Gate outside writes on the owner's stored credentials, not only connections

API-key, widget and public-link callers were held to the write allowlist
only on connected accounts, so they could still write through an API
tool or a signed-in MCP server that carries the owner's credentials. Any
write on credentials the caller doesn't hold is now refused unless the
owner allowlisted it, and a scheduled run for such a caller counts as not
holding any. The tool list names these writes per tool, so the allowlist
can offer them, and its copy now names every route it covers.

frontend/src/agents/ApiWriteAllowlist.test.tsx

@@ -34,6 +34,7 @@ const TOOLS = {
       id: 'tg',
       displayName: 'Telegram',
       connection_id: 'c1',
+      owner_credential_writes: ['telegram_send_message'],
       actions: [
         { name: 'telegram_send_message', access: 'write', active: true },
         { name: 'telegram_read', access: 'read', active: true },
@@ -43,8 +44,16 @@ const TOOLS = {
       id: 'memory',
       displayName: 'Memory',
       connection_id: null,
+      owner_credential_writes: [],
       actions: [{ name: 'memory_write', access: 'write', active: true }],
     },
+    {
+      id: 'crm',
+      displayName: 'CRM API',
+      connection_id: null,
+      owner_credential_writes: ['create_lead'],
+      actions: [],
+    },
   ],
 };
 
@@ -101,7 +110,7 @@ describe('ApiWriteAllowlist', () => {
     return onConfigChange;
   };
 
-  it('lists only write actions on connected accounts, unchecked by default', async () => {
+  it("lists only writes on the owner's credentials, unchecked by default", async () => {
     await render(agent());
     const labels = Array.from(container.querySelectorAll('label')).map(
       (l) => l.textContent,
@@ -166,6 +175,14 @@ describe('ApiWriteAllowlist', () => {
     expect(selectActionToast(store.getState())?.variant).toBe('destructive');
   });
 
+  it('lists writes on stored credentials of tools without a connection', async () => {
+    await render(agent({ tools: ['crm'] }));
+    const labels = Array.from(container.querySelectorAll('label')).map(
+      (l) => l.textContent,
+    );
+    expect(labels).toEqual(['CRM API: Create lead']);
+  });
+
   it('renders nothing for an agent without connected tools', async () => {
     await render(agent({ tools: ['memory'] }));
     expect(container.textContent).toBe('');

frontend/src/agents/ApiWriteAllowlist.tsx

@@ -24,6 +24,7 @@ type UserTool = {
   displayName?: string;
   customName?: string;
   connection_id?: string | null;
+  owner_credential_writes?: string[];
   actions?: {
     name: string;
     description?: string;
@@ -33,9 +34,11 @@ type UserTool = {
 };
 
 /**
- * The write actions on the owner's connected accounts that anyone calling
- * this agent with its API key may run. Nobody can approve an action in the
- * widget or the API, so the server refuses every other such write.
+ * The write actions on the owner's accounts and stored credentials that
+ * anyone reaching this agent through its API key, widget, a webhook or its
+ * public link may run. Nobody there can approve an action for the owner, so
+ * the server refuses every other such write. The server names these writes
+ * per tool (`owner_credential_writes`).
  *
  * A toggle saves at once, on top of the agent's last saved config
  * (`getSavedConfig`), so edits still pending in the form are not saved with
@@ -76,19 +79,16 @@ export default function ApiWriteAllowlist({
         const agentTools = new Set(agent.tools);
         setActions(
           (data.tools ?? [])
-            .filter((tool) => agentTools.has(tool.id) && tool.connection_id)
+            .filter((tool) => agentTools.has(tool.id))
             .flatMap((tool) =>
-              (tool.actions ?? [])
-                .filter(
-                  (action) =>
-                    action.access === 'write' && action.active !== false,
-                )
-                .map((action) => ({
-                  entry: `${tool.id}:${action.name}`,
-                  tool: tool.customName || tool.displayName || '',
-                  action: action.name,
-                  description: action.description ?? '',
-                })),
+              (tool.owner_credential_writes ?? []).map((name) => ({
+                entry: `${tool.id}:${name}`,
+                tool: tool.customName || tool.displayName || '',
+                action: name,
+                description:
+                  tool.actions?.find((action) => action.name === name)
+                    ?.description ?? '',
+              })),
             ),
         );
       })

frontend/src/locale/de.json

@@ -1889,8 +1889,8 @@
       "resetKey": "Schlüssel zurücksetzen",
       "resetKeyConfirm": "Möchten Sie den API-Schlüssel wirklich zurücksetzen? Der aktuelle Schlüssel funktioniert sofort nicht mehr und diese Aktion kann nicht rückgängig gemacht werden.",
       "apiWrites": {
-        "title": "Aktionen, die jeder mit diesem Schlüssel in deinem Namen ausführen kann",
-        "description": "Im Widget oder über die API kann niemand eine Aktion bestätigen. Änderungen an deinen verbundenen Konten sind daher blockiert, außer du erlaubst sie hier.",
+        "title": "Aktionen, die API-, Widget- und Public-Link-Nutzer in deinem Namen ausführen können",
+        "description": "Über den API-Schlüssel, das Widget, einen Webhook oder den öffentlichen Link des Agenten kann niemand eine Aktion für dich bestätigen. Änderungen mit deinen verbundenen Konten und gespeicherten Zugangsdaten sind daher blockiert, außer du erlaubst sie hier.",
         "item": "{{tool}}: {{action}}",
         "saveFailed": "Speichern fehlgeschlagen. Versuche es erneut."
       },

