deer-flow/frontend/src/components/workspace/workspace-nav-menu.tsx
Ryker_Feng 7aa314b4c1
feat: add Lark CLI integration (#3971)
* feat: add lark cli integration

* fix: polish lark integration actions

* feat: support lark incremental permissions

* fix: detect lark authorization completion

* fix: harden lark integration install

* feat: expand lark auth scopes and reuse host auth in sandbox

Default lark auth to least-privilege (recommend=false, base sign-in only)
and expose the full set of lark-cli --domain business domains as native
--domain grants instead of a 4-domain read-only mapping. Resolve the
skill pack from the latest larksuite/cli GitHub release at install time
with content-hash integrity, and surface version/runtime drift in status.

Share the per-user lark-cli config/data profile between the Gateway
Settings auth flow and agent conversations by mounting the integration
dirs into the AIO sandbox and injecting the matching env for lark-cli
commands, with an allowlisted extra_mounts path in the provisioner/K8s
backend and traversal guards on integration paths.

* style: fix lint issues from ruff and prettier

Sort imports in the provisioner PVC test and re-wrap two long i18n
description strings to satisfy backend ruff and frontend prettier CI.

* fix(lark): address managed integration review feedback

* fix(frontend): stabilize integrations settings e2e

* test(sandbox): isolate remote backend legacy visibility check

* test: fix backend unit failures after merge

* Harden Lark integration review fixes

* Format Lark integration E2E test

* fix(lark): harden sandbox credential exposure and status disclosure

Address willem_bd's security review on PR #3971:

- Mount the per-user lark-cli config dir (long-lived appSecret) read-only
  into the AIO sandbox; only the refreshable-token data dir stays writable.
- Redact host filesystem paths (install_path, cli.path) from
  GET /lark/status and the config/auth complete responses for non-admin
  callers, fail-closed on any auth error.
- Document the npm postinstall trade-off (--ignore-scripts is not viable
  because @larksuite/cli fetches its platform binary in postinstall).
- Document the sandbox credential trust boundary in AGENTS.md and README,
  pointing at the sidecar-broker follow-up (#4338).

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
2026-07-26 08:09:17 +08:00

151 lines
4.5 KiB
TypeScript

"use client";
import {
BugIcon,
ChevronsUpDown,
GlobeIcon,
InfoIcon,
MailIcon,
Settings2Icon,
SettingsIcon,
} from "lucide-react";
import { useEffect, useState } from "react";
import {
DropdownMenu,
DropdownMenuContent,
DropdownMenuGroup,
DropdownMenuItem,
DropdownMenuSeparator,
DropdownMenuTrigger,
} from "@/components/ui/dropdown-menu";
import {
SidebarMenu,
SidebarMenuButton,
SidebarMenuItem,
useSidebar,
} from "@/components/ui/sidebar";
import { useI18n } from "@/core/i18n/hooks";
import { GithubIcon } from "./github-icon";
import { useSettingsDialog } from "./settings";
function NavMenuButtonContent({
isSidebarOpen,
t,
}: {
isSidebarOpen: boolean;
t: ReturnType<typeof useI18n>["t"];
}) {
return isSidebarOpen ? (
<div className="text-muted-foreground flex w-full items-center gap-2 text-left text-sm">
<SettingsIcon className="size-4" />
<span>{t.workspace.settingsAndMore}</span>
<ChevronsUpDown className="text-muted-foreground ml-auto size-4" />
</div>
) : (
<div className="flex size-full items-center justify-center">
<SettingsIcon className="text-muted-foreground size-4" />
</div>
);
}
export function WorkspaceNavMenu() {
const { openSettings } = useSettingsDialog();
const [mounted, setMounted] = useState(false);
const { open: isSidebarOpen } = useSidebar();
const { t } = useI18n();
useEffect(() => {
setMounted(true);
}, []);
return (
<>
<SidebarMenu className="w-full">
<SidebarMenuItem>
{mounted ? (
<DropdownMenu>
<DropdownMenuTrigger asChild>
<SidebarMenuButton
size="lg"
className="data-[state=open]:bg-sidebar-accent data-[state=open]:text-sidebar-accent-foreground"
>
<NavMenuButtonContent isSidebarOpen={isSidebarOpen} t={t} />
</SidebarMenuButton>
</DropdownMenuTrigger>
<DropdownMenuContent
className="w-(--radix-dropdown-menu-trigger-width) min-w-56 rounded-lg"
align="end"
sideOffset={4}
>
<DropdownMenuGroup>
<DropdownMenuItem
onClick={() => {
openSettings("appearance");
}}
>
<Settings2Icon />
{t.common.settings}
</DropdownMenuItem>
<DropdownMenuSeparator />
<a
href="https://deerflow.tech/"
target="_blank"
rel="noopener noreferrer"
>
<DropdownMenuItem>
<GlobeIcon />
{t.workspace.officialWebsite}
</DropdownMenuItem>
</a>
<a
href="https://github.com/bytedance/deer-flow"
target="_blank"
rel="noopener noreferrer"
>
<DropdownMenuItem>
<GithubIcon />
{t.workspace.visitGithub}
</DropdownMenuItem>
</a>
<DropdownMenuSeparator />
<a
href="https://github.com/bytedance/deer-flow/issues"
target="_blank"
rel="noopener noreferrer"
>
<DropdownMenuItem>
<BugIcon />
{t.workspace.reportIssue}
</DropdownMenuItem>
</a>
<a href="mailto:support@deerflow.tech">
<DropdownMenuItem>
<MailIcon />
{t.workspace.contactUs}
</DropdownMenuItem>
</a>
</DropdownMenuGroup>
<DropdownMenuSeparator />
<DropdownMenuItem
onClick={() => {
openSettings("about");
}}
>
<InfoIcon />
{t.workspace.about}
</DropdownMenuItem>
</DropdownMenuContent>
</DropdownMenu>
) : (
<SidebarMenuButton size="lg" className="pointer-events-none">
<NavMenuButtonContent isSidebarOpen={isSidebarOpen} t={t} />
</SidebarMenuButton>
)}
</SidebarMenuItem>
</SidebarMenu>
</>
);
}