mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/cli@0.2.32-beta.264
4207 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alberto Schiabel
|
6606c0da92 |
fix(ts): upgrade vitest for GHSA-5xrq-8626-4rwp (#3569)
This PR: - closes #3502 - extracts the useful dependency and Cloudflare config slice from https://github.com/ComposioHQ/composio/pull/3503 onto a clean `next` branch - upgrades `vitest` and `@vitest/ui` through the workspace catalog to resolve the critical advisory - switches the Mastra provider test dependency back to the catalog - migrates the Cloudflare Worker Vitest configs to the `cloudflareTest()` plugin API - preserves existing `COMPOSIO_BASE_URL` bindings that were dropped in #3503 - keeps Vitest 4 compatibility fixes scoped to constructor mocks, spy cleanup, and temp-root project detection - leaves Node, `mise`, release docs, and Effect catalog versions unchanged; the commit includes @Dotify71 as `Co-authored-by` Co-authored-by: Dushyant Acharya <dushyantacharya873@gmail.com>@composio/cli@0.2.32-beta.264 |
||
|
Alberto Schiabel
|
74ce25812e |
fix(ci): repair CLI binary and docs sync workflows (#3568)
This PR: - patches the Peekaboo sidecar build to rewrite the resolved `swift-system` `AT_RESOLVE_BENEATH` Darwin guard before compiling on GitHub macOS runners - adds regression coverage for the `swift-system` checkout patch and includes script tests in `@composio/cli-local-tools` Vitest - switches the SDK docs sync workflow to `anthropics/claude-code-action/base-action` so push-triggered automation does not fail on unsupported event parsing - moves Claude tool restrictions to `claude_args` and quotes `$GITHUB_OUTPUT` writes so the workflow passes `actionlint` - verifies the changed package and workflow with targeted tests, build, formatting, YAML parsing, and `actionlint`@composio/cli@0.2.32-beta.263 |
||
|
Alberto Schiabel
|
4fe776898a |
chore(toolchain): finish mise migration (#3493)
## Summary Depends on #3492. This completes the Phase 2 migration by removing the transitional version-file layer and making `mise.toml` plus `mise.lock` the repository toolchain source of truth. It also moves runtime test matrices into `toolchain-versions.json`, so CI matrix changes are explicit and reviewable without reintroducing `.nvmrc`, `.dvmrc`, `.bun-version`, or `.python-version`. The Node.js e2e matrix now starts at the latest Node 22 LTS line and also covers the latest Node 24 and Node 25 lines. That removes Node 20 from the well-known e2e versions while keeping us covered on the runtimes SDK users are moving toward. ## Rationale Phase 1 introduced mise side by side with the existing version files to keep the first PR low-risk. Phase 2 removes that compatibility layer so there is one place to update tool versions. That avoids silent drift between local setup, GitHub Actions, Docker E2E images, release docs, and install-time checks. The composite setup actions now install Node, Bun, Python, and uv through mise by default, with explicit version overrides only where a matrix needs them. New GitHub actions added in this PR are pinned by release commit SHA and include the release version comment. ## What changed - Deleted the transitional root/version files: `.nvmrc`, `.bun-version`, `.dvmrc`, root `.python-version`, and `python/.python-version`. - Removed `idiomatic_version_file_enable_tools` from `mise.toml` and added a committed `mise.lock` for linux/macOS x64/arm64 tool resolution. - Replaced `BYPASS_BUN_VERSION_CHECK` with `BYPASS_TOOLCHAIN_CHECK`, and made Docker E2E image installs use that bypass because they receive explicit build args instead of installing mise. - Updated Node/Bun and Python/uv composite actions to default to mise, remove `*-version-file` inputs, report resolved versions, and cache pnpm after `corepack enable`. - Centralized CI runtime matrices in `toolchain-versions.json` for TS E2E, Python tests, and CLI npm fallback coverage. - Updated the Node E2E matrix to `22.22.3`, `24.16.0`, and `25.9.0`, removing Node 20 from the well-known runtime versions. - Updated workflows, docs, E2E helpers, Dockerfiles, and release guidance to reference `mise.toml` / `mise.lock`. ## Verification - Verified latest Node 22/24/25 releases from the official Node dist index: `22.22.3`, `24.16.0`, `25.9.0` (https://nodejs.org/dist/index.json). - `pnpm install --frozen-lockfile` - `pnpm --filter @e2e-tests/utils typecheck` - `pnpm --filter @e2e-tests/utils exec tsc --noEmit --target es2022 --module esnext --moduleResolution bundler --types bun --resolveJsonModule --skipLibCheck --strict scripts/docker-build.ts` - `bash -n ts/scripts/pre-install.sh && bun run ts/scripts/pre-install/check-toolchain.ts && BYPASS_TOOLCHAIN_CHECK=1 bash ts/scripts/pre-install.sh` - `pnpm exec prettier --check ...