 'Operation', type: 'dropdown' })],
+        userProvidedParams: { operation: 'read_gmail' },
+        conditionValues: { operation: 'read_gmail' },
+      })
+    ).toEqual([])
+  })
+
+  it('still states the action field when a trigger sibling shares its canonical group', () => {
+    // Gmail puts `triggerCredentials` in the same canonical group as `credential`. A trigger
+    // sibling is a different surface, not a statement about the value, so it must not block it.
+    expect(
+      collect({
+        subBlocks: [
+          sub({
+            id: 'credential',
+            title: 'Gmail Account',
+            type: 'oauth-input',
+            canonicalParamId: 'oauthCredential',
+          }),
+          sub({
+            id: 'triggerCredentials',
+            title: 'Gmail Account',
+            type: 'oauth-input',
+            mode: 'trigger',
+            canonicalParamId: 'oauthCredential',
+          }),
+        ],
+        resolvedResourceParams: { oauthCredential: 'cred-a' },
+      })
+    ).toEqual([{ title: 'Gmail Account', resource: { kind: 'credential', id: 'cred-a' } }])
+  })
+
+  it('never states a trigger-mode field', () => {
+    expect(
+      collect({
+        subBlocks: [
+          sub({ id: 'selectedTriggerId', title: 'Trigger', type: 'short-input', mode: 'trigger' }),
+        ],
+        userProvidedParams: { selectedTriggerId: 'gmail_new_email' },
+        conditionValues: {},
+      })
+    ).toEqual([])
+  })
+
   it('respects a hidden tool-param declaration', () => {
     expect(
       collect({
@@ -226,13 +310,14 @@ describe('collectToolPinnedFields', () => {
     }
   })
 
-  it('states nothing when the caller omits the tool param map', () => {
+  it('states an unconditional field even when the tool does not declare it', () => {
+    // No condition means the field applies to every operation the block supports.
     expect(
       collect({
         subBlocks: [sub({ id: 'folder', title: 'Label', type: 'folder-selector' })],
         userProvidedParams: { folder: 'INBOX' },
       })
-    ).toEqual([])
+    ).toEqual([{ title: 'Label', value: 'INBOX' }])
   })
 
   it('drops a field whose title sanitizes to nothing', () => {

apps/sim/providers/tool-binding.ts

@@ -1,5 +1,9 @@
 import { truncate } from '@sim/utils/string'
 import type { SubBlockType } from '@sim/workflow-types/blocks'
+import {
+  evaluateSubBlockCondition,
+  isTriggerModeSubBlock,
+} from '@/lib/workflows/subblocks/visibility'
 import type { SubBlockConfig } from '@/blocks/types'
 import { isNonEmpty } from '@/tools/merge-params'
 
@@ -51,6 +55,12 @@ const UNSTATEABLE_SUBBLOCK_TYPES: ReadonlySet<string> = new Set([
   'secrets-management',
 ])
 
+/**
+ * The operation selector itself. It is a real subblock with a value, but it names the tool rather
+ * than constraining it, so stating it would only repeat what the tool id already says.
+ */
+const OPERATION_PARAM_ID = 'operation'
+
 /**
  * Secret-ish names `isPasswordParameter` does not cover. It is tuned to Sim-authored param ids
  * (`password`, `apiKey`, `token`, `secret`, `key`, `credential`, …), but this module also states
@@ -154,11 +164,13 @@ interface CollectToolPinnedFieldsInput extends PinnedFieldSourceOptions {
   userProvidedParams: Record<string, unknown>
   /** Params after canonical basic/advanced pairs have collapsed onto their canonical id. */
   resolvedResourceParams: Record<string, unknown>
+  /** The selected tool's declared params, consulted only for `hidden` visibility. */
+  toolParams?: Record<string, { visibility?: string } | undefined>
   /**
-   * The selected tool's declared params. A block's subblocks span every operation it supports, so
-   * this is what keeps a field left over from another operation out of this tool's description.
+   * Values the subblock conditions are evaluated against — the configured params plus the selected
+   * operation, matching how the block's own tool selector resolves them.
    */
-  toolParams?: Record<string, { visibility?: string } | undefined>
+  conditionValues: Record<string, unknown>
   /** `toolEnrichment.dependsOn`, when the tool rewrote its own description from that param. */
   selfDescribedParamId?: string
   /** Name for a `workflow` field the caller already fetched. */
@@ -182,6 +194,7 @@ export function collectToolPinnedFields(input: CollectToolPinnedFieldsInput): To
     selfDescribedParamId,
     workflowLabel,
     formatParamLabel,
+    conditionValues,
   } = input
   if (!subBlocks?.length) return []
 
