refactor(chat): gate the UI on NEXT_PUBLIC_CHAT_DISABLED, not an opt-in flag

CHAT_ENABLED made Chat opt-in, so every existing deployment that already had
COPILOT_API_KEY would have lost the module until it set a new variable. Invert
to an opt-out so nothing changes for them.

That also collapses the twin. The only reason the flag needed a server/client
pair was that it projected a secret; NEXT_PUBLIC_CHAT_DISABLED is not one, so
getEnv resolves the same value from process.env on the server and window.__ENV
in the browser. Gone with it: the FLAG_TWINS entry and its doctor sync check,
the two-variable wizard write, and the boot-time throw, whose contradiction
(flag on, key absent) can no longer be expressed.

Presentation and capability are now separate concerns. NEXT_PUBLIC_CHAT_DISABLED
decides whether the surfaces render; COPILOT_API_KEY decides whether the work
can run, and gates the paths that need it — the Sim Chat block, prompt-job
claims, and inbox access — each failing on its own terms.

The wizard writes the opt-out when you skip the chat key, which is the case this
started from: a fresh self-host that never configured Chat.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ErcRgvi7VQBeKDQ3MBMha

Author: TheodoreSpeaks

apps/docs/content/docs/en/platform/self-hosting/environment-variables.mdx

@@ -64,9 +64,8 @@ import { Callout } from 'fumadocs-ui/components/callout'
 | Variable | Description |
 |----------|-------------|
 | `API_ENCRYPTION_KEY` | Encrypts stored API keys (32 hex chars): `openssl rand -hex 32` |
-| `COPILOT_API_KEY` | API key for Chat. Required whenever `CHAT_ENABLED` is set — the app refuses to start without it |
-| `CHAT_ENABLED` | Shows the Chat module. Leave unset and the workspace lands on your first workflow, with no chats list, scheduled tasks, editor Chat panel, or Sim Chat block |
-| `NEXT_PUBLIC_CHAT_ENABLED` | Browser twin of `CHAT_ENABLED`. Set both together (`bun run setup` does) |
+| `COPILOT_API_KEY` | API key for Chat. Without it the Sim Chat block, scheduled prompt jobs, and Inbox cannot run |
+| `NEXT_PUBLIC_CHAT_DISABLED` | Set to `true` to hide the Chat module: the workspace lands on your first workflow, with no chats list, scheduled tasks, or editor Chat panel. Chat is shown when unset; `bun run setup` sets it for you if you skip the chat key |
 | `ADMIN_API_KEY` | Admin API key for GitOps operations |
 | `ALLOWED_LOGIN_DOMAINS` | Restrict signups to domains (comma-separated) |
 | `ALLOWED_LOGIN_EMAILS` | Restrict signups to specific emails (comma-separated) |

apps/sim/.env.example

@@ -22,13 +22,8 @@ NEXT_PUBLIC_APP_URL=http://localhost:3000
 # AUTH_TRUSTED_PROXIES=10.0.0.0/24,192.0.2.10  # Optional: reverse-proxy IPs/CIDRs in front of the app. Better Auth walks x-forwarded-for right to left, skips these hops, and uses the first untrusted address as the client IP (prevents forwarded-header spoofing). Use your proxies' actual addresses, not broad private ranges that also cover clients.
 
 # Chat (Optional)
-# Leave these unset and the Chat module is hidden entirely: the workspace lands
-# on your first workflow, and the chats list, scheduled tasks, workflow-editor
-# Chat panel, and Sim Chat block are all absent. `bun run setup` writes all three
-# together; set them by hand only if you skip the wizard.
-# COPILOT_API_KEY=                      # Mint one at https://sim.ai — required whenever CHAT_ENABLED is true (the app refuses to boot otherwise)
-# CHAT_ENABLED=true                     # Server-side gate
-# NEXT_PUBLIC_CHAT_ENABLED=true         # Browser twin — must match CHAT_ENABLED
+# COPILOT_API_KEY=                      # Mint one at https://sim.ai. Without it the Sim Chat block, prompt jobs, and Inbox cannot run
+# NEXT_PUBLIC_CHAT_DISABLED=true        # Hides the Chat module: the workspace lands on your first workflow, and the chats list, scheduled tasks, and editor Chat panel are absent. Chat is shown when unset; `bun run setup` sets this for you if you skip the chat key
 