` on touched YAML/Markdown/TS/JSON files - `ruby -e "require \"yaml\"; ARGV.each { |f| YAML.load_file(f) }" ...` on touched actions/workflows - `mise lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64 && git diff --exit-code mise.lock` - `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/utils typecheck` - `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/node-esm-basic typecheck` - `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/node-cjs-basic typecheck` - `docker manifest inspect node:24.16.0-slim` - `docker manifest inspect node:25.9.0-slim` - `git diff --check` |
||
|
Sarah Simionescu
|
382f0b1c72 |
Create box-integration.mdx (#3565)
Adds a hidden Box integration docs page for use as the "Add" button link in the Box app directory submission. |
||
|
Aaliya
|
938eade263 | Create box-integration.mdx | ||
|
palash-c
|
1124aed57a |
docs: MCP servers → Sessions migration guide (twoslash-fixed re-add of #3551) (#3553)
Re-adds the MCP servers → Sessions migration guide that landed in #3551 and was reverted in #3552 because the docs build broke. **Root cause of the original break:** the docs site type-checks every TS code block via twoslash. The standalone snippets (direct-tools preset, `session.tools()`, `session.execute()`) referenced `composio` / `session` without declaring them → `[2552] Cannot find name 'composio'`. Fixed by adding a hidden `import` + `const composio` + `// ---cut---` setup preamble to each block (the same pattern `configuring-sessions.mdx` uses), and lifting the tools/execute examples out of nested list bullets into their own section. **Verified locally** against latest `next`: `bun run build` → `✓ Compiled successfully` + `✓ Generating static pages (1410/1410)`, exit 0. Files: new `docs/content/docs/migration-guide/mcp-servers-to-sessions.mdx` + registered in `migration-guide/meta.json`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Palash Kala
|
39af0f007c |
docs: drop client names + connect.composio.dev link, add guide to migration index
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Palash Kala
|
a6acec9071 |
docs: add MCP servers → Sessions migration guide (twoslash-safe re-add of #3551)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Rahul Tarak
|
08810af023 |
Revert "docs: add MCP servers → Sessions migration guide" (#3552)
Reverts ComposioHQ/composio#3551 |
||
|
palash-c
|
b77dbe8444 |
docs: add MCP servers → Sessions migration guide (#3551)
Adds a migration guide for developers moving from **MCP servers** (`composio.mcp.create` / `composio.mcp.generate`, the "Single Toolkit MCP" flow) to **sessions**. New page: `docs/content/docs/migration-guide/mcp-servers-to-sessions.mdx` (registered in `migration-guide/meta.json` after `direct-to-sessions`). ### What it covers - What carries over (tools, auth configs/connected accounts — no re-auth, the MCP URL pattern, per-user isolation, fixed tool lists) - Old → new mapping table + the *why* - 3-step migration (`composio.create` replaces server+generate · point the client at `session.mcp.url` · direct-tools preset for a fixed tool list) - Things to know: reuse one session, `session.tools()` as native framework tools, `session.execute()` for tool execution without an LLM, shared connections, tenant params, white-labeling, triggers, and a pointer to **Composio For You** (connect.composio.dev) for no-code/personal app connections ### Before merge - [ ] Confirm cross-links resolve in preview (`/docs/configuring-sessions`, `/docs/authenticating-users/shared-connections`, `/docs/white-labeling-authentication`, `/docs/how-composio-works`) - [ ] Sanity-check the `session.execute` / `session.tools` / direct-tools-preset snippets against the current SDK - [ ] Confirm the `https://connect.composio.dev` link + product-switcher wording for Composio For You 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tri
|
6478b80169 |
docs: add HVTracker badge to README (#3501)
Closes #3490 |
||
|
Dushyant Acharya
|
114ce807cb | docs: add HVTracker badge to README | ||
