Skip to content

docs: update toolkits, API spec, and meta tools data - #4330

Merged
Alberto Schiabel (jkomyno) merged 1 commit into
nextfrom
docs/auto-update-data
Sep 8, 2026
Merged

docs: update toolkits, API spec, and meta tools data#4330
Alberto Schiabel (jkomyno) merged 1 commit into
nextfrom
docs/auto-update-data

Conversation

@sdkrelease

@sdkrelease sdkrelease Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Summary

Automated sync of backend data into the docs site.

  • Trigger: schedule
  • Dispatch action: n/a
  • Source commit: n/a

What changed

  • Toolkit catalog (docs/public/data/toolkits.json, toolkits-list.json) — refreshed list of available toolkits, auth schemes, and tools from the backend API
  • OpenAPI specs (docs/public/openapi.json, docs/public/openapi-v3.json, docs/public/openapi-webhooks.json) — latest v3.1 and v3.0 API specifications plus the webhook-events spec, fetched from production
  • API reference pages (docs/content/reference/api-reference/, docs/content/reference/v3/api-reference/) — regenerated index pages for both API versions
  • Meta tools reference (docs/public/data/meta-tools.json, docs/content/toolkits/meta-tools/*.mdx) — updated meta tool schemas and reference docs

@vercel

vercel Bot commented Sep 2, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs Ready Ready Preview Sep 8, 2026 3:06pm UTC

Request Review

@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 50329f3 to 7309979 Compare September 2, 2026 10:04
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 7309979 to 611b4f4 Compare September 2, 2026 15:06
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 611b4f4 to 29aa401 Compare September 3, 2026 00:05
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 29aa401 to 92db49e Compare September 3, 2026 10:04
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 92db49e to 7211b66 Compare September 3, 2026 15:04
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 7211b66 to 68eb860 Compare September 3, 2026 20:05
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 68eb860 to 5d5c9de Compare September 4, 2026 00:08
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 5d5c9de to dce2675 Compare September 4, 2026 05:06
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from dce2675 to 2ac2ca1 Compare September 4, 2026 10:08
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 2ac2ca1 to 7a288eb Compare September 4, 2026 15:05
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 7a288eb to eed567d Compare September 4, 2026 20:04
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from eed567d to b28305a Compare September 5, 2026 00:05
@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from b28305a to 1388552 Compare September 5, 2026 10:04
@claude

claude Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Claude finished @sdkrelease[bot]'s task in 5m 13s —— View job


Docs review

  • Read docs/agent-guidance/agents/docs-reviewer.md
  • Review diff against origin/next
  • Apply checklist to changed .mdx pages
  • Sanity-check generated JSON data
  • Ran the relevant static tests (bun test tests/static/{openapi-tags,api-deprecation,toolkit-data,toolkit-schema,api-version-markdown}76 pass, 0 fail)

The sync itself is structurally clean: all four JSON files parse, toolkits.json and toolkits-list.json agree on all 1502 slugs, every newly added toolkit has a description, auth schemes, a pinned version, and a non-empty tool list, and toolCount matches tools.length for all 1502 entries. The legacy: true flag on the newly deprecated endpoint is picked up correctly by the generator and rendered properly (getApiDisplayTitle strips the (DEPRECATED) suffix so it isn't duplicated next to the Legacy badge).

Two things to resolve, and some follow-ups that this sync surfaces but didn't cause.


1. strava silently dropped from the toolkit catalog — please confirm this is intentional

The catalog went 1467 → 1502: 36 added, and strava removed. In the base data it was a fully-featured toolkit — 36 tools, Composio-managed OAUTH2, version 20260721_00. That's not the shape of a stub being cleaned up.

