fix(tools): render_widget follows the assistant's data access; no widget is rendered until a host allows it #112

Open
james.maes wants to merge 1 commits from fix/render-widget-follows-data-access into develop
pull from: fix/render-widget-follows-data-access
1 Commits
Author SHA1 Message Date
james.maesandClaude Fable 5.2 50845aa99b fix(tools): render_widget follows the assistant's data access; no widget is rendered until a host allows it
maven / build (push) Successful in 8m50s
build / maven (push) Successful in 8m56s
A widget is code of the application and can show rows of any table, so
render_widget could hand a model the rows of a table the assistant may not
read. The tool now refuses, before the application is asked, every widget
the host did not allow by name (withAllowedWidgetNames, empty by default),
one it hid, and one that reads a table the assistant may not read
(new: withWidgetTables).

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
2026-11-15 05:30:57 -06:00