Owner's connector keys and secrets default to 'No Bot'; make them available to all of the owner's Bots (#359) #545

Owner decision 2026-10-20 20:21 (Asia/Shanghai): the owner's connectors and secrets are on by default for all of the owner's own Bots, per #359 / AGENTS.md hard rule 4 (connector tools on by default for the owner's Bots, off by default for other people's Bots). Filed on the owner's order; agent-ready because the owner ordered it.

Environment

FlyBot main @ b6e89d2, group chat with Chief (Main), Maintainer, SelfTest, Release; GitHub connected (identity Birfy) and Composio connected.

Steps to reproduce

1. Settings → Connectors → connect GitHub with a token (or Composio with a key).
2. Open Settings → Secrets.

Actual

• GITHUB_TOKEN (and COMPOSIO_API_KEY) is listed as No Bot. list_secrets tells every Bot "for no Bot — you may not use it". Chief reported (translated): "the GITHUB_TOKEN in the secrets area is marked for no Bot, so neither I nor these Bots can use it", and asked the owner to tick Release and Maintainer by hand or hand over a new PAT in DM.
• Release's self-check reported seeing the Composio Gmail connection but no GitHub MCP.

Expected

• A key the owner saves (on the Secrets page, from a card, or through a connector) is for all of the owner's Bots unless the owner narrows it; new and existing Bots, Bots in group chats included. Friends' Bots never get it.
• Keys that are "No Bot" only because of the old connector default move to "All my Bots" once; a scope the owner chose stays.
• The Secrets page shows and changes the scope with an explicit control: All my Bots / Chosen Bots / No Bot.

Where it sits

• core/src/host/connectors.js connector-connect: a first connect saved the secret with scope: [] ("A new secret is shared with no Bot's shell").
• core/src/host/secrets.js: an empty scope list cannot be told apart from an owner's choice; scopeText → "no Bot".
• core/src/client/secret-card.js ScopeEditor: only "All Bots" / "Chosen Bots"; "none" is an empty pick list.
• Connector tools (mcp__github__*, mcp__composio__*) are already on by default for the owner's own turns (connector-access.js, Connector tools: on by default for the owner's own use of every Bot, also on shared Bots; other people's use is a separate opt-in #369/Connector tools on by default for your own Bots; sharing a Bot doesn't take them away; others need your opt-in #370); both connectors go through the same gate, so Release's missing GitHub MCP is not explained by a per-Bot default in code. To check on the running instance: GitHub connector state (Settings → Connectors: ready / error), and Release's own connector switch (Bot settings → Connectors).

Change scope

secrets.js (default + one-time migration + scopeSet marker), connectors.js (no scope: [] on connect), secret-card.js + i18n.js (three-way scope control), tests, docs.