fix(integrations): show disabled role combobox for readonly members

[waleedlatif1]

Re-opening of #3921 — originally merged into staging but lost when the branch was accidentally deleted and recreated from main.

[cursor]

PR Summary

High Risk
Adds new CloudWatch API/tool surface that handles AWS credentials and introduces new billing/usage accounting for embedding tokens, both of which are security- and money-sensitive. Also touches multiple user-facing flows with new PostHog event emission and subscription-gated connector sync intervals.

Overview
Adds a new AWS CloudWatch integration end-to-end: server routes under /api/tools/cloudwatch/*, shared client utilities (cloudwatch/utils.ts), tool configs/types in tools/cloudwatch/*, selector support for CloudWatch log groups/streams, and a new CloudWatchBlock wired into the blocks/tools registries (plus AWS SDK deps).

Enforces plan-based “live sync” for knowledge-base connectors by rejecting syncIntervalMinutes under 60 minutes unless hasLiveSyncAccess passes, and updates the KB connector UI to offer a new Live (5 min) interval that is disabled/badged when Max access isn’t available.

Refactors embeddings to return { embeddings, totalTokens, isBYOK, modelName }, updates callers accordingly, and adds usage billing for KB document embedding generation when not using BYOK (including a new usage_log_source value knowledge-base).

Expands PostHog analytics: emits new server/client events for folder/schedule/document actions, workflow import/export, logs filter usage, and search result selection; removes the task_marked_read event and adds missing workspace_id to task_message_sent. Also adjusts integrations UI so read-only members see a disabled role combobox instead of a role badge.

^{Reviewed by Cursor Bugbot for commit 768eda9. Configure here.}

[greptile-apps]

Greptile Summary

This PR re-lands a previously merged fix (originally #3921) that shows a disabled role Combobox to non-admin members instead of a plain Badge. The change ensures visual consistency in the integrations settings UI — all members see the same role selector component, just with editing locked for non-admins.

• Moved Combobox for role selection outside the isSelectedAdmin conditional so it always renders for every member row
• disabled prop correctly uses !isSelectedAdmin || (member.role === 'admin' && adminMemberCount <= 1), guarding both permission and last-admin scenarios
• Removed <Badge variant='gray-secondary'> display for non-admin viewers (disabled Combobox replaces it visually)
• Extracted roleComboOptions to module level to avoid re-allocating the array on every render

Confidence Score: 5/5

Safe to merge — focused, single-file UI fix with no logic regressions

Single-file change with a clear, correct intent. The disabled condition properly handles both the permissions guard (!isSelectedAdmin) and the last-admin guard. Grid layout and role-value display are both preserved. Badge import is still used elsewhere in the file. No new issues introduced.

No files require special attention

Important Files Changed

Filename	Overview
apps/sim/app/workspace/[workspaceId]/settings/components/integrations/integrations-manager.tsx	Moves role Combobox outside isSelectedAdmin guard (disabled for non-admins); removes Badge fallback; extracts roleComboOptions to module level

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Render member row] --> B[Always render Combobox]
    B --> C{isSelectedAdmin?}
    C -- No --> D[disabled = true]
    C -- Yes --> E{Last admin?}
    E -- Yes --> F[disabled = true]
    E -- No --> G[disabled = false]
    D --> H[Render empty div spacer]
    F --> H
    G --> I[Render Remove button]
    I --> J{Last admin?}
    J -- Yes --> K[Remove button disabled]
    J -- No --> L[Remove button enabled]

Loading

_{Reviews (1): Last reviewed commit: "fix(integrations): show disabled role co..." | Re-trigger Greptile}