fix(chat): correct password-change confirmation gate and stale reveal error

Addresses both open Bugbot findings.

- shouldConfirmPasswordChange keyed on "a chat exists" rather than "a password
  exists", so switching a public chat to password protection for the first time
  asked the admin to confirm changing a password that was never set. It now
  takes the existing-password signal the component already computes.
- A failed reveal left "Failed to load the current password" on screen while the
  admin typed or generated a replacement, because the mutation only drops its
  error on the next attempt. Editing or regenerating now resets it.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx

@@ -245,7 +245,7 @@ export function ChatDeploy({
 
       if (
         !passwordChangeConfirmed &&
-        shouldConfirmPasswordChange(Boolean(existingChat?.id), formData.authType, formData.password)
+        shouldConfirmPasswordChange(existingPassword, formData.authType, formData.password)
       ) {
         setShowPasswordChangeConfirmation(true)
         return
@@ -700,6 +700,16 @@ function AuthSelector({
   const emailsRef = useRef(emails)
   const invalidEmailItemsRef = useRef(invalidEmailItems)
 
+  /**
+   * Editing or regenerating the password clears a failed reveal. The mutation
+   * only drops its error on the next attempt, so it would otherwise keep
+   * reporting a stale failure over a field the admin has already moved on from.
+   */
+  const handlePasswordChange = (value: string) => {
+    if (revealPasswordMutation.isError) revealPasswordMutation.reset()
+    onPasswordChange(value)
+  }
+
   useEffect(() => {
     emailsRef.current = emails
   }, [emails])
@@ -799,7 +809,7 @@ function AuthSelector({
           </Label>
           <GeneratedPasswordInput
             value={password}
-            onChange={onPasswordChange}
+            onChange={handlePasswordChange}
             disabled={disabled}
             placeholder={hasExistingPassword ? '' : getPasswordPlaceholder(false)}
             required={!hasExistingPassword}

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/utils.test.ts

@@ -38,11 +38,16 @@ describe.concurrent('chat password state', () => {
     expect(getPasswordHelperText(false)).toBe('This password will be required to access your chat')
   })
 
-  it('confirms a password change only for an existing password deployment with a new value', () => {
+  it('confirms only when a stored password is actually being replaced', () => {
     expect(shouldConfirmPasswordChange(true, 'password', 'new-password')).toBe(true)
     expect(shouldConfirmPasswordChange(true, 'password', '')).toBe(false)
     expect(shouldConfirmPasswordChange(true, 'password', '   ')).toBe(false)
     expect(shouldConfirmPasswordChange(true, 'public', 'new-password')).toBe(false)
+  })
+
+  it('does not confirm when the deployment has no password to replace', () => {
     expect(shouldConfirmPasswordChange(false, 'password', 'new-password')).toBe(false)
+    expect(hasExistingPassword({ authType: 'public', hasPassword: false })).toBe(false)
+    expect(hasExistingPassword({ authType: 'password', hasPassword: true })).toBe(true)
   })
 })

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/utils.ts

@@ -23,12 +23,18 @@ export function isWhitespaceOnlyPassword(password: string): boolean {
   return password.length > 0 && password.trim().length === 0
 }
 
+/**
+ * Whether submitting should confirm before overwriting the stored password.
+ * Only a genuine replacement warrants the prompt — keying this on "a chat
+ * exists" asked an admin to confirm changing a password that was never set,
+ * e.g. when switching a public chat to password protection for the first time.
+ */
 export function shouldConfirmPasswordChange(
-  hasExistingChat: boolean,
+  existingPassword: boolean,
   authType: AuthType,
   password: string
 ): boolean {
-  return hasExistingChat && authType === 'password' && password.trim().length > 0
+  return existingPassword && authType === 'password' && password.trim().length > 0
 }
 
 export function getPasswordPlaceholder(existingPassword: boolean): string {