From 12865194980bfd011aae980137d69f8ae933fb3e Mon Sep 17 00:00:00 2001
From: Waleed <walif6@gmail.com>
Date: Sat, 23 May 2026 12:40:37 -0700
Subject: [PATCH 1/3] fix(resource): prevent permission-gated breadcrumb items
 from flashing on load (#4732)

* improvement(kb-connectors): align connector UI surfaces and strip redundant description suffix

- Fix icon colors to use --text-icon token across connector cards and modal
- Switch Reconnect/Update access buttons from active to primary variant
- Lift search box surface from --surface-2 to --surface-3 so it's visible against modal bg
- Replace raw <button> elements with emcn Button in base.tsx
- Shrink Connected Sources modal from lg to md
- Strip " to/into/from your knowledge base" from all 27 connector descriptions to prevent overflow

* fix(resource): replace raw pagination button with emcn Button

* fix(resource): prevent permission-gated breadcrumb items from flashing on load

* fix(resource): self-remove keydown listener on Escape and include session loading in isLoading guard
---
 .../components/resource/resource.tsx          | 44 ++++++++++++++++--
 .../workspace/[workspaceId]/files/files.tsx   |  4 +-
 .../[workspaceId]/knowledge/[id]/base.tsx     | 46 +++++++++++++------
 .../add-connector-modal.tsx                   |  4 +-
 .../connector-selector-field.tsx              |  2 +-
 .../connectors-section/connectors-section.tsx |  6 +--
 apps/sim/connectors/airtable/airtable.ts      |  2 +-
 apps/sim/connectors/asana/asana.ts            |  2 +-
 apps/sim/connectors/confluence/confluence.ts  |  2 +-
 apps/sim/connectors/discord/discord.ts        |  2 +-
 apps/sim/connectors/dropbox/dropbox.ts        |  2 +-
 apps/sim/connectors/evernote/evernote.ts      |  2 +-
 apps/sim/connectors/fireflies/fireflies.ts    |  2 +-
 apps/sim/connectors/github/github.ts          |  2 +-
 apps/sim/connectors/gmail/gmail.ts            |  2 +-
 .../google-calendar/google-calendar.ts        |  2 +-
 .../sim/connectors/google-docs/google-docs.ts |  2 +-
 .../connectors/google-drive/google-drive.ts   |  2 +-
 .../connectors/google-sheets/google-sheets.ts |  2 +-
 apps/sim/connectors/hubspot/hubspot.ts        |  2 +-
 apps/sim/connectors/intercom/intercom.ts      |  2 +-
 apps/sim/connectors/jira/jira.ts              |  2 +-
 apps/sim/connectors/linear/linear.ts          |  2 +-
 .../microsoft-teams/microsoft-teams.ts        |  2 +-
 apps/sim/connectors/notion/notion.ts          |  2 +-
 apps/sim/connectors/onedrive/onedrive.ts      |  2 +-
 apps/sim/connectors/outlook/outlook.ts        |  2 +-
 apps/sim/connectors/reddit/reddit.ts          |  2 +-
 apps/sim/connectors/salesforce/salesforce.ts  |  2 +-
 apps/sim/connectors/sharepoint/sharepoint.ts  |  2 +-
 apps/sim/connectors/slack/slack.ts            |  2 +-
 apps/sim/connectors/webflow/webflow.ts        |  2 +-
 apps/sim/connectors/zendesk/zendesk.ts        |  3 +-
 apps/sim/hooks/use-user-permissions.ts        |  8 ++--
 34 files changed, 111 insertions(+), 58 deletions(-)

diff --git a/apps/sim/app/workspace/[workspaceId]/components/resource/resource.tsx b/apps/sim/app/workspace/[workspaceId]/components/resource/resource.tsx
index d2490ec46f6..93512d9467f 100644
--- a/apps/sim/app/workspace/[workspaceId]/components/resource/resource.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/components/resource/resource.tsx
@@ -219,6 +219,36 @@ export const ResourceTable = memo(function ResourceTable({
     direction: 'desc',
   })
 
+  const [contextMenuRowId, setContextMenuRowId] = useState<string | null>(null)
+
+  const wrappedOnRowContextMenu = useCallback(
+    (e: React.MouseEvent, rowId: string) => {
+      setContextMenuRowId(rowId)
+      onRowContextMenu?.(e, rowId)
+    },
+    [onRowContextMenu]
+  )
+
+  useEffect(() => {
+    if (!contextMenuRowId) return
+    const clear = () => setContextMenuRowId(null)
+    const handleKeyDown = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') {
+        document.removeEventListener('keydown', handleKeyDown)
+        clear()
+      }
+    }
+    const timeoutId = setTimeout(() => {
+      document.addEventListener('pointerdown', clear, { once: true })
+      document.addEventListener('keydown', handleKeyDown)
+    }, 0)
+    return () => {
+      clearTimeout(timeoutId)
+      document.removeEventListener('pointerdown', clear)
+      document.removeEventListener('keydown', handleKeyDown)
+    }
+  }, [contextMenuRowId])
+
   const handleSort = useCallback((column: string, direction: 'asc' | 'desc') => {
     setInternalSort({ column, direction })
   }, [])
@@ -343,7 +373,8 @@ export const ResourceTable = memo(function ResourceTable({
                 rowDragDrop={rowDragDrop}
                 onRowClick={onRowClick}
                 onRowHover={onRowHover}
-                onRowContextMenu={onRowContextMenu}
+                onRowContextMenu={onRowContextMenu ? wrappedOnRowContextMenu : undefined}
+                isContextMenuTarget={contextMenuRowId === row.id}
                 hasCheckbox={hasCheckbox}
               />
             ))}
@@ -403,17 +434,18 @@ const Pagination = memo(function Pagination({
             }
             if (page < 1 || page > totalPages) return null
             return (
-              <button
+              <Button
                 key={page}
                 type='button'
+                variant='ghost'
                 onClick={() => onPageChange(page)}
                 className={cn(
-                  'font-medium text-sm transition-colors hover-hover:text-[var(--text-body)]',
+                  'h-auto p-0 font-medium text-sm transition-colors hover-hover:bg-transparent hover-hover:text-[var(--text-body)]',
                   page === currentPage ? 'text-[var(--text-body)]' : 'text-[var(--text-secondary)]'
                 )}
               >
                 {page}
-              </button>
+              </Button>
             )
           })}
         </div>
@@ -460,6 +492,7 @@ interface DataRowProps {
   onRowClick?: (rowId: string) => void
   onRowHover?: (rowId: string) => void
   onRowContextMenu?: (e: React.MouseEvent, rowId: string) => void
+  isContextMenuTarget?: boolean
   hasCheckbox: boolean
 }
 
@@ -472,6 +505,7 @@ const DataRow = memo(function DataRow({
   onRowClick,
   onRowHover,
   onRowContextMenu,
+  isContextMenuTarget,
   hasCheckbox,
 }: DataRowProps) {
   const isSelected = selectable?.selectedIds.has(row.id) ?? false
@@ -554,7 +588,7 @@ const DataRow = memo(function DataRow({
         onRowClick && 'cursor-pointer',
         isDraggable && 'cursor-grab active:cursor-grabbing',
         isDropTarget && 'data-[drop-target=true]:outline-offset-[-1px]',
-        (selectedRowId === row.id || isSelected) && 'bg-[var(--surface-3)]',
+        (selectedRowId === row.id || isSelected || isContextMenuTarget) && 'bg-[var(--surface-3)]',
         isActiveDropTarget && 'bg-[var(--surface-4)] outline outline-1 outline-[var(--accent)]',
         (isDragging || (isAnyDragActive && isSelected && !isActiveDropTarget)) && 'opacity-50'
       )}
diff --git a/apps/sim/app/workspace/[workspaceId]/files/files.tsx b/apps/sim/app/workspace/[workspaceId]/files/files.tsx
index 1e715a8a373..6aa7d5a40b1 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/files.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/files.tsx
@@ -1585,10 +1585,11 @@ export function Files() {
               }
             : undefined,
         dropdownItems:
-          isCurrentFolder && canEdit
+          isCurrentFolder && (canEdit || userPermissions.isLoading)
             ? [
                 {
                   label: 'Rename',
+                  disabled: !canEdit,
                   onClick: () => breadcrumbRenameRef.current.startRename(folder.id, folder.name),
                 },
               ]
@@ -1605,6 +1606,7 @@ export function Files() {
     router,
     workspaceId,
     canEdit,
+    userPermissions.isLoading,
     breadcrumbRename.editingId,
     breadcrumbRename.editValue,
   ])
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/base.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/base.tsx
index 301cdd26be0..43071af70a7 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/base.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/base.tsx
@@ -814,15 +814,26 @@ export function KnowledgeBase({
           }
         : undefined,
       dropdownItems: [
-        ...(userPermissions.canEdit
+        ...(userPermissions.canEdit || userPermissions.isLoading
           ? [
               {
                 label: 'Rename',
                 icon: Pencil,
+                disabled: !userPermissions.canEdit,
                 onClick: () => kbRename.startRename(id, knowledgeBaseName),
               },
-              { label: 'Tags', icon: Tag, onClick: () => setShowTagsModal(true) },
-              { label: 'Delete', icon: Trash, onClick: () => setShowDeleteDialog(true) },
+              {
+                label: 'Tags',
+                icon: Tag,
+                disabled: !userPermissions.canEdit,
+                onClick: () => setShowTagsModal(true),
+              },
+              {
+                label: 'Delete',
+                icon: Trash,
+                disabled: !userPermissions.canEdit,
+                onClick: () => setShowDeleteDialog(true),
+              },
             ]
           : []),
       ],
@@ -830,8 +841,15 @@ export function KnowledgeBase({
   ]
 
   const headerActions: HeaderAction[] = [
-    ...(userPermissions.canEdit
-      ? [{ label: 'New connector', icon: Plus, onClick: () => setShowAddConnectorModal(true) }]
+    ...(userPermissions.canEdit || userPermissions.isLoading
+      ? [
+          {
+            label: 'New connector',
+            icon: Plus,
+            disabled: !userPermissions.canEdit,
+            onClick: () => setShowAddConnectorModal(true),
+          },
+        ]
       : []),
   ]
 
@@ -886,18 +904,18 @@ export function KnowledgeBase({
           />
         </div>
         {enabledFilter.length > 0 && (
-          <button
-            type='button'
+          <Button
+            variant='ghost'
             onClick={() => {
               setEnabledFilter([])
               setCurrentPage(1)
               setSelectedDocuments(new Set())
               setIsSelectAllMode(false)
             }}
-            className='flex h-[32px] w-full items-center justify-center rounded-md text-[var(--text-secondary)] text-caption transition-colors hover-hover:bg-[var(--surface-active)]'
+            className='h-[32px] w-full text-[var(--text-secondary)] text-caption'
           >
             Clear status filter
-          </button>
+          </Button>
         )}
         <TagFilterSection
           tagDefinitions={tagDefinitions}
@@ -1322,7 +1340,7 @@ export function KnowledgeBase({
       )}
 
       <Modal open={showConnectorsModal} onOpenChange={setShowConnectorsModal}>
-        <ModalContent size='lg'>
+        <ModalContent size='md'>
           <ModalHeader>Connected Sources</ModalHeader>
           <ModalDescription className='sr-only'>
             Manage connected data sources for this knowledge base
@@ -1535,13 +1553,13 @@ function TagFilterSection({ tagDefinitions, entries, onChange }: TagFilterSectio
             >
               <div className='flex items-center justify-between'>
                 <Label className='text-[var(--text-muted)] text-xs'>Tag</Label>
-                <button
-                  type='button'
+                <Button
+                  variant='ghost'
+                  className='size-5 p-0 text-[var(--text-muted)] hover-hover:text-[var(--text-error)]'
                   onClick={() => removeFilter(entry.id)}
-                  className='text-[var(--text-muted)] transition-colors hover-hover:text-[var(--text-error)]'
                 >
                   <X className='size-3' />
-                </button>
+                </Button>
               </div>
               <Combobox
                 options={tagOptions}
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal/add-connector-modal.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal/add-connector-modal.tsx
index d2dab7eec57..88cb146e059 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal/add-connector-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal/add-connector-modal.tsx
@@ -246,7 +246,7 @@ export function AddConnectorModal({
           <ModalBody className={step === 'select-type' ? 'pt-2 pb-3' : 'pb-3'}>
             {step === 'select-type' ? (
               <div className='flex min-h-0 flex-col gap-2.5'>
-                <div className='flex h-8 items-center gap-2 rounded-md border border-[var(--border)] bg-[var(--surface-2)] px-2 transition-colors duration-100 hover-hover:border-[var(--border-1)] hover-hover:bg-[var(--surface-3)]'>
+                <div className='flex h-8 items-center gap-2 rounded-md border border-[var(--border)] bg-[var(--surface-3)] px-2 transition-colors duration-100 hover-hover:border-[var(--border-1)] hover-hover:bg-[var(--surface-4)]'>
                   <Search
                     className='size-[14px] flex-shrink-0 text-[var(--text-icon)]'
                     strokeWidth={2}
@@ -549,7 +549,7 @@ function ConnectorTypeCard({ config, onClick }: ConnectorTypeCardProps) {
       className='group flex min-h-10 w-full justify-start gap-2 rounded-md px-2 py-1.5 text-left transition-colors hover-hover:bg-[var(--surface-active)]'
       onClick={onClick}
     >
-      <Icon className='size-[18px] flex-shrink-0' />
+      <Icon className='size-[18px] flex-shrink-0 text-[var(--text-icon)]' />
       <div className='flex min-w-0 flex-1 flex-col gap-[1px]'>
         <span className='truncate font-medium text-[var(--text-body)] text-small'>
           {config.name}
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-selector-field/connector-selector-field.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-selector-field/connector-selector-field.tsx
index ea39d97cfac..4106c94d286 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-selector-field/connector-selector-field.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-selector-field/connector-selector-field.tsx
@@ -72,7 +72,7 @@ export function ConnectorSelectorField({
 
   if (isLoading && isEnabled) {
     return (
-      <div className='flex items-center gap-2 rounded-sm border border-[var(--border-1)] bg-[var(--surface-5)] px-2 py-1.5 font-medium text-[var(--text-muted)] text-sm'>
+      <div className='flex items-center gap-2 rounded-sm border border-[var(--border-1)] bg-[var(--surface-5)] px-2 py-1.5 font-medium text-[var(--text-muted)] text-small'>
         <Loader className='size-3.5' animate />
         Loading…
       </div>
diff --git a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx
index b388ff2b246..a70738c7cd4 100644
--- a/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx
@@ -372,7 +372,7 @@ function ConnectorCard({
       <div className='flex items-center justify-between gap-2 px-2 py-2'>
         <div className='flex min-w-0 items-center gap-2.5'>
           <div className='relative flex size-9 flex-shrink-0 items-center justify-center rounded-lg bg-[var(--surface-4)]'>
-            {Icon && <Icon className='size-5 text-[var(--text-secondary)]' />}
+            {Icon && <Icon className='size-5 text-[var(--text-icon)]' />}
             {connector.status === 'disabled' && (
               <AlertTriangle className='-right-0.5 -top-0.5 absolute size-3 text-[var(--caution)]' />
             )}
@@ -532,7 +532,7 @@ function ConnectorCard({
             </p>
             {canEdit && serviceId && providerId && (
               <Button
-                variant='active'
+                variant='primary'
                 onClick={() => {
                   if (connector.credentialId) {
                     writeOAuthReturnContext({
@@ -566,7 +566,7 @@ function ConnectorCard({
             </div>
             {canEdit && (
               <Button
-                variant='active'
+                variant='primary'
                 onClick={() => {
                   if (connector.credentialId) {
                     writeOAuthReturnContext({
diff --git a/apps/sim/connectors/airtable/airtable.ts b/apps/sim/connectors/airtable/airtable.ts
index 48f808cc687..bace2ca9e90 100644
--- a/apps/sim/connectors/airtable/airtable.ts
+++ b/apps/sim/connectors/airtable/airtable.ts
@@ -75,7 +75,7 @@ function parseCursor(cursor?: string): string | undefined {
 export const airtableConnector: ConnectorConfig = {
   id: 'airtable',
   name: 'Airtable',
-  description: 'Sync records from an Airtable table into your knowledge base',
+  description: 'Sync records from an Airtable table',
   version: '1.0.0',
   icon: AirtableIcon,
 
