fix(selectors): restore the credential-group provider label resolver, and probe getQueryKey for missing dependsOn

Two findings from a final adversarial pass over the migration, both the same
class as the three the review bots caught: something a `fetchOptions` sub-block
declared that its replacement selector quietly does not.

`credential-group.providerFilter` had a `fetchOptionById`;
`workspace.credentialGroupProviders` had no `fetchById`, so the canvas card
summarising several stored provider ids lost every label. The field is
multi-select, which is exactly when a label has to resolve without the full list.

The `dependsOn` assertion in `selector-backed-subblocks.test.ts` only probed
`enabled` against three hand-listed context fields, which is why it caught
`clickup.triggerWorkspaceId` and would have missed the rest. It now probes
`getQueryKey` as well — a selector's key names every context field its RESULT
depends on — and derives the sub-block-sourced set from
`SELECTOR_CONTEXT_FIELDS` rather than a literal. Verified by deleting a real
`dependsOn`: it fails naming the field and the fields it depends on.

Also checked and NOT changed: `display.ts` and the copilot dropdown validator
both guard `options` before use, so stripping `options: []` does not reach them.
The validator's behaviour does shift from "reject every value" (an empty
`validIds` array matched nothing) to "skip validation", which is a relaxation
rather than a regression. `function.sandboxId` kept its `dependsOn: ['language']`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/blocks/selector-backed-subblocks.test.ts

@@ -5,6 +5,7 @@ import { describe, expect, it, vi } from 'vitest'
 
 vi.unmock('@/blocks/registry')
 
+import { SELECTOR_CONTEXT_FIELDS } from '@/lib/workflows/subblocks/context'
 import { getAllBlocks } from '@/blocks/registry'
 import { getSelectorDefinition } from '@/hooks/selectors/registry'
 import type { SelectorKey } from '@/hooks/selectors/types'
@@ -17,6 +18,17 @@ import type { SelectorKey } from '@/hooks/selectors/types'
  * has to tolerate the absence. The controls read `options` on first paint, before any fetch
  * resolves, and an unguarded `.map` there takes out the whole editor for that block.
  */
+/**
+ * Context fields supplied by a sibling SUB-BLOCK value. `workspaceId` / `workflowId` come from
+ * the surface itself and `excludeWorkflowId` from a flag, so none of them can be declared as a
+ * `dependsOn` and none belong here.
+ */
+const SUB_BLOCK_SOURCED = new Set(
+  [...SELECTOR_CONTEXT_FIELDS].filter(
+    (field) => field !== 'workspaceId' && field !== 'workflowId' && field !== 'excludeWorkflowId'
+  )
+)
+
 describe('selector-backed sub-blocks', () => {
   const selectorBacked = getAllBlocks().flatMap((block) =>
     ((block.subBlocks ?? []) as Array<Record<string, any>>)
@@ -51,33 +63,39 @@ describe('selector-backed sub-blocks', () => {
     }
   })
 
