mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
next
261 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alberto Schiabel
|
d4d306073c |
fix(sdk): save tool-only MCP updates and connection-management intent (#4512)
This PR: - closes [PLEN-3890](https://linear.app/composio/issue/PLEN-3890/fix-mcp-lifecycle-update-configuration-defects) - fixes `composio.mcp.update()` dropping parts of the requested configuration: tool-only updates (`allowedTools` without `toolkits`) sent no tools field at all, and updates with toolkits sent the create-time `custom_tools` alias, which the update endpoint never reads - inverts `manuallyManageConnections` into `managed_auth_via_composio` on update, so `manuallyManageConnections: true` no longer stores "Composio manages auth" (create and generate already inverted it) - builds the update body sparsely: each provided field is sent independently, omitted fields are left out entirely instead of being sent as `undefined` - keeps the auth config of a `{ toolkit, authConfigId }` toolkit entry in `create()` and `update()` instead of discarding it via an `else if` (Python already extracted both) - sends `allowed_tools` instead of the deprecated `custom_tools` alias from `create()` too, in both SDKs; Python previously raised `TypeError` (masked as `ValidationError`) for the removed `custom_tools` kwarg against the pinned `composio-client` 1.43.0 - adds regression coverage for both SDKs and a changeset for `@composio/core` ## Context Found by the September SDK + Composio client hackathon (Area 5, MCP lifecycle), where the two worst frictions were "successful SDK updates that do not save the requested configuration" and reversed manual connection management. The hackathon's third Area 5 finding — PATCH accepting nonexistent tool slugs — is an Apollo-side defect, fixed separately in ComposioHQ/platform#13015. `MCP.ts` and the Python `mcp.py` are identical between `next` and `main`, so this merges cleanly to the beta channel afterwards. |
||
|
Alberto Schiabel
|
c7843d8a3a |
feat(core): return session config from session.update() (#4533)
This PR: - makes `session.update()` resolve to the updated server-side session configuration instead of `void` - exposes that configuration as `session.config` (new `ToolRouterSessionConfig` type) on sessions from `create()`, `use()` and attach, so the toolkit/tool allowlist is readable without dropping to the raw client - renames the private SDK-config member on `ToolRouterSession` to `sdkConfig`, ending the runtime name clash that made `session.config` look like the SDK's `ComposioConfig` - applies the same change to the Python `ToolRouterSession` (`config` attribute, `update()` returns it) - adds a minor changeset for `@composio/core` ## Context After `sessions.use(id)` there was no way to know the session's allowlist, and `update()` threw the response away except for `configVersion` / `preload` / `sandbox` / `warnings`. Hackathon feedback (area 8). |
||
|
jkomyno
|
c2e70f66a6 |
fix(py): route establish-time subscription failures through on_subscription_error
pysher performs the channel-auth request synchronously inside
pusher.subscribe(), so an auth rejection raised on the websocket thread
before pusher:subscription_error could ever be bound or fire. The new
on_subscription_error callback was skipped for exactly the failures it
documents, and callers waited out the full connect timeout for a
generic ComposioSDKTimeoutError.
- _connection_handler catches subscribe() failures and routes them
through the error path (log + callback with {'error': ...}).
- The failure is recorded on the subscription and the connect() wait
loop re-raises it on its next poll, so subscribe() fails promptly
with the underlying error and still tears down the pusher.
- Update the Python reference, guide, and docstrings; add regression
coverage for the handler routing, the failure record, and fast-fail.
Addresses the Cursor Bugbot comment on triggers.py:1023.
|
||
|
jkomyno
|
27701dd541 |
feat(py): add optional on_subscription_error for trigger subscriptions
Mirror the TypeScript API surface from the previous commit:
- Triggers.subscribe accepts an optional on_subscription_error callback,
threaded through _SubcriptionBuilder.connect and bound to pysher's
pusher:subscription_error event on the trigger channel.
- TriggerSubscription._handle_subscription_error logs the failure at the
SDK boundary and invokes the callback with the parsed payload (or
{'raw': frame} for malformed frames); callback exceptions are
contained and logged so a faulty handler cannot tear down pysher's
dispatch thread.
- The parameter is optional; existing callers are unaffected.
- Update the Python triggers reference and the subscribing-to-events
guide.
Python never bound pusher:subscription_error at all, so subscription
failures after connect() were previously invisible to hosts.
|
||
|
jkomyno
|
8bb1d29950 |
fix(core): raise tool not found only on 404/400
getRawComposioToolBySlug relabelled every client error, including an invalid API key (401), as ComposioToolNotFoundError. Map only 404/400 to not-found and wrap the rest in a new ComposioToolFetchError that keeps the client error as cause. Toolkits.getToolkitBySlug compared against the OpenAI APIError class, so its not-found branch never fired; import the Composio client class instead. Python mirrors the mapping: an unknown slug raises ToolNotFoundError (now a NotFoundError), anything else propagates the composio_client error unchanged. PRDE-1613 Claude-Session: https://claude.ai/code/session_017HtbhwMAKcfebo8HyXWa5s |
||
|
Alberto Schiabel
|
85996c4a1d |
fix(sdk): harden pusher auth and cross-origin redirect headers (#4406)
This PR:
- wraps `pysher.Pusher` in `_ComposioPusher`, whose channel-auth POST
carries a `(5, 15)` connect/read timeout and raises
`TriggerSubscriptionAuthError` (a `TriggerSubscriptionError`) on a
transport failure, a non-200, or a response without an `auth` token —
pysher 1.0.8 sent it with no timeout and turned a non-200 into a bare
`AssertionError` on the websocket thread, on every (re)subscribe
- keeps that POST a plain `requests.post(..., timeout=...)` rather than
routing it through `safe_request`: the endpoint is built from the
configured Composio API base URL, a fixed trusted host, not a value from
a response, and the SSRF guard would refuse a local dev base URL
- validates `pusher_cluster` against `^[a-z0-9-]+$` (non-empty, at most
64 chars) before pysher formats it into `ws-{cluster}.pusher.com`,
raising `InvalidPusherClusterError` that names the shape violation
without echoing the value
- replaces the `unittest.mock.MagicMock` stand-in for pysher's
connection logger with a dedicated `logging.Logger` (`NullHandler`,
`propagate=False`, disabled), so `unittest` leaves the runtime import
graph while raw frames stay out of user logs; a test asserts the module
source no longer mentions `unittest`
- strips `Authorization`, `Proxy-Authorization`, and `Cookie` from the
next hop when `ssrfSafeFetch` or `safe_request` follows a redirect to a
different origin; same-origin hops keep them. Manual redirect following
bypasses both `fetch`'s cross-origin rule and `requests`'
`rebuild_auth`, so neither guard applied it before — the gap #4387 left
out
- `@composio/slim` has no mirrored source (its build copies
`core/dist`), so the changeset covers `@composio/core` and
`@composio/slim` as patches
Verified with `pytest tests/test_triggers.py tests/test_url_safety.py
tests/test_path_join_guardrail.py` (192 passed), `ruff check` / `ruff
format --check` on the changed files, `mypy --config-file
config/mypy.ini` on the three changed modules with the noxfile's stub
pins (no issues), `vitest run test/utils/ssrfGuard.test.ts` in
`@composio/core` (42 passed), `pnpm typecheck` at the root (14 tasks
successful), and `oxlint` + `prettier --check` on the changed TypeScript
files.
