datasette-apps 0.3a0

What it claims

datasette-apps 0.3a0, released 4 November 2026, extends how Datasette Agent builds and manages custom HTML apps hosted inside Datasette. The release centres on a permission model for which stored queries an app may call. Read and write queries are treated differently, and the user is the gate for any write access.

How it works

The agent controls an app's query access through three tools, and each one checks permissions:

• app_create() now verifies that every requested stored query exists and that the current user can view it. It then asks the user to approve any write queries before the app is created.
• app_add_stored_queries() adds queries to an existing app. Granting a write query through this tool also requires user approval first. The summary mentions approval only for app_create().
• app_remove_stored_queries() revokes an app's access to queries.

flowchart TD
    A[Agent requests query for app] --> B{Query exists and user can view it?}
    B -- no --> X[Rejected]
    B -- yes --> C{Write query?}
    C -- no --> D[Granted]
    C -- yes --> E{User approves?}
    E -- yes --> D
    E -- no --> X

Typing # in a Datasette Agent chat message autocompletes app names. It offers only the apps the user has permission to view. The "View app" buttons from the agent tools, and the links on # app references, now open the app full screen inside the Datasette Agent panel.

Limits

The version is an alpha (0.3a0). The page is a short release note. It gives no install command, licence, compatibility requirements or description of the approval interface. It does not say whether the checks re-run when stored queries or user permissions change after an app has been granted access.