fix(env): flag combinations for sandboxes

[icecrasher321]

Summary

Flag combinations for sandboxes to work in pattern with other enteprise features.

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 6, 2026 3:18am

[cursor]

PR Summary

Medium Risk
Changes entitlement and access-control paths for a paid/enterprise feature and workflow serialization behavior for Function blocks; incorrect flag wiring could hide sandboxes or expose UI without runtime, but tests and docs were updated accordingly.

Overview
Sandbox availability now requires both deployment entitlement and a configured remote Function provider (E2B/Daytona + immutable base). isSandboxDeploymentEntitled separates plan/Enterprise flags from isSandboxesEnabled, which combines entitlement with provider readiness. Billing-free self-hosted no longer treats sandboxes as on by default (sandboxes legacy default is false); hasWorkspaceSandboxAccess fails closed without a ready provider and no longer grants access when billing is disabled unless Enterprise or Sandbox flags are set.

Function block UI keeps the language field always visible and serialized; only Shell and the custom sandbox selector stay gated on sandbox readiness. Workflow serialization no longer drops subblocks that are hidden only by presentation env gates, so saved language (e.g. Python) is not stripped when the remote runtime is off.

Docs clarify that import-free JavaScript still runs in the local isolated VM without a remote provider; Python/Shell and remote paths fail explicitly instead of being reinterpreted as JavaScript.

^{Reviewed by Cursor Bugbot for commit 8ebf68f. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8ebf68f. Configure here.}

[greptile-apps]

Greptile Summary

This PR separates custom-Sandbox entitlement from remote-provider readiness while preserving Function language values across environment changes.

• Adds a shared resolver for deployment entitlement and provider availability.
• Updates workspace access checks for hosted and billing-free deployments.
• Keeps Python selectable and serialized while gating Shell and custom Sandbox controls on remote-runtime readiness.
• Expands tests and self-hosting documentation for the supported flag combinations.

Confidence Score: 5/5

The PR appears safe to merge because the changed flag combinations preserve local JavaScript execution while consistently requiring both entitlement and provider readiness for custom Sandboxes.

The access resolver, workspace gate, Function configuration, serializer behavior, and tests align around the documented distinction between stable saved language values and remote-runtime availability, with no concrete blocking failure remaining.

Important Files Changed

Filename	Overview
apps/sim/lib/core/config/env-flags.ts	Separates Sandbox deployment entitlement from provider readiness and combines them into a complete availability flag.
apps/sim/lib/core/config/enterprise-entitlements.ts	Changes the legacy Sandbox default to fail closed and adds a pure resolver for supported billing, entitlement, and provider combinations.
apps/sim/lib/billing/core/subscription.ts	Requires deployment availability before applying an explicit override or workspace subscription check.
apps/sim/blocks/blocks/function.ts	Keeps the language field visible, always offers JavaScript and Python, and limits Shell to deployments with a ready remote runtime.
apps/sim/serializer/index.ts	Treats environment gates as presentation controls so hidden execution parameters remain serialized.
apps/sim/serializer/tests/serializer.extended.test.ts	Verifies that environment visibility changes do not erase a saved Function language.
apps/sim/app/api/function/execute/route.test.ts	Verifies that import-free JavaScript still uses the local isolated VM without a remote provider.
packages/testing/src/mocks/env-flags.mock.ts	Adds the deployment-entitlement mock and updates defaults to reflect fail-closed Sandbox availability.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Billing[Billing enabled?]
  Entitlement[Enterprise or Sandbox deployment entitlement]
  Provider[Remote Function provider ready]
  Available[Deployment Sandbox feature available]
  Plan[Workspace has Max or Enterprise access]
  Granted[Custom Sandbox access granted]
  Denied[Access denied]

  Billing --> Available
  Entitlement --> Available
  Provider --> Available
  Available -->|No| Denied
  Available -->|Yes| Billing
  Billing -->|No, entitlement present| Granted
  Billing -->|Yes, explicit override| Granted
  Billing -->|Yes, no override| Plan
  Plan -->|Yes| Granted
  Plan -->|No| Denied

Loading

_{Reviews (1): Last reviewed commit: "more changes" | Re-trigger Greptile}