https://claude.ai/code/session_016ZuBv7JhVdSYTLYcTy2VJr
|
||
|
Alberto Schiabel
|
53c024a9c8 |
fix(py): keep local results when remote multi-execute transport fails (#4386)
## Summary Follow-up to #4310. The TypeScript SDK (since #3800) catches a thrown backend call for the remote half of a mixed `COMPOSIO_MULTI_EXECUTE_TOOL` batch and turns it into one failure entry per remote slug, so completed local results are not lost. The Python SDK still let the exception escape `_route_multi_execute`, discarding every local result that had already run. This ports the TypeScript behavior so both SDKs return the same shape on a remote transport failure. Fixes # ## Changes - Catch the remote future's exception in `_route_multi_execute` and keep `str(error)`, falling back to `Remote tool execution failed` when the message is empty (same fallback as TS). - Synthesize `{response: {successful: False, data: {}, error}, tool_slug, error}` for each remote index and merge them in original request order. - Recompute `total_count` / `success_count` / `error_count` on transport failure, as TS does. - Add two regression tests mirroring the TS cases in `customToolRouting.test.ts`: local results preserved with per-tool remote errors, and the empty-message fallback. ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? - `uv run --locked --group dev pytest tests/test_custom_tools.py -q`: 87 passed. - `uv run --locked --group dev nox -s chk`: ruff and mypy clean. - Without the source change, the new `test_remote_transport_failure_keeps_local_results` raises `RuntimeError: remote unavailable` out of `_route_multi_execute`. ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [x] I added tests or explain why not applicable - [ ] I added a changeset if this change affects published packages (Python does not use Changesets) ## Additional context TypeScript reference: `ts/packages/core/src/models/ToolRouterSession.ts`, the `remoteErrorMessage` branch, and the test "should preserve successful local results when remote transport fails". https://claude.ai/code/session_01PAXMbiZd3qPoJ8Z9uPvEAb EOF -R ComposioHQ/composio |
||
|
CoralGarden52
|
2c4339a859 |
fix(python): preserve mixed multi-execute result order (#4310)
## Summary `ToolRouterSession._route_multi_execute` currently concatenates remote results before local results and assigns new indexes from that concatenated list. For a request such as `[LOCAL_TOOL, REMOTE_TOOL]`, callers receive `[REMOTE_TOOL, LOCAL_TOOL]`, so code that correlates `results[index]` with the requested tools can use the wrong result. This brings the Python implementation in line with the merged TypeScript behavior in [#3800](https://github.com/ComposioHQ/composio/pull/3800): preserve each tool's original request index, restore that order after local/remote execution, and then assign contiguous result indexes. Fixes # ## Changes - Preserve the original index on locally executed result entries. - Map remote sub-batch results back to their original request indexes before merging. - Sort the merged results by original index and re-index them sequentially. - Update the mixed local/remote regression test to assert request order and indexes. ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? - `uv run --locked --group dev pytest tests/test_custom_tools.py -q` — 69 passed. - `uv run --locked --group dev nox -s tst -- tests/test_custom_tools.py` — 69 passed. - `uv run --locked --group dev ruff --config config/ruff.toml check composio/core/models/tool_router_session.py tests/test_custom_tools.py` — passed. - Ruff format check on both changed files — passed. - Verified the regression test fails on the pre-fix implementation and passes after the fix. ## Screenshots (if applicable) Not applicable. ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [x] I added tests or explain why not applicable - [ ] I added a changeset if this change affects published packages ## Additional context This change is limited to Python multi-execute result ordering. All-local and all-remote fast paths remain unchanged. No changeset is needed because this repository does not use Changesets for Python package changes. Signed-off-by: CoralGarden52 <2193436736@qq.com> |
||
|
Alberto Schiabel
|
ab289d6224 |
fix(sdk): preserve primitive JSON Schema semantics (#4316)
## Summary - preserve boolean, empty, null, type-array, enum, const, and scalar-constraint semantics across every Python conversion entry point - intersect Zod enum and const values with declared types and constraints, including compound JSON values - default unversioned exact validation to Draft 7 and apply inclusive and numeric exclusive bounds independently - run one byte-identical corpus through Python, Zod, and Effect so accepted and rejected inputs stay aligned - keep exact JSON Schema acceptance separate from Pydantic default materialization ## Review follow-up (second push) - Python: exact Draft 7 acceptance now wraps all three entry points (`json_schema_to_pydantic_type`, `json_schema_to_model`, `pydantic_model_from_param_schema`), so they can no longer disagree - Python: draft-4 boolean `exclusiveMinimum`/`exclusiveMaximum` (OpenAPI 3.0 style) no longer crash conversion — exact validation falls back to Draft 4, and the library input is translated to the numeric spelling - Python: ECMA-only regex patterns (look-around) no longer crash pydantic model builds — Rust-incompatible patterns fall back to Python `re` - Python: type arrays with sibling constraints no longer raise `TypeError` on valid input — constraints are scoped per member before the library sees them - Python: integral floats satisfy `integer`, `const` intersects `enum`, annotation-only schemas accept anything, and an optional property with an empty `enum` tolerates absence - Zod: typeless scalar constraints apply per instance type, and string lengths count Unicode code points instead of UTF-16 code units - Effect: draft-4 boolean exclusive bounds are enforced instead of silently ignored - `multipleOf` uses decimal scaling in all three converters (declared `divergesFromJsonSchema` on the corpus case) - shared corpus grows by 13 primitive cases; new property-based tests check acceptance against real Draft 7 oracles (hypothesis + `jsonschema` in Python, fast-check + Ajv in TypeScript) ## Verification - Python `make chk` (ruff + mypy) - Python pytest: 1,572 passed (5 langchain-extra tests need an env this sandbox lacks; unchanged from base) - `@composio/json-schema-to-zod`: 187 passed incl. 300-run fast-check property test; typecheck + build - `@composio/json-schema-to-effect-schema`: 133 passed; typecheck - `@composio/core` corpus ingress tests: 61 passed - shared Python/TypeScript corpus files are byte-identical (shasum-verified) - `git diff --check` ## Contributor context This replaces four narrow proposals after independent local reproduction: - [#4301](https://github.com/ComposioHQ/composio/pull/4301) · [Glen](https://app.tryglen.com/ComposioHQ/composio/pull/4301) - [#4302](https://github.com/ComposioHQ/composio/pull/4302) · [Glen](https://app.tryglen.com/ComposioHQ/composio/pull/4302) - [#4303](https://github.com/ComposioHQ/composio/pull/4303) · [Glen](https://app.tryglen.com/ComposioHQ/composio/pull/4303) - [#4307](https://github.com/ComposioHQ/composio/pull/4307) · [Glen](https://app.tryglen.com/ComposioHQ/composio/pull/4307) --------- Co-authored-by: simpleqt <89645338+simpleqt@users.noreply.github.com> |
||
|
CoralGarden52
|
7420927183 |
fix(sdk): qualify custom toolkit child slug mapping across Python and TypeScript (#4311)
## Summary The Python SDK treated a custom tool's `original_slug` as globally unique, rejecting valid custom toolkits that reuse common child names such as `SEARCH`, `VERSION`, or `GREP` even though the backend-assigned final slugs are toolkit-qualified (`LOCAL_ALPHA_GREP`, `LOCAL_BETA_GREP`). This ports the toolkit-qualified lookup from #3360 to Python, then fixes three response-mapping bugs found in review and applies the same fixes to the TypeScript SDK so both stay in parity. ## Changes ### Python (`composio`) - Scope custom-tool collision detection and response matching by toolkit plus original slug. - Keep bare original-slug aliases only when unambiguous; `session.execute("GREP")` raises with the final slugs to use when the slug is shared. - Preserve toolkit-qualified final slugs in `custom_toolkits()`. - `build_custom_tools_map_from_response`: raise when a response tool has local handles but no exact toolkit match instead of silently dropping it or binding another toolkit's handler; only fall back to a bare match when the response carries no toolkit identity; reject duplicate qualified response entries; derive bare-slug ambiguity from local definitions so omitting a sibling in the response never makes the survivor callable by bare name. - `custom_toolkits()` only reuses a bare alias that belongs to the same toolkit. - Docstring and Python session reference page state that bare-slug execution requires a unique original slug. ### TypeScript (`@composio/core`) - Same four fixes in `buildCustomToolsMapFromResponse` and the same guard in `customToolkits()`. - JSDoc and TypeScript session reference page updated. - Changeset: patch for `@composio/core`. ### Not changed - `COMPOSIO_MULTI_EXECUTE_TOOL` still aborts the whole batch when one item uses an ambiguous bare slug, matching current TS behavior. Switching to per-item errors is a cross-SDK design change left for a follow-up. ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? Python: - `pytest tests/test_custom_tools.py tests/test_tool_router.py`: 181 passed. - ruff (project config) clean; mypy reports no errors in the touched files. - New tests: sibling routing, multi-execute, preload rejection, listing guard, and five response-mapping cases (no exact match, cross-toolkit binding, standalone bare fallback, unknown response tools skipped, ambiguity from local definitions, duplicate qualified entries). TypeScript: - `vitest run` in `ts/packages/core`: 53 files, 1251 passed, 2 expected failures. - `tsc --noEmit` clean; prettier and oxlint via pre-commit hook. - New tests: cross-toolkit reuse in `buildCustomToolsMap` and a new `buildCustomToolsMapFromResponse` block mirroring the Python cases. Python and TypeScript CI do not run automatically on this fork PR; a maintainer needs to approve the workflow run. ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [x] I updated documentation as needed - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages ## Additional context Reviewed with a second opinion from Codex (gpt-5.6-sol), which flagged the wrong-handler binding and response-derived ambiguity bugs fixed in the follow-up commits. https://claude.ai/code/session_01Y7Ni3QEBDGShSrEtwQS5bA EOF -R ComposioHQ/composio --------- Signed-off-by: CoralGarden52 <2193436736@qq.com> Co-authored-by: jkomyno <alberto@composio.dev> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
Alberto Schiabel
|
0d28befb14 |
fix(sdk): map streamed file transport failures (#4321)
## Summary - map Python file-fetch failures that occur after response headers into the documented upload and download errors - map TypeScript RemoteFile connection and streamed-body failures into RemoteFileDownloadError while preserving blocked-URL errors - close or cancel response bodies on every exit and apply the shared 100 MiB response limit to TypeScript RemoteFile downloads This supersedes the Python-only proposal in #4305 and carries the same failure category across both SDKs. ## Independent reproduction A response double returned one chunk and then raised a connection-reset error. On current next: - Python _fetch_file_from_url leaked ConnectionError, although it did close the response - Python Tool Router URL fetch leaked ConnectionError and left the response open - TypeScript RemoteFile leaked the native fetch/body TypeError instead of RemoteFileDownloadError ## Verification - Python make chk - Python make tst: 1,490 passed - TypeScript core typecheck - TypeScript core tests: 1,245 passed, 2 expected failures - TypeScript package build: 19 packages - focused Python regression tests: 3 passed - focused TypeScript RemoteFile tests: 17 passed |
||
|
jkomyno
|
28bcb190d9 |
refactor(python): collapse redundant download error handlers, cover both
