@xopcai/xopc 0.0.303 → 0.0.307

package/dist/src/connectors/composio.js

@@ -1,23 +1,31 @@
-import { getConnectorConnection, getConnectorInstallation, listConnectorConnections, upsertConnectorActionMetadata, upsertConnectorConnection, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
-import { getConnectorAccount, refreshConnectorAccountCurrent } from "../storage/sqlite/connector-account-repository.js";
+import { getConnectorAccount, init_connector_account_repository, refreshConnectorAccountCurrent, updateConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
+import { getConnectorConnection, getConnectorInstallation, init_connector_repository, listConnectorConnections, upsertConnectorActionMetadata, upsertConnectorConnection, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import { CredentialResolver, init_credentials } from "../auth/credentials.js";
+import { activateComposioBackend, addComposioBackend, ensureComposioBackend, getComposioBackend, listComposioBackends, markComposioBackendVerified, resolveBackendKey } from "./composio-backends.js";
 import { connectorIdentityKey } from "./connector-identity.js";
+import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { ComposioSessionsAdapter, assertComposioAccessConfigured } from "./composio-sessions.js";
+import { getConnectorLearningPlan } from "./learning-recipes.js";
 import { COMPOSIO_AGENT_READY_TOOLKITS, COMPOSIO_TOOLKIT_DISPLAY_NAMES, connectorDefinitionFromComposioToolkit } from "./composio-catalog.js";
-import { consumeConnectorSetupSecretRef } from "./setup-secrets.js";
+import { randomUUID } from "node:crypto";
 //#region src/connectors/composio.ts
 init_credentials();
+init_connector_account_repository();
+init_connector_repository();
 function toComposioConnection(connection) {
 	const toolkit = toolkitFromConnectionMetadata(connection);
 	const account = connection.accountId ? getConnectorAccount(connection.accountId) : void 0;
 	return {
+		supportsLearning: Boolean(getConnectorLearningPlan(toolkit)),
 		id: connection.id,
 		accountId: connection.accountId,
+		backendLabel: account?.backendId ? getComposioBackend(account.backendId)?.label : void 0,
+		accountEnabled: account?.enabled ?? false,
+		allowedAgentIds: account?.allowedAgentIds ?? null,
 		providerConnectionId: connection.providerConnectionId,
 		toolkit,
 		status: connection.status,
-		alias: connection.alias,
-		isDefault: connection.isDefault,
+		alias: account?.label ?? connection.alias,
 		isCurrentAuthorization: account?.currentConnectionId === connection.id,
 		accountEmail: typeof connection.identity.email === "string" ? connection.identity.email : void 0,
 		workspace: typeof connection.identity.workspace === "string" ? connection.identity.workspace : void 0,
@@ -29,7 +37,6 @@ function toComposioConnection(connection) {
 		lastError: connection.lastError
 	};
 }
-const COMPOSIO_API_KEY_PROVIDER = "connector-composio-api-key";
 const COMPOSIO_SCOPE_ORDER = {
 	read: 1,
 	write: 2,
@@ -296,47 +303,7 @@ function canUseComposioAction(config, slug) {
 		scope: action.scope
 	};
 }
-const COMPOSIO_CONNECTORS = [{
-	id: "composio-api-key",
-	version: "1.0.0",
-	displayName: "Composio API Key",
-	description: "Store a Composio API key for direct-mode toolkit connectors.",
-	category: "automation",
-	kind: "composio",
-	source: "builtin",
-	branding: {
-		logoUrl: "/connector-icons/composio.svg",
-		source: "composio-catalog"
-	},
-	verificationLevel: "verified",
-	capabilities: [
-		"auth.apiKey",
-		"tools",
-		"events",
-		"workflows"
-	],
-	tags: [
-		"composio",
-		"oauth",
-		"integrations"
-	],
-	auth: { mode: "apiKey" },
-	setup: { secrets: [{
-		key: "COMPOSIO_API_KEY",
-		label: "Composio API key",
-		required: true
-	}] },
-	runtime: {
-		type: "composio",
-		toolkit: "composio",
-		role: "credential"
-	},
-	integrationStrategy: {
-		lane: "composio",
-		workload: "long_tail",
-		preferred: true
-	}
-}, ...COMPOSIO_AGENT_READY_TOOLKITS.map((toolkit) => {
+const COMPOSIO_CONNECTORS = [...COMPOSIO_AGENT_READY_TOOLKITS.map((toolkit) => {
 	return {
 		...connectorDefinitionFromComposioToolkit({
 			slug: toolkit,
@@ -348,29 +315,52 @@ const COMPOSIO_CONNECTORS = [{
 		source: "builtin"
 	};
 })];
-async function saveComposioApiKey(input, resolver = new CredentialResolver()) {
-	const raw = input.secrets?.COMPOSIO_API_KEY;
-	const resolved = typeof raw === "string" && raw.trim().startsWith("secret://") ? consumeConnectorSetupSecretRef(raw) : raw;
-	if (typeof resolved !== "string" || !resolved.trim()) throw new Error("Composio API key is required.");
-	await resolver.saveApiKey(COMPOSIO_API_KEY_PROVIDER, resolved.trim(), { profileName: "default" });
-}
-async function configureComposioApiKey(apiKey, resolver = new CredentialResolver()) {
