feat(workspace-forking): make every fork-clearable sub-block reconfigurable at sync time, and lint that it stays so

`clearDependentsOnRemap` wipes every transitive dependent of a remapped parent,
and a credential mapped between environments changes value on EVERY sync — so a
dependent the sync modal could not offer was re-emptied on every push, with
nowhere to set it that stuck. Setting it in the target did not survive. 36 fields
were in that state.

The selector migration closed most of it; this closes the rest. The collector now
also emits plain text dependents (`short-input` / `long-input`), which need no
selector — just somewhere to type — and the modal's no-selector branch renders
them through the same control it already drew for custom-block inputs. It
deliberately does NOT emit the manual half of a selector-backed canonical pair:
that pair already represents the field once, and its manual member is verbatim by
policy, so offering both would show one concept twice and invite writing into the
inactive half.

`forkDependentControl` replaces the direct `customBlockInputControl` call in the
view, because `fieldType` now means two different things: a custom-block input
declares a Start FIELD type (`string`, `file[]`), while every other no-selector
dependent is a canvas SUB-BLOCK whose own type says it. They agreed by accident
before; now they are classified separately.

`check:fork-dependent-coverage` fails when a sub-block under a
credential/knowledge-base/table anchor is none of: selector-backed, a canonical
pair member, a preserved name-based type, or text. 656 dependents, zero
uncovered, no baseline — verified to fail by seeding a regression. Picked up
automatically by `check:audits` (all 30 green).

Documented in `/add-block`, `/add-trigger`, and `.claude/rules/sim-integrations.md`,
including the two rules the checks enforce: a secret never enters a selector's
query key, and a fork-clearable dependent must be reconfigurable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

.agents/skills/add-block/SKILL.md

@@ -1052,3 +1052,34 @@ After creating the block, you MUST validate it against every tool it references:
 4. **Verify conditions** — each subBlock should only show for the operations that actually use it
 5. **Verify `{Service}BlockMeta` is exported** with at least 7 templates, each having `icon`, `title`, `prompt`, `modules`, `category`, and `tags`
 6. **If any tool outputs are still unknown**, explicitly tell the user instead of guessing block outputs
+
+## Option Lists: `selectorKey` or `options`, never a per-block fetcher
+
+A sub-block gets its choices from exactly one of two places. There is no third.
+
+**`selectorKey` — every remote list.** Register the list in `hooks/selectors/providers/<service>/selectors.ts`, add its key to `SelectorKey`, and point the sub-block at it. A selector is parameterized by an explicit `SelectorContext`, so the same definition serves the canvas, the workspace-fork sync modal, and anything added later.
+
+```ts
+{ id: 'triggerCredentials', type: 'oauth-input', canonicalParamId: 'oauthCredential', mode: 'trigger' },
+{ id: 'labelIds', type: 'dropdown', multiSelect: true,
+  selectorKey: 'gmail.labels', dependsOn: ['triggerCredentials'], mode: 'trigger' },
+{ id: 'manualLabelIds', type: 'short-input', mode: 'trigger-advanced' },
+```
+
+`canonicalParamId: 'oauthCredential'` on the credential sub-block is the line people forget. `buildSelectorContextFromBlock` keys the context on a sub-block's CANONICAL id, so without it `context.oauthCredential` is never set and the picker looks unfixable without reading the store. (A credential field is also recognised by its `oauth-input` TYPE as a fallback, so a block whose shipped param is already named something else does not have to rename it.)
+
+**`options` — everything else.** A static array, or a pure function of the block's own values for a list that narrows to a sibling's selection. No I/O.
+
+```ts
+options: (params) => {
+  const model = params?.values.model
+  return typeof model === 'string' ? effortsFor(model) : DEFAULT_EFFORTS
+}
+```
+
+**Never fetch inside `options`, and never reach into the stores from a block definition.** A fetcher that resolves its credential with `readSubBlockValue(blockId, ...)` only works on the canvas — every surface that is not the editor gets an empty list. `fetchOptions`/`fetchOptionById` were removed for exactly this reason.
+
+Two rules the checks enforce:
+
+- **A secret never enters a selector's `getQueryKey`.** A query key identifies a resource; a credential authorizes access to it. A credential *id* is fine; a typed password is not (see `imap.mailboxes`).
+- **A sub-block that `dependsOn` a credential / knowledge-base / table selector must be reconfigurable at fork-sync time** — a `selectorKey`, a canonical pair whose basic member is a selector, or a `short-input`/`long-input`. `bun run check:fork-dependent-coverage` fails otherwise, because a fork sync clears those fields on every push and an unofferable one can never be set anywhere that sticks.