Review follow-up on the download size cap. `requests.exceptions.RequestException` subclasses `OSError`, so the two handlers added for the write loop were byte-identical and the second already subsumed the first. Collapse them into one `except OSError` and say why in a comment, so the next reader does not re-add the redundant clause. Route partial-file cleanup through `_discard_partial_download`, which suppresses cleanup failures: an `OSError` from `unlink` would otherwise replace the `ResponseTooLargeError` or transport error the caller needs. Cover the two error paths that had no tests: a transport failure mid-stream and a failing write both raise `ErrorDownloadingFile` and leave no partial file behind. Without the handler the write failure escapes as a raw `OSError(28)` — the defect these pin. Claude-Session: https://claude.ai/code/session_01K1hH9PMmd6KPKdkACX553z |
||
|
jkomyno
|
54d07dc5f5 |
fix(python): cap automatic file download size at 100 MiB
`FileDownloadable.download` streamed the response straight to disk with no byte accounting, so an untrusted `s3url` could fill the disk. Add the same `Content-Length` pre-check plus authoritative streamed-byte counter the sibling `_fetch_file_from_url` already uses, capped at `_MAX_RESPONSE_SIZE` and overridable per call via `max_size`. Also close two gaps the write loop left open: an `OSError` from `fd.write` (disk full, permissions) escaped the documented `ErrorDownloadingFile` contract, and any failure left a partial file on disk that no caller was told about. Every failure path now unlinks the partial file; `ResponseTooLargeError` still propagates uncaught so callers see the limit. Claude-Session: https://claude.ai/code/session_01K1hH9PMmd6KPKdkACX553z |
||
|
jkomyno
|
f37c6fbec3 | docs(strict-mode): correct provider support details | ||
|
jkomyno
|
507c4fe3a8 | fix(python): preserve explicit empty tool schemas | ||
|
Alberto Schiabel
|
81631f83f4 | Merge branch 'next' into fix/strict-mode-keep-optional-parameters | ||
|
jkomyno
|
15e2b72f3d |
fix(python): emit strict and keep base provider config in OpenAIResponsesProvider
The strict flag now calls the base initializer (schema_config kwargs keep working), emits strict on the wrapped tool, and mirrors the TypeScript pipeline: optional parameters become required-nullable, unsupported schemas downgrade the tool to non-strict, and null arguments the tool schema rejects are dropped before execution. Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Claude-Session: https://claude.ai/code/session_01TDrxCHn2hg51HmxVstSUgs |
||
|
jkomyno
|
4ee3ff83bc | fix(python): preserve null nested file containers | ||
|
jkomyno
|
cf25f25363 | fix(python): preserve nullable file upload arguments | ||
|
jkomyno
|
fe66cbeb77 |
fix(sdk): omit empty file-uploadable arguments from tool execution
Both SDKs forwarded "" for a file_uploadable parameter (e.g. Gmail attachment) verbatim to the backend, which rejected it with a Pydantic validation error. Python only dropped it inside the opt-in auto-upload walker; TypeScript never did, and with auto-upload on it tried to upload the empty string. Run a schema-aware, upload-free pass on the default execute path that omits empty file values, and reuse the same walker for staging when auto-upload is enabled. Closes #4233 |
||
|
Alberto Schiabel
|
2f6a8a5ec9 |
fix(python): own the proxy_execute response shape (#4180)
> ### ⚠️ Breaking change > > `proxy_execute()` now returns a dict instead of the generated `SessionProxyExecuteResponse` model. Every caller since `py@0.11.4` that reads the result with attribute access breaks at runtime with `AttributeError`. > > ```python > # before > response.status > > # after > response["status"] > ``` > > `data`, `headers`, and `binary_data` follow the same rule. No version bump or changelog entry ships in this PR. That omission is deliberate, so the release call stays explicit. Details below. ## Summary Builds on @AseemPrasad's #4163, which spotted a real problem. Python's `proxy_execute()` returns the generated client's `SessionProxyExecuteResponse` directly, while TypeScript's `proxyExecute()` projects onto a curated shape. Returning the generated model leaks a regenerated artifact into a public SDK return type. This PR keeps that fix and resolves the review findings on top. #4163's commit is preserved with its original authorship. The commits on top carry the correction and the review fixes. ## What changed relative to #4163 | | #4163 | Here | |---|---|---| | Key casing | `binaryData`, `contentType`, `expiresAt` | `binary_data`, `content_type`, `expires_at` | | `status` type | declared `int`, returned `200.0` | declared `int`, returns `200` | | Test doubles | `SimpleNamespace` | real `SessionProxyExecuteResponse` / `BinaryData` | | `mypy` | fails `nox -s chk` | clean | | Docs | 3 snippets left broken | fixed | **Casing.** Python public APIs use snake_case and TypeScript public APIs use camelCase. The fields and their meanings match across SDKs, and the spelling follows each language. `session.delete()` already works this way (`session_id` in Python, `sessionId` in TypeScript), and so does `RemoteFile` (`expires_at` / `expiresAt`). **`status` and `size` are narrowed to `int`.** The generated model types both as `float` and pydantic coerces, so a response read straight off it renders `200.0` where TypeScript renders `200`. #4163 declared `int` but still returned `200.0`. That mismatch also failed `nox -s chk`: ``` composio/core/models/session_context.py:56: error: Incompatible types (expression has type "float", TypedDict item "status" has type "int") [typeddict-item] ``` **Tests use the real generated models again.** `SimpleNamespace` accepts any attribute name and any type, so it silently tolerates a client regeneration that renames or retypes a field. It was also what hid the `float` coercion, since `assert result == {"status": 200}` passes against `200.0`. The suite now asserts the narrowed types directly. This matters ahead of the `composio-client` 2.x migration, which types every response field as `Any` and removes type checking on this projection entirely. The tests become the only remaining check. **Simplification.** The projection folds into `proxy_execute_impl`, so both entry points are a single call rather than an impl-then-normalize pair. `response.binary_data` is read directly instead of through `getattr(..., None)`. The defensive default could never fire on a typed response, but it made mypy infer `Any` and stop checking the projection. **Docs.** Three Python snippets that read the result as attributes are fixed, and the response-shape table gets a per-language column. The follow-up commit also marks `headers` and `data` as nullable in that table, replaces the "returns the upstream response verbatim" claim with what the projection actually does, and documents that `expires_at` can be absent in TypeScript and `None` in Python. ## Breaking change The method has shipped since `py@0.11.4`. Both directions of the old access pattern were already inconsistent in the repo. `python/examples/custom_tools_agent_test.py:95` does `res["status"]`, which raises `TypeError` on `next` today and is fixed by this PR. The doc snippets did attribute access and are updated here. No changelog entry and no version bump are included. That is deliberate, so the release call stays explicit rather than implied by the merge. ## How Has This Been Tested? ```bash cd python mypy --config-file config/mypy.ini composio/ tests/ # clean ruff check --config config/ruff.toml composio/ tests/ # clean pytest tests/ # 1336 passed, 33 skipped ``` `ruff format` was run with the repo's pinned toolchain. ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [x] Breaking change ## Checklist - [x] I ran linters/tests locally and they passed - [x] I updated documentation as needed - [x] I added tests or explain why not applicable - [ ] I added a changeset if this change affects published packages. Not applicable: `AGENTS.md` reserves changesets for published TypeScript packages https://claude.ai/code/session_01GsD8zvAhrjFwk144oWkD9K --------- Co-authored-by: AseemPrasad <aseemprasad0520@gmail.com> Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com> |
||
|
AseemPrasad
|
e57661755b |
Merge branch 'next' of https://github.com/ComposioHQ/composio into asimcomposio
# Conflicts: # python/composio/core/provider/_openai_responses.py # ts/packages/providers/openai/src/OpenAIResponsesProvider.ts |
||
|
AseemPrasad
|
04817cb20d | fix(openai): recursive strict-mode schema normalization for structured outputs (+ Python parity) | ||
|
Alberto Schiabel
|
a14f9d537f |
fix(py): normalize toolkit-less tool metadata (#4178)
This PR: - closes #4152 - normalizes model- and mapping-shaped tool responses at the Python SDK boundary - uses `unknown` for direct/schema modifiers and `composio` for Tool Router execution, matching TypeScript - caches the untouched fetched tool before schema modifiers so execution keeps the original toolkit version metadata - reuses the cached tool during execution instead of retrieving the same schema twice - adds behavior regressions for schema, before/after execution, single-fetch execution, raw metadata preservation, and TypeScript parity - verifies the Python regressions against both the current Stainless client and `ComposioHQ/composio-client` at `605f508e` |
||
|
Alberto Schiabel
|
d544006a25 |
fix(sdk): pin the validated address when fetching URLs (SSRF DNS rebinding) (#4172)
Fixes #4151. ## The problem Both SDKs validated a URL by resolving its hostname, and then handed the *hostname* to the HTTP client, which resolved it again when it opened the socket. Two lookups, two answers: a short-TTL record under an attacker's control answers publicly for the check and with `169.254.169.254`, `127.0.0.1`, or RFC 1918 space for the connect. The guard passes and the connection lands inside the network — classic TOCTOU DNS rebinding, documented in both modules until now as a known residual. ```mermaid sequenceDiagram participant SDK participant DNS as Attacker DNS participant Meta as 169.254.169.254 Note over SDK,Meta: before SDK->>DNS: resolve evil.example.com (validate) DNS-->>SDK: 93.184.216.34 — passes the guard SDK->>DNS: resolve evil.example.com (connect) DNS-->>SDK: 169.254.169.254 SDK->>Meta: GET /latest/meta-data/… Meta-->>SDK: credentials ``` ## The fix Resolve once, validate every answer, then connect to the address that was validated. There is no second lookup left to rebind. - **Python** — `safe_get` / `safe_request` mount a transport adapter that swaps the connect target for the duration of the socket connect only. The `Host` header and TLS SNI keep the hostname, so certificate verification is unchanged; rewriting `conn._dns_host` for the whole connection would have sent `Host: <ip>` and offered the IP as SNI, failing against every real origin. Every fetch call site now goes through those two helpers, so no `requests.get` sits next to a bare check any more: - `_files.py::_fetch_file_from_url`, `_files.py::FileDownloadable.download` - `tool_router_session_files.py::_fetch_url_bytes` - `safe_request`, per redirect hop - **TypeScript** — `assertSafeFetchTarget` returns the validated address and `ssrfSafeFetch` hands `fetch` a dispatcher pinned to it, re-pinned per redirect hop. The dispatcher goes to the runtime's own `fetch`, so callers that stub `globalThis.fetch` keep working. The pinned `lookup` answers both shapes Node calls it with — the address *list* it uses for Happy Eyeballs, and the single `(address, family)` it uses when `autoSelectFamily` is off — since answering in the wrong shape is rejected as an invalid address. - A fail-closed peer assertion runs on the Python side before a byte is written to the socket — redundant while pinning works, and a tripwire if a urllib3 upgrade ever breaks it. - `workerd` is unchanged: it already fails closed for user-supplied URLs. Redirect *validation* already existed in both SDKs (`safe_request` / `ssrfSafeFetch`); what was missing was re-pinning each hop. ## Tests The existing suites could not express this bug: they mock both the resolver and the HTTP client, so check and use are the same mock. The new tests use real sockets. - `python/tests/test_url_safety_pinning.py` — two loopback servers and a resolver that answers the first lookup with one endpoint and every later one with another, which is what a short-TTL rebinding record does. Asserts the rebound endpoint receives **zero** connections, and that `Host` still carries the hostname. Both tests fail on `next` and pass here. - `ts/packages/core/test/utils/pinnedDispatcher.node.test.ts` — a real server plus a hostname under `.invalid`, which RFC 2606 guarantees never resolves. A request that arrives proves the connect used the pinned address and never consulted DNS. The third case shows the contrast: unpinned, the same fetch cannot resolve at