 # Security (Required)
 ENCRYPTION_KEY=your_encryption_key  # Use `openssl rand -hex 32` to generate, used to encrypt environment variables

apps/sim/bootstrap.ts

@@ -6,20 +6,6 @@
 import { loadRuntimeSecrets } from '@sim/runtime-secrets'
 
 await loadRuntimeSecrets()
-
-/**
- * Chat cannot reach the mothership without `COPILOT_API_KEY`, so serving the
- * module with the key missing yields a UI where every message 401s. Fail the
- * deploy instead. Mirrors `isTruthy` from `lib/core/config/env.ts`, inlined
- * because this file is bundled separately for the container entrypoint and must
- * not pull the Next-only env module into its graph.
- */
-const chatEnabled = process.env.CHAT_ENABLED?.toLowerCase()
-if ((chatEnabled === 'true' || chatEnabled === '1') && !process.env.COPILOT_API_KEY) {
-  throw new Error(
-    'CHAT_ENABLED is set without COPILOT_API_KEY — Chat would render against a backend that rejects every request. Set COPILOT_API_KEY, or unset CHAT_ENABLED and NEXT_PUBLIC_CHAT_ENABLED.'
-  )
-}
 // `server.js` is the Next standalone build artifact, a sibling of this file in
 // the image; it does not exist at type-check time, so the specifier is held in a
 // variable to keep it out of static module resolution.

apps/sim/executor/handlers/mothership/mothership-handler.test.ts

@@ -1,6 +1,6 @@
 import '@sim/testing/mocks/executor'
 
-import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing'
+import { resetEnvMock, setEnv } from '@sim/testing'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { BlockType } from '@/executor/constants'
 import { MothershipBlockHandler } from '@/executor/handlers/mothership/mothership-handler'
@@ -115,8 +115,8 @@ describe('MothershipBlockHandler', () => {
     mockIsRedisCancellationEnabled.mockReset()
     mockIsRedisCancellationEnabled.mockReturnValue(false)
     mockReadUserFileContent.mockReset()
-    // The handler refuses to run without Chat; the shared mock defaults it off.
-    setEnvFlags({ isChatEnabled: true })
+    // The handler refuses to run without the mothership credential.
+    setEnv({ COPILOT_API_KEY: 'test-copilot-key' })
 
     block = {
       id: 'mothership-block-1',
@@ -149,7 +149,7 @@ describe('MothershipBlockHandler', () => {
     vi.useRealTimers()
     vi.clearAllMocks()
     vi.unstubAllGlobals()
-    resetEnvFlagsMock()
+    resetEnvMock()
   })
 
   function createNdjsonResponse(events: unknown[]): Response {
@@ -226,12 +226,12 @@ describe('MothershipBlockHandler', () => {
     })
   })
 
-  it('rejects execution before the internal request when Chat is disabled', async () => {
-    setEnvFlags({ isChatEnabled: false })
+  it('rejects execution before the internal request when COPILOT_API_KEY is unset', async () => {
+    setEnv({ COPILOT_API_KEY: undefined })
 
     await expect(
       handler.execute(context, block, { prompt: 'Hello from workflow' })
-    ).rejects.toThrow('Chat is disabled on this deployment')
+    ).rejects.toThrow('COPILOT_API_KEY is not configured')
     expect(fetchMock).not.toHaveBeenCalled()
   })
 

apps/sim/executor/handlers/mothership/mothership-handler.ts

@@ -5,7 +5,7 @@ import {
   BILLING_ATTRIBUTION_HEADER,
   serializeBillingAttributionHeader,
 } from '@/lib/billing/core/billing-attribution'
-import { isChatEnabled } from '@/lib/core/config/env-flags'
+import { env } from '@/lib/core/config/env'
 import { isExecutionCancelled, isRedisCancellationEnabled } from '@/lib/execution/cancellation'
 import { readUserFileContent } from '@/lib/execution/payloads/materialization.server'
 import {
@@ -338,10 +338,10 @@ export class MothershipBlockHandler implements BlockHandler {
     block: SerializedBlock,
     inputs: Record<string, any>
   ): Promise<BlockOutput | StreamingExecution> {
-    // Reaches the same backend as the Chat module, so with Chat off the request
-    // can only come back 401. Fail with something the workflow author can act on.
-    if (!isChatEnabled) {
-      throw new Error('Chat is disabled on this deployment, so the Sim Chat block cannot run')
+    // Without the key the mothership rejects every request, so fail with
+    // something the workflow author can act on instead of a bare 401.
+    if (!env.COPILOT_API_KEY) {
+      throw new Error('COPILOT_API_KEY is not configured, so the Sim Chat block cannot run')
     }
 
