fix(knowledge): repair CI and apply cleanup passes

- Bump the chart version for the member-sync cron and secret
- Pass an access scope to getDocuments in the list-convention test and
  resolve a knowledge scope only for knowledge-base file reads
- Drop memoisation nothing observes, read the enrollment error from the
  mutation, hoist the empty connector list, use the default Cancel variant,
  let Badge own its gap, and keep the sidebar lit on the Search tab

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx

@@ -444,7 +444,7 @@ function ConnectorCard({
               {syncsPerMember && (
                 <Tooltip.Root>
                   <Tooltip.Trigger asChild>
-                    <Badge variant='gray' size='sm' className='flex-shrink-0 gap-1'>
+                    <Badge variant='gray' size='sm' className='flex-shrink-0'>
                       <Users className='size-3' />
                       Per member
                     </Badge>

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/edit-connector-modal.tsx

@@ -242,8 +242,7 @@ export function EditConnectorModal({
 
   const hasMaxAccess = hasWorkspaceMaxConnectorAccess(ownerBilling)
 
-  const persistedAccess = useMemo(() => currentAccess(connector), [connector])
-  const accessDirty = accessChanged(persistedAccess, access)
+  const accessDirty = accessChanged(currentAccess(connector), access)
   const groupOptions = useConnectorMemberGroupOptions({
     workspaceId,
     connectorConfig,
@@ -260,14 +259,10 @@ export function EditConnectorModal({
   /** A disabled member sync is re-enabled by applying the current binding again. */
   const canReenableMemberSync =
     !accessDirty && connector.accessMode === 'members' && connector.memberSyncStatus === 'disabled'
-  const memberCapFieldIds = useMemo(
-    () =>
-      new Set(
-        access.accessMode === 'members'
-          ? (connectorConfig?.permissionScopedListing?.capFieldIds ?? [])
-          : []
-      ),
-    [access.accessMode, connectorConfig]
+  const memberCapFieldIds = new Set(
+    access.accessMode === 'members'
+      ? (connectorConfig?.permissionScopedListing?.capFieldIds ?? [])
+      : []
   )
 
   const persistedCanonicalModes = useMemo(
@@ -590,7 +585,7 @@ function SettingsTab({
                         ? 'Switch to per-member access'
                         : 'Switch to workspace access'}
                   </Button>
-                  <Button variant='ghost' size='sm' onClick={onResetAccess} disabled={isSaving}>
+                  <Button variant='default' size='sm' onClick={onResetAccess} disabled={isSaving}>
                     Cancel
                   </Button>
                 </div>

apps/sim/app/workspace/[workspaceId]/search/components/member-connectors-section/member-connectors-section.tsx

@@ -15,6 +15,7 @@ import {
 import { useMemberEnrollment } from '@/hooks/use-member-enrollment'
 
 const SHARED_WITH_YOU_LABEL = 'Shared with you'
+const EMPTY_CONNECTORS: WorkspaceMemberConnector[] = []
 
 /** Memberships the viewer can act on themselves. */
 const CONNECTABLE: ReadonlySet<ViewerConnectorMembership> = new Set([
@@ -54,7 +55,7 @@ interface MemberConnectorsSectionProps {
  * page offers, so a person can do it from whichever surface they are on.
  */
 export function MemberConnectorsSection({ workspaceId, search }: MemberConnectorsSectionProps) {
-  const { data: connectors = [] } = useWorkspaceMemberConnectors(workspaceId)
+  const { data: connectors = EMPTY_CONNECTORS } = useWorkspaceMemberConnectors(workspaceId)
   const connectedConnectorIds = useMemo(
     () =>
       new Set(

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx

@@ -793,9 +793,12 @@ export const Sidebar = memo(function Sidebar({
           label: 'Integrations',
           icon: Integration,
           href: `/workspace/${workspaceId}/integrations`,
-          /* Skills is a tab of this surface, not its own nav item — keep the entry
-             lit while the user is on it. */
-          additionalActivePaths: [`/workspace/${workspaceId}/skills`],
+          /* Skills and Search are tabs of this surface, not their own nav items —
+             keep the entry lit while the user is on either. */
+          additionalActivePaths: [
+            `/workspace/${workspaceId}/skills`,
+            `/workspace/${workspaceId}/search`,
+          ],
           hidden: permissionConfig.hideIntegrationsTab,
         },
       ].filter((item) => !item.hidden),

apps/sim/hooks/use-member-enrollment.ts

@@ -1,6 +1,6 @@
 'use client'
 