The page itself won't hard-404 (createToolkitResolver falls back to the live production API on a snapshot miss), but the toolkit leaves the /toolkits catalog listing and the search index (docs/lib/search-index.ts:608), while the docs keep shipping content built around it:

  • docs/content/kb/guide/toolkits-strava.mdx — a KB guide with toolkitSlugs: ["strava"] for a toolkit no longer in the catalog
  • docs/content/docs/composio-connect.mdx:15 — advertises Strava as one of the apps Composio Connect gives agents access to

Since 36 toolkits were added in the same run, truncated pagination is unlikely — but a single toolkit vanishing from an automated sync is worth one look before merge. If it was genuinely delisted upstream, the KB guide and the Connect prose need a follow-up. If the sync just missed it, re-running is much better than shipping a catalog that quietly loses a live toolkit. Fix this →

2. POST /tools/scopes/required is now deprecated, but hand-written docs still recommend it

The spec change is correct and the generated index page reflects it (docs/content/reference/api-reference/tools/index.mdx:55 now carries legacy: true). But two hand-maintained sources still send developers to the deprecated endpoint with no signal:

  • docs/api-overviews/tools.mdx:8 — "Look up the OAuth scopes a set of tools requires…". This is the source of the prose that lands in both reference/api-reference/tools/index.mdx:15 and reference/v3/api-reference/tools/index.mdx:15, so a reader hits the recommendation in the prose and then finds the endpoint tagged Legacy in the table below it.
  • docs/lib/api-version-guidance.ts:29,37 — lists POST /tools/scopes/required among the five endpoints whose v3.1 version default changed, and says it "is v3.1-only", with no mention that it's deprecated. This text is injected into the .md/llms output, so agents reading the docs will adopt it.

The spec's own replacement path is POST /api/v3.1/toolkits/{toolkit_slug}/scopes/recommended, with GET /api/v3.1/toolkits/{toolkit_slug}/scopes/grant_context for discovering grant_context values. Fix this →

(The changelog mention at docs/content/changelog/04-08-26-v31-api.mdx:23 is a historical record — leave it alone.)


Follow-ups — not blocking, and not caused by this PR

grant_context response fields renamed with no changelog entry. In docs/public/openapi.json the grant-context response went grant_context_keysgrant_context_dimensions, keydimension, allowed_valuesvalues, and gained a required default_grant_context. I grepped docs/content/** and no prose references the old names, so nothing is stale. But this is a breaking rename to a shipped response shape arriving through a silent data sync. It's flagged x-experimental / "contract may change", so it's within contract — still, a changelog entry would be kind to anyone already calling it.

New COMPOSIO_SUBMIT_FEEDBACK meta tool has no docs page. It's now in the meta-tool enum in both specs and in toolkits.json, but docs/public/data/meta-tools.json still lists 6 tools and content/toolkits/meta-tools/ has no page for it. Regenerating won't fix it: scripts/generate-meta-tools.ts:88 creates its session without experimental.submit_feedback.enable, and the flag defaults to false, so the generator can never observe the tool. COMPOSIO_WAIT_FOR_CONNECTIONS is missing from the same file for a related reason. If these should be documented, the generator's session config needs to opt in.

Fabricated v3 paths in endpoint tables. docs/scripts/generate-api-index.ts:379 falls back to op.path.replace('/v3.1/', '/v3/') when an operation has no v3 counterpart. With the version toggle on 3.0, the tools table renders POST /api/v3/tools/scopes/required and the toolkits table renders GET /api/v3/toolkits/{toolkit_slug}/scopes/grant_context — neither path exists in openapi-v3.json. The tools case directly contradicts api-version-guidance.ts:29, which states the endpoint is v3.1-only. Pre-existing and out of scope here, but a developer on v3 copying that path gets a 404. Fix this →

Upstream descriptions got less useful. In openapi.json, the session-creation experimental request object lost its description entirely ("Experimental features - not stable, may be modified or removed in future versions." was deleted, leaving only x-experimental: true), and the response-side description went from "Experimental features including the generated system prompt. Only returned on session creation, not on GET." to "Experimental v3.1 features - may change without notice". That first version told developers something they cannot infer from the schema — the field only appears on create, not on GET. Worth raising with whoever owns the backend spec; nothing to change in this repo.

Nit on the PR body. It claims meta tools, openapi-webhooks.json, and reference/v3/api-reference/ pages were updated, but none of those files are in the diff. Harmless boilerplate, though generating the body from the actual changed paths would make these reviews faster.