     const prompt = inputs.prompt

apps/sim/lib/billing/core/subscription.ts

@@ -24,10 +24,10 @@ import {
   hasUsableSubscriptionAccess,
   USABLE_SUBSCRIPTION_STATUSES,
 } from '@/lib/billing/subscriptions/utils'
+import { env } from '@/lib/core/config/env'
 import {
   isAccessControlEnabled,
   isBillingEnabled,
-  isChatEnabled,
   isHosted,
   isInboxEnabled,
   isSandboxesEnabled,
@@ -623,10 +623,11 @@ async function hasMaxTierWorkspaceAccess(workspaceId: string): Promise<boolean>
  * the workspace's organization, or its billed account for personal workspaces,
  * is on a Max or enterprise plan.
  *
- * Always false when Chat is disabled — inbox tasks run through the mothership
- * and answer with a link to the resulting chat, so neither half works without it.
- * That check comes first because the `!isBillingEnabled` shortcut below would
- * otherwise hand every self-hosted deployment a broken Inbox.
+ * Always false without `COPILOT_API_KEY` — inbox tasks are executed by the
+ * mothership and answered with a link to the resulting chat, so neither half
+ * works without it. That check comes first because the `!isBillingEnabled`
+ * shortcut below would otherwise hand every self-hosted deployment a broken
+ * Inbox.
  *
  * Otherwise returns true if:
  * - INBOX_ENABLED env var is set (self-hosted override), OR
@@ -636,7 +637,7 @@ async function hasMaxTierWorkspaceAccess(workspaceId: string): Promise<boolean>
  */
 export async function hasWorkspaceInboxAccess(workspaceId: string): Promise<boolean> {
   try {
-    if (!isChatEnabled) return false
+    if (!env.COPILOT_API_KEY) return false
     if (isInboxEnabled) return true
     if (!isBillingEnabled) return true
     return await hasMaxTierWorkspaceAccess(workspaceId)

apps/sim/lib/core/config/env-flags.ts

@@ -60,21 +60,22 @@ export const isCopilotBillingAttributionV1Enabled = isTruthy(
 export const isCopilotBillingProtocolRequired = isTruthy(env.COPILOT_BILLING_PROTOCOL_REQUIRED)
 
 /**
- * Is the Chat module exposed.
+ * Are the Chat module's surfaces shown. On by default, so a deployment that
+ * already has `COPILOT_API_KEY` keeps Chat without setting anything; the setup
+ * wizard writes the opt-out when you skip the key.
  *
- * Server code reads `CHAT_ENABLED`; client evaluation reads the
- * `NEXT_PUBLIC_CHAT_ENABLED` twin via `window.__ENV`, so deployments must set
- * both together (the setup wizard writes the pair). Chat needs
- * `COPILOT_API_KEY` to reach the mothership at all — `bootstrap.ts` throws when
- * this flag is on without it, so the two can never disagree at runtime.
+ * This governs presentation only. Whether Chat can actually reach the mothership
+ * is a separate question answered by `COPILOT_API_KEY`, which gates the paths
+ * that need it (the Sim Chat block, prompt-job claims, inbox execution). Keeping
+ * them separate is what lets this be a single variable: the key is a secret and
+ * could never be read in the browser, but `NEXT_PUBLIC_CHAT_DISABLED` is not, so
+ * `getEnv` resolves the same value from `process.env` on the server and
+ * `window.__ENV` on the client — no twin to keep in sync.
  *
  * Read at module scope or inline during render only. Resolving it through
  * `useState`/`useEffect` would render chat surfaces before removing them.
  */
-export const isChatEnabled =
-  typeof window === 'undefined'
-    ? isTruthy(env.CHAT_ENABLED)
-    : isTruthy(getEnv('NEXT_PUBLIC_CHAT_ENABLED'))
+export const isChatEnabled = !isTruthy(getEnv('NEXT_PUBLIC_CHAT_DISABLED'))
 
 /**
  * Holds tools the catalog marks `requiresApproval` — shell commands, workflow
@@ -303,13 +304,12 @@ export const isOrganizationsEnabled =
 
 /**
  * Is inbox (Sim Mailer) enabled
- *
- * Requires Chat: an inbound message is executed by the mothership and answered
- * with a link to the resulting chat, so with Chat off every inbox task fails and
- * mails the recipient a dead link.
  */
-export const isInboxEnabled =
-  enterpriseFeatureEnabled('inbox', env.INBOX_ENABLED, 'NEXT_PUBLIC_INBOX_ENABLED') && isChatEnabled
+export const isInboxEnabled = enterpriseFeatureEnabled(
+  'inbox',
+  env.INBOX_ENABLED,
+  'NEXT_PUBLIC_INBOX_ENABLED'
+)
 
 /**
  * Are custom sandboxes (workspace dependency sets for Function blocks) enabled.