@@ -199,6 +212,10 @@ export function collectToolPinnedFields(input: CollectToolPinnedFieldsInput): To
     const paramId = subBlock.canonicalParamId ?? subBlock.id
     const kind = RESOURCE_SUBBLOCK_KINDS[subBlock.type]
     if (kind) kindByParamId.set(paramId, kind)
+    // Only value-level disqualifiers block the whole group: a canonical group shares one value, so
+    // if any half calls it secret or unstateable, the value is. Trigger mode is a property of the
+    // SURFACE, not the value — several blocks put a trigger-mode credential in the same canonical
+    // group as the action one — so it is skipped per subblock below instead.
     if (subBlock.password || subBlock.hidden || UNSTATEABLE_SUBBLOCK_TYPES.has(subBlock.type)) {
       blockedParamIds.add(paramId)
     }
@@ -208,6 +225,10 @@ export function collectToolPinnedFields(input: CollectToolPinnedFieldsInput): To
   const seenParamIds = new Set<string>()
 
   for (const subBlock of subBlocks) {
+    // Not a candidate, and deliberately without claiming the param: an action-mode sibling in the
+    // same canonical group still has to be considered.
+    if (isTriggerModeSubBlock(subBlock)) continue
+
     const paramId = subBlock.canonicalParamId ?? subBlock.id
     if (seenParamIds.has(paramId)) continue
     if (selfDescribedParamId && paramId === selfDescribedParamId) continue
@@ -216,15 +237,19 @@ export function collectToolPinnedFields(input: CollectToolPinnedFieldsInput): To
 
     const kind = kindByParamId.get(paramId)
 
-    // Both checks apply only to a literal. A resource never reaches the model as its configured
-    // value — only as a name looked up from it — so the secret-name heuristic would misfire
+    // These apply only to a literal. A resource never reaches the model as its configured value —
+    // only as a name looked up from it — so the secret-name heuristic would misfire here
     // (`isPasswordParameter` matches `oauthCredential`), and a resource is a block-level input
-    // that is legitimately absent from the tool's own params. Anything else must belong to the
-    // selected tool, or it is left over from a different operation on the same block.
+    // legitimately absent from the tool's own params.
     if (!kind) {
+      if (paramId === OPERATION_PARAM_ID) continue
       if (isSecretParamId(paramId, input)) continue
-      const declared = toolParams?.[paramId]
-      if (!declared || declared.visibility === 'hidden') continue
+      if (toolParams?.[paramId]?.visibility === 'hidden') continue
+      // A block's subblocks span every operation it supports, so a field belonging to a different
+      // operation must not be advertised as this tool's constraint. The subblock's own condition is
+      // exactly that statement, and unlike matching against the tool's param names it survives a
+      // block that renames a field on its way to the tool.
+      if (!evaluateSubBlockCondition(subBlock.condition, conditionValues)) continue
     }
 
     const raw = subBlock.canonicalParamId

apps/sim/providers/utils.ts

@@ -910,6 +910,12 @@ export async function transformBlockTool(
       userProvidedParams,
       resolvedResourceParams,
       toolParams: toolConfig.params,
+      // Matches how the block's own tool selector resolves the operation (see `tools.config.tool`
+      // above): stored params, with the agent's selected operation taking precedence.
+      conditionValues: {
+        ...userProvidedParams,
+        ...(selectedOperation ? { operation: selectedOperation } : {}),
+      },
       selfDescribedParamId,
       workflowLabel,
       formatParamLabel: formatParameterLabel,