The agent share dialog gains a collapsed "What this agent uses" section:
each attached tool, source and prompt, and a workflow agent's node tools
and sources, with whose access it runs with (your access, a sponsor's, the
owner's, your or someone's service account, or each person's own).
Stopped items are marked with why they stopped, and the section opens by
itself when one did. Tools with writes on stored credentials that aren't
in the API write allowlist are marked, with a note that API, widget and
public-link users can't make those changes until they're allowed in
Access Details. Only owners and editors get the data it reads.
A tool's share dialog uses the same words: "Your account" or "Each
person's own", and "The owner's account" for an editor who may share it.
resource_states now carries, for a running tool, its credential mode when
it has a connection (after any mode an admin forces), whose account an
owner-mode connection acts as, and the write actions it takes on
credentials its owner stored, which API, widget and public-link users can
run only from the agent's API write allowlist. The service of a connected
tool is named whether it runs or not. Still only for people who may edit
the agent or workflow.
The agent page shows one notice in place of the sponsored-resources one:
who added what runs with their access, and every attached tool, source or
prompt that stopped, with the reason in plain words and what the reader
can do. Reconnect signs the account in again in place, Run it with my
access now asks first in the sponsor dialog naming who reaches the agent
and is sent with the next save, Remove takes the item off the form, and
when the reader can't fix it the notice says whom to ask.
The workflow builder shows the same notice over the canvas for its node
tools and sources, with take-over sent on the next save and Remove taking
the item off every agent node.
The agent and workflow reads now return resource_states to people who may
edit them: every attached tool, source and prompt (and workflow node tool
and source) with active or stopped and the reason: deleted,
owner_lost_access, the sponsor reasons, connection_needs_reconnect,
connection_removed or connector_disabled. Each entry names the sponsor,
someone other than the reader who can fix it, the service for a connection
reason, and whether the reader may take it over or reconnect it. When
something can be taken over, sponsor_audience says who it would reach.
The state comes from the checks the run itself uses (ref_access,
resolve_holder_tool and the tool's connection as the run resolves it), so
the page and the run can't disagree. A run that leaves a resource out logs
resource_stopped with the holder, type, id and reason.
The workflow read gives sponsor details, run state and node resource names
only to people who may edit it, and names only resources the workflow runs,
someone sponsored, or the reader can see. Owner saves and new workflows
now refuse node tools and sources the owner can't use, like editor saves.
The sponsored-resources notice now says why each item stopped (the person
can no longer edit the agent, or can no longer edit the item) and offers
"Run it with my access" for items the reader may sponsor; the next save
sends that confirmation. Saves go through one confirmation round trip
shared by the agent form and the workflow builder, so the details sheet
closes on a confirmed save and stays open without an error when the
editor declines. An outdated confirmation shows a translated message and
reloads the sponsor details. The tool picker forgets a removed tool's row
once the removal is saved, and workflow node pickers keep a remove-only
option for the owner's private tools and sources.
A resource attached in a save now ignores any sponsor recorded for it
before it was removed: the caller must be able to sponsor it and confirm.
YAML import prunes the sponsors of resources it drops, for agents and
workflow graphs. Sponsor details, with the resources' names, go only to
people who may edit the agent. The workflow read returns the names of
every node tool and source, so editors can remove the owner's private
ones. An agent image is stored only once the save is known to go ahead.
Research steps ran each tool call straight through the executor, never
asking check_pause, so approval-gated actions (including a public-link
visitor's wiki edits) and an outside caller's writes on the owner's
accounts ran unchecked. A step can't pause, so it now checks each call
first and answers any pause with a refusal the model reads, journaled
like a headless denial. Headless and research runs share the journaling.
Public-link visitors edit only wikis they can edit themselves and approve
each edit. The docs also note that with authentication off every caller
is the owner's local user, so the switch has no effect there.
A paused turn is found by the agent owner's id, so anyone holding one of
the owner's agent keys could resume the owner's own chat with its saved
wiki edit rights. A resume now counts as an API or widget caller when
either the saved state or the resuming request is one, cuts the wiki tool
to wiki_view unless the wiki allows outside edits, and gives the tool
executor the same flags. A request that names an agent, by key or id, may
only resume that agent's turn; otherwise the claim is released and the
request refused.
