composiohq__composio

mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00

Author	SHA1	Message	Date
Alberto Schiabel	62e51e838f	chore(deps): refresh safe dependencies and Effect v4 (#4538 ) ## Summary Refreshes the safe TypeScript, Python, and GitHub Actions dependency surface in one maintainer-owned change. Effect 4 rc.115, Vitest 5, the vendored Effect source, CLI migrations, and agent guidance move together, while known incompatible boundaries stay pinned. The Effect v4 config schemas preserve unknown fields across `config.json` and `user_data.json` read-update-write cycles. Fixes #4535 ## Changes - Keeps Cloudflare Workers fixtures on Vitest 4 until `@cloudflare/vitest-pool-workers` supports Vitest 5. - Keeps Mastra on the Workers-compatible versions and AG2 below 1.0 because AG2 1.x no longer ships the imported `autogen` module. - Removes the unused package-level `pnpm` dependency instead of changing the repository's pinned pnpm 11 toolchain. - Migrates the Effect CLI APIs, Eve callback contract, provider peer ranges, and repository skills required by the selected upgrades. - Preserves unknown CLI settings when `config.json` and `user_data.json` are read, updated, and written back. - Uses immutable SHA pins for the refreshed Claude Code actions and adds release metadata for the affected published TypeScript packages. ## Type of change - [x] Bug fix - [ ] New feature - [x] Refactor/Chore - [x] Documentation - [ ] Breaking change ## How Has This Been Tested? - `pnpm install --frozen-lockfile` with pnpm 11.8.0 - `pnpm typecheck` - `pnpm build:packages` - `pnpm --filter @composio/cli test` — 1,400 passed, 1 skipped, including targeted persistence regressions for `config.json` and `user_data.json` - Package tests — 28 workspace tasks passed - Example typechecks/tests and all Cloudflare dry-runs - Provider compatibility, experimental/Eve, Mastra, CLI keyring, and JSON-schema Effect checks - Agent-skill validation, routing validation, Effect skill example compilation, and peer-dependency checks - All three Python `uv lock --check` runs - `nox -s tst_autogen`, `nox -s snt`, and `nox -s chk type_inference` - Production dependency audit completed with the repository's three existing ignored advisories Docker CLI E2E was not run locally because the Docker daemon is unavailable. The exact root lint command also enters the vendored Effect submodule, whose checkout does not install its `@effect/oxc/oxlint` plugin; scoped lint over the changed non-vendor files passed. ## Screenshots (if applicable) Not applicable. ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [ ] I ran linters/tests locally and they passed - [x] I updated documentation as needed - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages The dependency migrations are covered by the focused and workspace suites. Two targeted regression tests verify that CLI updates preserve unknown fields in `config.json` and `user_data.json`. ## Additional context The Connect client sync retains its existing `Bash(curl *)` permission while moving the removed `allowed_tools` input to `claude_args`. A separate hardening change should move logo downloads outside the model-controlled shell boundary. --- [![Compound Engineering](https://img.shields.io/badge/Built_with-Compound_Engineering-6366f1)](https://github.com/EveryInc/compound-engineering-plugin)	2026-09-21 15:23:42 +04:00
Alberto Schiabel	705591451c	chore(deps): upgrade CI actions and every outdated dependency (#4381 ) This PR: - upgrades every CI action to its latest release (only `changesets/action` had one: v2.1.1 -> v2.1.2, SHA-pinned) and every outdated dependency across the pnpm workspace, the docs bun workspace, and all three `uv.lock` files - moves zod to 4.5.4 everywhere first-party — catalog, docs, `@composio/json-schema-to-zod`, `@composio/claude-agent-sdk` and the zod-v4 e2e fixtures; the `-zod-v3` fixtures stay on 3.25.76 because that is what they exercise - moves `@mastra/core` 1.52.1 -> 1.53.0, which is the ceiling rather than a preference: bisecting `ts/examples/mastra`'s `cf:dry-run` shows 1.54.0 moved the workspace/sandbox subsystem behind `@mastra/core/agent`, which drags execa (-> `npm-run-path` -> `unicorn-magic`) into the Workers bundle where esbuild cannot link it. `@mastra/mcp` is capped at 1.17.2 for the same reason — 1.17.3 wants `@mastra/core` >=1.64. The docs bun workspace mirrors that cap as an explicit devDependency plus `overrides` entry, because bun does not apply overrides to auto-installed peers - clears every production advisory that has a published fix, so the audit gate can run without `--ignore`, which does not filter a single run: it writes the advisory into `auditConfig` and exits 0 whatever else is outstanding, so the gate was passing over nine advisories - `qs` -> >=6.16.0, `fast-uri` -> >=3.1.6, `toml` -> the 4.x line, all via overrides in the existing `# temporary: … drop when` style - `extract-zip` (GHSA-jmr9-qjv8-65gv) has no fixed version to move to — 2.0.1 is the newest release and GitHub records `first_patched_version` as null — so it moves to `auditConfig.ignoreGhsas` pointing at the `extractZipSafely` mitigation that already covers it - GHSA-866g-f22w-33x8 (`@ai-sdk/provider-utils` 3.x, low) also has nothing to move to: the advisory names 3.0.98 as patched but the 3.x line stopped at 3.0.30 and GitHub records no fixed version. It only enters the tree through `@mastra/core`, which is a peer or dev dependency of every published package, so all flagged paths are private examples and e2e fixtures. It goes in `ignoreGhsas` with that rationale so the un-levelled `pnpm audit --prod` step stops posting a warning comment on every PR - widens `@composio/anthropic`'s `@anthropic-ai/sdk` peer range to include `^0.124.0`, the line its devDependency now tests against (for a `0.x` caret, `^0.120.0` excluded it); the package is in the changeset for that reason - adapts three call sites that upstream broke: `eve` 0.52 moved `ApprovalContext` to `eve/tools/approval`, `@pierre/diffs` 1.4 gave `FileDiffProps` a second type parameter, and `fumadocs-openapi` 11.4 fixed the undeclared-tag drop that a docs guard test asserted (the guard now also asserts the page positively, so it cannot pass vacuously) - drops the stale `hono` `minimumReleaseAgeExclude` entry (its comment said to after 2026-08-06) and adds an `undici` `peerDependencyRules` allowance for openai 7.10's new optional peer ## Context Some upgrades were deliberately declined, each for a reason recorded next to the pin: - `vitest`/`@vitest/ui` stay on 4.1.11 — `@cloudflare/vitest-pool-workers@0.22.0` (latest) peers on `vitest ^4.1.0` - `undici` stays on `^7` in core — `pinnedDispatcher.node.ts` documents that Node's `fetch` rejects undici 8 dispatchers - the `pnpm` catalog entry stays on `^11` to match the mise-owned toolchain - `eve` stays on 0.27.6 in docs — 0.52 changes the `defineAgent` model definition and the `useEveAgent` helpers, so `agent/agent.ts` and `components/eve-chat.tsx` fail `types:check`; migrating the docs agent is its own PR - `@earendil-works/pi-coding-agent` stays on 0.84.4 — 0.85.x imports `@earendil-works/pi-server` without declaring it, so `test/pi.test.ts` fails to load `declareOperationTags` is kept as a safety net rather than retired, even though `fumadocs-openapi` 11.4 makes it redundant: removing it changes how specs are normalised at sync time and is worth its own PR. Verified locally: `pnpm build:packages`, `pnpm typecheck`, `pnpm test`, `pnpm typecheck:examples`, `pnpm lint:examples`, `turbo cf:dry-run --filter='./ts/examples/'`, `pnpm peers check`, `pnpm audit --prod --audit-level=high` (exit 0), frozen-lockfile installs for pnpm and bun, docs `types:check` + 542 static tests, and Python `make chk` + `make tst` (1790 passed). https://claude.ai/code/session_018evFic47PFPXuB95uRE1aw EOF -R ComposioHQ/composio	2026-09-08 16:15:34 +02:00
jkomyno	9758571072	chore(deps-dev): update TypeScript tooling	2026-08-28 14:52:53 +02:00
Alberto Schiabel	f926058147	fix(cli): refuse symlink entries when extracting archives (#4210 ) Addresses the `pnpm audit --prod` warning that has been riding along on recent CLI PRs: `extract-zip` unvalidated symlink path traversal, [GHSA-jmr9-qjv8-65gv](https://github.com/advisories/GHSA-jmr9-qjv8-65gv) / CVE-2026-56876, high. ## There is no version to upgrade to `pnpm audit` renders "Patched versions >=2.0.2", which reads like a bump would fix it. It would not: - `npm view extract-zip versions` ends at 2.0.1 — no 2.0.2 was ever published - the advisory itself records `"first_patched_version": null` So `pnpm audit --fix --prod` cannot resolve this, and neither can a version constraint. ## What the flaw actually is I reproduced it rather than working from the summary. `extract-zip` 2.0.1 does block writes that traverse a symlink — an archive with `link -> ../../ESCAPED` plus `link/pwned.txt` is refused with `Out of bound path ... while processing file link/pwned.txt`, and nothing lands outside the target. What it does not do is validate the symlink itself. An archive whose only entry is `escape-abs -> /tmp/ABSOLUTE-TARGET` extracts cleanly and plants that dangling symlink in the output directory. Per the advisory: "Depending on how extract-zip is used, an attacker could read or write to arbitrary files." Every call site here extracts an archive and then reads or copies files back out of the tree, which is exactly the shape that turns a planted symlink into an arbitrary-path read. ## Why not swap the library `#4183` moved tar extraction to `Bun.Archive`, so that was the obvious candidate. It does not work: `Bun.Archive` cannot read zip archives at all. A benign zip fails with `ReadError`, same as the malicious ones — those "refusals" were read failures, not security. Verified before ruling it out. ## Why not fix it upstream Because it already is, three times over, and none of it has moved: \| PR \| Date \| Targets \| \| --- \| --- \| --- \| \| [max-mapper/extract-zip#158](https://github.com/max-mapper/extract-zip/pull/158) \| 2026-08-14 \| GHSA-jmr9-qjv8-65gv, this advisory \| \| [#160](https://github.com/max-mapper/extract-zip/pull/160) \| 2026-08-17 \| CVE-2026-19693, symlink at the final path component \| \| [#161](https://github.com/max-mapper/extract-zip/pull/161) \| 2026-08-20 \| CVE-2026-56876 again, and bumps the version to 2.0.2 \| All three are mergeable with zero review comments. The repository's last commit to `master` was August 2021; 2.0.1 shipped June 2020. [Issue #159](https://github.com/max-mapper/extract-zip/issues/159), a downstream consumer asking whether a patched release is planned, has three replies — every one from another stranded consumer, none from a maintainer. A fourth PR would not be a contribution. And our implementation is the wrong shape to upstream regardless: refusing every symlink is right for an application whose archives never carry one, but a breaking change for a general-purpose library, where the correct fix is validating that a link's resolved target stays inside the extraction root — which is what #158 and #161 already do. Upstream even tracks "do not extract symlinks" as a separate [feature request](https://github.com/max-mapper/extract-zip/issues/140), open since 2023. So this is a deliberate local workaround on a timeline we control. The helper's doc comment records the tracking PRs and the condition for deleting it: a published release that actually carries the fix. ## The fix No archive either package extracts — release binaries, companion assets, skills, sidecar bundles — legitimately contains a symlink. So the entry type is refused outright, via `extract-zip`'s own `onEntry` hook, which runs before the entry is written. A rejected archive plants nothing. All four call sites now go through it: \| package \| call site \| \| --- \| --- \| \| `cli` \| `services/upgrade-binary.ts` \| \| `cli` \| `services/run-companion-modules.ts` \| \| `cli` \| `effects/install-skill.ts` \| \| `cli-local-tools` \| `src/bundled-binaries.ts` \| Each package carries its own copy of the helper rather than sharing one. `run-companion-modules.ts` is bundled as a standalone companion module and imports nothing from `@composio/cli-local-tools`; routing it through that package to share ~15 lines would pull the local-tools tree into those bundles. ## Verification Committed three fixture archives (827 bytes total) and tested against real zips, not mocks: - benign archive extracts, contents intact - `symlink-absolute.zip` (`-> /tmp/ABSOLUTE-TARGET`) refused, output directory left empty - `symlink-relative.zip` (`-> ../../outside`) refused, output directory left empty - `isSymlinkZipEntry` unit-tested across symlink, regular file, directory, and Windows-authored entries with no Unix mode Mutation-checked: neutering the predicate makes exactly the three symlink tests fail and leaves the other four green, so the suite genuinely detects the regression rather than passing by construction. Suites: `@composio/cli` 123 files / 1263 passed, `@composio/cli-local-tools` 7 files / 20 passed. Typecheck clean on both. `pnpm validate:changesets` passes; note lands in `ts/packages/cli/CHANGELOG.md`. `extract-zip` stays as the dependency — it is still the only working zip reader here, and with symlink entries refused the advisory's vector no longer applies to this codebase. https://claude.ai/code/session_01JkwtxPHfobZxzvAqe53x62	2026-08-23 12:28:24 +02:00
