From 554f2b2b6c4407f1522dbb0928668832aed8e83d Mon Sep 17 00:00:00 2001 From: David McKay Date: Tue, 15 Sep 2026 11:33:59 -0700 Subject: [PATCH] Reconcile the release notes and the connector list with what shipped The Unreleased changelog was missing several changes that landed since v0.0.11: the Composio connector (#481), the removal of a skill's grants when it is uninstalled (#563), and the request-validation sweep that answers a malformed request with a 400 rather than coercing it or letting it through (#543-#548, #550), including the one fail-open it closed. Added, each checked against the code. The README's Governed MCP bullet named only Google Drive and Notion; Composio brokers a few hundred more apps in the catalogue now, so it says so. --- CHANGELOG.md | 30 ++++++++++++++++++++++++++++++ README.md | 2 +- 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bc9e660bc..b1a977856 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,36 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged. ## Unreleased +### A deployment can broker its Bots into a few hundred apps through Composio + +Composio holds a person's connections to a few hundred SaaS apps behind one account. A deployment +that sets `COMPOSIO_API_KEY` now has that broker: each person connects their own accounts, a Bot is +granted an app's tools the way it is granted any other, and every call is decided and recorded +through the gateway like the rest. Unset, there is nothing to connect, nothing to grant and no +Composio tool for a Bot to call, and the Plugins page says so under **More apps** rather than +pretending otherwise. See [docs/plugins/composio.md](docs/plugins/composio.md). + +### A skill's grants are removed when it is uninstalled + +Uninstalling a skill deleted the skill but left its tool grants, which are keyed by its slug. A new +skill created under the same slug then inherited them, and was offered on the Bots the old skill had +been granted to with no grant ever made for it. Uninstalling now removes a skill's grants along with +it, in one transaction, and an upgrade drops any grants already left orphaned this way. + +### Malformed requests are refused instead of coerced, and a fail-open is closed + +A pass across the write and query surface answers a malformed request with a 400 that names the bad +field, rather than coercing it, failing at the store, or letting it through: the plugin server and +tool-call endpoints, the admin people search and credential input, skill tools and grant ids, blank +route ids on routines, host-access, agents and channels, the routing text length, routine dispatch +and page-frame params, and the runtime env, tokens and model content the computer and supervisor +read. The app reads these responses more defensively too, degrading rather than throwing on a shape +it did not expect. + +One of these closed a hole rather than tightening an edge: a skill installed with a non-string entry +in its `tools` list had that entry silently dropped, so the skill declared nothing and installed as a +success. It is refused now. + ### Naming a conversation asks the endpoint OPENAI_BASE_URL names, not OpenAI The job that names a conversation sent its request to api.openai.com whatever `OPENAI_BASE_URL` said, diff --git a/README.md b/README.md index e1ae4ef76..a05e4f76e 100644 --- a/README.md +++ b/README.md @@ -170,7 +170,7 @@ Leave `EMBEDDED_POSTGRES` off and set `DATABASE_URL` to point at a database you - **Secrets never enter the transcript**: the trail records that a secret was requested and how long it was, not what it said. - **Bring your own agent**: any AG-UI endpoint is a Bot, on a framework or hand-written. Endpoints are validated with the same target checks used for browser navigation, and an auth header is stored write-only. - **Components instead of prose**: compiled React components live in `app/src/components/gallery/`, sandboxed ones are authored in `/admin/playground` and published with no deployment. Every call asks the server whether the component exists, is published, and is not withheld from that Bot. Data functions are granted per component. -- **Governed MCP**: Google Drive and Notion ship in the catalogue, reached as the person asking. The catalogue carries only vendors this deployment stands behind, so adding one is a review of that vendor. Custom servers must pass URL checks; unknown tools and custom-server tools are treated as writes, and a catalogue tool the server advertises but does not name as a write classifies as a read. A Bot is told which connectors exist here and which it holds, so it says it has not been granted one rather than browsing to the vendor's website. +- **Governed MCP**: Google Drive and Notion ship in the catalogue, and Composio brokers a few hundred more apps behind one account, each reached as the person asking. The catalogue carries only vendors this deployment stands behind, so adding one is a review of that vendor. Custom servers must pass URL checks; unknown tools and custom-server tools are treated as writes, and a catalogue tool the server advertises but does not name as a write classifies as a read. A Bot is told which connectors exist here and which it holds, so it says it has not been granted one rather than browsing to the vendor's website. - **Skills are instructions, not capabilities**: personal skills attach only to Bots their author owns, deployment skills are admin-owned, and both are invoked with `/` in the composer. A Bot granted the shipped `skill-creator` skill can write one with you in the conversation, and saves it only when you press the button on the card. - **Sign in with what your company already has**: Google, Microsoft or Okta from the environment, or a company's own SAML or OpenID Connect provider registered while the deployment runs and routed by email domain. Any one turns sign-in on; several may be configured at once. - **Decide who gets in**: `/admin/people` lists everybody who has signed in, promotes and demotes them, and removes access, which ends the session they are using and stops the next sign-in. Every change is on the audit trail.