onbuzz 4.9.0 → 4.9.5

package/src/services/__tests__/composioService.test.js

@@ -26,29 +26,75 @@ function makeStubApiKeyManager(initial = {}) {
 function makeStubClient() {
   return {
     toolkits: {
-      list: jest.fn().mockResolvedValue([
-        { slug: 'github', name: 'GitHub' },
-        { slug: 'slack',  name: 'Slack' },
-      ]),
+      // listToolkits no longer uses SDK methods (the SDK has no public
+      // `.list`, and `.get` drops the pagination cursor) — it goes via
+      // REST. Tests for listToolkits mock `global.fetch` instead.
     },
     tools: {
-      list: jest.fn().mockResolvedValue([
-        { slug: 'GITHUB_CREATE_AN_ISSUE', description: 'Create issue' },
-      ]),
+      // Same story — listTools uses REST.
       execute: jest.fn().mockResolvedValue({ successful: true, data: { issueNumber: 42 } }),
     },
+    authConfigs: {
+      // The connect path needs to look up or create an auth-config.
+      // Default: one already exists for the toolkit, so list returns it.
+      list:   jest.fn().mockResolvedValue({
+        items: [{ id: 'auth-cfg-existing', toolkitSlug: 'github' }],
+      }),
+      create: jest.fn().mockResolvedValue({ id: 'auth-cfg-new' }),
+    },
     connectedAccounts: {
       list:       jest.fn().mockResolvedValue([
         { id: 'conn-1', toolkitSlug: 'github', status: 'ACTIVE' },
         { id: 'conn-2', toolkitSlug: 'slack',  status: 'INITIATED' },
       ]),
       get:        jest.fn().mockResolvedValue({ id: 'conn-1', status: 'ACTIVE' }),
-      initiate:   jest.fn().mockResolvedValue({ id: 'conn-1', redirectUrl: 'https://connect.composio.dev/link/abc' }),
+      // The new endpoint replacing the deprecated `initiate`.
+      link:       jest.fn().mockResolvedValue({
+        id: 'conn-new',
+        redirectUrl: 'https://connect.composio.dev/link/abc',
+      }),
       delete:     jest.fn().mockResolvedValue({ success: true }),
     },
   };
 }
 
+/**
+ * Stub `global.fetch` to script REST responses, scoped to the test.
+ * Returns the spy so tests can assert calls. The returned cleanup
+ * function restores the original.
+ *
+ * Pages are consumed in order — each call to fetch returns the next
+ * page in the list, with `next_cursor` set on all but the last.
+ */
+function stubFetch(pagesPerPath) {
+  const original = global.fetch;
+  const calls = [];
+  // pagesPerPath: { '/api/v3.1/toolkits': [[item, item], [item, item]] }
+  const cursors = new Map(); // path → current page index
+  global.fetch = jest.fn(async (url) => {
+    const u = url instanceof URL ? url : new URL(String(url));
+    const path = u.pathname;
+    calls.push({ path, query: Object.fromEntries(u.searchParams) });
+    const pages = pagesPerPath[path];
+    if (!pages) {
+      return new Response(JSON.stringify({ error: `no stub for ${path}` }), { status: 404 });
+    }
+    const idx = cursors.get(path) || 0;
+    const items = pages[idx] || [];
+    const isLast = idx >= pages.length - 1;
+    cursors.set(path, idx + 1);
+    return new Response(JSON.stringify({
+      items,
+      next_cursor: isLast ? null : `cursor-${idx + 1}`,
+    }), { status: 200, headers: { 'content-type': 'application/json' } });
+  });
+  return {
+    fetch: global.fetch,
+    calls,
+    restore: () => { global.fetch = original; },
+  };
+}
+
 let savedApiKey;
 beforeEach(() => {
   savedApiKey = process.env.COMPOSIO_API_KEY;
@@ -148,23 +194,128 @@ describe('composioService — setApiKey + forgetApiKey', () => {
 });
 