+async function configureComposioApiKey(apiKey, resolver = new CredentialResolver(), replaceBackendId) {
 	const normalized = apiKey.trim();
 	if (!normalized) throw new Error("Composio API key is required.");
 	if (normalized.length > 4096) throw new Error("Composio API key is too long.");
-	await new ComposioSessionsAdapter({ resolver: { resolveApiKey: async () => normalized } }).listToolkitCatalog({ principalId: LOCAL_OWNER_PRINCIPAL });
-	await resolver.saveApiKey(COMPOSIO_API_KEY_PROVIDER, normalized, { profileName: "default" });
+	const adapter = new ComposioSessionsAdapter({ apiKey: normalized });
+	await adapter.listToolkitCatalog({ principalId: LOCAL_OWNER_PRINCIPAL });
+	await ensureComposioBackend(resolver);
+	if (replaceBackendId) {
+		const backend = getComposioBackend(replaceBackendId);
+		if (!backend || backend.mode !== "byok" || !backend.credential_ref) throw new Error("Unknown Composio project.");
+		if (backend.credential_source === "environment") throw new Error("Update this key in the gateway environment, or add a locally stored project.");
+		await adapter.verifyConnections(listConnectorConnections({ principalId: LOCAL_OWNER_PRINCIPAL }).filter((connection) => getConnectorAccount(connection.accountId)?.backendId === backend.id && connection.status !== "revoked"));
+		await resolver.saveApiKey(backend.credential_ref, normalized, { profileName: "default" });
+		markComposioBackendVerified(backend.id);
+		return;
+	}
+	for (const backend of listComposioBackends()) if (backend.mode === "byok" && await resolveBackendKey(backend, resolver) === normalized) {
+		activateComposioBackend(backend.id);
+		return;
+	}
+	const id = randomUUID();
+	const credentialRef = `connector-composio-${id}`;
+	await resolver.saveApiKey(credentialRef, normalized, { profileName: "default" });
+	addComposioBackend({
+		id,
+		mode: "byok",
+		label: `Composio · ${id.slice(0, 6)}`,
+		credentialRef
+	});
+	markComposioBackendVerified(id);
+	activateComposioBackend(id);
 }
 async function listComposioConnections(resolver = new CredentialResolver()) {
-	await new ComposioSessionsAdapter({ resolver }).syncConnections({ principalId: LOCAL_OWNER_PRINCIPAL });
+	const adapter = new ComposioSessionsAdapter({ resolver });
+	const verified = new Set((await adapter.syncConnections({ principalId: LOCAL_OWNER_PRINCIPAL })).map((connection) => connection.id));
 	const connections = listConnectorConnections({ principalId: LOCAL_OWNER_PRINCIPAL }).filter((connection) => connection.provider === "composio");
 	for (const accountId of new Set(connections.flatMap((connection) => connection.accountId ? [connection.accountId] : []))) refreshConnectorAccountCurrent(accountId);
-	return connections.map(toComposioConnection);
+	return connections.map((connection) => toComposioConnection(verified.has(connection.id) || connection.status !== "active" ? connection : {
+		...connection,
+		status: "unknown"
+	}));
 }
 async function inspectComposioConnectorHealth(toolkit, resolver = new CredentialResolver()) {
 	const normalizedToolkit = normalizeToolkit(toolkit);
 	try {
-		await assertComposioAccessConfigured(resolver);
+		if (!listConnectorConnections({ principalId: LOCAL_OWNER_PRINCIPAL }).length) await assertComposioAccessConfigured(resolver);
 		const connections = (await listComposioConnections(resolver)).filter((connection) => connection.toolkit.toLowerCase() === normalizedToolkit);
 		const byAccount = /* @__PURE__ */ new Map();
 		for (const connection of connections) {
@@ -422,7 +412,11 @@ async function inspectComposioConnectorHealth(toolkit, resolver = new Credential
 	}
 }
 async function getComposioToolkitAuthState(toolkit, resolver = new CredentialResolver()) {
-	return new ComposioSessionsAdapter({ resolver }).getToolkitAuthState(normalizeToolkit(toolkit));
+	const backend = await ensureComposioBackend(resolver);
+	return {
+		...await new ComposioSessionsAdapter({ resolver }).getToolkitAuthState(normalizeToolkit(toolkit)),
+		mode: backend.mode
+	};
 }
 function classifyComposioHealthError(error) {
 	const message = error instanceof Error ? error.message : String(error);
@@ -464,7 +458,7 @@ function getComposioInstallationPolicy(config, toolkit) {
 		allowedAgentIds: existing?.allowedAgentIds ?? [],
 		maxScope: getComposioToolkitScope(config, normalizedToolkit),
 		confirmationPolicy: existing?.confirmationPolicy ?? "writes",
-		selectedConnectionIds: existing?.selectedConnectionIds ?? [],
+		selectedAccountIds: existing?.selectedAccountIds ?? null,
 		createdAt: existing?.createdAt
 	});
 }
@@ -474,16 +468,16 @@ function updateComposioInstallationPolicy(config, toolkit, patch) {
 		...current,
 		allowedAgentIds: patch.allowedAgentIds ?? current.allowedAgentIds,