Verdict: confirm the strava removal (#1) and the data sync is good to go. #2 is a small prose fix that can land here or as an immediate follow-up. Nothing else blocks.
· Branch: docs/auto-update-data

@claude

claude Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Claude finished @sdkrelease[bot]'s task in 5m 2s —— View job


Docs review

Re-reviewed after the force-push (the sync picked up more upstream changes: toolkits.json +8533→+9045, openapi.json +147→+175).

  • Read docs/agent-guidance/agents/docs-reviewer.md
  • Diff against origin/next
  • Re-check the two blockers from the previous review
  • Sanity-check generated JSON data
  • Review what's new in this push
  • Run relevant static tests (18 suites → 230 pass, 1 pre-existing failure)

Data sanity: clean. All four JSON files parse. toolkits.json and toolkits-list.json agree on all 1502 slugs. toolCount === tools.length for all 1502 entries. Every one of the 36 new toolkits has a description, auth schemes, a version, and a non-empty tool list. legacy: true on the newly deprecated endpoint validates against apiEndpointSchema and renders correctly.

Test note, so nobody chases it: bun test tests/static/api-version-markdown prints [mdxToCleanMarkdown] unparseable/invalid ApiEndpointsTable payload on /reference/api-reference/tools. That is not the new legacy: true payload — it comes from the two intentional negative tests at docs/tests/static/api-version-markdown.test.ts:162,171. The real payload parses and validates. Separately, tests/static/llms-openapi.test.ts fails with Export named 'getAllToolkitsSync' not found — I re-ran it with origin/next's data files checked in and it fails identically, so it's pre-existing and not caused by this sync.


Still blocking

1. strava silently dropped from the catalog — unchanged from the last push

1467 → 1502: 36 added, strava removed. In the base data it is not a stub:

slug: strava, authSchemes: ['OAUTH2'], composioManagedAuthSchemes: ['OAUTH2'],
toolCount: 36, version: 20260721_00, category: fitness

/toolkits/strava won't hard-404 — createToolkitResolver (docs/lib/toolkit-resolution.ts:17-20) falls back to the production API on a snapshot miss. But the toolkit leaves the /toolkits catalog and the search index (docs/lib/search-index.ts:605, which is built from getAllToolkitsSync()), while four docs surfaces keep shipping content built around it:

  • docs/content/kb/guide/toolkits-strava.mdx — a KB guide with toolkitSlugs: ["strava"]
  • docs/content/kb/guide/meta.json:112 — indexes that guide
  • docs/content/toolkits/faq/strava.md — FAQ content loaded by docs/app/(home)/toolkits/[[...slug]]/page.tsx:107
  • docs/content/docs/composio-connect.mdx:15 — names Strava as an app Composio Connect gives agents access to

36 toolkits arrived in the same run, so truncated pagination is unlikely — but one toolkit disappearing from an automated sync still deserves a look before merge. If it was genuinely delisted upstream, those four surfaces need a follow-up. If the sync missed it, re-running beats shipping a catalog that quietly loses a live toolkit. Fix this →

2. POST /tools/scopes/required is now deprecated, but hand-written docs still recommend it

The spec change is right and the generated page reflects it (docs/content/reference/api-reference/tools/index.mdx:55 now carries legacy: true). Two hand-maintained sources still point developers at it with no signal:

  • docs/api-overviews/tools.mdx:8 — "Look up the OAuth scopes a set of tools requires…". This prose is injected into both reference/api-reference/tools/index.mdx:15 and reference/v3/api-reference/tools/index.mdx:15, so a reader gets the recommendation in the prose and then finds the endpoint tagged Legacy in the table below it.
  • docs/lib/api-version-guidance.ts:29,37 — lists POST /tools/scopes/required among the five endpoints whose v3.1 version default changed and states it "is v3.1-only", with no mention of deprecation. This text goes into the .md/llms output, so agents reading the docs will adopt it.

The spec's own replacement is POST /api/v3.1/toolkits/{toolkit_slug}/scopes/recommended, with GET /api/v3.1/toolkits/{toolkit_slug}/scopes/grant_context for discovering grant_context values. Fix this →

(docs/content/changelog/04-08-26-v31-api.mdx:23 is a historical record — leave it.)


