Merge main into dev3/1271-catch-fail-closed (#1271)

#1275 landed on main and changed the same page, the same refusal string and the same
assertions. Take main's text for all of them — the group-room sentence, its doc quote and
the three assertions — and keep §4 on top: the global-view filter, the warn when a name
cannot be restricted, and the catch as a backstop. No §2 text is reverted.

Refs #1271

Author: Birfy

changelog.d/1271-room-refusal-wording.changed.md

@@ -0,0 +1 @@
+A connector call refused in a group room now says the tool is not available there, instead of pointing the caller at its own chat — a friend's Bot has no composio tools in its chat either ([#1271](https://github.com/ThinkFlowLab/FlyBot/issues/1271)).

core/src/host/connector-access.js

@@ -101,7 +101,7 @@ export function install(rt) {
     // a Bot that reads it knows where the tool went, and the refusal is the same for every origin.
     if (roomHidden(who, name)) {
       return id === COMPOSIO
-        ? `The ${COMPOSIO} connector is available in your own chat, not in a group room (#1237).`
+        ? `The ${COMPOSIO} connector is not available in a group room (#1237).`
         : `Schedules are managed in your own chat, not in a group room (#1237).`
     }
     if (id === undefined) return undefined

core/test/connector-access.test.js

@@ -145,7 +145,7 @@ test('default: a connected connector is on for every Bot, old or new, in its cha
   // #1237: it is the one Session that carries neither the composio tools nor the schedule ones.
   assert.deepEqual([...hiddenFrom('room-writer')].sort(), [...COMPOSIO].sort(), 'the mask lands with the Agent, not with the turn')
   const done = await turn('room-writer', { kind: 'bot', form: 'relay', role: 'room', roomId: 'room', exchangeId: 'rr', senderName: 'You', hop: 0, origin: 'owner' })
-  assert.match(guard(COMPOSIO[0], 'room-writer'), /own chat, not in a group room/)
+  assert.match(guard(COMPOSIO[0], 'room-writer'), /not available in a group room/)
   assert.equal(guard(GITHUB[0], 'room-writer'), undefined, 'github stays: a room judges pull requests')
   done()
   assert.equal(guard(COMPOSIO[0], 'plain'), undefined)
@@ -210,9 +210,11 @@ test('#1237: a room turn drops the composio and schedule tools and keeps github
   // notice a renamed or emptied SCHEDULE_TOOLS; these are the DSH names (0.2.0-rc.2).
   for (const name of ['schedule_create', 'schedule_list', 'schedule_update', 'schedule_delete']) assert.ok(allHidden('room-writer').has(name), `${name} is hidden in a room`)
   for (const name of [...GITHUB, ...OWN]) assert.equal(guard(name, 'room-writer'), undefined, `${name}`)
-  for (const name of [...COMPOSIO, ...SCHEDULE]) assert.match(guard(name, 'room-writer'), /own chat, not in a group room/, name)
+  for (const name of [...SCHEDULE]) assert.match(guard(name, 'room-writer'), /own chat, not in a group room/, name)
   assert.equal(guard('schedule_list', 'room-writer'), 'Schedules are managed in your own chat, not in a group room (#1237).')
-  assert.equal(guard(COMPOSIO[0], 'room-writer'), 'The composio connector is available in your own chat, not in a group room (#1237).')
+  // #1271: a friend's Bot that holds a room Session is refused here too, and it has no composio tools in
+  // its own chat either, so the refusal no longer points there.
+  for (const name of [...COMPOSIO]) assert.equal(guard(name, 'room-writer'), 'The composio connector is not available in a group room (#1237).', name)
 })
 
 test('#1237: a Bot\'s own chat keeps composio and the schedule tools', async (t) => {
@@ -277,7 +279,8 @@ test('#601: a group round of any origin keeps the github tools, also with a frie
     begin('room-writer')
     await tick()
     for (const name of GITHUB) assert.equal(guard(name, 'room-writer'), undefined, `${origin}: ${name}`)
-    for (const name of [...COMPOSIO, ...SCHEDULE]) assert.match(guard(name, 'room-writer'), /own chat, not in a group room/, `${origin}: ${name}`)
+    for (const name of [...SCHEDULE]) assert.match(guard(name, 'room-writer'), /own chat, not in a group room/, `${origin}: ${name}`)
+    for (const name of [...COMPOSIO]) assert.match(guard(name, 'room-writer'), /not available in a group room/, `${origin}: ${name}`)
     assert.deepEqual([...allHidden('room-writer')].sort(), [...COMPOSIO, ...SCHEDULE].sort(), `${origin}: the mask is the same in every origin`)
     end('room-writer')
   }