dependabot[bot]	c0c511bb4b	chore(deps-dev): bump the npm-development group with 7 updates (#4133 ) Bumps the npm-development group with 7 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) \| `26.1.2` \| `26.2.0` \| \| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) \| `1.77.0` \| `1.78.0` \| \| [oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint) \| `1.77.0` \| `1.78.0` \| \| [turbo](https://github.com/vercel/turborepo) \| `2.10.8` \| `2.10.9` \| \| [chrome-devtools-mcp](https://github.com/ChromeDevTools/chrome-devtools-mcp) \| `1.6.0` \| `1.7.0` \| \| [@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent) \| `0.83.0` \| `0.84.1` \| \| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) \| `0.29.5` \| `0.31.3` \| Updates `@types/node` from 26.1.2 to 26.2.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.77.0 to 1.78.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's changelog</a>.</em></p> <blockquote> <h2>[1.78.0] - 2026-08-10</h2> <h3>🚀 Features</h3> <ul> <li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>) (Mikhail Baev)</li> <li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>) (Cole Ellison)</li> <li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>) (Cole Ellison)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>9573937 linter/typescript: Validate <code>ban-ts-comment</code> description_format (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>) (Mikhail Baev)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a> release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25473">#25473</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/ccb8fe89db08123ff2b86d7fb2f39d0dd6c33df7"><code>ccb8fe8</code></a> feat(linter/jsdoc): implement <code>no-blank-blocks</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/9573937df3cc01f29e1c65bc018ce378ec947e0e"><code>9573937</code></a> fix(linter/typescript): validate <code>ban-ts-comment</code> description_format (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/d4a897ce2290bf853720b4fbf371304bfea2c980"><code>d4a897c</code></a> feat(linter/eslint): implement <code>one-var</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/5ab9340637eff80539bca89a494e162e94569358"><code>5ab9340</code></a> feat(linter/jsx-a11y/anchor-has-content): add options to match eslint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.78.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Updates `oxlint-plugin-eslint` from 1.77.0 to 1.78.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxlint-plugin-eslint's releases</a>.</em></p> <blockquote> <h2>oxlint v1.78.0 & oxfmt v0.63.0</h2> <h2>Table of Contents</h2> <ul> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxlint-v1.78.0">Oxlint v1.78.0</a></li> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxfmt-v0.63.0">Oxfmt v0.63.0</a></li> </ul> <h2>Oxlint v1.78.0</h2> <h3>🚀 Features</h3> <ul> <li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25207">#25207</a>) (Mikhail Baev)</li> <li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24470">#24470</a>) (Cole Ellison)</li> <li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24571">#24571</a>) (Cole Ellison)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>b746e00 linter/eslint/no-implicit-coercion: Preserve template coercion whitespace (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25470">#25470</a>) (camc314)</li> <li>a92c541 linter: Preserve source text for JS plugin ignore fixes (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25280">#25280</a>) (Norcleeh)</li> <li>675c840 linter/eslint/prefer-promise-reject-errors: Handle parenthesized calls (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25378">#25378</a>) (camc314)</li> <li>1703739 linter/unicorn/new-for-builtins: Ignore optional chains (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25411">#25411</a>) (tanakalucky)</li> <li>95ece63 linter/unicorn/prefer-code-point: Downgrade the auto-fix to dangerous (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25412">#25412</a>) (leemr)</li> <li>c451a0e linter/vitest: Validate <code>consistent-test-filename</code> regex patterns (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25408">#25408</a>) (Mikhail Baev)</li> <li>937825c react_compiler: Disable exhaustive memo validation by default (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25417">#25417</a>) (Boshen)</li> <li>f0f7dae linter/eslint/no-unused-vars: Report invalid regex options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25380">#25380</a>) (Cameron)</li> <li>44e73fd linter/unicorn/prefer-array-flat: Fix <code>concat.apply</code> suggestions (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25373">#25373</a>) (Cameron)</li> <li>6846a9a linter/react/rules-of-hooks: Detect constructor callbacks (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25377">#25377</a>) (camc314)</li> <li>b247a9d linter/unicorn/new-for-builtins: Support <code>Float16Array</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25382">#25382</a>) (tanakalucky)</li> <li>19109cd linter/unicorn/error-message: Support <code>SuppressedError</code> messages (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25375">#25375</a>) (camc314)</li> <li>9c13f5e linter: Assert token lookup invariants (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25368">#25368</a>) (camc314)</li> <li>bc35f83 linter/eslint/no-unused-vars: Bound catch parameter lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25367">#25367</a>) (camc314)</li> <li>c159fb9 linter/unicorn/switch-case-braces: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25363">#25363</a>) (camc314)</li> <li>03b2eb2 linter/unicorn/no-static-only-class: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25361">#25361</a>) (camc314)</li> <li>0afc59e linter/unicorn/empty-brace-spaces: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25353">#25353</a>) (camc314)</li> <li>2963d98 linter/eslint/no-unreachable-loop: Do not report loops whose body has a finally block (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25335">#25335</a>) (Todor Andonov)</li> <li>589e5fb linter/eslint/no-param-reassign: Validate <code>ignorePropertyModificationsForRegex</code> property (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25346">#25346</a>) (Mikhail Baev)</li> <li>aae5d8b linter/eslint/no-throw-literal: False positive on variable declared without initializer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25275">#25275</a>) (cjnoname)</li> <li>6b1c479 oxlint: Normalize customized rule names (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25316">#25316</a>) (camc314)</li> <li>d494eb5 linter/unicorn/consistent-existence-index-check: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25325">#25325</a>) (camc314)</li> <li>4266037 linter/typescript/prefer-namespace-keyword: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25322">#25322</a>) (camc314)</li> <li>4745b4e linter/typescript/no-namespace: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25321">#25321</a>) (camc314)</li> <li>648a481 linter/eslint/one-var: Avoid joining exported declarations (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25314">#25314</a>) (camc314)</li> <li>9573937 linter/typescript: Validate <code>ban-ts-comment</code> description_format (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25320">#25320</a>) (Mikhail Baev)</li> <li>ebf7d18 linter/typescript/consistent-type-definitions: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25281">#25281</a>) (camc314)</li> <li>1501ccf linter/typescript/consistent-generic-constructors: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25258">#25258</a>) (camc314)</li> </ul> <h3>⚡ Performance</h3> <ul> <li>8f784f3 linter: Reduce rule config dispatch size (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25461">#25461</a>) (Boshen)</li> <li>2de4ec2 linter: Reduce visitor code size (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25441">#25441</a>) (Boshen)</li> <li>6fb7f47 linter/unicorn/prefer-export-from: Narrow <code>ExportFromDeclaration</code> lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25381">#25381</a>) (camc314)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a> release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25473">#25473</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/apps_v1.78.0/npm/oxlint-plugin-eslint">compare view</a></li> </ul> </details> <br /> Updates `turbo` from 2.10.8 to 2.10.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.10.9</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>chore: Release Turborepo 2.10.8 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13626">vercel/turborepo#13626</a></li> <li>perf: Walk literal-prefix tree globs without wax compilation by <a href="https://github.com/charpeni"><code>@charpeni</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13522">vercel/turborepo#13522</a></li> <li>fix: Accept semver ranges in devEngines.packageManager.version by <a href="https://github.com/bangseongbeom"><code>@bangseongbeom</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13623">vercel/turborepo#13623</a></li> <li>docs: Explain affected package invalidation reasons by <a href="https://github.com/ghoullier"><code>@ghoullier</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13594">vercel/turborepo#13594</a></li> <li>perf(lockfiles): Borrow field-name scalars in the pnpm fast parser by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13648">vercel/turborepo#13648</a></li> <li>perf(repository): Avoid discarded alias allocation in Relationship by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13650">vercel/turborepo#13650</a></li> <li>perf(lockfiles): Drop redundant human_name clone for pnpm v7/v9 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13649">vercel/turborepo#13649</a></li> <li>perf: Index workspace nodes by name in project_relationships by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13647">vercel/turborepo#13647</a></li> <li>perf: Share resolution identity lists across identical workspace closures by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13641">vercel/turborepo#13641</a></li> <li>docs: Fix duplicated word in runtime dependencies guide summary by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13630">vercel/turborepo#13630</a></li> <li>refactor: Remove turborepo-lsp dependency on turborepo-lib by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13631">vercel/turborepo#13631</a></li> <li>perf: Index Bun nested lockfile entries by name for fallback resolution by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13633">vercel/turborepo#13633</a></li> <li>perf: Memoize framework inference per package during task hashing by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13634">vercel/turborepo#13634</a></li> <li>perf: Avoid materializing transient declarations in external_dependencies by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13646">vercel/turborepo#13646</a></li> <li>perf: Enable shared closure DP for npm and yarn1 lockfiles by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13635">vercel/turborepo#13635</a></li> <li>perf: Parse pnpm explicit-key entries in the lockfile fast path by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13640">vercel/turborepo#13640</a></li> <li>perf: Parallelize resolution fingerprint hashing by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13642">vercel/turborepo#13642</a></li> <li>perf: Build resolution identity lists in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13643">vercel/turborepo#13643</a></li> <li>perf: Intern resolution identities as Arc<str> across closures by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13645">vercel/turborepo#13645</a></li> <li>fix: Compose affected tasks with package filters by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13656">vercel/turborepo#13656</a></li> <li>docs: Explain worktree cache path isolation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13657">vercel/turborepo#13657</a></li> <li>fix: Upgrade brace-expansion to 5.0.9 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13658">vercel/turborepo#13658</a></li> <li>docs: Correct verified inaccuracies in the Turborepo Agent Skill by <a href="https://github.com/charpeni"><code>@charpeni</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13644">vercel/turborepo#13644</a></li> <li>chore: Update Next.js to 16.3.0 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13659">vercel/turborepo#13659</a></li> <li>fix: Don't use <code>eprintln!</code> in the panic hook by <a href="https://github.com/molofsky"><code>@molofsky</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13637">vercel/turborepo#13637</a></li> <li>fix: Invalidate only when Git ignore sources change by <a href="https://github.com/smasato"><code>@smasato</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13632">vercel/turborepo#13632</a></li> <li>docs: Update Geistdocs to 1.19.4 by <a href="https://github.com/christopherkindl"><code>@christopherkindl</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13680">vercel/turborepo#13680</a></li> <li>docs: Exclude Turborepo from its own OSS products menu by <a href="https://github.com/christopherkindl"><code>@christopherkindl</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13681">vercel/turborepo#13681</a></li> <li>docs: Use the geistdocs Turborepo logo in the navbar by <a href="https://github.com/christopherkindl"><code>@christopherkindl</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13682">vercel/turborepo#13682</a></li> <li>docs: Update redirected vercel.com/nextjs.org links to current targets by <a href="https://github.com/molebox"><code>@molebox</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13685">vercel/turborepo#13685</a></li> <li>refactor: Generalize native command arguments by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13664">vercel/turborepo#13664</a></li> <li>refactor: Move native contracts to tasks by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13665">vercel/turborepo#13665</a></li> <li>docs: Fix loadTransformers reference in turbo-codemod README by <a href="https://github.com/latent-9"><code>@latent-9</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13683">vercel/turborepo#13683</a></li> <li>refactor: Model native task execution explicitly by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13666">vercel/turborepo#13666</a></li> <li>feat: Compose aggregate native task dependencies by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13667">vercel/turborepo#13667</a></li> <li>fix: Respect aggregate task overrides by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13668">vercel/turborepo#13668</a></li> <li>test: Stabilize watch task inputs regression test by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13686">vercel/turborepo#13686</a></li> <li>feat: Parse Python quality tool declarations by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13669">vercel/turborepo#13669</a></li> <li>feat: Resolve Python quality plans by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13670">vercel/turborepo#13670</a></li> <li>refactor: Extract uv native task specs by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13671">vercel/turborepo#13671</a></li> <li>feat: Synthesize Python quality tasks by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13672">vercel/turborepo#13672</a></li> <li>test: Cover Python quality task commands by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13673">vercel/turborepo#13673</a></li> <li>feat: Hash Python quality task inputs by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13674">vercel/turborepo#13674</a></li> <li>test: Cover Python quality task graph by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13675">vercel/turborepo#13675</a></li> <li>chore: Release Turborepo 2.10.9-canary.1 