github-featured / composiohq--composio

发布

0 发布 1,233 Git 标签

RSS 订阅源
  • @composio/cli@0.2.30-beta.247 d6bf4370d7
    比较

    feat(cli): add enhanced permission cache gating (#3419)

    frostbyte_neo 发布于 2026-05-13 08:37:20 +00:00

    Summary

    • Add a CLI consumer permission cache backed by
      ~/.composio/tool-permissions-cache.json with a 5 minute TTL.
    • Read enhanced-controls state from /api/v3.1/org/consumer/config and
      resolve stored connected-account permissions from
      /api/v3.1/consumer/permissions/resolve.
    • Thread consumer cache scope through Tool Router session creation so
      CLI link sessions use the enhanced public link URL when enhanced
      controls are enabled.
    • Add execute/run-compatible gating: CLI execute checks cached
      permission config before the Tool Router execute call and opens the
      bundled macOS native UI sidecar for ask modes.
    • Use the sidecar --callback-file JSON decision channel, pass the
      selected connection word_id to the UI account line, and treat no
      response within 30 seconds as denial.
    • Fall back to browser approval when the native sidecar is
      unavailable/non-macOS.

    Stack

    • Base PR: #3418 (pi/swift-sidecar-ui-dfceb48e) — native UI sidecar.
    • This PR: CLI permissions cache and native sidecar gating integration.

    Tests

    • pnpm --filter @composio/cli typecheck
    • pnpm exec eslint ts/packages/cli/src/effects/create-tool-router-session.ts ts/packages/cli/src/services/tools-executor.ts ts/packages/cli/src/services/native-ui-sidecar.ts ts/packages/cli/src/services/tool-permissions.ts
    • pnpm --filter @composio/cli build
    • pnpm --filter @composio/cli-local-tools build:composio-native-ui -- --target darwin-arm64
    • Earlier on this branch: pnpm install --frozen-lockfile, pnpm build:packages

    Notes / Risks

    • Native approval UI is macOS-only. Non-macOS or missing sidecar
      binaries fall back to the temporary browser approval page.
    • The CLI gates locally and does not pass experimental.permissions
      into Tool Router sessions yet, because direct CLI execute does not
      provide MCP elicitation transport. It does pass
      experimental.link_url_overwrite for enhanced link flows.
    • On a cold cache, the first consumer Tool Router session creation
      refreshes permission state synchronously; fresh cache entries are
      returned immediately while a background refresh updates disk for future
      calls.
    下载附件