 		confirmationPolicy: patch.confirmationPolicy ?? current.confirmationPolicy,
-		selectedConnectionIds: patch.selectedConnectionIds ?? current.selectedConnectionIds
+		selectedAccountIds: patch.selectedAccountIds === void 0 ? current.selectedAccountIds : patch.selectedAccountIds
 	});
 }
 function updateComposioConnection(id, patch) {
 	const connection = getConnectorConnection(id);
 	if (!connection || connection.provider !== "composio" || connection.principalId !== LOCAL_OWNER_PRINCIPAL) throw new Error("Composio connection not found.");
+	if (connection.accountId && patch.alias !== void 0) updateConnectorAccount(connection.accountId, { label: patch.alias });
 	upsertConnectorConnection({
 		...connection,
-		alias: patch.alias === void 0 ? connection.alias : patch.alias.trim() || void 0,
-		isDefault: patch.isDefault ?? connection.isDefault
+		alias: patch.alias === void 0 ? connection.alias : patch.alias.trim() || void 0
 	});
 	return toComposioConnection(getConnectorConnection(id));
 }
@@ -509,6 +503,7 @@ async function startComposioAuthorize(connectorId, toolkit, resolver = new Crede
 	if (!authorization.connectUrl) throw new Error("Composio authorize did not return a connect URL.");
 	return {
 		toolkit: authorization.toolkit,
+		attemptId: authorization.attemptId,
 		connectUrl: authorization.connectUrl,
 		connectionId: authorization.connectionId
 	};
@@ -558,24 +553,13 @@ async function executeComposioTool(params, resolver = new CredentialResolver())
 	if (allowed.ok === false) throw new Error(allowed.reason);
 	if (!allowed.toolkit) throw new Error(`Unknown Composio toolkit for action: ${params.slug}`);
 	const connectorId = `composio-${allowed.toolkit}`;
-	const installation = upsertConnectorInstallation({
-		id: `${connectorId}-${LOCAL_OWNER_PRINCIPAL}`,
-		connectorId,
-		principalId: LOCAL_OWNER_PRINCIPAL,
-		enabled: true,
-		allowedAgentIds: [],
-		maxScope: getComposioToolkitScope(params.config, allowed.toolkit),
-		confirmationPolicy: "writes",
-		selectedConnectionIds: []
-	});
-	const connection = listConnectorConnections({
-		principalId: LOCAL_OWNER_PRINCIPAL,
-		connectorId
-	}).find((candidate) => candidate.status === "active" && candidate.isDefault) ?? listConnectorConnections({
-		principalId: LOCAL_OWNER_PRINCIPAL,
-		connectorId
-	}).find((candidate) => candidate.status === "active");
-	const result = await new ComposioSessionsAdapter({ resolver }).executeWithPolicy({
+	const installation = getConnectorInstallation(`${connectorId}-${LOCAL_OWNER_PRINCIPAL}`);
+	if (!installation) throw new Error("Connector policy is unavailable.");
+	const adapter = new ComposioSessionsAdapter({ resolver });
+	const connections = currentAccountConnections((await adapter.syncConnections({ principalId: LOCAL_OWNER_PRINCIPAL })).filter((candidate) => canAccessConnectorAccount(candidate, installation)));
+	const connection = params.accountId ? connections.find((candidate) => candidate.accountId === params.accountId) : connections.length === 1 ? connections[0] : void 0;
+	if (!connection) throw new Error("Select an available account explicitly.");
+	const result = await adapter.executeWithPolicy({
 		context: {
 			principalId: LOCAL_OWNER_PRINCIPAL,
 			toolkits: [allowed.toolkit],
@@ -592,10 +576,10 @@ async function executeComposioTool(params, resolver = new CredentialResolver())
 			cachedAt: (/* @__PURE__ */ new Date()).toISOString()
 		},
 		args: params.arguments && typeof params.arguments === "object" && !Array.isArray(params.arguments) ? params.arguments : {},
-		confirmed: true
+		confirmed: false
 	});
 	if (result.decision !== "allowed") throw new Error(result.reason);
 	return result.result;
 }
 //#endregion
-export { COMPOSIO_CONNECTORS, canUseComposioAction, configureComposioApiKey, executeComposioTool, getComposioInstallationPolicy, getComposioToolkitAuthState, getComposioToolkitScope, getConfiguredComposioAuthConfigs, inspectComposioConnectorHealth, isComposioActionAllowedByCatalog, listComposioConnections, listComposioTools, refreshComposioConnection, revokeComposioConnection, saveComposioApiKey, scopeForComposioAction, setComposioToolkitScope, startComposioAuthorize, toolkitFromComposioSlug, updateComposioConnection, updateComposioInstallationPolicy };
+export { COMPOSIO_CONNECTORS, canUseComposioAction, configureComposioApiKey, executeComposioTool, getComposioInstallationPolicy, getComposioToolkitAuthState, getComposioToolkitScope, getConfiguredComposioAuthConfigs, inspectComposioConnectorHealth, isComposioActionAllowedByCatalog, listComposioConnections, listComposioTools, refreshComposioConnection, revokeComposioConnection, scopeForComposioAction, setComposioToolkitScope, startComposioAuthorize, toolkitFromComposioSlug, updateComposioConnection, updateComposioInstallationPolicy };