-import { useCallback, useEffect, useState } from 'react'
+import { useEffect, useState } from 'react'
 import { createLogger } from '@sim/logger'
 import { type QueryKey, useQueryClient } from '@tanstack/react-query'
 import { useStartConnectorMemberEnrollment } from '@/hooks/queries/kb/connectors'
@@ -34,9 +34,8 @@ export function useMemberEnrollment({
   connectedConnectorIds,
 }: UseMemberEnrollmentProps) {
   const queryClient = useQueryClient()
-  const { mutate: startEnrollment, isPending } = useStartConnectorMemberEnrollment()
+  const { mutate: startEnrollment, isPending, error } = useStartConnectorMemberEnrollment()
   const [awaitingSince, setAwaitingSince] = useState<ReadonlyMap<string, number>>(() => new Map())
-  const [error, setError] = useState<string | null>(null)
 
   const awaiting = [...awaitingSince.keys()].some((id) => !connectedConnectorIds.has(id))
   useEffect(() => {
@@ -59,39 +58,31 @@ export function useMemberEnrollment({
     return () => clearInterval(timer)
   }, [awaiting, connectedConnectorIds, membershipQueryKeys, queryClient])
 
-  const connect = useCallback(
-    (knowledgeBaseId: string, connectorId: string) => {
-      setError(null)
-      const tab = window.open('about:blank', '_blank')
-      if (tab) tab.opener = null
-      startEnrollment(
-        { knowledgeBaseId, connectorId },
-        {
-          onSuccess: ({ url }) => {
-            if (tab && !tab.closed) {
-              tab.location.href = url
-            } else {
-              window.location.assign(url)
-              return
-            }
-            setAwaitingSince((current) => new Map(current).set(connectorId, Date.now()))
-          },
-          onError: (err) => {
-            tab?.close()
-            logger.error('Failed to start member enrollment', { error: err.message })
-            setError(err.message)
-          },
-        }
-      )
-    },
-    [startEnrollment]
-  )
+  const connect = (knowledgeBaseId: string, connectorId: string) => {
+    const tab = window.open('about:blank', '_blank')
+    if (tab) tab.opener = null
+    startEnrollment(
+      { knowledgeBaseId, connectorId },
+      {
+        onSuccess: ({ url }) => {
+          if (tab && !tab.closed) {
+            tab.location.href = url
+          } else {
+            window.location.assign(url)
+            return
+          }
+          setAwaitingSince((current) => new Map(current).set(connectorId, Date.now()))
+        },
+        onError: (err) => {
+          tab?.close()
+          logger.error('Failed to start member enrollment', { error: err.message })
+        },
+      }
+    )
+  }
 
-  const isAwaiting = useCallback(
-    (connectorId: string) =>
-      awaitingSince.has(connectorId) && !connectedConnectorIds.has(connectorId),
-    [awaitingSince, connectedConnectorIds]
-  )
+  const isAwaiting = (connectorId: string) =>
+    awaitingSince.has(connectorId) && !connectedConnectorIds.has(connectorId)
 
-  return { connect, isAwaiting, isPending, error }
+  return { connect, isAwaiting, isPending, error: error?.message ?? null }
 }

apps/sim/lib/api/list-convention.test.ts

@@ -56,6 +56,7 @@ vi.mock('@/lib/workflows/skills/builtin-skills', () => ({
 
 import { listVisibleWorkspaceCredentials } from '@/lib/credentials/queries'
 import { listFoldersForWorkspace } from '@/lib/folders/queries'
+import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
 import { getDocuments } from '@/lib/knowledge/documents/service'
 import { getWorkspaceKnowledgeBases } from '@/lib/knowledge/service'
 import { listWorkspaceMcpServers } from '@/lib/mcp/queries'
@@ -182,7 +183,8 @@ const CASES: ListCase[] = [
       getDocuments(
         'knowledge-1',
         { search, sortBy: sortBy as never, sortOrder: sortOrder as never },
-        'request-1'
+        'request-1',
+        WORKSPACE_ACCESS_SCOPE
       ),
     sort: {
       sortBy: 'fileSize',

apps/sim/lib/execution/payloads/materialization.server.ts

@@ -319,9 +319,10 @@ export async function assertUserFileContentAccess(
    * is one; `options.userId` alone may be the workflow owner standing in for an
    * actorless run and must not widen what the run can read.
    */
-  const knowledgeAccess = options.principal
-    ? await resolveKnowledgeAccessScope(options.principal, { workspaceId: options.workspaceId })
-    : undefined
+  const knowledgeAccess =
+    context === 'knowledge-base' && options.principal
+      ? await resolveKnowledgeAccessScope(options.principal, { workspaceId: options.workspaceId })
+      : undefined
   const hasAccess = await verifyFileAccess(file.key, options.userId, undefined, context, false, {
     knowledgeAccess,
   })

helm/sim/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: sim
 description: A Helm chart for Sim - the open-source AI workspace where teams build, deploy, and manage AI agents
 type: application
-version: 1.7.0
+version: 1.8.0
 appVersion: "v0.8.18"
 kubeVersion: ">=1.25.0-0"
 home: https://sim.ai