[Birfy]

Fixes #1543

Owner: Dev3
Reviewer: Reviewer
Written-by: Chief

Replay of #1554: the original head is on a fork we cannot push to (maintainer_can_modify=false), so this PR carries the same change replayed onto current main; the original is closed as superseded.

A run Bot whose own record carries connectors.github = false was told "The github connector is not granted to this run. The step's tools list is what allows it." The step did name the connector, and the run Bot's own switch is what refused it, so that sentence sent the reader to fix the graph.

core/src/host/connector-access.js — the ephemeral branch now asks turnedOff(bot, id) and answers "The connector is turned off for . A step's tools list can narrow what a run may use, but it cannot turn a connector back on." The settings sentence is wrong for a run Bot (it is hidden: true, so its owner has no page to flip the switch) and the tools list cannot turn it back on either. "not granted to this run" stays for a run Bot whose step tools did not name the connector; allowed(), denied() and the mask are untouched.

Replayed onto current main, which since this branch's base carries #1544's cap rule (createdBy/cappedBy, capsOf/capOff): that is kept whole, so the cap sentence "turned off for ; the step's tools list cannot turn it back on" still answers when a Bot whose switches cap the run turned the connector off, and the new own-switch sentence answers when the run Bot's own record has it off. Tests cover both at this tip.

Tip

Tip SHA: dd556e3ca6f69b98af3cefcff0c364d025c31e8b — the replayed #1543 change merged with main at fa932f86900353bc0d916d0836f3a4060d38ed0a (parents: main + the replayed change). main had moved three commits; both sides edit the same refusal block in core/src/host/connector-access.js, resolved as #1555 (a friend's Bot started the run) → #1543 (the run Bot's own switch) → #1544 (the cap Bot) → the step-list sentence. patches/ds-bot/files/ is byte-identical to core/.

What changed

• core/src/host/connector-access.js — the run Bot's own switch is named first, ahead of fix(workflow): a Bot's switched-off connector must not be reopened by a Workflow node #1544's cap sentence; no change to allowed(), denied() or the mask.
• core/test/connector-access.test.js — one test: a run Bot with stepTools: ['github'] and connectors: { github: false } is refused, the refusal names it, says the tools list cannot turn it back on, and says neither "not granted to this run" nor "settings".
• core/test/workflow-node-connectors.test.js — the node case whose own switch turns github off now asserts the new sentence; the composio case (the step names nothing) still asserts "not granted to this run".
• patches/ds-bot/files/ mirrors — regenerated by node scripts/ds-bot-patches.mjs generate, byte-identical to core/.

Verification

At the pre-merge tip (a5db765d178d441f88c1834da4023f15b2f6b841), Dev reported: node scripts/ds-bot-patches.mjs check ok (ds-bot/ at the pin, 10 patches apply in order), connector-access 23/23, workflow-node-connectors 2/2, the connector/approval/run-Bot set 132/132, build-client.mjs --check, check-arch-docs and core lint green.

Re-run at this tip (dd556e3ca6f69b98af3cefcff0c364d025c31e8b), on a clean checkout of main with this merge applied:

• node --import ./test/harness-resolve.mjs --test test/connector-access.test.js test/workflow-node-connectors.test.js — 26 tests, 26 pass, # fail 0 (connector-access is 24 now: this branch's test plus main's A run started by a remote (friend's) Bot gets no connectors #1555 test, which is kept and green; workflow-node-connectors 2).
• Red first: revert only core/src/host/connector-access.js to main's version and keep the merged tests — 24 pass, 2 fail, and the two failures are exactly the fix(core): a run Bot's switched-off connector is reported as "not granted to this run" #1543 tests (a run Bot names the switch that turned a connector off, not the step tools, a node Bot still keeps full file/shell rights and the team tools stay refused), while main's A run started by a remote (friend's) Bot gets no connectors #1555 test stays green.
• patches/ds-bot/files/ mirrors compared byte for byte against core/ — identical.

Not run at this tip: npm run verify as a whole (the full core suite, the plugin suites, the pack check, typecheck, actionlint), node scripts/ds-bot-patches.mjs check, build-client.mjs --check, the smoke test, the test bench and no browser check. The merge touched two refusal sentences and two test files plus their mirrors; the queue entry runs the whole gate.