 describe('composioService — listToolkits', () => {
-  test('returns the SDK list', async () => {
-    const client = makeStubClient();
-    composioService._injectClientForTests(client);
-    const r = await composioService.listToolkits();
-    expect(r.success).toBe(true);
-    expect(r.toolkits).toHaveLength(2);
-    expect(r.toolkits[0].slug).toBe('github');
-    expect(client.toolkits.list).toHaveBeenCalled();
+  // listToolkits used to call `client.toolkits.list()` — a method that
+  // doesn't actually exist on the @composio/core SDK. It silently
+  // returned `undefined`, which the normaliser converted to `[]`, so
+  // every agent saw "0 toolkits available" no matter what was enabled.
+  // The fix bypasses the SDK and calls REST directly so we can also
+  // follow cursor pagination (SDK's `toolkits.get` discards nextCursor).
+
+  test('paginates the REST endpoint until exhausted', async () => {
+    const stub = stubFetch({
+      '/api/v3.1/toolkits': [
+        [{ slug: 'github', name: 'GitHub', meta: { description: 'Repos' } },
+         { slug: 'slack',  name: 'Slack',  meta: { description: 'Messaging' } }],
+        [{ slug: 'canva',  name: 'Canva',  meta: { description: 'Design'    } }],
+      ],
+    });
+    try {
+      const r = await composioService.listToolkits({ force: true });
+      expect(r.success).toBe(true);
+      expect(r.toolkits.map(t => t.slug).sort()).toEqual(['canva', 'github', 'slack']);
+      // Two REST round-trips: page 1 (no cursor) + page 2 (with cursor).
+      const toolkitCalls = stub.calls.filter(c => c.path === '/api/v3.1/toolkits');
+      expect(toolkitCalls).toHaveLength(2);
+      expect(toolkitCalls[0].query.cursor).toBeUndefined();
+      expect(toolkitCalls[1].query.cursor).toBe('cursor-1');
+    } finally { stub.restore(); }
   });
 