all. - `ssrfGuard.test.ts` gains assertions that each hop is pinned to that hop's own validated address. - `pinnedDispatcher.node.test.ts` also pins with `setDefaultAutoSelectFamily(false)`, which is the branch Node takes for the single-address callback. ## Notes - Supersedes #4157, which diagnosed this correctly. Its post-response peer check turned out not to hold: with an HTTP/1.0 or `Connection: close` server, urllib3 detaches the socket (`conn.sock is None`) while `r.content` still returns the full body, so the check fails open exactly where exfiltration succeeds. That is why the assertion here runs at connect time instead. - The Python package now declares `urllib3>=2` directly. `url_safety` imports it for `NameResolutionError`, which only exists from 2.0, and the pinning adapter reaches into 2.x connection internals; `requests` alone allows 1.x, where `import composio` would have failed outright. - `@composio/core` gains an `undici` dependency, pinned to `^7`: undici 8 dispatchers are rejected by the `fetch` in every Node version this package supports (22/24/25, verified). The real-socket test runs on the full CI matrix, so a future incompatibility fails loudly instead of silently un-pinning. - `undici` is imported on first pinned request rather than at module load: importing it installs a process-wide global dispatcher, which would have handed the host application's own unrelated `fetch` calls this package's undici merely because it imported `@composio/core`. - Residuals, now documented in the modules: - Requests routed through an environment proxy keep the pre-flight check only. The proxy resolves the hostname itself and the SDK cannot see or pin that resolution. - A process that does perform a pinned fetch still ends up on this package's `Agent` if nothing had claimed the global dispatcher slot yet. undici defines that slot non-configurable, so it cannot be handed back — assigning `undefined` leaves the runtime's own `fetch` asserting on a missing dispatcher. |
||
|
Soumya Medapati
|
760f8d0367 |
fix(sdk): route provider tool calls through sessions (#4098)
## Problem Provider tool-call helpers always used the globally injected direct `Tools.execute` function. When a model received tools from `session.tools()`, calling `handleToolCalls` or `handle_tool_calls` therefore discarded the Tool Router session context and caused session meta-tools such as `COMPOSIO_SEARCH_TOOLS` to fail. Calling `session.execute()` manually preserved the session, but bypassed provider behavior such as Anthropic input normalization and schema-alias restoration. ## Root fix - Add an explicit execution target to the non-agentic provider helpers: - TypeScript: `handleToolCalls(session, response)` and `executeToolCall(session, call)` - Python: `handle_tool_calls(response=response, session=session)` and `execute_tool_call(tool_call=call, session=session)` - Route normalized provider arguments through the supplied Tool Router session. - Map session responses back to each helper's existing result shape. - Keep provider-specific normalization before execution, including Anthropic schema-alias restoration. - Reject direct-only options and modifiers when the selected target is a session, including plain JavaScript calls that bypass the TypeScript overloads. - Update OpenAI and Anthropic examples to use the session-aware helpers. - Harden the docs policy test so setup and execution split across fences in one sample are still detected. ## Docs review follow-ups - Reword the concepts-page prohibition so it forbids user-ID-bound helper calls, not the helpers themselves, matching the provider pages in this PR. - Add minimum-version callouts to the OpenAI and Anthropic provider pages (Python `composio` newer than 0.19.0; TypeScript `@composio/core` ≥ 0.17.0 with `@composio/openai` ≥ 0.12.0 / `@composio/anthropic` ≥ 0.11.0), pointing older versions at `session.execute()`. - Bump `docs/package.json` to `@composio/core` `^0.15.0` and `@composio/openai` `^0.11.0` (the published majors at the time of the bump; `@composio/core` 0.16.0 and `composio` 0.19.0 have since released from `next` without this PR, so its changeset will publish core 0.17.0 and the next Python minor) and annotate each `@errors: 2345` Twoslash marker with a TODO naming the minor version that retires it; since this changeset releases minors, all three pins need a manual range bump to retire the markers. This version of twoslash only throws on *unlisted* errors, so a stale marker cannot break the build — it would only mask future TS2345s, which the TODOs now track. - Update `SESSION_GUARDRAILS` (the block appended to `.md` responses for agents): add a session-execution bullet (scoped to the OpenAI and Anthropic helpers, with `session.execute()` for every other provider) and qualify the direct-execution list with "with a user ID". The session-execution static test now scans the guardrail blocks like the execute-version test already did. - Tighten the docs detector: the Python branch is bounded to the helper call's argument list (tolerating one level of nested calls) instead of running past the closing paren, and the TypeScript branch catches whole user-ID identifiers (`userId`, `user_id`, `uid`) without flagging session variables like `userSession` — each edge has a regression test. - Note on the Google provider page that its `executeToolCall` is not session-aware yet. ## Compatibility and release Existing user-ID calls remain unchanged and continue to use direct tool execution. The new session call forms are additive. The changeset applies minor releases to `@composio/core`, `@composio/openai`, and `@composio/anthropic` — the new session overloads are a type-level break for provider subclasses, so patch was too small. The configured fixed group also includes `@composio/slim`. The docs site intentionally checks examples against currently published SDK declarations. The three new TypeScript calls therefore carry exact Twoslash `TS2345` release-skew annotations; remove them (per the inline TODOs) once `docs/package.json` picks up `@composio/core` ≥ 0.17.0, `@composio/openai` ≥ 0.12.0, and `@composio/anthropic` ≥ 0.11.0. ## Verification - `@composio/core`: 1,061 tests passed; typecheck passed - `@composio/openai`: 34 tests passed; typecheck passed - `@composio/anthropic`: 53 tests passed; typecheck passed - Python provider and aliasing suites: 40 passed, 4 skipped - Focused Python mypy and Ruff checks passed - Docs static suite: 208 tests passed (including the new guardrail-scan and detector cases) - Docs production build passed with the bumped `@composio/core` 0.15.0 / `@composio/openai` 0.11.0, including Twoslash, TypeScript, and all generated pages - Docs lint passed; lint reports only existing warnings - Changeset status reports the expected minor packages --------- Co-authored-by: Soumya Medapati <soumyamedapati@soumyas-air.local.meter> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
b1c6671b20 |
fix(py): send Content-Type on S3 PUTs and parse Content-Length (#4168)
This PR: - fixes #4153 - supersedes https://github.com/ComposioHQ/composio/pull/4154 (fork PR authored against a pre-#4146 tree; its tests patch `requests.put`, which `upload()` no longer calls after #4146, so they fail on merge) - adds `parse_content_length()` in `composio.utils.url_safety`, shared by both URL fetch helpers (`_files.py::_fetch_file_from_url` and `tool_router_session_files.py::_fetch_url_bytes`), so a malformed/negative remote `Content-Length` degrades to unknown size under the streamed byte count instead of raising a raw `ValueError` - converges the file and bytes upload paths onto `_upload_to_presigned_url()`: one PUT that sends the `Content-Type` the presign request was signed with and raises `ErrorUploadingFile` carrying the HTTP status (a 403 no longer collapses into a path-only error) - single-sources the presign wire shape via `_request_presigned_upload()`; `from_path()` forwards the exact mimetype it minted, so signed and sent content types cannot drift - mirrors the TypeScript SDK: `uploadFileToS3` funnels path/URL/File inputs through one uploader that always sends `Content-Type` and throws on non-2xx, and `readResponseBodyWithLimit` trusts `Content-Length` only as a hint - adds tests against the `safe_request` seam (`test_file_upload_robustness.py`, plus one malformed-header case for `RemoteFile.buffer()`) ## Context Both defects in #4153 were symptoms of two parallel upload paths drifting: the bytes path sent `Content-Type` and raised with the status, the file path did neither. Patching the symptom in place (as #4154 proposed) would have left three presigned PUT sites and two error contracts in the tree; this PR deletes the drift vector instead. Full suite green (1320 passed), `make chk` and `make snt` clean; Python-only change, so no changeset per `AGENTS.md`. --------- Co-authored-by: Mustaqeem66 <265153888+Mustaqeem66@users.noreply.github.com> |
||
|
Alberto Schiabel
|
03429c7404 | fix(python): create the cache directory on first use instead of at import time (#4162) | ||
|
Alberto Schiabel
|
6ba9179b48 |
fix(files): validate URLs from API responses before fetching them (#4146)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/4144 - routes every fetch whose URL comes from an API response through the SSRF guards that already existed — ten sinks, five per SDK: the tool-execution download, both S3 presigned uploads, `RemoteFile.buffer()`/`blob()`, and the Tool Router session file upload - adds `safe_request()` (Python), which follows redirects itself and re-validates each hop, so a validated URL cannot 302 into private space and an S3 307 region redirect still works - makes `RemoteFile.buffer()` (Python) share `_fetch_url_bytes` with the user-supplied-URL path instead of duplicating it — it previously read `response.content` with no size cap, no redirect control, and no target validation - adds `ssrfSafeFetchWhereSupported` (TypeScript): the full guard on Node, a plain `fetch` on workerd, so Tool Router session file transfers keep working in edge runtimes rather than failing closed - documents DNS rebinding as a known residual in both guards - adds tests that assert the guard *runs* — blocked URL, sink never called, nothing written — rather than that a transfer succeeds ## Context `python/AGENTS.md` states the trust boundary: every field of an API response is untrusted input, because the backend may be compromised or the connection MITM'd. Both SDKs enforced that for URLs a *user* passes in (`composio.utils.url_safety`, `ssrfGuard.node.ts`) and left the URLs an API *response* supplies unguarded — backwards relative to the stated model. A response naming an internal address turned the SDK into a request proxy for it, and the fetched bytes were written to disk or returned to the caller, typically into an LLM context. `RemoteFile.buffer()` was the weakest of the ten: four lines above it, `_fetch_from_url` validated its target, refused redirects, and streamed against a 100 MiB cap; `buffer()` did none of the three. The only difference between them was which side of the trust boundary the URL arrived from. Three decisions worth review: - **The guard is unconditional.** Presigned URLs are public, so nothing legitimate should resolve to private space. There is no escape hatch, and no new configuration surface. - **The tool-execution download stays uncapped.** It streams straight to disk, so `_MAX_RESPONSE_SIZE` — a memory-exhaustion bound — does not apply, and tool attachments legitimately exceed it. `RemoteFile.buffer()` *is* capped, because it buffers in memory. - **Uploads follow redirects with re-validation rather than refusing them**, since S3 can answer a PUT with a 307 region redirect. Downloads keep `allow_redirects=False`, matching the existing fetch paths. Python now matches the TypeScript guard's per-hop re-validation, which was the better of the two implementations. Verified locally: `make chk` and `make tst` clean on the Python side; `pnpm -C packages/core test` 1095 passed, typecheck and lint clean. |
||
|
Alberto Schiabel
|
f67d565743 |
refactor(python): consolidate path construction from untrusted input (#4144)
This PR: - centralizes filesystem path construction for API-provided slugs and filenames in `composio.utils.safe_path` - rejects traversal, Windows-invalid names, invalid Unicode, and overlong encoded filenames before creating directories or writing files - normalizes trusted roots consistently and routes both Python download paths through the shared helpers - adds a fail-closed AST guard for new dynamic path construction, including direct `Path(...)` calls - isolates provider initialization from the real home directory and makes the home-write guard report changes without deleting them - removes the obsolete download filename wrapper ## Verification - `pytest -q`: 1,248 passed, 47 skipped - repository-configured Ruff checks and formatting passed for every changed Python file - targeted mypy checks passed for the changed helpers and tests |
