skills/composiohq__composio
1
0
Fork 0
mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,428 Commits 338 Branches 1,550 Tags
@composio/claude-agent-sdk@0.10.1
Commit Graph

285 Commits

Author SHA1 Message Date
Kshitij Jhunjhunwala d583e7ef6f fix(cli): harden plugin setup installation 2026-07-13 15:19:38 -07:00
dependabot[bot] 09aab1d19f chore(deps-dev): bump the npm-development group across 1 directory with 3 updates (#3795) 
Bumps the npm-development group with 3 updates in the / directory:
[turbo](https://github.com/vercel/turborepo),
[typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)
and [typedoc](https://github.com/TypeStrong/TypeDoc).

Updates `turbo` from 2.10.2 to 2.10.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.10.4</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>release(turborepo): 2.10.3 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13222">vercel/turborepo#13222</a></li>
<li>ci: Retry Windows nextest aborts from transient 0xc0000142 spawn
failures by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13240">vercel/turborepo#13240</a></li>
<li>perf: Use mimalloc as the global allocator by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13237">vercel/turborepo#13237</a></li>
<li>perf: Parse yarn v1 lockfiles in a single pass by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13241">vercel/turborepo#13241</a></li>
<li>ci: Fix cache outputs for Eve app by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13243">vercel/turborepo#13243</a></li>
<li>perf: Stop materializing spans for the disabled daemon log layer by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13244">vercel/turborepo#13244</a></li>
<li>fix: Keep ancestor-scoped bun dependencies resolvable after prune
renames by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13236">vercel/turborepo#13236</a></li>
<li>perf: Overlap external dependency hashing with package file hashing
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13234">vercel/turborepo#13234</a></li>
<li>perf: Build tracked repo index concurrently with package graph by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13232">vercel/turborepo#13232</a></li>
<li>perf: Release tokio runtime at exit so background DNS lookups never
stall the user by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13231">vercel/turborepo#13231</a></li>
<li>perf: Overhaul pnpm lockfile parsing and dependency closure
computation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13228">vercel/turborepo#13228</a></li>
<li>feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13227">vercel/turborepo#13227</a></li>
<li>feat: Introduce toolchain provider abstraction by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13235">vercel/turborepo#13235</a></li>
<li>perf: Parse Berry lockfiles in a single pass by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13242">vercel/turborepo#13242</a></li>
<li>fix: Apply input exclusion globs to the filesystem walk by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13224">vercel/turborepo#13224</a></li>
<li>fix: Stop root-directory packages from claiming every file in change
mapping by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13225">vercel/turborepo#13225</a></li>
<li>chore: Rename turborepo-repository napi package to
<code>@​turbo/repository</code> by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13226">vercel/turborepo#13226</a></li>
<li>perf: Hash git blobs with hardware-accelerated SHA-1 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13245">vercel/turborepo#13245</a></li>
<li>release(turborepo): 2.10.4-canary.1 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13247">vercel/turborepo#13247</a></li>
<li>feat: Discover Cargo crates as packages by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13248">vercel/turborepo#13248</a></li>
<li>perf: Reuse per-package external dependency hashes in run summaries
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13249">vercel/turborepo#13249</a></li>
<li>perf: Stat workspace turbo.json files concurrently during discovery
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13251">vercel/turborepo#13251</a></li>
<li>chore: Add tracing spans to workspace discovery and globwalk phases
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13252">vercel/turborepo#13252</a></li>
<li>fix: Avoid non-reentrant libc calls in concurrent shutdown process
scans by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13256">vercel/turborepo#13256</a></li>
<li>perf: Memoize resolved task definitions during engine construction
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13257">vercel/turborepo#13257</a></li>
<li>perf: Compute transitive closures and external dependency hashes
concurrently with run setup by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13250">vercel/turborepo#13250</a></li>
<li>perf: Probe microfrontends configs in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13262">vercel/turborepo#13262</a></li>
<li>feat: Execute Cargo crate tasks via cargo by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13261">vercel/turborepo#13261</a></li>
<li>perf: Pre-size engine task collections by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13265">vercel/turborepo#13265</a></li>
<li>feat: Expose resolved experimentalCI task configuration in
<code>turbo query</code> by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13264">vercel/turborepo#13264</a></li>
<li>feat: Derive input and output globs for Cargo tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13263">vercel/turborepo#13263</a></li>
<li>perf: Parse large pnpm lockfile sections in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13266">vercel/turborepo#13266</a></li>
<li>feat: Hash Cargo external dependencies per-crate by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13267">vercel/turborepo#13267</a></li>
<li>ci: Install pnpm 10 in musl containers for Library Release by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13269">vercel/turborepo#13269</a></li>
<li>ci: Force pnpm overwrite in Library Release musl containers by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13270">vercel/turborepo#13270</a></li>
<li>perf: Defer the untracked-scan barrier to first file-hash use by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13268">vercel/turborepo#13268</a></li>
<li>ci: Fetch API-created commit before updating local ref by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13271">vercel/turborepo#13271</a></li>
<li>release(library): 0.0.1-canary.22 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13272">vercel/turborepo#13272</a></li>
<li>perf: Remove lock and dispatch overhead from task hash
precomputation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13273">vercel/turborepo#13273</a></li>
<li>fix: Fall back to lockfile detection in
<code>@​turbo/repository</code> when package manager is undeclared by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13275">vercel/turborepo#13275</a></li>
<li>test: Add end-to-end coverage for Cargo workspaces by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13274">vercel/turborepo#13274</a></li>
<li>release(library): 0.0.1-canary.23 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13276">vercel/turborepo#13276</a></li>
<li>release(turborepo): 2.10.4-canary.2 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13278">vercel/turborepo#13278</a></li>
<li>fix: Collapse nested package-manager fallback conditional by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13279">vercel/turborepo#13279</a></li>
<li>feat: Make turbo watch Cargo-aware by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13280">vercel/turborepo#13280</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/1506a114e377dd7e1e8e7a7863c42adf94a9f776"><code>1506a11</code></a>
publish 2.10.4 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/11a68c705274cc7a408776b576ce7a9e14d6e6df"><code>11a68c7</code></a>
fix: Stop flagging relative imports that resolve into node_modules in
boundar...</li>
<li><a
href="https://github.com/vercel/turborepo/commit/947b4784cd1b254e62b663bbdb22891a849b7442"><code>947b478</code></a>
fix: Raise the open-file soft limit at startup (<a
href="https://redirect.github.com/vercel/turborepo/issues/13282">#13282</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/ddc584d788349fc3668e280286f540feee4eb6b9"><code>ddc584d</code></a>
feat: Make turbo prune Cargo-aware (<a
href="https://redirect.github.com/vercel/turborepo/issues/13281">#13281</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/ff0d50822314c5b388d9b4daa9c6159387752d95"><code>ff0d508</code></a>
perf: Skip dependency-closure assembly for toolchains that derive
nothing (<a
href="https://redirect.github.com/vercel/turborepo/issues/1">#1</a>...</li>
<li><a
href="https://github.com/vercel/turborepo/commit/39d623e1323ef50e06be0a103082ae29cc545779"><code>39d623e</code></a>
feat: Make turbo watch Cargo-aware (<a
href="https://redirect.github.com/vercel/turborepo/issues/13280">#13280</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/af01fdfeb5efe07a7b6843a0b8f5033b59ebbb2c"><code>af01fdf</code></a>
fix: Collapse nested package-manager fallback conditional (<a
href="https://redirect.github.com/vercel/turborepo/issues/13279">#13279</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/7e02f94f647cb4d527a438313dc4adbe3e8c0df3"><code>7e02f94</code></a>
release(turborepo): 2.10.4-canary.2 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13278">#13278</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/8e3a59fdb6c71ad24fbbb363db52f88eb9a89116"><code>8e3a59f</code></a>
release(library): 0.0.1-canary.23 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13276">#13276</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/ce18f0a79eb49e9a22c7e6cfa491777c24ed746a"><code>ce18f0a</code></a>
test: Add end-to-end coverage for Cargo workspaces (<a
href="https://redirect.github.com/vercel/turborepo/issues/13274">#13274</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.2...v2.10.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `typescript-eslint` from 8.62.1 to 8.63.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's
releases</a>.</em></p>
<blockquote>
<h2>v8.63.0</h2>
<h2>8.63.0 (2026-07-06)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-misused-promises] detect async
usage of a sync dispose usage (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12426">#12426</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [method-signature-style] suggest
converting readonly function properties instead of emitting invalid
syntax (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12447">#12447</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12446">#12446</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
handle optional-chained calls to overloaded functions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12491">#12491</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12485">#12485</a>)</li>
<li><strong>eslint-plugin:</strong> [no-base-to-string] don't flag a
shadowed String() call (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12492">#12492</a>)</li>
<li><strong>scope-manager:</strong> export ClassStaticBlockScope (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12460">#12460</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Kristjan <a
href="https://github.com/KristjanTammekivi"><code>@​KristjanTammekivi</code></a></li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov"><code>@​mnaoumov</code></a></li>
<li>Serhii Leniv <a
href="https://github.com/Serhii-Leniv"><code>@​Serhii-Leniv</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's
changelog</a>.</em></p>
<blockquote>
<h2>8.63.0 (2026-07-06)</h2>
<p>This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374"><code>290cf6c</code></a>
chore(release): publish 8.63.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `typedoc` from 0.28.19 to 0.28.20
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/TypeStrong/TypeDoc/releases">typedoc's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.20</h2>
<h3>Features</h3>
<ul>
<li>Group/category section headings (<code>&lt;h2&gt;</code>) in the
default theme now include an <code>id</code> attribute so they can be
linked to via fragment identifiers (e.g.
<code>modules.html#classes</code>), <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li>
<li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert
variable/type references as a re-export instead of a new symbol, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li>
<li>API: Introduced <code>generateOutputsBegin</code> and
<code>generateOutputsEnd</code> events on <code>Application</code> for
plugin use.</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>When <code>--emit none</code> is used, TypeDoc will now report
warnings about missing relative paths previously reported when
rendering, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li>
<li>Improved performance via asynchronously performing git and file
write operations, more performant JSX rendering, and source code
bundling, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li>
<li>A <code>@hidden</code> tag on a constructor parameter-property will
now only hide the property, not both the property and the parameter, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li>
<li>Custom <code>@group</code> and <code>@category</code> titles with
the same sort weight are now ordered consistently with the
<code>alphabetical</code> reflection sort, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li>
</ul>
<h3>Thanks!</h3>
<ul>
<li><a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a></li>
<li><a
href="https://github.com/jonathanhefner"><code>@​jonathanhefner</code></a></li>
<li><a
href="https://github.com/kcastellino"><code>@​kcastellino</code></a></li>
<li><a href="https://github.com/Metbcy"><code>@​Metbcy</code></a></li>
<li><a
href="https://github.com/StoneCypher"><code>@​StoneCypher</code></a></li>
<li><a
href="https://github.com/wotan-allfather"><code>@​wotan-allfather</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md">typedoc's
changelog</a>.</em></p>
<blockquote>
<h2>v0.28.20 (2026-07-05)</h2>
<h3>Features</h3>
<ul>
<li>Group/category section headings (<code>&lt;h2&gt;</code>) in the
default theme now include an <code>id</code> attribute so they can be
linked to via fragment identifiers (e.g.
<code>modules.html#classes</code>), <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li>
<li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert
variable/type references as a re-export instead of a new symbol, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li>
<li>API: Introduced <code>generateOutputsBegin</code> and
<code>generateOutputsEnd</code> events on <code>Application</code> for
plugin use.</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>When <code>--emit none</code> is used, TypeDoc will now report
warnings about missing relative paths previously reported when
rendering, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li>
<li>Improved performance via asynchronously performing git and file
write operations, more performant JSX rendering, and source code
bundling, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li>
<li>A <code>@hidden</code> tag on a constructor parameter-property will
now only hide the property, not both the property and the parameter, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li>
<li>Custom <code>@group</code> and <code>@category</code> titles with
the same sort weight are now ordered consistently with the
<code>alphabetical</code> reflection sort, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li>
</ul>
<h3>Thanks!</h3>
<ul>
<li><a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a></li>
<li><a
href="https://github.com/jonathanhefner"><code>@​jonathanhefner</code></a></li>
<li><a
href="https://github.com/kcastellino"><code>@​kcastellino</code></a></li>
<li><a href="https://github.com/Metbcy"><code>@​Metbcy</code></a></li>
<li><a
href="https://github.com/StoneCypher"><code>@​StoneCypher</code></a></li>
<li><a
href="https://github.com/wotan-allfather"><code>@​wotan-allfather</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/34d843be0953fc81de0fde14bea8db72d0bbccc6"><code>34d843b</code></a>
Update changelog for release</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/fbd4a254952c171b9ba7ebbe96c5151e844743be"><code>fbd4a25</code></a>
Bump version to 0.28.20</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/93ba157000e4a632bfbf32a0b6f00f8ae57c7c99"><code>93ba157</code></a>
Update dependencies in example</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/e8c5df8844edca9800dfc62cee9115ef0fba59ea"><code>e8c5df8</code></a>
Remove unnecessary files from distribution</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/392b0dd50a428ea0c732c38c6c263e74cb6200b1"><code>392b0dd</code></a>
Update dependencies</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/8510dd48c7778f419f4605146f1a733af27993fa"><code>8510dd4</code></a>
Add missing entries in changelog before release</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/51dc0521890924269f06e08972c6453299f63cb5"><code>51dc052</code></a>
Update change log for 0.28.20 release</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/72f20cd87b4ef30aae97b68fcbb42ca19cebdc22"><code>72f20cd</code></a>
Merge branch 'fix-locale-sort-group-category-titles' into dev</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/623f2c0bd35b5e89cc79fb5783dac01c6f2530e9"><code>623f2c0</code></a>
Fix failing test, accept slightly slower build for now</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/c8bdf14cab0c22dd415b6872cc647c6cf81f917c"><code>c8bdf14</code></a>
Minor config tweak to improve dev build time</li>
<li>Additional commits viewable in <a
href="https://github.com/TypeStrong/TypeDoc/compare/v0.28.19...v0.28.20">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-13 13:54:29 +04:00
dependabot[bot] 4baacbeb77 chore(deps): bump the npm-production group across 1 directory with 7 updates (#3799) 
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
 2026-07-10 19:06:45 +04:00
Alberto Schiabel b07fcada3f feat(experimental): add Eve provider and iMessage example (#3800) 
This PR:

- supersedes https://github.com/ComposioHQ/composio/pull/3642 and
credits @shamsharoon for the original Eve provider and iMessage work
- rebases the integration onto the current `next` branch and resolves
its lockfile conflicts
- publishes an isolated `@composio/experimental/eve` entry with the
correct Eve 0.12+ peer contract
- adds recoverable per-session discovery, native Eve context
propagation, and durable approval policies for direct and batched side
effects
- centralizes circular-safe auth-link extraction across Eve and Pi and
replaces dense conditional expressions with named control flow
- hardens the iMessage example against `osascript` option injection,
unsafe trigger scoping, and third-party prompt injection
- preserves completed local-tool results when a mixed local/remote batch
loses its remote transport
- consolidates the example documentation onto shared components,
documents direct model-provider credentials, and clarifies that the
browsable source is not yet a standalone fixture
- verifies the change with 999 core tests, 32 experimental tests,
package builds/typechecks, packed peer-isolation smokes, and a
production docs build

---------

Co-authored-by: shams haroon <144290365+shamsharoon@users.noreply.github.com>
Co-authored-by: shams haroon <shamsharoon7@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: shams haroon <shams@composio.dev>
 2026-07-10 16:57:11 +04:00
Alberto Schiabel 30ba4d2930 feat(openai): add executable provider example (#3798) 
This PR:

- builds on top of https://github.com/ComposioHQ/composio/pull/3790
- makes the OpenAI example executable in direct-tools, Tool Router,
smoke, and Cloudflare Workers modes
- keeps direct and Tool Router agents in separate files so each
execution model is explicit and readable
- requires a successful Composio tool execution before either agent can
accept a final model response
- adds OpenAI to the nightly staging matrix without weakening the
existing Mastra coverage
- updates two stale experimental OpenAI usages so the complete example
package typechecks against current SDK APIs

## Testing

- `pnpm --filter openai-example run typecheck`
- `pnpm --filter openai-example run lint` (0 errors; 4 pre-existing
warnings)
- `pnpm --filter openai-example run smoke` (staging: 5 direct tools and
6 Tool Router tools)
- `pnpm --filter openai-example run cf:dry-run`
- `pnpm run typecheck`
- `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx`
- `pnpm run typecheck:examples`
- `pnpm run lint:examples`
- `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'`
- [branch
nightly](https://github.com/ComposioHQ/composio/actions/runs/29079263571):
OpenAI and Mastra both passed smoke, direct-tools, and Tool Router
against staging

## Post-deploy validation

- dispatch `ts.examples-nightly.yml` on `next` after merge and confirm
both matrix legs stay green
- healthy runs finish within the 20-minute job budget and log successful
tool-backed responses for both agent modes
- revert this PR if the OpenAI leg blocks the nightly; examples
maintainers own the first post-merge run and the next 06:00 UTC schedule

---

[![Compound
Engineering](https://img.shields.io/badge/Built_with-Compound_Engineering-6366f1)](https://github.com/EveryInc/compound-engineering-plugin)
![Codex](https://img.shields.io/badge/GPT--5-000000)
 2026-07-10 13:41:59 +04:00
Alberto Schiabel 76881491d0 feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788) 
## What

Turns the **Mastra** example into an executable reference that doubles
as a test, and wires the examples into CI for the first time. First
slice of the v1 "executable examples" workstream — the pattern here is
the template for the other TS providers, then Python.

## Why

Examples under `ts/examples/*` were unverified: the only CI tie-in is
`validate-examples.ts`, which is transpile-only (no cross-file types, no
lint, no execution) and passes on exactly the schema-conversion
regressions we keep hitting in the Mastra provider — all closed but
unprotected:

- https://github.com/ComposioHQ/composio/issues/2109 (zod→json
serialization crash)
- https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped
while `$ref` kept)
- https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema
tools crash serialization)

## Changes

**Canonical Mastra example** (`ts/examples/mastra`)
- `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS`
toolkit
- `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` →
`session.tools()` (drops the deprecated bare `composio.create` alias)
- `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers
runtime (`export default { fetch }`)
- `src/smoke.ts` — deterministic wrapping + tool-router assertions
(needs only `COMPOSIO_API_KEY`)
- Removed the old Gmail/MCP entries that used deprecated APIs and
required auth
- Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts`

**Real typecheck + lint** (examples previously escaped both)
- Example now has a `typecheck` script (Node + Worker tsconfigs);
`typecheck:examples` / `lint:examples` scripts added
- eslint now covers `ts/examples/**` with type-safety rules kept
(`no-explicit-any`) and console noise allowed

**Two-tier CI**
- `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck
→ lint → `wrangler deploy --dry-run`. This is the tier that catches the
schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces
as a **type** error.
- `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes
against the **staging** backend with secrets; runs the deterministic
smoke always and the full agent examples when an LLM key is set.

## Verification

Locally against staging: `smoke` passes (5 direct + 6 tool-router
tools), `typecheck:examples` and `lint:examples` are green, the Worker
`wrangler deploy --dry-run` bundles, and seeded regressions (a type
error / an `any`) correctly fail their gate.

## Notes

- No changeset — example packages are private/unpublished.
- Follow-ups (separate PRs): template the pattern to the other TS
providers, then port to `python/examples/*`.
 2026-07-10 01:40:03 +04:00
Alberto Schiabel 72eac88133 fix(cli): replace abandoned decompress dependency (GHSA-mp2f-45pm-3cg9) (#3767) 
This PR:
- replaces `decompress` (unmaintained; the zip-slip fix in the GHSA
advisory was never published to npm past 4.2.1) with `extract-zip`
across the CLI's four zip-extraction call sites: `install-skill.ts`,
`run-companion-modules.ts`, `upgrade-binary.ts`, and
`cli-local-tools/bundled-binaries.ts`
- `extract-zip` validates each entry resolves inside the target
directory before writing, closing the path-traversal issue `pnpm audit`
flags as critical
- replaces the one `.tgz`-extracting call site
(`scripts/_acp-adapters.ts`, used to vendor ACP adapter binaries at
build time) with `tar`, since `extract-zip` only handles zip archives
- removes `@types/decompress`; both `extract-zip` and `tar` ship their
own type definitions
- `pnpm audit --prod --audit-level=high` now passes (previously failing
on `next`, unrelated to #3766)

Verified `extract-zip` and `tar` extract nested directories correctly
with a local smoke test (real `.zip`/`.tgz` archives), in addition to
the existing `@composio/cli` (724 tests) and `@composio/cli-local-tools`
(13 tests) suites passing.
 2026-07-07 18:58:17 +04:00
Alberto Schiabel 58bc93b2d9 chore(deps): consolidate dependency updates (#3760) 
This PR:
- consolidates https://github.com/ComposioHQ/composio/pull/3733,
https://github.com/ComposioHQ/composio/pull/3735 through
https://github.com/ComposioHQ/composio/pull/3744, and
https://github.com/ComposioHQ/composio/pull/3752
- refreshes the pnpm workspace dependencies under the existing
`minimumReleaseAge` supply-chain gate
- keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare
workers types 4 where latest majors conflict with the current workspace
- keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the
workspace catalog to zod 4
- bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock`
- updates the SHA-pinned Claude and Codex workflow actions from the
Dependabot action group
- adds a patch changeset for the versioned package manifests touched by
dependency updates
- verifies the rollup with frozen pnpm/uv locks, peer checks, audit
threshold checks, typecheck, lint, builds, TypeScript tests, and Python
`nox -s chk`