New in this push

session_config_id arrives with no way to create one. Session creation gained experimental.session_config_id ("Experimental reusable Session config to resolve for this new Session"), the response gained experimental.source_session_config, and a new 404 was added for "The referenced Session config … does not exist". But openapi.json has zero session-config paths, and grep finds no session_config_id/sessionConfigId anywhere under docs/content or docs/lib. So the field is documented but the resource it points at has no documented lifecycle. It's x-experimental, so not a blocker — worth raising with the spec owner.

Playground tag added to both specs with zero operations. Harmless (generate-api-index produces nothing for an operation-less tag, and no reference dir is created), just noting it so it isn't mistaken for a missing page.

grant_context response was renamed. grant_context_keysgrant_context_dimensions, keydimension, allowed_valuesvalues, plus a new required default_grant_context. I grepped docs/content and docs/lib for the old names — zero hits, so nothing in the docs is stale. Still a breaking rename to a shipped response shape landing through a silent data sync; it's flagged x-experimental/"contract may change" so it's within contract, but a changelog entry would be kind.

COMPOSIO_SUBMIT_FEEDBACK is the 8th meta tool and has no docs page. It's in the enum in both specs, but docs/public/data/meta-tools.json still lists 6 and content/toolkits/meta-tools/ has no page. Regenerating won't fix it: scripts/generate-meta-tools.ts:88 builds its session without experimental.submit_feedback.enable, which defaults to false, so the generator can never observe the tool — the same reason COMPOSIO_WAIT_FOR_CONNECTIONS is missing. If these should be documented, the generator's session config needs to opt in.

Upstream description regression, still present. The session-creation experimental request object lost its description entirely, and the response-side one went from "Experimental features including the generated system prompt. Only returned on session creation, not on GET." to "Experimental v3.1 features - may change without notice". The old text told developers something they cannot infer from the schema — the field only appears on create. Nothing to change in this repo; worth raising with whoever owns the spec.


Follow-ups — pre-existing, not caused by this PR

Fabricated v3 paths in endpoint tables. docs/scripts/generate-api-index.ts:379 falls back to op.path.replace('/v3.1/', '/v3/') when an operation has no v3 counterpart. openapi-v3.json contains no scopes paths and no api_key_revocation path at all, yet with the version toggle on 3.0 the generated tables render POST /api/v3/tools/scopes/required, POST /api/v3/toolkits/{toolkit_slug}/scopes/recommended, GET /api/v3/toolkits/{toolkit_slug}/scopes/grant_context, and POST /api/v3/api_key_revocation — four dead paths. The tools case also directly contradicts api-version-guidance.ts:29, which says the endpoint is v3.1-only. Fix this →

API-key permissions table is out of sync with the spec. docs/content/reference/authenticating-to-composio/project-api-key-permissions.mdx:114-115 lists GET /api/v3.1/tools/scopes/required (the spec defines it as POST) and GET /api/v3.1/tools/get_scopes_required (not in the spec at all). Neither replacement endpoint appears anywhere in that file, so a developer migrating off the now-deprecated endpoint can't tell which permission the new one needs. Fix this →

PR body nit. It still claims meta tools, openapi-webhooks.json, and reference/v3/api-reference/ pages were updated; none are in the diff. Generating the body from the actual changed paths would make these reviews faster.


Verdict: the data itself is clean and the tests pass. Confirm the strava removal (#1) and this is good to merge; #2 is a small prose fix that can land here or immediately after. Everything else is non-blocking.
· Branch: docs/auto-update-data

@sdkrelease
sdkrelease Bot force-pushed the docs/auto-update-data branch from 6be9d6d to 769a140 Compare September 8, 2026 15:04
@claude

claude Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Claude finished @sdkrelease[bot]'s task in 3m 55s —— View job


Docs review

Re-reviewed after this push. The sync moved again: toolkits.json +12575/-716 (was +9045), and the catalog is now 1467 → 1516 (49 added, strava removed).

  • Read docs/agent-guidance/agents/docs-reviewer.md
  • Diff against origin/next
  • Re-check the two prior blockers
  • Sanity-check generated JSON data
  • Review what's new in this push
  • Verify generated pages are in sync with the specs (re-ran bun run generate:api-index)
  • Run relevant static tests (12 suites → 153 pass, 0 fail)

Data sanity: clean. All four JSON files parse. toolkits.json and toolkits-list.json agree on all 1516 slugs. toolCount === tools.length for all 1516 entries. Every entry has a description, a version, and a non-empty tool list.