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13687">vercel/turborepo#13687</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/33237d4be13d7b74768c2cf3353b19cfa8d1af7c"><code>33237d4</code></a> publish 2.10.9 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/3b0e57f1289b2a6b3d6dd402bce928469d3b25fa"><code>3b0e57f</code></a> fix: Prevent Windows process cleanup PID reuse (<a href="https://redirect.github.com/vercel/turborepo/issues/13695">#13695</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/efe4e1bdf665f2950cf89d7968907de36c2f0737"><code>efe4e1b</code></a> fix: Prune Bun wildcard workspace dev dependencies (<a href="https://redirect.github.com/vercel/turborepo/issues/13694">#13694</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/a98e5cde97796088c6107684a64a40a967cd1ef0"><code>a98e5cd</code></a> docs: Document dependency-driven Python tasks (<a href="https://redirect.github.com/vercel/turborepo/issues/13676">#13676</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/c09a92f526b6dca9ea0243922f680803779759cd"><code>c09a92f</code></a> chore: Release Turborepo 2.10.9-canary.1 (<a href="https://redirect.github.com/vercel/turborepo/issues/13687">#13687</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/09bd548dddbff2a29086bdef7cb07b02d5e5458a"><code>09bd548</code></a> test: Cover Python quality task graph (<a href="https://redirect.github.com/vercel/turborepo/issues/13675">#13675</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/3584a5fb8edac9efc826fdea57e92088505fc76a"><code>3584a5f</code></a> feat: Hash Python quality task inputs (<a href="https://redirect.github.com/vercel/turborepo/issues/13674">#13674</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/0d43ff3cbf5ac8873c646a84b2fd7ae53097e08d"><code>0d43ff3</code></a> test: Cover Python quality task commands (<a href="https://redirect.github.com/vercel/turborepo/issues/13673">#13673</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/94708adc6bc19b41805741cc5a15ac5467a481cf"><code>94708ad</code></a> feat: Synthesize Python quality tasks (<a href="https://redirect.github.com/vercel/turborepo/issues/13672">#13672</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/e14f04ec6c2dc2791b0a3beb32df7515b31b3d4b"><code>e14f04e</code></a> refactor: Extract uv native task specs (<a href="https://redirect.github.com/vercel/turborepo/issues/13671">#13671</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.10.8...v2.10.9">compare view</a></li> </ul> </details> <br /> Updates `chrome-devtools-mcp` from 1.6.0 to 1.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/releases">chrome-devtools-mcp's releases</a>.</em></p> <blockquote> <h2>chrome-devtools-mcp: v1.7.0</h2> <h2><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a> (2026-08-10)</h2> <h3>🎉 Features</h3> <ul> <li>add a utility function to check for localhost. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li> <li>Add get_heapsnapshot_object_details MCP tool (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li> <li>Emit native contexts in snapshot summary (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li> <li>Filter heap snapshot objects by native context (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li> <li><strong>telemetry:</strong> log devtools data. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li> <li><strong>telemetry:</strong> log is_devtools_open with each tool call. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li> <li><strong>telemetry:</strong> report whether tool call is made on localhost. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li> <li>update lighthouse to 13.4.1 (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li> </ul> <h3>🛠️ Fixes</h3> <ul> <li>bound per-navigation network request retention (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li> <li><strong>cli:</strong> validate session ids (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li> <li><strong>cli:</strong> warn about version mismatch between cli and daemon (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li> <li><strong>daemon:</strong> preserve hyphenated browser flags in arg serialization and lazy daemon startup (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li> <li>dispose heap snapshot workers on context teardown (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li> <li>do not throw synchronously when a CDP session is gone (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li> <li>don't throw if Dialog was handled (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li> <li>downscale viewport screenshots when no viewport is emulated (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li> <li>improve daemon lifecycle (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li> <li>improve file writing (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li> <li>include the tab id in <code>get_tab_id</code>'s text response (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li> <li><strong>memory:</strong> dispose the heap-snapshot worker when loading fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li> <li><strong>performance:</strong> reset trace-running flag when start_trace setup fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li> <li>regression after the <a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a> (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li> <li>rename maxRetainedSize column (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li> <li><strong>screenshot:</strong> dispose element handle after take_screenshot (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li> <li>toggle lazy loading for source maps. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li> <li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens during an action (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li> </ul> <h3>📄 Documentation</h3> <ul> <li>Add devin cli install instruction to README (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li> <li>correct the user data directory documentation (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li> <li><strong>skills:</strong> update memory leak debugging skill to use native MCP tools (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li> <li>Update Chrome requirement for categoryExperimentalWebmcp (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li> <li>update security.md (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li> </ul> <h3>🏗️ Refactor</h3> <ul> <li>clean up McpResponse.handle (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/main/CHANGELOG.md">chrome-devtools-mcp's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a> (2026-08-10)</h2> <h3>🎉 Features</h3> <ul> <li>add a utility function to check for localhost. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li> <li>Add get_heapsnapshot_object_details MCP tool (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li> <li>Emit native contexts in snapshot summary (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li> <li>Filter heap snapshot objects by native context (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li> <li><strong>telemetry:</strong> log devtools data. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li> <li><strong>telemetry:</strong> log is_devtools_open with each tool call. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li> <li><strong>telemetry:</strong> report whether tool call is made on localhost. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li> <li>update lighthouse to 13.4.1 (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li> </ul> <h3>🛠️ Fixes</h3> <ul> <li>bound per-navigation network request retention (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li> <li><strong>cli:</strong> validate session ids (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li> <li><strong>cli:</strong> warn about version mismatch between cli and daemon (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li> <li><strong>daemon:</strong> preserve hyphenated browser flags in arg serialization and lazy daemon startup (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li> <li>dispose heap snapshot workers on context teardown (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li> <li>do not throw synchronously when a CDP session is gone (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li> <li>don't throw if Dialog was handled (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li> <li>downscale viewport screenshots when no viewport is emulated (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li> <li>improve daemon lifecycle (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li> <li>improve file writing (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li> <li>include the tab id in <code>get_tab_id</code>'s text response (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li> <li><strong>memory:</strong> dispose the heap-snapshot worker when loading fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li> <li><strong>performance:</strong> reset trace-running flag when start_trace setup fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li> <li>regression after the <a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a> (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li> <li>rename maxRetainedSize column (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li> <li><strong>screenshot:</strong> dispose element handle after take_screenshot (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li> <li>toggle lazy loading for source maps. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li> <li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens during an action (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li> </ul> <h3>📄 Documentation</h3> <ul> <li>Add devin cli install instruction to README (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li> <li>correct the user data directory documentation (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li> <li><strong>skills:</strong> update memory leak debugging skill to use native MCP tools (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li> <li>Update Chrome requirement for categoryExperimentalWebmcp (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li> <li>update security.md (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li> </ul> <h3>🏗️ Refactor</h3> <ul> <li>clean up McpResponse.handle (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li> <li>introduce Explicit resouce managent (using) (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5b25370c9cd779032c3c9dc9880eca7031c73005">5b25370</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/774d78f5eef5e610407a0c92fa6ec5ed74b027e8"><code>774d78f</code></a> chore(main): release chrome-devtools-mcp 1.7.0 (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2363">#2363</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57"><code>5ddbffd</code></a> docs: correct the user data directory documentation (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753"><code>8028bfe</code></a> fix: toggle lazy loading for source maps. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d1e4d711aa520c67df045a2f805380e9b3307abd"><code>d1e4d71</code></a> chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.2 in the all gr...</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93"><code>744738d</code></a> fix(memory): dispose the heap-snapshot worker when loading fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ca66d0f321a57473ae400fa5e82842d4bbffe210"><code>ca66d0f</code></a> chore(dev-deps): bump devtools-frontend (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2498">#2498</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/2f375c7e592d15ee9d0e1d665a4600a8b20879d0"><code>2f375c7</code></a> chore: fix Explicit resource management polyfill (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2496">#2496</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/830f78b8ce19f8ee1e1d8c4d812bd9d6e4f48c2f"><code>830f78b</code></a> chore: re-use connection adapter and dispose devtools unvierse (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2465">#2465</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c96dca1f19711a80308bd0d608fb8d40e29d152"><code>4c96dca</code></a> ci: add main branch (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2497">#2497</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/71d897b27e7936c1a8911d053e19d92ec2c46655"><code>71d897b</code></a> chore: add a new profiler scenario for get_console_messages. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2491">#2491</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">compare view</a></li> </ul> </details> <br /> Updates `@earendil-works/pi-coding-agent` from 0.83.0 to 0.84.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/earendil-works/pi/releases">@earendil-works/pi-coding-agent's releases</a>.</em></p> <blockquote> <h2>v0.84.1</h2> <h3>New Features</h3> <ul> <li><strong>Qwen Token Plan Individual</strong> — Use the built-in provider for models documented for Individual subscriptions. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API Keys</a>.</li> <li><strong>Authentication readiness checks</strong> — Use <code>pi auth check</code> to verify provider or model credentials, optionally emitting the resolved credential.</li> <li><strong>Improved fullscreen interaction</strong> — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI Fullscreen Viewport</a>.</li> <li><strong>Terminating blocked tool calls</strong> — Extension <code>tool_call</code> handlers can stop all-terminating batches without another model call. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool Events</a>.</li> </ul> <h3>Added</h3> <ul> <li>Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international <code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API Keys</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a> by <a href="https://github.com/arasovic"><code>@arasovic</code></a>).</li> <li>Added <code>pi auth check</code> provider/model auth preflight with optional credential output (<a href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li> <li>Added <code>terminate</code> support to blocked extension <code>tool_call</code> events so all-terminating batches can skip the automatic follow-up model call. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool Events</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a> by <a href="https://github.com/muyiyr"><code>@muyiyr</code></a>).</li> <li>Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (<a href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>, <a href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a> by <a href="https://github.com/volsa"><code>@volsa</code></a>).