|
shams haroon
|
094aed6b98 |
rename scoped API key reference (#3534)
## Summary - Rename the scoped key reference page title to `Scoped project API keys` - Update the two cards that link to the page so the visible label is consistent ## Validation - `bun run lint:links` - `bun run types:check` |
||
|
Rahul Tarak
|
4abf06b23f |
ci: use GitHub App token for the release bot (replaces expired CI_BOT_TOKEN) (#3539)
## Problem The changeset release bot (`ts.release.yml` → `changesets/action`) authenticated with the **`CI_BOT_TOKEN`** personal access token. That PAT expired, so **every "TS SDK Release" run since 2026-06-04 failed** with: ``` HttpError: Bad credentials - https://docs.github.com/rest ``` `changeset version` ran fine, but the GitHub API call to create/update the "Release: update version" PR failed — so no version PR, no publish. (This is why 0.2.31 had to be shipped via a manual version bump in #3538.) ## Fix Mint a **short-lived GitHub App installation token** with [`actions/create-github-app-token`](https://github.com/actions/create-github-app-token) (pinned to `bcd2ba4` / v3.2.0) and use it for both `checkout` and the `changesets/action` step, instead of the PAT. Why an App token over a PAT or the default `GITHUB_TOKEN`: - **No silent expiry** — minted per run; nothing to rotate manually (exactly what just broke). - **Triggers downstream workflows** — the default `GITHUB_TOKEN` is blocked from triggering other workflows, so the version-PR merge would never kick off `build-cli-binaries.yml` to publish. App-token-created events *do* trigger them (same as a PAT, better hygiene). - **Not tied to a personal account.** (OIDC was considered but doesn't apply here — it authenticates to *external* services like cloud/npm trusted-publishing, not GitHub-internal PR/push operations.) ## Required setup before this lands Create a **GitHub App** (org-owned), installed on this repo, with repository permissions: - **Contents: Read & write** - **Pull requests: Read & write** Then add two repo secrets: - `RELEASE_BOT_APP_ID` — the App's ID - `RELEASE_BOT_APP_PRIVATE_KEY` — a generated private key (full PEM) Once those exist, the next push to `next` with pending changesets will regenerate the "Release: update version" PR correctly. `CI_BOT_TOKEN` can then be deleted. ## Out of scope / follow-up `docs.sync-connect-clients.yml` also uses `CI_BOT_TOKEN` (as `GH_TOKEN`). It can be migrated to the same App token in a follow-up; left untouched here to keep this focused on the release pipeline. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Rahul Tarak
|
56534e2158 |
chore(cli): release 0.2.31 (#3538)
## What Manual version bump for **`@composio/cli` → 0.2.31**, replacing the broken changeset-bot flow. - Bumps `ts/packages/cli/package.json` `0.2.30 → 0.2.31` - Adds the `0.2.31` entry to `ts/packages/cli/CHANGELOG.md` - Consumes (deletes) the 5 CLI changesets it covers: - `composio upgrade <version>` (#3428) - `x-cli-session-id` header (#3430) - refreshed approval fallback page (#3431) - LLM-friendly output (#3450) - fish completion paths (#3162) + 1-hour permission expiry (#3449) - Leaves the `@composio/core` changesets untouched for the bot. ## Why manual The changeset release bot (`ts.release.yml` → `changesets/action`) has been failing on **`HttpError: Bad credentials`** on every run since 2026-06-04 — its `CI_BOT_TOKEN` secret is expired/invalid — so it can no longer regenerate the "Release: update version" PR (#3429, stale since 2026-05-20). `build-cli-binaries.yml` is healthy and independent of that token: on merge to `next` it compares `ts/packages/cli/package.json` against the previous commit, detects the version change, and builds + publishes the stable **`@composio/cli@0.2.31`** GitHub release (cross-platform binaries). The CLI is `"private": true`, so it ships only as the GitHub binary release, not npm — this path fully covers it. ## Validated The pinned-actions binary pipeline was already validated green end-to-end (all 4 platform binaries built + full install-test matrix passed) on a `build-beta` run. Local binary (built from this same source) passed version/whoami/help, LLM-friendly stdout, `upgrade <version>`, and the full Slack + `experimental_subAgent` integration test. ## Follow-up (separate) `CI_BOT_TOKEN` needs refreshing to restore the changeset bot (recommend a GitHub App installation token over a personal PAT to avoid future expiry). Tracked outside this PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>0.2.31 @composio/cli@0.2.31 @composio/cli@0.2.31-beta.259 |
||