.agents/skills/add-trigger/SKILL.md

@@ -472,6 +472,37 @@ Add to `helm/sim/values.yaml` under the existing polling cron jobs:
 - Cursor-based (changes API): `apps/sim/lib/webhooks/polling/google-drive.ts`
 - Timestamp-based: `apps/sim/lib/webhooks/polling/google-calendar.ts`
 
+## Option Lists: `selectorKey` or `options`, never a per-block fetcher
+
+A sub-block gets its choices from exactly one of two places. There is no third.
+
+**`selectorKey` — every remote list.** Register the list in `hooks/selectors/providers/<service>/selectors.ts`, add its key to `SelectorKey`, and point the sub-block at it. A selector is parameterized by an explicit `SelectorContext`, so the same definition serves the canvas, the workspace-fork sync modal, and anything added later.
+
+```ts
+{ id: 'triggerCredentials', type: 'oauth-input', canonicalParamId: 'oauthCredential', mode: 'trigger' },
+{ id: 'labelIds', type: 'dropdown', multiSelect: true,
+  selectorKey: 'gmail.labels', dependsOn: ['triggerCredentials'], mode: 'trigger' },
+{ id: 'manualLabelIds', type: 'short-input', mode: 'trigger-advanced' },
+```
+
+`canonicalParamId: 'oauthCredential'` on the credential sub-block is the line people forget. `buildSelectorContextFromBlock` keys the context on a sub-block's CANONICAL id, so without it `context.oauthCredential` is never set and the picker looks unfixable without reading the store. (A credential field is also recognised by its `oauth-input` TYPE as a fallback, so a block whose shipped param is already named something else does not have to rename it.)
+
+**`options` — everything else.** A static array, or a pure function of the block's own values for a list that narrows to a sibling's selection. No I/O.
+
+```ts
+options: (params) => {
+  const model = params?.values.model
+  return typeof model === 'string' ? effortsFor(model) : DEFAULT_EFFORTS
+}
+```
+
+**Never fetch inside `options`, and never reach into the stores from a block definition.** A fetcher that resolves its credential with `readSubBlockValue(blockId, ...)` only works on the canvas — every surface that is not the editor gets an empty list. `fetchOptions`/`fetchOptionById` were removed for exactly this reason.
+
+Two rules the checks enforce:
+
+- **A secret never enters a selector's `getQueryKey`.** A query key identifies a resource; a credential authorizes access to it. A credential *id* is fine; a typed password is not (see `imap.mailboxes`).
+- **A sub-block that `dependsOn` a credential / knowledge-base / table selector must be reconfigurable at fork-sync time** — a `selectorKey`, a canonical pair whose basic member is a selector, or a `short-input`/`long-input`. `bun run check:fork-dependent-coverage` fails otherwise, because a fork sync clears those fields on every push and an unofferable one can never be set anywhere that sticks.
+
 ## Checklist
 
