feat: Composio Tool Router integration with Google Sheets

[sidneyswift]

Changes

• Removed old Google Sheets implementation (858 lines deleted)
• Composio Tool Router tools now added directly in setupToolsForRequest
• Fixed tool validation for inputSchema (Composio uses inputSchema not parameters)
• Fixed callback URL to localhost:3001 (so composio login goes back to chat in dev)

Related

• Recoup-Chat PR: feat: add Connectors page UI with disconnect functionality Recoup-Chat#1455

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
recoup-api	Ready	Preview	Jan 20, 2026 9:07pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sweetmantech]

rollback changes to this file.

[vercel]

Additional Suggestion:

Missing null/undefined check before using the 'in' operator on session.tools() result causes TypeError if the Composio API returns null or undefined

View Details

📝 Patch Details

diff --git a/lib/composio/toolRouter/getTools.ts b/lib/composio/toolRouter/getTools.ts
index 3d71342..2c66191 100644
--- a/lib/composio/toolRouter/getTools.ts
+++ b/lib/composio/toolRouter/getTools.ts
@@ -58,6 +58,11 @@ export async function getComposioTools(
   // Filter to only allowed tools with runtime validation
   const filteredTools: ToolSet = {};
 
+  // Check if allTools is a valid object before using the 'in' operator
+  if (!allTools || typeof allTools !== "object") {
+    return filteredTools;
+  }
+
   for (const toolName of ALLOWED_TOOLS) {
     if (toolName in allTools) {
       const tool = (allTools as Record<string, unknown>)[toolName];

Analysis

Bug Analysis

Why it happens:

The getComposioTools function in lib/composio/toolRouter/getTools.ts calls session.tools() and immediately uses the result with the in operator without validating it. In JavaScript, the in operator requires its right operand to be an object. If session.tools() returns null or undefined, the code throws a TypeError: "Cannot use 'in' operator to search for [toolName] in null/undefined".

When it manifests:

This error could occur in several scenarios:

1. Network failures when calling the Composio API
2. Unexpected API responses from Composio
3. Session creation failures that return an invalid session object
4. API changes or library bugs in Composio that return null instead of an object

While Composio likely returns a valid object in normal operation, defensive programming requires handling these edge cases, especially for external API calls.

Impact:

• Runtime TypeError crash that would terminate the chat request
• User's chat would fail to load tools
• Application would return a 500 error to the client
• No graceful fallback to continue chat without Composio tools

Fix Applied

Added a null/undefined check immediately after calling session.tools():

// Check if allTools is a valid object before using the 'in' operator
if (!allTools || typeof allTools !== "object") {
  return filteredTools;
}

This check:

1. Validates that allTools is not null or undefined
2. Ensures it's actually an object type
3. Returns an empty ToolSet (which is the correct type) if validation fails
4. Prevents the TypeError while maintaining proper behavior

The fix is safe because:

• An empty ToolSet is a valid return value
• It allows the chat to continue without Composio tools rather than crashing
• The existing code already handles empty objects correctly (the loop just doesn't execute)
• It's consistent with defensive programming practices for external API calls