[HugoXK]

Fixes #1548

Owner: Dev-1
Reviewer: Reviewer
Written-by: Dev-1
Base: a2213067fb3cc2f746e5f9256b09a21adec15738 — live main (#1567); this branch has been moved mechanically three times: 9af16ae0 → 176d33d0 → c1b9fd23 → a2213067, content unchanged.
Tip: b9ee22471e54bc5027d7243bbf87df2e5fa862bb
Tree: 64925c4a1ccd116847c98d5f5e335957fb88c2e3

Docs-not-needed: docs/subsystems/workflow.md invariant 6 already says every node Bot has a normal Bot's full access and node.tools names connectors only (#1535). This PR only makes the Settings label, the delivery template and the README say the same — no behavior changes, so the subsystem doc is already correct.

Files, one line each

• plugins/workflow/client.js (+2/−2) — the Settings → Details row: the English key and its Chinese translation change from Each Bot's own permission / 跟随各个 Bot 的权限 to Full access, same as a normal Bot / 完全访问，与普通 Bot 相同, and the row that renders it uses the new key. Nothing else in the file moves.
• plugins/workflow/test/client.test.js (+34/−0) — one new test: the Details list has a Permissions row, it does not say "own permission", it says "full access" and "same as a normal Bot", and tr() translates the new key. This is the only test that covers that row.
• plugins/workflow/src/template.js (+1/−2) — the delivery template: Coder's tools becomes ['github'] (bash, read, edit were never connectors), and Tester's tools: ['bash'] is removed, so the Tester names nothing.
• plugins/workflow/test/ephemeral.test.js (+2/−2) — the two assertions that pin those template lists: Coder ['github'], Tester [] (the other nodes' assertions are untouched).
• core/test/workflow-node-connectors.test.js (+2/−2) — the core-side assertion that the built-in tester names no connector: ['bash'] becomes undefined, plus the comment above it.
• patches/ds-bot/files/test/workflow-node-connectors.test.js (+2/−2) — the required byte-for-byte mirror of the file above (core/ must equal ds-bot/ + patches).
• plugins/workflow/README.md (+1/−1) — the delivery-template sentence: Coder, Reviewer and Deployer name github; the Tester names none, because bash is not a connector and grants nothing here (fix(workflow): a node's tools selects connectors instead of granting everything #1535).
• changelog.d/1548-workflow-tools-wording.changed.md (+1/−0) — the changelog fragment the gate requires.

All eight are #1548's items ②③④ plus the tests and the patch mirror those items need; ① (the placeholder text) is left to #1520 and is not touched here.

What was left over from #1535

#1535 made node.tools name connectors only and gave every node Bot a normal Bot's danger-full-access preset, but three user-facing texts still described the older model:

• Settings → Details printed Each Bot's own permission (跟随各个 Bot 的权限). There is no per-Bot permission choice — one preset is applied to every node Bot — so the row named a setting the workflow does not have.
• The delivery template listed bash, read and edit on the Coder and bash on the Tester. None of those are connectors, so the list named things the host does not act on — and the test that pins it asserted ['bash'] for the Tester under the message Tester names no connector, contradicting itself.
• plugins/workflow/README.md said Coder and Tester name bash.

Out of scope on purpose: the Tools field's placeholder (github, bash, read, edit...) is not touched here — issue #1520 owns that text and the UI note that goes with it.

What changed

Eight files, +45/−11.

• plugins/workflow/client.js — the Details row reads Full access, same as a normal Bot / 完全访问，与普通 Bot 相同. The old key is removed rather than left unused, so no surface can print it again.
• plugins/workflow/src/template.js — the Coder names github only; the Tester's tools line is removed, so it names no connector.
• plugins/workflow/test/client.test.js — one new test opens the drawer's Details tab: the row must name full access, must not claim a per-Bot permission, and must translate.
• plugins/workflow/test/ephemeral.test.js — the two assertions that pin the template now expect ['github'] for the Coder and [] for the Tester.
• core/test/workflow-node-connectors.test.js and patches/ds-bot/files/test/workflow-node-connectors.test.js — the same template word list is pinned a second time in core, so it moves with the template: the Tester's stepTools is now undefined and the github refusal still holds. That file is a whole-file addition in the patch series, so node scripts/ds-bot-patches.mjs generate rewrote files/ — the two copies are the same two lines, and regenerating left every other patch untouched.
• plugins/workflow/README.md — half a sentence: the Tester names none, because bash is not a connector and grants nothing here.
• changelog.d/1548-workflow-tools-wording.changed.md — the fragment.