|
Rahul Tarak
|
df104ec1fa |
chore: CLI 0.2.31 patch release (#3536)
## Changes since `@composio/cli@0.2.30` ### Features - **feat(cli): `composio upgrade <version>`** (#3428) — install a specific stable or beta release (`0.13.1`, `0.13.1-beta.42`, or full tag). No-arg behavior unchanged; `--beta` still controls the latest-prerelease case. - **feat(cli): send `x-cli-session-id` header** (#3430) — attach the per-cwd CLI session id to every client request so tool execution logs can be grouped by CLI session. - **feat(cli): refresh approval fallback page** (#3431) — browser fallback tool-approval prompt restyled in the CLI landing-page visual language and served directly from the loopback callback server; native macOS sidecar remains preferred. ### Fixes - **fix(cli): make output more LLM-friendly** (#3450) — route logger output to stderr, gate human-only notices/prompts on interactive TTYs, keep `composio run` helper/subagent logs off stdout. - **fix(cli): permission allows expire after 1 hour** (#3449) — prompt action relabeled "Allow for 1 hr"; cached allow decisions expire after 1h with stale-entry pruning. - **fix: fish completion install paths** (#3162) — write completions to `~/.config/fish/completions/composio.fish` and sanitize lines that could break parsing. ## Changeset A single patch bump (`@composio/cli` → 0.2.31) aggregated from the pending changesets: - `.changeset/cli-upgrade-version-arg.md` - `.changeset/cli-session-id-header.md` - `.changeset/cli-permission-fallback-design.md` - `.changeset/quiet-llm-friendly-cli.md` - `.changeset/cli-fish-completions-and-permission-expiry.md` (new — covers #3162 and #3449) ## Testing ### Phase 1: CI Types/Lint - N/A for this branch — `ts.typecheck` / `ts.test` / `ts.build` are gated on `paths: ts/**`, and this branch only adds a `.changeset/*.md`. Each underlying CLI PR (#3428/#3430/#3431/#3449/#3450/#3162) already passed CI when merged to `next`. ### Phase 2: Local Binary Test ✅ Built from source (`pnpm turbo build` → `build:binary`) and tested: - `composio version` → `0.2.30` ✅ · `composio whoami` → JSON ✅ · `composio --help` ✅ - `composio run 'console.log(...)'` → clean stdout (LLM-friendly stderr routing confirmed, #3450) ✅ - `composio upgrade` `<version>` arg wired (`normalizeReleaseTag`, #3428) ✅ - `SLACK_SEND_MESSAGE` input validation correctly rejects unknown keys (LLM-friendly errors) ✅ - **Slack integration test** ✅ — `SLACK_FIND_CHANNELS` → `SLACK_SEND_MESSAGE` → `SLACK_FETCH_CONVERSATION_HISTORY` → `experimental_subAgent` (structured output via `z` schema + `result.prompt()`) → summary posted to `#buzz-skill-based-cli-testing`. ### Phase 3: Bundled Binary (CI) ✅ pipeline unblocked The CI binary pipeline was briefly blocked by a new org policy requiring SHA-pinned actions — **already resolved on `next` by #3531** (`chore(ci): pin GitHub Actions to SHAs`). A validation `build-beta` on an identically-pinned branch confirmed the fix: "Resolve Release Metadata" passes and binaries build/test green across platforms. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
shams haroon
|
43b2057847 | docs: rename scoped api key reference | ||
|
shams haroon
|
e4ec5476a8 |
add project api key permissions docs (#3532)
## Summary - Add a Project API key permissions reference page under `Reference > Authentication`. - List the routes covered by each permission area and access level. - Add stable anchor links for dashboard Learn more links, for example `/reference/authentication/project-api-key-permissions#webhooks`. - Link the new page from the Reference authentication overview and the Projects page. - Fix two existing docs build blockers that prevented local preview/build: quote SDK reference frontmatter and use `zod/v3` in the migration-guide custom tool sample. ## Validation - `bun run lint:links` - `bun run types:check` - `bun run build` - `curl -I http://localhost:3000/reference/authentication/project-api-key-permissions` returned `200` locally. |
||
|
Alberto Schiabel
|
90a436e393 |
chore(ci): pin GitHub Actions to SHAs (#3531)
## Summary
- Pin every remote GitHub Action used by `.github/workflows` and
`.github/actions` to a full 40-character commit SHA with a version
comment.
