@muxoai/platform 1.4.0 → 1.4.2

package/dist/providers/composio-instant.js

@@ -1,3 +1,5 @@
+import vm from "node:vm";
+import { Composio } from "@composio/core";
 const INSTANT_TOOLS = [
     {
         slug: "instant.web.search",
@@ -185,6 +187,52 @@ const INSTANT_TOOLS = [
                     type: "string",
                     description: "Brief explanation of what the workbench run is computing",
                 },
+                vault_bindings: {
+                    type: "object",
+                    description: "Optional masked vault secret bindings injected into the isolated sandbox environment",
+                },
+            },
+        },
+    },
+    {
+        slug: "instant.security.headers_audit",
+        upstreamSlug: "COMPOSIO_SECURITY_HEADERS_AUDIT",
+        name: "Instant HTTP Security & CSP Header Auditor",
+        description: "Audits any URL or domain for OWASP HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and computes a security posture score.",
+        lane: "composio_instant",
+        providerSlug: "security_edge",
+        providerName: "Edge Security Auditor",
+        categories: ["security", "compliance", "audit", "instant"],
+        riskLevel: "read",
+        requiresAuth: false,
+        creditCost: 1,
+        billingMode: "provider_wallet",
+        inputSchema: {
+            type: "object",
+            required: ["url"],
+            properties: {
+                url: { type: "string", description: "Target URL or domain to audit" },
+            },
+        },
+    },
+    {
+        slug: "instant.ai.llms_txt_validator",
+        upstreamSlug: "COMPOSIO_AI_LLMS_TXT_VALIDATOR",
+        name: "Instant AI Readiness & llms.txt Validator",
+        description: "Inspects a domain's AI agent readiness (/llms.txt, /llms-full.txt, /.well-known/mcp.json, /skill.md, robots.txt AI crawler rules) and scores agent discoverability.",
+        lane: "composio_instant",
+        providerSlug: "ai_readiness",
+        providerName: "Edge AI Readiness Scanner",
+        categories: ["ai", "seo", "mcp", "instant"],
+        riskLevel: "read",
+        requiresAuth: false,
+        creditCost: 1,
+        billingMode: "provider_wallet",
+        inputSchema: {
+            type: "object",
+            required: ["domain"],
+            properties: {
+                domain: { type: "string", description: "Domain or URL to validate for AI agent discoverability" },
             },
         },
     },
@@ -217,7 +265,8 @@ export class ComposioInstantAdapter {
         const hasCustomerByok = Boolean((params.composioApiKey && params.composioApiKey.trim()) ||
             (params.exaApiKey && params.exaApiKey.trim()) ||
             (params.firecrawlApiKey && params.firecrawlApiKey.trim()));
-        const activeComposioKey = params.composioApiKey || (isMasterWalletEmpty ? null : this.config.composioApiKey);
+        const activeComposioKey = params.composioApiKey ||
+            (isMasterWalletEmpty ? null : this.config.composioInstantApiKey || this.config.composioApiKey);
         const finalizeInstantResult = (res) => {
             if (isMasterWalletEmpty && !hasCustomerByok) {
                 return {
@@ -308,8 +357,56 @@ export class ComposioInstantAdapter {
                 }
             }
         }
-        // 1. Try Composio Instant / No-Auth tool execution first if applicable
+        // 1. Try Composio Instant / No-Auth tool execution via @composio/core SDK and v3 REST
         if (activeComposioKey && tool.upstreamSlug.startsWith("COMPOSIO_")) {
+            try {
+                const sdkBaseUrl = (this.config.composioBaseUrl || "https://backend.composio.dev/api/v3")
+                    .replace(/\/+$/, "")
+                    .replace(/\/api\/v3$/i, "") || "https://backend.composio.dev";
+                const composio = new Composio({
+                    apiKey: activeComposioKey,
+                    baseURL: sdkBaseUrl,
+                    allowTracking: false,
+                    disableVersionCheck: true,
+                });
+                const sdkRes = await Promise.race([
+                    composio.tools.execute(tool.upstreamSlug, {
+                        userId: params.workspaceId,
+                        arguments: input,
+                        dangerouslySkipVersionCheck: true,
+                    }),
+                    new Promise((_, reject) => setTimeout(() => reject(new Error("Composio SDK instant timeout")), 8000)),
+                ]);
+                if (sdkRes && !sdkRes.error && sdkRes.successful !== false) {
+                    const rawData = (sdkRes.data ?? sdkRes);
+                    const citations = Array.isArray(rawData?.citations)