 ### Trigger Definition

.claude/rules/sim-integrations.md

@@ -17,4 +17,5 @@ The full authoring instructions — tool/block/icon/trigger scaffolding, SubBloc
 - Type coercions (`Number()`, etc.) belong in `tools.config.params` (runs at execution, after variable resolution) — never in `tools.config.tool` (runs at serialization; coercing there destroys dynamic `<Block.output>` references).
 - `canonicalParamId` must NOT match any subblock's `id`, must be unique **block-wide** (groups are keyed by canonical id across every subblock and hold exactly one `basicId`, so two operations that each need a pair need two different canonical ids), and all subblocks in a canonical group must share the same `required` status. The `inputs` section and the params function reference canonical IDs, not raw subblock IDs — the serializer deletes the subblock IDs and republishes the active member's value under the canonical ID.
 - A canonical pair carries ONE concept. For files that is upload (basic) + file reference (advanced), as in Gmail attachments (`blocks/blocks/gmail.ts`). Never overload the advanced side with alternate identifiers (URL, provider asset ID) — give those their own subblocks, mark mutually exclusive sources `required: false`, and enforce "exactly one" at execution.
+- A sub-block's option list is EITHER `selectorKey` (a registered selector — the only way to load a remote list, and the only one that works off the canvas) OR `options` (a static array, or a pure function of the block's own values). Never fetch from a block definition, and never read the workflow stores there. A credential sub-block needs `canonicalParamId: 'oauthCredential'` for its dependants' selectors to resolve. A secret must never appear in a selector's `getQueryKey`. `bun run check:fork-dependent-coverage` fails a `dependsOn` under a credential/KB/table anchor that the fork sync modal cannot offer.
 - Blocks must also set the catalog/UI metadata fields `integrationType`, `tags`, `authMode`, `docsLink`, and export a `{Service}BlockMeta` — see the `/add-block` skill's BlockMeta section for details.

apps/sim/ee/workspace-forking/components/fork-sync/custom-block-input-control.ts

@@ -90,8 +90,24 @@ export const CUSTOM_BLOCK_UNSUPPORTED_HINT = 'Uploaded in the workflow — kept
  * unconfigured required field relies on.
  */
 export function isForkSyncConfigurableField(
-  field: Pick<ForkDependentReconfig, 'parentKind' | 'fieldType'>
+  field: Pick<ForkDependentReconfig, 'parentKind' | 'fieldType' | 'selectorKey'>
 ): boolean {
-  if (field.parentKind !== 'custom-block') return true
-  return customBlockInputControl(field.fieldType) !== 'unsupported'
+  return forkDependentControl(field) !== 'unsupported'
+}
+
+/**
+ * The control the sync modal renders for one dependent field.
+ *
+ * `fieldType` means two different things depending on where the field came from, so the two
+ * are classified separately rather than by one lookup that happens to agree:
+ *  - a **custom-block input** declares a Start FIELD type (`string`, `boolean`, `file[]`),
+ *    which {@link customBlockInputControl} maps through the canvas's own mapping;
+ *  - every other no-selector dependent is a canvas SUB-BLOCK, whose own type says it.
+ */
+export function forkDependentControl(
+  field: Pick<ForkDependentReconfig, 'parentKind' | 'fieldType' | 'selectorKey'>
+): CustomBlockInputControl | 'selector' {
+  if (field.selectorKey) return 'selector'
+  if (field.parentKind === 'custom-block') return customBlockInputControl(field.fieldType)
+  return field.fieldType === 'long-input' ? 'textarea' : 'input'
 }

apps/sim/ee/workspace-forking/components/fork-sync/fork-sync-view.tsx

@@ -36,7 +36,7 @@ import { forkRefKey } from '@/ee/workspace-forking/components/fork-sync/copy-rec
 import {
   CUSTOM_BLOCK_UNSUPPORTED_HINT,
   customBlockBooleanOptions,
-  customBlockInputControl,
+  forkDependentControl,
 } from '@/ee/workspace-forking/components/fork-sync/custom-block-input-control'
 import { CustomBlockInputField } from '@/ee/workspace-forking/components/fork-sync/custom-block-input-field'
 import { DependentFieldSelector } from '@/ee/workspace-forking/components/fork-sync/dependent-field-selector'
@@ -221,15 +221,18 @@ function DependentSelector({
       : effectiveDependentValue(f, state, parentChanged)
   const baselineValueFor = (f: ForkDependentReconfig) => effectiveValueIn(f, {})
   const effectiveValue = (f: ForkDependentReconfig) => effectiveValueIn(f, reconfig)
-  if (isCustomBlockInput) {
-    // Not a selector: there is no parent resource to browse and no options to fetch, just the
-    // target block's own declared input. Renders a BARE control, like `DependentFieldSelector`
-    // does — the row wrapper above already draws the field's label and required marker, so a
-    // labelled `ChipModalField` printed the title twice.
+  // A dependent with no selector has no parent resource to browse and no options to fetch —
+  // just a value to type. That is every custom-block input, and also a plain text field under
+  // a remapped credential (a Jira issue type, a Notion block id), which the sync clears on
+  // every push and so must be re-settable here.
+  if (!field.selectorKey) {
+    // Renders a BARE control, like `DependentFieldSelector` does — the row wrapper above
+    // already draws the field's label and required marker, so a labelled `ChipModalField`
+    // printed the title twice.
     const setValue = (value: string) =>
       setReconfig((current) => ({ ...current, [dependentKey(field)]: value }))
     const value = effectiveValue(field)
-    switch (customBlockInputControl(field.fieldType)) {
+    switch (forkDependentControl(field)) {
       case 'switch':
         return (
           <ChipSwitch