docs/subsystems/core-host.md

@@ -355,7 +355,7 @@ The connector tools are mounted once for the whole DSH profile, so which Bot may
 - **Boundaries that stay.** A friend's Bot (`bot.remote`) never gets the tools. An Agent whose Bot cannot be determined (a parent Session that is gone, or a parent chain deeper than eight) gets none either (fail closed), so an unresolved sub-agent never reads as a plain owner Session. A chain that really ends at a Session of no Bot (the DSH Agent, a plain Session) keeps them. A sub-agent Session is followed to its parent Bot (`whoseAgent`, also on `rt.whoseAgent` for `secrets.js`).
 - **Enforcement is two layers.** A `ctx.tools.guard` refuses every `mcp__github__*` / `mcp__composio__*` call that is not allowed, and `agent.ctx.tools.restrict({ deny })` takes the same tools out of that Agent's tool list. The mask is refreshed when the Agent is created, on every `resolveAgent` (delivery), when a switch changes, and on `tools/change` (a connector that mounts or goes away later). Turns and sharing no longer change it. DSH's hidden "Tool added/removed" notices for these tools are not drawn in the chat (`cells.js`).
 - **A mask that cannot be rebuilt keeps the previous one (#1271).** `hideConnectorTools` lifts the old mask before it reads `schemas()` again, so a `restrict()` that refuses a name would otherwise leave the Agent with no mask and every tool listed again. The rebuild now names only what the global view (`schemas()` with no Agent) can restrict, and if a restriction still fails the catch puts the previous deny list back: the guard refuses a call either way, and a list that widens by itself is a wrong answer. A denied name the Agent itself serves stays listed — `restrict()` cannot name a scope's own tool — and the warn line says so.
-- **A group room turn carries no composio tools and no schedule tools (#1237).** The eight tools — `mcp__composio__*` and `schedule_create` / `schedule_list` / `schedule_update` / `schedule_delete` — are 20,355 characters of schema (≈5.2k tokens at the measured 3.92 chars/token) on every call, and a room round uses neither: an outside app is reached from the Bot's own chat, and a schedule belongs to a Session (#628), so managing it from a member's room Session would write to the wrong place. The rule is one function in `connector-access.js`: the same `denied()` that answers the per-Bot switches also names these eight when `rt.groupOwners` — the store's Session → room index — has the Agent's Session, so the mask rides the existing refresh points (Agent created, `resolveAgent` on every delivery, a switch, `tools/change` for a plugin that mounts later) and the guard refuses a call with `… available in your own chat, not in a group room`. The github tools stay (a room judges pull requests), and the Bot's own chat, its earlier parts and its sub-agents are unchanged. Taking the github tools out too is a separate decision, in #1237's 「不做」.
+- **A group room turn carries no composio tools and no schedule tools (#1237).** The eight tools — `mcp__composio__*` and `schedule_create` / `schedule_list` / `schedule_update` / `schedule_delete` — are 20,355 characters of schema (≈5.2k tokens at the measured 3.92 chars/token) on every call, and a room round uses neither: an outside app is reached from the Bot's own chat, and a schedule belongs to a Session (#628), so managing it from a member's room Session would write to the wrong place. The rule is one function in `connector-access.js`: the same `denied()` that answers the per-Bot switches also names these eight when `rt.groupOwners` — the store's Session → room index — has the Agent's Session, so the mask rides the existing refresh points (Agent created, `resolveAgent` on every delivery, a switch, `tools/change` for a plugin that mounts later) and the guard refuses a call with `… not available in a group room` — the room answer comes before the friend's-Bot one, and a friend's Bot has no composio tools in its own chat either, so the refusal does not send it there. The github tools stay (a room judges pull requests), and the Bot's own chat, its earlier parts and its sub-agents are unchanged. Taking the github tools out too is a separate decision, in #1237's 「不做」.d3-1274m/docs/subsystems/core-host.md
 - **Bots prefer the connector for GitHub.** The Bot rules (`prompt.js`) say to use the GitHub connector tools first and `$DSH_SECRET_GITHUB_TOKEN` with `gh` or `git` in the shell only for what they cannot do, such as `git push`.
 - **Defaults and disconnect.** New and duplicated Bots (and tree children) start on. The Connectors row reads "On for all N Bots", "On for K of N Bots" or "Off for every Bot"; **Choose Bots** and each Bot's **Connectors** card show one switch per Bot and connector. **Disconnect** clears every Bot's record for that connector. The switches change only through the `bot-connectors` channel endpoint, which Bots do not call; it is in `SHARED_BLOCKED`, so with more than one member it is refused like the other connector writes.
 - **Whose request a turn answers** (`turn-origin.js`, recorded by `turns.js`, carried by relays, posts and resume records) is still tracked: standing approvals (`approvals.js`) and resumed turns read it. It no longer decides connector tools or secrets.