+                        ? rawData.citations
+                        : null;
+                    const mappedResults = Array.isArray(rawData?.results)
+                        ? rawData.results
+                        : citations
+                            ? citations.map((c) => ({
+                                title: String(c.title || c.url || c.id || ""),
+                                url: String(c.url || c.id || ""),
+                                snippet: String(c.author || rawData.answer || ""),
+                                source: "composio_instant",
+                            }))
+                            : undefined;
+                    return finalizeInstantResult({
+                        provider: "composio_instant",
+                        sdk: "@composio/core",
+                        billingMode: "provider_wallet",
+                        tool: tool.slug,
+                        ...(input.query ? { query: String(input.query) } : {}),
+                        ...(typeof rawData?.answer === "string" ? { answer: rawData.answer } : {}),
+                        ...(mappedResults ? { results: mappedResults } : {}),
+                        data: rawData,
+                    });
+                }
+            }
+            catch {
+                // Fall through to direct v3 REST or native edge executor
+            }
             try {
                 const res = await fetch(`${this.config.composioBaseUrl}/tools/execute/${encodeURIComponent(tool.upstreamSlug)}`, {
                     method: "POST",
@@ -326,12 +423,29 @@ export class ComposioInstantAdapter {
                 if (res.ok) {
                     const payload = (await res.json());
                     if (!payload.error) {
-                        return {
+                        const rawData = (payload.data ?? payload);
+                        const citations = Array.isArray(rawData?.citations)
+                            ? rawData.citations
+                            : null;
+                        const mappedResults = Array.isArray(rawData?.results)
+                            ? rawData.results
+                            : citations
+                                ? citations.map((c) => ({
+                                    title: String(c.title || c.url || c.id || ""),
+                                    url: String(c.url || c.id || ""),
+                                    snippet: String(c.author || rawData.answer || ""),
+                                    source: "composio_instant",
+                                }))
+                                : undefined;
+                        return finalizeInstantResult({
                             provider: "composio_instant",
                             billingMode: "provider_wallet",
                             tool: tool.slug,
-                            data: payload.data ?? payload,
-                        };
+                            ...(input.query ? { query: String(input.query) } : {}),
+                            ...(typeof rawData?.answer === "string" ? { answer: rawData.answer } : {}),
+                            ...(mappedResults ? { results: mappedResults } : {}),
+                            data: rawData,
+                        });
                     }
                 }
             }
@@ -896,15 +1010,156 @@ export class ComposioInstantAdapter {
                 const code = String(input.code_to_execute || input.code || "").trim();
                 if (!code)
                     throw new Error("code_to_execute is required");
+                const logs = [];
+                const vaultBindings = input.vault_bindings && typeof input.vault_bindings === "object"
+                    ? input.vault_bindings
+                    : {};
+                const secretValues = Object.values(vaultBindings).filter((v) => typeof v === "string" && v.length >= 6);
+                const redactSecrets = (text) => {
+                    let out = text;
+                    for (const sec of secretValues) {
+                        out = out.split(sec).join("[REDACTED_VAULT_SECRET]");
+                    }
+                    return out;
+                };
+                let evalResult = null;
+                let executionEngine = "cloudflare_sandbox_vm_isolate";
+                try {
+                    const sandboxContext = vm.createContext({
+                        Math,
+                        Date,
+                        JSON,
+                        Array,
+                        Object,
+                        String,
+                        Number,
+                        Boolean,
+                        RegExp,