apps/sim/ee/workspace-forking/lib/mapping/dependent-reconfigs.test.ts

@@ -359,6 +359,72 @@ describe('collectForkDependentReconfigs', () => {
     expect(sheet?.context.spreadsheetId).toBe('ss-src')
   })
 
+  it('offers a plain text dependent of a remapped credential', () => {
+    // `clearDependentsOnRemap` wipes it on EVERY sync (a credential mapped across environments
+    // changes value each time), so a text field the modal never offered was re-emptied on every
+    // push with nowhere to set it that stuck.
+    vi.mocked(getBlock).mockReturnValue(
+      blockWith([
+        { id: 'credential', title: 'Credential', type: 'oauth-input' },
+        {
+          id: 'issueType',
+          title: 'Issue Type',
+          type: 'short-input',
+          dependsOn: ['credential'],
+        },
+      ])
+    )
+    const states = new Map<string, WorkflowState>([
+      [
+        'wf-src',
+        sourceState('jira', { credential: { value: 'cred-src' }, issueType: { value: 'Bug' } }),
+      ],
+    ])
+    const fields = collectForkDependentReconfigs([replaceItem], states, resolve)
+    expect(fields).toHaveLength(1)
+    expect(fields[0]).toMatchObject({ subBlockKey: 'issueType', fieldType: 'short-input' })
+    expect(fields[0].selectorKey).toBeUndefined()
+  })
+
+  it('does not offer the manual half of a selector-backed canonical pair', () => {
+    // The pair's selector member already represents the field, and the manual member is
+    // verbatim by policy — offering both shows one concept twice and invites writing into the
+    // inactive half.
+    vi.mocked(getBlock).mockReturnValue(
+      blockWith([
+        { id: 'credential', title: 'Credential', type: 'oauth-input' },
+        {
+          id: 'projectId',
+          title: 'Project',
+          type: 'project-selector',
+          canonicalParamId: 'projectId',
+          mode: 'basic',
+          selectorKey: 'jira.projects',
+          dependsOn: ['credential'],
+        },
+        {
+          id: 'manualProjectId',
+          title: 'Project ID',
+          type: 'short-input',
+          canonicalParamId: 'projectId',
+          mode: 'advanced',
+          dependsOn: ['credential'],
+        },
+      ])
+    )
+    const states = new Map<string, WorkflowState>([
+      [
+        'wf-src',
+        sourceState('jira', { credential: { value: 'cred-src' }, projectId: { value: 'PROJ' } }),
+      ],
+    ])
+    const keys = collectForkDependentReconfigs([replaceItem], states, resolve).map(
+      (field) => field.subBlockKey
+    )
+    expect(keys).toContain('projectId')
+    expect(keys).not.toContain('manualProjectId')
+  })
+
   it('uses the persisted canonical mode when building a dependent selector context', () => {
     vi.mocked(getBlock).mockReturnValue(
       blockWith([

