docs(workflow): finish the Tools/README wording left over from #1523 (after #1535) #1548

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: 497f1db8119741a399e9f75e3cb94386
Branch: dev/1-1523-wording-leftover
Base: 6202359
At: 2026-10-28T04:09:41Z

Implementation: FlyBot (ours) — PR follows within 24h after its gate opens (see "When"). Do not pick up without a pickup-ok comment.

Written-by: FlyBot Lead

Why this is a separate issue

#1523 was closed on 2026-10-28 (comment 6459826882) because its whole premise — "spawn does not hand tools to the run Bot" — becomes false the moment #1535 lands. Four pieces of its content are still worth doing afterwards, and they are the only survivors of that PR. This issue is the record: the comment sinks with the closed PR, this does not.

Do not start before #1535 is merged. All four touch files #1535 edits (plugins/workflow/client.js, README.md, src/template.js); starting earlier means rebasing into a moving target and re-verifying twice.

The four items

1. plugins/workflow/client.js — the Tools field has no explanation. The placeholder still says github, bash, read, edit..., which mixes real connector ids (github, composio) with shell/file words that a node's tools cannot grant. Say what the field does after fix(workflow): a node's tools selects connectors instead of granting everything #1535: it selects the connectors the run Bot may use; file/shell access is the same for every node Bot and does not come from this field.
2. plugins/workflow/client.js — the i18n string Each Bot's own permission is now wrong. Since fix(workflow): a node's tools selects connectors instead of granting everything #1535 every node Bot is created with danger-full-access, so permissions do not vary per Bot. Replace the string (and its translation) with what actually varies per node: the connector list.
3. plugins/workflow/README.md:37 — the bash note reads as if it is in effect. Its Coder and Tester carry a bash note, and its Coder, Reviewer and Deployer carry a github note — after fix(workflow): a node's tools selects connectors instead of granting everything #1535 only the github note grants anything; bash in tools is inert because permissionFor() is always danger-full-access. Reword so the github note is the one that does something.
4. plugins/workflow/src/template.js:20 and :34 — shell/file words sit in the connector list. Coder is tools: ['github', 'bash', 'read', 'edit'] and Tester ['bash']. If the wording in items 1–3 says this field is about connectors, the template should not model file/shell words in it. Cleaning the template is optional; if done, it must change the assertions fix(workflow): a node's tools selects connectors instead of granting everything #1535 pinned in plugins/workflow/test/ephemeral.test.js (the built-in delivery nodes hand their connector list to the host: coder === ['github','bash','read','edit'], tester === ['bash']) in the same PR, or CI goes red.

Scope

• Wording only in items 1–3; item 4 is a data change in the built-in template plus the pinned assertions, and can be dropped if the wording solution keeps bash/read/edit meaningful.
• No permission behaviour changes: the run Bot's permission stays danger-full-access, and connector access still comes from node.tools only.
• npm run verify green; if item 4 is included, plugins/workflow tests updated in the same commit.

Out of scope

The exchange-panel defects (core/src/client/exchange.js half-fence copy, and the "does not follow a new line" enhancement) are separate items in the backlog, not this issue.