From b9cb2494bfcfc29a814f4d1cc268c303e70c025e Mon Sep 17 00:00:00 2001 From: Guilhem Lemouel Date: Tue, 13 Oct 2026 06:06:42 -0700 Subject: [PATCH] fix: keep rebase_draft from operators who can only draft schedules and triggers Co-Authored-By: Claude Opus 5.5 (1M context) --- frontend/src/lib/components/copilot/chat/global/core.ts | 6 ++++-- .../components/copilot/chat/global/sessionToolset.test.ts | 3 ++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts index 8a8e8c3f9d..a8816a6271 100644 --- a/frontend/src/lib/components/copilot/chat/global/core.ts +++ b/frontend/src/lib/components/copilot/chat/global/core.ts @@ -4279,8 +4279,10 @@ export const globalTools: SessionTool<{}>[] = [ app: WRITE_DRAFT, resource: WRITE_DRAFT, variable: WRITE_DRAFT, - schedule: WRITE_SCHEDULE_DRAFT, - trigger: WRITE_TRIGGER_DRAFT + // Not the schedule/trigger draft rights: `rebaseDraft` has no handler for these kinds, + // so an operator holding only those rights would be offered a tool that always throws. + schedule: WRITE_DRAFT, + trigger: WRITE_DRAFT } satisfies Record<(typeof ITEM_TYPES)[number], SessionToolPolicy>, def: createToolDef( rebaseDraftSchema, diff --git a/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts b/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts index ee403d88dc..cd9ea68328 100644 --- a/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts +++ b/frontend/src/lib/components/copilot/chat/global/sessionToolset.test.ts @@ -76,10 +76,11 @@ const REACHABLE_PROFILES = [ [false, true].flatMap((operator) => // `checkDeployRules` bypasses on admin, so an admin has only the one outcome. (isAdmin ? [true] : [false, true]).flatMap((deployRulesPass) => - // The operator rights a workspace can set: none, the builder right, one lock, both. + // The operator rights a workspace can set: none, the builder right, either lock, both. [ undefined, { builder_flows: true }, + { manage_schedules: false }, { manage_triggers: false }, { manage_schedules: false, manage_triggers: false } ].map((operatorSettings) => {