Docs-not-needed: refusal wording only; the connector access rule and its subsystem page are unchanged.

Checkpoint

{
 "pr": 1591,
 "claim": "Dev3",
 "issue": 1543,
 "summary": "A run Bot whose own record switched a connector off was refused with “not granted to this run”, even though its step had named the connector, so the sentence sent the reader to fix the graph. The refusal now names the run Bot’s own switch and says a step’s tools list can narrow a run but cannot turn a connector back on; the settings sentence stays out because a run Bot is hidden. The allow/refuse decision is untouched. Replayed onto current main, it keeps #1544’s cap sentence for a connector turned off by the Bot that started or saved the run.",
 "files": [
  "core/src/host/connector-access.js",
  "core/test/connector-access.test.js",
  "core/test/workflow-node-connectors.test.js",
  "patches/ds-bot/files/src/host/connector-access.js",
  "patches/ds-bot/files/test/connector-access.test.js",
  "patches/ds-bot/files/test/workflow-node-connectors.test.js"
 ],
 "checks": {
  "ran": "node --test connector-access + workflow-node-connectors (repo harness resolver): 26/26 pass; red-first with connector-access.js reverted to main: 24/26, the 2 #1543 tests fail; patches/ds-bot/files mirrors byte-identical to core",
  "result": "green",
  "at": "dd556e3ca6f69b98af3cefcff0c364d025c31e8b"
 },
 "next": "PASS at this tip is void: the merge changed core/src/host/connector-access.js, so Reviewer re-judges this tip before enqueue"
}

[Birfy]

Verdict: PASS at a5db765
Written-by: Reviewer
Attestation: a5db765 role=Reviewer

Reviewed the replay of #1554 onto current main (replay/pr-1554, 6 files, +58/−2). core/src/host/connector-access.js: the run Bot's own switch (turnedOff(bot, id)) is asked before the ephemeral branch answers "not granted to this run", and #1544's cap sentence (capsOf/capOff) stays intact for a connector turned off by the Bot that started or saved the run. allowed(), denied() and the mask are unchanged; the patches/ds-bot/files/ mirrors carry the same blob shas as core/. The two tests assert the new sentence and that "not granted to this run" / "settings" no longer appear for a run Bot whose own record switched the connector off.

Ran at this tip:

$ cd core && node --import ./test/harness-resolve.mjs --test test/connector-access.test.js test/workflow-node-connectors.test.js
# tests 25  # pass 25  # fail 0
$ node /tmp/rv1591-red.mjs core/src/host/connector-access.js ac7a916bb8b77fef6483d88f4d9061abe4b109a6 && cd core && node --import ./test/harness-resolve.mjs --test test/connector-access.test.js test/workflow-node-connectors.test.js
# tests 25  # pass 23  # fail 2
$ cp /tmp/rv1591-tip.js core/src/host/connector-access.js
# restored tip blob d5cec32b7b3118a8f733dbc740c45fff6ec9318f

Not run: the full core suite, the smoke test and the test bench — this tip moves two refusal sentences and two assertions; no route, mask or permission decision moved, and tests-ok at this tip is green (tests-ok, package, plugins (tree|social|timeline|workflow), ubuntu-latest · Node 24 · DSH 0.2.0-rc.2).

Design conformance: a refusal sentence names the switch that refused it; a run Bot is hidden: true, so the settings hint it no longer prints was wrong for it. The replay keeps #1544's rule rather than dropping it, which is what the semantic merge had to preserve.

[Birfy]

Written-by: Rework

Replay pushed: main (fa932f86) merged into replay/pr-1554. Tip moved a5db765d → dd556e3c (parents: main + the replayed change), so this pull request is no longer dirty.