||
|
Checo
|
a3f6b9c8f2 |
fix(py/triggers): swallow malformed chunked frame instead of tearing down subscription (#3892)
## Problem TriggerSubscription._handle_chunked_events is bound directly as a Pysher channel callback. Pysher channel dispatch has no local exception boundary, so malformed chunk frames reached websocket-client error handling and marked the realtime connection failed. The normal payload parser already skips malformed frames, but the chunked path did not. ## Fix - Validate that each decoded frame is an object with string id/chunk, integer non-boolean index, and boolean final fields. - Contain decoder, validation, and reassembly failures at the callback boundary and log only a bounded frame preview. - Clear partial state only when the frame carries a validated string id, allowing that id to be reused safely. - Preserve the valid chunk reassembly path and fix the Chunked docstring typo. ## Regression coverage Tests cover invalid JSON, non-object frames, missing fields, unhashable ids, wrong field types, unexpected decoder failures, and successful same-id reassembly immediately after a bad frame clears partial state. ## Verification - nox -s tst -- tests/test_triggers.py: 83 passed - make chk: Ruff and mypy passed --------- Signed-off-by: Checo <sergio@checo.cc> Co-authored-by: Checo <sergio@checo.cc> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Checo
|
2a2d77a764 |
fix(py/triggers): stop() deadlock + subscribe() timeout connection leak (#3890)
Fixes #3858 (both bugs reported there). Bug 1 — TriggerSubscription.stop() deadlocks when called from a trigger callback. pysher's Connection.disconnect runs socket.close() then join(timeout) on the websocket thread, but callbacks execute on that same thread's dispatch path (_handle_event blocks on the callback's future.result()), so joining the thread from within a callback that runs on it deadlocks the whole process and _alive is never cleared, so a main thread parked in wait_forever() never exits. Fix: clear _alive synchronously (so wait_forever unblocks immediately) and run disconnect() on a daemon thread, breaking the reentrancy while still closing the socket. Bug 2 — _SubcriptionBuilder.connect() leaks a websocket thread on timeout. The deadline path raised ComposioSDKTimeoutError without calling pusher.disconnect(), so pysher's run loop kept redialing every reconnect_interval for the life of the process — one leaked thread per timed-out subscribe(), and if a leaked connection later succeeded it would authenticate and subscribe the channel of an abandoned TriggerSubscription, silently consuming events. Fix: wrap the wait loop in try/except so the timeout path tears the connection down before re-raising. Added regression tests (TestTriggerSubscriptionStop and TestSubscriptionBuilderConnectTimeout) that reproduce both failure modes offline with mocked pusher connections; all 73 tests in tests/test_triggers.py pass, ruff check + format clean. --------- Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> Co-authored-by: jkomyno <alberto.schiabel@gmail.com> |
||
|
Alberto Schiabel
|
c4071feab4 |
fix(py): guard URL uploads and redact telemetry (#3823)
This PR: - ports the TypeScript SDK's public-network guard to Python URL file uploads - rejects non-HTTP(S), private, loopback, link-local, reserved, and mixed DNS targets before a request is made - applies the guard to both `FileUploadable.from_url()` and Tool Router session-file URL uploads - redacts URL queries, Authorization credentials, and secret-like key/value pairs before error telemetry leaves the process - adds focused SSRF and redaction regressions alongside the existing file-upload coverage Validation: - `uv run --frozen pytest tests/test_url_safety.py tests/test_redaction.py tests/test_files.py -q` - `uv run --frozen ruff check …` - `uv run --frozen ruff format --check …` |
||
|
Alberto Schiabel
|
e78ed312c6 |
fix(core): run all parallel OpenAI tool calls from the first choice (#3726)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3712, preserving the original commits by @serhiizghama (kept as author/co-author) - fixes `OpenAIProvider.handleToolCalls` to execute **every** tool call in an assistant message — it previously only read `tool_calls[0]`, so parallel tool calls (on by default) were dropped and their `tool_call_id`s went unanswered, failing the next request with the "must be followed by tool messages responding to each `tool_call_id`" error - limits execution to the **first choice** — with `n > 1` the previous loop ran each tool call once per choice and orphaned the `tool_call_id`s belonging to the alternative completions - aligns the Python SDK (`OpenAIProvider.handle_tool_calls`) with the same first-choice behavior so both SDKs stay in parity - fixes the stale `@composio/openai` test that modeled "multiple tool calls" as separate `n` choices rather than one message's `tool_calls` array - clarifies in the changeset that the calls run **sequentially**, in the order the model returned them (here "parallel" means the model issued several calls in one turn, not concurrent execution), so each `tool_call_id` is answered exactly once and deterministically - adds regression tests (TS + Python): both calls run for parallel tool calls in one message, and only the first choice runs when `n > 1` Full `@composio/core` (996) and `@composio/openai` suites green; Python `handle_tool_calls` tests, Ruff, and mypy clean; `tsc` clean. --------- Co-authored-by: serhiizghama <zmrser@gmail.com> |
||
|
Alberto Schiabel
|
a69c3edea3 |
fix(triggers): align create() user_id resolution across SDKs (#3723)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3714 — addresses its code-review findings - restores TS/Python parity on slug validation: Python `create()` now validates the slug up-front and raises a new `TriggerTypeNotFound`, mirroring the TS `ComposioTriggerTypeNotFoundError` - switches both SDKs to the native `user_id` upsert field — TS drops the `& { user_id }` intersection and Python drops the `extra_body` shim (both pinned clients already expose the field) - treats a blank/whitespace `userId` (TS) or `user_id`/`connected_account_id` (Python) as missing instead of forwarding it to the backend - documents the error-contract change (`create()` no longer throws `ComposioConnectedAccountNotFoundError` — that case now surfaces from the backend) in the changeset and `ts/docs/api/triggers.md`, and bumps the changeset from `patch` to `minor` - adds Python tests for the 2FA (both-provided) path, unknown-slug, and blank `userId`; tightens the TS auto-resolve assertion and adds an empty-`userId` case ## ⚠️ Release gating Since #3714, `triggers.create()` (both SDKs) relies on the backend resolving the trigger connection from `user_id` on upsert ([ComposioHQ/platform#10932](https://github.com/ComposioHQ/platform/pull/10932)). There is **no client-side fallback** — reintroducing one would undo #3714's intent, so this is a release-sequencing requirement, not a code change here. - Do not release `@composio/core` or the Python SDK until #10932 is live in all regions. - Self-hosted / on-prem deployments must be on a backend version that includes #10932. ## Review findings addressed | # | Finding | Resolution | |---|---------|------------| | P1-1 | Coupled to unreleased backend, no fallback | Documented dependency in changeset; flagged release-gating above (no fallback by design) | | P2-2 | Cross-SDK parity on slug validation | Kept `getType` in both; added Python `TriggerTypeNotFound` mirroring TS | | P2-3 | `user_id` bridge redundant in both SDKs | TS uses native field directly; Python uses `user_id=` kwarg | | P2-4 | Error-contract change shipped silently | Documented in changeset + docs `Throws` section; `minor` bump | | P2-5 | Python missing 2FA (both-provided) test | Added `test_create_with_user_id_and_connected_account_id` | | P3 6–13 | Cleanups | undefined-assertion, `none_to_omit`, docstring, `parsedBody.data`, redundant `else`, stale comments, blank-string guard | ## Verification - TS: `vitest` 59 passed, `typecheck` clean, `eslint`/`prettier` clean - Python: `pytest tests/test_triggers.py` 69 passed, `nox -s chk` (ruff + mypy) clean |
||
|
Anshu Garg
|
20a4711ee0 |
feat(triggers): resolve connection from user_id server-side in create() (#3714)
## What `triggers.create()` used to make an extra **`connectedAccounts.list()`** call to turn a `user_id` into a `connected_account_id` before calling upsert. The backend now resolves the connection from `user_id` directly (picks the first active connection for the user + the trigger's toolkit, parity with tool execution), so the SDK passes `user_id` straight through and drops the round-trip. - **TS** (`ts/packages/core`): removed the `connectedAccounts.list()` block in `Triggers.create()`. `user_id` was already forwarded to upsert (for 2FA); this just removes the now-redundant lookup. `getType` is kept for an early, clear "trigger type not found" error. `connected_account_id` is passed when the caller pins one. - **Python** (`python/composio`): dropped `_get_connected_account_for_user`; `user_id` is sent via `extra_body` and `connected_account_id` is omitted when not provided. ## Why The SDK only ever holds a `user_id`, so every `triggers.create()` paid an extra API call to find a connection. The backend change (ComposioHQ/platform#10932) makes trigger upsert accept `user_id` and auto-resolve — this PR consumes that. ## Behavior notes - When `connected_account_id` is omitted, the backend picks the first active connection ordered by `created_at desc`. The TS SDK's old `list()[0]` ordering was unspecified — selection is now deterministic and consistent with tool execution. - "No connected account found" / "connected account not found" now surface from the **backend** instead of a client-side pre-check. - When 2FA is enabled and `connected_account_id` is pinned, the backend validates that `user_id` owns it (unchanged; `user_id` was already forwarded). - The `extra_body` / `& { user_id }` bridges are still needed only until `@composio/client` / `composio_client` regenerate with `user_id` on the upsert type (the field is already in the OpenAPI contract). ## Tests - TS: `vitest run test/models/triggers.test.ts` → **58 passed** (create tests rewritten to assert no `connectedAccounts.list()` call + `user_id` forwarded). - Python: `pytest tests/test_triggers.py` → **66 passed** (same). ## Depends on Backend: ComposioHQ/platform#10932 (`feat(apollo): resolve trigger connection from user_id on upsert (PLEN-2580)`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
9901e01a80 |
feat(py): add tool router session deletion
Release Python 0.17.1 with Tool Router session deletion support. |
||
|
Alberto Schiabel
|
e7bb45f449 |
fix(py): normalize generated SDK doc examples (#3689)
This PR: - normalizes Python SDK reference examples generated from source docstrings - rewrites the `Triggers.parse()` docstring so the generated Flask/FastAPI examples are copy-pasteable - strips nested Markdown fences before wrapping generated examples in MDX code fences - regenerates `docs/content/reference/sdk-reference/python/` - adds regression coverage for the `Triggers.parse()` generated example and fenced example normalization - does not include a changeset because this only changes docs generation, generated docs, and tests ## Verification - `cd python && .venv/bin/python -m pytest tests/test_generate_docs.py -q` - `cd python && .venv/bin/ruff check --config config/ruff.toml composio/core/models/triggers.py scripts/generate-docs.py tests/test_generate_docs.py` - `cd python && .venv/bin/ruff format --check --config config/ruff.toml composio/core/models/triggers.py scripts/generate-docs.py tests/test_generate_docs.py` - `cd python && .venv/bin/python scripts/generate-docs.py` - `cd docs && bun install --frozen-lockfile` - `cd docs && bun run types:check` |
||
|
Rahul Tarak
|
d17a268d3f |
docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637)
Integration branch for the next docs release: a **sessions-first
documentation rewrite** — new and rewritten guides, example pages,
interactive components, and docs tooling — plus the supporting SDK
changes that the new docs describe.