Generated pages are complete. I re-ran bun run generate:api-index against the new specs and git status came back empty — the three checked-in index.mdx changes are exactly what the generator produces, nothing was missed, and the reference/v3/api-reference/ tree correctly has no changes (the v3.0 spec's summaries and deprecation flags didn't move).

Test note, so nobody chases it: tests/static/api-version-markdown prints unparseable/invalid ApiEndpointsTable payload on /reference/api-reference/tools — that's the two intentional negative tests at docs/tests/static/api-version-markdown.test.ts:162,171, not the new legacy: true payload, which parses and validates. Separately tests/static/llms-openapi.test.ts fails with Export named 'getAllToolkitsSync' not found in module docs/lib/toolkit-data.ts — that file isn't in this diff, so it's pre-existing.


Action needed

1. strava is gone for the third sync run in a row — the delisting now looks real, so the docs need cleanup

This is the third independent sync that omits it, and 49 toolkits arrived in the same run. Truncated pagination doesn't reproduce three times while the rest of the catalog grows, so I'd now treat this as a genuine upstream delisting rather than a flaky run — which flips the ask from "re-run the sync" to "clean up the pages built on it."

In the base data it was fully featured: authSchemes: ['OAUTH2'], toolCount: 36, version: 20260721_00, category: fitness.

/toolkits/strava won't hard-404 — createToolkitResolver (docs/lib/toolkit-resolution.ts:17-20) falls back to the production API on a snapshot miss. But the toolkit leaves the /toolkits catalog and the search index (built from getAllToolkitsSync()), while four surfaces keep shipping content around it:

  • docs/content/kb/guide/toolkits-strava.mdx — KB guide with toolkitSlugs: ["strava"]
  • docs/content/kb/guide/meta.json:112 — indexes that guide
  • docs/content/toolkits/faq/strava.md — FAQ content loaded by docs/app/(home)/toolkits/[[...slug]]/page.tsx
  • docs/content/docs/composio-connect.mdx:15 — names Strava among the apps Composio Connect gives agents access to

A developer who reads the Connect page or lands on the KB guide, then searches the catalog for Strava and finds nothing, is left guessing whether the integration still exists. Worth one confirmation against production before merge; if it is delisted, these four need a follow-up. Fix this →

2. POST /tools/scopes/required is deprecated, but hand-written docs still recommend it

The spec change is right and the generated table reflects it (docs/content/reference/api-reference/tools/index.mdx:55 now carries legacy: true and the (DEPRECATED) summary). Two hand-maintained sources still point developers at it with no signal — I re-checked both on this HEAD and neither has changed:

  • docs/api-overviews/tools.mdx:8 — "Look up the OAuth scopes a set of tools requires…". This prose is injected into reference/api-reference/tools/index.mdx:15, so a reader gets the recommendation and then finds the endpoint tagged Legacy in the table directly below it.
  • docs/lib/api-version-guidance.ts:29,37 — lists POST /tools/scopes/required among the five endpoints whose v3.1 version default changed and states it "is v3.1-only", with no mention of deprecation. This text goes into the .md/llms output, so agents reading the docs will adopt the deprecated endpoint.

The spec's own replacement is POST /api/v3.1/toolkits/{toolkit_slug}/scopes/recommended, with GET /api/v3.1/toolkits/{toolkit_slug}/scopes/grant_context for discovering grant_context values — both already in the toolkits table. Fix this →

(docs/content/changelog/04-08-26-v31-api.mdx:23 is a historical record — leave it.)