frontend/src/locale/en.json

@@ -1895,8 +1895,8 @@
       "resetKey": "Reset key",
       "resetKeyConfirm": "Are you sure you want to reset the API key? The current key will stop working immediately and this action cannot be undone.",
       "apiWrites": {
-        "title": "Actions anyone with this key can take as you",
-        "description": "Nobody can approve an action in the widget or through the API, so changes on your connected accounts are blocked unless you allow them here.",
+        "title": "Actions API, widget and public-link users can take as you",
+        "description": "Nobody can approve an action for you through the API key, the widget, a webhook or the agent's public link, so changes made with your connected accounts and saved credentials are blocked unless you allow them here.",
         "item": "{{tool}}: {{action}}",
         "saveFailed": "Could not save. Try again."
       },

frontend/src/locale/es.json

@@ -1889,8 +1889,8 @@
       "resetKey": "Restablecer clave",
       "resetKeyConfirm": "¿Seguro que quieres restablecer la clave de API? La clave actual dejará de funcionar de inmediato y esta acción no se puede deshacer.",
       "apiWrites": {
-        "title": "Acciones que cualquiera con esta clave puede realizar en tu nombre",
-        "description": "Nadie puede aprobar una acción en el widget ni a través de la API, así que los cambios en tus cuentas conectadas se bloquean salvo que los permitas aquí.",
+        "title": "Acciones que los usuarios de la API, del widget y del enlace público pueden realizar en tu nombre",
+        "description": "Nadie puede aprobar una acción por ti a través de la clave de API, el widget, un webhook o el enlace público del agente, así que los cambios con tus cuentas conectadas y credenciales guardadas se bloquean salvo que los permitas aquí.",
         "item": "{{tool}}: {{action}}",
         "saveFailed": "No se pudo guardar. Inténtalo de nuevo."
       },

frontend/src/locale/jp.json

@@ -1878,8 +1878,8 @@
       "resetKey": "キーをリセット",
       "resetKeyConfirm": "APIキーをリセットしてもよろしいですか？現在のキーは直ちに無効になり、この操作は元に戻せません。",
       "apiWrites": {
-        "title": "このキーを持つ人があなたとして実行できる操作",
-        "description": "ウィジェットや API では誰も操作を承認できないため、接続済みアカウントへの変更はここで許可しない限りブロックされます。",
+        "title": "API、ウィジェット、公開リンクの利用者があなたとして実行できる操作",
+        "description": "API キー、ウィジェット、Webhook、エージェントの公開リンクでは誰もあなたの代わりに操作を承認できないため、接続済みアカウントや保存済みの認証情報を使う変更は、ここで許可しない限りブロックされます。",
         "item": "{{tool}}: {{action}}",
         "saveFailed": "保存できませんでした。もう一度お試しください。"
       },

frontend/src/locale/ru.json

@@ -1973,8 +1973,8 @@
       "resetKey": "Сбросить ключ",
       "resetKeyConfirm": "Вы уверены, что хотите сбросить API-ключ? Текущий ключ немедленно перестанет работать, и это действие нельзя отменить.",
       "apiWrites": {
-        "title": "Действия, которые любой с этим ключом может выполнить от вашего имени",
-        "description": "В виджете и через API никто не может подтвердить действие, поэтому изменения в подключённых аккаунтах заблокированы, если вы не разрешите их здесь.",
+        "title": "Действия, которые пользователи API, виджета и публичной ссылки могут выполнить от вашего имени",
+        "description": "Через API-ключ, виджет, вебхук или публичную ссылку агента никто не может подтвердить действие за вас, поэтому изменения с вашими подключёнными аккаунтами и сохранёнными учётными данными заблокированы, если вы не разрешите их здесь.",
         "item": "{{tool}}: {{action}}",
         "saveFailed": "Не удалось сохранить. Попробуйте ещё раз."
       },

frontend/src/locale/zh-TW.json

@@ -1878,8 +1878,8 @@
       "resetKey": "重設金鑰",
       "resetKeyConfirm": "確定要重設 API 金鑰嗎？目前的金鑰將立即停止運作，此操作無法復原。",
       "apiWrites": {
-        "title": "持有此金鑰的任何人都能以你的身分執行的操作",
-        "description": "在小工具或 API 中無人能核准操作，因此除非你在此允許，否則對已連線帳號的變更都會被封鎖。",
+        "title": "API、小工具和公開連結使用者能以你的身分執行的操作",
+        "description": "透過 API 金鑰、小工具、Webhook 或代理的公開連結，無人能替你核准操作，因此除非你在此允許，否則使用你的已連線帳號和已儲存憑證的變更都會被封鎖。",
         "item": "{{tool}}：{{action}}",
         "saveFailed": "無法儲存。請再試一次。"
       },

frontend/src/locale/zh.json

@@ -1878,8 +1878,8 @@
       "resetKey": "重置密钥",
       "resetKeyConfirm": "确定要重置 API 密钥吗？当前密钥将立即停止工作，此操作无法撤销。",
       "apiWrites": {
-        "title": "持有此密钥的任何人都能以你的身份执行的操作",
-        "description": "在小组件或 API 中无人能批准操作，因此除非你在此允许，否则对已连接账号的更改都会被阻止。",
+        "title": "API、小组件和公开链接用户能以你的身份执行的操作",
+        "description": "通过 API 密钥、小组件、Webhook 或智能体的公开链接，无人能替你批准操作，因此除非你在此允许，否则使用你的已连接账号和已保存凭据的更改都会被阻止。",
         "item": "{{tool}}：{{action}}",
         "saveFailed": "无法保存。请重试。"
       },