## Context

`pnpm audit --prod --audit-level=moderate` passes. The remaining
production audit item is a low `@ai-sdk/provider-utils` advisory through
Mastra transitive dependencies; forcing it higher would require leaving
the compatible stable Mastra dependency path.
 2026-07-06 14:33:55 +04:00
Alberto Schiabel 49e4c11427 chore(deps): resolve high prod audit advisories via in-range bumps (#3751) 
This PR:

- refreshes lockfile resolutions for the 17 high `pnpm audit --prod`
advisories via `pnpm update -r` — real version bumps within the ranges
parents already declare (minimatch 5/9, lodash, fast-uri, picomatch,
langsmith, `@hono/node-server`, express-rate-limit, ws), not resolution
overrides
- bumps the pre-existing #3467 security pin `protobufjs: 7.5.9 -> 7.6.1`
in `pnpm-workspace.yaml` (7.5.9 itself is vulnerable to GHSA
unbounded-Any DoS)
- adds ONE temporary scoped override, `minimatch@>=10.0.0 <10.2.3 ->
>=10.2.3`: `@zed-industries/claude-code-acp@0.16.2` (latest) exact-pins
vulnerable `minimatch 10.2.1` and no fixed release exists; commented in
the file, drop when upstream ships
- no `package.json` changes anywhere: none of the vulnerable packages is
a direct dependency of any workspace package, so there is nothing to
major-bump on our side

## Context

Split out of #3748 (CI hardening) so dependency changes land in
isolation. **Merge this before #3748** — its new `pnpm audit --prod
--audit-level=high` hard gate needs this green baseline, per the plan's
"gate lands together with the dependency fix" rule.

Verified: `pnpm audit --prod --audit-level=high` exits 0 (remaining: 1
low, 6 moderate); `pnpm install --frozen-lockfile` passes. Dev-path high
advisories (vite, undici, flatted, linkify-it, minimatch 3.x) are out of
scope — the gate is `--prod`; tracked as backlog.
 2026-07-04 10:24:01 +04:00
Alberto Schiabel 8d5823be87 chore(ci): cache turbo, bun, and uv and cancel superseded pr runs (#3747) 
This PR:

- adds `concurrency` to the ten PR/push CI workflows: superseded **PR**
runs are cancelled, while push runs use a per-run group
(`github.run_id`) so every commit on `next`/`master` still gets its own
run
- caches turbo outputs (`.turbo/cache`) via a new opt-in
`enable-turbo-cache` input on the `setup-node-pnpm-bun` composite (keyed
per job — concurrent jobs save different task graphs), enabled in
`ts.build`, `ts.test`, `ts.typecheck`, and all four `ts.test-e2e` jobs
- enables turbo caching for `typecheck`, removes the incorrect `dist/`
outputs from `test`, hashes root `tsconfig.base.json` in
`build`/`typecheck` inputs, and adds `mise.toml`/`mise.lock` to
`globalDependencies` so toolchain bumps bust every task hash (addresses
the Bugbot finding)
- fixes `@composio/slim`'s build to participate in the turbo graph: core
moves to slim's `devDependencies` (published `dependencies` unchanged)
and the script no longer shells out to `pnpm --filter @composio/core
build`, which raced concurrent dependents by wiping `core/dist`
mid-build and double-built core on every cold run — slim's `dist`
remains byte-identical to core's; no changeset added since the published
artifact is unchanged (say the word if policy wants one anyway)
- fixes the `py.test` matrix cache to `~/.cache/uv` (it cached
`~/.cache/pip` while installing via `uv pip`) and caches
`~/.bun/install/cache` in the five docs workflows
- adds `turbo.jsonc` to the TS workflows' path filters (previously
unwatched)
- release/publish workflows are deliberately untouched

Measured (same commit, cold first attempt vs `gh run rerun` warm):
ts.build 103s → 53s, ts.test 157s → 55s (`turbo test` 24/24 cached in
182ms), ts.typecheck 80s → 43s; py.test legs save a few seconds each (uv
was already fast). Warm floor is checkout + mise + pnpm-install
overhead.

## Context

Implements `plans/001-ci-speed-caching-and-concurrency.md` from the
advisor audit on `docs/sdk-v1-decision-records`. Implementation by codex
against the plan, then self-reviewed and counter-reviewed; warm-rerun
testing surfaced and fixed three latent issues (toolchain files absent
from turbo's hash, first-writer-wins cache-key collision across jobs,
and the slim out-of-band core rebuild race).
 2026-07-03 22:22:18 +04:00
Alberto Schiabel 03cb181fdb chore(deps): roll up dependency bumps (#3711) 
This PR:
- rolls up https://github.com/ComposioHQ/composio/pull/3695,
https://github.com/ComposioHQ/composio/pull/3696,
https://github.com/ComposioHQ/composio/pull/3697, and
https://github.com/ComposioHQ/composio/pull/3698 into one
dependency-bump branch
- updates Python dependency metadata for `langchain-openai`,
`pyautogen`, and `crewai`
- updates npm production dependency metadata for `zod-to-json-schema`,
`openai`, and `@modelcontextprotocol/sdk`
- refreshes `uv.lock` and `pnpm-lock.yaml` with the repo-pinned package
managers
- leaves Changesets unchanged because the touched TS package manifests
are private/ignored and no published TS SDK package metadata changes
- verified with `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm
typecheck`, focused TS builds/tests, clean-worktree `pnpm
test:examples`, Python import tests, and Python nox checks
- note: local `pnpm build:packages` hit a pre-existing broad-build race
around `@composio/slim` rebuilding `@composio/core`; focused dependent
builds pass

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-29 19:20:15 +04:00
Alberto Schiabel cddd66c3ce chore(ts): bump Hono, Mastra, and Chrome deps (#3691) 
This PR:
- bumps `hono`, `@mastra/core`, and `chrome-devtools-mcp` to their
current latest published versions
- routes the remaining Cloudflare Tool Router Hono consumer through the
workspace catalog
- updates the `@composio/mastra` `@mastra/core` peer range and adds a
patch changeset
- fixes `check-peer-deps` to resolve `semver` through the normal package
dependency
 2026-06-26 20:45:25 +04:00
Alberto Schiabel 9ffc696a99 feat(vercel): support AI SDK v7 (#3683) 
This PR:

- widens the `ai` peer dependency of `@composio/vercel` to `^6.0.0 ||
^7.0.0`, adding AI SDK v7 support and dropping the previously-untested
v5 arm
- adds Docker-based Node e2e compatibility suites for AI SDK v6 and v7
under `ts/e2e-tests/runtimes/node/vercel-ai-sdk-v{6,7}`, auto-discovered
by the existing e2e matrix (so PR CI exercises them)
- each installs the packed `@composio/vercel` tarball, typechecks the
provider against the target `ai` major, and asserts runtime tool
wrapping/execution (object inputs, JSON-string normalization via
`normalizeToolArguments`, `ToolSet` shape)
- the v7 suite additionally exercises v7's `ToolExecutionOptions` passed
to `tool.execute`
- ships a `minor` changeset (the peer-range narrowing removes a
previously-supported major)
- breaking:
- `ai@5` is no longer an accepted peer of `@composio/vercel`; v5
consumers should stay on the prior minor
 2026-06-26 14:08:09 +04:00
Rahul Tarak d17a268d3f docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637) 
Integration branch for the next docs release: a **sessions-first
documentation rewrite** — new and rewritten guides, example pages,
interactive components, and docs tooling — plus the supporting SDK
changes that the new docs describe.

The bulk of this PR is docs (~24k lines across ~150 commits); the SDK
changes (~5k lines) back the new guides.

## Documentation (the bulk)

- **Sessions-first restructure** — reorganized navigation and section
structure (incl. the "Sandbox (prev workbench)" section), with
v3-reorganization redirects so old URLs keep resolving.
- **Rewritten core guides** — quickstart, configuring sessions, triggers
(creating + subscribing to events), proxy-execute, toolkits
enable/disable, and common FAQ, rewritten in the house voice.
- **New example pages** — local-sandbox PR reviewer, daily standup bot,
and slack bot, with runnable build-ups.
- **New interactive components & diagrams** — triggers flow animation,
manage-connections visual, connection-refresh visual, and the
terminal-kit components.
- **Docs tooling** — a docs-graph link-graph connectivity checker,
search reprioritization (deprioritize legacy pages), and SDK-reference
regeneration.

## Supporting SDK changes

**`@composio/core` → 0.13.0 (minor)**
- `composio.sessions.create()` as the first-class sessions API
(`composio.create()` kept as an alias).
- **MCP is opt-in:** default `create()` / `use()` return native-tool
sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface
`session.mcp`. _Migration: read `session.mcp` only after creating with
`{ mcp: true }`._
- `session.sandbox` is the canonical resolved config;
`session.workbench` kept as a deprecated alias. `sandbox` is the
preferred session-config key (`workbench` still accepted).
- `connectedAccounts.updateAcl()` graduated from experimental (alias
kept).
- `triggers.parse()` (parse + optionally verify an incoming webhook) and
`triggers.setWebhookSubscription()`.

**`@composio/experimental` → minor** — local-workbench helpers moved
onto the `@composio/experimental/workbench` subpath (out of
`@composio/core/experimental`), keeping the ~14 KB embedded Python
helper out of core. Plus the experimental Pi provider.

**`@composio/slim` → minor.**

**Python → 0.17.0** — mirrors the TS surface: `composio.sessions` mount
(`tool_router` deprecated), `triggers.parse()` /
`set_webhook_subscription()`, the `sandbox` config key, and
`connected_accounts.update_acl()`.

## Review response (#3664)

Addressed the `@composio/core` review:
- **Security:** `triggers.parse()` no longer fails open — a
present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`)
now throws instead of silently skipping verification; omitting it stays
an explicit opt-out (both SDKs).
- Removed snake_case leakage from `transformWebhookSubscription` (+ the
index signature that allowed it).
- **Removed** the TS-only `connectedAccounts.link()` toolkit
auto-resolve (shipped with cancellability / orphaned-auth-config bugs
and was effectively undocumented; to be reintroduced properly later).
- Unified Python error types on `ValidationError`; added `mcp=True`
Python tests; fixed runtime-portability + error-type test assertions.
- Polished deprecation messages; fixed the backwards `/experimental`
`@deprecated` note and the `SessionWithMcp` JSDoc.

