fix: restore connected app discovery and mentions

[iamjr15]

Summary

• Include active connected apps alongside custom skills in the composer @ catalog.
• Add a small database-backed composer capability endpoint so opening @ never waits on Composio.
• Recover from over-specific Composio tool searches with one bounded toolkit fetch and deterministic local ranking.
• Preserve the existing /v1/skills contract for safe, independent Worker and Vercel rollouts.

Context

Direct production bug report; no separate Linear issue or plan document exists.

Architecture

The gateway projects tenant-scoped custom skills and distinct active integration slugs from Postgres in one signed user transaction. The web composer validates and caches this bounded catalog. At execution time, the agent still uses the generic, version-aware Composio list/execute boundary; only an exact zero-result query triggers a bounded broad lookup and local rank.

Decisions Made

Decision	Choice	Alternatives considered	Reasoning
Composer catalog	Dedicated /v1/composer/skills endpoint	Change /v1/skills; call integration catalog separately	Avoids a rollout contract mismatch and removes a second client/provider-dependent request.
Connected-app representation	Active toolkit slugs from Postgres	Import one skill per connector	The existing generic runtime remains tenant-scoped and supports the full open toolkit catalog without bundled vendor sprawl.
Search recovery	Exact query, then one bounded broad fetch and local rank	Guess action slugs; always fetch all actions	Preserves the fast path, handles Composio phrase-search misses, and keeps response/runtime bounds explicit.

Edge Cases Handled

Scenario	Handling
Worker deploy precedes web deploy	Existing /v1/skills response remains unchanged.
Web deploy precedes Worker deploy	React Query surfaces a transient catalog error; no incompatible parsing of the old route.
Duplicate active accounts for one toolkit	Database projection returns distinct toolkit slugs.
Unknown valid toolkit slug	UI derives a safe title-cased display name.
Natural-language action phrase returns zero	Runtime broadens once and ranks non-deprecated tools deterministically.
Broad list exceeds returned candidates	toolsTruncated remains true so the model can refine with a shorter keyword.

How to Review

1. Start with packages/agent-core/src/mastra/tool-defs/composio-tool.ts for discovery semantics.
2. Review apps/gateway-worker/src/skills-routes.ts and packages/db/src/integrations.ts for the catalog boundary.
3. Review apps/web/src/components/composer/use-composer-menu.ts and mention-skill-source.ts for @ behavior.
4. The README and skill text changes document those contracts.

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode
• pnpm architecture:check
• pnpm turbo skills:build
• Production @ catalog shows active Gmail and Notion connections after merge/deploy.
• Ordinary Gmail read prompt discovers and executes the correct action after merge/deploy.
• Ordinary Notion read prompt discovers and executes the correct action after merge/deploy.