`PUT /api/workflows/{id}` defaults `exact_tools` to true and discards the per-step detail it already computed

[scottcain]

Posted by an AI assistant on scottcain's behalf.

Summary

Two related problems on the workflow-update path.

1. A second escape hatch under a different name. PUT /api/workflows/{id} resolves each step's
tool via toolbox.get_tool(tool_id, tool_version=…, exact=exact_tools, tool_uuid=…), where
exact_tools — a real field on WorkflowUpdateOptions — defaults to True unless the request body
sets it. This is the same false-positive tool-resolution behavior already known at invocation time
(workaroundable there with require_exact_tool_versions: false), recurring at save time under a
different, undocumented field name, with no hint that a save-time escape hatch exists at all.

2. The specific error is computed and then thrown away. When get_tool(…, exact=True) fails,
update_workflow_from_raw_description builds a real per-step message —
f"Step {n+1}: Requires tool '{tool_id}'." — into missing_tool_tups and raises
MissingToolsException. The API handler unconditionally rewrites this to a generic
{"err_msg": "This workflow contains missing tools. It cannot be saved until they have been removed from the workflow or installed.", "err_code": 0}, discarding the already-computed per-step list
before it reaches the client.

Evidence

PUT /api/workflows/{id} with a corrected native workflow JSON (bare {"workflow": {…}} body)
returned the generic message for 4 tools — collapse_dataset 5.1.0, lexicmap_search 0.9.0+galaxy1,
kmindex_query 0.6.1+galaxy4, collection_column_join 0.0.3 — each independently re-confirmed
installed via /api/tools/{id}/build moments before and after.

Re-submitting the identical workflow content with two added top-level sibling keys,
{"exact_tools": false, "allow_missing_tools": true}, succeeded immediately with no other change.

Expected

1. The error response should surface the specific per-step missing-tool list it already computed
   (missing_tool_tups) instead of discarding it for a generic message with err_code: 0. That alone
   would have saved a full diagnostic round trip.
2. Document exact_tools / allow_missing_tools — WorkflowUpdateOptions' real fields — as the
   save-time equivalent of invocation-time's require_exact_tool_versions /
   allow_tool_state_corrections, ideally in the same place. A caller who learned one has no way to
   guess the other exists under a different name on a different endpoint.