diff --git a/apps/sim/connectors/asana/asana.ts b/apps/sim/connectors/asana/asana.ts
index 0418fc54872..b06c01ea517 100644
--- a/apps/sim/connectors/asana/asana.ts
+++ b/apps/sim/connectors/asana/asana.ts
@@ -133,7 +133,7 @@ async function listWorkspaceProjects(
 export const asanaConnector: ConnectorConfig = {
   id: 'asana',
   name: 'Asana',
-  description: 'Sync tasks from Asana into your knowledge base',
+  description: 'Sync tasks from Asana',
   version: '1.0.0',
   icon: AsanaIcon,
 
diff --git a/apps/sim/connectors/confluence/confluence.ts b/apps/sim/connectors/confluence/confluence.ts
index 8a4fa32ef39..658debb4cda 100644
--- a/apps/sim/connectors/confluence/confluence.ts
+++ b/apps/sim/connectors/confluence/confluence.ts
@@ -146,7 +146,7 @@ function cqlResultToStub(item: Record<string, unknown>, domain: string): Externa
 export const confluenceConnector: ConnectorConfig = {
   id: 'confluence',
   name: 'Confluence',
-  description: 'Sync pages from a Confluence space into your knowledge base',
+  description: 'Sync pages from a Confluence space',
   version: '1.1.0',
   icon: ConfluenceIcon,
 
diff --git a/apps/sim/connectors/discord/discord.ts b/apps/sim/connectors/discord/discord.ts
index 51679871692..0bc5b8107b9 100644
--- a/apps/sim/connectors/discord/discord.ts
+++ b/apps/sim/connectors/discord/discord.ts
@@ -137,7 +137,7 @@ function formatMessages(messages: DiscordMessage[]): string {
 export const discordConnector: ConnectorConfig = {
   id: 'discord',
   name: 'Discord',
-  description: 'Sync channel messages from Discord into your knowledge base',
+  description: 'Sync channel messages from Discord',
   version: '1.0.0',
   icon: DiscordIcon,
 
diff --git a/apps/sim/connectors/dropbox/dropbox.ts b/apps/sim/connectors/dropbox/dropbox.ts
index c612eb5aca4..3ffc4423aa2 100644
--- a/apps/sim/connectors/dropbox/dropbox.ts
+++ b/apps/sim/connectors/dropbox/dropbox.ts
@@ -98,7 +98,7 @@ function fileToStub(entry: DropboxFileEntry): ExternalDocument {
 export const dropboxConnector: ConnectorConfig = {
   id: 'dropbox',
   name: 'Dropbox',
-  description: 'Sync text files from Dropbox into your knowledge base',
+  description: 'Sync text files from Dropbox',
   version: '1.0.0',
   icon: DropboxIcon,
 
diff --git a/apps/sim/connectors/evernote/evernote.ts b/apps/sim/connectors/evernote/evernote.ts
index 2dfd2271f5f..34fabc4a40b 100644
--- a/apps/sim/connectors/evernote/evernote.ts
+++ b/apps/sim/connectors/evernote/evernote.ts
@@ -366,7 +366,7 @@ async function apiGetNote(
 export const evernoteConnector: ConnectorConfig = {
   id: 'evernote',
   name: 'Evernote',
-  description: 'Sync notes from Evernote into your knowledge base',
+  description: 'Sync notes from Evernote',
   version: '1.0.0',
   icon: EvernoteIcon,
 
diff --git a/apps/sim/connectors/fireflies/fireflies.ts b/apps/sim/connectors/fireflies/fireflies.ts
index 0251fb4a697..7de7dfd5302 100644
--- a/apps/sim/connectors/fireflies/fireflies.ts
+++ b/apps/sim/connectors/fireflies/fireflies.ts
@@ -123,7 +123,7 @@ function formatTranscriptContent(transcript: FirefliesTranscript): string {
 export const firefliesConnector: ConnectorConfig = {
   id: 'fireflies',
   name: 'Fireflies',
-  description: 'Sync meeting transcripts from Fireflies.ai into your knowledge base',
+  description: 'Sync meeting transcripts from Fireflies.ai',
   version: '1.0.0',
   icon: FirefliesIcon,
 
diff --git a/apps/sim/connectors/github/github.ts b/apps/sim/connectors/github/github.ts
index 50d7fa34253..e5330da82ad 100644
--- a/apps/sim/connectors/github/github.ts
+++ b/apps/sim/connectors/github/github.ts
@@ -179,7 +179,7 @@ function treeItemToStub(
 export const githubConnector: ConnectorConfig = {
   id: 'github',
   name: 'GitHub',
-  description: 'Sync files from a GitHub repository into your knowledge base',
+  description: 'Sync files from a GitHub repository',
   version: '1.0.0',
   icon: GithubIcon,
 
diff --git a/apps/sim/connectors/gmail/gmail.ts b/apps/sim/connectors/gmail/gmail.ts
index eab77834c27..d0ccb6ff8e5 100644
--- a/apps/sim/connectors/gmail/gmail.ts
+++ b/apps/sim/connectors/gmail/gmail.ts
@@ -339,7 +339,7 @@ function threadToStub(thread: {
 export const gmailConnector: ConnectorConfig = {
   id: 'gmail',
   name: 'Gmail',
-  description: 'Sync email threads from Gmail into your knowledge base',
+  description: 'Sync email threads from Gmail',
   version: '1.0.0',
   icon: GmailIcon,
 
diff --git a/apps/sim/connectors/google-calendar/google-calendar.ts b/apps/sim/connectors/google-calendar/google-calendar.ts
index 104743b535d..5f2ef751481 100644
--- a/apps/sim/connectors/google-calendar/google-calendar.ts
+++ b/apps/sim/connectors/google-calendar/google-calendar.ts
@@ -246,7 +246,7 @@ function eventToDocument(
 export const googleCalendarConnector: ConnectorConfig = {
   id: 'google_calendar',
   name: 'Google Calendar',
-  description: 'Sync calendar events from Google Calendar into your knowledge base',
+  description: 'Sync calendar events from Google Calendar',
   version: '1.0.0',
   icon: GoogleCalendarIcon,
 
diff --git a/apps/sim/connectors/google-docs/google-docs.ts b/apps/sim/connectors/google-docs/google-docs.ts
index 33821bea166..0a89ea91650 100644
--- a/apps/sim/connectors/google-docs/google-docs.ts
+++ b/apps/sim/connectors/google-docs/google-docs.ts
@@ -163,7 +163,7 @@ function buildQuery(sourceConfig: Record<string, unknown>): string {
 export const googleDocsConnector: ConnectorConfig = {
   id: 'google_docs',
   name: 'Google Docs',
-  description: 'Sync Google Docs documents into your knowledge base',
+  description: 'Sync Google Docs documents',
   version: '1.0.0',
   icon: GoogleDocsIcon,
 
diff --git a/apps/sim/connectors/google-drive/google-drive.ts b/apps/sim/connectors/google-drive/google-drive.ts
index 4371d110ffa..0516c47fd7e 100644
--- a/apps/sim/connectors/google-drive/google-drive.ts
+++ b/apps/sim/connectors/google-drive/google-drive.ts
@@ -171,7 +171,7 @@ function fileToStub(file: DriveFile): ExternalDocument {
 export const googleDriveConnector: ConnectorConfig = {
   id: 'google_drive',
   name: 'Google Drive',
-  description: 'Sync documents from Google Drive into your knowledge base',
+  description: 'Sync documents from Google Drive',
   version: '1.0.0',
   icon: GoogleDriveIcon,
 
diff --git a/apps/sim/connectors/google-sheets/google-sheets.ts b/apps/sim/connectors/google-sheets/google-sheets.ts
index 38ac6b175a2..e765cc4bf70 100644
--- a/apps/sim/connectors/google-sheets/google-sheets.ts
+++ b/apps/sim/connectors/google-sheets/google-sheets.ts
@@ -199,7 +199,7 @@ async function sheetToDocument(
 export const googleSheetsConnector: ConnectorConfig = {
   id: 'google_sheets',
   name: 'Google Sheets',
-  description: 'Sync spreadsheet data from Google Sheets into your knowledge base',
+  description: 'Sync spreadsheet data from Google Sheets',
   version: '1.0.0',
   icon: GoogleSheetsIcon,
 
diff --git a/apps/sim/connectors/hubspot/hubspot.ts b/apps/sim/connectors/hubspot/hubspot.ts
index 04e4db3a678..f41465c857c 100644
--- a/apps/sim/connectors/hubspot/hubspot.ts
+++ b/apps/sim/connectors/hubspot/hubspot.ts
@@ -174,7 +174,7 @@ function recordToDocument(
 export const hubspotConnector: ConnectorConfig = {
   id: 'hubspot',
   name: 'HubSpot',
-  description: 'Sync CRM records from HubSpot into your knowledge base',
+  description: 'Sync CRM records from HubSpot',
   version: '1.0.0',
   icon: HubspotIcon,
 
diff --git a/apps/sim/connectors/intercom/intercom.ts b/apps/sim/connectors/intercom/intercom.ts
index 7b7362dc3d7..f59cb7f1a65 100644
--- a/apps/sim/connectors/intercom/intercom.ts
+++ b/apps/sim/connectors/intercom/intercom.ts
@@ -269,7 +269,7 @@ function formatArticle(article: IntercomArticle): string {
 export const intercomConnector: ConnectorConfig = {
   id: 'intercom',
   name: 'Intercom',
-  description: 'Sync Help Center articles and conversations from Intercom into your knowledge base',
+  description: 'Sync Help Center articles and conversations from Intercom',
   version: '1.0.0',
   icon: IntercomIcon,
 
diff --git a/apps/sim/connectors/jira/jira.ts b/apps/sim/connectors/jira/jira.ts
index 409dca78020..1573600722b 100644
--- a/apps/sim/connectors/jira/jira.ts
+++ b/apps/sim/connectors/jira/jira.ts
@@ -106,7 +106,7 @@ function issueToFullDocument(issue: Record<string, unknown>, domain: string): Ex
 export const jiraConnector: ConnectorConfig = {
   id: 'jira',
   name: 'Jira',
-  description: 'Sync issues from a Jira project into your knowledge base',
+  description: 'Sync issues from a Jira project',
   version: '1.0.0',
   icon: JiraIcon,
 
diff --git a/apps/sim/connectors/linear/linear.ts b/apps/sim/connectors/linear/linear.ts
index 72067d2069f..fe480d52a4d 100644
--- a/apps/sim/connectors/linear/linear.ts
+++ b/apps/sim/connectors/linear/linear.ts
@@ -203,7 +203,7 @@ function buildIssuesQuery(
 export const linearConnector: ConnectorConfig = {
   id: 'linear',
   name: 'Linear',
-  description: 'Sync issues from Linear into your knowledge base',
+  description: 'Sync issues from Linear',
   version: '1.0.0',
   icon: LinearIcon,
 
diff --git a/apps/sim/connectors/microsoft-teams/microsoft-teams.ts b/apps/sim/connectors/microsoft-teams/microsoft-teams.ts
index 3d18b127726..9ffe95014ba 100644
--- a/apps/sim/connectors/microsoft-teams/microsoft-teams.ts
+++ b/apps/sim/connectors/microsoft-teams/microsoft-teams.ts
@@ -193,7 +193,7 @@ async function resolveChannel(
 export const microsoftTeamsConnector: ConnectorConfig = {
   id: 'microsoft_teams',
   name: 'Microsoft Teams',
-  description: 'Sync channel messages from Microsoft Teams into your knowledge base',
+  description: 'Sync channel messages from Microsoft Teams',
   version: '1.0.0',
   icon: MicrosoftTeamsIcon,
 
diff --git a/apps/sim/connectors/notion/notion.ts b/apps/sim/connectors/notion/notion.ts
index e4181cd4803..06993fc8654 100644
--- a/apps/sim/connectors/notion/notion.ts
+++ b/apps/sim/connectors/notion/notion.ts
@@ -179,7 +179,7 @@ function pageToStub(page: Record<string, unknown>): ExternalDocument {
 export const notionConnector: ConnectorConfig = {
   id: 'notion',
   name: 'Notion',
-  description: 'Sync pages from a Notion workspace into your knowledge base',
+  description: 'Sync pages from a Notion workspace',
   version: '1.0.0',
   icon: NotionIcon,
 
diff --git a/apps/sim/connectors/onedrive/onedrive.ts b/apps/sim/connectors/onedrive/onedrive.ts
index 9ee72da8552..63111d5b849 100644
--- a/apps/sim/connectors/onedrive/onedrive.ts
+++ b/apps/sim/connectors/onedrive/onedrive.ts
@@ -136,7 +136,7 @@ function buildListUrl(folderPath?: string): string {
 export const onedriveConnector: ConnectorConfig = {
   id: 'onedrive',
   name: 'OneDrive',
-  description: 'Sync documents from Microsoft OneDrive into your knowledge base',
+  description: 'Sync documents from Microsoft OneDrive',
   version: '1.0.0',
   icon: MicrosoftOneDriveIcon,
 
diff --git a/apps/sim/connectors/outlook/outlook.ts b/apps/sim/connectors/outlook/outlook.ts
index 81d750b7f2c..cd21314032f 100644
--- a/apps/sim/connectors/outlook/outlook.ts
+++ b/apps/sim/connectors/outlook/outlook.ts
@@ -269,7 +269,7 @@ function formatConversation(
 export const outlookConnector: ConnectorConfig = {
   id: 'outlook',
   name: 'Outlook',
-  description: 'Sync email conversations from Outlook into your knowledge base',
+  description: 'Sync email conversations from Outlook',
   version: '1.0.0',
   icon: OutlookIcon,
 
diff --git a/apps/sim/connectors/reddit/reddit.ts b/apps/sim/connectors/reddit/reddit.ts
index ccb5c53dbe9..9f1d4f7dcb0 100644
--- a/apps/sim/connectors/reddit/reddit.ts
+++ b/apps/sim/connectors/reddit/reddit.ts
@@ -245,7 +245,7 @@ function resolveSortConfig(sourceConfig: Record<string, unknown>): {
 export const redditConnector: ConnectorConfig = {
   id: 'reddit',
   name: 'Reddit',
-  description: 'Sync subreddit posts and comments from Reddit into your knowledge base',
+  description: 'Sync subreddit posts and comments from Reddit',
   version: '1.0.0',
   icon: RedditIcon,
 
diff --git a/apps/sim/connectors/salesforce/salesforce.ts b/apps/sim/connectors/salesforce/salesforce.ts
index f373c34249e..9067a09a11c 100644
--- a/apps/sim/connectors/salesforce/salesforce.ts
+++ b/apps/sim/connectors/salesforce/salesforce.ts
@@ -268,7 +268,7 @@ function recordToDocument(
 export const salesforceConnector: ConnectorConfig = {
   id: 'salesforce',
   name: 'Salesforce',
-  description: 'Sync records from Salesforce into your knowledge base',
+  description: 'Sync records from Salesforce',
   version: '1.0.0',
   icon: SalesforceIcon,
 
diff --git a/apps/sim/connectors/sharepoint/sharepoint.ts b/apps/sim/connectors/sharepoint/sharepoint.ts
index ac310ef90d9..4860cabfaa9 100644
--- a/apps/sim/connectors/sharepoint/sharepoint.ts
+++ b/apps/sim/connectors/sharepoint/sharepoint.ts
@@ -279,7 +279,7 @@ function decodeCursor(cursor: string): PaginationState {
 export const sharepointConnector: ConnectorConfig = {
   id: 'sharepoint',
   name: 'SharePoint',
-  description: 'Sync documents from a SharePoint site into your knowledge base',
+  description: 'Sync documents from a SharePoint site',
   version: '1.0.0',
   icon: MicrosoftSharepointIcon,
 
diff --git a/apps/sim/connectors/slack/slack.ts b/apps/sim/connectors/slack/slack.ts
index 814fe13a734..1c70a096631 100644
--- a/apps/sim/connectors/slack/slack.ts
+++ b/apps/sim/connectors/slack/slack.ts
@@ -486,7 +486,7 @@ async function buildSlackChannelDocument(
 export const slackConnector: ConnectorConfig = {
   id: 'slack',
   name: 'Slack',
-  description: 'Sync channel messages from Slack into your knowledge base',
+  description: 'Sync channel messages from Slack',
   version: '1.0.0',
   icon: SlackIcon,
 