-  test('surfaces SDK errors as success:false', async () => {
-    const client = makeStubClient();
-    client.toolkits.list = jest.fn().mockRejectedValue(new Error('rate limited'));
-    composioService._injectClientForTests(client);
-    const r = await composioService.listToolkits();
-    expect(r.success).toBe(false);
-    expect(r.error).toMatch(/rate limited/);
+  test('camelizes snake_case fields in the REST response', async () => {
+    const stub = stubFetch({
+      '/api/v3.1/toolkits': [[
+        {
+          slug: 'gh', name: 'GitHub',
+          is_local_toolkit: false,
+          auth_schemes: ['OAUTH2'],
+          composio_managed_auth_schemes: ['OAUTH2'],
+          no_auth: false,
+          meta: {
+            description: 'Code hosting',
+            tools_count: 42,
+            triggers_count: 3,
+            app_url: 'https://github.com',
+            created_at: '2024-01-01',
+            updated_at: '2024-12-31',
+          },
+        },
+      ]],
+    });
+    try {
+      const r = await composioService.listToolkits({ force: true });
+      expect(r.success).toBe(true);
+      const t = r.toolkits[0];
+      expect(t.slug).toBe('gh');
+      expect(t.isLocalToolkit).toBe(false);
+      expect(t.authSchemes).toEqual(['OAUTH2']);
+      expect(t.composioManagedAuthSchemes).toEqual(['OAUTH2']);
+      expect(t.noAuth).toBe(false);
+      expect(t.meta.toolsCount).toBe(42);
+      expect(t.meta.triggersCount).toBe(3);
+      expect(t.meta.appUrl).toBe('https://github.com');
+      expect(t.meta.createdAt).toBe('2024-01-01');
+      // Top-level description alias is the only "denormalised" field — it's
+      // there so the agent UI can show toolkit summaries without diving
+      // into .meta.
+      expect(t.description).toBe('Code hosting');
+    } finally { stub.restore(); }
+  });
+
+  test('surfaces REST errors as success:false', async () => {
+    const original = global.fetch;
+    global.fetch = jest.fn(async () => new Response(
+      JSON.stringify({ error: 'rate limited' }), { status: 429 }
+    ));
+    try {
+      const r = await composioService.listToolkits({ force: true });
+      expect(r.success).toBe(false);
+      expect(r.error).toMatch(/rate limited/);
+      expect(r.error).toMatch(/HTTP 429/);
+    } finally { global.fetch = original; }
+  });
+
+  test('caches the catalog for ~1 minute (avoid hammering REST in agent loops)', async () => {
+    const stub = stubFetch({
+      '/api/v3.1/toolkits': [[{ slug: 'gh', name: 'GitHub' }]],
+    });
+    try {
+      const r1 = await composioService.listToolkits({ force: true });
+      const r2 = await composioService.listToolkits();
+      expect(r1.toolkits).toHaveLength(1);
+      expect(r2.toolkits).toHaveLength(1);
+      expect(r2.cached).toBe(true);
+      // Only ONE REST call despite two listToolkits invocations.
+      expect(stub.calls.filter(c => c.path === '/api/v3.1/toolkits')).toHaveLength(1);
+    } finally { stub.restore(); }
+  });
+
+  test('key rotation drops the cache (next call hits REST with the new key)', async () => {
+    // Hand-rolled fetch stub: each call returns ONE complete (single-page)
+    // catalog response. The two listToolkits() invocations across the
+    // rotation should therefore produce two separate REST calls.
+    const responses = [
+      [{ slug: 'gh', name: 'GitHub' }],
+      [{ slug: 'sl', name: 'Slack'  }],
+    ];
+    const original = global.fetch;
+    const calls = [];
+    global.fetch = jest.fn(async (url) => {
+      const u = url instanceof URL ? url : new URL(String(url));
+      calls.push(u.pathname);
+      const items = responses.shift() ?? [];
+      return new Response(JSON.stringify({ items, next_cursor: null }), {
+        status: 200, headers: { 'content-type': 'application/json' },
+      });
+    });
+    try {
+      const r1 = await composioService.listToolkits({ force: true });
+      expect(r1.toolkits.map(t => t.slug)).toEqual(['gh']);
+      composioService.invalidateClientCache();
+      const r2 = await composioService.listToolkits();
+      // New REST round-trip after rotation — fresh response fires.
+      expect(r2.toolkits.map(t => t.slug)).toEqual(['sl']);
+      expect(calls.filter(p => p === '/api/v3.1/toolkits')).toHaveLength(2);
+    } finally { global.fetch = original; }
   });
 });
 
@@ -188,6 +339,46 @@ describe('composioService — listConnections', () => {
     expect(r.connections).toHaveLength(1);
     expect(r.connections[0].id).toBe('x');
   });
+
+  // Regression guard for the UI crash:
+  //   TypeError: (S.slug || "").toLowerCase is not a function
+  // The SDK returns `toolkit` as an OBJECT `{slug, name, ...}` (camelCased
+  // pass-through of the REST shape). The UI did `c.toolkitSlug || c.toolkit`,
+  // got the whole object as the "slug", then called `.toLowerCase()` on it
+  // and crashed. The service now always exposes a STRING `toolkitSlug` at
+  // the top level so callers never have to dig.
+  test('normalises connection.toolkit (object) → top-level toolkitSlug (string)', async () => {
+    const client = makeStubClient();
+    client.connectedAccounts.list = jest.fn().mockResolvedValue([
+      // SDK-style: toolkit is an object, no top-level toolkitSlug.
+      { id: 'c1', toolkit: { slug: 'canva', name: 'Canva' }, status: 'INITIATED' },
+      // Snake-case-style: toolkit_slug instead of toolkitSlug.
+      { id: 'c2', toolkit_slug: 'slack',                     status: 'ACTIVE'   },
+      // String fallback: toolkit is a bare string.
+      { id: 'c3', toolkit: 'github',                          status: 'ACTIVE'   },
+      // Already-normalised: toolkitSlug already a string.
+      { id: 'c4', toolkitSlug: 'notion',                      status: 'ACTIVE'   },
+    ]);
+    composioService._injectClientForTests(client);
+    const r = await composioService.listConnections('operator');
+    expect(r.success).toBe(true);
+    expect(r.connections).toHaveLength(4);
+    // Every connection has a string toolkitSlug — no objects sneaking through.
+    for (const c of r.connections) {
+      expect(typeof c.toolkitSlug).toBe('string');
+    }
+    expect(r.connections.map(c => c.toolkitSlug)).toEqual(['canva', 'slack', 'github', 'notion']);
+  });
+
+  test('returns empty toolkitSlug (not undefined/object) when nothing is extractable', async () => {
+    const client = makeStubClient();
+    client.connectedAccounts.list = jest.fn().mockResolvedValue([
+      { id: 'mystery', status: 'INITIATED' }, // no toolkit field at all
+    ]);
+    composioService._injectClientForTests(client);
+    const r = await composioService.listConnections('operator');
+    expect(r.connections[0].toolkitSlug).toBe('');
+  });
 });
 