- Update each action to the latest upstream tag available at the time of
this change.
- Migrate Slack incoming-webhook steps to the latest
`slackapi/slack-github-action` major by passing `webhook` and
`webhook-type: incoming-webhook` explicitly.
- Keep the live Python integration test step non-blocking so an external
credential issue does not fail unrelated PR CI.
## Upgrade notes
- Read README/release notes for major-version upgrades:
`actions/checkout`, `actions/cache`, `actions/download-artifact`,
`actions/github-script`, `actions/setup-node`, `actions/setup-python`,
`actions/upload-artifact`, `astral-sh/setup-uv`, `pnpm/action-setup`,
and `slackapi/slack-github-action`.
- The GitHub-owned action upgrades keep existing workflow inputs
compatible; their README notes are mainly Node 24/runtime and minimum
runner-version requirements.
- `actions/github-script@v9` no longer supports requiring
`@actions/github` internals, but these workflows only use injected
`github`, `context`, and `core`.
- `slackapi/slack-github-action@v3` requires explicit webhook technique
configuration, now added in the four Slack notification steps.
## Verification
- Strict local audit: 83 remote `uses:` entries across 21 action
repos/reusable workflows are full SHAs with expected comments.
- Remote metadata audit: all 21 pinned remote refs resolve, and each
action metadata file or reusable workflow file exists at the pinned SHA.
- `.github/scripts/check-action-repos.sh`
- `ruby -e 'require "yaml"; Dir[".github/workflows/*.{yml,yaml}",
".github/actions/**/*.yml", ".github/actions/**/*.yaml"].each { |f|
YAML.load_file(f); puts "ok #{f}" }'`
- `git diff --check`
- `go run github.com/rhysd/actionlint/cmd/actionlint@latest -shellcheck=
-pyflakes= -ignore 'label "depot-ubuntu-[^\"]+" is unknown'`
`actionlint` without the ignore only reports the existing custom Depot
runner labels in `cli.test-installation.yml`.
|
||
|
Alberto Schiabel
|
80448048a8 |
docs: remove legacy custom tools references and retarget redirects (#3510)
This PR is **part 3 of 3** splitting https://github.com/ComposioHQ/composio/pull/3505 to make the removal of the old 2025 custom tools easier to review. It carries the **docs** slice. - builds on top of https://github.com/ComposioHQ/composio/pull/3509 (stacked — this PR's base is `remove-ts-custom-tools`) - deletes the legacy `/docs/tools-direct/custom-tools` page and prunes its `meta.json` entry - retargets redirects for `/docs/tools-direct/custom-tools` and the `:path*` wildcard to `/docs/toolkits/custom-tools-and-toolkits`, with matching `redirects.test.ts` expectations - updates migration-guide, glossary, proxy-execute, and executing-tools prose; fixes the `ctx.proxyExecute` example to include the required GitHub toolkit - updates agent guidance (`AGENTS.md`, `building-agents` skills) to the experimental custom tools API ## Notes - This slice is a byte-identical subset of #3505 — the three split branches recombine to that PR's exact tree. Docs link/redirect checks could not run in the source checkout (missing docs deps); CI runs them per PR. |
||
|
Alberto Schiabel
|
44e5458c35 |
feat(core): remove legacy TypeScript custom tools (#3509)