</li> <li>Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI Fullscreen Viewport</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li> </ul> <h3>Changed</h3> <ul> <li>Softened the bash tool's <code>PI_</code> environment guideline in an attempt to reduce unnecessary inspection commands (<a href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li> <li>Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed Bun standalone binaries crashing on startup when the cwd contains a <code>bunfig.toml</code> with <code>preload</code> by compiling with <code>--no-compile-autoload-bunfig</code> (<a href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a> by <a href="https://github.com/geril07"><code>@geril07</code></a>).</li> <li>Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (<a href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li> <li>Fixed right-click not pasting clipboard text in fullscreen mode on Windows.</li> <li>Fixed inherited <code>Agent.reset()</code> clearing transcript and runtime state during active runs; it now rejects until the agent is idle (<a href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a> by <a href="https://github.com/wesleyzhangwq"><code>@wesleyzhangwq</code></a>).</li> <li>Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.</li> <li>Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.</li> </ul> <h2>v0.84.0</h2> <h3>New Features</h3> <ul> <li><strong>Fullscreen TUI mode</strong> — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#ui--display">UI & Display</a>.</li> <li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#markdown">Markdown settings</a> and <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/tui/README.md#markdown">TUI Markdown</a>.</li> <li><strong>Per-directory context overrides</strong> — Use <code>AGENTS.override.md</code> to replace context files for a specific directory. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/usage.md#context-files">Context Files</a>.</li> <li><strong>Advanced custom model sampling</strong> — Configure arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM <code>thinking_token_budget</code> values. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/models.md#sampling-parameters">Sampling Parameters</a>.</li> <li><strong>Baseten provider</strong> — Use built-in Baseten authentication and model support. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/providers.md#api-keys">API Keys</a>.</li> </ul> <h3>Breaking Changes</h3> <ul> <li> <p>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code> interface to <code>ModelsRequestTransforms</code> because its header transformation now applies to all authenticated provider requests.</p> </li> <li> <p>Changed JSON and RPC <code>message_update</code> events to emit only <code>assistantMessageEvent</code> deltas, removing the cumulative <code>message</code> and <code>assistantMessageEvent.partial</code> fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between <code>message_start</code> and <code>message_end</code>; the latter remains authoritative (<a href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</p> </li> <li> <p><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns <code>ProviderHeaders</code> with <code>string \| null</code> values and preserves <code>null</code> header-deletion markers. Extensions that inspect returned headers must handle <code>null</code>; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (<a href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</p> </li> <li> <p>Changed <code>ModelRegistry.refresh()</code> to accept <code>ModelsRefreshOptions</code> and return <code>ModelsRefreshResult</code> instead of discarding cancellation and provider errors.</p> </li> <li> <p>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth cancellation options rather than catalog refresh options. Call <code>refresh({ providers: [providerId], signal })</code> separately when remote freshness is required.</p> </li> <li> <p>Required config-form extension OAuth <code>refreshToken(credentials, signal)</code> callbacks to accept and honor a concrete abort signal.</p> </li> <li> <p>Replaced dynamic provider refresh context store access with the read-only <code>context.stored</code> snapshot and generation-checked <code>context.publish()</code> transaction.</p> <p><strong>Providers built with <code>createProvider({ fetchModels })</code>:</strong> no catalog-publication migration is required. Before and after, return the fetched models and register the resulting provider; <code>createProvider()</code> owns restoration, persistence, and in-memory publication.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@earendil-works/pi-coding-agent's changelog</a>.</em></p> <blockquote> <h2>[0.84.1] - 2026-08-07</h2> <h3>New Features</h3> <ul> <li><strong>Qwen Token Plan Individual</strong> — Use the built-in provider for models documented for Individual subscriptions. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API Keys</a>.</li> <li><strong>Authentication readiness checks</strong> — Use <code>pi auth check</code> to verify provider or model credentials, optionally emitting the resolved credential.</li> <li><strong>Improved fullscreen interaction</strong> — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI Fullscreen Viewport</a>.</li> <li><strong>Terminating blocked tool calls</strong> — Extension <code>tool_call</code> handlers can stop all-terminating batches without another model call. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool Events</a>.</li> </ul> <h3>Added</h3> <ul> <li>Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international <code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API Keys</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a> by <a href="https://github.com/arasovic"><code>@arasovic</code></a>).</li> <li>Added <code>pi auth check</code> provider/model auth preflight with optional credential output (<a href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li> <li>Added <code>terminate</code> support to blocked extension <code>tool_call</code> events so all-terminating batches can skip the automatic follow-up model call. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool Events</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a> by <a href="https://github.com/muyiyr"><code>@muyiyr</code></a>).</li> <li>Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (<a href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>, <a href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a> by <a href="https://github.com/volsa"><code>@volsa</code></a>).</li> <li>Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI Fullscreen Viewport</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li> </ul> <h3>Changed</h3> <ul> <li>Softened the bash tool's <code>PI_</code> environment guideline in an attempt to reduce unnecessary inspection commands (<a href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li> <li>Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed Bun standalone binaries crashing on startup when the cwd contains a <code>bunfig.toml</code> with <code>preload</code> by compiling with <code>--no-compile-autoload-bunfig</code> (<a href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a> by <a href="https://github.com/geril07"><code>@geril07</code></a>).</li> <li>Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (<a href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li> <li>Fixed right-click not pasting clipboard text in fullscreen mode on Windows.</li> <li>Fixed inherited <code>Agent.reset()</code> clearing transcript and runtime state during active runs; it now rejects until the agent is idle (<a href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a> by <a href="https://github.com/wesleyzhangwq"><code>@wesleyzhangwq</code></a>).</li> <li>Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.</li> <li>Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.</li> </ul> <h2>[0.84.0] - 2026-08-06</h2> <h3>New Features</h3> <ul> <li><strong>Fullscreen TUI mode</strong> — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#ui-display">UI & Display</a>.</li> <li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#markdown">Markdown settings</a> and <a href="https://github.com/earendil-works/pi/blob/main/packages/tui/README.md#markdown">TUI Markdown</a>.</li> <li><strong>Per-directory context overrides</strong> — Use <code>AGENTS.override.md</code> to replace context files for a specific directory. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context Files</a>.</li> <li><strong>Advanced custom model sampling</strong> — Configure arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM <code>thinking_token_budget</code> values. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/models.md#sampling-parameters">Sampling Parameters</a>.</li> <li><strong>Baseten provider</strong> — Use built-in Baseten authentication and model support. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API Keys</a>.</li> </ul> <h3>Breaking Changes</h3> <ul> <li>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code> interface to <code>ModelsRequestTransforms</code> because its header transformation now applies to all authenticated provider requests.</li> <li>Changed JSON and RPC <code>message_update</code> events to emit only <code>assistantMessageEvent</code> deltas, removing the cumulative <code>message</code> and <code>assistantMessageEvent.partial</code> fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between <code>message_start</code> and <code>message_end</code>; the latter remains authoritative (<a href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</li> <li><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns <code>ProviderHeaders</code> with <code>string \| null</code> values and preserves <code>null</code> header-deletion markers. Extensions that inspect returned headers must handle <code>null</code>; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (<a href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</li> <li>Changed <code>ModelRegistry.refresh()</code> to accept <code>ModelsRefreshOptions</code> and return <code>ModelsRefreshResult</code> instead of discarding cancellation and provider errors.</li> <li>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth cancellation options rather than catalog refresh options. Call <code>refresh({ providers: [providerId], signal })</code> separately when remote freshness is required.</li> <li>Required config-form extension OAuth <code>refreshToken(credentials, signal)</code> callbacks to accept and honor a concrete abort signal.</li> <li>Replaced dynamic provider refresh context store access with the read-only <code>context.stored</code> snapshot and generation-checked <code>context.publish()</code> transac... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-17 18:57:12 +02:00
jkomyno	a850f2c1c1	chore(deps-dev): refresh development tooling	2026-08-03 17:04:43 +05:30
Alberto Schiabel	503b50ab02	chore(deps): refresh SDK, Python, and CI dependencies (#3955 ) This PR: - splits https://github.com/ComposioHQ/composio/pull/3953 in two: this PR carries every dependency and GitHub Actions bump except the docs site, which follows in a stacked PR - consolidates and supersedes Dependabot PRs #3915, #3916, and #3934 through #3942 - adopts TypeScript 7.0.2 for primary compilation while retaining the `@typescript/typescript6` API lane that TypeScript-ESLint still requires, following the upstream side-by-side guidance - refreshes Python core and provider dependencies, lockfiles, and the Ruff 0.16 lint configuration - updates every GitHub Action with a verified newer official release, including majors, while retaining immutable commit SHA pins and migrating setup-uv cache pruning - deletes four per-package `eslint.config.mjs` shims: under ESLint 10 the default per-file config lookup re-anchors the root config's globs into each package, so `pnpm lint` stayed green while the CLI's try/catch, `process.env` and node-builtin bans went unenforced - bounds and documents the new `brace-expansion` and `@hono/node-server` security overrides, raising the `@hono/node-server` floor to 2.0.10 to clear GHSA-9mqv-5hh9-4cgg - preserves intentional compatibility fixtures and lanes for AI SDK 6, Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints ## Context The docs site is a separate Bun workspace with its own `bun.lock` and is not a pnpm workspace member, so the two halves share no lockfile and no build. Splitting them keeps the Fumadocs 11 migration (a breaking API change with real refactoring) reviewable on its own, independently of the mechanical version bumps here. The `brace-expansion` override deliberately spans majors: GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with no 1.x or 2.x backport, so narrowing it to the 5.x line puts `brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and `pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the trade-off it buys is recorded inline in `pnpm-workspace.yaml`. Verified on this branch standalone: `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963 tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`.	2026-07-27 17:57:29 +05:30
Alberto Schiabel	72eac88133	fix(cli): replace abandoned decompress dependency (GHSA-mp2f-45pm-3cg9) (#3767 ) This PR: - replaces `decompress` (unmaintained; the zip-slip fix in the GHSA advisory was never published to npm past 4.2.1) with `extract-zip` across the CLI's four zip-extraction call sites: `install-skill.ts`, `run-companion-modules.ts`, `upgrade-binary.ts`, and `cli-local-tools/bundled-binaries.ts` - `extract-zip` validates each entry resolves inside the target directory before writing, closing the path-traversal issue `pnpm audit` flags as critical - replaces the one `.tgz`-extracting call site (`scripts/_acp-adapters.ts`, used to vendor ACP adapter binaries at build time) with `tar`, since `extract-zip` only handles zip archives - removes `@types/decompress`; both `extract-zip` and `tar` ship their own type definitions - `pnpm audit --prod --audit-level=high` now passes (previously failing on `next`, unrelated to #3766) Verified `extract-zip` and `tar` extract nested directories correctly with a local smoke test (real `.zip`/`.tgz` archives), in addition to the existing `@composio/cli` (724 tests) and `@composio/cli-local-tools` (13 tests) suites passing.	2026-07-07 18:58:17 +04:00