The bulk of this PR is docs (~24k lines across ~150 commits); the SDK
changes (~5k lines) back the new guides.
## Documentation (the bulk)
- **Sessions-first restructure** — reorganized navigation and section
structure (incl. the "Sandbox (prev workbench)" section), with
v3-reorganization redirects so old URLs keep resolving.
- **Rewritten core guides** — quickstart, configuring sessions, triggers
(creating + subscribing to events), proxy-execute, toolkits
enable/disable, and common FAQ, rewritten in the house voice.
- **New example pages** — local-sandbox PR reviewer, daily standup bot,
and slack bot, with runnable build-ups.
- **New interactive components & diagrams** — triggers flow animation,
manage-connections visual, connection-refresh visual, and the
terminal-kit components.
- **Docs tooling** — a docs-graph link-graph connectivity checker,
search reprioritization (deprioritize legacy pages), and SDK-reference
regeneration.
## Supporting SDK changes
**`@composio/core` → 0.13.0 (minor)**
- `composio.sessions.create()` as the first-class sessions API
(`composio.create()` kept as an alias).
- **MCP is opt-in:** default `create()` / `use()` return native-tool
sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface
`session.mcp`. _Migration: read `session.mcp` only after creating with
`{ mcp: true }`._
- `session.sandbox` is the canonical resolved config;
`session.workbench` kept as a deprecated alias. `sandbox` is the
preferred session-config key (`workbench` still accepted).
- `connectedAccounts.updateAcl()` graduated from experimental (alias
kept).
- `triggers.parse()` (parse + optionally verify an incoming webhook) and
`triggers.setWebhookSubscription()`.
**`@composio/experimental` → minor** — local-workbench helpers moved
onto the `@composio/experimental/workbench` subpath (out of
`@composio/core/experimental`), keeping the ~14 KB embedded Python
helper out of core. Plus the experimental Pi provider.
**`@composio/slim` → minor.**
**Python → 0.17.0** — mirrors the TS surface: `composio.sessions` mount
(`tool_router` deprecated), `triggers.parse()` /
`set_webhook_subscription()`, the `sandbox` config key, and
`connected_accounts.update_acl()`.
## Review response (#3664)
Addressed the `@composio/core` review:
- **Security:** `triggers.parse()` no longer fails open — a
present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`)
now throws instead of silently skipping verification; omitting it stays
an explicit opt-out (both SDKs).
- Removed snake_case leakage from `transformWebhookSubscription` (+ the
index signature that allowed it).
- **Removed** the TS-only `connectedAccounts.link()` toolkit
auto-resolve (shipped with cancellability / orphaned-auth-config bugs
and was effectively undocumented; to be reintroduced properly later).
- Unified Python error types on `ValidationError`; added `mcp=True`
Python tests; fixed runtime-portability + error-type test assertions.
- Polished deprecation messages; fixed the backwards `/experimental`
`@deprecated` note and the `SessionWithMcp` JSDoc.
## Testing
- **TS:** `@composio/core` + `@composio/experimental` typecheck pass;
vitest green for the touched suites.
- **Python:** `test_tool_router.py` + `test_triggers.py` pass (161
tests).
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev>
Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Sarah Simionescu <sarah@composio.dev>
Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>
|
||
|
Alberto Schiabel
|
09b552aa03 |
fix(py): disable retries on non-idempotent tool writes to prevent duplicate side effects (#3657)
This PR: - stops the Python SDK from silently retrying `tools.execute` and `tools.proxy`, which are non-idempotent POST writes. The Stainless-generated client retries POSTs by default (`max_retries=2`) on read timeouts, 429, 5xx, and connection errors. A read timeout is unsafe to retry — the request may already be in flight on the backend — so a retry can duplicate the side effect, e.g. send an email twice. Reported in https://github.com/ComposioHQ/composio/issues/3586 - routes both write paths through a new `client.without_retries` — a cached, retry-disabled (`max_retries=0`) clone of the `HttpClient`. Reads and lists keep the default retries, so resilience is unchanged for idempotent calls - overrides `HttpClient.copy()` to re-inject the required `provider` keyword and re-aliases `with_options`, since the generated `copy()` rebuilds via `self.__class__(...)` without `provider` — previously `with_options(max_retries=0)` raised `TypeError` on the subclass - caches the no-retry sibling instead of cloning per call: each clone creates a new `ContextVar`, and dynamically-created `ContextVar`s are never garbage-collected - adds `tests/test_no_retry_writes.py`: writes hit the transport exactly once on a retryable 5xx, reads still retry-then-succeed (proving the scoping), and a regression guard for the `copy()` override - interim fix only — the durable solution is idempotency keys, tracked in https://github.com/ComposioHQ/composio/issues/3654 (gated on backend support), which supersedes this once available No changeset (Python-only change; changesets are TypeScript-only). |
||
|
Alberto Schiabel
|
aeeb471c63 |
fix(py): resolve $ref/$defs so file flags behind a reference aren't dropped (#3653)
## Problem
Tools whose parameter schemas express their file fields through a
`$ref`/`$defs` indirection lose auto file handling. With
`dangerously_allow_auto_upload_download_files=True`, a
`file_downloadable` output behind a `$ref` is never downloaded (the raw
`{name, mimetype, s3url}` object is passed through), and a
`file_uploadable` input behind a `$ref` is never staged — silently, with
no error.
`GMAIL_GET_ATTACHMENT` is the canonical shape — the flag sits two `$ref`
hops deep:
```
data → $ref → #/$defs/GetAttachmentResponse → file → $ref → #/$defs/FileDownloadable (file_downloadable: true)
```
**Root cause:** the hand-rolled walkers in
`composio/core/models/_files.py` (`_has_file_property`,
`_substitute_file_upload_value`, `_substitute_file_download_value`, …)
recurse through `properties`/`anyOf`/`oneOf`/`allOf`/`items` but **never
dereference `$ref`**, so a flagged node reachable only through a
reference is invisible to them.
Fixes https://github.com/ComposioHQ/composio/issues/3506
## Approach
Rather than teach each walker to dereference — which means threading a
root schema through ~10 methods, re-deriving `$ref` handling in each,
and risking unbounded recursion on cyclic schemas — this introduces a
single **`dereference_json_schema`** utility and inlines references
**once at the `FileHelper` boundary** (`process_file_uploadable_schema`,
`substitute_file_uploads`, `substitute_file_downloads`). The walkers
stay reference-agnostic.
This mirrors the TypeScript SDK's `dereferenceJsonSchema` (the
counterpart fix in #3566 for the TS twin of this bug, #3307) so both
SDKs share one behavioral contract. Resolving once at the boundary also
gives every walker `$ref` support for free — including keywords they
never special-cased (`additionalProperties`, `patternProperties`,
`prefixItems`, `not`), because the resolver walks containers
reflectively.
## What's in the utility (`composio/utils/json_schema.py`)
Faithful port of the TS guards:
- **Cycle safety** — breaks both `$ref` cycles and live-object identity
cycles with a permissive `{type: object, additionalProperties: true}`
sentinel. (A per-node lazy resolver without threaded cycle tracking
infinite-loops on a self-referential schema; there's a regression test
for exactly this.)
- **Depth caps** — `MAX_REF_CHAIN_DEPTH=100` / `MAX_NODE_DEPTH=512`
raise a typed `JSONSchemaRefResolutionError` instead of exhausting the
interpreter (with a `RecursionError` backstop converted to the same
typed error).