## Testing

- **TS:** `@composio/core` + `@composio/experimental` typecheck pass;
vitest green for the touched suites.
- **Python:** `test_tool_router.py` + `test_triggers.py` pass (161
tests).

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev>
Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Sarah Simionescu <sarah@composio.dev>
Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>
 2026-06-25 18:27:43 -07:00
Alberto Schiabel f8cd90ce5a chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646) 
This PR:

- uses plain `tsdown` package scripts and a shared typed
`tsdown.config.base.ts` so Node 24 builds work without loader flags
- switches the repo dev/build toolchain to Node `24.17.0` and pnpm
`11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml`
- marks the root package as ESM with `type: module`, matching the
TypeScript packages
- keeps Node `22.22.3` in the runtime/E2E matrices as the minimum
supported user runtime
- changes the TypeScript build workflow back to a single build on the
mise-managed toolchain and broadens path filters for
package-manager/build config files
- adds pnpm 11 build-script policy with `allowBuilds` and intentionally
ignored `sharp` builds
- enables tsdown ESM shims for the packaged CLI wrapper so `composio
--help` runs under Node 22 and Node 24

Verified locally:

- `CI=true pnpm install --frozen-lockfile`
- `pnpm lint`
- `pnpm run build:packages`
- `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter
@e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run
test:e2e:node`
- `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3`
and `24.17.0`
 2026-06-24 18:58:11 +04:00
Alberto Schiabel 23f9053804 chore(ts): clean up dependencies and bump toolchain (#3623) 
This PR:

- consolidates and bumps TypeScript/npm dependencies across the
monorepo, docs, examples, and e2e fixtures — no runtime behavior changes
- **cleanup:** remove the unused `ansis` dependency from `@composio/cli`
(`picocolors` is the actual color lib), drop the dead `uuid` catalog
entry, catalog `dotenv` + `@types/bun` and repoint drifting examples/e2e
onto them, and replace `chalk` with `picocolors` in `@composio/core`
(smaller, ESM, already used by the CLI)
- **TypeScript 6:** bump `typescript` `5.9 → 6.0.3` everywhere (catalog,
CLI test fixtures, docs); drop vestigial `declaration`/`outDir` from the
provider `tsconfig.json`s to fix the TS 6 `rootDir` regression
(`TS6059`); add `ignoreDeprecations: "6.0"` in docs for the `baseUrl`
deprecation
- **toolchain:** `tsdown 0.18 → 0.22.3`, `vitest` + `@vitest/ui →
4.1.9`, `publint → 0.3.21`, `wrangler → 4.101.0` (each the latest
version within the 3-day `minimumReleaseAge` gate)
- **Effect + hono:** `effect 3.21.3`, `@effect/cli 0.75.2`,
`@effect/platform 0.96.1`, `platform-bun 0.90.0`, `platform-node-shared
0.60.0`, `language-service 0.86.2`, `@effect/vitest 0.29.0`, `hono
4.12.25`; pin the Effect peer cohort
(`printer`/`printer-ansi`/`typeclass`/`rpc`/`sql`/`cluster`/`experimental`/`workflow`)
as `@composio/cli` devDeps so the auto-installed peers resolve
coherently, and bump `@cloudflare/workers-types` to satisfy `wrangler`'s
peer
- changesets: `@composio/cli` patch (ansis removal) and `@composio/core`
patch (chalk → picocolors)
- verified: `build`, `typecheck` (tsgo + real `tsc` 6.0.3), and local
tests (excluding e2e) all pass
 2026-06-21 00:54:27 +04:00
Alberto Schiabel 24e647fa16 test(ts/e2e): cover claude agent sdk on node current (#3620) 
This PR:
- builds on top of https://github.com/ComposioHQ/composio/pull/3495
- adds a Node.js `current` e2e suite for `@composio/claude-agent-sdk`
- exercises the packaged provider through Claude Agent SDK
`createSdkMcpServer` / `query()` with a deterministic local tool
- forwards `ANTHROPIC_API_KEY` through Turbo, Docker e2e env
passthrough, and the Node e2e workflow
 2026-06-20 02:08:34 +04:00
Alberto Schiabel 025a657597 feat(ts): drop CommonJS support (#3494) 
This PR moves the TypeScript SDK support floor to the latest Node.js 22
release and uses that as the point where we stop carrying custom
CommonJS compatibility machinery. The e2e runtime coverage now exercises
the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested
against the minimum supported version and the newer runtimes users are
likely to adopt next.

Because the SDK packages are still on `0.x`, the accompanying changeset
uses `minor` bumps while calling out that this is a breaking change
inside the existing 0.x line.

It also moves pnpm under mise on this Node 22 layer. That belongs here,
not in #3493, because the pinned `pnpm@10.28.2` requires Node.js
`>=22.13`. Removing Corepack is intentional: Node.js documents that
Corepack is no longer distributed starting with Node.js v25, so relying
on `corepack enable` would keep a toolchain dependency that is already
on the way out of the Node distribution.

## What changed

- Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`,
`mise.lock`, `toolchain-versions.json`, and root `devEngines`.
- Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise
the single source of truth for the pnpm version. Removes the root
`packageManager` / `devEngines.packageManager` Corepack pin entirely
(rather than keeping a second copy of the version that could drift) and
removes stale `packageManager` metadata from real TS packages/examples
and generators.
- Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so
Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a
`packageManager` field. Without this, Turbo fails workspace resolution
(`Could not resolve workspaces -> Missing 'packageManager' field`),
which is the only reason the field would otherwise need to stay.
- Replaces `corepack enable` in the shared setup action with
mise-managed pnpm. The E2E Docker images install bun + pnpm directly
from `mise.toml`/`mise.lock` (with
`dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay
on the base image as the test matrix axis and are disabled via
`MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are
symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build
args are threaded from the host anymore, and bun+pnpm now carry
`mise.lock` checksum verification.
- Extends the install-time toolchain check to validate pnpm against mise
alongside Bun.
- Sets the Node E2E matrix and install fallback checks to `22.22.3`,
`24.16.0`, and `25.9.0`.
- Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts`
only and uses the ATTW `esm-only` profile.
- Removes explicit `require` / `.cjs` / `.d.cts` package export paths
and internal import mappings from the public TS SDK packages.
- Marks public TS SDK packages as `type: module` where they were missing
it.
- Replaces the remaining runtime `require('pusher-js')` with dynamic ESM
import.
- Deletes the legacy CJS example.
- Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop
E2E: it verifies `require('@composio/core')` works through Node's native
ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`,
not a `.cjs` artifact.
- Removes `.cjs` / `.cts` handling from example validation and CLI
project-language detection.
- Updates provider scaffolding so newly generated providers are
ESM-only.
- Adds a minor changeset warning that CommonJS callers can only rely on
Node's native `require(esm)` interop and that custom CommonJS
compatibility machinery is gone.

## Bundled behavior changes

Two changes here are technically independent of the CommonJS removal but
ride along because they touch the same files and ship in the same
release cut. Calling them out explicitly so they are not missed in
review:

- **`PusherUtils` realtime channel auth (`@composio/core`).** Replacing
the runtime `require('pusher-js')` with a dynamic ESM `import()` was
done alongside conforming `channelAuthorization` to pusher-js's typed
`customHandler(params, callback)` contract. The previous `(authOptions)
=> Promise` shape did not match pusher-js's actual calling convention —
it read `endpoint`/`headers`/`params` off an argument that pusher-js
never passes — so this also fixes that latent mismatch. New unit tests
(`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request
shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name`
body) and the success / invalid-JSON / network-failure callback paths.
- **CLI meta-tool slug list (`@composio/cli`).** Drops
`COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from
`META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client`
alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']`
union. The list is declared `satisfies
ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at
compile time (`pnpm typecheck`) — keeping the stale slugs would be a
type error — and needs no separate runtime test.

## Verification

- Verified latest Node 22/24/25 releases from the official Node dist
index: `22.22.3`, `24.16.0`, `25.9.0`
(https://nodejs.org/dist/index.json).
- Verified Node docs state Corepack is no longer distributed starting
with Node.js v25:
https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html
- `mise exec -- pnpm --version` -> `10.28.2`
- `mise exec -- pnpm install --frozen-lockfile`
- `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts`
- `mise exec -- pnpm --filter @e2e-tests/utils typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node`
- `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck`
- `mise exec -- pnpm --filter @composio/cli typecheck`
- `mise exec -- pnpm --filter @composio/cli test -- --runInBand`
- `mise exec -- pnpm --filter @composio/core typecheck`
- `mise exec -- pnpm --filter @composio/core exec vitest run
test/utils/pusher.test.ts`
- `mise exec -- pnpm run build:packages`
- `mise exec -- turbo run build --dry-run` resolves all workspace
packages with no root `packageManager` field (pnpm discovered from
`pnpm-lock.yaml`).
- `mise exec -- pnpm --filter @composio/cli exec vitest run
test/src/services/project-environment-detector.test.ts`
- `mise exec -- pnpm exec prettier --check ...`
- `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg
NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also
`Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build
green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 /
bun 1.3.10 from mise.
- `docker manifest inspect node:24.16.0-slim`
- `docker manifest inspect node:25.9.0-slim`
- `bash -n ts/scripts/create-provider.sh && git diff --check`
- `ruby -e "require 'yaml';
YAML.load_file('.github/workflows/ts.test-e2e.yml')"`
- Tracked example validation in a clean temporary tree: `Validated 21
example packages.`
 2026-06-19 22:22:17 +04:00
Alberto Schiabel a0bef5d986 chore(deps): bump composio client SDKs (TS alpha.74, Py 1.41.0) (#3609) 
This PR:

- bumps the TS catalog `@composio/client` from `0.1.0-alpha.72` to
`0.1.0-alpha.74` (published from ComposioHQ/composio-base-ts#84) and
refreshes `pnpm-lock.yaml`
- bumps the Python `composio-client` pin from `1.39.0` to `1.41.0`
(published from ComposioHQ/composio-base-py#69)
- adds a patch changeset for `@composio/core` and `@composio/cli` so the
client bump actually ships in the next release

## Context

Neither client is auto-bumped in this repo — there is no
Stainless→consumer bot, and Dependabot does not touch the pnpm
`catalog:` pin (TS) or the exact `composio-client==` pin (Py), so these
were a manual catch-up. The Python `1.41.0` PyPI publish initially
failed with a `403 Forbidden` (stale `PYPI_TOKEN`); it was re-run
successfully before this bump, so `1.41.0` is live on PyPI.
 2026-06-19 18:42:59 +04:00
Alberto Schiabel 6606c0da92 fix(ts): upgrade vitest for GHSA-5xrq-8626-4rwp (#3569) 
This PR:

- closes #3502
- extracts the useful dependency and Cloudflare config slice from
https://github.com/ComposioHQ/composio/pull/3503 onto a clean `next`
branch
- upgrades `vitest` and `@vitest/ui` through the workspace catalog to
resolve the critical advisory
- switches the Mastra provider test dependency back to the catalog
- migrates the Cloudflare Worker Vitest configs to the
`cloudflareTest()` plugin API
- preserves existing `COMPOSIO_BASE_URL` bindings that were dropped in
#3503
- keeps Vitest 4 compatibility fixes scoped to constructor mocks, spy
cleanup, and temp-root project detection
- leaves Node, `mise`, release docs, and Effect catalog versions
unchanged; the commit includes @Dotify71 as `Co-authored-by`

Co-authored-by: Dushyant Acharya <dushyantacharya873@gmail.com>
 2026-06-15 19:38:51 +04:00
Alberto Schiabel 44e5458c35 feat(core): remove legacy TypeScript custom tools (#3509) 
This PR is **part 2 of 3** splitting
https://github.com/ComposioHQ/composio/pull/3505 to make the removal of
the old 2025 custom tools easier to review. It carries the
**TypeScript** slice.