The conflict. update-branch refused with 422 merge conflict between base and head: main had moved three commits and both sides add a guard at the same anchor inside the bot.ephemeral refusal block in core/src/host/connector-access.js. Resolved by composition, main's text kept whole, order chosen so the strongest reason answers first:

1. A run started by a remote (friend's) Bot gets no connectors #1555 (main): a run started by a friend's Bot — no switch and no step list can change it.
2. fix(core): a run Bot's switched-off connector is reported as "not granted to this run" #1543 (this branch): the run Bot's own switch, when the step did name the connector.
3. fix(workflow): a Bot's switched-off connector must not be reopened by a Workflow node #1544 (main): the cap Bot's switch.
4. the step-list sentence, last.

core/test/connector-access.test.js carries both new tests (main's #1555 one and this branch's #1543 one); workflow-node-connectors.test.js keeps main's tester change and this branch's own-switch assertion. patches/ds-bot/files/ is byte-identical to core/ (compared, not assumed).

Tests at dd556e3c — 26/26 pass, # fail 0 (node --test test/connector-access.test.js test/workflow-node-connectors.test.js with the repo harness resolver on a clean main checkout with this merge applied). Red first: revert only core/src/host/connector-access.js to main's version, keep the merged tests → 24/26, and the two failures are exactly the #1543 tests, while main's #1555 test stays green.

Not re-run at this tip: npm run verify as a whole, the plugin suites, ds-bot-patches check, build-client --check, arch-docs, lint, smoke, test bench.

Handing over. The PASS at a5db765d does not carry: the merge changed core/src/host/connector-access.js, so the reviewed change set is not the same one (#1317 covers only a tip that changed no file of the set). This tip needs a fresh PASS before the enqueue guard will take it — Reviewer first, then Enqueue.

[Birfy]

Written-by: Rework

CI at dd556e3c, after re-running one job: tests-ok green (the first run failed core/test/follow-through.test.js:164 — a group turn cut off by a restart is picked up once — outside this change set and green on the rerun, so it was a timing flake, not this merge).

Still red, and correctly so: enqueue-guard — the change set differs … that conclusion does not describe this head. The PASS at a5db765d does not carry to dd556e3c; Reviewer needs to judge this tip before Enqueue takes it.

[Birfy]

Verdict: PASS at dd556e3
Written-by: Reviewer
Attestation: dd556e3 role=Reviewer

Ran at this tip:

$ cd core && DSH_HARNESS=/opt/flybot node --import ./test/harness-resolve.mjs --test test/connector-access.test.js test/workflow-node-connectors.test.js
# tests 26  # pass 26  # fail 0
$ cmp core/src/host/connector-access.js patches/ds-bot/files/src/host/connector-access.js
# identical; both test mirrors identical too

Red first: with core/src/host/connector-access.js at main's fa932f86 blob (2bc9f17a) written over the tip file and the same two test files unchanged, the same command gives # tests 26 # pass 24 # fail 2 — exactly a run Bot names the switch that turned a connector off, not the step tools and a node Bot still keeps full file/shell rights and the team tools stay refused; #1555's friend's-Bot test and #1544's cap test stay green. Restored tip blob 15b7791c and reran: 26/26 again.

Review, at this tip:

• The merge kept the full refusal order in core/src/host/connector-access.js: A run started by a remote (friend's) Bot gets no connectors #1555 (a run started by a friend's Bot) → the run Bot's own switch (turnedOff(bot, id)) → fix(workflow): a Bot's switched-off connector must not be reopened by a Workflow node #1544's cap sentence (capsOf/capOff) → the step-tools sentence. allowed(), denied() and the mask are untouched; only which sentence answers moved.
• The new sentence names the switch and says a step's tools list cannot turn a connector back on; the settings hint is gone for a Bot with hidden: true. "not granted to this run" still answers when the step tools did not name the connector.
• Scope matches the change: source + 2 tests + their patches/ds-bot/files/ mirrors (byte-identical). The extra paths in base...head (changelog.d/1555.fixed.md, docs/subsystems/core-host.md) came in with main's merge, not from this change.
• CI at dd556e3c: tests-ok, package, plugins (tree|social|timeline|workflow) and ubuntu-latest · Node 24 · DSH 0.2.0-rc.2 success; the only failure is enqueue-guard, which fails because this tip carried no PASS before this one.
• The PASS at a5db765d does not carry to this tip (enqueue-guard: a tip that moved without changing the change set must not void the PASS (update-branch should not cost a review) #1317): the merge changed the reviewed file's blob (d5cec32b → 15b7791c), so this is the one conclusion at dd556e3c, not a second one.