mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-08-13 16:28:38 +00:00
* feat: add lark cli integration * fix: polish lark integration actions * feat: support lark incremental permissions * fix: detect lark authorization completion * fix: harden lark integration install * feat: expand lark auth scopes and reuse host auth in sandbox Default lark auth to least-privilege (recommend=false, base sign-in only) and expose the full set of lark-cli --domain business domains as native --domain grants instead of a 4-domain read-only mapping. Resolve the skill pack from the latest larksuite/cli GitHub release at install time with content-hash integrity, and surface version/runtime drift in status. Share the per-user lark-cli config/data profile between the Gateway Settings auth flow and agent conversations by mounting the integration dirs into the AIO sandbox and injecting the matching env for lark-cli commands, with an allowlisted extra_mounts path in the provisioner/K8s backend and traversal guards on integration paths. * style: fix lint issues from ruff and prettier Sort imports in the provisioner PVC test and re-wrap two long i18n description strings to satisfy backend ruff and frontend prettier CI. * fix(lark): address managed integration review feedback * fix(frontend): stabilize integrations settings e2e * test(sandbox): isolate remote backend legacy visibility check * test: fix backend unit failures after merge * Harden Lark integration review fixes * Format Lark integration E2E test * fix(lark): harden sandbox credential exposure and status disclosure Address willem_bd's security review on PR #3971: - Mount the per-user lark-cli config dir (long-lived appSecret) read-only into the AIO sandbox; only the refreshable-token data dir stays writable. - Redact host filesystem paths (install_path, cli.path) from GET /lark/status and the config/auth complete responses for non-admin callers, fail-closed on any auth error. - Document the npm postinstall trade-off (--ignore-scripts is not viable because @larksuite/cli fetches its platform binary in postinstall). - Document the sandbox credential trust boundary in AGENTS.md and README, pointing at the sidecar-broker follow-up (#4338). --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
151 lines
4.5 KiB
TypeScript
151 lines
4.5 KiB
TypeScript
"use client";
|
|
|
|
import {
|
|
BugIcon,
|
|
ChevronsUpDown,
|
|
GlobeIcon,
|
|
InfoIcon,
|
|
MailIcon,
|
|
Settings2Icon,
|
|
SettingsIcon,
|
|
} from "lucide-react";
|
|
import { useEffect, useState } from "react";
|
|
|
|
import {
|
|
DropdownMenu,
|
|
DropdownMenuContent,
|
|
DropdownMenuGroup,
|
|
DropdownMenuItem,
|
|
DropdownMenuSeparator,
|
|
DropdownMenuTrigger,
|
|
} from "@/components/ui/dropdown-menu";
|
|
import {
|
|
SidebarMenu,
|
|
SidebarMenuButton,
|
|
SidebarMenuItem,
|
|
useSidebar,
|
|
} from "@/components/ui/sidebar";
|
|
import { useI18n } from "@/core/i18n/hooks";
|
|
|
|
import { GithubIcon } from "./github-icon";
|
|
import { useSettingsDialog } from "./settings";
|
|
|
|
function NavMenuButtonContent({
|
|
isSidebarOpen,
|
|
t,
|
|
}: {
|
|
isSidebarOpen: boolean;
|
|
t: ReturnType<typeof useI18n>["t"];
|
|
}) {
|
|
return isSidebarOpen ? (
|
|
<div className="text-muted-foreground flex w-full items-center gap-2 text-left text-sm">
|
|
<SettingsIcon className="size-4" />
|
|
<span>{t.workspace.settingsAndMore}</span>
|
|
<ChevronsUpDown className="text-muted-foreground ml-auto size-4" />
|
|
</div>
|
|
) : (
|
|
<div className="flex size-full items-center justify-center">
|
|
<SettingsIcon className="text-muted-foreground size-4" />
|
|
</div>
|
|
);
|
|
}
|
|
|
|
export function WorkspaceNavMenu() {
|
|
const { openSettings } = useSettingsDialog();
|
|
const [mounted, setMounted] = useState(false);
|
|
const { open: isSidebarOpen } = useSidebar();
|
|
const { t } = useI18n();
|
|
|
|
useEffect(() => {
|
|
setMounted(true);
|
|
}, []);
|
|
|
|
return (
|
|
<>
|
|
<SidebarMenu className="w-full">
|
|
<SidebarMenuItem>
|
|
{mounted ? (
|
|
<DropdownMenu>
|
|
<DropdownMenuTrigger asChild>
|
|
<SidebarMenuButton
|
|
size="lg"
|
|
className="data-[state=open]:bg-sidebar-accent data-[state=open]:text-sidebar-accent-foreground"
|
|
>
|
|
<NavMenuButtonContent isSidebarOpen={isSidebarOpen} t={t} />
|
|
</SidebarMenuButton>
|
|
</DropdownMenuTrigger>
|
|
<DropdownMenuContent
|
|
className="w-(--radix-dropdown-menu-trigger-width) min-w-56 rounded-lg"
|
|
align="end"
|
|
sideOffset={4}
|
|
>
|
|
<DropdownMenuGroup>
|
|
<DropdownMenuItem
|
|
onClick={() => {
|
|
openSettings("appearance");
|
|
}}
|
|
>
|
|
<Settings2Icon />
|
|
{t.common.settings}
|
|
</DropdownMenuItem>
|
|
<DropdownMenuSeparator />
|
|
<a
|
|
href="https://deerflow.tech/"
|
|
target="_blank"
|
|
rel="noopener noreferrer"
|
|
>
|
|
<DropdownMenuItem>
|
|
<GlobeIcon />
|
|
{t.workspace.officialWebsite}
|
|
</DropdownMenuItem>
|
|
</a>
|
|
<a
|
|
href="https://github.com/bytedance/deer-flow"
|
|
target="_blank"
|
|
rel="noopener noreferrer"
|
|
>
|
|
<DropdownMenuItem>
|
|
<GithubIcon />
|
|
{t.workspace.visitGithub}
|
|
</DropdownMenuItem>
|
|
</a>
|
|
<DropdownMenuSeparator />
|
|
<a
|
|
href="https://github.com/bytedance/deer-flow/issues"
|
|
target="_blank"
|
|
rel="noopener noreferrer"
|
|
>
|
|
<DropdownMenuItem>
|
|
<BugIcon />
|
|
{t.workspace.reportIssue}
|
|
</DropdownMenuItem>
|
|
</a>
|
|
<a href="mailto:support@deerflow.tech">
|
|
<DropdownMenuItem>
|
|
<MailIcon />
|
|
{t.workspace.contactUs}
|
|
</DropdownMenuItem>
|
|
</a>
|
|
</DropdownMenuGroup>
|
|
<DropdownMenuSeparator />
|
|
<DropdownMenuItem
|
|
onClick={() => {
|
|
openSettings("about");
|
|
}}
|
|
>
|
|
<InfoIcon />
|
|
{t.workspace.about}
|
|
</DropdownMenuItem>
|
|
</DropdownMenuContent>
|
|
</DropdownMenu>
|
|
) : (
|
|
<SidebarMenuButton size="lg" className="pointer-events-none">
|
|
<NavMenuButtonContent isSidebarOpen={isSidebarOpen} t={t} />
|
|
</SidebarMenuButton>
|
|
)}
|
|
</SidebarMenuItem>
|
|
</SidebarMenu>
|
|
</>
|
|
);
|
|
}
|