 describe('composioService — connectionStatus', () => {
@@ -200,35 +391,186 @@ describe('composioService — connectionStatus', () => {
   });
 
   test('maps missing connection → connected:false', async () => {
+    // After the fix, connectionStatus uses .list({userId, toolkit})
+    // and filters client-side rather than calling .get(object) (which
+    // the SDK serializes to "[object Object]" in a URL path segment).
     const client = makeStubClient();
-    client.connectedAccounts.get = jest.fn().mockResolvedValue(null);
+    client.connectedAccounts.list = jest.fn().mockResolvedValue([]); // no connections
     composioService._injectClientForTests(client);
     const r = await composioService.connectionStatus('operator', 'github');
     expect(r.connected).toBe(false);
     expect(r.status).toBe('NOT_CONNECTED');
   });
+
+  test('uses connectedAccounts.list (not .get) — guards against the SDK "[object Object]" path-segment bug', async () => {
+    const client = makeStubClient();
+    // If anything calls .get with an object, the SDK would barf. The
+    // fix should NEVER reach .get for status lookups.
+    client.connectedAccounts.get = jest.fn(() => {
+      throw new Error('Path parameters result in path with invalid segments: [object Object]');
+    });
+    composioService._injectClientForTests(client);
+    const r = await composioService.connectionStatus('operator', 'github');
+    expect(r.success).toBe(true);
+    expect(client.connectedAccounts.get).not.toHaveBeenCalled();
+    expect(client.connectedAccounts.list).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'operator', toolkit: 'github' })
+    );
+  });
+
+  test('handles wrapped {items:[]} response shape from the SDK', async () => {
+    // The Composio TS SDK returns paginated wrappers; the fix
+    // normalises Array | {items} | {data} → flat Array.
+    const client = makeStubClient();
+    client.connectedAccounts.list = jest.fn().mockResolvedValue({
+      items: [{ id: 'conn-1', toolkitSlug: 'github', status: 'ACTIVE' }],
+    });
+    composioService._injectClientForTests(client);
+    const r = await composioService.connectionStatus('operator', 'github');
+    expect(r.connected).toBe(true);
+    expect(r.connectionId).toBe('conn-1');
+  });
 });
 