package/dist/src/connectors/connected-source-ingestion.js

@@ -2,6 +2,7 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getConnectorInstallation, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
 import "../storage/sqlite/index.js";
+import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { decodeConnectedSourceCursor, encodeConnectedSourceCursor } from "./connected-source-cursor.js";
 import { scopeForComposioAction } from "./composio.js";
@@ -288,11 +289,11 @@ async function ingestComposioConnectedSource(input) {
 	const installation = getConnectorInstallation(`${connectorId}-local-owner`);
 	if (!installation?.enabled) throw new Error("Connector installation is not enabled.");
 	if (installation.allowedAgentIds.length && !installation.allowedAgentIds.includes(input.agentId)) throw new Error("This agent is not allowed to sync from the connector.");
-	const activeConnections = listConnectorConnections({
+	const activeConnections = currentAccountConnections(listConnectorConnections({
 		principalId: "local-owner",
 		connectorId
-	}).filter((connection) => connection.status === "active");
-	const connection = input.connectionId ? activeConnections.find((candidate) => candidate.id === input.connectionId) : activeConnections.find((candidate) => candidate.isDefault) ?? activeConnections[0];
+	}).filter((connection) => canAccessConnectorAccount(connection, installation, input.agentId)));
+	const connection = input.connectionId ? activeConnections.find((candidate) => candidate.id === input.connectionId) : activeConnections.length === 1 ? activeConnections[0] : void 0;
 	if (!connection) throw new Error("No active connector account is available for connected source ingestion.");
 	if (!connection.accountId) throw new Error("The connector authorization is not assigned to an account.");
 	const adapter = input.adapter ?? new ComposioSessionsAdapter();