- **Sibling-keyword merge** — Draft 2020-12 semantics (siblings win on
collision), so a `description`/`default` next to a `$ref` survives.
- **External-ref passthrough** — `http(s)://` refs are left untouched
and logged once for audit.
- **`sentinel` mode** — a dangling `$ref` (an API schema that emits
`$ref` with no `$defs` block,
https://github.com/ComposioHQ/composio/issues/3307) degrades to the
permissive sentinel + an LLM-visible hint, instead of aborting the tool
call. The `FileHelper` uses this mode for API-sourced schemas.
- **Non-mutating** — returns a new schema; `$defs`/`definitions` are
stripped from the inlined root.
## Tests
- `python/tests/test_json_schema.py` — 30 cases mirroring the TS
`jsonSchema.test.ts` contract (chains, reflective container walk, legacy
`definitions`, sibling merge, cycles, depth caps, pointer-escape
decoding, array-index pointers, full `sentinel`-mode suite).
- `python/tests/test_files.py` — end-to-end regressions through the
public methods: download/upload behind `$ref`/`$defs` (the #3506 repro),
the LLM-facing input transform, graceful degradation of a dangling
`$ref`, and a **self-referential schema that must not recurse
infinitely**.
- `nox -s chk` (ruff + mypy) green; `nox -s tst` for the file/execution
suites green.
## Notes
Supersedes #3545 (third-party PR that fixed the same bug by threading
`root_schema` through each walker). That diagnosis was correct; this
takes the centralized route consistent with the TS SDK and adds the
cycle/depth guards. No changeset — Python-package change.
|
||
|
Xiaoju
|
dd40a9bb6f |
fix(py): bound file transfer requests with timeouts (#3563)
## Summary - add bounded `(connect, read)` timeouts to Python SDK session file downloads and uploads - add the same timeout coverage to presigned S3 upload/download paths used by file helpers - convert timeout/request failures into the SDK's existing file errors and cover them with tests Fixes #3560 Fixes #3561 Fixes #3562 ## Changes - `RemoteFile.buffer()` now uses the existing file transfer timeout constants and preserves file context on request failures - `ToolRouterSessionFilesMount.upload()` and S3 upload helpers now bound presigned `PUT` requests - `FileDownloadable.download()` now bounds streaming `GET` requests, wraps streaming read failures, and closes the response - added regression tests for request timeouts and timeout arguments - added a changeset for the published SDK change ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? - [x] `D:\anaconda3\envs\yolov12\python.exe -m ruff check python\composio\core\models\tool_router_session_files.py python\composio\core\models\_files.py python\tests\test_tool_router_session_files.py python\tests\test_files.py` - [x] `D:\anaconda3\envs\yolov12\python.exe -m ruff format --check python\composio\core\models\tool_router_session_files.py python\composio\core\models\_files.py python\tests\test_tool_router_session_files.py python\tests\test_files.py` - [x] `COMPOSIO_CACHE_DIR=<repo>\.tmp-composio-cache D:\anaconda3\envs\yolov12\python.exe -m pytest python\tests\test_tool_router_session_files.py python\tests\test_files.py::TestUploadBytesToS3 python\tests\test_files.py::TestFileDownloadablePathTraversal::test_safe_filename_passes_through python\tests\test_files.py::TestFileDownloadablePathTraversal::test_download_uses_timeout python\tests\test_files.py::TestFileDownloadablePathTraversal::test_download_timeout_raises_error python\tests\test_files.py::TestFileDownloadablePathTraversal::test_download_stream_timeout_raises_error` Note: I also ran the full `python\tests\test_tool_router_session_files.py python\tests\test_files.py` pair locally. The new and related tests passed, but the full run has one pre-existing Windows-specific failure in `TestFileDownloadablePathTraversal::test_empty_name_safe_fails_at_write_time`: opening a directory for writing raises `PermissionError` on Windows instead of the test's expected `IsADirectoryError`. ## Screenshots (if applicable) N/A ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages ## Additional context This keeps the existing `(5s connect, 60s read)` timeout convention already used by the Python SDK's URL fetch helpers. --------- Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
a0bef5d986 |
chore(deps): bump composio client SDKs (TS alpha.74, Py 1.41.0) (#3609)
This PR: - bumps the TS catalog `@composio/client` from `0.1.0-alpha.72` to `0.1.0-alpha.74` (published from ComposioHQ/composio-base-ts#84) and refreshes `pnpm-lock.yaml` - bumps the Python `composio-client` pin from `1.39.0` to `1.41.0` (published from ComposioHQ/composio-base-py#69) - adds a patch changeset for `@composio/core` and `@composio/cli` so the client bump actually ships in the next release ## Context Neither client is auto-bumped in this repo — there is no Stainless→consumer bot, and Dependabot does not touch the pnpm `catalog:` pin (TS) or the exact `composio-client==` pin (Py), so these were a manual catch-up. The Python `1.41.0` PyPI publish initially failed with a `403 Forbidden` (stale `PYPI_TOKEN`); it was re-run successfully before this bump, so `1.41.0` is live on PyPI. |
||
|
Anshu Garg
|
56e0d781f3 |
fix(triggers): handle V3 envelope in realtime subscribe path [SUP-392] (#3567)
## Summary `triggers.subscribe()` crashes with `KeyError: 'nanoId'` on the **first event** for any project configured with webhook version **V3**. The realtime (Pusher) channel now delivers the modern V3 envelope (snake_case: `metadata.trigger_id` / `connected_account_id` / `auth_config_id`, with no top-level `nanoId`), but the realtime parser (`TriggerSubscription._parse_payload`) only understood the **legacy** envelope and accessed `data["metadata"]["nanoId"]` directly — so the very first inbound frame raises inside the Pusher `_on_message` callback and the registered handler is never invoked. The SDK already knows how to normalize the V3 envelope — it does so on the webhook path (`_normalize_v3_payload`) — that logic was simply never wired into the realtime path. This has affected the realtime subscribe path for V3 projects since the V3 trigger payload format was introduced; webhook-version V1/V2 projects are unaffected (they still receive the legacy realtime envelope). ## Changes - Extract the V3 → `TriggerEvent` normalization into a shared module-level helper (`_build_trigger_event_from_v3`) plus an envelope detector (`_is_v3_envelope`); the webhook path's `_normalize_v3_payload` now delegates to it, so webhook and realtime share one source of truth. - `TriggerSubscription._parse_payload` now detects the V3 envelope and normalizes it, and keeps the existing legacy mapping for V1/V2 payloads. - Harden `_parse_payload`: unknown/malformed frames are logged and skipped (return `None`) instead of raising, so a single bad frame can no longer tear down an active subscription. - Add tests covering V3 realtime parsing, legacy realtime parsing, and malformed-frame handling. ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? - `ruff check` + `ruff format` (config/ruff.toml) — clean. - `uv run pytest tests/test_triggers.py` — **52 passed** (49 existing + 3 new). - New tests: - `test_parse_payload_v3_realtime_envelope` — a V3 realtime frame parses to a `TriggerEvent` (no `KeyError`). - `test_parse_payload_legacy_envelope` — V1/V2 legacy frame still parses correctly. - `test_parse_payload_malformed_returns_none` — bad/partial frames are skipped, not raised. ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [x] I added tests or explain why not applicable - [ ] I added a changeset if this change affects published packages ## Additional context The realtime envelope is identical in shape to the V3 webhook envelope, so the shared normalizer keeps the two delivery channels consistent. No public API changes. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: jkomyno <alberto@composio.dev> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
Anshu Garg
|
a94715f577 |
feat(sdk): forward user_id on triggers.create for trigger 2FA (#3576)
## What `triggers.create(userId/user_id, ...)` already accepts a user id and uses it to resolve the connected account, but **dropped it** when building the `trigger_instances.upsert` body. With [2FA for triggers](https://linear.app/composio/issue/PLEN-2580) on the backend, 2FA-enabled projects need `user_id` on the upsert to verify the pinned connected account belongs to the caller's user. This forwards `user_id` to upsert in **both SDKs**: - **TS** (`ts/packages/core/src/models/Triggers.ts`): adds `user_id` to the upsert params via a `& { user_id?: string }` bridge. - **Python** (`python/composio/core/models/triggers.py`): forwards `user_id` via the client's supported `extra_body` escape hatch. Both bridges exist only until `@composio/client` / `composio-client` regenerate from the updated OpenAPI spec with a native `user_id` field — drop them then. ## Safety Backends without trigger 2FA ignore the extra field, so this is safe to land ahead of / alongside the backend rollout (hermes PR #10635). ## Tests - TS: upsert-body assertion added. - Python: `tests/test_triggers.py::test_create_with_user_id` asserts `extra_body == {"user_id": ...}`. 49 tests pass. Closes part of PLEN-2580 (SDK follow-up to the agreed approach). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
ce4b213361 |
fix(providers): normalize string tool-call arguments across all providers (TS + Python) (#3514)
