[Bug]: Enhanced Controls maps Outlook read permissions to obsolete OUTLOOK_OUTLOOK_* slugs

SDK Language

Not sure. This occurs in the Composio CLI consumer flow.

SDK Version

Composio CLI 0.4.0

Runtime Environment

macOS 26.6.2 on Apple Silicon (arm64)

Environment

Local Development

Describe the Bug

Outlook Read actions open the Enhanced Controls approval modal on every call even though the Outlook Read category is configured as Always Allow.

The refreshed local permission snapshot contains always_allow entries for obsolete doubled-prefix slugs, while the current slugs executed by the CLI have no matching entries and fall through to the snapshot default of ask_every_call.

Observed redacted snapshot:

{
  "default": "ask_every_call",
  "currentSearch": null,
  "staleSearch": "always_allow",
  "currentGet": null,
  "staleGet": "always_allow"
}

The compared keys are:

OUTLOOK_SEARCH_MESSAGES:<connected-account-id>            missing
OUTLOOK_OUTLOOK_SEARCH_MESSAGES:<connected-account-id>    always_allow
OUTLOOK_GET_MESSAGE:<connected-account-id>                missing
OUTLOOK_OUTLOOK_GET_MESSAGE:<connected-account-id>        always_allow

The resulting temporary approvals appear in the same cache with expiry timestamps, so the prompts return after the temporary allowance expires.

Expected: current Outlook read slugs inherit the configured Read = Always Allow policy and execute without approval prompts.

Actual: current slugs miss the policy and use ask_every_call.

Steps to Reproduce

1. Enable Enhanced Controls and configure Outlook Read as Always Allow.
2. Connect an Outlook account.
3. Execute OUTLOOK_SEARCH_MESSAGES or OUTLOOK_GET_MESSAGE through Composio CLI.
4. Observe an approval modal despite the Always Allow setting.
5. Inspect the refreshed tool-permissions-cache.json and compare the current slug with the corresponding doubled-prefix policy entry.

Minimal Reproducible Example

composio execute OUTLOOK_SEARCH_MESSAGES -d '{"query":"test","size":1}'

Error Output / Stack Trace

No exception. The native approval UI opens because permission resolution returns ask_every_call for the current slug.

Reproducibility

• Always reproducible
• Intermittent / Sometimes
• Happened once, can't reproduce

Additional Context or Screenshots

This appears related to the Outlook enum-slug migration documented in #2810 and #3391. PR #3879 intentionally fails closed to ask_every_call when the policy snapshot cannot resolve a tool, which matches this behavior. Issue #4049 / PR #4053 fixed a separate slug-resolution problem under Enhanced Controls but does not cover stale Outlook permission keys.

No organization, project, consumer-user, connected-account, API-key, or email identifiers are included here.