package/dist/src/connectors/connection-recovery-service.js

@@ -3,17 +3,18 @@ import { init_logger } from "../utils/logger.js";
 import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
 import { readCurrentTranscriptId } from "../storage/sqlite/session-instance-repository.js";
 import { getSessionInputState, init_session_input_repository } from "../storage/sqlite/session-input-repository.js";
+import { getConnectorAccount, init_connector_account_repository } from "../storage/sqlite/connector-account-repository.js";
+import { getConnectorConnection, getConnectorInstallation, init_connector_repository, listConnectorConnections, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import { cancelConnectionObjective, getActiveConnectionWait, getConnectionWait, init_connection_wait_repository, listConnectionWaitsToCheck, publishConnectionWait, queueConnectionResolution, updateConnectionWait } from "../storage/sqlite/connection-wait-repository.js";
 import { init_session_repository } from "../storage/sqlite/session-repository.js";
-import { getConnectorInstallation, listConnectorConnections, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
-import { getConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
+import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { getConfiguredComposioAuthConfigs, isComposioActionAllowedByCatalog, scopeForComposioAction } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
+import { listConnectorInstances } from "./instances.js";
 import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
 import { connectorPrincipalForSession } from "./principal.js";
 import { resolveConnectionCandidate } from "./connection-candidates.js";
-import { listConnectorInstances } from "./instances.js";
 import { installConnector } from "./install.js";
 import { persistConfigMutation } from "../config/config-mutation.js";
 import { randomUUID } from "node:crypto";
@@ -22,6 +23,8 @@ init_transaction();
 init_session_repository();
 init_session_input_repository();
 init_connection_wait_repository();
+init_connector_repository();
+init_connector_account_repository();
 init_logger();
 const log = createLogger("Connectors:Recovery");
 const SCOPE_ORDER = {
@@ -88,12 +91,13 @@ var ConnectionRecoveryService = class {
 			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === need.connectorId);
 			const installation = getConnectorInstallation(`${need.connectorId}-${wait.principalId}`);
 			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
-			const blocked = scopeBlocked || instance?.enabled === false || installation?.enabled === false || Boolean(installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId));
 			const all = listConnectorConnections({
 				principalId: wait.principalId,
 				connectorId: need.connectorId
 			});
-			const eligible = all.filter((connection) => connection.status === "active" && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (!installation?.selectedConnectionIds.length || installation.selectedConnectionIds.includes(connection.id)));
+			const requested = need.accountId ? all.find((connection) => connection.accountId === need.accountId) : void 0;
+			const blocked = scopeBlocked || instance?.enabled === false || installation?.enabled === false || installation?.selectedAccountIds?.length === 0 || Boolean(installation && requested && !canAccessConnectorAccount(requested, installation, wait.agentId)) || Boolean(installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId));
+			const eligible = all.filter((connection) => connection.status === "active" && (!installation || canAccessConnectorAccount(connection, installation, wait.agentId)) && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (installation?.selectedAccountIds == null || Boolean(connection.accountId && installation.selectedAccountIds.includes(connection.accountId))));
 			const byAccount = /* @__PURE__ */ new Map();
 			for (const connection of eligible) {
 				const key = connection.accountId ?? connection.id;
@@ -102,7 +106,7 @@ var ConnectionRecoveryService = class {
 				if (!previous || connection.id === preferredId || previous.id !== preferredId && connection.updatedAt > previous.updatedAt) byAccount.set(key, connection);
 			}
 			const active = [...byAccount.values()];
-			const selected = !verifiedIds && need.unavailable ? void 0 : need.attempt ? active.find((connection) => connection.providerConnectionId === need.attempt?.connectionId) : need.connectionId ? active.find((connection) => connection.id === need.connectionId) : active.length === 1 && !need.accountSelector ? active[0] : void 0;
+			const selected = !verifiedIds && need.unavailable ? void 0 : need.attempt ? active.find((connection) => connection.providerConnectionId === need.attempt?.connectionId) : need.accountId ? active.find((connection) => connection.accountId === need.accountId) : need.connectionId ? active.find((connection) => connection.id === need.connectionId) : active.length === 1 && !need.accountSelector ? active[0] : void 0;
 			const phase = blocked || selected && need.capabilityError ? "blocked" : selected ? "ready" : active.length > 1 || need.accountSelector && active.length > 0 && !need.connectionId ? "choose_account" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable || all.some((connection) => [
 				"expired",
 				"revoked",
@@ -115,11 +119,12 @@ var ConnectionRecoveryService = class {
 			return {
 				...need,
 				alternatives,
+				accountId: selected?.accountId ?? need.accountId,
 				connectionId: selected?.id ?? need.connectionId,
 				phase,
 				accounts: active.map((connection) => ({
-					id: connection.id,
-					label: connection.alias ?? String(connection.identity.email ?? connection.identity.name ?? connection.id)
+					id: connection.accountId,
+					label: [getConnectorAccount(connection.accountId)?.label, connection.identity.email ?? connection.identity.name ?? connection.accountId].filter(Boolean).join(" · ")
 				})),
 				...need.capabilityError && selected ? { reason: need.capabilityError } : {},
 				...blocked ? { reason: scopeBlocked ? "This action needs broader permissions. Review connector permissions in settings." : "This app is disabled or unavailable to the current agent. Review connector settings." } : {}
@@ -154,7 +159,7 @@ var ConnectionRecoveryService = class {
 			allowedAgentIds: [],
 			maxScope: "read",
 			confirmationPolicy: "writes",
-			selectedConnectionIds: []
+			selectedAccountIds: null
 		});
 	}
 	async checkCapabilities(wait, verified) {
@@ -175,10 +180,15 @@ var ConnectionRecoveryService = class {
 				const definition = getConnectorDefinition(need.connectorId);
 				if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error("Unsupported connector");
 				const toolkit = definition.runtime.toolkit;
+				const selected = views.find((view) => view.key === need.key);
+				const connection = selected?.connectionId ? getConnectorConnection(selected.connectionId) : void 0;
 				const result = await (await this.adapter.createSession({
 					principalId: wait.principalId,
 					toolkits: [toolkit],
-					authConfigs: getConfiguredComposioAuthConfigs(this.deps.getConfig(), [toolkit])
+					backendId: selected?.accountId ? getConnectorAccount(selected.accountId)?.backendId : void 0,
+					...typeof connection?.metadata.providerPrincipalId === "string" ? { providerPrincipalId: connection.metadata.providerPrincipalId } : {},
+					...connection ? { connectedAccounts: { [toolkit]: [connection.providerConnectionId] } } : {},
+					authConfigs: typeof connection?.metadata.authConfigId === "string" ? { [toolkit]: connection.metadata.authConfigId } : void 0
 				})).search({
 					query: `${toolkit} ${need.capabilities.join(" ")} ${capabilityActions(need).flat().join(" ")}`,
 					toolkits: [toolkit]
@@ -303,6 +313,8 @@ var ConnectionRecoveryService = class {
 				const auth = await this.adapter.authorize({
 					principalId: wait.principalId,
 					toolkit: definition.runtime.toolkit,
+					expectedAccountId: need.accountId,
+					backendId: need.accountId ? getConnectorAccount(need.accountId)?.backendId : void 0,
 					installationId,
 					authConfigId: getConfiguredComposioAuthConfigs(config, [definition.runtime.toolkit])?.[definition.runtime.toolkit]
 				});
@@ -336,7 +348,7 @@ var ConnectionRecoveryService = class {
 				const latest = getConnectionWait(wait.id);
 				if (!latest || latest.version !== wait.version || latest.status !== "open") throw new Error("WAIT_CHANGED");
 				let needs = wait.needs.map((need) => {
-					const authorized = fresh.find((item) => item.providerConnectionId === need.attempt?.connectionId && item.status === "active");
+					const authorized = fresh.find((item) => item.providerConnectionId === need.attempt?.connectionId && item.status === "active" && item.connectorId === need.connectorId && (!need.accountId || item.accountId === need.accountId));
 					return authorized ? {
 						...need,
 						unavailable: false,
@@ -352,8 +364,8 @@ var ConnectionRecoveryService = class {
 				});
 				if (action.action === "select_account") {
 					const need = needs.find((item) => item.key === action.needKey);
-					const connection = fresh.find((item) => item.id === action.accountId && item.connectorId === need?.connectorId && item.status === "active");
-					if (!need || !connection || !this.view(wait, verified).needs.find((item) => item.key === need.key)?.accounts.some((item) => item.id === connection.id)) throw new Error("Account is unavailable.");
+					const connection = currentAccountConnections(fresh).find((item) => item.accountId === action.accountId && item.connectorId === need?.connectorId);
+					if (!need || !connection || !this.view(wait, verified).needs.find((item) => item.key === need.key)?.accounts.some((item) => item.id === connection.accountId)) throw new Error("Account is unavailable.");
 					needs = needs.map((item) => item.key === need.key ? {
 						...item,
 						connectionId: connection.id,