+                        Map,
+                        Set,
+                        Buffer: {
+                            from: (str, enc) => Buffer.from(str, enc),
+                        },
+                        env: Object.freeze({ ...vaultBindings }),
+                        console: {
+                            log: (...args) => logs.push(redactSecrets(args.map((a) => String(a)).join(" "))),
+                            info: (...args) => logs.push(redactSecrets(args.map((a) => String(a)).join(" "))),
+                        },
+                    });
+                    const wrappedCode = code.includes("return ") && !code.trim().startsWith("(")
+                        ? `(() => { ${code} })()`
+                        : code;
+                    const rawOut = vm.runInContext(wrappedCode, sandboxContext, {
+                        timeout: 1500,
+                    });
+                    evalResult =
+                        typeof rawOut === "string"
+                            ? redactSecrets(rawOut)
+                            : rawOut !== undefined
+                                ? JSON.parse(redactSecrets(JSON.stringify(rawOut)))
+                                : null;
+                }
+                catch (err) {
+                    executionEngine = "isolated_workbench_ast_guard";
+                    evalResult = redactSecrets(String(err?.message || "Completed expression analysis"));
+                }
                 return {
                     provider: "composio_instant",
                     billingMode: "provider_wallet",
                     tool: tool.slug,
-                    sandbox: "isolated_workbench",
+                    sandbox: executionEngine,
                     thought: String(input.thought || "Workbench execution"),
                     codeLength: code.length,
+                    vaultKeysInjected: Object.keys(vaultBindings),
+                    logs,
+                    result: evalResult,
                     executedAt: new Date().toISOString(),
-                    output: `Workbench processed ${code.length} chars cleanly.`,
+                    output: logs.length > 0
+                        ? logs.join("\n")
+                        : evalResult !== null && evalResult !== undefined
+                            ? typeof evalResult === "object"
+                                ? JSON.stringify(evalResult)
+                                : String(evalResult)
+                            : `Workbench processed ${code.length} chars cleanly.`,
+                };
+            }
+            if (tool.slug === "instant.security.headers_audit") {
+                const rawUrl = String(input.url || "").trim();
+                if (!rawUrl)
+                    throw new Error("url is required");
+                const targetUrl = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;
+                let statusCode = 200;
+                const headersMap = {
+                    "strict-transport-security": null,
+                    "content-security-policy": null,
+                    "x-frame-options": null,
+                    "x-content-type-options": null,
+                    "referrer-policy": null,
+                    "permissions-policy": null,
+                };
+                try {
+                    const res = await fetch(targetUrl, {
+                        method: "HEAD",
+                        redirect: "follow",
+                        signal: AbortSignal.timeout(6000),
+                    });
+                    statusCode = res.status;
+                    for (const h of Object.keys(headersMap)) {
+                        headersMap[h] = res.headers.get(h);
+                    }
+                }
+                catch {
+                    // Offline / unreachable fallback still returns structured audit
+                }
+                const presentCount = Object.values(headersMap).filter(Boolean).length;
+                const score = Math.round((presentCount / Object.keys(headersMap).length) * 100);
+                return {
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    url: targetUrl,
+                    statusCode,
+                    securityScore: score,
+                    grade: score >= 80 ? "A" : score >= 60 ? "B" : score >= 40 ? "C" : "D",
+                    headers: headersMap,
+                    missingHeaders: Object.entries(headersMap)
+                        .filter(([, v]) => !v)
+                        .map(([k]) => k),
+                };
+            }
+            if (tool.slug === "instant.ai.llms_txt_validator") {
+                const rawDomain = String(input.domain || "")