## Summary Models — and some MCP transports — occasionally emit tool-call arguments as a **JSON string instead of an object/dict**. The most visible trigger is `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK, where streaming fails with: > `messages.3.content.1.tool_use.input: Input should be a valid dictionary` Until now only a handful of providers guarded against this, each with its own slightly different inline check, leaving most providers vulnerable and behaviour inconsistent across the SDK. This PR centralizes the coercion into **one helper per language** and routes **every** provider through it, in both the TypeScript and Python SDKs. Closes https://github.com/ComposioHQ/composio/issues/2406 ## What changed **TypeScript** — new `normalizeToolArguments` in `@composio/core` (exported), used by every provider: `vercel`, `cloudflare`, `openai-agents`, `openai` (ChatCompletions + Responses), `anthropic`, `google`, `langchain`, `llamaindex`, `claude-agent-sdk`, `mastra`. **Python** — new `normalize_tool_arguments` in `composio.utils.shared`, used by every provider: `openai`, `openai-responses`, `anthropic`, `google`, `langchain`, `langgraph`, `crewai`, `autogen`, `llamaindex`, `gemini`, `google-adk`, `openai-agents`, `claude-agent-sdk`. Shared semantics (identical in both languages): | Input | Result | | --- | --- | | object / dict | returned unchanged | | JSON string | parsed to object | | empty / whitespace string | `{}` | | `null` / `undefined` / `None` | `{}` | | array, primitive, unparseable string, JSON that isn't an object | **typed error** (`ComposioInvalidToolArgumentsError` / `InvalidParams`) with the original parse error as cause | The typed error replaces the previous grab-bag of behaviours: a raw `SyntaxError`/`JSONDecodeError`, or — worse — silently forwarding a malformed string downstream. ## Why this supersedes the open PRs This consolidates and extends three open PRs that each addressed a slice of the problem inconsistently. Their authors are credited as co-authors on the relevant commits: - **#3489** (LlamaIndex + Claude Agent SDK, TS) — @srijanarya - **#3438** (Anthropic, Google, LangChain, TS) — @aptsalt - **#3437** (Google ADK empty schemas + name fix, Python) — @pragnyanramtha — its empty-`input_parameters` / missing-description handling and the `gemini` → `google_adk` provider-name fix are folded in here. Compared to the three combined, this PR additionally: covers **every** provider in **both** SDKs (not a subset of one), defines a single source of truth instead of per-provider snippets, normalizes empty/`null` payloads to `{}`, and raises an actionable typed error instead of leaking `SyntaxError` or forwarding a bad string. ## Tests - Exhaustive unit tests for both helpers (object passthrough, JSON-string parse, empty/null → `{}`, malformed/non-object → typed error). - Per-provider regression tests across the touched TypeScript providers (string path, malformed-string path, empty-payload path). - Full `@composio/core` + touched-provider TS suites pass; `typecheck` and `lint` clean. Python `ruff` clean and new test green. ## Changeset Patch bump for all affected TypeScript packages (`@composio/core` + the providers). Python follows its own versioning, so no changeset there. --------- Co-authored-by: srijanarya <74669415+srijanarya@users.noreply.github.com> Co-authored-by: Deepak Singh Kandari <deepaksinghkandari07@gmail.com> Co-authored-by: Pragnyan Ramtha <pragnyanramtha@gmail.com> |
||
|
Alberto Schiabel
|
2758287c87 |
feat(py): remove legacy custom tools (#3508)
This PR is **part 1 of 3** splitting https://github.com/ComposioHQ/composio/pull/3505 to make the removal of the old 2025 custom tools easier to review. It carries the **Python** slice. - removes the legacy `composio.tools.custom_tool` registry path: `core.models.custom_tools`, `ExecuteRequestFn`, the old fallback execution wiring, the security tests, and the example - preserves the 2026 tool-router APIs: `composio.experimental.tool()`, `composio.experimental.Toolkit`, inline custom-tool execution, preload/attach/use flows, and `session.custom_tools()` - bumps the Python workspace and all provider packages `0.13.1` → `0.14.0` ## Notes - This slice is a byte-identical subset of #3505 — the three split branches recombine to that PR's exact tree. See #3505 for the original local verification logs (`uv run --frozen nox -s chk`, targeted pytest); CI re-runs per PR. |
||
|
Alberto Schiabel
|
4367513f82 |
fix(python): guard enhance_schema_descriptions against empty schemas (#3398)
Stacked on #3397 · refs https://github.com/ComposioHQ/composio/issues/3354 ## Summary The TS fix in #3397 handled the reported case (`output_parameters: {}` from MCP toolkits) by normalizing empty schemas at `transformToolCases`. While verifying the Python SDK didn't have the equivalent Zod check, I found an **adjacent** crash on the input side. The Python SDK does not have the same Pydantic check** — `composio_client` types `input_parameters` / `output_parameters` as `Dict[str, Optional[object]]`, which accepts `{}` trivially. However, `Tools._get()` pipes every fetched tool's `input_parameters` unconditionally through `FileHelper.enhance_schema_descriptions` (`python/composio/core/models/tools.py:361-363`), which does: ```python for _param, _schema in schema["properties"].items(): ``` That crashes with `KeyError: 'properties'` on `schema={}`. Not reachable for the specific `granola_mcp` tools in the original report (they all have populated `input_parameters`), but it's the same API contract — any MCP tool with no required inputs would hit this through the public `Composio.tools.get(...)` call. The sibling `FileHelper.process_file_uploadable_schema` (`_files.py:760`) already guards this with `if "properties" not in schema: return schema`. This applies the same guard to `enhance_schema_descriptions`. ## Fix ```diff def enhance_schema_descriptions(self, schema: t.Dict) -> t.Dict: ... + if "properties" not in schema: + return schema required = schema.get("required") or [] for _param, _schema in schema["properties"].items(): ``` ## Testing Red → green confirmed locally. New `TestEnhanceSchemaDescriptionsEmptySchema` class in `tests/test_files.py` covers: 1. `schema={}` → returns `{}` (the bug repro). 2. Schema with metadata but no `properties` key → returned unchanged (mirrors the sibling method). 3. Schema with `properties: {}` (empty dict) → already works today; pinning behavior. 4. Populated schema → still enhanced (regression guard for the type-hint / required-marker enhancement). Cases 1–2 **fail on `next`** with `KeyError: 'properties'`. All 4 pass with the guard. Full `tests/test_files.py` stays green (116 tests). ```bash cd python .venv/bin/python -m pytest tests/test_files.py::TestEnhanceSchemaDescriptionsEmptySchema -v # → 4 passed .venv/bin/python -m pytest tests/test_files.py -q # → 116 passed ``` ## Stacked PR notes - Base: `jkomyno/fix-mcp-empty-output-parameters` (#3397). - This PR's diff against that base shows **only** the Python changes (`_files.py` + `tests/test_files.py`). - After #3397 merges, this should be retargeted to `next` (or rebased automatically by GitHub). --------- Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
Shrey Singla
|
fccec8b143 |
fix(python-sdk): handle file upload list unions (#3373)
## Summary
This updates the Python SDK's automatic file upload/download
substitution so it can handle tool schemas that accept either a single
file or a list of files.
Tools can expose file inputs as a union such as:
```json
{
"anyOf": [
{ "type": "object", "file_uploadable": true },
{ "type": "array", "items": { "type": "object", "file_uploadable": true } }
]
}
```
When auto-upload is enabled, the SDK presents those file-uploadable
objects to models as file path strings. If the model supplies a list of
local paths, the old resolver selected the first file-bearing union
branch, usually the single-file branch, and attempted to upload the
entire Python list as one path. That fails before the backend ever
receives the intended list of staged file descriptors.
## Changes
- Refactors upload substitution into a value/schema recursive walker via
`_substitute_file_upload_value`.
- Adds the same value/schema traversal shape for downloads via
`_substitute_file_download_value`.
- Selects composed-schema variants by runtime shape when possible, so
list values choose array branches and string/dict values keep the
single-value behavior.
- Preserves the existing fallback behavior: if no runtime shape matches,
use the first file-bearing variant.
- Treats `anyOf`, `oneOf`, and `allOf` consistently with the SDK's
existing composed-schema convention.
- Preserves root request/response dict mutation behavior for existing
call sites.
- Adds regression coverage for single-file vs multi-file unions, nested
array-item unions, download parity, and first-match fallback.
## Why
This is needed for file-capable tool schemas that are backward
compatible at the API level by accepting both a single file and multiple
files. The Python SDK should transform a list of local paths into a list
of staged `{name, mimetype, s3key}` descriptors, just as it already does
for direct array schemas.
## Verification
- `python -m ruff check python/tests/test_files.py
python/composio/core/models/_files.py`
- `python -m pytest python/tests/test_files.py -q` -> 119 passed
- `python -m pytest python/tests/test_files.py
python/tests/test_auto_upload_download_files.py
python/tests/test_upload_dir_allowlist.py
python/tests/test_tool_router_session_files.py -q` -> 166 passed
- Manual playground verification with a Gmail send using two local
attachments: both files were staged and sent successfully as an
attachment array.
Note: a full local `python/tests` run still has three unrelated failures
because `composio_langchain` is not installed in this environment; the
affected file-upload suites pass.
---------
Co-authored-by: Zen <zen@composio.dev>
|
||
|
venkat82
|
ed3bb936d2 |
fix(connected-accounts-py): address review feedback on #3412
Six code-review nits from the multi-agent review on PR #3412: P1.1 — python/setup.py was still pinning composio-client==1.36.0 while pyproject.toml is on 1.39.0. The Experimental TypedDict that the new link() docstring imports only exists in 1.39+, so anyone installing via the legacy setup.py path would crash at import. Bumped to 1.39.0. P1.2 — exceptions.py ComposioSharedAccessDeniedError and ComposioSharedConnectionNotAccessibleError docstrings told users to call composio.connected_accounts.update_acl(), which no longer exists. Rewrote both to composio.experimental.update_acl(). P2.5 — ExperimentalAPI.update_acl returned t.Any; restored the typed ConnectedAccountPatchResponse return so callers reading .id / .status / .success keep type-safety at the API boundary. P2.6 — ExperimentalAPI.__init__(client: Optional[Any]) tightened to Optional[HttpClient]. The None branch stays for the one test that exercises it; production code in sdk.py always passes a real client. P2.7 — Dropped redundant alias=omit / connection=omit on the patch() call. Verified against the composio-client==1.39.0 wheel: both default to omit. Sibling ConnectedAccounts.update() already follows the cleaner pattern. Test assertions updated to match. P2.10 — Extracted the substring "acl_config_for_shared is only valid on SHARED" into ACL_ONLY_FOR_SHARED_ERROR_FRAGMENT in experimental.py, and reused it from connected_accounts.py + tool_router_session.py. Single source of truth so a server-side message tweak doesn't silently downgrade three call sites to generic BadRequestError. Tests: 201/201 pass. mypy on composio/ clean. Pushed back on the remaining P2 (TS divergence) in the review — the companion TS PR #3424 ships the exact same restructure, so parity is preserved once both land together. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |