Comate v0.0.31

Comate v0.0.31

A major release: a browser API-discovery workbench, big expansions to Skills (provider filters/health, WeSkillHub, Enterprise Zone, Expert Packages), and a wide-ranging hardening of the WeCom bot sandbox — MCP tool classification, loopback API authentication, decision audit trail, an escalation approval ledger, and remote owner/admin approval cards for regular members.

🆕 Added

• Browser API discovery workbench — Agents can inspect one selected DOM element, bracket one browser action with bounded network capture, and receive ranked credential-redacted API candidates in chat. A task-scoped authenticated-request MCP and new comate api request CLI replay selected APIs through Comate-held cookies or bearer credentials without exposing them; GET/HEAD calls remain fluid, mutations show an exact sanitized approval card, and explicit Remember-site consent can preserve the selected authentication for browser-closed reuse.

• Skill search provider filters, health, and views — Skill Search now lets users include or exclude any connected provider, remembers that choice globally, and identifies unavailable providers with safe failure reasons and per-provider Retry. Searches skip unavailable sources while preserving healthy results, clearly warn when result coverage is incomplete, and support persistent card and list result layouts.

• WeSkillHub federated Skills provider — WeSkillHub is now the fifth federated provider, with discovery using the generic project/global Skill installation and update lifecycle.

• Enterprise Zone in Skills — Skills now includes a top-level Enterprise Zone for searchable, industry-filtered enterprise discovery, per-enterprise Skill search and sorting, Skill details, and individual project/global installation through the standard Skill flow.

• Expert Packages in Skills — Skills now includes a top-level Expert Packages area with searchable and scene-filtered package discovery, package and included-Skill detail pages, and in-app project/global installation. Complete package installs preserve partial successes and support failed-item retry, while package orchestration remains runtime-compatible but is labeled separately from standard Skills.

• MCP tool classification and admin boundary (bot sandbox model, U9) — MCP tools in bot sessions are no longer silently allow-all: every mcp__* call is now classified at the permission gate as read / write / unknown. Server-provided annotations (readOnlyHint / destructiveHint) are honored first, a per-server override in the bot policy (mcpClassification, keyed by server name) wins over the annotation, and an unclassifiable tool always asks — it can never fall through to allow. Write-class and unknown-class calls enter the escalation flow as mcp-write requests: regular members route to the channel's owner/admin approval cards (with the same dedupe, caps, TTL, and no-approver deny-with-explanation as bash escapes), owner/admin requesters self-ask, and Feishu channels keep the previous deny until their card flow is aligned. Read-class tools continue through the existing category policy without a card. The bundled scheduled-tasks MCP server now advertises annotations (list_scheduled_tasks is read-only; task creation is write-class), and the admin role's target boundary is enforced at the gate itself: an admin can write the workspace and the closed capability set (.claude/skills, .claude/agents) but is now denied writes into .claude/plugins, hooks, settings files, and anything outside the workspace — previously only bash was constrained (by the sandbox), while the Edit/Write tools ran wide open inside .claude for admins. The owner's reach is unchanged.

• Loopback API authentication (bot sandbox hardening, U12) — the entire /api surface is now default-deny authenticated at the route-registration layer: every present and future route requires a Bearer credential, with exemptions declared explicitly. Bot sessions receive a per-session capability token (24h TTL, rotated on runtime rebuild, revoked on session close/demotion/boot, stored as SHA-256 hashes) that reaches only the closed set of wecom CLI routes, with identity and admin rights derived from the token-bound session — a self-asserted sessionId is no longer trusted. The desktop client authenticates with a per-boot GUI credential delivered via the sidecar ready message (Tauri) or a 0600 credential file (dev proxy). The wecom CLI context moved from the workspace-root .claude/wecom-context.json (discovered by walking up directories) to a per-session data/<user>/.runtime/wecom-context.json passed explicitly via COMATE_WECOM_CONTEXT_FILE, so a context planted in a user-writable directory can no longer redirect the CLI; the CLI also routes its loopback calls through the sandbox HTTP proxy when one is present (required for egress from sandboxed sessions).

