Files
ironclaw/registry/tools/composio.json
Vu Tran 8dfedfa5fb feat: add native Composio tool for third-party app integrations (#920)
* feat: add Composio WASM tool for third-party app integrations

Add Composio integration as a WASM tool (tools-src/composio/), providing
a single multiplexed tool with 4 actions: list, execute, connect, and
connected_accounts. Supports 250+ third-party apps via Composio's REST
API with WASM sandbox security (fuel metering, memory limits, network
allowlisting, host-injected credentials).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review — retry safety, dead code, registry manifest

Code fixes (tools-src/composio/src/lib.rs):
- Only retry GET requests (idempotent); POST executes once to prevent
  duplicate side effects on execute/connect actions
- Remove dead parse_json_response status check (already handled by
  caller); use serde_json::from_slice to avoid extra allocation
- Remove misleading secret_exists pre-flight (only checks capability
  allowlist, not actual presence); instead surface helpful error on
  401/403 from the API
- Extract entity_id logic into extract_entity_id() helper with 6 unit
  tests covering precedence chain and edge cases

Registry:
- Add registry/tools/composio.json manifest (matches format of other
  tools like web-search, github, gmail)
- Add composio to the default bundle in _bundles.json

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: restore secret pre-flight, enforce schema, remove default tag

- Restore secret_exists pre-flight as best-effort check (avoids wasting
  rate-limited API calls when clearly misconfigured)
- Add #[serde(deny_unknown_fields)] to Params to match the schema's
  additionalProperties: false contract
- Remove "default" tag from registry manifest and remove from default
  bundle until WASM artifacts are published

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: simplify entity_id fallback, add params type to schema

- Remove requester_id fallback from extract_entity_id (user_id is
  always present in JobContext, so requester_id was dead code)
- Add "type": "object" to params field in both tool schema and
  capabilities.json to prevent schema-driven callers from sending
  non-object values

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: align with Composio v3 API contract + fixture tests

Address serrrfirat's review — update all response parsing and request
fields to match the current Composio v3 API:

- Add unwrap_items() helper for paginated { "items": [...] } envelopes,
  with bare-array fallback for backward compatibility
- connect_app: parse auth_configs from paginated response via
  extract_auth_config_id()
- execute_action: use v3 fields `user_id` + `arguments` (not deprecated
  `entity_id` + `input`)
- list_accounts/resolve_account: use plural query params `user_ids`,
  `toolkit_slugs` (v3 contract)
- lookup_app_for_tool: look for nested `toolkit.slug` (v3), falling
  back to `toolkit_slug` and `appName`
- find_active_account: sort by `updated_at` (v3), falling back to
  `updatedAt`

Add 15 fixture-style tests covering:
- Paginated envelope parsing (envelope, bare array, empty, non-array)
- Auth config extraction (paginated, bare, empty)
- Toolkit slug extraction (v3 nested, legacy flat, appName fallback,
  case-insensitive, not-found)
- Active account selection (v3 timestamps, legacy timestamps, no active)

Total: 25 tests (5 URL, 5 entity_id, 15 v3 contract fixtures)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review — remove duplicate parameters, validate params, fix ordering

- Remove `parameters` section from capabilities JSON (duplicates SCHEMA const,
  runtime ignores it, creates drift risk)
- Fix Cargo.toml exclude ordering: tools-src/composio before tools-src/github
- Validate `params` is a JSON object when provided, reject non-object values early
- Remove 429 from retry logic (WASM has no sleep/backoff, immediate retry wastes
  rate-limit budget) — only retry on transient 5xx
- Add tests for params validation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address maintainer review — retry convention, numeric IDs, slug validation

- Revert 429 retry to align with github/web-search tool convention (sub-second
  sliding-window resets can make immediate retries worthwhile)
- Handle numeric entity_id/user_id in context JSON (as_u64/as_i64 fallback)
- Add validate_tool_slug() defense-in-depth against path traversal (same
  pattern as github tool)
- Add tests for numeric entity IDs and slug validation (32 total)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address 4 unresolved audit issues — pagination, direct lookup, array params

1. list_tools: expose cursor/limit params in schema, preserve next_cursor
   and total in response for multi-page browsing, add toolkit_versions=latest
2. lookup_app_for_tool: use direct GET /tools/{slug} endpoint instead of
   fuzzy search (avoids false negatives from search pagination/ranking),
   add toolkit_versions=latest
3. connected_accounts queries: encode user_ids and toolkit_slugs as array
   params (user_ids[], toolkit_slugs[]) per v3 API contract
4. toolkit_versions=latest added to both list and lookup endpoints

Adds 5 new tests (37 total): cursor/limit params, array query encoding,
direct tool response parsing (v3 nested, legacy, missing).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: ilblackdragon@gmail.com <ilblackdragon@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: firat.sertgoz <f@nuff.tech>
2026-04-10 23:53:13 +09:00

34 lines
709 B
JSON

{
"name": "composio",
"display_name": "Composio",
"kind": "tool",
"version": "0.1.0",
"wit_version": "0.3.0",
"description": "Connect to 250+ apps (Gmail, GitHub, Slack, Notion, Jira, etc.) via Composio",
"keywords": [
"composio",
"integrations",
"oauth",
"automation",
"apps"
],
"source": {
"dir": "tools-src/composio",
"capabilities": "composio-tool.capabilities.json",
"crate_name": "composio-tool"
},
"artifacts": {},
"auth_summary": {
"method": "manual",
"provider": "Composio",
"secrets": [
"composio_api_key"
],
"shared_auth": null,
"setup_url": "https://app.composio.dev/"
},
"tags": [
"integrations"
]
}