 describe('composioService — connect', () => {
-  test('forwards userId + toolkit and returns the connect link', async () => {
+  // History:
+  //   v0: called connectedAccounts.initiate({obj}) — wrong shape; threw
+  //       "authConfigIds.0 should be a string …".
+  //   v1: switched to client.toolkits.authorize(userId, slug, authConfigId)
+  //       — that worked locally but Composio deprecated the endpoint it
+  //       calls last (POST /connected_accounts) on 2026-05-28. Started
+  //       returning 400 ConnectedAccount_BadRequest with the message
+  //       "Use POST /api/v3/connected_accounts/link instead".
+  //   v2 (current): replicate authorize's auth-config find-or-create
+  //       flow ourselves, then finish with connectedAccounts.link()
+  //       — the SDK method that maps to the new endpoint.
+
+  test('reuses an existing auth-config and calls the link endpoint', async () => {
     const client = makeStubClient();
     composioService._injectClientForTests(client);
     const r = await composioService.connect('operator', 'github');
     expect(r.success).toBe(true);
     expect(r.connectLink).toMatch(/^https:\/\/connect\.composio\.dev/);
-    expect(r.connectionId).toBe('conn-1');
-    expect(client.connectedAccounts.initiate).toHaveBeenCalledWith({
-      userId: 'operator', toolkit: 'github',
+    expect(r.connectionId).toBe('conn-new');
+    expect(r.authConfigId).toBe('auth-cfg-existing');
+    expect(r.usedExistingConfig).toBe(true);
+    // The deprecated path (.initiate) must NEVER be called.
+    expect(client.connectedAccounts.initiate).toBeUndefined();
+    expect(client.connectedAccounts.link).toHaveBeenCalledWith(
+      'operator', 'auth-cfg-existing', {}
+    );
+    // Didn't try to create a new one — there was already a hit.
+    expect(client.authConfigs.create).not.toHaveBeenCalled();
+  });
+
+  test('creates a managed auth-config when none exists for the toolkit', async () => {
+    const client = makeStubClient();
+    client.authConfigs.list = jest.fn().mockResolvedValue({ items: [] });
+    composioService._injectClientForTests(client);
+    const r = await composioService.connect('operator', 'canva');
+    expect(r.success).toBe(true);
+    expect(r.authConfigId).toBe('auth-cfg-new');
+    expect(r.createdConfig).toBe(true);
+    expect(client.authConfigs.create).toHaveBeenCalledWith('canva', {
+      type: 'use_composio_managed_auth',
+      name: 'canva Auth Config',
     });
+    expect(client.connectedAccounts.link).toHaveBeenCalledWith(
+      'operator', 'auth-cfg-new', {}
+    );
+  });
+
+  test('passes through an explicit authConfigId (skips lookup + create)', async () => {
+    const client = makeStubClient();
+    composioService._injectClientForTests(client);
+    await composioService.connect('operator', 'github', { authConfigId: 'auth-cfg-explicit' });
+    expect(client.authConfigs.list).not.toHaveBeenCalled();
+    expect(client.authConfigs.create).not.toHaveBeenCalled();
+    expect(client.connectedAccounts.link).toHaveBeenCalledWith(
+      'operator', 'auth-cfg-explicit', {}
+    );
   });
 
