fix(workflow): a Bot's switched-off connector must not be reopened by a Workflow node #1544

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: 9ee9a372cc1a4d709deac8bb75af488d
Branch: dev/2-connector-launder
Base: 6202359
At: 2026-10-28T04:06:27Z

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment.

Written-by: FlyBot Lead

What happens

A Bot's switched-off connector can be reopened by defining a Workflow. Since #1535 a Workflow node Bot receives the connectors its node declares in tools. run_workflow and define_workflow are registered without visibleTo, so visible() allows any Bot to define and run one. A normal Bot with connectors.github = false can therefore:

1. define a Workflow whose node declares tools: ['github'],
2. run it,
3. get a fresh run Bot whose github connector is on — and call github through it.

Measured by FlyBot Security on the #1535 tip: with connectors.github: false the caller's run_workflow and define_workflow guards both return allow, and the node Bot spawned from that call reaches github. On base this path did not exist (run Bots carried no connectors at all), so #1535 opened it.

Why it matters

Turning a connector off for a Bot is treated by the owner as a boundary, not a preference. A boundary that any ordinary "define a workflow" action can wash out is not a boundary: the switch would only apply to Bots that never use Workflow.

Expected

Denial wins. A run Bot must never receive a connector that the Bot which started the run had switched off. Node tools chooses which connectors a node may use among the ones the caller still has; it never adds one back.

• Caller has github off, node declares tools: ['github'] → the node's run Bot has github off, and the call is refused with the switched-off reason.
• Caller has github on, node declares tools: ['github'] → unchanged behaviour from fix(workflow): a node's tools selects connectors instead of granting everything #1535.
• No caller identity to intersect with (a run started from the Main Bot UI rather than through a Bot's tool call) → current behaviour.

Suggested shape (implementation is the Dev's call)

Carry the starting Bot's switched-off connector set into the run at start time and apply it when the run Bots are spawned, instead of relying on visibleTo — limiting run_workflow/define_workflow to Main Bots would remove the normal use of defining and running a Workflow from a Bot.

Scope

• plugins/workflow/index.js (start/assign/run_workflow entry that spawns), plugins/workflow/src/ephemeral.js (what is handed to fb.bot.create),
• the host seam in core/src/host/ only if the connector record must be read at spawn,
• one red test first: caller with github off + node declaring tools: ['github'] → github refused for that run Bot. It must be red on main before the fix.
• fix(workflow): a node's tools selects connectors instead of granting everything #1535 is not touched: that PR stays frozen at its reviewed tip; this is a follow-up.

Owner ruling to record in the PR body: a switched-off connector is a refusal, not a preference (relayed 2026-10-28); this PR is the code that makes that true. Security advisory source: FlyBot Security's review of #1535, worry (a).