package/dist/src/connectors/connector-identity.d.ts

@@ -1,4 +1,6 @@
 import type { ConnectorConnection } from './types.js';
+/** Only verified display fields may enter model context or account summaries. */
+export declare function connectorIdentitySummary(identity: Record<string, unknown>): Record<string, string>;
 export declare function normalizeConnectorIdentity(toolkit: string, result: unknown): ConnectorConnection['identity'];
 export declare function connectorIdentityKey(toolkit: string, identity: Record<string, unknown>): string | undefined;
 export declare function mergeConnectorIdentity(toolkit: string, current: Record<string, unknown>, incoming: Record<string, unknown>): Record<string, unknown>;

package/dist/src/connectors/connector-identity.js

@@ -1,4 +1,17 @@
 //#region src/connectors/connector-identity.ts
+/** Only verified display fields may enter model context or account summaries. */
+function connectorIdentitySummary(identity) {
+	return Object.fromEntries([
+		"email",
+		"username",
+		"displayName",
+		"workspace",
+		"workspaceId",
+		"userId",
+		"enterpriseId",
+		"botUserId"
+	].flatMap((key) => typeof identity[key] === "string" && identity[key].trim() ? [[key, identity[key].slice(0, 320)]] : []));
+}
 function object(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	return value;
@@ -85,16 +98,16 @@ function mergeConnectorIdentity(toolkit, current, incoming) {
 		"googledrive",
 		"github",
 		"slack"
-	].includes(normalizedToolkit)) return {
+	].includes(normalizedToolkit)) return connectorIdentitySummary({
 		...current,
 		...incoming
-	};
+	});
 	const normalized = Object.fromEntries(Object.entries(normalizeConnectorIdentity(normalizedToolkit, incoming)).filter(([, value]) => value !== void 0 && value !== null && value !== ""));
-	return {
+	return connectorIdentitySummary({
 		...current,
 		...incoming,
 		...normalized
-	};
+	});
 }
 //#endregion
-export { connectorIdentityKey, mergeConnectorIdentity, normalizeConnectorIdentity };
+export { connectorIdentityKey, connectorIdentitySummary, mergeConnectorIdentity, normalizeConnectorIdentity };