-  test('passes through authConfigId when provided', async () => {
+  test('forwards callbackUrl to the link options', async () => {
     const client = makeStubClient();
     composioService._injectClientForTests(client);
-    await composioService.connect('operator', 'github', { authConfigId: 'auth-cfg-xyz' });
-    expect(client.connectedAccounts.initiate).toHaveBeenCalledWith({
-      userId: 'operator', toolkit: 'github', authConfigId: 'auth-cfg-xyz',
+    await composioService.connect('operator', 'github', {
+      authConfigId: 'auth-cfg-xyz', callbackUrl: 'https://app.example.com/oauth/cb',
     });
+    expect(client.connectedAccounts.link).toHaveBeenCalledWith(
+      'operator', 'auth-cfg-xyz', { callbackUrl: 'https://app.example.com/oauth/cb' }
+    );
+  });
+
+  test('returns a clean error if the SDK is missing connectedAccounts.link', async () => {
+    const client = makeStubClient();
+    delete client.connectedAccounts.link;
+    composioService._injectClientForTests(client);
+    const r = await composioService.connect('operator', 'github');
+    expect(r.success).toBe(false);
+    expect(r.error).toMatch(/missing connectedAccounts\.link/);
+  });
+
+  test('authConfigs.create 400 → actionable "no managed-OAuth client" hint', async () => {
+    // Composio returns 400 when no managed OAuth client exists for the
+    // toolkit. The operator needs to register one in the dashboard.
+    const client = makeStubClient();
+    client.authConfigs.list = jest.fn().mockResolvedValue({ items: [] });
+    const err = new Error('No default auth config found for toolkit canva');
+    err.status = 400;
+    client.authConfigs.create = jest.fn().mockRejectedValue(err);
+    composioService._injectClientForTests(client);
+    const r = await composioService.connect('operator', 'canva');
+    expect(r.success).toBe(false);
+    expect(r.code).toBe('COMPOSIO_AUTH_CONFIG_MISSING');
+    expect(r.error).toMatch(/no managed-OAuth client/i);
+    expect(r.error).toMatch(/canva/);
+    expect(r.error).toMatch(/app\.composio\.dev/);
+    expect(r.rawError).toMatch(/No default auth config/);
+  });
+
+  test('link() "toolkit not found" → actionable slug-mismatch hint', async () => {
+    const client = makeStubClient();
+    client.connectedAccounts.link = jest.fn().mockRejectedValue(
+      new Error('ComposioToolkitNotFoundError: Toolkit with slug canva_design not found')
+    );
+    composioService._injectClientForTests(client);
+    const r = await composioService.connect('operator', 'canva_design');
+    expect(r.success).toBe(false);
+    expect(r.code).toBe('COMPOSIO_TOOLKIT_NOT_FOUND');
+    expect(r.error).toMatch(/doesn't exist in Composio's catalog/);
+    expect(r.error).toMatch(/list-toolkits/);
+  });
+
+  test('unrelated SDK errors pass through unchanged with authConfigId attached', async () => {
+    const client = makeStubClient();
+    client.connectedAccounts.link = jest.fn().mockRejectedValue(new Error('rate limit hit'));
+    composioService._injectClientForTests(client);
+    const r = await composioService.connect('operator', 'github');
+    expect(r.success).toBe(false);
+    expect(r.code).toBeUndefined();
+    expect(r.error).toMatch(/rate limit hit/);
+    // We still know which auth-config we were trying to link — surface
+    // it so the operator can debug.
+    expect(r.authConfigId).toBe('auth-cfg-existing');
+  });
+});
+
+describe('composioService — _normalizeListResult', () => {
+  test('returns plain arrays unchanged', () => {
+    expect(composioService._normalizeListResult([1, 2, 3])).toEqual([1, 2, 3]);
+    expect(composioService._normalizeListResult([])).toEqual([]);
+  });
+  test('unwraps {items}, {data}, {results} shapes', () => {
+    expect(composioService._normalizeListResult({ items: [1] })).toEqual([1]);
+    expect(composioService._normalizeListResult({ data: [2] })).toEqual([2]);
+    expect(composioService._normalizeListResult({ results: [3] })).toEqual([3]);
+  });
+  test('non-list-shaped / falsy inputs → []', () => {
+    expect(composioService._normalizeListResult(null)).toEqual([]);
+    expect(composioService._normalizeListResult(undefined)).toEqual([]);
+    expect(composioService._normalizeListResult('string')).toEqual([]);
+    expect(composioService._normalizeListResult({ unknown: true })).toEqual([]);
   });
 });
 
@@ -241,12 +583,17 @@ describe('composioService — disconnect', () => {
     expect(client.connectedAccounts.delete).toHaveBeenCalledWith('conn-1');
   });
 
-  test('disconnect by {userId, toolkitSlug} looks up the id first', async () => {
+  test('disconnect by {userId, toolkitSlug} looks up the id via .list (not .get)', async () => {
+    // The lookup now uses .list({userId, toolkit}) + client-side
+    // filter — same fix as connectionStatus to avoid the SDK
+    // "[object Object]" path-segment trap.
     const client = makeStubClient();
     composioService._injectClientForTests(client);
     const r = await composioService.disconnect({ userId: 'operator', toolkitSlug: 'github' });
     expect(r.success).toBe(true);
-    expect(client.connectedAccounts.get).toHaveBeenCalledWith({ userId: 'operator', toolkit: 'github' });
+    expect(client.connectedAccounts.list).toHaveBeenCalledWith(
+      expect.objectContaining({ userId: 'operator', toolkit: 'github' })
+    );
     expect(client.connectedAccounts.delete).toHaveBeenCalledWith('conn-1');
   });
 