diff --git a/apps/sim/connectors/webflow/webflow.ts b/apps/sim/connectors/webflow/webflow.ts
index 638e3e7e42d..871326c0ac6 100644
--- a/apps/sim/connectors/webflow/webflow.ts
+++ b/apps/sim/connectors/webflow/webflow.ts
@@ -83,7 +83,7 @@ export const webflowConnector: ConnectorConfig = {
   id: 'webflow',
   name: 'Webflow',
   description:
-    'Sync CMS collection items from a Webflow site into your knowledge base. Note: Webflow OAuth tokens do not support refresh — you may need to reconnect periodically.',
+    'Sync CMS collection items from a Webflow site. Note: Webflow OAuth tokens do not support refresh — you may need to reconnect periodically.',
   version: '1.0.0',
   icon: WebflowIcon,
 
diff --git a/apps/sim/connectors/zendesk/zendesk.ts b/apps/sim/connectors/zendesk/zendesk.ts
index a71234d1747..5ad42a99d82 100644
--- a/apps/sim/connectors/zendesk/zendesk.ts
+++ b/apps/sim/connectors/zendesk/zendesk.ts
@@ -314,8 +314,7 @@ function ticketToDocument(
 export const zendeskConnector: ConnectorConfig = {
   id: 'zendesk',
   name: 'Zendesk',
-  description:
-    'Sync Help Center articles and support tickets from Zendesk into your knowledge base',
+  description: 'Sync Help Center articles and support tickets from Zendesk',
   version: '1.0.0',
   icon: ZendeskIcon,
 
diff --git a/apps/sim/hooks/use-user-permissions.ts b/apps/sim/hooks/use-user-permissions.ts
index d17e4a5fd04..8b08e9d5999 100644
--- a/apps/sim/hooks/use-user-permissions.ts
+++ b/apps/sim/hooks/use-user-permissions.ts
@@ -33,17 +33,17 @@ export function useUserPermissions(
   permissionsLoading = false,
   permissionsError: string | null = null
 ): WorkspaceUserPermissions {
-  const { data: session } = useSession()
+  const { data: session, isPending: sessionLoading } = useSession()
 
   const userPermissions = useMemo((): WorkspaceUserPermissions => {
     const sessionEmail = session?.user?.email
-    if (permissionsLoading || !sessionEmail) {
+    if (permissionsLoading || sessionLoading || !sessionEmail) {
       return {
         canRead: false,
         canEdit: false,
         canAdmin: false,
         userPermissions: 'read',
-        isLoading: permissionsLoading,
+        isLoading: permissionsLoading || sessionLoading,
         error: permissionsError,
       }
     }
@@ -99,7 +99,7 @@ export function useUserPermissions(
       isLoading: false,
       error: permissionsError,
     }
-  }, [session, workspacePermissions, permissionsLoading, permissionsError])
+  }, [session, sessionLoading, workspacePermissions, permissionsLoading, permissionsError])
 
   return userPermissions
 }

From 6b1210b8af24434bc23f1631d768a918df4a3537 Mon Sep 17 00:00:00 2001
From: Waleed <walif6@gmail.com>
Date: Sat, 23 May 2026 12:48:20 -0700
Subject: [PATCH 2/3] fix(files): never dedup external URL fetches by path
 filename (#4733)

* fix(files): never dedup external URL fetches by path filename

External URL fetches in the file parse route were keyed on the path
filename, so two distinct URLs whose paths ended in `image.png` (e.g.
every Slack clipboard paste) collided in the workspace cache and
returned stale bytes from a prior fetch.

Extracts the fetch + save flow into `fetchExternalUrlToWorkspace` so
the broken dedup pattern can't be reintroduced. The helper always
downloads; `uploadWorkspaceFile` handles name collisions on save by
suffixing (`image.png` -> `image (1).png` -> ...).

* fix(files): distinguish non-member from read-only in workspace-save skip log

Splits the workspace-save skip branch so non-members (permission === null)
log 'user is not a workspace member' instead of the misleading 'lacks
write permission'. Adds a test covering the null case so the relaxed
behavior (vs. the prior route's hard 'File not found') is explicit.
---
 apps/sim/app/api/files/parse/route.test.ts    |  84 ++++---
 apps/sim/app/api/files/parse/route.ts         | 153 +++--------
 .../workspace/fetch-external-url.test.ts      | 237 ++++++++++++++++++
 .../contexts/workspace/fetch-external-url.ts  | 155 ++++++++++++
 .../lib/uploads/contexts/workspace/index.ts   |   1 +
 5 files changed, 476 insertions(+), 154 deletions(-)
 create mode 100644 apps/sim/lib/uploads/contexts/workspace/fetch-external-url.test.ts
 create mode 100644 apps/sim/lib/uploads/contexts/workspace/fetch-external-url.ts

diff --git a/apps/sim/app/api/files/parse/route.test.ts b/apps/sim/app/api/files/parse/route.test.ts
index eb421bf450e..b2ab510c9f8 100644
--- a/apps/sim/app/api/files/parse/route.test.ts
+++ b/apps/sim/app/api/files/parse/route.test.ts
@@ -31,8 +31,6 @@ const {
   mockFsWriteFile,
   mockJoin,
   actualPath,
-  mockFileExistsInWorkspace,
-  mockListWorkspaceFiles,
   mockUploadWorkspaceFile,
 } = vi.hoisted(() => {
   // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -62,9 +60,19 @@ const {
       return actualPath.join(...args)
     }),
     actualPath,
-    mockFileExistsInWorkspace: vi.fn().mockResolvedValue(false),
-    mockListWorkspaceFiles: vi.fn().mockResolvedValue([]),
-    mockUploadWorkspaceFile: vi.fn().mockResolvedValue({}),
+    mockUploadWorkspaceFile: vi
+      .fn()
+      .mockImplementation(
+        async (workspaceId: string, _userId: string, _buffer: Buffer, fileName: string) => ({
+          id: 'wf_test',
+          name: fileName,
+          size: 0,
+          type: 'application/octet-stream',
+          url: `/api/files/serve/${workspaceId}/${fileName}`,
+          key: `${workspaceId}/${fileName}`,
+          context: 'workspace',
+        })
+      ),
   }
 })
 
@@ -110,9 +118,7 @@ vi.mock('@/lib/uploads/contexts/execution', () => ({
   uploadExecutionFile: vi.fn(),
 }))
 
-vi.mock('@/lib/uploads/contexts/workspace', () => ({
-  fileExistsInWorkspace: mockFileExistsInWorkspace,
-  listWorkspaceFiles: mockListWorkspaceFiles,
+vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
   uploadWorkspaceFile: mockUploadWorkspaceFile,
 }))
 
@@ -190,9 +196,7 @@ describe('File Parse API Route', () => {
     mockFsStat.mockResolvedValue({ isFile: () => true, size: 17 })
     mockFsReadFile.mockResolvedValue(Buffer.from('test file content'))
     mockIsSupportedFileType.mockReturnValue(true)
-    mockFileExistsInWorkspace.mockResolvedValue(false)
-    mockListWorkspaceFiles.mockResolvedValue([])
-    mockUploadWorkspaceFile.mockResolvedValue({})
+    mockUploadWorkspaceFile.mockClear()
     mockParseFile.mockResolvedValue({
       content: 'parsed content',
       metadata: { pageCount: 1 },
@@ -384,34 +388,32 @@ describe('File Parse API Route', () => {
     )
   })
 
-  it('should preserve the full download cap when an external URL reuses a workspace file', async () => {
+  it('should never dedup external URL fetches by path filename — two URLs sharing image.png both download', async () => {
     inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValue({
       isValid: true,
       resolvedIP: '203.0.113.10',
     })
-    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
-      new Response('file content', {
-        status: 200,
-        headers: { 'content-type': 'text/plain' },
-      })
-    )
-    mockFileExistsInWorkspace.mockResolvedValueOnce(false).mockResolvedValueOnce(true)
-    mockListWorkspaceFiles.mockResolvedValueOnce([
-      { name: 'file2.txt', key: 'workspace-file2.txt' },
-    ])
-
-    mockParseBuffer
-      .mockResolvedValueOnce({
-        content: 'a'.repeat(4 * 1024 * 1024),
-        metadata: { pageCount: 1 },
-      })
-      .mockResolvedValueOnce({
-        content: 'second file',
-        metadata: { pageCount: 1 },
-      })
+    inputValidationMockFns.mockSecureFetchWithPinnedIP
+      .mockResolvedValueOnce(
+        new Response('first image bytes', {
+          status: 200,
+          headers: { 'content-type': 'image/png' },
+        })
+      )
+      .mockResolvedValueOnce(
+        new Response('second image bytes — different content', {
+          status: 200,
+          headers: { 'content-type': 'image/png' },
+        })
+      )
+    mockIsSupportedFileType.mockReturnValue(false)
+    permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('write')
 
     const req = createMockRequest('POST', {
-      filePath: ['https://example.com/file1.txt', 'https://example.com/file2.txt'],
+      filePath: [
+        'https://files.slack.com/files-pri/T07-FAAA/download/image.png',
+        'https://files.slack.com/files-pri/T07-FBBB/download/image.png',
+      ],
       workspaceId: 'workspace-id',
     })
 
@@ -420,9 +422,21 @@ describe('File Parse API Route', () => {
 
     expect(response.status).toBe(200)
     expect(data.results).toHaveLength(2)
-    expect(storageServiceMockFns.mockDownloadFile).toHaveBeenCalledWith(
-      expect.objectContaining({ key: 'workspace-file2.txt', maxBytes: 100 * 1024 * 1024 })
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).toHaveBeenCalledTimes(2)
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).toHaveBeenNthCalledWith(
+      1,
+      'https://files.slack.com/files-pri/T07-FAAA/download/image.png',
+      '203.0.113.10',
+      expect.any(Object)
+    )
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).toHaveBeenNthCalledWith(
+      2,
+      'https://files.slack.com/files-pri/T07-FBBB/download/image.png',
+      '203.0.113.10',
+      expect.any(Object)
     )
+    expect(mockUploadWorkspaceFile).toHaveBeenCalledTimes(2)
+    expect(storageServiceMockFns.mockDownloadFile).not.toHaveBeenCalled()
   })
 
   it('should stop multi-file parsing once the combined parsed output is too large', async () => {
diff --git a/apps/sim/app/api/files/parse/route.ts b/apps/sim/app/api/files/parse/route.ts
index d015bc1cf66..ea4f493dd80 100644
--- a/apps/sim/app/api/files/parse/route.ts
+++ b/apps/sim/app/api/files/parse/route.ts
@@ -10,21 +10,15 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { fileParseContract } from '@/lib/api/contracts/storage-transfer'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
-import {
-  secureFetchWithPinnedIP,
-  validateUrlWithDNS,
-} from '@/lib/core/security/input-validation.server'
 import { sanitizeUrlForLog } from '@/lib/core/utils/logging'
-import {
-  assertKnownSizeWithinLimit,
-  DEFAULT_MAX_ERROR_BODY_BYTES,
-  isPayloadSizeLimitError,
-  readResponseTextWithLimit,
-  readResponseToBufferWithLimit,
-} from '@/lib/core/utils/stream-limits'
+import { assertKnownSizeWithinLimit, isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { isSupportedFileType, parseFile } from '@/lib/file-parsers'
 import { isUsingCloudStorage, type StorageContext, StorageService } from '@/lib/uploads'
 import { uploadExecutionFile } from '@/lib/uploads/contexts/execution'
+import {
+  ExternalUrlValidationError,
+  fetchExternalUrlToWorkspace,
+} from '@/lib/uploads/contexts/workspace'
 import { UPLOAD_DIR_SERVER } from '@/lib/uploads/core/setup.server'
 import { getFileMetadataByKey } from '@/lib/uploads/server/metadata'
 import {
@@ -36,7 +30,6 @@ import {
   inferContextFromKey,
   isInternalFileUrl,
 } from '@/lib/uploads/utils/file-utils'
-import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 import { verifyFileAccess } from '@/app/api/files/authorization'
 import type { UserFile } from '@/executor/types'
 import '@/lib/uploads/core/setup.server'
@@ -453,9 +446,16 @@ function validateFilePath(filePath: string): { isValid: boolean; error?: string
 }
 
 /**
- * Handle external URL
- * If workspaceId is provided, checks if file already exists and saves to workspace if not
- * If executionContext is provided, also stores the file in execution storage and returns UserFile
+ * Handle external URL.
+ *
+ * Always fetches the URL fresh — there is no filename-based dedup. Distinct URLs
+ * commonly share a path tail (e.g. every Slack clipboard paste is `image.png`),
+ * so keying a cache by filename returns stale bytes. `fetchExternalUrlToWorkspace`
+ * delegates to `uploadWorkspaceFile`, which suffix-disambiguates collisions on save.
+ *
+ * Workspace save is skipped when the URL already points at our execution-files
+ * bucket (re-uploading our own bytes is wasteful and would generate `image (1).png`
+ * style aliases for files we already own).
  */
 async function handleExternalUrl(
   url: string,
@@ -470,23 +470,6 @@ async function handleExternalUrl(
 ): Promise<ParseResult> {
   try {
     logger.info('Fetching external URL:', url)
-    logger.info('WorkspaceId for URL save:', workspaceId)
-
-    const urlValidation = await validateUrlWithDNS(url, 'fileUrl')
-    if (!urlValidation.isValid) {
-      logger.warn(`Blocked external URL request: ${urlValidation.error}`)
-      return {
-        success: false,
-        error: urlValidation.error || 'Invalid external URL',
-        filePath: url,
-      }
-    }
-
-    const urlPath = new URL(url).pathname
-    const filename = urlPath.split('/').pop() || 'download'
-    const extension = path.extname(filename).toLowerCase().substring(1)
-
-    logger.info(`Extracted filename: ${filename}, workspaceId: ${workspaceId}`)
 
     const {
       S3_EXECUTION_FILES_CONFIG,
@@ -511,104 +494,27 @@ async function handleExternalUrl(
       isExecutionFile = false
     }
 
-    // Only apply workspace deduplication if:
-    // 1. WorkspaceId is provided
-    // 2. URL is NOT from execution files bucket/container
-    const shouldCheckWorkspace = workspaceId && !isExecutionFile
-
-    if (shouldCheckWorkspace) {
-      const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
-      if (permission === null) {
-        logger.warn('User does not have workspace access for file parse', {
-          userId,
-          workspaceId,
-          filename,
-        })
-        return {
-          success: false,
-          error: 'File not found',
-          filePath: url,
-        }
-      }
-
-      const { fileExistsInWorkspace, listWorkspaceFiles } = await import(
-        '@/lib/uploads/contexts/workspace'
-      )
-      const exists = await fileExistsInWorkspace(workspaceId, filename)
-
-      if (exists) {
-        logger.info(`File ${filename} already exists in workspace, using existing file`)
-        const workspaceFiles = await listWorkspaceFiles(workspaceId)
-        const existingFile = workspaceFiles.find((f) => f.name === filename)
-
-        if (existingFile) {
-          const storageFilePath = `/api/files/serve/${existingFile.key}`
-          return handleCloudFile(
-            storageFilePath,
-            fileType,
-            'workspace',
-            userId,
-            executionContext,
-            maxDownloadBytes,
-            maxParsedOutputBytes
-          )
-        }
-      }
-    }
-
-    const response = await secureFetchWithPinnedIP(url, urlValidation.resolvedIP!, {
-      timeout: DOWNLOAD_TIMEOUT_MS,
-      maxResponseBytes: maxDownloadBytes,
-      signal,
-      ...(headers && Object.keys(headers).length > 0 && { headers }),
-    })
-    if (!response.ok) {
-      await readResponseTextWithLimit(response, {
-        maxBytes: DEFAULT_MAX_ERROR_BODY_BYTES,
-        label: 'file download error response',
-        signal,
-      }).catch(() => '')
-      throw new Error(`Failed to fetch URL: ${response.status} ${response.statusText}`)
-    }
-
-    const buffer = await readResponseToBufferWithLimit(response, {
-      maxBytes: maxDownloadBytes,
-      label: 'file download',
+    const { filename, buffer, mimeType } = await fetchExternalUrlToWorkspace({
+      url,
+      userId,
+      workspaceId: workspaceId || undefined,
+      saveToWorkspace: Boolean(workspaceId) && !isExecutionFile,
+      headers,
       signal,
+      maxDownloadBytes,
+      timeoutMs: DOWNLOAD_TIMEOUT_MS,
     })
+    const extension = path.extname(filename).toLowerCase().substring(1)
 
     logger.info(`Downloaded file from URL: ${url}, size: ${buffer.length} bytes`)
 
     let userFile: UserFile | undefined
-    const mimeType = response.headers.get('content-type') || getMimeTypeFromExtension(extension)
-
     if (executionContext) {
       try {
         userFile = await uploadExecutionFile(executionContext, buffer, filename, mimeType, userId)
         logger.info(`Stored file in execution storage: ${filename}`, { key: userFile.key })
       } catch (uploadError) {
-        logger.warn(`Failed to store file in execution storage:`, uploadError)
-        // Continue without userFile - parsing can still work
-      }
-    }
-
-    if (shouldCheckWorkspace) {
-      try {
-        const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
-        if (permission !== 'admin' && permission !== 'write') {
-          logger.warn('User does not have write permission for workspace file save', {
-            userId,
-            workspaceId,
-            filename,
-            permission,
-          })
-        } else {
-          const { uploadWorkspaceFile } = await import('@/lib/uploads/contexts/workspace')
-          await uploadWorkspaceFile(workspaceId, userId, buffer, filename, mimeType)
-          logger.info(`Saved URL file to workspace storage: ${filename}`)
-        }
-      } catch (saveError) {
-        logger.warn(`Failed to save URL file to workspace:`, saveError)
+        logger.warn('Failed to store file in execution storage:', uploadError)
       }
     }
 
