tauri-apps/tauri · error

missing command scope for key

Error message

missing command scope for key {key}

What it means

get_command_scope_typed resolves a command's allow/deny scope from a per-command cache keyed by command name. If the key is absent from `self.command_scope`, the library panics because typed scope lookups assume the command was registered with a resolved scope during capability parsing; a missing entry is an internal invariant violation.

Solutions

1. Verify the command key matches exactly (case and path) the command declared in your capabilities file and regenerated ACLs.
2. Regenerate the ACL/permissions so the command scope is embedded (rebuild after adding the command to capabilities).
3. Use the non-panicking cache path: check `cache.try_get::<ScopeValue<T>>()` / query the scope map (`command_scope.get(key)`) and handle None instead of the panicking typed getter.
4. Ensure capabilities are loaded before any typed scope resolution (lookups happen after manager initialization).

Example fix

// before
let scope: Vec<ScopeValue<MyScope>> = acl
  .get_command_scope_typed::<MyScope>("my_plugin:allow-read")
  .unwrap(); // panics if key missing
// after
let scope = acl.command_scope.get("my_plugin:allow-read")
  .map(|resolved| resolved.clone().try_into_scope::<MyScope>())
  .unwrap_or_default(); // or return a proper error

// check the scope exists before the typed, panicking lookup
let exists = acl.command_scope.contains_key("my_plugin:allow-read");
if !exists { return Err(anyhow!("no scope registered for command")); }

When it happens

Trigger: Requesting a typed scope via `get_command_scope_typed::<T>(key)` for a command key that was never inserted into the ACL/command_scope map — e.g. querying a scope for a command not referenced by any capability, or a typo'd/mismatched command key.

Common situations: Plugin authors resolving custom scoped types at runtime for commands whose capabilities weren't generated (missing in capabilities JSON), key naming drift between build-time ACL generation and runtime lookup, or calling the lookup before ACLs are resolved.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• invalid permission identifier
• Not a CheckMenuItem
• Not a MenuItem
• Not a PredefinedMenuItem
• Not a Submenu

AI-assisted analysis of tauri-apps/tauri@460ec35447 (2026-09-18). Data as JSON: /api/errors/ff6fe64df0e12475. Report an issue: GitHub.

Appendix: source

Thrown at crates/tauri/src/ipc/authority.rs:785

        self.global_scope_cache.set(scope.clone());
        Ok(scope)
      }
    }
  }

  fn get_command_scope_typed<R: Runtime, T: ScopeObject>(
    &self,
    app: &AppHandle<R>,
    key: &ScopeKey,
  ) -> crate::Result<ScopeValue<T>> {
    let cache = self.command_cache.get(key).unwrap();
    match cache.try_get::<ScopeValue<T>>() {
      Some(cached) => Ok((*cached).clone()),
      None => {
        let resolved_scope = self
          .command_scope
          .get(key)
          .unwrap_or_else(|| panic!("missing command scope for key {key}"));

        let mut allow = Vec::new();
        let mut deny = Vec::new();

        for allowed in &resolved_scope.allow {
          allow
            .push(Arc::new(T::deserialize(app, allowed.clone()).map_err(
              |e| crate::Error::CannotDeserializeScope(Box::new(e)),
            )?));
        }
        for denied in &resolved_scope.deny {
          deny
            .push(Arc::new(T::deserialize(app, denied.clone()).map_err(
              |e| crate::Error::CannotDeserializeScope(Box::new(e)),
            )?));
        }

        let value = ScopeValue {

View on GitHub (pinned to 460ec35447)