@@ -259,7 +606,7 @@ describe('composioService — disconnect', () => {
 
   test('handles missing connection cleanly when looking up by toolkit', async () => {
     const client = makeStubClient();
-    client.connectedAccounts.get = jest.fn().mockResolvedValue(null);
+    client.connectedAccounts.list = jest.fn().mockResolvedValue([]); // no connections
     composioService._injectClientForTests(client);
     const r = await composioService.disconnect({ userId: 'operator', toolkitSlug: 'github' });
     expect(r.success).toBe(false);
@@ -268,20 +615,55 @@ describe('composioService — disconnect', () => {
 });
 
 describe('composioService — listTools', () => {
-  test('forwards toolkit + userId', async () => {
-    const client = makeStubClient();
-    composioService._injectClientForTests(client);
-    const r = await composioService.listTools('github', 'operator');
-    expect(r.success).toBe(true);
-    expect(r.tools[0].slug).toBe('GITHUB_CREATE_AN_ISSUE');
-    expect(client.tools.list).toHaveBeenCalledWith({ toolkit: 'github', userId: 'operator' });
+  // Same story as listToolkits — the SDK's `client.tools.list` is
+  // internal-only; the public `tools.get(userId, filter)` wraps results
+  // in the LLM provider's format (function-calling shape) and strips
+  // toolkitSlug/displayName. We need the raw catalog shape, so we call
+  // REST directly.
+
+  test('forwards toolkit_slugs + user_id to REST', async () => {
+    const stub = stubFetch({
+      '/api/v3.1/tools': [[
+        { slug: 'GITHUB_CREATE_AN_ISSUE', display_name: 'Create Issue',
+          description: 'Create issue', input_parameters: { type: 'object' },
+          toolkit: { slug: 'github' } },
+      ]],
+    });
+    try {
+      const r = await composioService.listTools('github', 'operator');
+      expect(r.success).toBe(true);
+      expect(r.tools).toHaveLength(1);
+      expect(r.tools[0].slug).toBe('GITHUB_CREATE_AN_ISSUE');
+      expect(r.tools[0].displayName).toBe('Create Issue');
+      expect(r.tools[0].toolkitSlug).toBe('github');
+      // input_parameters → camelCase + aliases for legacy callers.
+      expect(r.tools[0].inputParameters).toEqual({ type: 'object' });
+      expect(r.tools[0].input).toEqual({ type: 'object' });
+      expect(r.tools[0].parameters).toEqual({ type: 'object' });
+      const call = stub.calls.find(c => c.path === '/api/v3.1/tools');
+      expect(call.query.toolkit_slugs).toBe('github');
+      expect(call.query.user_id).toBe('operator');
+    } finally { stub.restore(); }
   });
 
-  test('omits userId from the SDK call when not provided', async () => {
-    const client = makeStubClient();
-    composioService._injectClientForTests(client);
-    await composioService.listTools('github');
-    expect(client.tools.list).toHaveBeenCalledWith({ toolkit: 'github' });
+  test('omits user_id from the REST query when not provided', async () => {
+    const stub = stubFetch({
+      '/api/v3.1/tools': [[
+        { slug: 'X', toolkit: { slug: 'github' } },
+      ]],
+    });
+    try {
+      await composioService.listTools('github');
+      const call = stub.calls.find(c => c.path === '/api/v3.1/tools');
+      expect(call.query.toolkit_slugs).toBe('github');
+      expect(call.query.user_id).toBeUndefined();
+    } finally { stub.restore(); }
+  });
+
+  test('rejects empty toolkitSlug with a clean error', async () => {
+    const r = await composioService.listTools('');
+    expect(r.success).toBe(false);
+    expect(r.error).toMatch(/toolkitSlug is required/);
   });
 });
 

package/src/services/__tests__/telegramService.test.js

@@ -559,6 +559,97 @@ describe('error fan-out vs watch-gating', () => {
     expect(sent).toBeDefined();
   });
 