@@ -657,6 +563,15 @@ async function handleExternalUrl(
       }
     }
 
+    if (error instanceof ExternalUrlValidationError) {
+      logger.warn(`Blocked external URL request: ${error.message}`)
+      return {
+        success: false,
+        error: error.message,
+        filePath: url,
+      }
+    }
+
     return {
       success: false,
       error: `Error fetching URL: ${(error as Error).message}`,
diff --git a/apps/sim/lib/uploads/contexts/workspace/fetch-external-url.test.ts b/apps/sim/lib/uploads/contexts/workspace/fetch-external-url.test.ts
new file mode 100644
index 00000000000..d8c2476da9a
--- /dev/null
+++ b/apps/sim/lib/uploads/contexts/workspace/fetch-external-url.test.ts
@@ -0,0 +1,237 @@
+/**
+ * @vitest-environment node
+ */
+import {
+  inputValidationMock,
+  inputValidationMockFns,
+  permissionsMock,
+  permissionsMockFns,
+} from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockUploadWorkspaceFile } = vi.hoisted(() => ({
+  mockUploadWorkspaceFile: vi.fn(),
+}))
+
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
+vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
+  uploadWorkspaceFile: mockUploadWorkspaceFile,
+}))
+
+import {
+  ExternalUrlValidationError,
+  fetchExternalUrlToWorkspace,
+} from '@/lib/uploads/contexts/workspace/fetch-external-url'
+
+function makeResponse(body: string, contentType = 'application/octet-stream'): Response {
+  return new Response(body, { status: 200, headers: { 'content-type': contentType } })
+}
+
+describe('fetchExternalUrlToWorkspace', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValue({
+      isValid: true,
+      resolvedIP: '203.0.113.10',
+    })
+    permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('write')
+    mockUploadWorkspaceFile.mockImplementation(
+      async (workspaceId: string, _userId: string, _buffer: Buffer, fileName: string) => ({
+        id: `wf_${fileName}`,
+        name: fileName,
+        size: 0,
+        type: 'application/octet-stream',
+        url: `/api/files/serve/${workspaceId}/${fileName}`,
+        key: `${workspaceId}/${fileName}`,
+        context: 'workspace',
+      })
+    )
+  })
+
+  it('downloads each URL independently — never dedups by path filename', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP
+      .mockResolvedValueOnce(makeResponse('first bytes', 'image/png'))
+      .mockResolvedValueOnce(makeResponse('different second bytes', 'image/png'))
+
+    const first = await fetchExternalUrlToWorkspace({
+      url: 'https://files.slack.com/files-pri/T07-FAAA/download/image.png',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+    const second = await fetchExternalUrlToWorkspace({
+      url: 'https://files.slack.com/files-pri/T07-FBBB/download/image.png',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(first.filename).toBe('image.png')
+    expect(second.filename).toBe('image.png')
+    expect(first.buffer.toString()).toBe('first bytes')
+    expect(second.buffer.toString()).toBe('different second bytes')
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).toHaveBeenCalledTimes(2)
+    expect(mockUploadWorkspaceFile).toHaveBeenCalledTimes(2)
+  })
+
+  it('throws ExternalUrlValidationError when SSRF validation fails', async () => {
+    inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValue({
+      isValid: false,
+      error: 'Blocked private IP',
+    })
+
+    await expect(
+      fetchExternalUrlToWorkspace({
+        url: 'http://169.254.169.254/secret',
+        userId: 'user-1',
+      })
+    ).rejects.toBeInstanceOf(ExternalUrlValidationError)
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+  })
+
+  it('throws on non-2xx fetch responses', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      new Response('not found', { status: 404, statusText: 'Not Found' })
+    )
+
+    await expect(
+      fetchExternalUrlToWorkspace({
+        url: 'https://example.com/missing.txt',
+        userId: 'user-1',
+      })
+    ).rejects.toThrow(/404/)
+  })
+
+  it('skips workspace save when saveToWorkspace is false', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+      saveToWorkspace: false,
+    })
+
+    expect(result.savedWorkspaceFile).toBeUndefined()
+    expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
+    expect(permissionsMockFns.mockGetUserEntityPermissions).not.toHaveBeenCalled()
+  })
+
+  it('skips workspace save when no workspaceId is provided', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+    })
+
+    expect(result.savedWorkspaceFile).toBeUndefined()
+    expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
+  })
+
+  it('skips workspace save when user lacks write permission', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+    permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('read')
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(result.savedWorkspaceFile).toBeUndefined()
+    expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
+  })
+
+  it('returns parsed bytes but skips save when user is not a workspace member', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+    permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue(null)
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(result.buffer.toString()).toBe('bytes')
+    expect(result.savedWorkspaceFile).toBeUndefined()
+    expect(mockUploadWorkspaceFile).not.toHaveBeenCalled()
+  })
+
+  it('returns the saved workspace file when permission allows save', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/notes.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(mockUploadWorkspaceFile).toHaveBeenCalledWith(
+      'workspace-1',
+      'user-1',
+      expect.any(Buffer),
+      'notes.txt',
+      'text/plain'
+    )
+    expect(result.savedWorkspaceFile?.key).toBe('workspace-1/notes.txt')
+  })
+
+  it('swallows workspace save errors so parsing can still proceed', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+    mockUploadWorkspaceFile.mockRejectedValueOnce(new Error('disk full'))
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/file.txt',
+      userId: 'user-1',
+      workspaceId: 'workspace-1',
+    })
+
+    expect(result.buffer.toString()).toBe('bytes')
+    expect(result.savedWorkspaceFile).toBeUndefined()
+  })
+
+  it('forwards custom headers to the fetch', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('bytes', 'text/plain')
+    )
+
+    await fetchExternalUrlToWorkspace({
+      url: 'https://files.slack.com/files-pri/T07/download/report.txt',
+      userId: 'user-1',
+      headers: { Authorization: 'Bearer xoxb-test-token' },
+    })
+
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).toHaveBeenCalledWith(
+      'https://files.slack.com/files-pri/T07/download/report.txt',
+      '203.0.113.10',
+      expect.objectContaining({
+        headers: { Authorization: 'Bearer xoxb-test-token' },
+      })
+    )
+  })
+
+  it('uses content-type from response headers', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(
+      makeResponse('pdf bytes', 'application/pdf')
+    )
+
+    const result = await fetchExternalUrlToWorkspace({
+      url: 'https://example.com/report.pdf',
+      userId: 'user-1',
+    })
+
+    expect(result.mimeType).toBe('application/pdf')
+  })
+})
diff --git a/apps/sim/lib/uploads/contexts/workspace/fetch-external-url.ts b/apps/sim/lib/uploads/contexts/workspace/fetch-external-url.ts
new file mode 100644
index 00000000000..fa942319876
--- /dev/null
+++ b/apps/sim/lib/uploads/contexts/workspace/fetch-external-url.ts
@@ -0,0 +1,155 @@
+import type { Buffer } from 'buffer'
+import path from 'path'
+import { createLogger } from '@sim/logger'
+import {
+  secureFetchWithPinnedIP,
+  validateUrlWithDNS,
+} from '@/lib/core/security/input-validation.server'
+import {
+  DEFAULT_MAX_ERROR_BODY_BYTES,
+  readResponseTextWithLimit,
+  readResponseToBufferWithLimit,
+} from '@/lib/core/utils/stream-limits'
+import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { getMimeTypeFromExtension } from '@/lib/uploads/utils/file-utils'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import type { UserFile } from '@/executor/types'
+
+const logger = createLogger('FetchExternalUrl')
+
+const DEFAULT_TIMEOUT_MS = 30_000
+const DEFAULT_MAX_DOWNLOAD_BYTES = 100 * 1024 * 1024
+
+/**
+ * Thrown when the URL fails SSRF/DNS validation. Callers should map this to a
+ * user-facing 4xx-style response rather than a generic fetch failure.
+ */
+export class ExternalUrlValidationError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'ExternalUrlValidationError'
+  }
+}
+
+export interface FetchExternalUrlOptions {
+  url: string
+  userId: string
+  /** When provided alongside `saveToWorkspace: true`, the downloaded bytes are persisted as a workspace file. */
+  workspaceId?: string
+  /** Defaults to true when a `workspaceId` is provided. Set false when the URL already points at our own storage. */
+  saveToWorkspace?: boolean
+  headers?: Record<string, string>
+  signal?: AbortSignal
+  maxDownloadBytes?: number
+  timeoutMs?: number
+}
+
+export interface FetchExternalUrlResult {
+  /**
+   * Filename derived from the URL path. NOT a content identity — distinct URLs
+   * frequently share the same path tail (e.g. every Slack clipboard paste is
+   * `image.png`). Never use this as a cache key.
+   */
+  filename: string
+  buffer: Buffer
+  /** Content-Type from the response, or inferred from the filename extension. */
+  mimeType: string
+  /**
+   * Saved workspace file record. Undefined when the workspace save was skipped
+   * (no workspaceId, `saveToWorkspace: false`, missing write permission, or a
+   * save error — the last is logged, not thrown, so the parse path stays alive).
+   */
+  savedWorkspaceFile?: UserFile
+}
+
+/**
+ * Fetch an external URL into memory and (optionally) save it as a fresh workspace file.
+ *
+ * URL fetches are NEVER deduplicated by filename. Two URLs whose paths end in
+ * `image.png` are two different fetches that produce two different workspace
+ * files; `uploadWorkspaceFile` allocates a unique on-disk name (`image.png`,
+ * `image (1).png`, ...) on the save side. Keying a cache by path tail would
+ * silently return stale bytes — that was the original bug this helper exists
+ * to make unrepresentable.
+ */
+export async function fetchExternalUrlToWorkspace(
+  options: FetchExternalUrlOptions
+): Promise<FetchExternalUrlResult> {
+  const {
+    url,
+    userId,
+    workspaceId,
+    saveToWorkspace = Boolean(workspaceId),
+    headers,
+    signal,
+    maxDownloadBytes = DEFAULT_MAX_DOWNLOAD_BYTES,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+  } = options
+
+  const urlValidation = await validateUrlWithDNS(url, 'fileUrl')
+  if (!urlValidation.isValid || !urlValidation.resolvedIP) {
+    throw new ExternalUrlValidationError(urlValidation.error || 'Invalid external URL')
+  }
+
+  const filename = new URL(url).pathname.split('/').pop() || 'download'
+  const extension = path.extname(filename).toLowerCase().substring(1)
+
+  const response = await secureFetchWithPinnedIP(url, urlValidation.resolvedIP, {
+    timeout: timeoutMs,
+    maxResponseBytes: maxDownloadBytes,
+    signal,
+    ...(headers && Object.keys(headers).length > 0 && { headers }),
+  })
+
+  if (!response.ok) {
+    await readResponseTextWithLimit(response, {
+      maxBytes: DEFAULT_MAX_ERROR_BODY_BYTES,
+      label: 'external url error body',
+      signal,
+    }).catch(() => '')
+    throw new Error(`Failed to fetch URL: ${response.status} ${response.statusText}`)
+  }
+
+  const buffer = await readResponseToBufferWithLimit(response, {
+    maxBytes: maxDownloadBytes,
+    label: 'external url download',
+    signal,
+  })
+
+  const mimeType = response.headers.get('content-type') || getMimeTypeFromExtension(extension)
+
+  let savedWorkspaceFile: UserFile | undefined
+  if (workspaceId && saveToWorkspace) {
+    const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
+    if (permission === 'admin' || permission === 'write') {
+      try {
+        savedWorkspaceFile = await uploadWorkspaceFile(
+          workspaceId,
+          userId,
+          buffer,
+          filename,
+          mimeType
+        )
+      } catch (saveError) {
+        logger.warn('Failed to save fetched URL to workspace storage', {
+          workspaceId,
+          filename,
+          saveError,
+        })
+      }
+    } else if (permission === null) {
+      logger.warn('Skipping workspace save: user is not a workspace member', {
+        userId,
+        workspaceId,
+      })
+    } else {
+      logger.warn('Skipping workspace save: user lacks write permission', {
+        userId,
+        workspaceId,
+        permission,
+      })
+    }
+  }
+
+  return { filename, buffer, mimeType, savedWorkspaceFile }
+}
diff --git a/apps/sim/lib/uploads/contexts/workspace/index.ts b/apps/sim/lib/uploads/contexts/workspace/index.ts
index b7dbcdee264..d5c542b512a 100644
--- a/apps/sim/lib/uploads/contexts/workspace/index.ts
+++ b/apps/sim/lib/uploads/contexts/workspace/index.ts
@@ -1,2 +1,3 @@
+export * from './fetch-external-url'
 export * from './workspace-file-folder-manager'
 export * from './workspace-file-manager'

From 4fab03c59557761146d5d96bebe657ecabb5cf9c Mon Sep 17 00:00:00 2001
From: Vikhyath Mondreti <vikhyathvikku@gmail.com>
Date: Sat, 23 May 2026 12:54:14 -0700
Subject: [PATCH 3/3] improvement(media-gen): retire vision block, add hosted
 key for fal ai for image/video gen, search visibility in cmd-k (#4684)

* improvement(media-gen): retire vision block, add hosted key for fal ai for image/video gen