New in this push

scopes/recommended gained available_scopes, and grant_context semantics changed. New request field available_scopes ("Scopes your OAuth app can request… fails with scope_not_available when a tool cannot be covered inside it"), the 422 now covers scope_not_available, and the response's grant_context is documented as "the toolkit default overlaid with your overrides". Alongside it, the grant-context response was renamed: grant_context_keysgrant_context_dimensions, keydimension, allowed_valuesvalues, description is now required, plus a new required default_grant_context. I grepped all of docs/content, docs/lib, and docs/api-overviews for the old names — zero hits, so nothing in the docs went stale. The reference pages pick all of this up from the spec automatically. Still a breaking rename to a shipped response shape landing through a silent data sync; it's x-experimental/"contract may change", so within contract, but a changelog entry would be kind to anyone already calling it.

api_key_revocation summary narrowed. "Publicly revoke leaked Composio API keys" → "Revoke Composio API keys". The long description still explains the leak-reporting purpose, and nothing in docs/content describes this endpoint in prose, so there's no mismatch to fix.

submit_feedback is now documented — which unblocks the missing meta-tool pages. Both specs gained experimental.submit_feedback.enable, and COMPOSIO_SUBMIT_FEEDBACK is in the meta-tool enum. docs/public/data/meta-tools.json still lists 6 and content/toolkits/meta-tools/ still has no page for it or for COMPOSIO_WAIT_FOR_CONNECTIONS.

Worth correcting the earlier diagnosis here: it isn't just a missing opt-in flag. docs/scripts/generate-meta-tools.ts:92-95 creates its session with

config: { autoManageConnections: true, recipesEnabled: true, enableWaitForConnections: true }

but the documented body for POST /api/v3.1/tool_router/session has no config property at all (user_id, toolkits, auth_configs, connected_accounts, manage_connections, tools, tags, workbench, multi_account, experimental, preload, search, execute), and none of autoManageConnections, recipesEnabled, or enableWaitForConnections appears anywhere in either spec. So all three flags are silently dropped — that's why COMPOSIO_WAIT_FOR_CONNECTIONS never shows up despite the generator asking for it, and the same block would swallow a submit_feedback opt-in. Fixing the request shape is what makes both tools documentable. Fix this →

session_config_id still has no documented lifecycle. Session creation takes experimental.session_config_id and the response returns experimental.source_session_config, with a new 404 for a missing config — but openapi.json has zero session-config paths and session_config_id appears nowhere under docs/content or docs/lib. x-experimental, so not blocking; worth raising with the spec owner. Note the v3.0 spec got the same new 404 without the field that can trigger it.

Playground tag added to both specs with zero operations. Harmless — generate-api-index emits nothing for an operation-less tag and tests/static/openapi-tags passes. Noting it so it isn't mistaken for a missing page.

Upstream description regression, still present in v3.1 only. The session-creation experimental request object in openapi.json lost its description entirely, and the response-side one went from "Experimental features including the generated system prompt. Only returned on session creation, not on GET." to "Experimental v3.1 features - may change without notice". openapi-v3.json kept its version. The old text told developers something they can't infer from the schema — the field only appears on create. Nothing to change in this repo.


Follow-ups — pre-existing, not caused by this PR

Fabricated v3 paths in endpoint tables. docs/scripts/generate-api-index.ts:379 falls back to op.path.replace('/v3.1/', '/v3/') when an operation has no v3 counterpart. openapi-v3.json contains no scopes paths and no api_key_revocation path, yet with the version toggle on 3.0 the generated tables render POST /api/v3/tools/scopes/required, POST /api/v3/toolkits/{toolkit_slug}/scopes/recommended, GET /api/v3/toolkits/{toolkit_slug}/scopes/grant_context, and POST /api/v3/api_key_revocation — four dead paths. The tools row also contradicts api-version-guidance.ts:29, which says that endpoint is v3.1-only. A developer on v3 copying any of them gets a 404. Fix this →

API-key permissions table is out of sync with the spec. docs/content/reference/authenticating-to-composio/project-api-key-permissions.mdx:114 lists GET /api/v3.1/tools/scopes/required, but the spec defines that operation as POST (and now deprecated). Neither replacement endpoint appears anywhere in that file, so a developer migrating off the deprecated endpoint can't tell which permission the new one needs. Fix this →

PR body nit. It still claims meta tools, openapi-webhooks.json, and reference/v3/api-reference/ pages were updated; none are in the diff. Generating the body from the actual changed paths would make these reviews faster.


Verdict: the data is clean, the generated pages are provably in sync with the specs, and the tests pass. strava (#1) is the one thing I'd confirm before merge — three consecutive runs make a real delisting the likely answer, which means the four Strava surfaces need a follow-up rather than a re-run. #2 is a small prose fix that can land here or immediately after. Everything else is non-blocking.