+  test('agent_error dedup: identical errors within the window only send once', async () => {
+    const svc = makeService();
+    const bot = await connected(svc);
+    await bot.simulateMessage(userMsg(111, '/start'));
+
+    const payload = { type: 'agent_error', agentId: 'a1', agentName: 'Cody', message: 'boom' };
+    await svc._handleBroadcastEvent(payload);
+    await svc._handleBroadcastEvent(payload);
+    await svc._handleBroadcastEvent(payload);
+    await svc._handleBroadcastEvent(payload);
+
+    const errorMessages = bot.calls.sendMessage.filter(c => c.text.includes('Agent Error'));
+    // Only the first one should have made it through; the next three are
+    // counted but suppressed.
+    expect(errorMessages).toHaveLength(1);
+    // Dedup state confirms three were absorbed.
+    const entry = [...svc._errorBroadcastDedup.values()][0];
+    expect(entry?.count).toBe(4);
+  });
+
+  test('agent_error dedup: different agents do NOT collide', async () => {
+    const svc = makeService();
+    const bot = await connected(svc);
+    await bot.simulateMessage(userMsg(111, '/start'));
+
+    await svc._handleBroadcastEvent({ type: 'agent_error', agentId: 'a1', agentName: 'Cody',  message: 'same' });
+    await svc._handleBroadcastEvent({ type: 'agent_error', agentId: 'a2', agentName: 'Carol', message: 'same' });
+
+    const errorMessages = bot.calls.sendMessage.filter(c => c.text.includes('Agent Error'));
+    expect(errorMessages).toHaveLength(2);
+  });
+
+  test('agent_error dedup: textual variations of same error coalesce', async () => {
+    const svc = makeService();
+    const bot = await connected(svc);
+    await bot.simulateMessage(userMsg(111, '/start'));
+
+    // Same error, formatted slightly differently — should dedup.
+    await svc._handleBroadcastEvent({ type: 'agent_error', agentId: 'a1', message: 'Connection refused' });
+    await svc._handleBroadcastEvent({ type: 'agent_error', agentId: 'a1', message: 'connection refused' });
+    await svc._handleBroadcastEvent({ type: 'agent_error', agentId: 'a1', message: '  Connection   refused  ' });
+
+    const errorMessages = bot.calls.sendMessage.filter(c => c.text.includes('Agent Error'));
+    expect(errorMessages).toHaveLength(1);
+  });
+
+  test('agent_error dedup: window close emits a "still happening" summary when count > 1', async () => {
+    jest.useFakeTimers();
+    try {
+      const svc = makeService();
+      const bot = await connected(svc);
+      await bot.simulateMessage(userMsg(111, '/start'));
+
+      // First fires immediately, plus two suppressed.
+      await svc._handleBroadcastEvent({ type: 'agent_error', agentId: 'a1', agentName: 'Cody', message: 'boom' });
+      await svc._handleBroadcastEvent({ type: 'agent_error', agentId: 'a1', agentName: 'Cody', message: 'boom' });
+      await svc._handleBroadcastEvent({ type: 'agent_error', agentId: 'a1', agentName: 'Cody', message: 'boom' });
+
+      // Advance past the 5-minute dedup window.
+      jest.advanceTimersByTime(5 * 60 * 1000 + 100);
+      // Let the timer callback's microtasks resolve.
+      await Promise.resolve();
+      await Promise.resolve();
+
+      const summary = bot.calls.sendMessage.find(c => c.text.includes('still happening'));
+      expect(summary).toBeDefined();
+      expect(summary.text).toMatch(/2 more/);
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
+  test('agent_error dedup: a single error does NOT trigger a summary', async () => {
+    jest.useFakeTimers();
+    try {
+      const svc = makeService();
+      const bot = await connected(svc);
+      await bot.simulateMessage(userMsg(111, '/start'));
+
+      await svc._handleBroadcastEvent({ type: 'agent_error', agentId: 'a1', message: 'one-off' });
+      jest.advanceTimersByTime(5 * 60 * 1000 + 100);
+      await Promise.resolve();
+
+      // The original message went out. No follow-up summary.
+      const summary = bot.calls.sendMessage.find(c => c.text.includes('still happening'));
+      expect(summary).toBeUndefined();
+    } finally {
+      jest.useRealTimers();
+    }
+  });
+
   test('execution_stopped does NOT relay unless /watch is on', async () => {
     const svc = makeService();
     const bot = await connected(svc);