## Summary
Security-hardening for automatic file upload in `@composio/core` (patch
release per changeset).
### Changes
- **Default denylist** for local paths before auto-upload /
`files.upload`: blocks common credential directories (e.g. `.ssh`,
`.aws`) and credential-like filenames (e.g. `.env`, default SSH private
keys). Resolves symlinks when the path exists.
- **Config:** `sensitiveFileUploadProtection`,
`fileUploadPathDenySegments` on `Composio`.
- **`beforeFileUpload`** hook (e.g. with `composio.tools.get` /
`tools.execute`): rewrite path, return `false` to abort, or throw.
- **Errors:** `ComposioSensitiveFilePathBlockedError`,
`ComposioFileUploadAbortedError`; file modifier errors exported from
`@composio/core` errors entry.
- **Changeset:** patch bump for `@composio/core`.
### Notes
- URLs and `File` blobs are not subject to the path denylist
(unchanged).
- Opt out of path checks only if required:
`sensitiveFileUploadProtection: false`.
### Tests
- `pnpm test` in `ts/packages/core` (799 tests) passed locally before
commit.
Made with [Cursor](https://cursor.com)
CustomToolkit was the old frozen dataclass that nobody creates anymore.
ExperimentalToolkit (via composio.experimental.Toolkit()) is the only
toolkit type. Removes all Union[CustomToolkit, ExperimentalToolkit] noise.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the TypeScript custom tools feature to the Python SDK, enabling
developers to define local tools that run in-process alongside remote
Composio tools within a session.
Three tool patterns supported:
- Standalone tools (no auth)
- Extension tools (inherits auth from a Composio toolkit via extends_toolkit)
- Custom toolkits (groups related tools under one namespace)
Key implementation:
- Factory functions: experimental_create_tool() and experimental_create_toolkit()
- Pydantic BaseModel for input schema (equivalent of Zod in TS)
- SessionContext with execute() for sibling routing and proxy_execute() for auth proxy
- COMPOSIO_MULTI_EXECUTE_TOOL routing: splits local/remote, parallel execution via ThreadPoolExecutor (max 5 workers)
- Custom tools map built from backend response (authoritative slug mapping)
- Bumps composio-client to 1.29.0 for custom_tools/custom_toolkits/proxy_execute types
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add Zod schema (TypeScript) and TypedDict (Python) for typed handling
of `composio.connected_account.expired` webhook events.
Schemas:
- ConnectionExpiredEventSchema: Full webhook event envelope validation
- SingleConnectedAccountDetailedResponseSchema: Matches GET API response
- WebhookConnectionMetadataSchema: Project and org ID metadata
This builds on PR #2553 which loosened V3 detection to accept any
composio.* event type. Users can now type-safely parse connection
expiration events in their webhook handlers.
Linear: PLEN-1398
Dhawal Upadhyay