Give workflow node tools the owner's toolset whoever runs the workflow

A node's tools resolved as the person running the workflow, so a teammate
or public-link user lost every owner tool they could not use themselves.
They now resolve as the workflow owner, then as the editor who attached
them, like an agent's own tools. The runner stays the invoker, so a
member-mode connection still uses their own account.
This commit is contained in:
arc53-machine committed 2026-09-29 15:09:48 +01:00
1 parent 23e7145cee
commit 5a503e9b3c
4 files changed
+123 -11

No files matched your search

+4 -1
View File
@@ -20,6 +20,7 @@ class _WorkflowNodeMixin:
api_key: str,
tool_ids: Optional[List[str]] = None,
tool_principals: Optional[Dict[str, str]] = None,
tool_owner: Optional[str] = None,
**kwargs,
):
super().__init__(
@@ -35,7 +36,9 @@ class _WorkflowNodeMixin:
# (Artifact / Code Executor / Read Document) and ``user_tools`` rows
# alike, and an empty list means the node's LLM gets no tools.
self.tool_executor.allowed_tool_ids = [str(t) for t in (tool_ids or [])]
# Tools the owner can't use resolve as the editor who attached them.
# The node's tools are the workflow owner's whoever runs it; tools the
# owner can't use resolve as the editor who attached them.
self.tool_executor.tool_owner = tool_owner
self.tool_executor.tool_principals = dict(tool_principals or {})