* address comments
---
 .../content/docs/en/tools/azure_devops.mdx    |  10 +-
 apps/docs/content/docs/en/tools/meta.json     |   1 -
 apps/docs/content/docs/en/tools/vision.mdx    |  60 -----
 .../content/docs/en/triggers/azure_devops.mdx |   8 +-
 .../integrations/data/icon-mapping.ts         |   2 -
 .../integrations/data/integrations.json       |  26 +--
 apps/sim/app/api/tools/image/route.ts         |  15 ++
 apps/sim/app/api/tools/video/route.ts         |  25 ++-
 .../settings/components/byok/byok.tsx         |   8 +
 .../[workspaceId]/w/[workflowId]/workflow.tsx |  16 +-
 .../components/search-modal/search-modal.tsx  |   9 +-
 .../w/components/sidebar/sidebar.tsx          |  11 +-
 apps/sim/blocks/blocks.test.ts                |  59 +++++
 apps/sim/blocks/blocks/agent.ts               |   1 +
 apps/sim/blocks/blocks/image_generator.ts     |  20 +-
 apps/sim/blocks/blocks/video_generator.ts     |  27 ++-
 apps/sim/blocks/blocks/vision.ts              |   2 +-
 apps/sim/blocks/types.ts                      |   2 +
 apps/sim/lib/api/contracts/byok-keys.ts       |   1 +
 .../lib/api/contracts/tools/media/image.ts    |   1 +
 .../lib/api/contracts/tools/media/video.ts    |   1 +
 apps/sim/lib/tools/falai-pricing.ts           | 205 ++++++++++++++++++
 apps/sim/stores/modals/search/store.test.ts   | 151 +++++++++++++
 apps/sim/stores/modals/search/store.ts        |  43 ++++
 apps/sim/stores/modals/search/types.ts        |   1 +
 apps/sim/tools/falai-hosting.test.ts          | 108 +++++++++
 apps/sim/tools/image/generate.ts              |  39 ++++
 apps/sim/tools/image/types.ts                 |  11 +
 apps/sim/tools/index.test.ts                  | 124 +++++++++++
 apps/sim/tools/index.ts                       |   8 +
 apps/sim/tools/types.ts                       |   3 +
 apps/sim/tools/video/falai.ts                 |  36 +++
 apps/sim/tools/video/types.ts                 |  11 +
 33 files changed, 934 insertions(+), 111 deletions(-)
 delete mode 100644 apps/docs/content/docs/en/tools/vision.mdx
 create mode 100644 apps/sim/lib/tools/falai-pricing.ts
 create mode 100644 apps/sim/stores/modals/search/store.test.ts
 create mode 100644 apps/sim/tools/falai-hosting.test.ts

diff --git a/apps/docs/content/docs/en/tools/azure_devops.mdx b/apps/docs/content/docs/en/tools/azure_devops.mdx
index 38b3bfb69d8..e0add5348ae 100644
--- a/apps/docs/content/docs/en/tools/azure_devops.mdx
+++ b/apps/docs/content/docs/en/tools/azure_devops.mdx
@@ -280,7 +280,7 @@ Get the execution timeline for an Azure DevOps build — every stage, job, and t
 |     ↳ `warningCount` | number | Number of warnings |
 |     ↳ `startTime` | string | ISO 8601 start timestamp |
 |     ↳ `finishTime` | string | ISO 8601 finish timestamp |
-|   ↳ `failedRecords` | array | Subset of records where result === "failed" — use logId to fetch logs |
+|   ↳ `failedRecords` | array | Subset of records where result is failed, partiallySucceeded, or succeededWithIssues — use logId to fetch logs |
 |     ↳ `id` | string | Record GUID |
 |     ↳ `name` | string | Step name |
 |     ↳ `type` | string | Stage \| Phase \| Job \| Task |
@@ -333,7 +333,8 @@ Execute a WIQL query to search for work items in Azure DevOps and return full fi
 | --------- | ---- | ----------- |
 | `content` | string | Human-readable summary of matching work items |
 | `metadata` | object | Work items metadata |
-|   ↳ `count` | number | Number of work items returned |
+|   ↳ `count` | number | Number of work items returned \(after hydration\) |
+|   ↳ `totalMatched` | number | Total number of work items matched by the WIQL query before hydration |
 |   ↳ `workItems` | array | Array of work item details |
 |     ↳ `id` | number | Work item ID |
 |     ↳ `title` | string | Work item title |
@@ -372,7 +373,7 @@ Fetch full details of a single work item by ID from Azure DevOps, including titl
 
 ### `azure_devops_get_work_items_batch`
 
-Fetch full details for multiple work items by ID from Azure DevOps in a single call. Pass comma-separated IDs (e.g. 
+Fetch full details for multiple work items by ID from Azure DevOps. Pass comma-separated IDs (e.g.
 
 #### Input
 
@@ -380,7 +381,7 @@ Fetch full details for multiple work items by ID from Azure DevOps in a single c
 | --------- | ---- | -------- | ----------- |
 | `organization` | string | Yes | Azure DevOps organization name |
 | `project` | string | Yes | Azure DevOps project name |
-| `ids` | string | Yes | Comma-separated work item IDs to fetch \(e.g. "123,456,789"\). Maximum 200 IDs. |
+| `ids` | string | Yes | Comma-separated work item IDs to fetch \(e.g. "123,456,789"\). Lists longer than 200 IDs are chunked automatically. |
 
 #### Output
 
@@ -389,6 +390,7 @@ Fetch full details for multiple work items by ID from Azure DevOps in a single c
 | `content` | string | Human-readable summary of the fetched work items |
 | `metadata` | object | Work items metadata |
 |   ↳ `count` | number | Number of work items returned |
+|   ↳ `totalRequested` | number | Total number of IDs requested \(across all chunks\) |
 |   ↳ `workItems` | array | Array of work item details |
 |     ↳ `id` | number | Work item ID |
 |     ↳ `title` | string | Work item title |
diff --git a/apps/docs/content/docs/en/tools/meta.json b/apps/docs/content/docs/en/tools/meta.json
index 075f99a2954..f259653fdaa 100644
--- a/apps/docs/content/docs/en/tools/meta.json
+++ b/apps/docs/content/docs/en/tools/meta.json
@@ -195,7 +195,6 @@
     "upstash",
     "vercel",
     "video_generator",
-    "vision",
     "wealthbox",
     "webflow",
     "whatsapp",
diff --git a/apps/docs/content/docs/en/tools/vision.mdx b/apps/docs/content/docs/en/tools/vision.mdx
deleted file mode 100644
index 1ab0cee507c..00000000000
--- a/apps/docs/content/docs/en/tools/vision.mdx
+++ /dev/null
@@ -1,60 +0,0 @@
----
-title: Vision
-description: Analyze images with vision models
----
-
-import { BlockInfoCard } from "@/components/ui/block-info-card"
-
-<BlockInfoCard 
-  type="vision_v2"
-  color="#4D5FFF"
-/>
-
-{/* MANUAL-CONTENT-START:intro */}
-Vision is a tool that allows you to analyze images with vision models.
-
-With Vision, you can:
-
-- **Analyze images**: Analyze images with vision models
-- **Extract text**: Extract text from images
-- **Identify objects**: Identify objects in images
-- **Describe images**: Describe images in detail
-- **Generate images**: Generate images from text
-
-In Sim, the Vision integration enables your agents to analyze images with vision models as part of their workflows. This allows for powerful automation scenarios that require analyzing images with vision models. Your agents can analyze images with vision models, extract text from images, identify objects in images, describe images in detail, and generate images from text. This integration bridges the gap between your AI workflows and your image analysis needs, enabling more sophisticated and image-centric automations. By connecting Sim with Vision, you can create agents that stay current with the latest information, provide more accurate responses, and deliver more value to users - all without requiring manual intervention or custom code.
-{/* MANUAL-CONTENT-END */}
-
-
-## Usage Instructions
-
-Integrate Vision into the workflow. Can analyze images with vision models.
-
-
-
-## Tools
-
-### `vision_tool`
-
-#### Input
-
-| Parameter | Type | Required | Description |
-| --------- | ---- | -------- | ----------- |
-| `apiKey` | string | Yes | API key for the selected model provider |
-| `imageUrl` | string | No | Publicly accessible image URL |
-| `imageFile` | file | No | Image file to analyze |
-| `model` | string | No | Vision model to use \(gpt-4o, claude-3-opus-20240229, etc\) |
-| `prompt` | string | No | Custom prompt for image analysis |
-
-#### Output
-
-| Parameter | Type | Description |
-| --------- | ---- | ----------- |
-| `content` | string | The analyzed content and description of the image |
-| `model` | string | The vision model that was used for analysis |
-| `tokens` | number | Total tokens used for the analysis |
-| `usage` | object | Detailed token usage breakdown |
-|   ↳ `input_tokens` | number | Tokens used for input processing |
-|   ↳ `output_tokens` | number | Tokens used for response generation |
-|   ↳ `total_tokens` | number | Total tokens consumed |
-
-
diff --git a/apps/docs/content/docs/en/triggers/azure_devops.mdx b/apps/docs/content/docs/en/triggers/azure_devops.mdx
index d22c9ae8257..d9d4b9b0128 100644
--- a/apps/docs/content/docs/en/triggers/azure_devops.mdx
+++ b/apps/docs/content/docs/en/triggers/azure_devops.mdx
@@ -31,7 +31,7 @@ Trigger workflow when an Azure DevOps build fails, is canceled, or partially suc
 | `branch` | string | Source branch name \(refs/heads/ prefix stripped\) |
 | `commitSha` | string | Source commit SHA |
 | `triggeredBy` | string | Display name of the person who triggered the build |
-| `triggeredByEmail` | string | Email/unique name of the person who triggered the build |
+| `triggeredByEmail` | string | Email/unique name of the person who triggered the build, or null if not set |
 | `startTime` | string | Build start time \(ISO 8601\) |
 | `finishTime` | string | Build finish time \(ISO 8601\) |
 | `buildUrl` | string | API URL for the build resource |
@@ -72,12 +72,12 @@ Trigger workflow when a work item is created in Azure DevOps
 | `workItemType` | string | Work item type for Basic process \(e.g. Issue, Task, Epic\) |
 | `title` | string | Work item title |
 | `state` | string | Work item state for Basic process \(e.g. To Do, Doing, Done\) |
-| `createdBy` | string | Display name of the creator |
-| `assignedTo` | string | Assignee display name, or empty string if unassigned |
+| `createdBy` | string | Display name of the creator, or null if not set |
+| `assignedTo` | string | Assignee display name, or null if unassigned |
 | `priority` | number | Priority \(1–4\), or 0 if not set |
 | `areaPath` | string | Area path |
 | `iterationPath` | string | Iteration path |
-| `description` | string | Work item description \(HTML\), or empty string if not set |
+| `description` | string | Work item description \(HTML\), or null if not set |
 | `projectName` | string | Azure DevOps project name |
 | `workItemUrl` | string | API URL for the work item resource |
 
diff --git a/apps/sim/app/(landing)/integrations/data/icon-mapping.ts b/apps/sim/app/(landing)/integrations/data/icon-mapping.ts
index 2394d741345..ff677b09153 100644
--- a/apps/sim/app/(landing)/integrations/data/icon-mapping.ts
+++ b/apps/sim/app/(landing)/integrations/data/icon-mapping.ts
@@ -57,7 +57,6 @@ import {
   EvernoteIcon,
   ExaAIIcon,
   ExtendIcon,
-  EyeIcon,
   FathomIcon,
   FindymailIcon,
   FirecrawlIcon,
@@ -405,7 +404,6 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   upstash: UpstashIcon,
   vercel: VercelIcon,
   video_generator_v3: VideoIcon,
-  vision_v2: EyeIcon,
   wealthbox: WealthboxIcon,
   webflow: WebflowIcon,
   whatsapp: WhatsAppIcon,
diff --git a/apps/sim/app/(landing)/integrations/data/integrations.json b/apps/sim/app/(landing)/integrations/data/integrations.json
index fdf1e75c533..bb13c23c653 100644
--- a/apps/sim/app/(landing)/integrations/data/integrations.json
+++ b/apps/sim/app/(landing)/integrations/data/integrations.json
@@ -1938,7 +1938,7 @@
       },
       {
         "name": "Get Work Items Batch",
-        "description": "Fetch full details for multiple work items by ID from Azure DevOps in a single call. Pass comma-separated IDs (e.g. "
+        "description": "Fetch full details for multiple work items by ID from Azure DevOps. Pass comma-separated IDs (e.g. "
       },
       {
         "name": "Create Work Item",
@@ -4156,10 +4156,6 @@
         "name": "Fetch",
         "description": "Fetch and parse a file from a URL with optional custom headers."
       },
-      {
-        "name": "Get",
-        "description": "Get a workspace file object from a selected file or canonical workspace file ID."
-      },
       {
         "name": "Write",
         "description": "Create a new workspace file. If a file with the same name already exists, a numeric suffix is added (e.g., "
@@ -4169,7 +4165,7 @@
         "description": "Append content to an existing workspace file. The file must already exist. Content is added to the end of the file."
       }
     ],
-    "operationCount": 5,
+    "operationCount": 4,
     "triggers": [],
     "triggerCount": 0,
     "authType": "none",
@@ -14253,24 +14249,6 @@
     "integrationTypes": ["ai", "design"],
     "tags": ["video-generation", "llm"]
   },
-  {
-    "type": "vision_v2",
-    "slug": "vision",
-    "name": "Vision",
-    "description": "Analyze images with vision models",
-    "longDescription": "Integrate Vision into the workflow. Can analyze images with vision models.",
-    "bgColor": "#4D5FFF",
-    "iconName": "EyeIcon",
-    "docsUrl": "https://docs.sim.ai/tools/vision",
-    "operations": [],
-    "operationCount": 0,
-    "triggers": [],
-    "triggerCount": 0,
-    "authType": "api-key",
-    "category": "tools",
-    "integrationTypes": ["ai", "documents"],
-    "tags": ["llm", "document-processing", "ocr"]
-  },
   {
     "type": "wealthbox",
     "slug": "wealthbox",
diff --git a/apps/sim/app/api/tools/image/route.ts b/apps/sim/app/api/tools/image/route.ts
index b1643542402..6476b53f5c9 100644
--- a/apps/sim/app/api/tools/image/route.ts
+++ b/apps/sim/app/api/tools/image/route.ts
@@ -32,6 +32,7 @@ import {
 } from '@/lib/core/utils/stream-limits'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { type FalAICostMetadata, getFalAICostMetadata } from '@/lib/tools/falai-pricing'
 
 const logger = createLogger('ImageProxyAPI')
 const MAX_IMAGE_BYTES = 25 * 1024 * 1024
@@ -53,6 +54,7 @@ interface GeneratedImageResult {
   revisedPrompt?: string
   seed?: number
   jobId?: string
+  falaiCost?: FalAICostMetadata
 }
 
 interface StoredImageResponse {
@@ -72,6 +74,8 @@ interface StoredImageResponse {
     jobId?: string
     contentType: string
   }
+  __falaiCostDollars?: number
+  __falaiBilling?: FalAICostMetadata
 }
 
 export const POST = withRouteHandler(async (request: NextRequest) => {
@@ -935,6 +939,13 @@ async function generateWithFalAI(
         revisedPrompt: getStringProperty(resultData, 'revised_prompt'),
         seed: getNumberProperty(resultData, 'seed'),
         jobId: falRequestId,
+        falaiCost: body.useHostedCostTracking
+          ? await getFalAICostMetadata({
+              apiKey,
+              endpointId: modelConfig.endpoint,
+              requestId: falRequestId,
+            })
+          : undefined,
       }
     }
 
@@ -992,6 +1003,8 @@ async function storeGeneratedImage(
         jobId: imageResult.jobId,
         contentType: imageResult.contentType,
       },
+      __falaiCostDollars: imageResult.falaiCost?.costDollars,
+      __falaiBilling: imageResult.falaiCost,
     }
   }
 
@@ -1024,5 +1037,7 @@ async function storeGeneratedImage(
       jobId: imageResult.jobId,
       contentType: imageResult.contentType,
     },
+    __falaiCostDollars: imageResult.falaiCost?.costDollars,
+    __falaiBilling: imageResult.falaiCost,
   }
 }
diff --git a/apps/sim/app/api/tools/video/route.ts b/apps/sim/app/api/tools/video/route.ts
index 0a6f3ddead4..1110432a473 100644
--- a/apps/sim/app/api/tools/video/route.ts
+++ b/apps/sim/app/api/tools/video/route.ts
@@ -17,6 +17,7 @@ import {
   readResponseToBufferWithLimit,
 } from '@/lib/core/utils/stream-limits'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { type FalAICostMetadata, getFalAICostMetadata } from '@/lib/tools/falai-pricing'
 import { downloadFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
 import { assertToolFileAccess } from '@/app/api/files/authorization'
 import type { UserFile } from '@/executor/types'
@@ -138,6 +139,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     let height: number | undefined
     let jobId: string | undefined
     let actualDuration: number | undefined
+    let falaiCost: FalAICostMetadata | undefined
 
     if (body.visualReference) {
       const denied = await assertToolFileAccess(
@@ -236,6 +238,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           resolution,
           body.promptOptimizer,
           body.generateAudio,
+          body.useHostedCostTracking === true,
           requestId,
           logger
         )
@@ -244,6 +247,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         height = result.height
         jobId = result.jobId
         actualDuration = result.duration
+        falaiCost = result.falaiCost
       } else {
         return NextResponse.json({ error: `Unknown provider: ${provider}` }, { status: 400 })
       }
@@ -301,6 +305,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         provider,
         model: model || 'default',
         jobId,
+        __falaiCostDollars: falaiCost?.costDollars,
+        __falaiBilling: falaiCost,
       })
     }
 
@@ -333,6 +339,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       provider,
       model: model || 'default',
       jobId,
+      __falaiCostDollars: falaiCost?.costDollars,
+      __falaiBilling: falaiCost,
     })
   } catch (error) {
     logger.error(`[${requestId}] Video proxy error:`, error)
@@ -1167,9 +1175,17 @@ async function generateWithFalAI(
   resolution: string | undefined,
   promptOptimizer: boolean | undefined,
   generateAudio: boolean | undefined,
+  useHostedCostTracking: boolean,
   requestId: string,
   logger: ReturnType<typeof createLogger>
-): Promise<{ buffer: Buffer; width: number; height: number; jobId: string; duration: number }> {
+): Promise<{
+  buffer: Buffer
+  width: number
+  height: number
+  jobId: string
+  duration: number
+  falaiCost?: FalAICostMetadata
+}> {
   logger.info(`[${requestId}] Starting Fal.ai generation with model: ${model}`)
 
   const modelConfig = FALAI_MODEL_CONFIGS[model]
@@ -1312,6 +1328,13 @@ async function generateWithFalAI(
         height,
         jobId: requestIdFal,
         duration: getNumberProperty(videoOutput, 'duration') || duration || 5,
+        falaiCost: useHostedCostTracking
+          ? await getFalAICostMetadata({
+              apiKey,
+              endpointId: modelConfig.endpoint,
+              requestId: requestIdFal,
+            })
+          : undefined,
       }
     }
 