Public-link visitors run as themselves and reach only wikis they may edit,
so the wiki switch no longer applies to them. Instead every wiki write in
a public-link run waits for the visitor's approval, so the agent owner's
prompt or sources can't steer an edit to the visitor's wiki unasked.
Saving an agent or workflow that the server refuses with
sponsor_confirmation_required opens a dialog naming each tool, source or
prompt and who reaches it through the agent (its teams, API key and
widget, public link, webhook), then saves again with confirm_sponsor. A
save the caller may not sponsor shows why instead of the raw message.
The tool picker adds a remove-only row for each attached tool the editor
can't list, so the owner's private tools can be taken off the agent.
Sponsoring a tool, source or prompt the agent's owner can't use now takes
owning it or having edit access to it; use access alone no longer extends it
to the agent's audience. A save that would make the caller a new sponsor is
refused with 409 sponsor_confirmation_required (the resources and the
agent's audience) until it is retried with confirm_sponsor listing them.
When a sponsor loses access, the resource stops instead of passing to
whoever saves next; another editor takes it over only by confirming.
Workflows follow the same rules. sponsor_details now reports each
sponsorship's state, the reason it stopped, and whether the reader can
take it over.
A wiki's owner gets a Wiki settings item in the source's menu. It opens a
dialog with one switch, "Let API, widget and public-link users edit this
wiki", which saves at once and flips back if the server refuses. Editors
and viewers don't get the item; anyone without manage_settings who reaches
the dialog sees the switch read-only.
A run from an agent's API key or widget acts as the agent's owner, so it
could rewrite any wiki the owner can edit. A new per-wiki setting,
wiki_outside_edits (off by default), decides whether such runs, and runs
from the agent's public link, get the wiki's edit actions. While it is off
they are offered only wiki_view, and the tool refuses writes itself after
reading the live setting. The owner changes it through the owner-only
/api/sources/<id>/wiki/settings route; tokens can read it but not change it.
It covers writes on any credentials the owner holds, for API-key and
widget callers, public-link users and the schedules they set, not only
connected accounts reached with the API key.
The owner sets a webhook up and its URL is a secret, and a webhook run
already refuses every action that needs approval, so holding it to the
API write allowlist only broke the owner's own automations. Webhook runs
no longer count as external callers; schedules keep their caller rules.
The allowlist copy no longer names webhooks.
Every API tool counted as holding the owner's credentials, so outside
callers were refused any write on one even when it sends nothing the
owner stored. Now an action counts only when its headers or query
parameters carry a saved value (sealed or legacy plaintext) or the tool
stores credentials; the allowlist lists just those writes.
The answer routes refuse such a request with 401, but only after building
the agent, so a public agent's prompt tools were pre-fetched, and their
actions run, for nobody. Anonymous chat without an agent key is not
supported, so the processor now stops before any setup and the route
answers 401 as before.
A scheduled or webhook run acts as the agent's owner with no one to
approve, so a public-link user or API-key caller could have the agent
schedule a write and have it run on the owner's accounts. Runs now keep
the caller's rules: a schedule set by someone who reaches the agent only
by its public link runs as a public-link caller, one set through the API
(recorded as created_via 'api', migration 0042) and every webhook run as
an external caller, each with the agent's API write allowlist.
Pre-fetch judged someone else's tool by its stored approval flags, which
a remote device or the code executor decides per call, and it took a
widget or API run for the owner because the run carries the owner's id.
Those tools no longer pre-fetch for anyone but their owner, an API-key or
public-link run treats every tool as someone else's, and writes with the
owner's credentials are never pre-fetched for them.
API-key, widget and public-link callers were held to the write allowlist
only on connected accounts, so they could still write through an API
tool or a signed-in MCP server that carries the owner's credentials. Any
write on credentials the caller doesn't hold is now refused unless the
owner allowlisted it, and a scheduled run for such a caller counts as not
holding any. The tool list names these writes per tool, so the allowlist
can offer them, and its copy now names every route it covers.
The /v1 route runs with the agent owner's token, so the processor took a
key holder for the owner: writes on the owner's connected accounts ran or
waited for an approval the client could send. The route now marks the
processor as an external caller server-side, which keeps the allowlist
in force for the run and any resume, including state saved before.
Callers that build a StreamProcessor without __init__ and stub the agent
key lookup never set the flag, and configuring the agent then failed.
It now reads as not a public-link caller.
Headless runs searched only the agent's primary source, so an agent whose
knowledge sat in its extra sources answered a schedule or webhook without
it. They now take the primary and every extra source through the same
owner-or-sponsor check a chat uses, shared as one helper, and retrieve
through the per-source dispatcher so each source keeps its own settings.
Tool pre-fetch ran the caller's own active tools, so a teammate chatting
with a shared agent had the owner's prompt fill in from their tools, and
even the owner got every active tool rather than the agent's. It now uses
the toolset the run gets: the agent's tools as its owner or sponsor, or
the caller's tools and defaults outside an agent. Pre-fetch asks nobody,
so on someone else's tool it skips approval-gated actions and anything on
a connected account.
Someone who reaches an agent only through its public link was offered the
approval card for writes on the owner's connected accounts, so a stranger
could approve for the owner. Those writes are now refused with a tool
result, like an API-key caller's, unless the owner allowed the action in
the agent's Access details. Team members keep the card, and a tool on the
caller's own account (member mode) is unaffected. The flag survives a
resume, and workflow nodes now follow the run's caller rules (scheduled,
API-key and public-link) instead of starting from none.
Overlapping loadConnectors calls applied whichever answer arrived last,
so a load started before a connect could replace the newer connection
list. The slice now records the latest request and ignores older
answers.
A toggle sent the form's draft config, so unsaved guardrail edits were
saved with it, and the form then read as changed because the saved
snapshot kept the old config. The allowlist now saves on top of the last
saved config and updates that snapshot.
With GITHUB_ACCESS_TOKEN set in the environment, load_data checked the
repository's visibility against the real GitHub API. The tests now clear
the instance token unless they set one.
A node's tools resolved as the person running the workflow, so a teammate
or public-link user lost every owner tool they could not use themselves.
They now resolve as the workflow owner, then as the editor who attached
them, like an agent's own tools. The runner stays the invoker, so a
member-mode connection still uses their own account.
Member-mode resolution ranked accounts by last_used_at first, so a
connection added by Connect to continue (never used) lost to any older
used account. Accounts now rank by the later of last use and creation.
The read fallback matched read verbs as substrings, so update_spreadsheet,
set_budget and enlist_member ran as reads with no approval. Names are now
split into words, and any write verb makes the action a write.
Migration 0040 dropped token_info values that were not objects before
clearing the plaintext column. Objects stored as JSON strings are now
decoded, and other values are kept in the envelope under
legacy_token_info so downgrade restores them.
Removing a connection with its tools now also deletes those tools' sharing
switches in the same transaction, as deleting a tool on its own does.
Team grants and chat preferences were already removed with the tools.
At run time a tool now refuses a connection whose connector does not list
the tool's type (a Telegram bot token never reaches an ntfy or MCP tool),
and an MCP tool refuses a connection when no server is known for it,
instead of sending the key without checking. Legacy MCP rows still find
their server from the stored provider value.
The caller's connections never include a teammate's, so a shared connected tool fell under Built in or Custom. The composer and agent pickers now rank on the tool's connection id and name the service from the catalog, or from the tool's own name when the catalog has no match.
The server lets only the owner change the secret on a tool's connection,
so an editor no longer gets live credential fields on a connected tool:
the locked-credentials notice shows and no config is sent, so a rename
or action edit still saves. The share dialog drops the "Editors can
change credentials" switch for a connected tool, uses the matching
editor hint, and says a viewer's runs use each member's own account in
member mode.
An editor the owner lets share now sees whose account shares use,
locked, and still has to confirm before sharing a tool that can act.
The owner's Reconnect is decided by the tool's connection id, so it no
longer flashes before the connections load, and the connection panel's
tool switch is labelled "In my chats", which is what it sets.
/api/update_tool now checks submitted actions against the stored ones the
same way /api/update_tool_actions does: nothing can be added, and only the
tool's owner can change a fixed value. The tool type (name) can no longer
be changed after creation by anyone.
For API tools, changing who fills an existing header, query or body
parameter, its value, or clearing a stored value is now owner-only on both
/api/update_tool and /api/update_tool_config. Before, an editor could hand
a stored secret query value to the model and read it back in the chat.
The chat now masks every value that came from the stored action rather
than from the model.
A connection-backed MCP tool can no longer be moved to another server or
sign-in method through /api/update_tool or /api/update_tool_config (400,
pointing to /api/mcp_server/save), and a new key saved through
/api/update_tool_config goes to its connection, owner only.
arc53-machine