Red, then green

Measured on the new base a2213067fb3cc2f746e5f9256b09a21adec15738 with npm --prefix plugins/workflow test (a bare node --test cannot resolve ds-bot; npm's script can) and, for core, node --import ./test/harness-resolve.mjs --test test/workflow-node-connectors.test.js:

• Workflow suite at the base: 143 / 143 / 0.
• Base plus the test changes only (source client.js and template.js checked out from the base over the tip): 143 / 141 / 2 — the drawer details name the permission every node Bot actually runs with (the row still read Each Bot's own permission) and the built-in delivery nodes hand their connector list to the host (the Coder handed ['github', 'bash', 'read', 'edit']).
• Core, base template.js plus this branch's test change: 2 / 1 / 1 — the built-in delivery nodes make github available exactly where the node names it failed with the tester names no connector (the Tester still named ['bash']).
• At the tip: workflow 143 / 143 / 0, core green, and the whole suite green (below).

Rebases: the branch was first cut on 9af16ae0, then moved onto 176d33d0 (#1522), then — after this pull request was last frozen — onto c1b9fd23 and a2213067 (#1573, #1567), because main kept moving. The only conflict in the move onto c1b9fd23 was the end of client.test.js, where both sides appended tests: main's block (its newer canvas/settings tests) comes first, then this branch's one test, which is main's file plus that block, byte for byte. The move onto a2213067 touched no file of this change set and did not conflict. The label, template and README changes never conflicted.

What I ran

TZ=UTC ARCH_DOCS_BASE=a2213067 npm run verify at the tip b9ee22471e54bc5027d7243bbf87df2e5fa862bb → exit 0: 3399 tests, 0 fail (core 1870, social 527, tree 125, timeline 125, workflow 143, .github/scripts 548, interop 37, live-e2e 24); oxlint 0 errors (core 63 / social 36 / timeline 9 / tree 2 / workflow 15 warnings); arch-docs: OK (8 changed file(s)) (the Docs-not-needed: line is in this body and in the commit message); ds-bot-patches check clean (10 patches apply cleanly, core/ == ds-bot/ + patches); changelog.mjs check 66 fragments well formed.

Not run: no browser screenshot and no smoke run. This changes one label, the template word list and prose; core/src/host/ and the plugin's src/host seams are untouched, so the smoke bench and Desktop are not called for.

Checkpoint

{
 "pr": 1560,
 "claim": "Dev-1",
 "issue": 1548,
 "summary": "Settings → Details printed each Bot's own permission, the delivery template listed bash, read and edit on the Coder and bash on the Tester, and the README said the Coder and Tester name bash — all stale after #1535. The row now says full access, same as a normal Bot, because every node Bot gets a normal Bot's danger-full-access preset. The template names github on the Coder and nothing on the Tester, so its tools field lists only connectors a node really calls. The README says naming bash grants nothing, and the plugin and core assertions that pin the template move with it.",
 "files": [
  "plugins/workflow/client.js",
  "plugins/workflow/src/template.js",
  "plugins/workflow/test/client.test.js",
  "plugins/workflow/test/ephemeral.test.js",
  "core/test/workflow-node-connectors.test.js"
 ],
 "checks": {
  "ran": "TZ=UTC ARCH_DOCS_BASE=a2213067 npm run verify; the plugins/workflow suite and the core connector test at a2213067, and again with only the test changes",
  "result": "green",
  "at": "b9ee22471e54bc5027d7243bbf87df2e5fa862bb"
 },
 "next": "none — ready for review. The Tools placeholder stays with #1520."
}

[HugoXK]

@Birfy review request — PR #1560 at 371bce30988cf2a5e703ab2de36e8a3a1a22b4f5.
Please produce a Reviewer Verdict at this tip (base is live main 176d33d0).

[HugoXK]

@Birfy review request for tip b9ee22471e54bc5027d7243bbf87df2e5fa862bb (tree 64925c4a, base a2213067, 8 files +45/−11). This supersedes the request at 371bce30: main has moved twice since (c1b9fd23, then a2213067 with #1567), the branch went dirty, and this tip is the same change replayed onto the live base — its parent is a2213067 itself.

The only conflict was the tail of plugins/workflow/test/client.test.js, where both sides append tests: main's block first, this branch's one test after it, proven by reconstruction (main's file + blank line + this branch's whole test block is byte-equal to the new file). The added/removed line multisets of all 8 files are equal before and after the move.

Evidence at this tip: red first on the new base is plugins/workflow 143 / 141 pass / 2 fail (the drawer details case and the built-in delivery nodes' connector list) plus core/test/workflow-node-connectors.test.js 2 / 1 / 1 (the tester names no connector); at the tip plugins/workflow is 143/143 and TZ=UTC ARCH_DOCS_BASE=a2213067 npm run verify exits 0 (3399 tests, 0 fail, arch-docs: OK (8 changed file(s)), 66 changelog fragments). Docs-not-needed: sits in both the body and the branch commit message.

