Classic298 076a84e3f0 fix: enforce automation limits in the builtin automation tools (#27523) ...

The `create_automation` and `update_automation` builtin tools wrote straight to `Automations.insert` / `Automations.update_by_id`, skipping the limit checks that `/api/v1/automations/create` and `/api/v1/automations/{id}/update` run through `check_automation_limits`. A non-admin user could therefore ask the model to create automations indefinitely, ignoring `AUTOMATION_MAX_COUNT`, and could schedule them below `AUTOMATION_MIN_INTERVAL`, on both create and update.

Both tools now call the same `check_automation_limits` helper the routers use, so the limits and the admin bypass cannot drift between the chat path and the HTTP path. A rejection is returned to the model as a plain error message instead of raising. `update_automation` also gained the missing user lookup guard, since the helper needs the user's role.

The `automations.enable` toggle and the `features.automations` user permission were already enforced when the tool set is assembled, so they are unaffected.

Fixes #27121

2026-07-26 17:55:56 -04:00

..

__init__.py

feat: native function calling for built-in tools

2026-01-05 04:45:17 +04:00

builtin.py

fix: enforce automation limits in the builtin automation tools (#27523)

2026-07-26 17:55:56 -04:00

knowledge_fs.py

fix: detect bare pipe alternation as regex in grep_knowledge_files (#26795)

2026-07-23 23:33:35 -04:00