I reviewed only — no files changed.
· Branch: docs/auto-update-data

@jkomyno
Alberto Schiabel (jkomyno) merged commit 80867a0 into next Sep 8, 2026
17 of 18 checks passed
@jkomyno
Alberto Schiabel (jkomyno) deleted the docs/auto-update-data branch September 8, 2026 16:14
Alberto Schiabel (jkomyno) added a commit that referenced this pull request Sep 8, 2026
The production catalog refresh in #4330 renamed Stripe's triggers without
the _TRIGGER suffix, so the Stripe guide cited two slugs the corpus
verifier now reports as dead and every docs PR fails "Docs - Tests". The
guide keeps the one renamed slug the catalog lists and points readers at
the catalog for invoice payment events.

The catalog only ever lists a toolkit's first 20 triggers because the
generator fetched trigger types without a page limit; it now asks for up
to 1000, matching the tools fetch.

Claude-Session: https://claude.ai/code/session_019wRk1S4Z6V6FWr4UsybGvR
Alberto Schiabel (jkomyno) added a commit that referenced this pull request Sep 8, 2026
This PR:

- Closes #4343
- stamps eve's durable callback descriptors on every tool `EveProvider`
wraps, via the new internal `withDurableClosure(closure, callback)`
helper — eve only stamps them on `defineTool` calls its build transform
finds in the agent's own source, which never runs on this package inside
`node_modules`, so eve discarded the whole resolver result and the agent
silently lost every Composio tool
- persists `{ slug, binding }` per callback, where `binding` is an id
minted per `wrapTools` call and prefixed with a per-process token, and
re-attaches it to that resolve's Composio executor through a
module-level binding map. `executeTool` is bound to one Composio
session, so a slug-only closure would have routed a call to whichever
session resolved last; sessions for different users share one provider,
and eve's callback registry is keyed by tool name only, so the map lives
at module level rather than on the instance
- covers `execute` and, when `needsApproval` is set, `approvalRequest`;
the descriptor key is the global-registry symbol
`Symbol.for('eve:durable-dynamic-callback')`, so no eve internal is
imported and the stamp is inert on eve versions that predate the
contract
- adds 9 regression tests: descriptor presence and shape,
JSON-serializability of the closure, replay of execute and approval from
the closure alone, per-resolve executor isolation when sessions share a
provider, hooks of the producing provider on replay, the unknown-slug
and unknown-binding errors, that two fresh module instances never mint
the same binding id, and one suite that loads eve 0.52.1's own
`validateDurableDynamicToolCallbacks`, `replayDynamicTools`, and
callback registry from the installed package to validate and replay a
wrapped tool end to end. Before the change eve threw `Dynamic tool "..."
callback "execute" does not have a durable descriptor`

## Context

The reporter hit this on eve 0.50 as `non-serializable capture`; 0.52.1
reports the same root cause as a missing descriptor. eve exports no
public durable-callback helper (tracked at vercel/eve#2967), so the
provider stamps the descriptor itself rather than pinning users to an
older eve.

Bindings are kept for the life of the process: eve can resume a parked
call at any time. A binding lives only in the process that resolved the
tools, so a call parked across a restart cannot be replayed; the
per-process token in the id makes the stale closure fail the lookup
loudly instead of matching whichever resolve reused its counter value in
the new process. Growth is one entry per `session.tools()` resolve.

Docs (`/docs/providers/eve`) now state the contract, the restart limit,
and the real reason the `step.started` resolver runs each step
(principal re-evaluation and retry, cached per session).

Also unblocks `Docs - Tests` on this branch: the catalog refresh in
#4330 renamed Stripe's triggers, so the Stripe knowledge-base guide
cited two dead slugs and the corpus verifier failed for any PR touching
docs. The guide now cites only the renamed slug the catalog lists, and
`generate-toolkits.ts` fetches trigger types with `limit=1000` so the
catalog stops truncating every toolkit to its first 20 triggers.

https://claude.ai/code/session_019wRk1S4Z6V6FWr4UsybGvR


EOF -R ComposioHQ/composio
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants