Tool tiles keep the caller's own In my chats switch, with the same
visibility and revert-on-failure as before, but without the label text
beside it; screen readers still get its name. A connected tool whose
connection needs signing in again has Sign in again in its menu, and a
paused synced source has Reconnect on its tile, both for the reader's own
connection and in place where the wizard can do it.
Tool cards no longer carry the In my chats switch; the chat's Tools
picker (and a connection's drawer) still sets it, for the same tools. The
Manage connection item goes from tool and source menus, with the
in-place connection drawer on Tools: connections are managed on the
Connectors page. The owner's connected tool keeps Share and Delete; a
teammate's still opens the tool editor.
The server lets only the owner change the secret on a tool's connection,
so an editor no longer gets live credential fields on a connected tool:
the locked-credentials notice shows and no config is sent, so a rename
or action edit still saves. The share dialog drops the "Editors can
change credentials" switch for a connected tool, uses the matching
editor hint, and says a viewer's runs use each member's own account in
member mode.
An editor the owner lets share now sees whose account shares use,
locked, and still has to confirm before sharing a tool that can act.
The owner's Reconnect is decided by the tool's connection id, so it no
longer flashes before the connections load, and the connection panel's
tool switch is labelled "In my chats", which is what it sets.
Main's access model (team editors and viewers, edit_credentials, owner-only
OAuth servers, per-user tool preferences, resource sponsors) now applies to
connection-backed tools and sources. Our migrations are renumbered to
0040_connections and 0041_connection_account_name, after main's
0038_resource_access_settings and 0039_resource_sponsors.
Where the two sides met: MCP tools save and load their connections as the
tool owner, editors may add a key (a new connection on the owner's account)
but never rewrite an existing connection's secret, fixed values stay
owner-only, and a member's own connection is used in member mode.
From a design review against frontend/DESIGN.md:
- Drawer panels use the subtle surface; ToolPermissions takes the
surface it sits on (outline in the wizard, subtle in the drawer).
- The OAuth sign-in is the wizard's footer action with a Cancel
(useConnectorAuth), and sign-in buttons show the service's own glyph
instead of a hard-coded Drive logo. Add Tool's links moved into its
ModalActions footer.
- Failed saves, disconnects and connector creates say so in a toast;
the admin page reports save errors as a toast too.
- Capability badges are neutral; status hues are left for states.
- Row titles use SectionHeader actions, setup settings a DescriptionList,
empty lists EmptyState, retry and row buttons their pill roles.
- The drawer names its close button and describes itself with
SheetDescription; counts are formatted for the app language.
- One ConnectorSetupNotice for the drawer and Upload; warning Alerts use
TriangleAlert; its link keeps the Alert colour (Approved exceptions).
- Tools and Sources tiles show the same "via <service>" meta line; the
paused badge explains itself in a Tooltip.
- On phones the category filter is a Select, empty categories are not
offered, and a composer's capability filter says so with Show all.
- The admin page uses PageToolbar and SectionHeader descriptions, and is
English throughout.
Every entry point (the Connectors page and drawer, Add Source, Add
Tool, the chat) opens one connect wizard: sign in or paste the
credentials, choose what to sync (content services only, skippable),
then a summary with Try it in chat. Tool services create their tools on
sign-in with write actions needing approval, and each action's
permission (Always allow, Needs approval, Off) can be changed in the
wizard or the drawer. The drawer also reconnects, syncs more content,
refreshes an MCP server's tools and removes a connection, keeping or
deleting what it feeds.
The file pickers work from a connection id and fetch a short-lived
picker token when they need one; no session token is kept in
localStorage any more, and any left by an older build is claimed once
and removed. S3 and Reddit reuse the keys stored on a connection.
A tool whose account needs signing in pauses on a Connect card in the
chat; after connecting, Continue resumes the call. A connection whose
sign-in stops working raises a Reconnect toast. The Connectors page is
hidden when the backend does not report connectors_enabled.
arc53-machine