Alberto Schiabel	58bc93b2d9	chore(deps): consolidate dependency updates (#3760 ) This PR: - consolidates https://github.com/ComposioHQ/composio/pull/3733, https://github.com/ComposioHQ/composio/pull/3735 through https://github.com/ComposioHQ/composio/pull/3744, and https://github.com/ComposioHQ/composio/pull/3752 - refreshes the pnpm workspace dependencies under the existing `minimumReleaseAge` supply-chain gate - keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare workers types 4 where latest majors conflict with the current workspace - keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the workspace catalog to zod 4 - bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock` - updates the SHA-pinned Claude and Codex workflow actions from the Dependabot action group - adds a patch changeset for the versioned package manifests touched by dependency updates - verifies the rollup with frozen pnpm/uv locks, peer checks, audit threshold checks, typecheck, lint, builds, TypeScript tests, and Python `nox -s chk` ## Context `pnpm audit --prod --audit-level=moderate` passes. The remaining production audit item is a low `@ai-sdk/provider-utils` advisory through Mastra transitive dependencies; forcing it higher would require leaving the compatible stable Mastra dependency path.	2026-07-06 14:33:55 +04:00
Alberto Schiabel	03cb181fdb	chore(deps): roll up dependency bumps (#3711 ) This PR: - rolls up https://github.com/ComposioHQ/composio/pull/3695, https://github.com/ComposioHQ/composio/pull/3696, https://github.com/ComposioHQ/composio/pull/3697, and https://github.com/ComposioHQ/composio/pull/3698 into one dependency-bump branch - updates Python dependency metadata for `langchain-openai`, `pyautogen`, and `crewai` - updates npm production dependency metadata for `zod-to-json-schema`, `openai`, and `@modelcontextprotocol/sdk` - refreshes `uv.lock` and `pnpm-lock.yaml` with the repo-pinned package managers - leaves Changesets unchanged because the touched TS package manifests are private/ignored and no published TS SDK package metadata changes - verified with `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, focused TS builds/tests, clean-worktree `pnpm test:examples`, Python import tests, and Python nox checks - note: local `pnpm build:packages` hit a pre-existing broad-build race around `@composio/slim` rebuilding `@composio/core`; focused dependent builds pass --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-29 19:20:15 +04:00
Alberto Schiabel	cddd66c3ce	chore(ts): bump Hono, Mastra, and Chrome deps (#3691 ) This PR: - bumps `hono`, `@mastra/core`, and `chrome-devtools-mcp` to their current latest published versions - routes the remaining Cloudflare Tool Router Hono consumer through the workspace catalog - updates the `@composio/mastra` `@mastra/core` peer range and adds a patch changeset - fixes `check-peer-deps` to resolve `semver` through the normal package dependency	2026-06-26 20:45:25 +04:00
Alberto Schiabel	20bf1b6345	chore(ts): quiet tsdown build warnings (#3665 ) This PR: - migrates shared tsdown dependency config from deprecated `external` / `noExternal` aliases to `deps.neverBundle` / `deps.alwaysBundle` - disables noisy Rolldown plugin timing and ineffective dynamic-import diagnostics in shared config while keeping build checks enabled - fixes the `json-schema-to-zod` `JSONSchema7TypeName` import so it stays type-only - keeps the CLI bundle graph aligned with `next` while quieting the dynamic-import warning through `checks.ineffectiveDynamicImport: false` - makes the Node file E2Es treat the current external storage `Unauthorized` upload response as an explicit `UPLOAD_UNAVAILABLE`/skip outcome instead of failing unrelated SDK build PRs Verification: - `pnpm build` - build log scan for `WARN`, deprecated `external` / `noExternal`, `deps.onlyBundle`, `PLUGIN_TIMINGS`, and `INEFFECTIVE_DYNAMIC_IMPORT` - `pnpm --dir ts/packages/cli test -- --runInBand` - `pnpm --dir ts/e2e-tests/runtimes/node/file-roundtrip typecheck` - `pnpm --dir ts/e2e-tests/runtimes/node/tool-router-files typecheck` - `pnpm lint:packages` - CI: TypeScript build/typecheck/test and Node 22/24/25, Deno, Cloudflare, and CLI e2e are green on the latest commit	2026-06-26 12:17:33 +04:00
sdkrelease[bot]	9764ce33ff	Release: update version (#3616 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.12.0 ### Minor Changes - `a0bef5d`: Bump `@composio/client` to `0.1.0-alpha.74`. - `dfd7a08`: Add per-request cancellation to public SDK methods via a new `ComposioRequestOptions` (`{ signal?: AbortSignal }`) trailing argument, plus a typed `ComposioRequestCancelledError` for detecting caller-initiated aborts. Without this, a slow `tools.get` or `tools.execute` had no way to be cancelled — a 100s search would block the calling agent indefinitely. The new shape: ```typescript try { const tools = await composio.tools.get( 'user_1', { search: 'send email', limit: 50 }, { signal: AbortSignal.timeout(5_000) } ); } catch (err) { if (err instanceof ComposioRequestCancelledError) { return; } throw err; } ``` The signal is forwarded to the underlying `@composio/client` fetch. Any abort error (`APIUserAbortError`, `AbortError`, or `DOMException(name='AbortError')`) coming back is normalized to `ComposioRequestCancelledError` so callers can `instanceof`-detect cancellation without unwrapping nested causes. Catch-and-wrap paths in `tools.execute` / `tools.getRawComposioToolBySlug` / `toolkits.get` re-throw the cancellation error rather than remapping it to `ComposioToolExecutionError` / `ComposioToolNotFoundError` / `ComposioToolkitFetchError`. Wired through on: - Tools: `get`, `getRawComposioTools`, `getRawComposioToolBySlug`, `getRawToolRouterSessionTools`, `execute`, `executeSessionTool`, `getToolsEnum`, `getInput`, `proxyExecute` - Toolkits: `get`, `listCategories` - AuthConfigs: `list`, `create`, `get`, `update`, `delete`, `updateStatus`, `enable`, `disable` - ConnectedAccounts: `list`, `get`, `delete`, `refresh`, `updateStatus`, `enable`, `disable`, `update` - Triggers: `listActive`, `create`, `update`, `delete`, `enable`, `disable`, `listTypes`, `getType`, `listEnum` - MCP: `create`, `list`, `get`, `delete`, `update`, `generate` - ToolRouter (`composio.create` / `composio.use`, `composio.toolRouter.create` / `.use`) — long-running session-creation paths - ToolRouterSession: `authorize`, `toolkits`, `search`, `execute`, `proxyExecute`, `update` ### Custom-tool cooperative cancellation Native tool execution is cancelled by the SDK (the underlying `fetch` is aborted). Custom tools are different — the SDK can't preempt user-supplied JavaScript. Two affordances are added so callers get sensible behavior anyway: 1. Pre-execute signal check: if `signal.aborted` is true before the user's `execute` runs, the SDK throws `ComposioRequestCancelledError` and never invokes user code. 2. Cooperative signal forwarding: the same `AbortSignal` is exposed via `SessionContext.signal` for Tool Router custom tools. Long-running implementations can wire `ctx.signal` into their own `fetch` (or any abortable IO) to abort mid-execution; the resulting `AbortError` is normalized to `ComposioRequestCancelledError` by the SDK. ```typescript import { experimental_createTool } from '@composio/core'; const longRunningFetch = experimental_createTool('LONG_RUNNING_FETCH', { name: 'Long-running fetch', description: 'Fetches a URL with cooperative cancellation', inputParams: z.object({ url: z.string() }), execute: async (input, ctx) => { // Pass ctx.signal into fetch so a session.execute(...) abort cancels // the in-flight HTTP request mid-flight. const resp = await fetch(input.url, { signal: ctx.signal }); return { result: await resp.json() }; }, }); ``` - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. - `4b76dbf`: Remove the deprecated `uuid` field from the auth config retrieve/list response type. The platform has removed the deprecated V1/V2 UUID-mirror field from V3 API responses (it was a mirror of the canonical nanoid `id`). The SDK no longer reads or re-exposes `uuid` on `AuthConfigRetrieveResponse` (and therefore on the items of `AuthConfigListResponse`). This is technically a breaking change to the SDK response type: consumers should use `id` instead of `uuid`. The `expectedInputFields` field is unaffected — it remains a top-level field on the API response. ### Patch Changes - `552859a`: Expose `search` and `showDisabled` filters on `authConfigs.list()`. - `23f9053`: Replace `chalk` with `picocolors` for colored error and log output. The two render identically, but `picocolors` is a fraction of the size (~0.8 kB gzipped vs chalk's much larger footprint), shrinking the bundled package. - `507318d`: Add a provider-agnostic JSON-schema property-key sanitizer: `sanitizeSchemaPropertyKeys(schema, policy)`, `restoreOriginalKeys(value, mapping)`, `mappingHasRenames(mapping)`, and the `KeyMapping` / `KeySanitizationPolicy` types. Some providers constrain the characters and length of tool `input_schema` property keys and reject the whole request on a single violation. This utility rewrites offending keys to conforming aliases (recursing through `properties`, array `items`/`prefixItems`, the composition keywords `allOf`/`anyOf`/`oneOf` and `not`/`if`/`then`/`else`, plus `additionalProperties`/`patternProperties`/`$defs`/`contains`) and records a schema-shaped reverse mapping so the original parameter names can be restored before execution. The _constraint_ is injected as a `KeySanitizationPolicy`, so the traversal, collision handling, prototype safety, and depth cap stay provider-agnostic. The `@composio/anthropic` provider now consumes it. - `6a4cb54`: Preserve root `$defs` / `definitions` blocks on tool parameter schemas and dereference them in the Node file modifier, so auto file upload/download detection works when `file_uploadable` or `file_downloadable` is hidden behind an internal `$ref`. - `cbbad15`: Improve Zod compatibility at the SDK schema boundary. Custom tools now convert both `zod/v3` and Zod v4 schemas to JSON Schema correctly instead of degrading Zod v4 object schemas to empty schemas. `@composio/core` now exposes `jsonSchemaToZodShape` via `@composio/core/utils/json-schema`, and the Claude Agent SDK provider uses that core subpath instead of converting to a full Zod object and casting `.shape` out of it. - Updated dependencies [`025a657`] - @composio/json-schema-to-zod@0.2.0 ## @composio/json-schema-to-zod@0.2.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/anthropic@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes - `507318d`: Harden the Anthropic tool property-key sanitizer: - Broader schema coverage. Illegal keys are now sanitized wherever they appear in a tool schema — under the composition keywords (`allOf`/`anyOf`/`oneOf`, `not`/`if`/`then`/`else`), `prefixItems` tuples, `additionalProperties`/`patternProperties`, and `$defs`/`definitions` — not just top-level `properties` and array `items`. Previously a single illegal key under one of these would still 400 the entire request. Renames inside composition keywords are restored correctly (they fold into the value level they share). - `$ref` keys restored. `wrapTool` now dereferences internal `$ref`/`$defs` (leniently — a dangling ref degrades to a permissive schema instead of throwing) before sanitizing, so keys reachable only through a reference are both made compliant and restored. Only genuinely dynamic positions (`additionalProperties`, `patternProperties`, `contains`) remain rewrite-only. - Shared core implementation. The traversal/restoration mechanism now lives in `@composio/core` (`sanitizeSchemaPropertyKeys` / `restoreOriginalKeys`); this provider supplies only the Anthropic key constraint as a policy, reusing core's prototype-pollution guard and depth cap. - Prototype-safe key restoration. Reverse-mapping lookups and the rebuilt argument object are now prototype-free, so a tool call whose arguments use a key matching an `Object.prototype` member (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, …) no longer throws or silently corrupts the payload sent to the backend. `Object.prototype` is never mutated. - Depth cap. Schema sanitization and key restoration now bound recursion (matching core's JSON-schema walker) so a pathologically deep schema or argument object fails with a clear error instead of overflowing the stack. - Empty / all-illegal keys. A property key that is empty (or made entirely of stripped characters) now becomes a deterministic non-empty alias instead of an empty string, which would itself have violated Anthropic's `{1,64}` length bound. - Collision loop. Replaced a latent non-terminating fixed point in the alias collision resolver with a counter that always makes progress. - Observability. The provider now emits `debug` logs when it rewrites a tool's schema keys and when it restores them at execution time, and the wrap-then-execute (same provider instance) contract for key restoration is documented. - `c90ae95`: Sanitize tool `input_schema` property keys that violate Anthropic's `^[a-zA-Z0-9_.-]{1,64}$` constraint before sending tools to the Messages API, then restore the original names when the tool is executed. A single non-conforming key previously made Anthropic reject the entire `tools` array with HTTP 400, taking down every other tool in the same request. This commonly happened with OneDrive's Microsoft Graph OData parameters (`$top`, `$filter`, `@microsoft.graph.conflictBehavior`) and with over-long flattened keys from tools such as Zoom. Offending keys are now rewritten to conforming aliases (`$` → `dollar_`, `@` → `at_`, any other illegal character → `_`, keys longer than 64 characters truncated with a deterministic suffix), recursing through nested object `properties` and array `items` schemas. The original parameter names are restored before the call reaches the Composio backend, so the model sees `dollar_top` while the backend still receives `$top`. Schemas whose keys already conform are left unchanged. ## @composio/claude-agent-sdk@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes - `cbbad15`: Improve Zod compatibility at the SDK schema boundary. Custom tools now convert both `zod/v3` and Zod v4 schemas to JSON Schema correctly instead of degrading Zod v4 object schemas to empty schemas. `@composio/core` now exposes `jsonSchemaToZodShape` via `@composio/core/utils/json-schema`, and the Claude Agent SDK provider uses that core subpath instead of converting to a full Zod object and casting `.shape` out of it. ## @composio/cloudflare@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/google@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/langchain@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/llamaindex@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/mastra@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes - `aaabf5e`: Relax the Mastra provider output schema so real third-party API responses are no longer rejected by Mastra's output validation (which dropped the data and substituted an error). Before compilation the output schema is made lenient: every typed node becomes nullable, objects allow extra keys (`additionalProperties: true`), `enum`/`const` are widened to also admit `null`, and `required` is dropped (APIs omit unset fields rather than returning `null` for them). All of these only widen what validates, so previously-valid output is unaffected. ## @composio/openai@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/openai-agents@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/vercel@0.10.