fix(selectors): key CloudWatch lists by search, and stop a caller erasing the credential gate

The CloudWatch log-group and log-stream selectors forwarded `search` into the
request as `prefix` but left it out of the query key, so every keystroke
resolved to the same fresh entry and no refetch fired. Server-side filtering
was dead: a log group outside the first page could not be reached. An audit of
all 69 selector definitions found these two and no others.

useSelectorOptions resolved `args.enabled ?? definition.enabled(...)`, so a
caller supplying its own gate replaced the definition's precondition rather
than narrowing it. useSelectorDisplayName knows nothing about credentials, so a
card holding a saved value with no credential context ran a query that could
only reject. The two are now conjoined. The detail hooks keep the override
deliberately — resolving one known id needs less context than listing, which
their TSDoc already documents.

The list-key fix has a test, proven to fail without it. The `enabled` change
has none: loading use-selector-query pulls the selector registry and emcn CSS,
which cannot resolve in a git worktree.

Author: waleedlatif1

apps/sim/hooks/selectors/providers/cloudwatch/selectors.test.ts

@@ -0,0 +1,30 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { cloudwatchSelectors } from '@/hooks/selectors/providers/cloudwatch/selectors'
+import type { SelectorQueryArgs } from '@/hooks/selectors/types'
+
+const AWS_CONTEXT: SelectorQueryArgs['context'] = {
+  awsAccessKeyId: 'AKIA',
+  awsSecretAccessKey: 'secret',
+  awsRegion: 'us-east-1',
+  logGroupName: '/aws/lambda/fn',
+}
+
+describe('cloudwatch selector query keys', () => {
+  it.each([['cloudwatch.logGroups' as const], ['cloudwatch.logStreams' as const]])(
+    '%s scopes its key by search, which fetchList forwards as `prefix`',
+    (key) => {
+      const definition = cloudwatchSelectors[key]
+      const base: SelectorQueryArgs = { key, context: AWS_CONTEXT }
+
+      const noSearch = definition.getQueryKey(base)
+      const withSearch = definition.getQueryKey({ ...base, search: 'api' })
+      const otherSearch = definition.getQueryKey({ ...base, search: 'worker' })
+
+      expect(withSearch).not.toEqual(noSearch)
+      expect(withSearch).not.toEqual(otherSearch)
+    }
+  )
+})

apps/sim/hooks/selectors/providers/cloudwatch/selectors.ts

@@ -20,11 +20,12 @@ export const cloudwatchSelectors = {
     key: 'cloudwatch.logGroups',
     contracts: [selectorContracts.cloudwatchLogGroupsSelectorContract],
     staleTime: SELECTOR_STALE,
-    getQueryKey: ({ context }: SelectorQueryArgs) => [
+    getQueryKey: ({ context, search }: SelectorQueryArgs) => [
       'selectors',
       'cloudwatch.logGroups',
       context.awsAccessKeyId ?? 'none',
       context.awsRegion ?? 'none',
+      search ?? '',
     ],
     enabled: ({ context }) =>
       Boolean(context.awsAccessKeyId && context.awsSecretAccessKey && context.awsRegion),
@@ -51,12 +52,13 @@ export const cloudwatchSelectors = {
     key: 'cloudwatch.logStreams',
     contracts: [selectorContracts.cloudwatchLogStreamsSelectorContract],
     staleTime: SELECTOR_STALE,
-    getQueryKey: ({ context }: SelectorQueryArgs) => [
+    getQueryKey: ({ context, search }: SelectorQueryArgs) => [
       'selectors',
       'cloudwatch.logStreams',
       context.awsAccessKeyId ?? 'none',
       context.awsRegion ?? 'none',
       context.logGroupName ?? 'none',
+      search ?? '',
     ],
     enabled: ({ context }) =>
       Boolean(

apps/sim/hooks/selectors/use-selector-query.ts

@@ -70,7 +70,17 @@ export function useSelectorOptions(
     context: args.context,
     search: args.search,
   }
-  const isEnabled = args.enabled ?? (definition.enabled ? definition.enabled(queryArgs) : true)
+  /**
+   * `definition.enabled` mirrors the preconditions the definition's own `fetchList` /
+   * `fetchPage` assert (`ensureCredential`, `ensureKnowledgeBase`, an early `return []`),
+   * so it is a hard precondition for the *list*, not a default a caller may replace.
+   * A caller's `enabled` narrows further — it never widens — otherwise a card that only
+   * knows it has a selection runs a fetch that is guaranteed to reject and caches the
+   * rejection. Unlike {@link useSelectorOptionDetail}, resolving nothing here is never
+   * cheaper than the list's own preconditions, so there is no case for an override.
+   */
+  const isEnabled =
+    (args.enabled ?? true) && (definition.enabled ? definition.enabled(queryArgs) : true)
   const supportsPagination = Boolean(definition.fetchPage)
 
   const flatQuery = useQuery<SelectorOption[]>({