[Birfy]

Fixes #1548

Owner: Dev
Reviewer: Reviewer

Replay of #1560: the original head is on a fork we cannot push to (maintainer_can_modify=false), so this PR carries the same change replayed onto current main; the original is closed as superseded.

Replayed onto main ac7a916bb8b77fef6483d88f4d9061abe4b109a6 from the original head b9ee22471e54bc5027d7243bbf87df2e5fa862bb (base a2213067, 14 commits behind). Four of the eight files were touched by main too: plugins/workflow/client.js, plugins/workflow/README.md, plugins/workflow/test/ephemeral.test.js and plugins/workflow/test/client.test.js. On the first three, main moved around those lines without rewriting them, so the original's edits apply unchanged; on client.test.js main appended 339 lines of newer tests, so the one new test now sits at the file's new tail. Nothing main landed was reverted. patches/ds-bot/files/ was regenerated by node scripts/ds-bot-patches.mjs generate, not hand-edited.

The original carried Owner: Dev-1; this replay carries Owner: Dev, because the in-repository enqueue guard reads that line against writers and Dev-1 is not a name it knows (the original was a fork PR, which that guard exempts).

What changed (8 files, +45/−11)

• plugins/workflow/client.js — the Settings → Details row: the English key and its Chinese translation go from Each Bot's own permission / 跟随各个 Bot 的权限 to Full access, same as a normal Bot / 完全访问，与普通 Bot 相同, and the row that renders it uses the new key; the old key is removed, not orphaned.
• plugins/workflow/test/client.test.js — one new test: the Details list has a Permissions row, it must not claim a per-Bot permission, it must say full access and same as a normal Bot, and tr() translates the new key.
• plugins/workflow/src/template.js — the delivery template: Coder's tools becomes ['github'] (bash, read, edit were never connectors), and the Tester's tools: ['bash'] is removed, so the Tester names nothing.
• plugins/workflow/test/ephemeral.test.js — the two assertions that pin those template lists: Coder ['github'], Tester [].
• core/test/workflow-node-connectors.test.js — the core-side assertion that the built-in tester names no connector: ['bash'] becomes undefined, plus its comment.
• patches/ds-bot/files/test/workflow-node-connectors.test.js — the byte-for-byte mirror of the file above, as core/ == ds-bot/ + patches requires.
• plugins/workflow/README.md — the delivery-template sentence: Coder, Reviewer and Deployer name github; the Tester names none, because bash is not a connector and grants nothing here (fix(workflow): a node's tools selects connectors instead of granting everything #1535).
• changelog.d/1548-workflow-tools-wording.changed.md — the fragment.

Out of scope on purpose: the Tools field's placeholder (github, bash, read, edit...) stays with #1520.

What I ran at dbcea23

TZ=UTC in a main tree with the eight files overwritten:

$ npm test                      # plugins/workflow — tests 176, pass 176, fail 0
$ node --import ./test/harness-resolve.mjs --test test/workflow-node-connectors.test.js   # core — tests 2, pass 2, fail 0
$ node scripts/ds-bot-patches.mjs check    # 10 patches apply cleanly; core/ == ds-bot/ + patches
$ node .github/scripts/changelog.mjs check # 78 fragments well formed

Not run: the red-first measurement (the review node does it), the full npm run verify, the smoke bench and a browser screenshot. The diff moves a label, the template word list, two assertions and prose — no core/src/host/ and no client bundle source.

Docs-not-needed: docs/subsystems/workflow.md invariant 6 already says every node Bot has a normal Bot's full access and node.tools names connectors only (#1535). This replay only makes the Settings label, the delivery template and the README say the same — no behavior changes, so the subsystem doc is already correct.

Checkpoint

{
 "pr": 1589,
 "claim": "Dev",
 "issue": 1548,
 "summary": "Settings → Details printed each Bot's own permission and the delivery template listed bash, read and edit on the Coder and bash on the Tester — stale after #1535. The row now says full access, same as a normal Bot, because every node Bot gets a normal Bot's danger-full-access preset. The template names github on the Coder and nothing on the Tester, and the README says naming bash grants nothing. This replay carries the same eight files onto main ac7a916b.",
 "files": [
  "plugins/workflow/client.js",
  "plugins/workflow/src/template.js",
  "plugins/workflow/test/client.test.js",
  "plugins/workflow/test/ephemeral.test.js",
  "core/test/workflow-node-connectors.test.js",
  "changelog.d/1548-workflow-tools-wording.changed.md"
 ],
 "checks": {
  "ran": "npm test (plugins/workflow) 176 pass; core workflow-node-connectors.test.js 2 pass; ds-bot-patches check; changelog.mjs check",
  "result": "green",
  "at": "dbcea23150c8e823e7a3f636a91f7e0c35217ba2"
 },
 "next": "none — ready for review. The review node measures the red first; the Tools placeholder stays with #1520."
}

[Birfy]

Verdict: PASS at dbcea23
Written-by: Reviewer
Attestation: dbcea23 role=Reviewer

Ran at this tip:

$ cd plugins/workflow && DSH_HARNESS=/data/dsh/bot/workspace/replay-1560/wt/core/dev/harness node --import ./test/resolve.mjs --test test/client.test.js
# tests 57  # pass 57  # fail 0
$ cp /data/dsh/bot/workspace/replay-1560/fetch/plugins__workflow__client.js.main client.js && node --import ./test/resolve.mjs --test test/client.test.js
# tests 57  # pass 56  # fail 1

Red first, one file: plugins/workflow/client.js swapped for its live-main blob (the change undone), same command. The only failure is the new test the drawer details name the permission every node Bot actually runs with, so the test pins the change; the file was restored afterwards and its md5 matches the tip.

Checks at tip: tests-ok, plugins (workflow), plugins (tree), plugins (social), plugins (timeline), package, ubuntu-latest · Node 24 · DSH 0.2.0-rc.2 and merge-gate all success. enqueue-guard red is the missing-PASS refusal this verdict answers, not a code failure.

Reviewed as the replay of #1560 onto main ac7a916b: 8 files, +46/−12. plugins/workflow/client.js differs from the original head only by what main landed since a2213067; against live main the file carries exactly the two label lines the original changed, with the old key removed. The other seven files carry the original edits, the regenerated patches/ds-bot/files/ mirror included. Nothing main landed is reverted.