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/ts-builders@0.2.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/cli@0.3.0 ### Minor Changes - `a0bef5d`: Bump `@composio/client` to `0.1.0-alpha.74`. - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes - `5f004ff`: Drop `COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from the CLI meta-tool list. These slugs were removed from `@composio/client` (alpha.74), so listing them broke the type-checked CLI build. - `23f9053`: Remove the unused `ansis` dependency from the CLI. Colored output is already handled by `picocolors`, so `ansis` was a dead production dependency that shipped with the package. - `446c6f6`: Fix virtual TypeScript file resolution used by CLI type generation so in-memory imports resolve consistently during transpilation and validation. - Updated dependencies [`552859a`] - Updated dependencies [`a0bef5d`] - Updated dependencies [`23f9053`] - Updated dependencies [`dfd7a08`] - Updated dependencies [`507318d`] - Updated dependencies [`025a657`] - Updated dependencies [`6a4cb54`] - Updated dependencies [`4b76dbf`] - Updated dependencies [`cbbad15`] - @composio/core@0.12.0 - @composio/json-schema-to-zod@0.2.0 - @composio/ts-builders@0.2.0 - @composio/cli-keyring@0.2.0 - @composio/cli-local-tools@0.1.0 ## @composio/cli-keyring@0.2.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/cli-local-tools@0.1.0 ### Minor Changes - `025a657`: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes - Updated dependencies [`552859a`] - Updated dependencies [`a0bef5d`] - Updated dependencies [`23f9053`] - Updated dependencies [`dfd7a08`] - Updated dependencies [`507318d`] - Updated dependencies [`025a657`] - Updated dependencies [`6a4cb54`] - Updated dependencies [`4b76dbf`] - Updated dependencies [`cbbad15`] - @composio/core@0.12.0 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-06-25 04:38:11 +04:00
Alberto Schiabel	f8cd90ce5a	chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646 ) This PR: - uses plain `tsdown` package scripts and a shared typed `tsdown.config.base.ts` so Node 24 builds work without loader flags - switches the repo dev/build toolchain to Node `24.17.0` and pnpm `11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml` - marks the root package as ESM with `type: module`, matching the TypeScript packages - keeps Node `22.22.3` in the runtime/E2E matrices as the minimum supported user runtime - changes the TypeScript build workflow back to a single build on the mise-managed toolchain and broadens path filters for package-manager/build config files - adds pnpm 11 build-script policy with `allowBuilds` and intentionally ignored `sharp` builds - enables tsdown ESM shims for the packaged CLI wrapper so `composio --help` runs under Node 22 and Node 24 Verified locally: - `CI=true pnpm install --frozen-lockfile` - `pnpm lint` - `pnpm run build:packages` - `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter @e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run test:e2e:node` - `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3` and `24.17.0`	2026-06-24 18:58:11 +04:00
Alberto Schiabel	025a657597	feat(ts): drop CommonJS support (#3494 ) This PR moves the TypeScript SDK support floor to the latest Node.js 22 release and uses that as the point where we stop carrying custom CommonJS compatibility machinery. The e2e runtime coverage now exercises the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested against the minimum supported version and the newer runtimes users are likely to adopt next. Because the SDK packages are still on `0.x`, the accompanying changeset uses `minor` bumps while calling out that this is a breaking change inside the existing 0.x line. It also moves pnpm under mise on this Node 22 layer. That belongs here, not in #3493, because the pinned `pnpm@10.28.2` requires Node.js `>=22.13`. Removing Corepack is intentional: Node.js documents that Corepack is no longer distributed starting with Node.js v25, so relying on `corepack enable` would keep a toolchain dependency that is already on the way out of the Node distribution. ## What changed - Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`, `mise.lock`, `toolchain-versions.json`, and root `devEngines`. - Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise the single source of truth for the pnpm version. Removes the root `packageManager` / `devEngines.packageManager` Corepack pin entirely (rather than keeping a second copy of the version that could drift) and removes stale `packageManager` metadata from real TS packages/examples and generators. - Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a `packageManager` field. Without this, Turbo fails workspace resolution (`Could not resolve workspaces -> Missing 'packageManager' field`), which is the only reason the field would otherwise need to stay. - Replaces `corepack enable` in the shared setup action with mise-managed pnpm. The E2E Docker images install bun + pnpm directly from `mise.toml`/`mise.lock` (with `dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay on the base image as the test matrix axis and are disabled via `MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build args are threaded from the host anymore, and bun+pnpm now carry `mise.lock` checksum verification. - Extends the install-time toolchain check to validate pnpm against mise alongside Bun. - Sets the Node E2E matrix and install fallback checks to `22.22.3`, `24.16.0`, and `25.9.0`. - Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts` only and uses the ATTW `esm-only` profile. - Removes explicit `require` / `.cjs` / `.d.cts` package export paths and internal import mappings from the public TS SDK packages. - Marks public TS SDK packages as `type: module` where they were missing it. - Replaces the remaining runtime `require('pusher-js')` with dynamic ESM import. - Deletes the legacy CJS example. - Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop E2E: it verifies `require('@composio/core')` works through Node's native ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`, not a `.cjs` artifact. - Removes `.cjs` / `.cts` handling from example validation and CLI project-language detection. - Updates provider scaffolding so newly generated providers are ESM-only. - Adds a minor changeset warning that CommonJS callers can only rely on Node's native `require(esm)` interop and that custom CommonJS compatibility machinery is gone. ## Bundled behavior changes Two changes here are technically independent of the CommonJS removal but ride along because they touch the same files and ship in the same release cut. Calling them out explicitly so they are not missed in review: - `PusherUtils` realtime channel auth (`@composio/core`). Replacing the runtime `require('pusher-js')` with a dynamic ESM `import()` was done alongside conforming `channelAuthorization` to pusher-js's typed `customHandler(params, callback)` contract. The previous `(authOptions) => Promise` shape did not match pusher-js's actual calling convention — it read `endpoint`/`headers`/`params` off an argument that pusher-js never passes — so this also fixes that latent mismatch. New unit tests (`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name` body) and the success / invalid-JSON / network-failure callback paths. - CLI meta-tool slug list (`@composio/cli`). Drops `COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from `META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client` alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']` union. The list is declared `satisfies ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at compile time (`pnpm typecheck`) — keeping the stale slugs would be a type error — and needs no separate runtime test. ## Verification - Verified latest Node 22/24/25 releases from the official Node dist index: `22.22.3`, `24.16.0`, `25.9.0` (https://nodejs.org/dist/index.json). - Verified Node docs state Corepack is no longer distributed starting with Node.js v25: https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html - `mise exec -- pnpm --version` -> `10.28.2` - `mise exec -- pnpm install --frozen-lockfile` - `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts` - `mise exec -- pnpm --filter @e2e-tests/utils typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node` - `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck` - `mise exec -- pnpm --filter @composio/cli typecheck` - `mise exec -- pnpm --filter @composio/cli test -- --runInBand` - `mise exec -- pnpm --filter @composio/core typecheck` - `mise exec -- pnpm --filter @composio/core exec vitest run test/utils/pusher.test.ts` - `mise exec -- pnpm run build:packages` - `mise exec -- turbo run build --dry-run` resolves all workspace packages with no root `packageManager` field (pnpm discovered from `pnpm-lock.yaml`). - `mise exec -- pnpm --filter @composio/cli exec vitest run test/src/services/project-environment-detector.test.ts` - `mise exec -- pnpm exec prettier --check ...` - `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also `Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 / bun 1.3.10 from mise. - `docker manifest inspect node:24.16.0-slim` - `docker manifest inspect node:25.9.0-slim` - `bash -n ts/scripts/create-provider.sh && git diff --check` - `ruby -e "require 'yaml'; YAML.load_file('.github/workflows/ts.test-e2e.yml')"` - Tracked example validation in a clean temporary tree: `Validated 21 example packages.`	2026-06-19 22:22:17 +04:00
Alberto Schiabel	b346272572	chore(ci): use OIDC for TS npm releases, add needed attributes to package.json (#3611 ) This PR: - configures the TS release workflow to request GitHub Actions OIDC ID tokens - runs the TS release publish path on Node 24.17.0 so npm supports trusted publishing - leaves a TODO to centralize that release runtime in `mise.toml` after https://github.com/ComposioHQ/composio/pull/3494 lands - removes the long-lived `NPM_TOKEN` `.npmrc` setup before `changeset publish` - adds npm package support metadata (`repository.url`, `bugs.url`, and `homepage`) for every public TS release workspace that Changesets can publish - marks `@composio/cli-local-tools` private so Changesets does not try to publish it	2026-06-19 18:34:10 +04:00
Abir Taheer	f6df489c0b	Release: update version (#3429 ) > [!WARNING] > ## ⚠️ Breaking change — `@composio/core@0.11.0` (minor bump, pre-1.0) > > The legacy in-memory custom-tools registry `composio.tools.createCustomTool(...)` has been removed (changeset `44e5458`). Because `@composio/core` is pre-1.0, this ships as a minor bump per semver convention — but it is breaking: any code calling `composio.tools.createCustomTool(...)` will fail to compile/run after upgrading. Consumers pinned to `^0.10.0` will not auto-upgrade to `0.11.0` and must opt in explicitly. ### Migration: use Tool Router custom tools Custom tools are now standalone factories bound to a Tool Router session, instead of being registered into an in-memory registry on the `composio.tools` namespace. Before (removed): ```ts // ❌ No longer available in 0.11.0 const tool = composio.tools.createCustomTool({ /* ... / }); ``` After — a standalone tool (no auth):* ```ts import { Composio, experimental_createTool } from '@composio/core'; import { z } from 'zod'; const composio = new Composio(); const grep = experimental_createTool('GREP', { name: 'Grep Search', description: 'Search for patterns in files', inputParams: z.object({ pattern: z.string(), path: z.string() }), execute: async (input) => ({ matches: [] }), }); // Bind the custom tool(s) to a Tool Router session const session = await composio.create(userId, { experimental: { customTools: [grep] }, }); ``` After — a tool that extends a Composio toolkit (inherits that toolkit's auth): ```ts const getImportantEmails = experimental_createTool('GET_IMPORTANT_EMAILS', { name: 'Get Important Emails', description: 'Fetch high-priority emails', extendsToolkit: 'gmail', inputParams: z.object({ limit: z.number().default(10) }), execute: async (input, ctx) => { // ctx.execute() returns the standard { data, error, logId } shape const result = await ctx.execute('GMAIL_SEARCH', { query: 'is:important' }); return { emails: result.data }; }, }); const session = await composio.create(userId, { experimental: { customTools: [getImportantEmails] }, }); ``` After — grouping related tools into a custom toolkit: ```ts import { experimental_createToolkit } from '@composio/core'; const devTools = experimental_createToolkit('DEV_TOOLS', { name: 'Dev Tools', description: 'Local developer utilities', tools: [grep], // tools here must NOT set `extendsToolkit` }); const session = await composio.create(userId, { experimental: { customToolkits: [devTools] }, }); ``` > Notes: > - `experimental_createTool` / `experimental_createToolkit` are also available from the dedicated `@composio/core/experimental` entry point. > - Tool slugs are auto-prefixed with `LOCAL_` when exposed to the agent (e.g. `GREP` → `LOCAL_GREP`; inside a toolkit, `DEV_TOOLS` + `GREP` → `LOCAL_DEV_TOOLS_GREP`). > - These APIs are intentionally namespaced `experimental_*` — they are not yet stable and may change. --- This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.11.0 ### Minor Changes - `a94715f`: Forward `userId` when creating trigger instances so trigger 2FA flows can verify connected account ownership. - `44e5458`: Remove the legacy `composio.tools.createCustomTool(...)