package/dist/src/connectors/content-enrichment.js

@@ -1,5 +1,5 @@
-import { getKnowledgeSourceItem, listKnowledgeSourceItems, upsertKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import { getConnectorConnection, getConnectorInstallation } from "../storage/sqlite/connector-repository.js";
+import { getKnowledgeSourceItem, listKnowledgeSourceItems, upsertKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import "../storage/sqlite/index.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";

package/dist/src/connectors/instances.js

@@ -27,7 +27,7 @@ function connectorInstanceFromRecord(instanceId, record) {
 	const definition = connectorDefinitionFromManagedMarker(markerRecord) ?? getConnectorDefinition(connectorId);
 	const runtime = record.runtime && typeof record.runtime === "object" && !Array.isArray(record.runtime) ? record.runtime : {};
 	const runtimeType = runtime.type;
-	if (runtimeType !== "composio" && runtimeType !== "channel" && runtimeType !== "nativeTool" && runtimeType !== "memorySource") return [];
+	if (runtimeType !== "composio" && runtimeType !== "memorySource") return [];
 	if (runtimeType === "composio" && (typeof runtime.toolkit !== "string" || runtime.role !== "credential" && runtime.role !== "toolkit")) return [];
 	const enabled = markerRecord.enabled !== false;
 	return [{
@@ -47,12 +47,6 @@ function connectorInstanceFromRecord(instanceId, record) {
 			id: instanceId,
 			toolkit: runtime.toolkit,
 			role: runtime.role
-		} : runtimeType === "channel" ? {
-			type: "channel",
-			id: instanceId
-		} : runtimeType === "nativeTool" ? {
-			type: "nativeTool",
-			id: instanceId
 		} : {
 			type: "memorySource",
 			id: instanceId

package/dist/src/connectors/learning-coordinator.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { claimNextConnectorLearningJob, enqueueConnectorLearningJob, listConnectorLearningJobs, recoverStaleConnectorLearningJobs, setConnectorLearningPaused, updateConnectorLearningJob } from "../storage/sqlite/connector-learning-repository.js";
-import { getConnectorInstallation, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
 import { getConnectorAccount, reconcileConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
+import { getConnectorInstallation, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
 import { getConnectorSyncPolicyForConnection } from "../storage/sqlite/connector-sync-policy-repository.js";
 import "../storage/sqlite/index.js";
 import { connectorIdentityKey, normalizeConnectorIdentity } from "./connector-identity.js";
@@ -74,8 +74,9 @@ function startConnectorLearningCoordinator(options) {
 		const connection = listConnectorConnections().find((item) => item.id === connectionId && item.status === "active");
 		if (!connection) return null;
 		if (!connection.accountId) throw new Error(`Connector account is missing for connection ${connection.id}.`);
+		if (!getConnectorAccount(connection.accountId)?.enabled) return null;
 		const syncPolicy = getConnectorSyncPolicyForConnection(connection.id);
-		if (request.reason !== "manual" && syncPolicy?.scanEnabled === false) return null;
+		if (request.reason !== "manual" && syncPolicy?.scanEnabled !== true) return null;
 		const definition = getConnectorDefinition(connection.connectorId);
 		if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") return null;
 		if (!getConnectorLearningPlan(definition.runtime.toolkit)) return null;
@@ -275,7 +276,7 @@ function startConnectorLearningCoordinator(options) {
 			...retention
 		}, "Connected source retention pruned");
 		const syncPolicy = getConnectorSyncPolicyForConnection(job.connectionId);
-		if (syncPolicy?.scanEnabled === false) return;
+		if (syncPolicy?.scanEnabled !== true) return;
 		const intervalMinutes = syncPolicy?.intervalMinutes ?? plan.intervalMinutes;
 		const nextRunAt = Date.now() + intervalMinutes * 6e4;
 		enqueueConnection(getConnectorAccount(job.accountId)?.currentConnectionId ?? job.connectionId, {