apps/sim/lib/core/config/env.ts

@@ -51,7 +51,6 @@ export const env = createEnv({
 
     // Copilot
     COPILOT_API_KEY:                       z.string().min(1).optional(),           // Secret for internal sim agent API authentication
-    CHAT_ENABLED:                          z.boolean().optional(),                 // Expose the Chat module (requires COPILOT_API_KEY); set the NEXT_PUBLIC_ twin together
     /** Enables attributed-v1 only after compatible Copilot instances are deployed. */
     COPILOT_BILLING_ATTRIBUTION_V1_ENABLED: z.boolean().optional(),
     /** Rejects markerless old-Go billing traffic only when explicitly enabled. */
@@ -606,7 +605,7 @@ export const env = createEnv({
     NEXT_PUBLIC_DISABLE_INVITATIONS:       z.boolean().optional(),                   // Disable workspace invitations globally (for self-hosted deployments)
     NEXT_PUBLIC_DISABLE_PUBLIC_API:        z.boolean().optional(),                   // Disable public API access UI toggle globally
     NEXT_PUBLIC_INBOX_ENABLED:             z.boolean().optional(),                   // Enable inbox (Sim Mailer) on self-hosted
-    NEXT_PUBLIC_CHAT_ENABLED:              z.boolean().optional(),                   // Client twin of CHAT_ENABLED — set both together. Read via getEnv(), never env.*
+    NEXT_PUBLIC_CHAT_DISABLED:             z.boolean().optional(),                   // Hide the Chat module. Not a secret, so it is read via getEnv() on both server and client
     NEXT_PUBLIC_SANDBOXES_ENABLED:         z.boolean().optional(),                   // Enable custom sandboxes on self-hosted
     NEXT_PUBLIC_EMAIL_PASSWORD_SIGNUP_ENABLED: z.boolean().optional().default(true), // Control visibility of email/password login forms
     NEXT_PUBLIC_TURNSTILE_SITE_KEY:        z.string().min(1).optional(),           // Cloudflare Turnstile site key for captcha widget
@@ -651,7 +650,7 @@ export const env = createEnv({
     NEXT_PUBLIC_DISABLE_INVITATIONS: process.env.NEXT_PUBLIC_DISABLE_INVITATIONS,
     NEXT_PUBLIC_DISABLE_PUBLIC_API: process.env.NEXT_PUBLIC_DISABLE_PUBLIC_API,
     NEXT_PUBLIC_INBOX_ENABLED: process.env.NEXT_PUBLIC_INBOX_ENABLED,
-    NEXT_PUBLIC_CHAT_ENABLED: process.env.NEXT_PUBLIC_CHAT_ENABLED,
+    NEXT_PUBLIC_CHAT_DISABLED: process.env.NEXT_PUBLIC_CHAT_DISABLED,
     NEXT_PUBLIC_SANDBOXES_ENABLED: process.env.NEXT_PUBLIC_SANDBOXES_ENABLED,
     NEXT_PUBLIC_EMAIL_PASSWORD_SIGNUP_ENABLED: process.env.NEXT_PUBLIC_EMAIL_PASSWORD_SIGNUP_ENABLED,
     NEXT_PUBLIC_TURNSTILE_SITE_KEY: process.env.NEXT_PUBLIC_TURNSTILE_SITE_KEY,

apps/sim/lib/invitations/core.test.ts

@@ -988,7 +988,7 @@ describe('acceptInvitation', () => {
 
     expect(result.success).toBe(true)
     if (result.success) {
-      expect(result.redirectPath).toBe('/workspace/workspace-1/home')
+      expect(result.redirectPath).toBe('/workspace/workspace-1')
     }
     expect(mockAttachOwnedWorkspacesToOrganizationTx).toHaveBeenCalledWith(
       expect.anything(),
@@ -1437,7 +1437,7 @@ describe('acceptInvitation', () => {
 
     expect(result.success).toBe(true)
     if (result.success) {
-      expect(result.redirectPath).toBe('/workspace/workspace-1/home')
+      expect(result.redirectPath).toBe('/workspace/workspace-1')
     }
   })
 

packages/testing/src/mocks/env-flags.mock.ts

@@ -3,8 +3,9 @@ import { vi } from 'vitest'
 /**
  * Mutable value-export state for the shared `@/lib/core/config/env-flags` mock.
  * Defaults mirror the real module evaluated under the vitest environment
- * (NODE_ENV=test, no feature env vars set): only `isTest` and
- * `isEmailPasswordEnabled` are true.
+ * (NODE_ENV=test, no feature env vars set): only `isTest`,
+ * `isEmailPasswordEnabled`, and `isChatEnabled` are true — the last because it
+ * is an opt-out flag, on unless `NEXT_PUBLIC_CHAT_DISABLED` is set.
  */
 export interface EnvFlagsMockState {
   isProd: boolean
@@ -59,7 +60,7 @@ const defaultEnvFlagsState: EnvFlagsMockState = {
   isHosted: false,
   isCopilotBillingAttributionV1Enabled: false,
   isCopilotBillingProtocolRequired: false,
-  isChatEnabled: false,
+  isChatEnabled: true,
   isCopilotToolPermissionsEnabled: false,
   isBillingEnabled: false,
   isEmailVerificationEnabled: false,