-  it('declares dependsOn for every context field its selector requires', () => {
-    // A selector gated on `enabled` returns nothing until its context is populated, and the
-    // context is only rebuilt when a `dependsOn` sibling changes. Without the declaration the
-    // list loads once, empty, and never refetches when the credential is picked.
-    const CONTEXT_SOURCED = new Set(['oauthCredential', 'credentialGroupId', 'tableId'])
+  it('declares dependsOn for every sub-block-sourced context field its selector reads', () => {
+    // A selector's `getQueryKey` names every context field its RESULT depends on, and `enabled`
+    // names what it is gated on. Both are probed rather than listing fields by hand, which is
+    // what let `clickup.triggerWorkspaceId` ship without a `dependsOn`.
+    //
+    // The declaration is what makes the list refetch: `useFetchedOptions` resets its fetch scope
+    // on `dependsOn` values changing. Without it the list loads once — before the credential is
+    // picked, or against the old language — and never reloads.
     for (const { block, sub } of selectorBacked) {
       const definition = getSelectorDefinition(sub.selectorKey as SelectorKey)
-      if (!definition.enabled) continue
       const probed = new Set<string>()
-      definition.enabled({
-        key: definition.key,
-        context: new Proxy({} as Record<string, unknown>, {
-          get: (_target, property) => {
-            if (typeof property === 'string') probed.add(property)
-            return undefined
-          },
-        }),
+      const context = new Proxy({} as Record<string, unknown>, {
+        get: (_target, property) => {
+          if (typeof property === 'string') probed.add(property)
+          return undefined
+        },
       })
-      const needsContext = [...probed].some((field) => CONTEXT_SOURCED.has(field))
-      if (!needsContext) continue
+      const args = { key: definition.key, context }
+      definition.getQueryKey(args)
+      definition.enabled?.(args)
+
+      const needed = [...probed].filter((field) => SUB_BLOCK_SOURCED.has(field))
+      if (needed.length === 0) continue
+
       const dependsOn = sub.dependsOn
-      const declared = Array.isArray(dependsOn)
-        ? dependsOn.length > 0
-        : Boolean(dependsOn?.all?.length || dependsOn?.any?.length)
+      const declared = new Set<string>(
+        Array.isArray(dependsOn)
+          ? dependsOn
+          : [...(dependsOn?.all ?? []), ...(dependsOn?.any ?? [])]
+      )
       expect(
-        declared,
-        `${block}.${sub.id} uses ${sub.selectorKey}, which is gated on context, but declares no dependsOn`
+        declared.size > 0,
+        `${block}.${sub.id} uses ${sub.selectorKey}, whose result depends on ${needed.join(', ')}, but declares no dependsOn — its list would never refetch`
       ).toBe(true)
     }
   })

apps/sim/hooks/selectors/providers/workspace/selectors.ts

@@ -109,24 +109,45 @@ export const workspaceSelectors = {
     },
   },
   /** Providers represented inside ONE credential group, for its per-provider filter. */
-  'workspace.credentialGroupProviders': workspaceScoped(
-    'workspace.credentialGroupProviders',
-    async (workspaceId, context) => {
-      if (!context.credentialGroupId) return []
-      const group = (await credentialGroups(workspaceId)).find(
+  'workspace.credentialGroupProviders': {
+    ...workspaceScoped(
+      'workspace.credentialGroupProviders',
+      async (workspaceId, context) => {
+        if (!context.credentialGroupId) return []
+        const group = (await credentialGroups(workspaceId)).find(
+          (candidate) => candidate.id === context.credentialGroupId
+        )
+        if (!group) return []
+        return group.options
+          .filter((option) => option.status === 'active')
+          .map((option) => {
+            const service = getCredentialGroupProviderService(option.provider)
+            return { id: service.providerId, label: service.name }
+          })
+          .sort((a, b) => a.label.localeCompare(b.label))
+      },
+      (context) => context.credentialGroupId ?? 'none'
+    ),
+    /**
+     * Resolves one stored provider id to its service name. The field is multi-select, so the
+     * canvas card summarises several stored ids at once and needs each label before (or
+     * without) the full list — which is what `useDynamicSubBlockOptionDisplayName` asks for.
+     */
+    fetchById: async ({ context, detailId }: SelectorQueryArgs) => {
+      if (!context.workspaceId || !context.credentialGroupId || !detailId) return null
+      const group = (await credentialGroups(context.workspaceId)).find(
         (candidate) => candidate.id === context.credentialGroupId
       )
-      if (!group) return []
-      return group.options
-        .filter((option) => option.status === 'active')
-        .map((option) => {
-          const service = getCredentialGroupProviderService(option.provider)
-          return { id: service.providerId, label: service.name }
-        })
-        .sort((a, b) => a.label.localeCompare(b.label))
+      const option = group?.options.find(
+        (candidate) =>
+          candidate.status === 'active' &&
+          getCredentialGroupProviderService(candidate.provider).providerId === detailId
+      )
+      if (!option) return null
+      const service = getCredentialGroupProviderService(option.provider)
+      return { id: service.providerId, label: service.name }
     },
-    (context) => context.credentialGroupId ?? 'none'
-  ),
+  },
   /**
    * Secret NAMES the workspace can resolve. Names only — values stay server-side and are
    * injected at execution. Both halves come from the one workspace-environment response, the