mirror of
https://github.com/rowboatlabs/rowboat.git
synced 2026-07-12 21:02:17 +02:00
ac7679ec16
The permission checker returned {required: false} for every non-builtin
toolId and for any builtin outside the executeCommand/file-tools switch,
so composio-execute-tool (email sends, GitHub/Jira writes), executeMcpTool,
and mcp:* attachments on user agents executed with no permission check —
even in manual mode — and never reached the auto-permission classifier.
The extension contract was inverted: a new side-effecting tool shipped
ungated unless someone remembered to extend a switch in another module.
Every builtin now declares its permission policy in the catalog itself
(required field, compile-enforced): "none", "prompt", "command-allowlist",
"file-boundary", "composio-execute", or "mcp-execute". The checker reads
the declaration and FAILS CLOSED: undeclared builtins, mcp:* attachments,
and unknown toolId families require permission. Composio and MCP requests
carry family-specific payloads (new ToolPermissionMetadata kinds, rendered
by the permission card; generic fallback for everything else). All
previously-ungated builtins keep today's behavior via explicit "none"
declarations, except addMcpServer which now prompts; a catalog test pins
the audited gated set so policy changes stay intentional.
Auto-permission flows (background tasks, live notes, channels) route the
newly gated calls through the existing classifier per the §9.3 matrix;
defer still denies without a human. No grant persistence yet — every
gated call prompts (or classifies) each time.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| agent-schedule-state.ts | ||
| agent-schedule.ts | ||
| agent.ts | ||
| background-task.ts | ||
| bases.ts | ||
| billing.ts | ||
| blocks.ts | ||
| browser-control.ts | ||
| channels.ts | ||
| code-mode.ts | ||
| code-sessions.ts | ||
| composio.ts | ||
| events.ts | ||
| example.ts | ||
| frontmatter.ts | ||
| index.ts | ||
| inline-task.ts | ||
| ipc.ts | ||
| live-note.ts | ||
| llm-step-events.ts | ||
| mcp.ts | ||
| message.ts | ||
| models.ts | ||
| notification-settings.ts | ||
| prefix-logger.ts | ||
| prompt-block.ts | ||
| rowboat-account.ts | ||
| rowboat-app.ts | ||
| runs.ts | ||
| service-events.ts | ||
| sessions.test.ts | ||
| sessions.ts | ||
| turns.test.ts | ||
| turns.ts | ||
| workspace.ts | ||