This PR:
- replaces https://github.com/ComposioHQ/composio/pull/4474 (D5), which
was merged into the D2 branch by mistake and conflicted with the
rewritten permissions reference on `next`;
https://github.com/ComposioHQ/composio/pull/4471 has been trimmed back
to D2 only
- rewrites the change against the current "Session tool execution" /
"Proxy execute (Legacy)" layout instead of the pre-rewrite page the
original targeted
- Session tool execution: drops the
`/tool_router/session/{session_id}/proxy_execute` row and says proxy
execution is not included; Proxy execute (Legacy): states it is the only
permission that grants the session proxy route, from
`session.proxyExecute()` or from the session's sandbox
- Proxy execute page callout: requires Proxy execute; Session tool
execution alone does not cover it
- KB article `platform-project-api-key-permissions` (source under
`docs/kb/articles`, generated guide regenerated with `bun run
generate:kb`): same correction
- merge after: ComposioHQ/platform#12846. Until it deploys, `next` is
correct and this page must not go live. Kept as a draft for that reason
PRD:
https://app.notion.com/p/composio/Session-Governance-via-hints-Across-toolkits-3daf261a6dfe80df8e0ce337a2b26e08
Linear workstream:
https://linear.app/composio/project/sessions-execution-governance-a0942233a0d0
Verification, run in `docs/` on this branch: `bun run types:check`
passes, `bun run lint:links` reports 0 errors. `pnpm exec prettier
--check` flags the touched mdx files on `next` already, so no
reformatting was applied.
Automated knowledge-base refresh for `ComposioHQ/support-knowledge`.
- Source commit: `5eac683455ff252a7a3b62f33ab6566445009b52` (unchanged;
rebuilt a stale semantic artifact)
- Regenerated public KB pages and search records
- Reused unchanged vectors and rebuilt the checked semantic artifact
- Ran KB freshness and semantic-artifact verification
Co-authored-by: sohambasu963 <80603154+sohambasu963@users.noreply.github.com>
Automated knowledge-base refresh for `ComposioHQ/support-knowledge`.
- Source commit: `5eac683455ff252a7a3b62f33ab6566445009b52` (unchanged;
rebuilt a stale semantic artifact)
- Regenerated public KB pages and search records
- Reused unchanged vectors and rebuilt the checked semantic artifact
- Ran KB freshness and semantic-artifact verification
Strava is no longer in the toolkit catalog (public/data/toolkits*.json
has no strava entry), so drop its orphaned FAQ page, KB guide, and
KB source/manifest/registry entries.
kb/semantic-index.json will go stale from the manifest change; it
regenerates via the existing "Docs - Rebuild KB Semantic Artifact"
workflow (or `bun run build:kb-semantic`).
Automated knowledge-base refresh for `ComposioHQ/support-knowledge`.
- Source commit: `5eac683455ff252a7a3b62f33ab6566445009b52` (unchanged;
rebuilt a stale semantic artifact)
- Regenerated public KB pages and search records
- Reused unchanged vectors and rebuilt the checked semantic artifact
- Ran KB freshness and semantic-artifact verification
Co-authored-by: sohambasu963 <80603154+sohambasu963@users.noreply.github.com>
This PR:
- Closes https://github.com/ComposioHQ/composio/issues/4343
- stamps eve's durable callback descriptors on every tool `EveProvider`
wraps, via the new internal `withDurableClosure(closure, callback)`
helper — eve only stamps them on `defineTool` calls its build transform
finds in the agent's own source, which never runs on this package inside
`node_modules`, so eve discarded the whole resolver result and the agent
silently lost every Composio tool
- persists `{ slug, binding }` per callback, where `binding` is an id
minted per `wrapTools` call and prefixed with a per-process token, and
re-attaches it to that resolve's Composio executor through a
module-level binding map. `executeTool` is bound to one Composio
session, so a slug-only closure would have routed a call to whichever
session resolved last; sessions for different users share one provider,
and eve's callback registry is keyed by tool name only, so the map lives
at module level rather than on the instance
- covers `execute` and, when `needsApproval` is set, `approvalRequest`;
the descriptor key is the global-registry symbol
`Symbol.for('eve:durable-dynamic-callback')`, so no eve internal is
imported and the stamp is inert on eve versions that predate the
contract
- adds 9 regression tests: descriptor presence and shape,
JSON-serializability of the closure, replay of execute and approval from
the closure alone, per-resolve executor isolation when sessions share a
provider, hooks of the producing provider on replay, the unknown-slug
and unknown-binding errors, that two fresh module instances never mint
the same binding id, and one suite that loads eve 0.52.1's own
`validateDurableDynamicToolCallbacks`, `replayDynamicTools`, and
callback registry from the installed package to validate and replay a
wrapped tool end to end. Before the change eve threw `Dynamic tool "..."
callback "execute" does not have a durable descriptor`
## Context
The reporter hit this on eve 0.50 as `non-serializable capture`; 0.52.1
reports the same root cause as a missing descriptor. eve exports no
public durable-callback helper (tracked at vercel/eve#2967), so the
provider stamps the descriptor itself rather than pinning users to an
older eve.
Bindings are kept for the life of the process: eve can resume a parked
call at any time. A binding lives only in the process that resolved the
tools, so a call parked across a restart cannot be replayed; the
per-process token in the id makes the stale closure fail the lookup
loudly instead of matching whichever resolve reused its counter value in
the new process. Growth is one entry per `session.tools()` resolve.
Docs (`/docs/providers/eve`) now state the contract, the restart limit,
and the real reason the `step.started` resolver runs each step
(principal re-evaluation and retry, cached per session).
Also unblocks `Docs - Tests` on this branch: the catalog refresh in
#4330 renamed Stripe's triggers, so the Stripe knowledge-base guide
cited two dead slugs and the corpus verifier failed for any PR touching
docs. The guide now cites only the renamed slug the catalog lists, and
`generate-toolkits.ts` fetches trigger types with `limit=1000` so the
catalog stops truncating every toolkit to its first 20 triggers.
https://claude.ai/code/session_019wRk1S4Z6V6FWr4UsybGvR
EOF -R ComposioHQ/composio
This PR:
- builds on [#4362](https://github.com/ComposioHQ/composio/pull/4362)
([Glen review](https://app.tryglen.com/ComposioHQ/composio/pull/4362))
and targets its branch so only the review fixes appear in the diff
- relates to
[DEVREL-42](https://linear.app/composio/issue/DEVREL-42/add-agent-first-setup-flow-to-composio-docs)
- links the Claude Code, Codex, and OpenClaw client sections to the
plugin or personal-access instructions advertised by their cards
- clarifies that OpenClaw discovers project-installed skills in its
configured or selected execution workspace, and documents the default
directory and global alternative
- regenerates the 901-record semantic search index for the updated
documentation
Validation: all 28 focused docs tests passed locally. On `4a1017722`, CI
passed link validation, semantic-index freshness, the full docs test
job, and TypeScript/build checks. The temporary artifact-only workflow
option was removed; the final diff contains only the docs correction and
generated index.
Alberto Schiabel