feat(kiloclaw) Enable composio connect via mcp

[St0rmz1]

Summary

KiloClaw's Composio settings asked for a uak_ user API key plus an organization value, and signed the Composio CLI into the instance at boot. Composio only issues uak_ keys through its agent-signup API, a leftover from the retired managed-onboarding flow. A user copying a key from the Composio dashboard gets a ck_ consumer key, which the old validation rejected, so the integration could not be configured by hand.

This replaces the CLI credential pair with a single consumer key and switches the controller from CLI sign-in to writing a Composio Connect remote MCP server into the instance's OpenClaw config. Nothing is installed or run in the instance: OpenClaw dials Composio's hosted endpoint and forwards the key as a header. Toolkit authorization (Gmail, Calendar, and so on) stays in the Composio dashboard.

Changes

• Secret catalog: the Composio entry now has one field, composioConsumerKey (COMPOSIO_CONSUMER_KEY), validated as ^ck_[A-Za-z0-9_-]{8,}$. Dropped the uak_/org fields and allFieldsRequired. Validation is deliberately loose because Composio's own CLI does no prefix or length check.
• Controller: new applyComposioConnectConfig in config-writer.ts writes mcp.servers.composio (transport: streamable-http, Composio's URL, x-consumer-api-key header) when a key is set. The definition is replaced outright rather than merged, so a stale auth: 'oauth' field cannot survive and suppress the header.
• Clearing the key removes the server definition, since openclaw.json persists on the volume across redeploys. Removal is limited to definitions KiloClaw tags with a kiloclawManaged marker, so a Composio server a user configured by hand (same URL and header) is left intact.
• TOOLS.md guidance for the in-instance agent now describes the MCP tools and points toolkit auth at the dashboard, instead of coaching composio login / composio link.
• The Composio CLI stays in the image and COMPOSIO_USER_API_KEY / COMPOSIO_ORG still reach the instance as ordinary custom secrets, so a sign-in a user set up themselves keeps working.
• Updated .specs/kiloclaw-composio.md to describe the MCP surface and the managed-marker ownership rule.
• Test coverage for add, update, replace-not-merge, oauth-drop, remove-when-cleared, and leave-unmarked-alone.

Verification

• No manual testing yet. apps/web Jest requires a running local Postgres and was not run locally; controller and secret-catalog suites pass (vitest). A real ck_ key against connect.composio.dev/mcp has not been exercised, so the returned tool list is unconfirmed.

Visual Changes

N/A

Reviewer Notes

• The mcp.servers.composio write and removal heuristics in applyComposioConnectConfig are the main thing to scrutinize. Ownership is tracked by the kiloclawManaged marker rather than inferred from Composio's published URL/header, because a hand-configured Connect server is otherwise byte-identical.
• No forced migration for existing users: both the CLI path and the new MCP path can coexist on an instance.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

This update adds RETAINED_SENSITIVE_ENV_VARS (COMPOSIO_USER_API_KEY, COMPOSIO_ORG) and merges it into SENSITIVE_KEYS, fixing the previously flagged loss of plaintext-encryption protection for these legacy env var names; no new issues found in the incremental diff.

Files Reviewed (6 files)

• .specs/kiloclaw-composio.md
• packages/kiloclaw-secret-catalog/src/__tests__/catalog.test.ts
• packages/kiloclaw-secret-catalog/src/catalog.ts
• packages/kiloclaw-secret-catalog/src/index.ts
• services/kiloclaw/src/gateway/env.test.ts
• services/kiloclaw/src/gateway/env.ts

Previous Review Summary (commit 3bb65b8)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 3bb65b8)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

Removing the legacy Composio catalog fields drops COMPOSIO_USER_API_KEY/COMPOSIO_ORG from the sensitive-env-var set used when building the Fly machine's environment, weakening plaintext protection for those two legacy names.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/kiloclaw-secret-catalog/src/catalog.ts	240	Removing COMPOSIO_USER_API_KEY/COMPOSIO_ORG from the catalog also removes them from ALL_SECRET_ENV_VARS, which is the only gate that encrypts a plaintext custom env var with those exact legacy names before it reaches Fly's config.env.

Files Reviewed (10 files)

• .specs/kiloclaw-composio.md - 0 issues
• apps/web/src/app/(app)/claw/components/secret-ui-adapter.ts - 0 issues
• apps/web/src/lib/kiloclaw/provision-secrets.ts - 0 issues
• apps/web/src/lib/kiloclaw/provision-secrets.test.ts - 0 issues
• packages/kiloclaw-secret-catalog/src/catalog.ts - 1 issue
• packages/kiloclaw-secret-catalog/src/__tests__/catalog.test.ts - 0 issues
• services/kiloclaw/controller/src/bootstrap.ts - 0 issues
• services/kiloclaw/controller/src/bootstrap.test.ts - 0 issues
• services/kiloclaw/controller/src/config-writer.ts - 0 issues
• services/kiloclaw/controller/src/config-writer.test.ts - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-5 · Input: 18 · Output: 3.8K · Cached: 343.8K}

_{Review guidance: REVIEW.md from base branch main}