patches/ds-bot/files/src/host/connector-access.js

@@ -101,7 +101,7 @@ export function install(rt) {
     // a Bot that reads it knows where the tool went, and the refusal is the same for every origin.
     if (roomHidden(who, name)) {
       return id === COMPOSIO
-        ? `The ${COMPOSIO} connector is available in your own chat, not in a group room (#1237).`
+        ? `The ${COMPOSIO} connector is not available in a group room (#1237).`
         : `Schedules are managed in your own chat, not in a group room (#1237).`
     }
     if (id === undefined) return undefined

patches/ds-bot/files/test/connector-access.test.js

@@ -145,7 +145,7 @@ test('default: a connected connector is on for every Bot, old or new, in its cha
   // #1237: it is the one Session that carries neither the composio tools nor the schedule ones.
   assert.deepEqual([...hiddenFrom('room-writer')].sort(), [...COMPOSIO].sort(), 'the mask lands with the Agent, not with the turn')
   const done = await turn('room-writer', { kind: 'bot', form: 'relay', role: 'room', roomId: 'room', exchangeId: 'rr', senderName: 'You', hop: 0, origin: 'owner' })
-  assert.match(guard(COMPOSIO[0], 'room-writer'), /own chat, not in a group room/)
+  assert.match(guard(COMPOSIO[0], 'room-writer'), /not available in a group room/)
   assert.equal(guard(GITHUB[0], 'room-writer'), undefined, 'github stays: a room judges pull requests')
   done()
   assert.equal(guard(COMPOSIO[0], 'plain'), undefined)
@@ -210,9 +210,11 @@ test('#1237: a room turn drops the composio and schedule tools and keeps github
   // notice a renamed or emptied SCHEDULE_TOOLS; these are the DSH names (0.2.0-rc.2).
   for (const name of ['schedule_create', 'schedule_list', 'schedule_update', 'schedule_delete']) assert.ok(allHidden('room-writer').has(name), `${name} is hidden in a room`)
   for (const name of [...GITHUB, ...OWN]) assert.equal(guard(name, 'room-writer'), undefined, `${name}`)
-  for (const name of [...COMPOSIO, ...SCHEDULE]) assert.match(guard(name, 'room-writer'), /own chat, not in a group room/, name)
+  for (const name of [...SCHEDULE]) assert.match(guard(name, 'room-writer'), /own chat, not in a group room/, name)
   assert.equal(guard('schedule_list', 'room-writer'), 'Schedules are managed in your own chat, not in a group room (#1237).')
-  assert.equal(guard(COMPOSIO[0], 'room-writer'), 'The composio connector is available in your own chat, not in a group room (#1237).')
+  // #1271: a friend's Bot that holds a room Session is refused here too, and it has no composio tools in
+  // its own chat either, so the refusal no longer points there.
+  for (const name of [...COMPOSIO]) assert.equal(guard(name, 'room-writer'), 'The composio connector is not available in a group room (#1237).', name)
 })
 
 test('#1237: a Bot\'s own chat keeps composio and the schedule tools', async (t) => {
@@ -277,7 +279,8 @@ test('#601: a group round of any origin keeps the github tools, also with a frie
     begin('room-writer')
     await tick()
     for (const name of GITHUB) assert.equal(guard(name, 'room-writer'), undefined, `${origin}: ${name}`)
-    for (const name of [...COMPOSIO, ...SCHEDULE]) assert.match(guard(name, 'room-writer'), /own chat, not in a group room/, `${origin}: ${name}`)
+    for (const name of [...SCHEDULE]) assert.match(guard(name, 'room-writer'), /own chat, not in a group room/, `${origin}: ${name}`)
+    for (const name of [...COMPOSIO]) assert.match(guard(name, 'room-writer'), /not available in a group room/, `${origin}: ${name}`)
     assert.deepEqual([...allHidden('room-writer')].sort(), [...COMPOSIO, ...SCHEDULE].sort(), `${origin}: the mask is the same in every origin`)
     end('room-writer')
   }