` in-memory registry API. Use Tool Router custom tools via `experimental_createTool`, `experimental_createToolkit`, and `composio.create(..., { experimental: { customTools, customToolkits } })` instead. ### Patch Changes - `22a9171`: Defer telemetry batch and error sends so instrumentation does not wait for telemetry network requests before returning SDK results or rethrowing SDK errors. - `93b67e8`: Fix automatic file upload/download substitution for file schemas that accept either a single file or a list of files. The file modifier now selects composed-schema branches by runtime value shape, so `anyOf(file, array<file>)` uploads or downloads each file when the tool receives a list while preserving existing single-file behavior. - `b69cef1`: Tolerate dangling `$ref` pointers in tool schemas the Composio API ships without a matching `$defs` entry. Some toolkits (e.g. `GMAIL_FETCH_EMAILS`) emit `outputParameters` with `"$ref": "#/$defs/FetchEmailsResponse"` while never declaring a top-level `$defs` block. After the strict resolver shipped with the previous Mastra fix, this caused `composio.tools.get(...)` to throw `JsonSchemaRefResolutionError` upfront, making every Gmail / Slack / Google-Calendar tool unusable through `MastraProvider`. The SDK now degrades the unresolvable branch to a permissive object schema and surfaces a single observability warning per `(toolSlug, ref)` pair instead of crashing. - `dereferenceJsonSchema` accepts a new optional second argument `{ onUnresolved?: 'throw' \| 'sentinel'; onReplace?: (ref, reason) => void }`. Default behavior is unchanged (`'throw'`) — first-party / custom-tool schemas with a typo'd `$ref` still surface as a hard error. Pass `'sentinel'` to replace unresolved branches with the cycle-break sentinel (`{ type: 'object', additionalProperties: true }`) that the resolver already uses for `$ref` cycles. The replaced sentinel carries a default `description` hint so LLMs consuming the wrapped tool's schema get an in-band signal that the branch is opaque; a caller-provided `description` sibling overrides the default (Draft 2020-12 sibling-keyword merge). Safety caps (`MAX_REF_CHAIN_DEPTH`, `MAX_NODE_DEPTH`) keep throwing in both modes. New `UnresolvedRefStrategy`, `UnresolvedRefReason`, and `DereferenceJsonSchemaOptions` type exports. - `MastraProvider.wrapTool` opts both `inputParameters` and `outputParameters` into `'sentinel'` mode and emits one `logger.warn` per `(toolSlug, ref)` pair via the provider-scoped dedup `Set`. User-controlled segments in the warning (`tool.slug`, `toolkit.slug`, `ref`) are `JSON.stringify`d to neutralize embedded newlines / ANSI escapes / control bytes that could otherwise forge log lines (CWE-117). A matching one-shot telemetry event (`composio.mastra.wrapTool.danglingRef`) fires next to the warn so the Composio team has aggregate visibility into which toolkits are affected; the event respects `COMPOSIO_DISABLE_TELEMETRY=true`. - The `telemetry` instance from `@composio/core` is now publicly re-exported alongside `logger`, so providers can emit aggregate signals without reaching into the package's internals. - Resolvable `$defs` / `definitions` continue to be inlined exactly as before — no regression in the type-info preservation contract introduced by the previous Mastra fix. - `1ba66ca`: Fix `tools.execute` (and `tools.get` / `tools.list`) failing with a `ZodError` for every tool from an MCP-backed toolkit (e.g. `granola_mcp`, `apify_mcp`, `tavily_mcp`). MCP toolkits don't declare an output schema, and the Composio API serializes that as `output_parameters: {}`. The SDK's `ParametersSchema` required `{ type: 'object', properties: {...} }`, so `transformToolCases` rejected the response and `getRawComposioToolBySlug` — called by `execute` and the list path — threw. The SDK now normalizes empty (`{}`), `null`, and missing `input_parameters` / `output_parameters` payloads to `undefined` before validation. `outputParameters` was already declared `.optional()` in the public `Tool` type, so this preserves the contract: "undefined means no declared schema." Tools that _do_ declare a schema continue to be validated strictly. No public API change; no toolkit allow-list. - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/cli-local-tools@0.0.5 ### Patch Changes - Updated dependencies [`22a9171`] - Updated dependencies [`93b67e8`] - Updated dependencies [`b69cef1`] - Updated dependencies [`1ba66ca`] - Updated dependencies [`a94715f`] - Updated dependencies [`ce4b213`] - Updated dependencies [`44e5458`] - @composio/core@0.11.0 ## @composio/anthropic@0.9.3 ### Patch Changes - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/claude-agent-sdk@0.9.3 ### Patch Changes - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/cloudflare@0.9.3 ### Patch Changes - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/google@0.9.3 ### Patch Changes - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/langchain@0.9.3 ### Patch Changes - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/llamaindex@0.9.3 ### Patch Changes - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/mastra@0.9.3 ### Patch Changes - `b69cef1`: Tolerate dangling `$ref` pointers in tool schemas the Composio API ships without a matching `$defs` entry. Some toolkits (e.g. `GMAIL_FETCH_EMAILS`) emit `outputParameters` with `"$ref": "#/$defs/FetchEmailsResponse"` while never declaring a top-level `$defs` block. After the strict resolver shipped with the previous Mastra fix, this caused `composio.tools.get(...)` to throw `JsonSchemaRefResolutionError` upfront, making every Gmail / Slack / Google-Calendar tool unusable through `MastraProvider`. The SDK now degrades the unresolvable branch to a permissive object schema and surfaces a single observability warning per `(toolSlug, ref)` pair instead of crashing. - `dereferenceJsonSchema` accepts a new optional second argument `{ onUnresolved?: 'throw' \| 'sentinel'; onReplace?: (ref, reason) => void }`. Default behavior is unchanged (`'throw'`) — first-party / custom-tool schemas with a typo'd `$ref` still surface as a hard error. Pass `'sentinel'` to replace unresolved branches with the cycle-break sentinel (`{ type: 'object', additionalProperties: true }`) that the resolver already uses for `$ref` cycles. The replaced sentinel carries a default `description` hint so LLMs consuming the wrapped tool's schema get an in-band signal that the branch is opaque; a caller-provided `description` sibling overrides the default (Draft 2020-12 sibling-keyword merge). Safety caps (`MAX_REF_CHAIN_DEPTH`, `MAX_NODE_DEPTH`) keep throwing in both modes. New `UnresolvedRefStrategy`, `UnresolvedRefReason`, and `DereferenceJsonSchemaOptions` type exports. - `MastraProvider.wrapTool` opts both `inputParameters` and `outputParameters` into `'sentinel'` mode and emits one `logger.warn` per `(toolSlug, ref)` pair via the provider-scoped dedup `Set`. User-controlled segments in the warning (`tool.slug`, `toolkit.slug`, `ref`) are `JSON.stringify`d to neutralize embedded newlines / ANSI escapes / control bytes that could otherwise forge log lines (CWE-117). A matching one-shot telemetry event (`composio.mastra.wrapTool.danglingRef`) fires next to the warn so the Composio team has aggregate visibility into which toolkits are affected; the event respects `COMPOSIO_DISABLE_TELEMETRY=true`. - The `telemetry` instance from `@composio/core` is now publicly re-exported alongside `logger`, so providers can emit aggregate signals without reaching into the package's internals. - Resolvable `$defs` / `definitions` continue to be inlined exactly as before — no regression in the type-info preservation contract introduced by the previous Mastra fix. - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/openai@0.9.3 ### Patch Changes - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/openai-agents@0.9.3 ### Patch Changes - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/vercel@0.9.3 ### Patch Changes - `ce4b213`: fix(providers): normalize string tool-call arguments across all providers Models occasionally emit tool-call arguments as a JSON string instead of an object (most visibly with `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK), which broke downstream validation with errors like `tool_use.input: Input should be a valid dictionary`. `@composio/core` now exposes a single `normalizeToolArguments` helper, and every provider routes model-supplied arguments through it. Object payloads pass through unchanged, JSON strings are parsed, empty/`null` payloads become `{}`, and anything that cannot resolve to an object throws a typed `ComposioInvalidToolArgumentsError` instead of a raw `SyntaxError` or a silently forwarded malformed string. This replaces the inconsistent per-provider guards that previously existed only in vercel, cloudflare and openai-agents. ## @composio/cli@0.2.32 ### Patch Changes - Updated dependencies [`22a9171`] - Updated dependencies [`93b67e8`] - Updated dependencies [`b69cef1`] - Updated dependencies [`1ba66ca`] - Updated dependencies [`a94715f`] - Updated dependencies [`ce4b213`] - Updated dependencies [`44e5458`] - @composio/core@0.11.0 - @composio/cli-local-tools@0.0.5 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-06-19 17:12:38 +04:00
Alberto Schiabel	74ce25812e	fix(ci): repair CLI binary and docs sync workflows (#3568 ) This PR: - patches the Peekaboo sidecar build to rewrite the resolved `swift-system` `AT_RESOLVE_BENEATH` Darwin guard before compiling on GitHub macOS runners - adds regression coverage for the `swift-system` checkout patch and includes script tests in `@composio/cli-local-tools` Vitest - switches the SDK docs sync workflow to `anthropics/claude-code-action/base-action` so push-triggered automation does not fail on unsupported event parsing - moves Claude tool restrictions to `claude_args` and quotes `$GITHUB_OUTPUT` writes so the workflow passes `actionlint` - verifies the changed package and workflow with targeted tests, build, formatting, YAML parsing, and `actionlint`	2026-06-15 15:27:21 +04:00
Rahul Tarak	afa118c8fb	fix(cli): make permission allows expire after one hour (#3449 ) ## Summary - Rename the permission prompt action from “Allow for session” to “Allow for 1 hr” in browser and native UI flows. - Cache allow decisions with a 1-hour expiry in `tool-permissions-cache.json`, with an in-memory fast path and stale-entry pruning. - Preserve existing permission snapshot cache behavior while keeping cached allow decisions across CLI invocations until expiry. ## Tests - `pnpm install --frozen-lockfile --ignore-scripts` - `pnpm build:packages` - `cd ts/packages/cli && pnpm run typecheck` ## Notes - The decision enum remains `allow_session` for compatibility with existing backend/native callback payloads; only the UX/caching semantics now expose and enforce a 1-hour duration.	2026-05-19 00:19:31 -07:00
Abir Taheer	878ac4d34b	Release: update version (#3425 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.10.0 ### Minor Changes - `42ebff3`: feat(connected-accounts): namespace SHARED-connection surface under `experimental` Aligns the TypeScript SDK with the experimental wire shape used by Shared Connections. The flat `accountType` / `aclConfigForShared` options on `connectedAccounts.link()` and `session.authorize()` have moved under a single `experimental` block, and `connectedAccounts.updateAcl()` has moved off the class onto a top-level `experimental_updateAcl(composio, id, opts)` export — same precedent as `experimental_createTool` / `experimental_createToolkit`. The `experimental` namespace is the signal that the shape may change in future releases. Pinning a SHARED connection in a session config (`connectedAccounts: { gmail: [...] }`) and direct execute by `connectedAccountId` are unchanged — only the connection-create / patch / authorize surfaces are namespaced. Also surfaces the `accountType` filter on `connectedAccounts.list()` so SHARED connections can be listed without dropping to the raw client. The wire keeps this as a flat query param, so the SDK keeps it flat too. `@composio/client` bumped from `0.1.0-alpha.71` → `0.1.0-alpha.72` so the generated typed client carries the `Experimental` namespaces for `link.create`, `toolRouter.session.link`, and `connectedAccounts.patch`. Caller migration: ```typescript // before await composio.connectedAccounts.link('user_id', 'auth_config_id', { accountType: 'SHARED', aclConfigForShared: { allowAllUsers: true }, }); await composio.connectedAccounts.updateAcl('ca_abc', { allowAllUsers: true }); await session.authorize('github', { accountType: 'SHARED', aclConfigForShared: { allowAllUsers: true }, }); // after await composio.connectedAccounts.link('user_id', 'auth_config_id', { experimental: { accountType: 'SHARED', aclConfigForShared: { allowAllUsers: true }, }, }); await experimental_updateAcl(composio, 'ca_abc', { allowAllUsers: true }); await session.authorize('github', { experimental: { accountType: 'SHARED', aclConfigForShared: { allowAllUsers: true }, }, }); // new — list SHARED connections const shared = await composio.connectedAccounts.list({ accountType: 'SHARED', userIds: ['user_creator'], }); ``` ## @composio/cli-local-tools@0.0.4 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/anthropic@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/claude-agent-sdk@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/cloudflare@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/google@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/langchain@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/llamaindex@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/mastra@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/openai@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/openai-agents@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/vercel@1.0.0 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 ## @composio/cli@0.2.30 ### Patch Changes - Updated dependencies [`42ebff3`] - @composio/core@0.10.0 - @composio/cli-local-tools@0.0.4 --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>	2026-05-13 19:23:33 +02:00
Rahul Tarak	69e6ef6495	chore(cli): drop darwin-x64 local tools, bundles, and enhanced controls (#3421 ) ## Summary - Remove darwin-x64 from local toolkit platform lists (beeper-imessage, peekaboo, chrome-devtools) and drop the corresponding bundled binary path entries. - Skip building native Swift sidecar binaries (peekaboo, imessage-cli, composio-native-ui) for darwin-x64; remove the bun-darwin-x64 matrix entry from `build-cli-binaries.yml` so we no longer produce a darwin-x64 CLI bundle. - Locally force-disable enhanced controls / elicitation on darwin-x64 in `tool-permissions.ts` even when the backend opts the org in (logs a debug message). ## Test plan - [x] `pnpm --filter @composio/cli typecheck` - [x] `pnpm --filter @composio/cli-local-tools typecheck` - [ ] CI green on the build workflow (no darwin-x64 job runs) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 02:34:36 -07:00