• Bot decision audit trail (bot sandbox hardening, U6) — the bot audit log now records the sandbox permission model's decision points: bash denials (with the structural reason and routing class), out-of-sandbox requests and their resolutions (approved/denied/expired, with the approver as actor and the requester recorded alongside), passlist rule additions (with manual/approval provenance), admin writes into the workspace capability dirs (.claude/skills, .claude/agents), capability-token mint/revoke, and loopback authentication rejections. Long commands, rules, and domains are stored in full with a SHA-256 integrity hash instead of being redacted, while secret-shaped values (API keys, bearer tokens, the 48-hex capability tokens) are masked at any length; audit rows are retained for 90 days and then purged, and the audit surface stays unreachable for bot session tokens — only the desktop credential can read it.

• Bot escalation approval ledger (bot sandbox hardening, U8) — out-of-sandbox approval requests from owner/admin bot sessions are now recorded in a persistent escalation ledger (requester, recipients, rule payload, state, expiry) instead of living only in memory. Approvals are bounded by a 30-minute TTL when the tool call carries no timeout of its own: an unanswered request now settles as a fail-closed denial with an expired audit row and a timeout notice to the requester (previously it could wait indefinitely). A server restart no longer strands approvals either — every still-pending request is expired at boot (never auto-approved), audited, and the requester is notified once the bot's WeCom connection is back. Each pending also carries an audience marker (self for owner/admin requesters, admins otherwise — fail-safe) that the upcoming remote-approval cards will route on. Desktop approvals now resolve through the same provenance writer as card approvals with identical audit shape, the desktop approvals endpoint never spawns a session runtime just to answer an approval (404 when none is live), and the desktop session list shows its existing pending indicator on bot sessions awaiting approval.

• Remote owner/admin approval cards for regular members (bot sandbox model, U11) — a regular channel member's out-of-sandbox bash request no longer hits a blanket denial: it now creates an escalation that delivers an actionable approval card to the channel's owner/admin. Owner and Admin requests retain their default role bypass and run without approval. The regular-member requester receives a read-only notice card instead of a self-approvable one — self-approval was never supervision. Card clicks are authorized against a fresh role check on the ledger row's bot (a demoted admin loses approval power immediately and members of other bots are rejected), and settlement is transactional first-click-wins, so double-clicks and late/replayed clicks are harmless no-ops; the clicker's card flips terminal while everyone else — the requester on any outcome and the non-clicking approvers — receives a terminal notification card on approve, deny, or TTL expiry. "始终允许" (always allow) now persists an exact-match structural rule (the literal command, never a wildcard) into the bot's out-of-sandbox passlist with the approver's identity and approval provenance in the audit trail, so the same command in a future session runs without asking while a same-tool/different-arguments variant still cannot match; SDK suggestions that would widen scope (mode changes, added directories, rule replacement) are dropped and suppress the button entirely. Escalation volume is bounded: parameter-variant retries collapse into a single pending card, per-user hourly and per-bot outstanding caps fail closed with a notice, and a turn that keeps retrying after repeated denials gets an explicit stop instruction. Regular members' allowUnsandboxedCommands is now enabled — the escape hatch finally has a supervised path. Feishu channels keep the previous behavior until their card flow is aligned.

🔁 Changed

• Incomplete Expert Package installation — package validation is now advisory. The app installs the raw package orchestration and every resolvable included Skill, reports unavailable children as per-item failures, and lets users correct the installed files afterward.

🐛 Fixed

• Packaged Comate CLI startup — the bundled comate executable now contains exactly one shebang, so the packaged CLI starts correctly instead of failing on a duplicated interpreter line.

📥 Downloads

Platform	Asset
macOS (Apple Silicon)	Comate_0.0.31_aarch64.dmg
macOS (Intel)	Comate_0.0.31_x64.dmg
Windows (x64)	Comate_0.0.31_x64_en-US.msi

Full Changelog: v0.0.30...v0.0.31

---

Comate v0.0.31(中文)

一次大版本更新:浏览器 API 发现工作台、Skills 的大幅扩展(Provider 筛选/健康、WeSkillHub、企业专区、专家包),以及对企业微信机器人沙箱的全面加固——MCP 工具分类、回环 API 鉴权、决策审计追踪、升级审批账本,以及面向普通成员的远程所有者/管理员审批卡片。