apps/sim/ee/workspace-forking/lib/mapping/dependent-reconfigs.ts

@@ -48,6 +48,12 @@ interface ReconfigItem {
  * intentionally excluded: their tool dependent has no `selectorKey` and a separate
  * (non-`useSelectorOptions`) stack, so it falls back to the needs-config surfacing.
  */
+/**
+ * Dependent sub-block types the modal renders as a free-text field rather than a picker.
+ * They carry no options to fetch, so they need no selector — just somewhere to type.
+ */
+const TEXT_DEPENDENT_TYPES = new Set<string>(['short-input', 'long-input'])
+
 const PARENT_ANCHORS: ReadonlyArray<{
   subBlockType: string
   parentKind: ForkDependentReconfig['parentKind']
@@ -130,6 +136,22 @@ function emitAnchoredDependents(params: EmitAnchoredParams): void {
   const canonicalIndex = buildCanonicalIndex(config.subBlocks)
   const gates = createCanonicalModeGates(config.subBlocks, values, canonicalModes)
   const configById = new Map(config.subBlocks.filter((cfg) => cfg.id).map((cfg) => [cfg.id, cfg]))
+  // Text members of a canonical pair whose basic side IS a selector. The pair already
+  // represents the field: its selector member is offered, and the manual member is verbatim by
+  // policy (`clearDependentsOnRemap` never clears it), so offering it too would show the same
+  // concept twice and invite writing into the inactive half.
+  const canonicalWithSelector = new Set(
+    config.subBlocks
+      .filter((cfg) => cfg.canonicalParamId && cfg.selectorKey)
+      .map((cfg) => cfg.canonicalParamId)
+  )
+  const canonicalPairMembers = new Set(
+    config.subBlocks
+      .filter(
+        (cfg) => cfg.id && cfg.canonicalParamId && canonicalWithSelector.has(cfg.canonicalParamId)
+      )
+      .map((cfg) => cfg.id as string)
+  )
   // A field could hang off two anchors (or be reachable via two paths); emit it once.
   const seen = new Set<string>()
 
@@ -167,7 +189,19 @@ function emitAnchoredDependents(params: EmitAnchoredParams): void {
 
       for (const clear of getTransitiveSubBlockDependents(config.subBlocks, [anchorCfg.id])) {
         const dependent = configById.get(clear.subBlockId)
-        if (!dependent?.id || !dependent.selectorKey) continue
+        // A dependent is offered when the modal can actually render a control for it: a
+        // registered selector, or a plain text field. Anything else is skipped and the
+        // fork-dependent-coverage check keeps that set empty — see
+        // `scripts/check-fork-dependent-coverage.ts`.
+        //
+        // Text fields matter as much as selectors here. `clearDependentsOnRemap` wipes every
+        // transitive dependent of a remapped parent on EVERY sync (a credential mapped across
+        // environments changes value each time), so a field the modal never offered was
+        // re-emptied on every push and could not be fixed by setting it in the target either.
+        if (!dependent?.id) continue
+        const isTextDependent =
+          TEXT_DEPENDENT_TYPES.has(dependent.type) && !canonicalPairMembers.has(dependent.id)
+        if (!dependent.selectorKey && !isTextDependent) continue
         // Skip fields gated off by their `condition` - a selector under a now-inactive
         // operation (e.g. a move-only label while the block reads) isn't in play. We do
         // NOT require a source value: an active selector the source left empty is still
@@ -233,7 +267,9 @@ function emitAnchoredDependents(params: EmitAnchoredParams): void {
           targetBlockId: resolveTargetBlockId(),
           blockName,
           subBlockKey: makeSubBlockKey(dependent.id),
-          selectorKey: dependent.selectorKey,
+          ...(dependent.selectorKey
+            ? { selectorKey: dependent.selectorKey }
+            : { fieldType: dependent.type }),
           title: makeTitle(dependent),
           ...(toolName ? { toolName } : {}),
           ...(dependencyScope ? { dependencyScope } : {}),

package.json

@@ -25,6 +25,7 @@
     "check": "turbo run format:check",
     "check:boundaries": "bun run scripts/check-monorepo-boundaries.ts",
     "check:api-validation": "bun run scripts/check-api-validation-contracts.ts --check",
+    "check:fork-dependent-coverage": "bun run scripts/check-fork-dependent-coverage.ts",
     "generate:openapi": "bun run scripts/generate-openapi.ts",
     "check:openapi": "bun run scripts/check-openapi.ts",
     "generate:cli-api": "bun run scripts/generate-v2-cli-api.ts",