Before upgrading. Two things change for an existing deployment:
- Migration
0052_shared_brokered_accountscopies every Composio connection into a new
brokered_connectionstable and leavescomposio_connectionsin place, unwritten. Rolling back to
0.1.2 works, but accounts connected after the upgrade are invisible to it. - A handoff now records what started the run it came from. Older remote Bots' signed runs carry no
such record for up to ten minutes after the upgrade, and calls they make to a Shared app in that
window are refused.
The desktop asks before every command that can edit a folder
When a Bot runs a command in a folder shared from the desktop app, the person sees a prompt that can
offer "Always allow in this folder". That choice now covers commands that only read the folder. A
command that can change or delete files in it shows the prompt every time, without the "Always
allow" option. Folders already set to "Always allow" work as before for read-only commands.
One Bots list, and one page per Bot
Agents, Team Bots and Bots were three lists of the same Bots. /bots is now the only one — pinned,
yours, shared with you, and the ones you hid — with New Bot at the top. A Bot's page holds
everything about it: its routines, its skills and what it may reach, who it is shared with, and its
name, role and connection. Where updates reach you and your answers to shared Bots moved to
Settings. /agents and /team-bots still work and open the new places. A Team Bot an administrator
assigns to a group is pinned at the top of its members' Bots list instead of sitting in their
sidebar.
The sidebar no longer lists each Bot that needs you. A badge on Bots counts the questions, approvals
and stalled hand-offs waiting across all of them, and Bots lists those Bots first, under Needs you.
Browser notifications when a Bot starts needing you are unchanged.
The sidebar is now Bots and Skills. Each Bot's page holds what that Bot is waiting on you for, its
suggested next steps, its responsibilities, where it reaches you, its memory sources and background
research, and its approval rules. /approvals, /memory, /reachability and /responsibilities
still work and open the new places. Messages from Bots, Slack and Teams that named those pages now
point at the Bot's page.
A group conversation is started like any other: put two or more Bots in the To: field of a new
conversation, in the order they should answer. The separate group button and /group/new screen
are gone; /group/new opens the new-conversation screen.
Settings now also holds whether your Bots ask before acting, rules for every Bot, your memories, your
devices and recent deliveries, and GitHub event sources. Team approval settings and shared account
requests moved to Admin → Approvals.
People can link their Slack and GitHub accounts
Settings → Connected accounts gains a Linked accounts section with one card per account a person can
link. Slack links through a one-time code sent to the OpenTag app in a direct message; a code posted
in a channel is cancelled. GitHub links through a GitHub App's user sign-in, set with
GITHUB_APP_CLIENT_ID and GITHUB_APP_CLIENT_SECRET (both or neither); the server refuses to start
with them and no public URL. Nothing reads the links yet: they are what GitHub alerts and reviews will
build on. Migration 0053_identity_links only adds tables.
An app's account can belong to the team
An administrator can make a Composio app Shared: one account, connected once, that every Bot granted
the app acts as. Who may use it through each Bot is approved per Bot — owner only, named people and
groups, or everyone, and separately whether email, Slack or webhook input may — and checked on every
call. Requests to widen it wait in the Approvals inbox. Writes through a Shared app ask the person
first.
A new deployment starts with two coworkers, not twelve
The example package loaded every coworker in examples/fintech/agents/, so a fresh deployment opened
with General Assistant, Knowledge and ten more at once. The ten now live in examples/fintech/catalog/,
which is not loaded, and a new deployment starts with General Assistant and Knowledge. Risk Analyst
and the picked harness still register when their endpoints are configured. To keep any of the ten,
copy its file from catalog/ into agents/.
A deployment that already registered them keeps them. A coworker dropped from the package is not
retired on the next boot: its row stays, still listed and still refused by delete as protected,
because only a remote coworker with a blank endpoint is retired automatically. To remove the ten
from such a deployment, set deleted_at on their agent_profiles rows after upgrading (see
configuration.md).