- builds on top of https://github.com/ComposioHQ/composio/pull/3508
(stacked — review/merge the Python slice first; this PR's base is
`remove-py-custom-tools`)
- removes the legacy `composio.tools.createCustomTool(...)` in-memory
registry: the plural `CustomTools` model, registry wiring, legacy-only
tests/examples/`ts/docs` pages, and stale error/type exports
- preserves the 2026 tool-router APIs: `experimental_createTool`,
`experimental_createToolkit`, `ToolRouter`, `ToolRouterSession`, and
inline custom-tool execution
- regenerates the TypeScript SDK reference so raw tool listing no longer
describes the removed local registry and points to session-scoped custom
tools
- adds a `@composio/core` minor changeset

## Notes

- The committed SDK reference is **verified self-consistent**: `pnpm
--filter @composio/core generate:docs` reproduces it with zero diff.
- This slice is a byte-identical subset of #3505 — the three split
branches recombine to that PR's exact tree. See #3505 for the original
verification logs (`typecheck`, `test`, `lint`, `cf-workers` e2e); CI
re-runs per PR.
 2026-06-04 23:53:58 -07:00
Zen 57942e87fd fix(security): pin protobufjs to 7.5.5 (Socket.dev critical CVE) (#3467) 
# Description

Adds a `pnpm.overrides` entry pinning `protobufjs` to **7.5.5** to patch
a critical RCE flagged by Socket.dev:

| Socket alert | CVE | GHSA | Severity | Patched in |
|---|---|---|---|---|
| `SOCKET-COMPOSIO-1686` | `CVE-2026-41242` |
[`GHSA-xq3m-2v4x-88gg`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg)
| Critical | `protobufjs@7.5.5` |

### Why an override

`protobufjs@7.5.4` is pulled in transitively by `@google/genai` (via
`google-auth-library`) — there are no direct imports of `protobufjs` in
`ts/packages/`. The cleanest, minimal-risk fix is a `pnpm.overrides`
pin: 7.5.4 -> 7.5.5 is a patch-only release containing the RCE fix.

This is the same override pattern hermes uses for its security-pinned
deps.

# How did I test this PR

- `BYPASS_BUN_VERSION_CHECK=1 pnpm install --lockfile-only` regenerated
`pnpm-lock.yaml`. Both `protobufjs@7.5.4` references now resolve to
`7.5.5`.
- `grep -rn "from ['\"]protobufjs" ts/packages/` confirms zero direct
imports — pure lockfile change.
- Relying on CI for lint / typecheck / unit-test coverage on the
lockfile bump.

---

Origin: cron-f7c85f82906b /
[zen-cron-6352a6575b74](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74)
Triggered by: saransh@composio.dev | Source: Socket.dev Vulnerability
Auto-Fix
Session:
https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74
 2026-05-26 14:28:17 +04:00
venkat82 42ebff3f6b feat(connected-accounts): namespace SHARED-connection surface under experimental 
Aligns the TypeScript SDK with the experimental wire shape used by
Shared Connections. The flat accountType / aclConfigForShared options
on connectedAccounts.link() and session.authorize() have moved under a
single experimental block, and connectedAccounts.updateAcl() has moved
off the class onto a top-level experimental_updateAcl(composio, id, opts)
export — same precedent as experimental_createTool /
experimental_createToolkit.

The experimental namespace is the signal that the shape may change in
future releases. Pinning a SHARED connection in a session config and
direct execute by connectedAccountId are unchanged — only the
connection-create / patch / authorize surfaces are namespaced.

Also surfaces the accountType filter on connectedAccounts.list() so
SHARED connections can be listed without dropping to the raw client.
The wire keeps this as a flat query param, so the SDK keeps it flat too.

@composio/client bumped from 0.1.0-alpha.71 -> 0.1.0-alpha.72 so the
generated typed client carries the Experimental namespaces for
link.create, toolRouter.session.link, and connectedAccounts.patch.

Caller migration:

  // before
  await composio.connectedAccounts.link('user_id', 'auth_config_id', {
    accountType: 'SHARED',
    aclConfigForShared: { allowAllUsers: true },
  });
  await composio.connectedAccounts.updateAcl('ca_abc', { allowAllUsers: true });
  await session.authorize('github', {
    accountType: 'SHARED',
    aclConfigForShared: { allowAllUsers: true },
  });

  // after
  await composio.connectedAccounts.link('user_id', 'auth_config_id', {
    experimental: {
      accountType: 'SHARED',
      aclConfigForShared: { allowAllUsers: true },
    },
  });
  await experimental_updateAcl(composio, 'ca_abc', { allowAllUsers: true });
  await session.authorize('github', {
    experimental: {
      accountType: 'SHARED',
      aclConfigForShared: { allowAllUsers: true },
    },
  });

  // new — list SHARED connections
  const shared = await composio.connectedAccounts.list({
    accountType: 'SHARED',
    userIds: ['user_creator'],
  });

Tests cover: experimental block forwarding (link + authorize), no-op
when omitted, empty-array preservation, typed error mapping for the
PRIVATE-with-ACL case, experimental_updateAcl body construction +
deny-list handling + ValidationError when no fields are provided, and
list(accountType: 'SHARED') flat-filter delegation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 16:16:56 +05:30
venkat82 483af36070 feat(connected-accounts): bump @composio/client to alpha.71, drop casts, add tests + error mapping 
Now that #77 in composio-base-ts merged and @composio/client@0.1.0-alpha.71 is
published with account_type + acl_config_for_shared in the typed surface,
all the forward-compat shims come out.

Removed:
- AclConfigWireShape, LinkCreateBodyWithAcl, ConnectedAccountPatchBodyWithAcl
  local types
- 3x `as unknown as Parameters<typeof X>[N]` casts in ConnectedAccounts.ts +
  ToolRouterSession.ts

Now uses the generated types directly:
- ConnectedAccountPatchParams, ConnectedAccountPatchResponse from
  @composio/client/resources/connected-accounts
- LinkCreateParams + LinkCreateParams.ACLConfigForShared from
  @composio/client/resources/link
- SessionLinkParams + SessionLinkParams.ACLConfigForShared from
  @composio/client/resources/tool-router/session/session

Review fixes from #3392 multi-agent review:

- P1-1: moved orphaned JSDoc back onto ComposioLegacyConnectedAccountsEndpoint-
  RetiredError (was stranded above ComposioSharedAccessDeniedError)
- P1-2: added empty-array footgun warning to updateAcl() JSDoc — passing
  `notAllowedUserIds: []` silently clears the deny list
- P1-3: changeset reconciled with PR body (Python ships as separate PR)
- P2-9: updateAcl() returns ConnectedAccountPatchResponse instead of void,
  matching sibling update()/refresh() ergonomics
- P2-11: clarifying JSDoc on update() pointing at updateAcl() and noting the
  pre-existing "alias/credentials" doc is inaccurate (this PR doesn't fix it)
- P3-12: callbackUrl/alias guards normalized to `!== undefined` (was a mix
  of `&&` and `!= null`) — empty strings now propagate correctly
- P3-17: refine-guard comment on UpdateConnectedAccountAclParamsSchema noting
  ZodEffects doesn't expose .shape

P2-6/P2-7: typed error mapping for ComposioAclOnlyForSharedError (400)
wired at three call sites:
- ConnectedAccounts.link()    — wraps existing
  ComposioFailedToCreateConnectedAccountLink catch
- ConnectedAccounts.updateAcl() — new catch with rethrow fallback
- ToolRouterSession.authorize() — new catch with rethrow fallback

Substring match on `'acl_config_for_shared is only valid on SHARED'` —
verified against apps/apollo/src/lib/connected_accounts/createConnectedAccount.ts
in hermes#9902. ComposioSharedAccessDeniedError and
ComposioSharedConnectionNotAccessibleError remain exported but not yet
thrown — they'll be wrapped when Tools.execute() and ToolRouterSession.create()
error-mapping lands in a follow-up.

Tests: 12 new behaviour tests in test/connectedAccounts/connectedAccounts.test.ts
covering link() ACL forwarding (5), updateAcl() body construction + empty-object
refine + AclOnlyForShared mapping (6), and link() error-mapping fallback (1).
911 tests pass (up from 899).

Verified: pnpm typecheck clean, pnpm build clean (publint + attw clean).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-11 23:55:13 +05:30
Rahul Tarak a4c9e0ada2 refactor(cli): define local tools as custom toolkits (#3356) 
## Summary
- Stacks this local-tools PR on top of #3360, which contains the core
duplicate custom-toolkit child slug fix.
- Refactors `@composio/cli-local-tools` to define bundled local toolkits
with core `experimental_createTool` / `experimental_createToolkit`
handles instead of hand-rolled schema objects.
- Keeps Tool Router v3.1 inline custom toolkit definitions attached to
session create/search/execute calls so bundled local tools remain
searchable/executable.
- Adds CLI/local-tools test coverage for forwarding local custom toolkit
payloads and for core custom toolkit handles from the local registry.

## Stack
- Base PR: #3360 (`fix(core): qualify custom toolkit child slug
lookups`)
- This PR should now show only CLI/local-tools changes relative to
#3360.