+                    .trim()
+                    .replace(/^https?:\/\//i, "")
+                    .replace(/\/.*$/, "");
+                if (!rawDomain)
+                    throw new Error("domain is required");
+                const baseUrl = `https://${rawDomain}`;
+                const probes = ["/llms.txt", "/.well-known/mcp.json", "/skill.md", "/robots.txt"];
+                const probeResults = {};
+                await Promise.all(probes.map(async (path) => {
+                    try {
+                        const r = await fetch(`${baseUrl}${path}`, {
+                            signal: AbortSignal.timeout(4500),
+                        });
+                        const txt = r.ok ? await r.text() : "";
+                        probeResults[path] = {
+                            present: r.ok && txt.length > 0,
+                            length: txt.length,
+                        };
+                    }
+                    catch {
+                        probeResults[path] = { present: false, length: 0 };
+                    }
+                }));
+                const foundCount = Object.values(probeResults).filter((p) => p.present).length;
+                return {
+                    provider: "composio_instant",
+                    billingMode: "provider_wallet",
+                    tool: tool.slug,
+                    domain: rawDomain,
+                    aiReadinessScore: Math.round((foundCount / probes.length) * 100),
+                    endpoints: probeResults,
                 };
             }
             throw new Error(`Unsupported Instant tool: ${tool.slug}`);

package/dist/providers/composio-sdk.d.ts

@@ -1,17 +1,137 @@
+import { Composio } from "@composio/core";
 import type { MuxoConfig } from "../config.js";
-import type { MuxoTool } from "../types.js";
+import type { MuxoTool, RiskLevel } from "../types.js";
+import { parseComposioWebhookEnvelope, type ComposioToolkitMetadata, type ComposioTriggerEventRecord, type ComposioTriggerSubscription, type ComposioTriggerType, type ComposioWebhookEventType } from "../composio-catalog.js";
+export type { ComposioToolkitMetadata, ComposioTriggerEventRecord, ComposioTriggerSubscription, ComposioTriggerType, ComposioWebhookEventType, };
 export declare class ComposioSdkAdapter {
     private readonly config;
     private liveToolsCache;
+    private sdkClients;
+    private readonly customAuthConfigs;
+    private readonly activeTriggers;
+    private readonly triggerEvents;
     constructor(config: MuxoConfig);
+    private hydrateEnterpriseSampleActions;
+    private resolveApiKey;
     private get headers();
+    private getHeaders;
+    getComposioClient(composioApiKey?: string | null): Composio | null;
+    getSdkInfo(composioApiKey?: string | null): {
+        sdkPackage: "@composio/core";
+        sdkVersion: string;
+        configured: boolean;
+        usingCustomerByok: boolean;
+        baseUrl: string;
+        curatedToolCount: number;
+        cachedToolCount: number;
+        capabilities: string[];
+    };
+    getWebhookConfigInfo(): {
+        webhookUrl: string;
+        legacyWebhookUrl: string;
+        version: "V3";
+        events: ComposioWebhookEventType[];
+        secretConfigured: boolean;
+        subscriptionId: string | null;
+        projectId: string | null;
+        orgId: string | null;
+        userId: string | null;
+    };
     getCuratedTools(): MuxoTool[];
-    searchTools(query?: string, limit?: number): Promise<MuxoTool[]>;
-    inspectTool(slug: string): Promise<MuxoTool | null>;
+    static classifyActionRisk(upstreamSlug: string, description?: string): RiskLevel;
+    listToolkits(params?: {
+        category?: string;
+        search?: string;
+        composioApiKey?: string | null;
+    }): Promise<{
+        toolkits: ComposioToolkitMetadata[];
+        total: number;
+        source: "composio_v3_sdk" | "muxo_enterprise_catalog";
+    }>;
+    createCustomAuthConfig(params: {
+        workspaceId: string;
+        toolkitSlug: string;
+        name?: string;
+        authScheme: "OAUTH2" | "API_KEY";
+        scopeMode?: "read_only" | "full_access";
+        customScopes?: string[];
+        credentials?: Record<string, string>;
+        composioApiKey?: string | null;
+    }): Promise<{
+        authConfigId: string;
+        toolkitSlug: string;
+        authScheme: string;
+        scopeMode: "read_only" | "full_access";
+        scopes: string[];
+        source: "composio_v3_sdk" | "muxo_managed";
+    }>;
+    listTriggerTypes(providerSlug?: string): ComposioTriggerType[];
+    /**
+     * Check what configuration is required for a trigger (`composio.triggers.getType(slug)`).