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx
index 306b62850cb..527d9262251 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx
@@ -23,6 +23,7 @@ import {
   FireworksIcon,
   GeminiIcon,
   GoogleIcon,
+  ImageIcon,
   JinaAIIcon,
   LinkupIcon,
   MistralIcon,
@@ -85,6 +86,13 @@ const PROVIDERS: {
     description: 'LLM calls',
     placeholder: 'Enter your Fireworks API key',
   },
+  {
+    id: 'falai',
+    name: 'Fal.ai',
+    icon: ImageIcon,
+    description: 'Image and video generation',
+    placeholder: 'Enter your Fal.ai API key',
+  },
   {
     id: 'firecrawl',
     name: 'Firecrawl',
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx
index 0d05ff2a24a..cd2cad75fb0 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx
@@ -204,6 +204,12 @@ interface BlockData {
   position: { x: number; y: number }
 }
 
+interface AddBlockFromToolbarDetail {
+  type?: unknown
+  enableTriggerMode?: unknown
+  presetOperation?: unknown
+}
+
 /**
  * Main workflow canvas content component.
  * Renders the ReactFlow canvas with blocks, edges, and all interactive features.
@@ -2004,7 +2010,7 @@ const WorkflowContent = React.memo(
 
     /** Handles toolbar block click events to add blocks to the canvas. */
     useEffect(() => {
-      const handleAddBlockFromToolbar = (event: CustomEvent) => {
+      const handleAddBlockFromToolbar = (event: CustomEvent<AddBlockFromToolbarDetail>) => {
         // Check if user has permission to interact with blocks
         if (!effectivePermissions.canEdit) {
           return
@@ -2012,7 +2018,7 @@ const WorkflowContent = React.memo(
 
         const { type, enableTriggerMode, presetOperation } = event.detail
 
-        if (!type) return
+        if (typeof type !== 'string' || !type) return
         if (type === 'connectionBlock') return
 
         const basePosition = getViewportCenter()
@@ -2070,8 +2076,10 @@ const WorkflowContent = React.memo(
           undefined,
           undefined,
           autoConnectEdge,
-          enableTriggerMode,
-          presetOperation ? { operation: presetOperation } : undefined
+          enableTriggerMode === true,
+          typeof presetOperation === 'string' && presetOperation
+            ? { operation: presetOperation }
+            : undefined
         )
       }
 
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx
index 1808418c608..d39c0f06d8b 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx
@@ -206,7 +206,10 @@ export function SearchModal({
         type === 'trigger' && block.config ? hasTriggerCapability(block.config) : false
       window.dispatchEvent(
         new CustomEvent('add-block-from-toolbar', {
-          detail: { type: block.type, enableTriggerMode },
+          detail: {
+            type: block.type,
+            enableTriggerMode,
+          },
         })
       )
       captureEvent(posthogRef.current, 'search_result_selected', {
@@ -376,12 +379,12 @@ export function SearchModal({
 
   const filteredBlocks = useMemo(() => {
     if (!isOnWorkflowPage) return []
-    return filterAndSort(blocks, (b) => `${b.name} block-${b.id}`, deferredSearch)
+    return filterAndSort(blocks, (b) => b.searchValue ?? `${b.name} block-${b.id}`, deferredSearch)
   }, [isOnWorkflowPage, blocks, deferredSearch])
 
   const filteredTools = useMemo(() => {
     if (!isOnWorkflowPage) return []
-    return filterAndSort(tools, (t) => `${t.name} tool-${t.id}`, deferredSearch)
+    return filterAndSort(tools, (t) => t.searchValue ?? `${t.name} tool-${t.id}`, deferredSearch)
   }, [isOnWorkflowPage, tools, deferredSearch])
 
   const filteredTriggers = useMemo(() => {
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx
index 8fd9fae2109..c9ba8668b11 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx
@@ -104,6 +104,7 @@ import { SIDEBAR_WIDTH } from '@/stores/constants'
 import { useFolderStore } from '@/stores/folders/store'
 import { useSearchModalStore } from '@/stores/modals/search/store'
 import { useMothershipDraftsStore } from '@/stores/mothership-drafts/store'
+import { useProvidersStore } from '@/stores/providers'
 import { useSidebarStore } from '@/stores/sidebar/store'
 
 const logger = createLogger('Sidebar')
@@ -360,10 +361,18 @@ export const Sidebar = memo(function Sidebar() {
   const { config: permissionConfig, filterBlocks } = usePermissionConfig()
   const { navigateToSettings, getSettingsHref } = useSettingsNavigation()
   const initializeSearchData = useSearchModalStore((state) => state.initializeData)
+  const providers = useProvidersStore((state) => state.providers)
+  const providerModelSignature = useMemo(
+    () =>
+      Object.values(providers)
+        .map((provider) => provider.models.join('\x00'))
+        .join('\x01'),
+    [providers]
+  )
 
   useEffect(() => {
     initializeSearchData(filterBlocks)
-  }, [initializeSearchData, filterBlocks])
+  }, [initializeSearchData, filterBlocks, providerModelSignature])
 
   const setSidebarWidth = useSidebarStore((state) => state.setSidebarWidth)
   const isCollapsed = useSidebarStore((state) => state.isCollapsed)
diff --git a/apps/sim/blocks/blocks.test.ts b/apps/sim/blocks/blocks.test.ts
index 8906f962ef3..105ca6020ea 100644
--- a/apps/sim/blocks/blocks.test.ts
+++ b/apps/sim/blocks/blocks.test.ts
@@ -734,6 +734,65 @@ describe.concurrent('Blocks Module', () => {
       expect(temperatureSubBlock?.min).toBe(0)
       expect(temperatureSubBlock?.max).toBe(2)
     })
+
+    it('should mark generator provider dropdowns as command-searchable', () => {
+      const imageGeneratorBlock = getBlock('image_generator_v2')
+      const videoGeneratorBlock = getBlock('video_generator_v3')
+
+      const imageProviderSubBlock = imageGeneratorBlock?.subBlocks.find(
+        (sb) => sb.id === 'provider'
+      )
+      const videoProviderSubBlock = videoGeneratorBlock?.subBlocks.find(
+        (sb) => sb.id === 'provider'
+      )
+      const imageProviderOptions = imageProviderSubBlock?.options
+      const videoProviderOptions = videoProviderSubBlock?.options
+
+      expect(imageGeneratorBlock?.hideFromToolbar).not.toBe(true)
+      expect(videoGeneratorBlock?.hideFromToolbar).not.toBe(true)
+      expect(imageProviderSubBlock?.commandSearchable).toBe(true)
+      expect(videoProviderSubBlock?.commandSearchable).toBe(true)
+      expect(imageProviderSubBlock?.value?.()).toBe('falai')
+      expect(videoProviderSubBlock?.value?.()).toBe('falai')
+      expect(
+        Array.isArray(imageProviderOptions) ? imageProviderOptions.map((option) => option.id) : []
+      ).toContain('falai')
+      expect(
+        Array.isArray(videoProviderOptions) ? videoProviderOptions.map((option) => option.id) : []
+      ).toContain('falai')
+      expect(getBlock('image_generator')?.hideFromToolbar).toBe(true)
+      expect(getBlock('video_generator_v2')?.hideFromToolbar).toBe(true)
+    })
+
+    it('should mark the agent model combobox as command-searchable', () => {
+      const agentBlock = getBlock('agent')
+      const modelSubBlock = agentBlock?.subBlocks.find((sb) => sb.id === 'model')
+
+      expect(agentBlock?.hideFromToolbar).not.toBe(true)
+      expect(modelSubBlock?.type).toBe('combobox')
+      expect(modelSubBlock?.commandSearchable).toBe(true)
+    })
+
+    it('should hide generator API keys on hosted only for Fal.ai providers', () => {
+      for (const blockType of ['image_generator_v2', 'video_generator_v3']) {
+        const block = getBlock(blockType)
+        const apiKeySubBlocks = block?.subBlocks.filter((sb) => sb.id === 'apiKey') ?? []
+
+        const falApiKeySubBlock = apiKeySubBlocks.find(
+          (sb) => sb.condition?.field === 'provider' && sb.condition.value === 'falai'
+        )
+        const nonFalApiKeySubBlock = apiKeySubBlocks.find(
+          (sb) =>
+            sb.condition?.field === 'provider' &&
+            sb.condition.value === 'falai' &&
+            sb.condition.not === true
+        )
+
+        expect(falApiKeySubBlock?.hideWhenHosted).toBe(true)
+        expect(nonFalApiKeySubBlock).toBeDefined()
+        expect(nonFalApiKeySubBlock?.hideWhenHosted).not.toBe(true)
+      }
+    })
   })
 
   describe('Block Consistency', () => {
diff --git a/apps/sim/blocks/blocks/agent.ts b/apps/sim/blocks/blocks/agent.ts
index b5068dfeece..30b506edcc7 100644
--- a/apps/sim/blocks/blocks/agent.ts
+++ b/apps/sim/blocks/blocks/agent.ts
@@ -133,6 +133,7 @@ Return ONLY the JSON array.`,
       required: true,
       defaultValue: 'claude-sonnet-4-6',
       options: getModelOptions,
+      commandSearchable: true,
     },
     {
       id: 'attachmentFiles',
diff --git a/apps/sim/blocks/blocks/image_generator.ts b/apps/sim/blocks/blocks/image_generator.ts
index be543494f53..5e095803128 100644
--- a/apps/sim/blocks/blocks/image_generator.ts
+++ b/apps/sim/blocks/blocks/image_generator.ts
@@ -333,7 +333,8 @@ export const ImageGeneratorV2Block: BlockConfig<ImageGenerationResponse> = {
         { label: 'Google Gemini', id: 'gemini' },
         { label: 'Fal.ai (Multi-Model)', id: 'falai' },
       ],
-      value: () => 'openai',
+      commandSearchable: true,
+      value: () => 'falai',
     },
     {
       id: 'model',
@@ -812,6 +813,18 @@ export const ImageGeneratorV2Block: BlockConfig<ImageGenerationResponse> = {
       placeholder: 'Enter your provider API key',
       password: true,
       connectionDroppable: false,
+      hideWhenHosted: true,
+      condition: { field: 'provider', value: 'falai' },
+    },
+    {
+      id: 'apiKey',
+      title: 'API Key',
+      type: 'short-input',
+      required: true,
+      placeholder: 'Enter your provider API key',
+      password: true,
+      connectionDroppable: false,
+      condition: { field: 'provider', value: 'falai', not: true },
     },
   ],
   tools: {
@@ -819,14 +832,13 @@ export const ImageGeneratorV2Block: BlockConfig<ImageGenerationResponse> = {
     config: {
       tool: () => 'image_generate',
       params: (params) => {
-        if (!params.apiKey) {
+        const provider = params.provider || 'openai'
+        if (provider !== 'falai' && !params.apiKey) {
           throw new Error('API key is required')
         }
         if (!params.prompt) {
           throw new Error('Prompt is required')
         }
-
-        const provider = params.provider || 'openai'
         const defaultModel =
           provider === 'gemini'
             ? 'gemini-3.1-flash-image-preview'
diff --git a/apps/sim/blocks/blocks/video_generator.ts b/apps/sim/blocks/blocks/video_generator.ts
index 4476891c297..86ab18e70d6 100644
--- a/apps/sim/blocks/blocks/video_generator.ts
+++ b/apps/sim/blocks/blocks/video_generator.ts
@@ -98,7 +98,7 @@ export const VideoGeneratorBlock: BlockConfig<VideoBlockResponse> = {
         { label: 'MiniMax Hailuo', id: 'minimax' },
         { label: 'Fal.ai (Multi-Model)', id: 'falai' },
       ],
-      value: () => 'runway',
+      value: () => 'falai',
       required: true,
     },
 
@@ -776,6 +776,17 @@ export const VideoGeneratorBlock: BlockConfig<VideoBlockResponse> = {
       placeholder: 'Enter your provider API key',
       password: true,
       required: true,
+      hideWhenHosted: true,
+      condition: { field: 'provider', value: 'falai' },
+    },
+    {
+      id: 'apiKey',
+      title: 'API Key',
+      type: 'short-input',
+      placeholder: 'Enter your provider API key',
+      password: true,
+      required: true,
+      condition: { field: 'provider', value: 'falai', not: true },
     },
   ],
 
@@ -894,7 +905,8 @@ export const VideoGeneratorV2Block: BlockConfig<VideoBlockResponse> = {
         { label: 'MiniMax Hailuo', id: 'minimax' },
         { label: 'Fal.ai (Multi-Model)', id: 'falai' },
       ],
-      value: () => 'runway',
+      commandSearchable: true,
+      value: () => 'falai',
       required: true,
     },
     {
@@ -1537,6 +1549,17 @@ export const VideoGeneratorV2Block: BlockConfig<VideoBlockResponse> = {
       placeholder: 'Enter your provider API key',
       password: true,
       required: true,
+      hideWhenHosted: true,
+      condition: { field: 'provider', value: 'falai' },
+    },
+    {
+      id: 'apiKey',
+      title: 'API Key',
+      type: 'short-input',
+      placeholder: 'Enter your provider API key',
+      password: true,
+      required: true,
+      condition: { field: 'provider', value: 'falai', not: true },
     },
   ],
   tools: {
diff --git a/apps/sim/blocks/blocks/vision.ts b/apps/sim/blocks/blocks/vision.ts
index 46c910ad8f4..0ab0f2934fc 100644
--- a/apps/sim/blocks/blocks/vision.ts
+++ b/apps/sim/blocks/blocks/vision.ts
@@ -109,7 +109,7 @@ export const VisionV2Block: BlockConfig<VisionResponse> = {
   type: 'vision_v2',
   name: 'Vision',
   description: 'Analyze images with vision models',
-  hideFromToolbar: false,
+  hideFromToolbar: true,
   tools: {
     access: ['vision_tool_v2'],
     config: {
diff --git a/apps/sim/blocks/types.ts b/apps/sim/blocks/types.ts
index 4125cb1e928..010be57690a 100644
--- a/apps/sim/blocks/types.ts
+++ b/apps/sim/blocks/types.ts
@@ -305,6 +305,8 @@ export interface SubBlockConfig {
   multiSelect?: boolean
   // Combobox specific: Enable search input in dropdown
   searchable?: boolean
+  /** Dropdown-specific: include static options as Cmd K search entries that preset this subblock. */
+  commandSearchable?: boolean
   // Wand configuration for AI assistance
   wandConfig?: {
     enabled: boolean
diff --git a/apps/sim/lib/api/contracts/byok-keys.ts b/apps/sim/lib/api/contracts/byok-keys.ts
index d427e506f32..7a761c44bd3 100644
--- a/apps/sim/lib/api/contracts/byok-keys.ts
+++ b/apps/sim/lib/api/contracts/byok-keys.ts
@@ -7,6 +7,7 @@ export const byokProviderIdSchema = z.enum([
   'google',
   'mistral',
   'fireworks',
+  'falai',
   'firecrawl',
   'exa',
   'serper',
diff --git a/apps/sim/lib/api/contracts/tools/media/image.ts b/apps/sim/lib/api/contracts/tools/media/image.ts
index 0172a899cbe..81ac09927e7 100644
--- a/apps/sim/lib/api/contracts/tools/media/image.ts
+++ b/apps/sim/lib/api/contracts/tools/media/image.ts
@@ -37,6 +37,7 @@ export const imageToolBodySchema = z
     workflowId: z.string().optional(),
     executionId: z.string().optional(),
     userId: z.string().optional(),
+    useHostedCostTracking: z.boolean().optional(),
   })
   .passthrough()
 