Rahul Tarak	7477aa9566	feat(cli): scaffold native UI sidecar (#3418 ) ## Summary - Scaffold a macOS Swift `composio-native-ui` sidecar with a borderless floating native overlay and Metal-driven pulsing/liquid-glass visual treatment. - Add a hidden/dev `composio dev native-ui` command that spawns the bundled sidecar from CLI local-tool assets. - Wire the sidecar into local-tool binary build scripts and CLI binary release packaging checks for Darwin artifacts. ## Tests - `pnpm install --frozen-lockfile` - `pnpm typecheck` - `pnpm --filter @composio/cli build` - `pnpm --filter @composio/cli-local-tools build:composio-native-ui -- --target darwin-arm64` - Manual launch via `COMPOSIO_LOCAL_TOOLS_BIN_DIR=../cli-local-tools/local-tools-binaries bun dist/bin.mjs dev native-ui --timeout 35` ## Notes / Risks - This is a scaffold/prototype and is intentionally opened as a draft PR. - The visual effect uses a transparent AppKit panel, `NSVisualEffectView`, and a Metal overlay. True optical distortion of arbitrary content behind the window would require a different approach such as ScreenCaptureKit/backdrop sampling and associated permissions. - Generated sidecar executables remain ignored; release jobs rebuild them before packaging artifacts. --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 01:30:14 -07:00
Abir Taheer	02723698b0	Release: update version (#3402 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/cli-local-tools@0.0.3 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/core@0.9.1 ### Patch Changes - `84a3a07`: Add `accountType` and per-user ACL support for SHARED connected accounts. - `accountType` on create: `composio.connectedAccounts.link(userId, authConfigId, { accountType: 'SHARED' })` creates a SHARED connection. Default remains `PRIVATE`. A SHARED connection can be used by other `userId`s, but only when the connection is explicitly pinned in a tool-router session's config and only when the requesting `userId` passes the connection's ACL. - `accountType` on retrieve: `get()` and `list()` responses now include `accountType` (`'PRIVATE' \| 'SHARED'`). - `aclConfigForShared` on create + retrieve: per-user ACL block — `{ allowAllUsers, allowedUserIds, notAllowedUserIds }`. On responses the field is `undefined` when the caller isn't authorised to see the ACL, so callers can distinguish _"I can't see the ACL"_ from _"ACL is the default deny-by-default state"_. - `updateAcl()` method (new): `composio.connectedAccounts.updateAcl(nanoid, { allowAllUsers, allowedUserIds, notAllowedUserIds })` writes the ACL via `PATCH`. PATCH semantics — omit a field to leave it unchanged; pass an empty array to clear an allow/deny list. At least one field required. Calling on a PRIVATE connection raises `ComposioAclOnlyForSharedError` (400). - `ToolRouterSession.authorize()` options gain `accountType` + `aclConfigForShared`, so a SHARED connection with an ACL can be created in one call from inside a tool-router session. ACL resolution rule (deny wins): 1. requesting `userId` ∈ `notAllowedUserIds` → DENY 2. `allowAllUsers === true` → ALLOW 3. requesting `userId` ∈ `allowedUserIds` → ALLOW 4. otherwise → DENY (deny-by-default) Limits: each ACL list accepts up to 1000 entries; each `userId` is 1..256 characters. The SDK enforces these caps at the input boundary. New error classes: - `ComposioSharedAccessDeniedError` (403) — surfaces from direct `connectedAccountId` execution paths when the requesting user fails the ACL. - `ComposioAclOnlyForSharedError` (400) — ACL fields sent on a PRIVATE connection. - `ComposioSharedConnectionNotAccessibleError` (400) — tool-router session create / PATCH with a pinned SHARED connection the session user cannot use. No breaking changes. Existing `link()` callers without the new options get a `PRIVATE` connection exactly as today; existing `get()` / `list()` callers see new optional fields. The Python SDK mirror ships in a separate PR. - `c358ffa`: Fix false-positive `initiate()` deprecation warning for custom auth configs (SEC-339 follow-up). `composio.connectedAccounts.initiate()` previously emitted a one-time `console.warn` on every redirectable-OAuth response, regardless of whether the auth config was Composio-managed (subject to the 2026-07-03 cutover) or custom (unaffected). The wording was conditional ("If this auth config is Composio-managed…") so callers using their own OAuth apps could ignore it, but the warning still printed and caused noise in logs. Apollo already emits the SEC-339 `Deprecation` / `Sunset` / `Link rel="deprecation"` headers (RFC 9745 / RFC 8594) only on the retiring branch — managed + redirectable OAuth. The SDK now reads the `Deprecation` header from the response (via `APIPromise.withResponse()`) and gates the warning on its presence. Custom auth configs and non-OAuth schemes get a clean response from the server and now stay silent in the SDK as well. - Behavior change: No warning is emitted for `initiate()` calls against custom OAuth auth configs or non-OAuth schemes (API key, bearer, basic). Managed-OAuth callers continue to get exactly one warning per process, now with revised wording that points at the response's `Sunset` header for the precise cutover date. - No public API change: `initiate()` returns the same `ConnectionRequest` shape and respects the same `allowMultiple` guard. `ComposioLegacyConnectedAccountsEndpointRetiredError` continues to surface from the 400 retired-path response. - Test scaffolding: new mock helper `mockApiPromiseWithHeaders()` in `connectedAccounts.test.ts` wraps a value as an `APIPromise`-shaped thenable so the new tests can simulate apollo's header behavior. Pre-existing initiate tests using `mockResolvedValueOnce` continue to pass via the SDK's defensive fallback when `withResponse` is absent on the mock. Python SDK gets the matching change in the same release train. ## @composio/anthropic@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/claude-agent-sdk@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/cloudflare@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/google@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/langchain@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/llamaindex@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/mastra@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/openai@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/openai-agents@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/vercel@0.9.1 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 ## @composio/cli@0.2.29 ### Patch Changes - Updated dependencies [`84a3a07`] - Updated dependencies [`c358ffa`] - @composio/core@0.9.1 - @composio/cli-local-tools@0.0.3 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-05-11 16:11:04 -07:00
github-actions[bot]	49629a7b9d	Release: update version	2026-05-07 13:59:55 +00:00
Rahul Tarak	a4c9e0ada2	refactor(cli): define local tools as custom toolkits (#3356 ) ## Summary - Stacks this local-tools PR on top of #3360, which contains the core duplicate custom-toolkit child slug fix. - Refactors `@composio/cli-local-tools` to define bundled local toolkits with core `experimental_createTool` / `experimental_createToolkit` handles instead of hand-rolled schema objects. - Keeps Tool Router v3.1 inline custom toolkit definitions attached to session create/search/execute calls so bundled local tools remain searchable/executable. - Adds CLI/local-tools test coverage for forwarding local custom toolkit payloads and for core custom toolkit handles from the local registry. ## Stack - Base PR: #3360 (`fix(core): qualify custom toolkit child slug lookups`) - This PR should now show only CLI/local-tools changes relative to #3360. ## Tests - `pnpm --filter @composio/core typecheck` - `pnpm --filter @composio/cli-local-tools typecheck` - `pnpm --filter @composio/cli typecheck` - `pnpm --filter @composio/cli-local-tools test` - `pnpm --filter @composio/cli-local-tools build` - `pnpm --filter @composio/cli exec vitest run test/src/commands/tools/tools.search.cmd.test.ts test/src/commands/tools/tools.execute.cmd.test.ts` - `pnpm --filter @composio/core exec vitest run test/models/customTool.test.ts test/models/toolRouter.test.ts test/models/customToolRouting.test.ts`	2026-05-07 05:29:06 -07:00
Rahul Tarak	b3e5df565e	fix(cli): patch BetterSwiftAX constants for binary builds (#3347 ) ## Summary - Broaden the Beeper iMessage macOS build patch so BetterSwiftAX `kAX...` constants compile on GitHub `macos-15`/`macos-15-intel`. - Pin the fixed `platform-imessage` submodule source and add Swift 6.2 / Peekaboo dependency patching for the CLI binary workflow. - Package and verify macOS local-tool sidecars plus `release-tag.txt` in CLI release zips. - Fix installed beta metadata/upgrade behavior so `--version`, update checks, and beta-default experimental flags use the installed release tag. - Let `LOCAL_*` execution bypass remote auth/project/schema validation. - Add runtime self-heal for missing installed `local-tools-binaries`: if an old upgrader installs the fixed beta binary without sidecars, first local-tool execution downloads the matching release zip, verifies checksum when available, and restores the sidecars. ## Validation - `pnpm --filter @composio/cli-local-tools build:beeper-imessage -- --target darwin-arm64` - `pnpm --filter @composio/cli-local-tools build:beeper-imessage -- --target darwin-x64` - `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target darwin-arm64` - `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target darwin-x64` - `pnpm --filter @composio/cli-local-tools typecheck:tsc` - `pnpm --filter @composio/cli-local-tools test` - `pnpm --filter @composio/cli typecheck:tsc` - `pnpm --filter @composio/cli build:binary` - Targeted CLI tests for execute/config/upgrade/version/update-check paths. - Packaged binary smoke test confirmed bundled Beeper sidecar works. - Repair smoke test: copied only the new `composio` binary plus `release-tag.txt` into a temp install with no `local-tools-binaries`; `execute LOCAL_BEEPER_IMESSAGE_VERSION -d '{}'` restored sidecars from `@composio/cli@0.2.29-beta.235` and succeeded. ## Release workflow - Beta build run `25405049712` succeeded for commit `9d0910c909b7b257d0f17b6d082980952d1e6c59` and published `@composio/cli@0.2.29-beta.235`. - This PR now includes one follow-up commit (`2c32cff4c`) to cover the old-upgrader/missing-sidecars incremental upgrade path; normal branch CI and beta build run `25406984535` are running again.	2026-05-05 16:45:50 -07:00
Rahul Tarak	422700a141	fix(cli): patch iMessage binary build for macOS 15 (#3346 ) ## Summary - Patch the resolved BetterSwiftAX checkout before building `imessage-cli` sidecars. - Replace newer macOS SDK AX subrole constants with equivalent `CFString` literals so GitHub `macos-15` runners can build the Beeper iMessage binary. - Keep the patch local to the generated build checkout; no native binary blobs are committed. ## Why The CLI binary release job failed in `Build local-tool sidecar binaries` on `macos-15` because BetterSwiftAX references AXWebConstants available in newer SDKs but missing from the runner SDK, e.g. `kAXLandmarkComplementarySubrole` and `kAXMathFenceOperatorSubrole`. ## Validation - `pnpm exec eslint ts/packages/cli-local-tools/scripts/build-beeper-imessage-binaries.ts --quiet` - `pnpm --filter @composio/cli-local-tools build:beeper-imessage -- --target darwin-arm64` - `pnpm --filter @composio/cli-local-tools build:beeper-imessage -- --target darwin-x64` - `pnpm --filter @composio/cli-local-tools typecheck:tsc` - `pnpm --filter @composio/cli-local-tools test`	2026-05-05 01:23:40 -07:00
Rahul Tarak	79ac22053f	feat(cli): add local tools foundation (#3340 ) ## Summary - Add experimental CLI local tools behind `local_tools` (beta-on, stable-off unless `composio config experimental local_tools on`). - Add reusable `@composio/cli-local-tools` package: declarations, metadata, readiness, command/MCP/native/FFI runtimes, bundled-binary resolution, and Tool Router search/execute/schema integration. - Add first-class local toolkits for: - `BEEPER_IMESSAGE` backed by `imessage-cli` from the ComposioHQ `platform-imessage` fork. - `CHROME_DEVTOOLS` backed by the official `chrome-devtools-mcp@0.24.0` npm/npx package. - `PEEKABOO` backed by upstream Peekaboo CLI. - Remove generated native executables from git: Beeper and Peekaboo binaries are now ignored, pinned via git submodules, and generated during CLI binary release jobs. - Update CLI binary workflow so Linux artifacts skip native sidecars, while macOS artifacts run on macOS runners and build only the matching `darwin-x64` or `darwin-arm64` Beeper/Peekaboo sidecars before packaging. ## Native binary policy - No generated `imessage-cli` or `peekaboo` binary blobs are committed in this PR history. - Beeper source is pinned as `ts/packages/cli-local-tools/vendor/platform-imessage` at `364445a1b3089ad9fe293d5951efe160c5677c42` from `https://github.com/ComposioHQ/platform-imessage`. - Peekaboo source is pinned as `ts/packages/cli-local-tools/vendor/peekaboo` at `31e66e8d02656141d18f60bf3b46b24c2b9bc785` from `https://github.com/steipete/Peekaboo`. - Build commands: - `pnpm --filter @composio/cli-local-tools build:local-tool-binaries -- --target darwin-arm64` - `pnpm --filter @composio/cli-local-tools build:local-tool-binaries -- --target darwin-x64` - Chrome DevTools is an npm/npx integration and is pinned as a dev dependency (`chrome-devtools-mcp@0.24.0`) instead of using native sidecars. ## Validation - `pnpm --filter @composio/cli-local-tools build:local-tool-binaries -- --target darwin-arm64` - `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target darwin-x64` - `pnpm --filter @composio/cli-local-tools build:beeper-imessage -- --target darwin-x64` - `pnpm --filter @composio/cli-local-tools typecheck:tsc` - `pnpm --filter @composio/cli-local-tools test` - `COMPOSIO_REAL_LOCAL_TOOLS_TESTS=1 pnpm --filter @composio/cli-local-tools test -- src/toolkits/beeper-imessage.test.ts src/toolkits/peekaboo.test.ts` - `pnpm --filter @composio/cli typecheck:tsc` - `pnpm --filter @composio/cli build` - `COMPOSIO_CACHE_DIR=<tmp-config-with-local_tools-enabled> bun ts/packages/cli/dist/bin.mjs local-tools doctor --json` - `pnpm turbo build` - Verified rewritten branch has no >1MB objects relative to `origin/next` and no native executable paths in the PR diff. ## Notes / risks - Beeper iMessage and Peekaboo are macOS-only and depend on local permissions. - Peekaboo requires macOS 15+; GUI tools require Screen Recording, Accessibility, and sometimes Automation. - Beeper send/reaction behavior can still depend on upstream Messages automation reliability. - Chrome DevTools can inspect/modify browser contents; avoid sensitive browser sessions.	2026-05-05 00:10:38 -07:00

28 Commits