fix(composio): migrate managed OAuth connections to Connect Links

[Rahulk644]

Summary

• migrate Composio-managed OAuth connections from the retired POST /connected_accounts endpoint to POST /connected_accounts/link
• add typed Zod contracts for Connect Link requests and responses
• consume the new connected_account_id and redirect_url response fields in the Electron connection flow
• add an offline regression test that pins the endpoint, request body, authentication header, and documented 201 response

Problem

Connecting managed OAuth toolkits such as YouTube or LinkedIn currently fails with HTTP 400. Composio retired the legacy endpoint for all managed OAuth organizations on July 3, 2026 and now returns:

Creating connections on this endpoint for Composio-managed OAuth auth configs is no longer supported. Use POST /api/v3/connected_accounts/link instead.

The migration is documented here:

• https://docs.composio.dev/docs/auth-configuration/migrating-initiate-to-link
• https://docs.composio.dev/reference/v3/api-reference/connected-accounts/postConnectedAccountsLink

Compatibility

The existing createConnectedAccount() client remains available for custom auth configs and non-OAuth schemes, which Composio states are not affected by the retirement. Only Rowboat's managed OAuth2 path moves to Connect Links.

The existing localhost callback server, account persistence, status polling, timeout cleanup, and post-connect sync behavior remain unchanged.

Verification

• pnpm --filter @x/core exec vitest run src/composio/client.test.ts
• env ROWBOAT_WORKDIR=/private/tmp/rowboat-composio-core-tests pnpm --filter @x/core test — 54 files / 587 tests passed
• pnpm --filter @x/core typecheck
• ESLint on all four changed files
• pnpm --filter @x/core build
• pnpm --filter rowboat build — Electron main bundle completed

The local Electron build also reported an unrelated Swift SDK/toolchain mismatch for the optional mic-monitor helper; the TypeScript build and main-process bundle completed successfully.