Replace Composio Connect with project sessions

[milind-soni]

What changed

• replace the legacy Composio Connect consumer-key flow with one Composio project key and a reusable Composio Session
• use the current Sessions APIs for toolkit status, browser auth links, disconnect/revoke, and the agent MCP endpoint
• validate the project key before saving and automatically recover a deleted Session
• keep the project key out of the packaged app's JSON config by encrypting it with Electron safeStorage
• remove stale legacy Connect fields during packaged-app upgrade
• simplify Settings to one Composio credential and add a self-host setup guide
• bump the release version to 0.1.22 and rebuild the packaged server output

Why

Fresh installs could not use connected apps because the UI still asked for the old Connect key, while current Composio projects use project API keys and Sessions. The old split-key setup also made onboarding needlessly confusing.

User impact

A self-hosting user now creates or copies one ak_… project key, pastes it once, and connects providers from the Connected apps screen. Provider OAuth tokens remain in Composio; OpenMausBot stores only its project key and non-secret Session identifiers.

The packaged desktop app encrypts the project key with the operating system credential store. Source/headless installs can use COMPOSIO_API_KEY.

Validation

• pnpm test: 471 passed, 8 skipped
• updater tests: 11 passed
• focused Composio/server tests: 71 passed, 1 skipped
• pnpm typecheck
• pnpm check:electron
• pnpm build
• pnpm package:prepare
• git diff --check

Remaining live check

One real provider authorization should be completed with a real Composio project key before marking this ready for merge.

Summary by CodeRabbit

• New Features

  • Composio now uses reusable Sessions for connected-app access, authorization, status checks, and account removal.
  • Added project API key configuration through App Settings.
  • Added secure OS-backed storage for Composio credentials in packaged desktop builds.
  • Added session reuse and recovery for more reliable connections.

• Bug Fixes

  • Improved handling of connection status, authentication links, and session errors.

• Documentation

  • Updated setup guidance, terminology, permissions, credential storage, and session management instructions.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 11cb284c-3e0a-484a-84bb-e2a74ee67ad6

📥 Commits

Reviewing files that changed from the base of the PR and between d579795 and 8d7840a.

📒 Files selected for processing (25)

• README.md
• dist-server/composio.js
• dist-server/config.js
• dist-server/drivers/claude.js
• dist-server/index.js
• dist-server/redact.js
• docs/composio.md
• electron/main.mjs
• electron/preload.cjs
• package.json
• server/composio.test.ts
• server/composio.ts
• server/config.ts
• server/contracts.ts
• server/drivers/claude.test.ts
• server/drivers/claude.ts
• server/index.test.ts
• server/index.ts
• server/redact.test.ts
• server/redact.ts
• src/components/ApiKeys.tsx
• src/components/PluginsPanel.tsx
• src/components/SettingsModal.tsx
• src/state/store.tsx
• src/types/ogb.d.ts

---

📝 Walkthrough

Walkthrough

Composio integration now uses project API keys and reusable Sessions. The server persists Session metadata, supports external secret storage, and exposes Session-based MCP and toolkit operations. Electron stores keys securely, while the UI and documentation use Composio Sessions terminology.

Changes

Composio Sessions integration

Layer / File(s)	Summary
Session and toolkit API layer server/composio.ts, dist-server/composio.js, server/config.ts, dist-server/config.js, server/contracts.ts, server/composio.test.ts	Project keys are validated and used to retrieve or create reusable Sessions. MCP configuration comes from the Session. Toolkit status, authorization, removal, and catalog requests use direct Session APIs.
Configuration persistence and server wiring server/index.ts, dist-server/index.js, server/index.test.ts	Configuration updates validate project keys, persist Session metadata, support external secret storage, and pass Session integrations to connectors.
Secure credential storage and settings UI electron/main.mjs, electron/preload.cjs, src/types/ogb.d.ts, src/components/ApiKeys.tsx, src/components/SettingsModal.tsx, src/state/store.tsx	Packaged Electron builds encrypt Composio keys with safeStorage. The settings UI saves project keys through the new credential bridge.
Driver, documentation, and terminology updates server/drivers/claude.ts, dist-server/drivers/claude.js, server/drivers/claude.test.ts, server/redact.ts, dist-server/redact.js, server/redact.test.ts, docs/composio.md, README.md, src/components/PluginsPanel.tsx, package.json	Claude MCP setup forwards Session URL and headers. Tests, documentation, UI copy, and README references use project keys and Composio Sessions.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant SettingsUI
  participant ElectronIPC
  participant ServerConfig
  participant ComposioSessions
  participant ClaudeDriver
  SettingsUI->>ElectronIPC: setCredential("composioApiKey", value)
  ElectronIPC->>ServerConfig: update Composio configuration
  ServerConfig->>ComposioSessions: validate or create Session
  ComposioSessions-->>ServerConfig: Session metadata
  ServerConfig-->>ElectronIPC: configured status
  ClaudeDriver->>ServerConfig: request Composio integration
  ServerConfig->>ComposioSessions: retrieve Session MCP details
  ComposioSessions-->>ClaudeDriver: MCP URL and x-api-key headers

Loading

Possibly related PRs

• milind-soni/OpenMausBot#36: Modifies Composio MCP integration mounting and configuration.
• milind-soni/OpenMausBot#61: Shares MCP integration seams in the server contracts, driver, and index.
• milind-soni/OpenMausBot#130: Shares Composio credential handling changes in the Claude driver and tests.

Suggested reviewers: kesleydavid, anicetngrt

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/composio-session-byok

---

_{Comment @coderabbitai help to get the list of available commands.}