diff --git a/apps/sim/lib/api/contracts/tools/media/video.ts b/apps/sim/lib/api/contracts/tools/media/video.ts
index 222e9385237..24122d5f2b3 100644
--- a/apps/sim/lib/api/contracts/tools/media/video.ts
+++ b/apps/sim/lib/api/contracts/tools/media/video.ts
@@ -29,6 +29,7 @@ export const videoToolBodySchema = z
     workflowId: z.string().optional(),
     executionId: z.string().optional(),
     userId: z.string().optional(),
+    useHostedCostTracking: z.boolean().optional(),
   })
   .passthrough()
 
diff --git a/apps/sim/lib/tools/falai-pricing.ts b/apps/sim/lib/tools/falai-pricing.ts
new file mode 100644
index 00000000000..f94f4d5d060
--- /dev/null
+++ b/apps/sim/lib/tools/falai-pricing.ts
@@ -0,0 +1,205 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { sleep } from '@sim/utils/helpers'
+
+export const FALAI_HOSTED_KEY_MARKUP_MULTIPLIER = 1.5
+export const FALAI_IMAGE_FALLBACK_PROVIDER_COST_DOLLARS = 0.05
+export const FALAI_VIDEO_FALLBACK_PROVIDER_COST_DOLLARS = 0.25
+const FALAI_BILLING_EVENT_ATTEMPTS = 2
+const FALAI_BILLING_EVENT_RETRY_MS = 500
+const logger = createLogger('FalAIPricing')
+
+export interface FalAICostMetadata {
+  endpointId: string
+  requestId: string
+  costDollars: number
+  source: 'billing_events' | 'historical_estimate' | 'fallback_floor'
+  outputUnits?: number | null
+  unitPrice?: number | null
+  percentDiscount?: number | null
+  currency?: string
+  error?: string
+}
+
+interface FalAIBillingEvent {
+  request_id: string
+  endpoint_id: string
+  output_units: number | null
+  unit_price: number | null
+  percent_discount: number | null
+  cost_estimate_nano_usd: number
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function getNumber(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isFinite(value) ? value : undefined
+}
+
+function getFalAIFallbackProviderCostDollars(endpointId: string): number {
+  const normalizedEndpointId = endpointId.toLowerCase()
+  const isImageEndpoint =
+    normalizedEndpointId.includes('image') ||
+    normalizedEndpointId.includes('nano-banana') ||
+    normalizedEndpointId.includes('seedream') ||
+    normalizedEndpointId.includes('flux') ||
+    normalizedEndpointId.includes('grok-imagine')
+
+  return isImageEndpoint
+    ? FALAI_IMAGE_FALLBACK_PROVIDER_COST_DOLLARS
+    : FALAI_VIDEO_FALLBACK_PROVIDER_COST_DOLLARS
+}
+
+function parseBillingEvent(value: unknown): FalAIBillingEvent | undefined {
+  if (!isRecord(value)) return undefined
+
+  const requestId = value.request_id
+  const endpointId = value.endpoint_id
+  const costEstimateNanoUsd = getNumber(value.cost_estimate_nano_usd)
+
+  if (typeof requestId !== 'string' || typeof endpointId !== 'string') return undefined
+  if (costEstimateNanoUsd === undefined) return undefined
+
+  return {
+    request_id: requestId,
+    endpoint_id: endpointId,
+    output_units: getNumber(value.output_units) ?? null,
+    unit_price: getNumber(value.unit_price) ?? null,
+    percent_discount: getNumber(value.percent_discount) ?? null,
+    cost_estimate_nano_usd: costEstimateNanoUsd,
+  }
+}
+
+async function fetchFalAIBillingEvent(
+  apiKey: string,
+  requestId: string
+): Promise<FalAIBillingEvent | undefined> {
+  const url = new URL('https://api.fal.ai/v1/models/billing-events')
+  url.searchParams.set('request_id', requestId)
+  url.searchParams.set('limit', '1')
+
+  let response: Response
+  try {
+    response = await fetch(url, {
+      headers: {
+        Authorization: `Key ${apiKey}`,
+      },
+    })
+  } catch (error) {
+    logger.warn('Failed to fetch Fal.ai billing event', {
+      requestId,
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return undefined
+  }
+
+  if (!response.ok) return undefined
+
+  const data = await response.json().catch((error) => {
+    logger.warn('Failed to parse Fal.ai billing event response', {
+      requestId,
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return undefined
+  })
+  if (!isRecord(data) || !Array.isArray(data.billing_events)) return undefined
+
+  return data.billing_events.map(parseBillingEvent).find(Boolean)
+}
+
+async function estimateFalAICallCost(
+  apiKey: string,
+  endpointId: string
+): Promise<{ costDollars?: number; error?: string }> {
+  let response: Response
+  try {
+    response = await fetch('https://api.fal.ai/v1/models/pricing/estimate', {
+      method: 'POST',
+      headers: {
+        Authorization: `Key ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        estimate_type: 'historical_api_price',
+        endpoints: {
+          [endpointId]: {
+            call_quantity: 1,
+          },
+        },
+      }),
+    })
+  } catch (error) {
+    return { error: getErrorMessage(error, 'Unknown error') }
+  }
+
+  if (!response.ok) {
+    const error = await response.text().catch(() => '')
+    return { error: `Fal.ai pricing estimate failed: ${response.status} ${error}` }
+  }
+
+  const data = (await response.json()) as unknown
+  const totalCost = isRecord(data) ? getNumber(data.total_cost) : undefined
+  if (totalCost === undefined) {
+    return { error: 'Fal.ai pricing estimate missing total_cost' }
+  }
+
+  return { costDollars: totalCost }
+}
+
+export async function getFalAICostMetadata({
+  apiKey,
+  endpointId,
+  requestId,
+}: {
+  apiKey: string
+  endpointId: string
+  requestId: string
+}): Promise<FalAICostMetadata> {
+  for (let attempt = 0; attempt < FALAI_BILLING_EVENT_ATTEMPTS; attempt++) {
+    const event = await fetchFalAIBillingEvent(apiKey, requestId)
+    if (event) {
+      return {
+        endpointId: event.endpoint_id,
+        requestId: event.request_id,
+        costDollars: event.cost_estimate_nano_usd / 1_000_000_000,
+        source: 'billing_events',
+        outputUnits: event.output_units,
+        unitPrice: event.unit_price,
+        percentDiscount: event.percent_discount,
+        currency: 'USD',
+      }
+    }
+
+    if (attempt < FALAI_BILLING_EVENT_ATTEMPTS - 1) {
+      await sleep(FALAI_BILLING_EVENT_RETRY_MS)
+    }
+  }
+
+  const estimate = await estimateFalAICallCost(apiKey, endpointId)
+  if (estimate.costDollars !== undefined) {
+    return {
+      endpointId,
+      requestId,
+      costDollars: estimate.costDollars,
+      source: 'historical_estimate',
+      currency: 'USD',
+    }
+  }
+
+  logger.warn('Fal.ai cost metadata unavailable after generation completed', {
+    endpointId,
+    requestId,
+    error: estimate.error,
+  })
+
+  return {
+    endpointId,
+    requestId,
+    costDollars: getFalAIFallbackProviderCostDollars(endpointId),
+    source: 'fallback_floor',
+    currency: 'USD',
+    error: estimate.error,
+  }
+}
diff --git a/apps/sim/stores/modals/search/store.test.ts b/apps/sim/stores/modals/search/store.test.ts
new file mode 100644
index 00000000000..36492582e1d
--- /dev/null
+++ b/apps/sim/stores/modals/search/store.test.ts
@@ -0,0 +1,151 @@
+import { createElement, type SVGProps } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { BlockConfig } from '@/blocks/types'
+
+const { mockGetAllBlocks, mockGetToolOperationsIndex, mockGetTriggersForSidebar } = vi.hoisted(
+  () => ({
+    mockGetAllBlocks: vi.fn(),
+    mockGetToolOperationsIndex: vi.fn(() => []),
+    mockGetTriggersForSidebar: vi.fn(() => []),
+  })
+)
+
+vi.mock('@/blocks', () => ({
+  getAllBlocks: mockGetAllBlocks,
+}))
+
+vi.mock('@/lib/search/tool-operations', () => ({
+  getToolOperationsIndex: mockGetToolOperationsIndex,
+}))
+
+vi.mock('@/lib/workflows/triggers/trigger-utils', () => ({
+  getTriggersForSidebar: mockGetTriggersForSidebar,
+}))
+
+import {
+  buildCommandSearchableOptionSearchValue,
+  useSearchModalStore,
+} from '@/stores/modals/search/store'
+
+function TestIcon(props: SVGProps<SVGSVGElement>) {
+  return createElement('svg', props)
+}
+
+function createBlock(overrides: Partial<BlockConfig> = {}): BlockConfig {
+  return {
+    type: 'image_generator_v2',
+    name: 'Image Generator',
+    description: 'Generate images',
+    category: 'tools',
+    bgColor: '#4D5FFF',
+    icon: TestIcon,
+    subBlocks: [
+      {
+        id: 'provider',
+        title: 'Provider',
+        type: 'dropdown',
+        commandSearchable: true,
+        options: [
+          { label: 'OpenAI', id: 'openai' },
+          { label: 'Fal.ai (Multi-Model)', id: 'falai' },
+          { label: 'Hidden Provider', id: 'hidden', hidden: true },
+        ],
+      },
+    ],
+    tools: { access: ['image_generate'] },
+    inputs: {},
+    outputs: {},
+    ...overrides,
+  }
+}
+
+describe('search modal store', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    useSearchModalStore.setState({
+      isOpen: false,
+      data: {
+        blocks: [],
+        tools: [],
+        triggers: [],
+        toolOperations: [],
+        docs: [],
+        isInitialized: false,
+      },
+    })
+  })
+
+  describe('buildCommandSearchableOptionSearchValue', () => {
+    it('builds search terms for marked static dropdown options', () => {
+      const block = createBlock()
+      const searchValue = buildCommandSearchableOptionSearchValue(block)
+
+      expect(searchValue).toContain('Provider')
+      expect(searchValue).toContain('Fal.ai (Multi-Model)')
+      expect(searchValue).toContain('falai')
+      expect(searchValue).not.toContain('Hidden Provider')
+      expect(searchValue).not.toContain('hidden')
+    })
+
+    it('does not index dropdowns that only use in-dropdown search', () => {
+      const block = createBlock({
+        subBlocks: [
+          {
+            id: 'timezone',
+            title: 'Timezone',
+            type: 'dropdown',
+            searchable: true,
+            options: [{ label: 'UTC', id: 'utc' }],
+          },
+        ],
+      })
+
+      expect(buildCommandSearchableOptionSearchValue(block)).toBe('')
+    })
+
+    it('builds search terms for marked combobox option functions', () => {
+      const block = createBlock({
+        subBlocks: [
+          {
+            id: 'model',
+            title: 'Model',
+            type: 'combobox',
+            commandSearchable: true,
+            options: () => [
+              { label: 'claude-sonnet-4-6', id: 'claude-sonnet-4-6' },
+              { label: 'Hidden Model', id: 'hidden-model', hidden: true },
+            ],
+          },
+        ],
+      })
+
+      const searchValue = buildCommandSearchableOptionSearchValue(block)
+
+      expect(searchValue).toContain('Model')
+      expect(searchValue).toContain('claude-sonnet-4-6')
+      expect(searchValue).not.toContain('Hidden Model')
+      expect(searchValue).not.toContain('hidden-model')
+    })
+  })
+
+  it('adds command-searchable options to visible block search values without extra rows', () => {
+    const visibleBlock = createBlock()
+    const hiddenBlock = createBlock({
+      type: 'hidden_generator',
+      hideFromToolbar: true,
+    })
+
+    mockGetAllBlocks.mockReturnValue([visibleBlock, hiddenBlock])
+
+    useSearchModalStore.getState().initializeData((blocks) => blocks)
+
+    const { tools } = useSearchModalStore.getState().data
+    expect(tools).toHaveLength(1)
+    expect(tools[0]).toEqual(
+      expect.objectContaining({
+        id: 'image_generator_v2',
+        searchValue: expect.stringContaining('Fal.ai (Multi-Model)'),
+      })
+    )
+  })
+})
diff --git a/apps/sim/stores/modals/search/store.ts b/apps/sim/stores/modals/search/store.ts
index 5a928246d34..ad2bb6004a2 100644
--- a/apps/sim/stores/modals/search/store.ts
+++ b/apps/sim/stores/modals/search/store.ts
@@ -4,6 +4,7 @@ import { devtools } from 'zustand/middleware'
 import { getToolOperationsIndex } from '@/lib/search/tool-operations'
 import { getTriggersForSidebar } from '@/lib/workflows/triggers/trigger-utils'
 import { getAllBlocks } from '@/blocks'
+import type { BlockConfig, SubBlockConfig } from '@/blocks/types'
 import type {
   SearchBlockItem,
   SearchData,
@@ -21,6 +22,47 @@ const initialData: SearchData = {
   isInitialized: false,
 }
 
+type CommandSearchableOption = {
+  label: string
+  id: string
+  hidden?: boolean
+}
+
+function getCommandSearchableOptions(subBlock: SubBlockConfig): CommandSearchableOption[] {
+  if (!subBlock.options) return []
+
+  try {
+    const options = typeof subBlock.options === 'function' ? subBlock.options() : subBlock.options
+    return Array.isArray(options) ? options : []
+  } catch {
+    return []
+  }
+}
+
+export function buildCommandSearchableOptionSearchValue(block: BlockConfig): string {
+  const terms = new Set<string>()
+
+  for (const subBlock of block.subBlocks) {
+    if (
+      (subBlock.type !== 'dropdown' && subBlock.type !== 'combobox') ||
+      !subBlock.commandSearchable
+    ) {
+      continue
+    }
+
+    for (const option of getCommandSearchableOptions(subBlock)) {
+      if (option.hidden) continue
+
+      const subBlockTitle = subBlock.title ?? subBlock.id
+      terms.add(subBlockTitle)
+      terms.add(option.label)
+      terms.add(option.id)
+    }
+  }
+
+  return Array.from(terms).join(' ')
+}
+
 export const useSearchModalStore = create<SearchModalState>()(
   devtools(
     (set, _) => ({
@@ -56,6 +98,7 @@ export const useSearchModalStore = create<SearchModalState>()(
             icon: block.icon,
             bgColor: block.bgColor || '#6B7280',
             type: block.type,
+            searchValue: `${block.name} ${block.type} block-${block.type} ${buildCommandSearchableOptionSearchValue(block)}`,
           }
 
           if (block.category === 'blocks' && block.type !== 'starter') {
diff --git a/apps/sim/stores/modals/search/types.ts b/apps/sim/stores/modals/search/types.ts
index ead6c2cb6a0..b276f23627a 100644
--- a/apps/sim/stores/modals/search/types.ts
+++ b/apps/sim/stores/modals/search/types.ts
@@ -11,6 +11,7 @@ export interface SearchBlockItem {
   bgColor: string
   type: string
   config?: BlockConfig
+  searchValue?: string
 }
 