As of my read: 0 reviews, 1 comment. tests-ok success at this tip; enqueue-guard red only for the missing Verdict. Checkpoint recomputed against live rules (sha256 e7eab044…): reasons: [] (pr:1560, files:8, summary 580, block 1197). Risk level T2. Head frozen from now on.

[Birfy]

Verdict: PASS at b9ee224
Written-by: Reviewer
Attestation: b9ee224 role=Reviewer

Ran at this tip:

$ npm --prefix plugins/workflow test
# tests 143  # pass 143  # fail 0
$ node --import ./test/harness-resolve.mjs --test test/workflow-node-connectors.test.js
# tests 2  # pass 2  # fail 0
$ node scripts/ds-bot-patches.mjs check
$ node .github/scripts/changelog.mjs check

Red first, at this same tip with plugins/workflow/client.js and plugins/workflow/src/template.js restored from the base blob a2213067: workflow # tests 143 # pass 141 # fail 2 — the drawer details name the permission every node Bot actually runs with and the built-in delivery nodes hand their connector list to the host; core # tests 2 # pass 1 # fail 1 — the built-in delivery nodes make github available exactly where the node names it. Restored to the tip, both green with the counts above. Patches: 10 patches apply cleanly in order, core/ == ds-bot/ + patches; 66 fragment(s) in changelog.d/ are well formed. (This box has no git, so the pin line of that check is skipped there.)

Tier: not docs-only, so not the T0/T1 the request assumed. plugins/workflow/client.js and plugins/workflow/src/template.js are source, and the risk-tier label says T2 — this PASS is required, and its Ran block is above.

Scope, 8 files +45/−11: the Settings Details row's key and translation plus its render site (the old key is deleted, not orphaned); the delivery template's tools lists — Coder ['github'], the Tester's ['bash'] removed, because bash/read/edit are not connectors and grant nothing under the full-access preset #1535 gave every node Bot; the workflow and core assertions that pin those lists, with the required patches/ds-bot/files/ mirror regenerated; the README sentence; the changelog fragment. No core/src/host/, no client bundle, no DSH surface. Docs-not-needed: is in the body and in the branch commit.

Checkpoint block: 1263 characters, summary 580, next 64, 5 files all in this diff, pr/claim/issue/checks matching this PR and tip. Body carries Fixes #1548, Owner: Dev-1, Reviewer: Reviewer (distinct), Written-by: Dev-1. agent-pr added.

One risk to watch, not a defect in this diff: the branch sits on a2213067 while main is now 0e6dfc0d — 10 commits, three of which touch plugins/workflow/client.js, plugins/workflow/README.md and plugins/workflow/test/client.test.js. GitHub reports the PR mergeable and the hunks do not overlap this change set, but the merge decision is the queue's merge tree; if the entry is kicked there, it is the base, not this review.

[Birfy]

Written-by: Reviewer

Queue note, not a verdict — the PASS at b9ee2247 above stands at that tip.

The entry I put in the queue was removed: the branch is CONFLICTING against live main 0e6dfc0d (10 commits ahead of the branch base a2213067; #1575 added tests at the tail of plugins/workflow/test/client.test.js, which is exactly where this branch appends its one new test, and #1489/#1559/#1575 also moved plugins/workflow/client.js and README.md). maintainerCanModify is false on this fork, so I cannot rebase it for you.

Next: rebase onto 0e6dfc0d (the new test moves to the new tail of client.test.js; the client.js, README.md and template.js hunks are context-clean — main still carries the old Each Bot's own permission rows at client.js:66 and :833). Then ask for a PASS at the new tip: the rebase rewrites client.test.js, so this PASS will not carry under #1317.

[Birfy]

Written-by: Chief

The head of this pull request is a branch on HugoXK/FlyBot, which we cannot push to (maintainer_can_modify=false), so it cannot be rebased or updated from here — and it has been CONFLICTING against main since #1575 appended a test to the same tail of plugins/workflow/test/client.test.js this branch appends to.

Per the owner decision of 2026-10-28 we replayed the change onto current main (ac7a916b) in this repository and opened #1589 (branch replay/pr-1560) as the same eight files, +45/−11:

• plugins/workflow/client.js, plugins/workflow/README.md, plugins/workflow/test/ephemeral.test.js — main moved around those lines without rewriting them, so the edits apply unchanged;
• plugins/workflow/test/client.test.js — the one new drawer test now sits at the file's new tail, after the 339 lines main added;
• plugins/workflow/src/template.js, core/test/workflow-node-connectors.test.js, its patches/ds-bot/files/ mirror and the changelog fragment carry over as they were.

Nothing main landed is reverted. Local: workflow 176/176, core connector 2/2, ds-bot-patches check clean.

This pull request is closed as superseded by #1589. Thank you @HugoXK — the change itself is unchanged and it now has a base it can merge on.