## Tests
- `pnpm --filter @composio/core typecheck`
- `pnpm --filter @composio/cli-local-tools typecheck`
- `pnpm --filter @composio/cli typecheck`
- `pnpm --filter @composio/cli-local-tools test`
- `pnpm --filter @composio/cli-local-tools build`
- `pnpm --filter @composio/cli exec vitest run
test/src/commands/tools/tools.search.cmd.test.ts
test/src/commands/tools/tools.execute.cmd.test.ts`
- `pnpm --filter @composio/core exec vitest run
test/models/customTool.test.ts test/models/toolRouter.test.ts
test/models/customToolRouting.test.ts`
 2026-05-07 05:29:06 -07:00
Abir Taheer 7c14438385 chore: update pnpm-lock.yaml for @composio/client 0.1.0-alpha.70 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-05-06 21:53:35 -07:00
Dhawal Upadhyay fb8549fce7 Bump generated clients for v3.1 (#3348) 
## Summary
- bump generated TS client to @composio/client 0.1.0-alpha.69 and Python
client to composio-client 1.36.0
- page through ToolRouter session tools in TS/Python using the generated
v3.1 cursor response
- accept generated connected account status REVOKED and fail connection
waits immediately for terminal states

## Validation
- pnpm --filter @composio/core typecheck
- pnpm --filter @composio/core test -- test/tools/tools.test.ts
test/models/toolRouter.test.ts
test/connectedAccounts/connectedAccounts.test.ts
test/connectedAccounts/connectionRequest.test.ts
- uv run --frozen ruff check python/composio/core/models/tools.py
python/tests/test_tool_execution.py
- uv run --frozen pytest
python/tests/test_tool_execution.py::TestToolExecution::test_get_raw_tool_router_meta_tools_fetches_all_pages
python/tests/test_tool_router.py

Note: pnpm install --frozen-lockfile hits the repo preinstall Bun guard
locally because this machine has Bun 1.2.10 and the branch expects
1.3.10; dependency sync was completed with --ignore-scripts for local
verification.
 2026-05-06 16:10:38 +05:30
Alberto Schiabel f5c5b84bd3 fix(mastra): resolve $ref in tool schemas before applyCompatLayer [PLEN-2244] (#3315) 
## Summary

Composio tools whose JSON Schema uses internal `$ref` pointers
(`#/$defs/...` or the legacy `#/definitions/...`) used to lose all type
information when wrapped by `MastraProvider.wrapTool`. The schema would
silently round-trip `raw → applyCompatLayer → convertSchemaToZod (drops
$ref → permissive anyOf) → zodToJsonSchema (no recovery)`. Customers
reported the user-visible surface as *"schema validation error: can't
resolve reference"* — AJV (bundled inside `@mastra/schema-compat`)
refusing to compile the schema downstream when validating tool input.

This PR pre-processes the schema with a new `dereferenceJsonSchema`
utility from `@composio/core` *before* it reaches
`@mastra/schema-compat`, preserving the type information from
`$defs`/`definitions` and avoiding the AJV failure entirely.

Closes
[PLEN-2244](https://linear.app/composio/issue/PLEN-2244/mastra-provider-schema-validation-error-cant-resolve-reference).

## What changed

- **`@composio/core`** — new `dereferenceJsonSchema(schema)` helper (and
`JsonSchemaRefResolutionError`):
- walks the schema reflectively (no JSON-Schema-keyword allow-list, so
future applicators are covered automatically),
- inlines internal `$ref` pointers transitively, with a 100-hop depth
cap,
- shallow-merges sibling keywords next to `$ref` per Draft 2020-12
semantics (siblings win on collision — preserves caller's `description`
/ `default` / `title`),
- breaks recursive cycles with `{ type: 'object', additionalProperties:
true }` (matches upstream guidance in
[mastra-ai/mastra#15341](https://github.com/mastra-ai/mastra/issues/15341)),
- strips `$defs` / `definitions` from the returned root once everything
reachable is inlined,
- leaves external (`http://`/`https://`) `$ref` pointers untouched so
callers can still forward them,
- throws `JsonSchemaRefResolutionError` on malformed pointers, missing
targets, and over-cap chains.
- **`@composio/mastra`** — `wrapTool` now runs `dereferenceJsonSchema`
over both `inputParameters` and `outputParameters` before calling
`applyCompatLayer`.
- **`@mastra/schema-compat`** floor bumped to `^1.2.9` so consumers
automatically pick up upstream [PR
#15400](https://github.com/mastra-ai/mastra/pull/15400)'s
recursive-`$ref` handling and [PR
#14530](https://github.com/mastra-ai/mastra/pull/14530)'s Draft-2020-12
AJV switch.
- Changeset: `.changeset/fix-mastra-ref-dereference.md` (patch bump for
`@composio/core` and `@composio/mastra`).

## Test plan

Red → green TDD across two commits — the `test:` commit reproduces
PLEN-2244 against the real `@mastra/schema-compat` (no `vi.mock`), the
`fix:` commit makes the regression tests pass.

- [x] `ts/packages/core/test/utils/jsonSchema.test.ts` — 14 unit tests
for `dereferenceJsonSchema` covering: basic resolution, chained refs,
container coverage (items / oneOf / anyOf / allOf / not /
additionalProperties / patternProperties / prefixItems), legacy
`definitions` (Draft 7), `$defs`/`definitions` mixed transitively,
sibling-keyword merge per Draft 2020-12, cycle break,
`$defs`/`definitions` strip, missing-target error, depth-cap error,
external `$ref` preserved, no input mutation, JSON Pointer escape
decoding (`~0`/`~1`), array-index pointers.
- [x] `ts/packages/providers/mastra/test/mastra-ref.test.ts` — un-mocked
integration tests against real `@mastra/schema-compat`: wrapping does
not throw, type info from `$defs` survives the round-trip (the `id`
field stays `type: 'string'` instead of degrading to permissive
`anyOf`), same for Draft-7 `definitions` on output schema, no remaining
`$ref` in the produced schemas.
- [x] `pnpm --filter @composio/core test` — 852/852 green.
- [x] `pnpm --filter @composio/mastra test` — 43/43 green (39 legacy + 4
new).
- [x] `pnpm --filter @composio/core --filter @composio/mastra typecheck`
— clean.
- [x] Existing `mastra.test.ts` (which mocks `@mastra/schema-compat`) is
**untouched** and still green.
- [x] Secret-hygiene scan: `git diff next..HEAD | grep -E
'sk-[A-Za-z0-9_-]{20,}|OPENAI_API_KEY=[A-Za-z]'` returns empty.

## Why it's a Mastra-only fix

The Mastra path is unique in routing JSON Schema through
`@mastra/schema-compat`, which embeds AJV. Sibling providers (`openai`,
`anthropic`, `vercel`, `langchain`, `google`, `llamaindex`) forward
Composio's JSON Schema through `@composio/json-schema-to-zod`, which
silently no-ops on unknown nodes. They are not affected today; expanding
pre-processing across providers is a separate PR if it ever becomes
needed.

## Caveats

- The cycle-break sentinel weakens type information for genuinely
recursive tool schemas. This is the same trade-off Mastra itself made in
[#15341](https://github.com/mastra-ai/mastra/issues/15341); without it
the agent crashes entirely.
- External `$ref` (`http://`/`https://`) is intentionally left
untouched. If a real customer schema ever needs them resolved, that's an
incremental follow-up that calls into
`@apidevtools/json-schema-ref-parser` only when needed.
- The cycle-break currently uses a single sentinel for any cycle; if
review prefers the higher-fidelity "keep first expansion, only break on
the recursion edge" pattern (mentioned in the research as a refinement),
that's a small follow-up.
 2026-05-06 11:17:57 +02:00
Rahul Tarak b3e5df565e fix(cli): patch BetterSwiftAX constants for binary builds (#3347) 
## Summary
- Broaden the Beeper iMessage macOS build patch so BetterSwiftAX
`kAX...` constants compile on GitHub `macos-15`/`macos-15-intel`.
- Pin the fixed `platform-imessage` submodule source and add Swift 6.2 /
Peekaboo dependency patching for the CLI binary workflow.
- Package and verify macOS local-tool sidecars plus `release-tag.txt` in
CLI release zips.
- Fix installed beta metadata/upgrade behavior so `--version`, update
checks, and beta-default experimental flags use the installed release
tag.
- Let `LOCAL_*` execution bypass remote auth/project/schema validation.
- Add runtime self-heal for missing installed `local-tools-binaries`: if
an old upgrader installs the fixed beta binary without sidecars, first
local-tool execution downloads the matching release zip, verifies
checksum when available, and restores the sidecars.

## Validation
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build:binary`
- Targeted CLI tests for execute/config/upgrade/version/update-check
paths.
- Packaged binary smoke test confirmed bundled Beeper sidecar works.
- Repair smoke test: copied only the new `composio` binary plus
`release-tag.txt` into a temp install with no `local-tools-binaries`;
`execute LOCAL_BEEPER_IMESSAGE_VERSION -d '{}'` restored sidecars from
`@composio/cli@0.2.29-beta.235` and succeeded.

## Release workflow
- Beta build run `25405049712` succeeded for commit
`9d0910c909b7b257d0f17b6d082980952d1e6c59` and published
`@composio/cli@0.2.29-beta.235`.
- This PR now includes one follow-up commit (`2c32cff4c`) to cover the
old-upgrader/missing-sidecars incremental upgrade path; normal branch CI
and beta build run `25406984535` are running again.
 2026-05-05 16:45:50 -07:00
Dhawal Upadhyay 82e0038c7c bump generated clients for v3.1 2026-05-05 14:44:43 +05:30
Rahul Tarak 79ac22053f feat(cli): add local tools foundation (#3340) 
## Summary
- Add experimental CLI local tools behind `local_tools` (beta-on,
stable-off unless `composio config experimental local_tools on`).
- Add reusable `@composio/cli-local-tools` package: declarations,
metadata, readiness, command/MCP/native/FFI runtimes, bundled-binary
resolution, and Tool Router search/execute/schema integration.
- Add first-class local toolkits for:
- `BEEPER_IMESSAGE` backed by `imessage-cli` from the ComposioHQ
`platform-imessage` fork.
- `CHROME_DEVTOOLS` backed by the official `chrome-devtools-mcp@0.24.0`
npm/npx package.
  - `PEEKABOO` backed by upstream Peekaboo CLI.
- Remove generated native executables from git: Beeper and Peekaboo
binaries are now ignored, pinned via git submodules, and generated
during CLI binary release jobs.
- Update CLI binary workflow so Linux artifacts skip native sidecars,
while macOS artifacts run on macOS runners and build only the matching
`darwin-x64` or `darwin-arm64` Beeper/Peekaboo sidecars before
packaging.

## Native binary policy
- No generated `imessage-cli` or `peekaboo` binary blobs are committed
in this PR history.
- Beeper source is pinned as
`ts/packages/cli-local-tools/vendor/platform-imessage` at
`364445a1b3089ad9fe293d5951efe160c5677c42` from
`https://github.com/ComposioHQ/platform-imessage`.
- Peekaboo source is pinned as
`ts/packages/cli-local-tools/vendor/peekaboo` at
`31e66e8d02656141d18f60bf3b46b24c2b9bc785` from
`https://github.com/steipete/Peekaboo`.
- Build commands:
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-x64`
- Chrome DevTools is an npm/npx integration and is pinned as a dev
dependency (`chrome-devtools-mcp@0.24.0`) instead of using native
sidecars.