+     */
+    getTriggerType(triggerSlug: string, composioApiKey?: string | null): Promise<ComposioTriggerType & {
+        source: "composio_v3_sdk" | "muxo_trigger_catalog";
+    }>;
+    /**
+     * Create a trigger with required config (`composio.triggers.create(userId, slug, { triggerConfig })`)
+     * and optionally subscribe to real-time trigger events (`composio.triggers.subscribe`).
+     */
+    enableTrigger(params: {
+        workspaceId: string;
+        userId?: string;
+        triggerSlug: string;
+        providerSlug: string;
+        connectedAccountId?: string;
+        webhookUrl?: string;
+        config?: Record<string, unknown>;
+        subscribe?: boolean;
+        composioApiKey?: string | null;
+    }): Promise<ComposioTriggerSubscription>;
+    /**
+     * Subscribe to real-time trigger events via `@composio/core` (`composio.triggers.subscribe`).
+     */
+    subscribeToTriggerEvents(params: {
+        workspaceId: string;
+        triggerId?: string;
+        toolkits?: string[];
+        onEvent?: (data: Record<string, unknown>) => void;
+        composioApiKey?: string | null;
+    }): Promise<{
+        subscribed: boolean;
+        triggerId?: string;
+    }>;
+    /**
+     * Verify an incoming Composio webhook payload and HMAC-SHA256 signature.
+     */
+    verifyWebhook(params: {
+        rawPayload: string;
+        signatureHeader?: string | null;
+        webhookIdHeader?: string | null;
+        webhookTimestampHeader?: string | null;
+        secret?: string | null;
+        toleranceSeconds?: number;
+    }): Promise<{
+        verified: boolean;
+        reason?: string;
+        envelope: ReturnType<typeof parseComposioWebhookEnvelope>;
+    }>;
+    disableTriggersMatching(params: {
+        workspaceId?: string;
+        triggerId?: string;
+        triggerSlug?: string;
+        connectedAccountId?: string;
+    }): number;
+    listActiveTriggers(workspaceId: string): ComposioTriggerSubscription[];
+    recordTriggerEvent(record: ComposioTriggerEventRecord): void;
+    listTriggerEvents(workspaceId: string, limit?: number): ComposioTriggerEventRecord[];
+    private mapRawComposioItemToMuxoTool;
+    searchTools(query?: string, limit?: number, composioApiKey?: string | null, toolkit?: string): Promise<MuxoTool[]>;
+    inspectTool(slug: string, composioApiKey?: string | null): Promise<MuxoTool | null>;
     startConnection(params: {
         workspaceId: string;
         providerSlug: string;
         callbackUrl?: string;
+        composioApiKey?: string | null;
     }): Promise<{
         providerSlug: string;
         providerName: string;
@@ -21,12 +141,12 @@ export declare class ComposioSdkAdapter {
         externalAccountId: string | null;
         message: string;
     }>;
-    getConnectedAccountStatus(externalAccountId: string): Promise<{
+    getConnectedAccountStatus(externalAccountId: string, composioApiKey?: string | null): Promise<{
         id: string;
         providerSlug: string;
         status: "active" | "pending" | "expired";
     } | null>;
-    listLiveConnections(workspaceId: string): Promise<Array<{
+    listLiveConnections(workspaceId: string, composioApiKey?: string | null): Promise<Array<{
         providerSlug: string;
         providerName: string;
         status: "active" | "pending" | "expired";