package/dist/src/connectors/materialize.js

@@ -4,6 +4,7 @@ import { createConnectorSecretReference } from "./secret-store.js";
 init_schema();
 const SERVER_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
 const TEMPLATE_PATTERN = /^\{\{(secrets|config)\.([A-Za-z0-9_.-]+)\}\}$/;
+const EMBEDDED_SECRET_PATTERN = /\{\{secrets\.([A-Za-z0-9_.-]+)\}\}/g;
 function assertValidConnectorServerId(serverId) {
 	if (!SERVER_ID_PATTERN.test(serverId)) throw new Error("Connector server name must start with a lowercase letter and only contain lowercase letters, numbers, dashes, and underscores.");
 }
@@ -14,7 +15,19 @@ function readInputValue(definition, input, scope, key) {
 function resolveTemplateValue(value, definition, input) {
 	if (typeof value !== "string") return value;
 	const match = TEMPLATE_PATTERN.exec(value.trim());
-	if (!match) return value;
+	if (!match) {
+		const matches = [...value.matchAll(EMBEDDED_SECRET_PATTERN)];
+		if (matches.length === 0) return value;
+		if (matches.length > 1) throw new Error("Connector template values may contain at most one embedded secret.");
+		const embedded = matches[0];
+		const token = embedded[0];
+		const fieldKey = embedded[1];
+		const offset = embedded.index ?? 0;
+		return createConnectorSecretReference(definition.id, fieldKey, {
+			prefix: value.slice(0, offset),
+			suffix: value.slice(offset + token.length)
+		});
+	}
 	return readInputValue(definition, input, match[1], match[2]);
 }
 function materializeTemplate(value, definition, input) {

package/dist/src/connectors/policy.d.ts

@@ -8,6 +8,6 @@ export declare function evaluateConnectorExecutionPolicy(input: {
     installation: ConnectorInstallationPolicy;
     action: Pick<ConnectorActionMetadata, 'scope' | 'curated'>;
     agentId?: string;
-    connectionId?: string;
+    accountId?: string;
     confirmed?: boolean;
 }): ConnectorPolicyEvaluation;

package/dist/src/connectors/policy.js

@@ -21,7 +21,7 @@ function evaluateConnectorExecutionPolicy(input) {
 		decision: "denied",
 		reason: "Agent is not allowed to use this connector."
 	};
-	if (installation.selectedConnectionIds.length > 0 && (!input.connectionId || !installation.selectedConnectionIds.includes(input.connectionId))) return {
+	if (installation.selectedAccountIds !== null && (!input.accountId || !installation.selectedAccountIds.includes(input.accountId))) return {
 		decision: "denied",
 		reason: "Connection is not allowed by this connector policy."
 	};

package/dist/src/connectors/principal.js

@@ -1,17 +1,38 @@
+import { getSessionMetadata, init_session_repository } from "../storage/sqlite/session-repository.js";
 import { getConversationRouting } from "../storage/sqlite/conversation-repository.js";
 import { init_session_key } from "../routing/session-key.js";
 //#region src/connectors/principal.ts
 init_session_key();
+init_session_repository();
 function connectorPrincipalForSession(conversationId) {
-	const parsed = getConversationRouting(conversationId);
+	let parsed = getConversationRouting(conversationId);
+	const agentId = parsed?.agentId;
+	const visited = /* @__PURE__ */ new Set();
+	while (conversationId && parsed?.source === "workflow" && !visited.has(conversationId) && visited.size < 8) {
+		visited.add(conversationId);
+		const metadata = getSessionMetadata(conversationId);
+		const parent = metadata?.parentConversationId ?? metadata?.customData?.parentConversationId;
+		if (typeof parent !== "string") {
+			if (metadata?.sessionType === "workflow-run") return {
+				principalId: "local-owner",
+				agentId,
+				isLocalOwner: true
+			};
+			break;
+		}
+		const parentRouting = getConversationRouting(parent);
+		if (!parentRouting) break;
+		conversationId = parent;
+		parsed = parentRouting;
+	}
 	if (!parsed || parsed.source === "cli" || parsed.source === "webchat") return {
 		principalId: "local-owner",
-		agentId: parsed?.agentId,
+		agentId,
 		isLocalOwner: true
 	};
 	return {
 		principalId: `channel:${parsed.source}:${parsed.accountId}:${parsed.peerKind}:${parsed.peerId}`,
-		agentId: parsed.agentId,
+		agentId,
 		isLocalOwner: false
 	};
 }

package/dist/src/connectors/providers.d.ts

@@ -6,5 +6,6 @@ export type ConnectorProvider = {
 };
 export declare const builtinConnectorProvider: ConnectorProvider;
 export declare const composioConnectorProvider: ConnectorProvider;
+export declare const chinaConnectorProvider: ConnectorProvider;
 export declare function listConnectorProviders(): ConnectorProvider[];
 export declare function listConnectorProviderDefinitions(): ConnectorDefinition[];