 /**
diff --git a/apps/sim/tools/falai-hosting.test.ts b/apps/sim/tools/falai-hosting.test.ts
new file mode 100644
index 00000000000..d3df0abfdd2
--- /dev/null
+++ b/apps/sim/tools/falai-hosting.test.ts
@@ -0,0 +1,108 @@
+/**
+ * @vitest-environment node
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import {
+  FALAI_HOSTED_KEY_MARKUP_MULTIPLIER,
+  FALAI_IMAGE_FALLBACK_PROVIDER_COST_DOLLARS,
+  getFalAICostMetadata,
+} from '@/lib/tools/falai-pricing'
+import { imageGenerateTool } from '@/tools/image/generate'
+import { falaiVideoTool } from '@/tools/video/falai'
+
+afterEach(() => {
+  vi.useRealTimers()
+  vi.unstubAllGlobals()
+})
+
+describe('Fal.ai hosted key pricing', () => {
+  it('applies hosted markup to image generation provider cost', () => {
+    const pricing = imageGenerateTool.hosting?.pricing
+    expect(pricing?.type).toBe('custom')
+    if (!pricing || pricing.type !== 'custom') throw new Error('Expected custom pricing')
+
+    const result = pricing.getCost(
+      {},
+      {
+        __falaiCostDollars: 0.1,
+        __falaiBilling: {
+          source: 'billing_events',
+          endpointId: 'fal-ai/nano-banana-2',
+        },
+      }
+    )
+
+    expect(typeof result).toBe('object')
+    if (typeof result === 'number') throw new Error('Expected structured pricing result')
+    expect(result.cost).toBeCloseTo(0.1 * FALAI_HOSTED_KEY_MARKUP_MULTIPLIER)
+    expect(result.metadata).toMatchObject({
+      providerCostDollars: 0.1,
+      markupMultiplier: FALAI_HOSTED_KEY_MARKUP_MULTIPLIER,
+      source: 'billing_events',
+    })
+  })
+
+  it('applies hosted markup to video generation provider cost', () => {
+    const pricing = falaiVideoTool.hosting?.pricing
+    expect(pricing?.type).toBe('custom')
+    if (!pricing || pricing.type !== 'custom') throw new Error('Expected custom pricing')
+
+    const result = pricing.getCost(
+      {},
+      {
+        __falaiCostDollars: 0.4,
+        __falaiBilling: {
+          source: 'billing_events',
+          endpointId: 'fal-ai/veo3.1',
+        },
+      }
+    )
+
+    expect(typeof result).toBe('object')
+    if (typeof result === 'number') throw new Error('Expected structured pricing result')
+    expect(result.cost).toBeCloseTo(0.4 * FALAI_HOSTED_KEY_MARKUP_MULTIPLIER)
+    expect(result.metadata).toMatchObject({
+      providerCostDollars: 0.4,
+      markupMultiplier: FALAI_HOSTED_KEY_MARKUP_MULTIPLIER,
+      source: 'billing_events',
+    })
+  })
+
+  it('returns fallback floor cost metadata instead of throwing when billing and estimate fail', async () => {
+    vi.useFakeTimers()
+
+    const mockFetch = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ billing_events: [] }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      )
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ billing_events: [] }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      )
+      .mockResolvedValueOnce(new Response('pricing unavailable', { status: 500 }))
+    vi.stubGlobal('fetch', mockFetch)
+
+    const resultPromise = getFalAICostMetadata({
+      apiKey: 'fal-key',
+      endpointId: 'fal-ai/nano-banana-2',
+      requestId: 'request-1',
+    })
+
+    await vi.advanceTimersByTimeAsync(500)
+    const result = await resultPromise
+
+    expect(result).toMatchObject({
+      endpointId: 'fal-ai/nano-banana-2',
+      requestId: 'request-1',
+      costDollars: FALAI_IMAGE_FALLBACK_PROVIDER_COST_DOLLARS,
+      source: 'fallback_floor',
+      currency: 'USD',
+    })
+  })
+})
diff --git a/apps/sim/tools/image/generate.ts b/apps/sim/tools/image/generate.ts
index e67de7e5428..d100d84d66f 100644
--- a/apps/sim/tools/image/generate.ts
+++ b/apps/sim/tools/image/generate.ts
@@ -1,3 +1,4 @@
+import { FALAI_HOSTED_KEY_MARKUP_MULTIPLIER } from '@/lib/tools/falai-pricing'
 import type { ImageGenerationParams, ImageGenerationResponse } from '@/tools/image/types'
 import type { ToolConfig } from '@/tools/types'
 
@@ -113,6 +114,38 @@ export const imageGenerateTool: ToolConfig<ImageGenerationParams, ImageGeneratio
     },
   },
 
+  hosting: {
+    enabled: (params) => params.provider === 'falai',
+    envKeyPrefix: 'FALAI_API_KEY',
+    apiKeyParam: 'apiKey',
+    byokProviderId: 'falai',
+    pricing: {
+      type: 'custom',
+      getCost: (_params, output) => {
+        const providerCostDollars = output.__falaiCostDollars
+        if (typeof providerCostDollars !== 'number' || Number.isNaN(providerCostDollars)) {
+          throw new Error('Fal.ai image response missing cost data')
+        }
+
+        return {
+          cost: providerCostDollars * FALAI_HOSTED_KEY_MARKUP_MULTIPLIER,
+          metadata: {
+            ...(typeof output.__falaiBilling === 'object' && output.__falaiBilling !== null
+              ? (output.__falaiBilling as Record<string, unknown>)
+              : {}),
+            providerCostDollars,
+            markupMultiplier: FALAI_HOSTED_KEY_MARKUP_MULTIPLIER,
+          },
+        }
+      },
+    },
+    rateLimit: {
+      mode: 'per_request',
+      requestsPerMinute: 40,
+      burstMultiplier: 1,
+    },
+  },
+
   request: {
     url: '/api/tools/image',
     method: 'POST',
@@ -122,6 +155,7 @@ export const imageGenerateTool: ToolConfig<ImageGenerationParams, ImageGeneratio
     body: (
       params: ImageGenerationParams & {
         _context?: { workspaceId?: string; workflowId?: string; executionId?: string }
+        __usingHostedKey?: boolean
       }
     ) => ({
       provider: params.provider,
@@ -144,6 +178,7 @@ export const imageGenerateTool: ToolConfig<ImageGenerationParams, ImageGeneratio
       workspaceId: params._context?.workspaceId,
       workflowId: params._context?.workflowId,
       executionId: params._context?.executionId,
+      useHostedCostTracking: params.__usingHostedKey === true,
     }),
   },
 
@@ -159,6 +194,8 @@ export const imageGenerateTool: ToolConfig<ImageGenerationParams, ImageGeneratio
       provider?: string
       model?: string
       metadata?: ImageGenerationResponse['output']['metadata']
+      __falaiCostDollars?: number
+      __falaiBilling?: ImageGenerationResponse['output']['__falaiBilling']
     }
 
     if (!response.ok || data.error) {
@@ -203,6 +240,8 @@ export const imageGenerateTool: ToolConfig<ImageGenerationParams, ImageGeneratio
           model: data.model || data.metadata?.model || '',
           ...data.metadata,
         },
+        __falaiCostDollars: data.__falaiCostDollars,
+        __falaiBilling: data.__falaiBilling,
       },
     }
   },
diff --git a/apps/sim/tools/image/types.ts b/apps/sim/tools/image/types.ts
index cb34c9adb42..1a1f9e2416f 100644
--- a/apps/sim/tools/image/types.ts
+++ b/apps/sim/tools/image/types.ts
@@ -36,5 +36,16 @@ export interface ImageGenerationResponse extends ToolResponse {
       jobId?: string
       contentType?: string
     }
+    __falaiCostDollars?: number
+    __falaiBilling?: {
+      endpointId: string
+      requestId: string
+      source: 'billing_events' | 'historical_estimate' | 'fallback_floor'
+      outputUnits?: number | null
+      unitPrice?: number | null
+      percentDiscount?: number | null
+      currency?: string
+      error?: string
+    }
   }
 }
diff --git a/apps/sim/tools/index.test.ts b/apps/sim/tools/index.test.ts
index f014fc72363..fc22a66fab8 100644
--- a/apps/sim/tools/index.test.ts
+++ b/apps/sim/tools/index.test.ts
@@ -2797,4 +2797,128 @@ describe('Cost Field Handling', () => {
 
     Object.assign(tools, originalTools)
   })
+
+  it('should skip hosted key injection when hosting predicate is false', async () => {
+    const mockTool = {
+      id: 'test_conditional_hosting',
+      name: 'Test Conditional Hosting',
+      description: 'A test tool with conditional hosted keys',
+      version: '1.0.0',
+      params: {
+        provider: { type: 'string', required: false },
+        apiKey: { type: 'string', required: false },
+      },
+      hosting: {
+        enabled: (params: { provider?: string }) => params.provider === 'hosted-provider',
+        envKeyPrefix: 'TEST_HOSTED_KEY',
+        apiKeyParam: 'apiKey',
+        pricing: {
+          type: 'per_request' as const,
+          cost: 0.005,
+        },
+        rateLimit: {
+          mode: 'per_request' as const,
+          requestsPerMinute: 100,
+        },
+      },
+      request: {
+        url: '/api/test/conditional-hosting',
+        method: 'POST' as const,
+        headers: () => ({ 'Content-Type': 'application/json' }),
+      },
+      transformResponse: vi.fn().mockResolvedValue({
+        success: true,
+        output: { result: 'success' },
+      }),
+    }
+
+    const originalTools = { ...tools }
+    ;(tools as any).test_conditional_hosting = mockTool
+
+    global.fetch = Object.assign(
+      vi.fn().mockImplementation(async () => ({
+        ok: true,
+        status: 200,
+        headers: new Headers(),
+        json: () => Promise.resolve({ success: true }),
+      })),
+      { preconnect: vi.fn() }
+    ) as typeof fetch
+
+    const mockContext = createToolExecutionContext({
+      userId: 'user-123',
+    } as any)
+    const result = await executeTool(
+      'test_conditional_hosting',
+      { provider: 'user-provider' },
+      { executionContext: mockContext }
+    )
+
+    expect(result.success).toBe(true)
+    expect(mockRateLimiterFns.acquireKey).not.toHaveBeenCalled()
+    expect(result.output.cost).toBeUndefined()
+
+    Object.assign(tools, originalTools)
+  })
+
+  it('should skip hosted key injection when user provides an API key', async () => {
+    const mockTool = {
+      id: 'test_user_key_priority',
+      name: 'Test User Key Priority',
+      description: 'A test tool where user keys should win',
+      version: '1.0.0',
+      params: {
+        apiKey: { type: 'string', required: false },
+      },
+      hosting: {
+        envKeyPrefix: 'TEST_HOSTED_KEY',
+        apiKeyParam: 'apiKey',
+        pricing: {
+          type: 'per_request' as const,
+          cost: 0.005,
+        },
+        rateLimit: {
+          mode: 'per_request' as const,
+          requestsPerMinute: 100,
+        },
+      },
+      request: {
+        url: '/api/test/user-key-priority',
+        method: 'POST' as const,
+        headers: () => ({ 'Content-Type': 'application/json' }),
+      },
+      transformResponse: vi.fn().mockResolvedValue({
+        success: true,
+        output: { result: 'success' },
+      }),
+    }
+
+    const originalTools = { ...tools }
+    ;(tools as any).test_user_key_priority = mockTool
+
+    global.fetch = Object.assign(
+      vi.fn().mockImplementation(async () => ({
+        ok: true,
+        status: 200,
+        headers: new Headers(),
+        json: () => Promise.resolve({ success: true }),
+      })),
+      { preconnect: vi.fn() }
+    ) as typeof fetch
+
+    const mockContext = createToolExecutionContext({
+      userId: 'user-123',
+    } as any)
+    const result = await executeTool(
+      'test_user_key_priority',
+      { apiKey: 'user-api-key' },
+      { executionContext: mockContext }
+    )
+
+    expect(result.success).toBe(true)
+    expect(mockRateLimiterFns.acquireKey).not.toHaveBeenCalled()
+    expect(result.output.cost).toBeUndefined()
+
+    Object.assign(tools, originalTools)
+  })
 })
diff --git a/apps/sim/tools/index.ts b/apps/sim/tools/index.ts
index ce8357bba20..66a641a72e6 100644
--- a/apps/sim/tools/index.ts
+++ b/apps/sim/tools/index.ts
@@ -232,8 +232,15 @@ async function injectHostedKeyIfNeeded(
 ): Promise<HostedKeyInjectionResult> {
   if (!tool.hosting) return { isUsingHostedKey: false }
   if (!isHosted) return { isUsingHostedKey: false }
+  if (tool.hosting.enabled && !tool.hosting.enabled(params)) {
+    return { isUsingHostedKey: false }
+  }
 
   const { envKeyPrefix, apiKeyParam, byokProviderId, rateLimit } = tool.hosting
+  const userProvidedKey = params[apiKeyParam]
+  if (typeof userProvidedKey === 'string' && userProvidedKey.trim().length > 0) {
+    return { isUsingHostedKey: false }
+  }
 
   const { workspaceId, userId, workflowId } = resolveToolScope(params, executionContext)
 
@@ -299,6 +306,7 @@ async function injectHostedKeyIfNeeded(
   }
 
   params[apiKeyParam] = acquireResult.key
+  params.__usingHostedKey = true
   logger.info(`[${requestId}] Using hosted key for ${tool.id} (${acquireResult.envVarName})`, {
     keyIndex: acquireResult.keyIndex,
     provider,
diff --git a/apps/sim/tools/types.ts b/apps/sim/tools/types.ts
index 5cd428c941e..6b39f863954 100644
--- a/apps/sim/tools/types.ts
+++ b/apps/sim/tools/types.ts
@@ -8,6 +8,7 @@ export type BYOKProviderId =
   | 'google'
   | 'mistral'
   | 'fireworks'
+  | 'falai'
   | 'firecrawl'
   | 'exa'
   | 'serper'
@@ -307,6 +308,8 @@ export type ToolHostingPricing<P = Record<string, unknown>> = PerRequestPricing
  * no code changes needed.
  */
 interface ToolHostingConfig<P = Record<string, unknown>> {
+  /** Optional predicate for tools where hosted keys only apply to some parameter combinations. */
+  enabled?: (params: P) => boolean
   /**
    * Env var name prefix for hosted keys.
    * At runtime, `{envKeyPrefix}_COUNT` is read to determine how many keys exist,
diff --git a/apps/sim/tools/video/falai.ts b/apps/sim/tools/video/falai.ts
index 77999d87820..b2314472f4d 100644
--- a/apps/sim/tools/video/falai.ts
+++ b/apps/sim/tools/video/falai.ts
@@ -1,3 +1,4 @@
+import { FALAI_HOSTED_KEY_MARKUP_MULTIPLIER } from '@/lib/tools/falai-pricing'
 import type { ToolConfig } from '@/tools/types'
 import type { VideoParams, VideoResponse } from '@/tools/video/types'
 import { parseBooleanParam, parseBooleanParamWithDefault } from '@/tools/video/utils'
@@ -68,6 +69,37 @@ export const falaiVideoTool: ToolConfig<VideoParams, VideoResponse> = {
     },
   },
 
+  hosting: {
+    envKeyPrefix: 'FALAI_API_KEY',
+    apiKeyParam: 'apiKey',
+    byokProviderId: 'falai',
+    pricing: {
+      type: 'custom',
+      getCost: (_params, output) => {
+        const providerCostDollars = output.__falaiCostDollars
+        if (typeof providerCostDollars !== 'number' || Number.isNaN(providerCostDollars)) {
+          throw new Error('Fal.ai video response missing cost data')
+        }
+
+        return {
+          cost: providerCostDollars * FALAI_HOSTED_KEY_MARKUP_MULTIPLIER,
+          metadata: {
+            ...(typeof output.__falaiBilling === 'object' && output.__falaiBilling !== null
+              ? (output.__falaiBilling as Record<string, unknown>)
+              : {}),
+            providerCostDollars,
+            markupMultiplier: FALAI_HOSTED_KEY_MARKUP_MULTIPLIER,
+          },
+        }
+      },
+    },
+    rateLimit: {
+      mode: 'per_request',
+      requestsPerMinute: 40,
+      burstMultiplier: 1,
+    },
+  },
+
   request: {
     url: '/api/tools/video',
     method: 'POST',
@@ -77,6 +109,7 @@ export const falaiVideoTool: ToolConfig<VideoParams, VideoResponse> = {
     body: (
       params: VideoParams & {
         _context?: { workspaceId?: string; workflowId?: string; executionId?: string }
+        __usingHostedKey?: boolean
       }
     ) => ({
       provider: 'falai',
@@ -91,6 +124,7 @@ export const falaiVideoTool: ToolConfig<VideoParams, VideoResponse> = {
       workspaceId: params._context?.workspaceId,
       workflowId: params._context?.workflowId,
       executionId: params._context?.executionId,
+      useHostedCostTracking: params.__usingHostedKey === true,
     }),
   },
 
@@ -128,6 +162,8 @@ export const falaiVideoTool: ToolConfig<VideoParams, VideoResponse> = {
         provider: 'falai',
         model: data.model,
         jobId: data.jobId,
+        __falaiCostDollars: data.__falaiCostDollars,
+        __falaiBilling: data.__falaiBilling,
       },
     }
   },
diff --git a/apps/sim/tools/video/types.ts b/apps/sim/tools/video/types.ts
index 5d31e29e2c7..861e9eabec4 100644
--- a/apps/sim/tools/video/types.ts
+++ b/apps/sim/tools/video/types.ts
@@ -33,6 +33,17 @@ export interface VideoResponse extends ToolResponse {
     provider?: string
     model?: string
     jobId?: string
+    __falaiCostDollars?: number
+    __falaiBilling?: {
+      endpointId: string
+      requestId: string
+      source: 'billing_events' | 'historical_estimate' | 'fallback_floor'
+      outputUnits?: number | null
+      unitPrice?: number | null
+      percentDiscount?: number | null
+      currency?: string
+      error?: string
+    }
   }
 }