feat(copilot): add the platform subagent

[j15z]

What

Registers the new platform subagent client-side — the sim half of a paired change (mothership: simstudioai/mothership#417, to be merged together). The platform agent is a context-isolated Sim-product specialist that takes over the docs beat (search_docs + the docs/ corpus) from the search agent.

• Generated mirrors: tool catalog + tool schemas regenerated from the mothership branch definitions, picking up the platform trigger tool and the slimmed search-agent surface.
• Client display: platform-agent tool chip naming in tool-display.ts and the home message-content types, so a platform delegation renders with a proper label instead of a raw tool ID.

Stacked PR

Stacked on #6389 (base = feat/docs-vfs-search-docs) — this diff shows only the platform-agent delta. The base auto-retargets to staging when #6389 merges; merge in order.

Deploy note

Same pairing rule as #6389: merge this and simstudioai/mothership#417 together and deploy normally.

Testing

Type-check clean; 669 copilot tool tests pass. Validated end-to-end at this stack level: Sim product questions route to the platform agent, which answers in ~1 search_docs round with named markdown-link citations (verified via traces).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 12, 2026 3:23am

[cursor]

PR Summary

Medium Risk
Touches enterprise access-control resolution and exposes billing/permission snapshots to copilot, but does not change authorization enforcement paths. Risk is mainly incorrect capability reporting rather than privilege escalation.

Overview
Registers the platform subagent and gives it live account/permission tools so product questions can be answered with current workspace access, not just docs.

Adds get_account_billing (plan, usage, credits) and get_enterprise_context (workspace capabilities, org relationship/role, governing permission group, and active restrictions). Access-control resolution is refactored to return richer context — including group resolution type and optional organizationRole on host context — without changing enforcement itself.

Also extracts shared PLATFORM_FEATURES for the Access Control UI and live restriction summaries, and updates permissions docs so deploy is Admin-only while Write can still run workflows.

^{Reviewed by Cursor Bugbot for commit 3adc397. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

Registers the client-side half of the new context-isolated Platform subagent, intended to be deployed with its paired Mothership implementation.

• Adds platform to the generated tool catalog, runtime schema, and subagent ID types.
• Adds Platform Agent labels and icon metadata to workspace message rendering and tool-display utilities.
• Moves Sim product-documentation delegation onto a dedicated subagent contract with a required self-contained task.

Confidence Score: 5/5

The client-side changes appear safe to merge as part of the explicitly paired Platform-agent deployment.

The generated catalog and schema agree on the new subagent contract, routing is derived from the catalog, and the relevant workspace display paths all recognize the platform identifier.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/generated/tool-catalog-v1.ts	Adds the Platform subagent’s catalog entry, unions, and registry mapping consistently with existing subagent definitions.
apps/sim/lib/copilot/generated/tool-schemas-v1.ts	Adds the matching runtime schema requiring a self-contained string task.
apps/sim/lib/copilot/tools/tool-display.ts	Adds the human-readable Platform Agent title to the central tool-title map.
apps/sim/app/workspace/[workspaceId]/home/types.ts	Adds the Platform Agent label used by workspace subagent rendering and dispatch recognition.
apps/sim/app/workspace/[workspaceId]/home/components/message-content/utils.ts	Assigns the Library icon to Platform agent groups in message content.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
Copilot[Copilot orchestrator] -->|platform task| Catalog[Generated tool catalog]
Catalog -->|route: subagent| Mothership[Mothership]
Mothership --> Platform[Platform agent]
Platform -->|subagent events| Workspace[Workspace message UI]
Workspace --> Label[Platform Agent label]
Workspace --> Icon[Library icon]

Loading

_{Reviews (1): Last reviewed commit: "feat(copilot): describe platform agent d..." | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3adc397. Configure here.}

[cursor]

Inactive AC exposes env restrictions

Medium Severity

get_enterprise_context always derives effectiveConfig and activeRestrictions from accessControl.config, even when entitled is false. Inactive contexts still run mergeEnvAllowlist(null), so a self-hosted ALLOWED_INTEGRATIONS value surfaces as Access Control restrictions with no governing group. The platform agent can then describe deployment env limits as permission-group policy.

Additional Locations (1)

• apps/sim/ee/access-control/utils/permission-check.ts#L158-L166

^{Reviewed by Cursor Bugbot for commit 3adc397. Configure here.}