Let the CEO hand out connector toolkits agent by agent

Connections belong to the company - one Composio connected account per
toolkit, mirrored locally in connector_accounts - and access belongs to
individuals: a new agent_connector_grants table records which agent may use
which toolkit. Agent runs now load composio tools from the intersection of
active connections and that agent's grants, and tool execution re-checks the
grant server-side so an ungranted agent cannot call a connector tool it
heard about. Any agent can list_connectors to see what the company has
connected and who holds access; grant_connector/revoke_connector are
CEO-only. The Composio client speaks the v3 contract (user_id,
connected_account_id, toolkit catalog with cursor paging, managed auth
config creation, connect-link initiation). Covered by four grants contract
tests.

AgentCompany-New/tests/unit/connector-grants.test.ts

@@ -0,0 +1,113 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { DatabaseConnection } from "../../src/main/database/connection";
+import { OrganizationService } from "../../src/main/services/organization-service";
+import { ChatService } from "../../src/main/services/chat-service";
+import { ConnectorGrantsService } from "../../src/main/services/composio/connector-grants";
+import { dispatchAgentTool, type AgentToolContext } from "../../src/main/services/agent-tools";
+
+function call(name: string, args: Record<string, unknown>) {
+  return { id: `call_${randomUUID()}`, name, arguments: args };
+}
+
+interface Harness {
+  connection: DatabaseConnection;
+  orgId: string;
+  ceoId: string;
+  danaId: string;
+  ceoCtx: AgentToolContext;
+  danaCtx: AgentToolContext;
+  deps: { db: DatabaseConnection["db"]; organization: OrganizationService; chat: ChatService };
+}
+
+function harness(): Harness {
+  const connection = new DatabaseConnection(join(tmpdir(), `ac-connector-${randomUUID()}.db`));
+  const organization = new OrganizationService(connection.db);
+  let orgId = "";
+  let ceoId = "";
+  let danaId = "";
+  connection.transaction(() => {
+    orgId = organization.createOrganization({ organizationName: "OrbitOps", employeeName: "Yang", mission: "m", goal: "g" });
+    const providerId = (connection.db.prepare("select id from providers where org_id = ? and provider_key = 'openai'").get(orgId) as { id: string }).id;
+    ceoId = organization.createAgent({
+      orgId, name: "CEO", role: "CEO", department: "Executive",
+      modelProviderId: providerId, modelId: "gpt-5.4", budgetCents: 25000, managerAgentId: null, roleLevel: "c_suite",
+    });
+    danaId = organization.createAgent({
+      orgId, name: "Dana", role: "Engineer", department: "Engineering",
+      modelProviderId: providerId, modelId: "gpt-5.4", budgetCents: 1000, managerAgentId: ceoId,
+    });
+  });
+  const context = (agentId: string): AgentToolContext => ({
+    orgId,
+    agent: { id: agentId, modelProviderId: null, modelId: null },
+    taskProjectId: null,
+    taskGoalId: null,
+    workspace: null,
+  });
+  return {
+    connection,
+    orgId,
+    ceoId,
+    danaId,
+    ceoCtx: context(ceoId),
+    danaCtx: context(danaId),
+    deps: { db: connection.db, organization, chat: new ChatService(connection.db) },
+  };
+}
+
+function connectToolkit(h: Harness, slug: string, name: string): void {
+  const now = new Date().toISOString();
+  h.connection.db.prepare(`
+    insert into connector_accounts(id, org_id, toolkit_slug, toolkit_name, auth_config_id, status, created_at, updated_at)
+    values (?, ?, ?, ?, ?, 'ACTIVE', ?, ?)
+  `).run(`ca_${slug}`, h.orgId, slug, name, `ac_${slug}`, now, now);
+}
+
+describe("connector grants", () => {
+  test("granting requires an actively connected toolkit", () => {
+    const h = harness();
+    const grants = new ConnectorGrantsService(h.connection.db);
+    expect(() => grants.grant({
+      orgId: h.orgId, agentId: h.danaId, toolkitSlug: "github", grantedByType: "employee", grantedById: null,
+    })).toThrow(/No active connection/);
+  });
+
+  test("the CEO grants and revokes toolkits for teammates", () => {
+    const h = harness();
+    connectToolkit(h, "github", "GitHub");
+    const granted = dispatchAgentTool(h.deps, h.ceoCtx, call("grant_connector", { agent_name: "Dana", toolkit: "github" }));
+    expect(granted).toContain("Dana now has access to the github connector");
+
+    const grants = new ConnectorGrantsService(h.connection.db);
+    expect(grants.toolkitsForAgent(h.orgId, h.danaId)).toEqual(["github"]);
+    expect(grants.toolkitsForAgent(h.orgId, h.ceoId)).toEqual([]);
+
+    const listing = dispatchAgentTool(h.deps, h.danaCtx, call("list_connectors", {}));
+    expect(listing).toContain("GitHub (github): granted to Dana");
+
+    const revoked = dispatchAgentTool(h.deps, h.ceoCtx, call("revoke_connector", { agent_name: "Dana", toolkit: "github" }));
+    expect(revoked).toContain("no longer has access");
+    expect(grants.toolkitsForAgent(h.orgId, h.danaId)).toEqual([]);
+  });
+
+  test("staff cannot hand out connector access", () => {
+    const h = harness();
+    connectToolkit(h, "github", "GitHub");
+    const denied = dispatchAgentTool(h.deps, h.danaCtx, call("grant_connector", { agent_name: "Dana", toolkit: "github" }));
+    expect(denied).toContain("ERROR");
+    expect(new ConnectorGrantsService(h.connection.db).toolkitsForAgent(h.orgId, h.danaId)).toEqual([]);
+  });
+
+  test("a disconnected toolkit stops counting for its grants", () => {
+    const h = harness();
+    connectToolkit(h, "slack", "Slack");
+    const grants = new ConnectorGrantsService(h.connection.db);
+    grants.grant({ orgId: h.orgId, agentId: h.danaId, toolkitSlug: "slack", grantedByType: "employee", grantedById: null });
+    expect(grants.toolkitsForAgent(h.orgId, h.danaId)).toEqual(["slack"]);
+    h.connection.db.prepare("update connector_accounts set status = 'EXPIRED' where org_id = ? and toolkit_slug = 'slack'").run(h.orgId);
+    expect(grants.toolkitsForAgent(h.orgId, h.danaId)).toEqual([]);
+  });
+});

AgentCompany-New/tests/unit/domain-services.test.ts

@@ -24,7 +24,7 @@ describe("domain services", () => {
     const connection = createConnection();
 
     const rows = connection.db.prepare("select version from schema_migrations order by version asc").all() as Array<{ version: number }>;
-    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44]);
+    expect(rows.map((row) => row.version)).toEqual([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45]);
     connection.close();
   });