## Validation
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `COMPOSIO_REAL_LOCAL_TOOLS_TESTS=1 pnpm --filter
@composio/cli-local-tools test -- src/toolkits/beeper-imessage.test.ts
src/toolkits/peekaboo.test.ts`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build`
- `COMPOSIO_CACHE_DIR=<tmp-config-with-local_tools-enabled> bun
ts/packages/cli/dist/bin.mjs local-tools doctor --json`
- `pnpm turbo build`
- Verified rewritten branch has no >1MB objects relative to
`origin/next` and no native executable paths in the PR diff.

## Notes / risks
- Beeper iMessage and Peekaboo are macOS-only and depend on local
permissions.
- Peekaboo requires macOS 15+; GUI tools require Screen Recording,
Accessibility, and sometimes Automation.
- Beeper send/reaction behavior can still depend on upstream Messages
automation reliability.
- Chrome DevTools can inspect/modify browser contents; avoid sensitive
browser sessions.
 2026-05-05 00:10:38 -07:00
Dhawal Upadhyay fed23cdc56 fix(tool-router): use generated execute offload params 2026-04-30 17:52:44 +05:30
jkomyno cc673b654c fix(mastra): resolve $ref in tool schemas before applyCompatLayer [PLEN-2244] 
Composio tools whose JSON Schema uses internal `$ref` pointers (`#/$defs/...`
or the legacy `#/definitions/...`) used to lose all type information when
wrapped by `MastraProvider.wrapTool`. The schema went through:

  raw JSON Schema (with $ref) → applyCompatLayer
    → convertSchemaToZod  (silently drops $ref, becomes a permissive anyOf)
    → zodToJsonSchema     (no way to recover the lost types)

Customers reported this surface as "schema validation error: can't resolve
reference" — AJV (bundled inside @mastra/schema-compat) refusing to compile
the schema downstream when validating tool input.

Fix: pre-process the schema with a new `dereferenceJsonSchema` helper before
handing it to `applyCompatLayer`. The helper:

- walks the schema reflectively (no JSON-Schema-keyword allow-list, so future
  applicators are covered automatically),
- inlines internal `$ref` pointers transitively, with a 100-hop depth cap,
- shallow-merges sibling keywords next to `$ref` per Draft 2020-12 semantics
  (siblings win on collision — preserves caller's `description`/`default`),
- breaks cycles with `{ type: 'object', additionalProperties: true }`,
  matching upstream guidance in mastra-ai/mastra#15341,
- strips `$defs`/`definitions` from the returned root once everything
  reachable is inlined,
- leaves external (`http://`/`https://`) `$ref` pointers untouched,
- throws `JsonSchemaRefResolutionError` on malformed pointers, missing
  targets, or chains over the cap.

Bumps the `@mastra/schema-compat` dependency floor to `^1.2.9` so users also
pick up upstream PR #15400's recursive-`$ref` handling.

The new red regression tests (committed in 5300bf8ba) now pass.
 2026-04-30 01:33:30 +02:00
Zen Agent 1c3276ba8d feat(sdk): add workbench sandbox compute tier (sandboxSize / sandbox_size) 
Expose `workbench.sandboxSize` (TypeScript) / `workbench.sandbox_size`
(Python) on `ToolRouter.create()` so callers can pick the workbench
sandbox compute tier (`standard`, `medium`, `large`, `xlarge`).
Optional; the server defaults to `standard` (1 vCPU / 1 GB) when
omitted, so existing callers keep current behavior.

- Bump stainless clients to pick up the field on the wire:
  - `@composio/client` 0.1.0-alpha.66 -> 0.1.0-alpha.67
  - `composio-client` 1.33.0 -> 1.34.0
- TS: extend `ToolRouterCreateSessionConfigSchema.workbench` with
  `sandboxSize` and forward it as snake_case `sandbox_size`. Export
  `SandboxSize` type and `SandboxSizeSchema` zod enum.
- Python: extend `ToolRouterWorkbenchConfig` TypedDict with
  `sandbox_size` and forward it on the create payload. Export
  `SandboxSize` literal alias.
- Changeset: `@composio/core` patch.
- Tests: cover the snake_case forwarding and zod enum rejection.

Docs (Configuring Sessions / Workbench / changelog) are split into a
separate PR so they can land alongside the SDK release.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-28 11:47:42 +00:00
Alberto Schiabel a10288aa87 fix(core): restore session.toolkits() pagination (#3193) 2026-04-16 12:02:23 -07:00
Rahul Tarak 08eccb85de feat(cli): migrate API key storage from plaintext to OS keyring (#3202) 
## Summary

- Wire `@composio/cli-keyring` into `ComposioUserContext` so the API key
lives in the macOS Keychain / Linux Secret Service instead of plaintext
`~/.composio/user_data.json`
- **Read precedence**: env var (`COMPOSIO_USER_API_KEY`) > OS keyring >
legacy plaintext
- **One-shot migration**: on first run after upgrade, if the keyring is
empty but `user_data.json` has an `api_key`, copy it to the keyring and
strip it from JSON
- **In-process memoization**: keyring read happens once at layer build
(~1.4ms), held in closure for the rest of the process
- **`dangerouslySaveApiKeyInUserConfig`**: opt-in escape hatch in
`~/.composio/config.json` for headless Linux / containers / CI where the
keyring is unavailable
- **`ctx.data` is now a getter**: fixes a pre-existing bug where
mutations via `login()`/`update()` were invisible through the stale
snapshot
- **In-memory mock keyring** for test isolation — tests never touch the
real keychain

## Files changed

| file | what |
|---|---|
| `ts/packages/cli/package.json` | Add `@composio/cli-keyring` workspace
dep |
| `ts/packages/cli/src/models/cli-user-config.ts` |
`dangerously_save_api_key_in_user_config` schema field |
| `ts/packages/cli/src/services/cli-user-config.ts` | Surface new field
on `CliUserConfigResolved` |
| `ts/packages/cli/src/services/user-context.ts` | Keyring-first
read/write/migrate/fallback chain |
| `ts/packages/cli/src/cli-main.ts` | Wire `KeyringLive` into layer
composition |
| `ts/packages/cli-keyring/src/stores/macos-security-ffi.ts` | Fix:
writes via subprocess `-A`, cleanup dead ACL builder code, add base64
encoding |
| `ts/packages/cli/test/__utils__/services/test-layer.ts` | In-memory
mock keyring for test isolation |
| `ts/packages/cli/test/src/commands/login.cmd.test.ts` | Update
assertion: api_key no longer in JSON after login |

## Verified end-to-end

```
$ ./dist/composio version
INFO: Composio API key migrated from user_data.json to the OS keyring
0.2.22

$ cat ~/.composio/user_data.json   # no api_key
{"base_url":"...","web_url":"...","org_id":"...","test_user_id":"..."}

$ # Rebuild binary (new hash) → read from keychain → no dialog
$ ./dist/composio whoami
{"email":"rahul@composio.dev",...}
```

## Test plan

- [x] 676 CLI tests passing (676 passed, 1 skipped)
- [x] Login test updated: asserts `api_key` absent from JSON + present
via `ctx.data.apiKey`
- [x] In-memory mock keyring — no real keychain access in tests
- [x] Binary build + FFI roundtrip verified
- [x] Rebuild with new hash → no keychain dialog (allow-any ACL via
`-A`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

**Stack: 2/2** — base PR: `cli/keyring-package` (#3201)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-14 00:13:41 -07:00
Rahul Tarak 9d7cf5aca2 feat(cli-keyring): add @composio/cli-keyring package (#3201) 
## Summary

- Cross-platform OS credential storage package for the Composio CLI,
structurally modeled on
[keyring-rs](https://github.com/open-source-cooperative/keyring-rs)
- **macOS FFI backend**: direct `SecItemCopyMatching` via `bun:ffi` —
**~1.4ms median reads** (vs 22ms subprocess). Writes delegate to
`/usr/bin/security -A` for reliable allow-any ACL
- **macOS subprocess fallback**: `/usr/bin/security` for Node/test
environments
- **Linux backend**: `secret-tool` subprocess with keyring-rs-compatible
attribute keys (`{service, username, target}`)
- All pointers as `bigint` (`FFIType.u64`) to handle CoreFoundation
tagged pointers above `2^53`
- `b64:` prefix encoding for cross-backend binary safety
- 11-variant `KeyringError` discriminated union matching
`keyring-core`'s error model
- Effect.ts integration via `@composio/cli-keyring/effect` subpath
export (optional peer dep)
- `dangerouslySaveApiKeyInUserConfig` escape hatch designed for the CLI
migration PR (next in stack)

## Benchmark (100 iterations, Apple Silicon)

| operation | subprocess | FFI | speedup |
|---|---|---|---|
| `getPassword` p50 | 19.95ms | **1.14ms** | **18×** |
| `getPassword` p99 | 88.72ms | **7.39ms** | **12×** |

## Test plan

- [x] 16 unit tests (errors, entry, shared encoding) — Node vitest
- [x] 4 E2E tests against real macOS keychain — gated on
`COMPOSIO_KEYRING_E2E=1`
- [x] 6 FFI-specific tests — gated on `typeof Bun !== 'undefined'` + E2E
flag
- [x] `publint` + `attw` clean
- [x] `bun build --compile` produces working standalone binary with FFI
reads

🤖 Generated with [Claude Code](https://claude.com/claude-code)

**Stack: 1/2** — next PR: `cli/keyring-migration` (wires this into the
CLI)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 23:55:30 -07:00
abir 7166c8e42d fix: regenerate lockfile with pnpm 10.28.0 and fix ruff formatting 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-authored-by: Zen Agent <zen@composio.dev>
 2026-04-10 02:18:23 +00:00
abir 28b8914d58 feat: bump client SDKs and simplify types using Stainless SDK 
- Bump @composio/client to 0.1.0-alpha.66 (TS) and composio-client to 1.33.0 (Python)
- Use SDK types directly: ConnectedAccountPatchResponse, SessionCreateParams.MultiAccount
- Move alias into connection param for initiate() (now in SDK's ConnectedAccountCreateParams.Connection)
- Simplify link(), authorize() methods — remove inline type casts, use SDK params directly
- Remove custom UpdateConnectedAccountResponse Zod schema (replaced by SDK type)
- Update tests for new alias location in create params

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-authored-by: Zen Agent <zen@composio.dev>
 2026-04-10 02:13:02 +00:00
abir 55355f6b10 chore: bump @composio/client to 0.1.0-alpha.64 
New client includes multi_account in SessionCreateParams.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-09 22:44:19 +00:00
abir 173f1e78f3 fix: regenerate pnpm-lock.yaml with pnpm 10.28.0 for CI compatibility 
Previous lockfile was corrupted by local pnpm 9.5.0 — missing overrides
section and wrong pnpmfileChecksum. Regenerated with pnpm 10.28.0
(matching CI's packageManager version).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-04-09 18:08:14 +00:00
abir 3332fe1a65 fix: upgrade @composio/client to alpha.63, use typed patch() for update 
- Bump @composio/client to 0.1.0-alpha.63 (adds connectedAccounts.patch)
- Replace raw client.patch() cast with typed client.connectedAccounts.patch()
- Keep minimal casts for alias on create/link (not yet in client types)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-authored-by: Zen Agent <zen@composio.dev>
 2026-04-09 18:03:41 +00:00
Rahul Tarak efcb8c2436 Add tsgo-backed typecheck targets across packages (#3130) 
## Summary
- Add `tsgo`-based `typecheck` scripts and matching `typecheck:tsc`
fallback scripts across the TypeScript packages.
- Wire the new `typecheck:tsc` task into Turbo so package-level
typecheck checks can run consistently.
- Update workspace and lockfile metadata to include
`@typescript/native-preview` and the new toolchain wiring.
- Remove redundant `baseUrl` settings from package tsconfig files where
they are no longer needed.