🆕 新增

• 浏览器 API 发现工作台 —— Agent 可以检视单个选中的 DOM 元素,用受限的网络捕获包裹一次浏览器操作,并在对话中收到按相关度排序、已脱敏凭据的 API 候选。任务级鉴权请求 MCP 与新的 comate api request CLI 可通过 Comate 持有的 cookie 或 bearer 凭据回放选中的 API,而不暴露这些凭据;GET/HEAD 调用保持流畅,变更类调用会显示精确的脱敏审批卡片,显式的"记住此站点"同意可在浏览器关闭后保留所选鉴权以复用。

• Skill 搜索的 Provider 筛选、健康与视图 —— Skill 搜索现在允许纳入或排除任意已连接的 Provider,全局记忆该选择,并以安全的失败原因和按 Provider 的"重试"标识不可用的 Provider。搜索会跳过不可用的来源、保留健康来源的结果,在结果覆盖不完整时明确警告,并支持常驻卡片和列表两种结果布局。

• WeSkillHub 联邦 Skills Provider —— WeSkillHub 现在是第五个联邦 Provider,其发现沿用通用的项目/全局 Skill 安装与更新生命周期。

• Skills 中的企业专区 —— Skills 现在包含顶层的企业专区,支持可搜索、按行业筛选的企业发现,按企业的 Skill 搜索与排序,Skill 详情,以及通过标准 Skill 流程进行单独的项目/全局安装。

• Skills 中的专家包 —— Skills 现在包含顶层的专家包区域,支持可搜索、按场景筛选的包发现,包及其所含 Skill 的详情页,以及应用内的项目/全局安装。完整包安装会保留部分成功项并支持失败项重试,而包编排保持运行时兼容,但与标准 Skills 分开标注。

• MCP 工具分类与管理员边界(机器人沙箱模型,U9) —— 机器人会话中的 MCP 工具不再是静默的全部允许:每个 mcp__* 调用现在都会在权限网关被分类为 只读 / 写 / 未知。优先采纳服务端提供的注解(readOnlyHint / destructiveHint),机器人策略中按服务名的逐服务器覆盖(mcpClassification)优先于注解,而无法分类的工具一律询问——绝不会落入允许。写类与未知类调用以 mcp-write 请求进入升级流程:普通成员路由到频道的所有者/管理员审批卡片(与 bash 逃逸相同的去重、上限、TTL 和无审批人则带说明拒绝),所有者/管理员请求者自审,飞书频道在卡片流程对齐前保持拒绝。只读类工具继续走既有类别策略,不出现卡片。内置的定时任务 MCP 服务端现在声明了注解(list_scheduled_tasks 为只读,任务创建为写类),管理员角色的目标边界在网关处强制执行:管理员可写工作区及封闭能力集(.claude/skills、.claude/agents),但被禁止写入 .claude/plugins、hooks、settings 文件以及工作区之外的任何内容——此前只有 bash 受约束(由沙箱),而管理员的 Edit/Write 工具在 .claude 内曾可随意写入。所有者的范围不变。

• 回环 API 鉴权(机器人沙箱加固,U12) —— 整个 /api 接口现在在路由注册层默认拒绝并要求鉴权:当前与未来的每个路由都需要 Bearer 凭据,豁免需显式声明。机器人会话获得一个按会话的能力令牌(24 小时 TTL,运行时重建时轮换,会话关闭/降级/启动时撤销,以 SHA-256 哈希存储),仅能访问封闭的 wecom CLI 路由集合,身份与管理员权限由令牌绑定的会话推导——不再信任自行断言的 sessionId。桌面客户端使用按启动的 GUI 凭据鉴权,通过 sidecar ready 消息(Tauri)或 0600 凭据文件(开发代理)下发。wecom CLI 上下文从工作区根目录的 .claude/wecom-context.json(靠向上遍历目录发现)迁移到按会话的 data/<user>/.runtime/wecom-context.json,并通过 COMATE_WECOM_CONTEXT_FILE 显式传入,因此植入在用户可写目录中的上下文无法再重定向 CLI;当存在沙箱 HTTP 代理时,CLI 也通过它进行回环调用(沙箱会话出站所必需)。

• 机器人决策审计追踪(机器人沙箱加固,U6) —— 机器人审计日志现在记录沙箱权限模型的决策点:bash 拒绝(含结构性原因与路由类别)、沙箱逃逸请求及其处理结果(批准/拒绝/过期,以审批人为执行者并一并记录请求者)、passlist 规则新增(含手动/审批来源)、管理员对工作区能力目录(.claude/skills、.claude/agents)的写入、能力令牌的签发/撤销,以及回环鉴权拒绝。长命令、规则和域名连同 SHA-256 完整性哈希完整存储而非脱敏,而密钥形态的值(API key、bearer token、48 位十六进制能力令牌)任意长度都会被掩码;审计行保留 90 天后清除,且审计接口对机器人会话令牌不可达——只有桌面凭据可读。

• 机器人升级审批账本(机器人沙箱加固,U8) —— 来自所有者/管理员机器人会话的沙箱逃逸审批请求现在记录在持久化的升级账本中(请求者、接收者、规则载荷、状态、过期),而不再仅存于内存。当工具调用本身未携带超时时,审批受 30 分钟 TTL 约束:未应答的请求现在以失败即关闭的拒绝方式了结,并写入 expired 审计行和给请求者的超时通知(此前可能无限等待)。服务器重启也不再遗留审批——每个仍待处理的请求在启动时即过期(绝不自动批准)、记入审计,并在机器人企业微信连接恢复后通知请求者。每个待处理项还携带受众标记(所有者/管理员请求者为 self,否则为 admins——失败即安全),供即将到来的远程审批卡片据此路由。桌面审批现在通过与卡片审批相同的来源写入器处理,审计形态一致,桌面审批端点不会仅为回答审批而启动会话运行时(无活跃会话时返回 404),桌面会话列表也会在等待审批的机器人会话上显示既有的待处理指示。

• 面向普通成员的远程所有者/管理员审批卡片(机器人沙箱模型,U11) —— 普通频道成员的沙箱逃逸 bash 请求不再遭遇一刀切拒绝:它现在会创建一次升级,向频道的所有者/管理员投递可操作的审批卡片。所有者与管理员请求保留默认角色绕过,无需审批即可运行。普通成员请求者收到只读通知卡片,而非可自审的卡片——自审从来不是监督。卡片点击会针对账本行所属机器人做一次新的角色检查以授权(被降级的管理员立即丧失审批权,其他机器人的成员会被拒绝),且结算为事务性的"首次点击生效",因此双击与迟到/重放的点击都是无害的空操作;点击者的卡片翻转为终态,而其他人——任何结果下的请求者以及未点击的审批人——都会在批准、拒绝或 TTL 过期时收到终态通知卡片。"始终允许"现在会把一条精确匹配的结构化规则(字面命令,绝不通配)以审批人身份和 approval 来源持久化到机器人的沙箱逃逸 passlist 并记入审计,因此同一命令在未来会话中无需询问即可运行,而同工具不同参数的变体仍无法匹配;会扩大范围的 SDK 建议(模式变更、新增目录、规则替换)会被丢弃并完全抑制该按钮。升级量受到约束:参数变体重试会合并为单个待处理卡片,按用户每小时与按机器人在途上限失败即关闭并给出提示,而在反复拒绝后仍不断重试的回合会收到明确的停止指令。普通成员的 allowUnsandboxedCommands 现已启用——这个逃生口终于有了受监督的路径。飞书频道在卡片流程对齐前保持既有行为。

🔁 变更

• 不完整的专家包安装 —— 包校验现在改为建议性。应用会安装原始的包编排和每个可解析的所含 Skill,将不可用的子项作为逐项失败上报,并允许用户随后修正已安装的文件。

🐛 修复

• 打包的 Comate CLI 启动 —— 打包的 comate 可执行文件现在只包含一个 shebang,因此打包后的 CLI 能正确启动,而不会因重复的解释器行失败。

📥 下载

平台	文件
macOS(Apple Silicon)	Comate_0.0.31_aarch64.dmg
macOS(Intel)	Comate_0.0.31_x64.dmg
Windows(x64)	Comate_0.0.31_x64_en-US.msi

完整变更日志:v0.0.30...v0.0.31