## Testing
- Not run (changes are limited to package scripts, tsconfig wiring, and
lockfile updates).
- Not run: `pnpm typecheck:tsc`
- Not run: `pnpm build`
- Not run: package-specific `typecheck` / `typecheck:tsc` commands in
`ts/packages/cli`, `ts/packages/core`, `ts/packages/json-schema-to-zod`,
and `ts/packages/providers/mastra`.
 2026-04-07 00:43:52 -07:00
dependabot[bot] a33aa4b0b7 chore(deps): bump path-to-regexp 
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).


Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-28 08:59:46 +00:00
Rahul Tarak b763753df5 [codex] bundle bun support files for standalone binaries (#3059) 
## Summary
- bundle the shipped `composio run` companion services with direct
`Bun.build(..., target: "bun")` output instead of reusing the shared
`dist` graph
- rebuild the Claude ACP support files as Bun-bundled runtime assets and
invalidate the cached adapter layout so stale raw files are not reused
- add runtime validation for shipped support files, wire the MCP helper
through the workspace `@composio/json-schema-to-zod` package, and cover
the static-import expectation in tests

## Why
Standalone binaries were still relying on external runtime dependencies
from companion support files. On a clean machine this surfaced as
failures like `Cannot find package 'decompress'` from the generated
companion modules. The fix is to make every shipped support file
self-contained for Bun and package exactly that tree into the binary
archives.

## Validation
- `pnpm run typecheck`
- `pnpm exec vitest run
test/src/services/run-subagent-output-mcp.test.ts
test/src/services/run-subagent-acp.test.ts`
- `pnpm run build:binary:all`
- `pnpm run build:binary:package`
- unpacked `dist/binaries/composio-darwin-aarch64.zip` and verified
`experimental_subAgent(..., { target: "codex", schema: ... })`
- unpacked `dist/binaries/composio-darwin-aarch64.zip` and verified
`experimental_subAgent(..., { target: "claude", schema: ... })`

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-27 11:56:41 -07:00
Rahul Tarak cb02575065 fix(cli): harden run subAgent structured output (#3046) 
## Summary
- harden `composio run` sub-agent structured output by adding an
MCP-backed `submit_structured_output` tool, permissive ACP approval, and
a repair turn when the agent answers with prose
- route all `run` helper logs into the per-run `artifacts/run.log`,
print `RUN_LOG_FILE=...` before execution starts, and include
`logFilePath` on `subAgent()` responses
- keep the run artifact directory and `~/.composio` accessible to
sub-agents and cover the new behavior with focused CLI/ACP tests

## Verification
- `pnpm --filter @composio/cli typecheck:src`
- `pnpm --filter @composio/cli test test/src/commands/run.cmd.test.ts
test/src/services/run-subagent-acp.test.ts`
- `pnpm --filter @composio/cli exec tsdown --config-loader unrun`
- `pnpm --filter @composio/cli run build:binary`
- manual `./ts/packages/cli/dist/composio run ...` checks against both
`target: "claude"` and `target: "codex"`

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-27 05:21:45 -07:00
Rahul Tarak f4922f9757 Add ACP-backed subagent execution to composio run (#3011) 
## Summary
- Adds a new ACP execution path for `subAgent()` in the CLI `run`
command, with fallback to the legacy CLI-based implementation when ACP
is unavailable.
- Introduces shared subagent helpers plus separate ACP and legacy
service modules to keep the invocation logic isolated.
- Adds `--acp-only` to force ACP usage and fail instead of falling back.
- Updates binary build output so the CLI ships the companion modules
needed by the `run` command in both source and compiled forms.
- Bumps CLI dependencies to include ACP packages used by the new
execution path.

## Testing
- `pnpm test ts/packages/cli/test/src/commands/run.cmd.test.ts`
- `pnpm test ts/packages/cli/test/src/services/run-subagent-acp.test.ts`
- Not run: full repository build or end-to-end CLI validation.
 2026-03-24 20:34:27 -07:00
Rahul Tarak ae08b37f91 feat(cli): add proxy execute (#2995) 
## Summary
- Adds a new `composio proxy` command plus `run`/consumer flow updates
to make local execution and debugging easier.
- Improves CLI UX across root help, command hints, input validation, and
hidden debug handling.
- Introduces experimental custom tools and toolkits support in the
TypeScript SDK, with docs and examples.
- Refreshes release metadata, changelog, and related docs for the new
CLI and SDK behavior.
- Updates tests and snapshots to cover the new command flows and
validation paths.

## Testing
- Not run (changes reviewed from diff and existing test coverage updated
in the branch).
- Updated/added CLI tests for `proxy`, `run`, `tools.execute`,
`tools.info`, `tools.list`, `tools.search`, and related command flows.
- Updated snapshot coverage for root help and command output changes.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 22:03:19 -07:00
Rahul Tarak 7633445b47 feat(cli): improve consumer command UX and hinting (#2979) 
## Summary

This PR continues the consumer CLI work by making the top-level workflow
more coherent around `search`, `link`, `tools`, `execute`, and `run`,
while moving developer-oriented workflows under a dedicated `dev`
namespace.

The main theme is to make the CLI easier for an agent or user to use
directly:
- discover tools semantically with `search`
- inspect toolkit-specific tools with `tools`
- try `execute` earlier, with fast schema-aware failure messages
- use `run` for programmatic multi-step flows without dropping into bash
- keep developer/project scaffolding under `dev`

## What Changed

### Consumer command UX

- added top-level `run` for inline Bun ESNext TS/JS or file execution
- added injected global helpers inside `run`
  - `execute(slug, data?)`
  - `search(query, options?)`
- updated root help text to better explain the intended flow and
encourage trying `execute` early
- clarified `search` as semantic search across toolkits/apps
- moved `tools list` and `tools info` to top level
- made `tools list` explicitly per-toolkit and non-semantic
- updated `tools info` to give a short summary plus a cached schema
reference instead of dumping raw detail
- cleaned up stale help/hints that still referenced removed command
paths

### New `dev` namespace

- introduced `composio dev ...` for developer/project workflows
- moved developer-focused flows under `dev`, including:
  - local init
  - playground-user execution
  - trigger listening
  - logs
- updated help copy so `manage` no longer claims to own `tools` or
`logs`
- reframed `dev` as the place for local scaffolding and project-building
workflows

### Execute improvements

- added schema-aware validation for `execute`
- cached tool definitions under `~/.composio/tool_definitions/`
- stored resolved version metadata with cached schemas
- added version freshness checks and stale-cache refresh behavior
- added a 12-hour version-check window to avoid refetching every
invocation
- invalidated stale cache entries when execution failures indicate the
schema may no longer be trustworthy
- improved validation errors to point at the cached schema file and give
more actionable guidance
- added `--get-schema` to fetch/cache the schema and print a compact
inspection hint
- added `--dry-run` to validate/preview execute calls without running
the remote action
- allowed `-d/--data` to accept JSON, JS-style object literals, `@file`,
or stdin
- added large-output handling that spills very large tool responses to
`/tmp/composio/...` and returns a file reference

### `run` improvements

- defaulted `run` to inline code, with `-f/--file` for file mode
- clarified in help that `run` uses Bun ESNext TS/JS, not Node/CJS
assumptions
- documented the injected helpers and when to use them
- made `run --dry-run` forward preview behavior through injected
`execute(...)`
- wired `run` to reuse consumer auth state and resolved consumer user
context for helper calls
- added AST-aware execute prewarming so static `execute("TOOL", ...)`
calls can prime schema/cache work

### Hint graph and debug tooling

- centralized command hints/examples in a shared registry
- added linked command relationships so hints can be maintained as a
graph instead of scattered hardcoded strings
- added support for variant nodes such as `root.execute.getSchema`
- added a hidden graph dump path for local iteration:
  - `composio debug generate-graph`
- hid local-only debug controls from help output while keeping them
usable:
  - `--perf-debug`
  - `--tool-debug`

### Internal cleanup

- updated many runtime hints to point at current commands instead of
removed paths
- aligned login/whoami/project/toolkit/log output hints with the new
command structure
- refreshed tests and snapshots for the new top-level layout and command
descriptions

## Verification

Ran:

- `pnpm --dir ts/packages/cli build:binary`
- `pnpm --dir ts/packages/cli typecheck`
- `./ts/packages/cli/dist/composio --help`

## Notes

This PR is intentionally focused on the CLI flow and help/hint surface.
It sets up a cleaner split between consumer-facing actions and
developer/project workflows, while also making `execute` and `run` much
more usable for agents.
 2026-03-23 18:06:04 -07:00
Dhawal Upadhyay 7b58c4a8d6 refactor: use official @composio/client types, proxyExecute via client method 
- Bump @composio/client to 0.1.0-alpha.62 (adds proxyExecute, custom tool types)
- Replace hand-rolled CustomToolDefinition/CustomToolkitDefinition with
  SessionCreateParams.Experimental.CustomTool/CustomToolkit from client
- Type experimentalPayload as SessionCreateParams['experimental'] instead
  of Record<string, unknown>
- Replace raw .post() hack in SessionContext/ToolRouterSession proxyExecute
  with official client.toolRouter.session.proxyExecute()
- proxyParamsTransform now returns official ClientProxyExecuteParams type
- Add ToolRouterSessionProxyExecuteResponse (status, data, headers, binaryData)
  matching ToolProxyResponse from client — consistent with tools.proxyExecute()
- Build CustomToolsMap from API response slug/original_slug mapping instead
  of computing LOCAL_ prefix client-side
- Add custom-tools.ts example showing standalone, extension (with proxyExecute),
  and toolkit tools with OpenAI Agents

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-18 13:05:19 -07:00