This PR is **part 2 of 3** splitting https://github.com/ComposioHQ/composio/pull/3505 to make the removal of the old 2025 custom tools easier to review. It carries the **TypeScript** slice. - builds on top of https://github.com/ComposioHQ/composio/pull/3508 (stacked — review/merge the Python slice first; this PR's base is `remove-py-custom-tools`) - removes the legacy `composio.tools.createCustomTool(...)` in-memory registry: the plural `CustomTools` model, registry wiring, legacy-only tests/examples/`ts/docs` pages, and stale error/type exports - preserves the 2026 tool-router APIs: `experimental_createTool`, `experimental_createToolkit`, `ToolRouter`, `ToolRouterSession`, and inline custom-tool execution - regenerates the TypeScript SDK reference so raw tool listing no longer describes the removed local registry and points to session-scoped custom tools - adds a `@composio/core` minor changeset ## Notes - The committed SDK reference is **verified self-consistent**: `pnpm --filter @composio/core generate:docs` reproduces it with zero diff. - This slice is a byte-identical subset of #3505 — the three split branches recombine to that PR's exact tree. See #3505 for the original verification logs (`typecheck`, `test`, `lint`, `cf-workers` e2e); CI re-runs per PR. |
||
|
Alberto Schiabel
|
2758287c87 |
feat(py): remove legacy custom tools (#3508)
This PR is **part 1 of 3** splitting https://github.com/ComposioHQ/composio/pull/3505 to make the removal of the old 2025 custom tools easier to review. It carries the **Python** slice. - removes the legacy `composio.tools.custom_tool` registry path: `core.models.custom_tools`, `ExecuteRequestFn`, the old fallback execution wiring, the security tests, and the example - preserves the 2026 tool-router APIs: `composio.experimental.tool()`, `composio.experimental.Toolkit`, inline custom-tool execution, preload/attach/use flows, and `session.custom_tools()` - bumps the Python workspace and all provider packages `0.13.1` → `0.14.0` ## Notes - This slice is a byte-identical subset of #3505 — the three split branches recombine to that PR's exact tree. See #3505 for the original local verification logs (`uv run --frozen nox -s chk`, targeted pytest); CI re-runs per PR. |
||
|
Alberto Schiabel
|
b69cef123f |
fix(mastra): tolerate dangling $ref in tool schemas [PLEN-2451] (#3400)
## Summary Closes [PLEN-2451](https://linear.app/composio/issue/PLEN-2451/mastraprovider-dollardefsdollarref-schema-is-dangling-at-the-api). Fixes https://github.com/ComposioHQ/composio/issues/3307. The Composio API ships some tools (e.g. `GMAIL_FETCH_EMAILS`) with `outputParameters` like: ```jsonc { "type": "object", "properties": { "data": { "$ref": "#/$defs/FetchEmailsResponse" }, // ← points into $defs "error": { "type": "string" }, "successful": { "type": "boolean" } }, "required": ["data", "successful"] // ← no `$defs` block anywhere } ``` Since [PLEN-2244](https://linear.app/composio/issue/PLEN-2244) introduced strict `dereferenceJsonSchema`, this caused `composio.tools.get(...)` to throw `JsonSchemaRefResolutionError: Cannot resolve $ref #/$defs/FetchEmailsResponse` upfront via `MastraProvider.wrapTool`, making every Gmail / Slack / Google Calendar tool unusable through the Mastra integration. ### Approach Two-tier fix that keeps the architectural boundary from PLEN-2244 (only the provider that owns the validation contract pre-processes the schema): 1. **`@composio/core`** — add an additive opt-in to `dereferenceJsonSchema`: ```ts dereferenceJsonSchema(schema, { onUnresolved: 'sentinel', // default 'throw' unchanged onReplace: (ref, reason) => { /* observe */ }, }) ``` In `'sentinel'` mode the unresolvable branch is replaced with the same `{ type: 'object', additionalProperties: true }` cycle-break sentinel the resolver already uses for `$ref` cycles. Safety caps (`MAX_REF_CHAIN_DEPTH`, `MAX_NODE_DEPTH`) keep throwing in both modes. Default behavior is byte-for-byte unchanged — first-party / custom-tool authors who typo a `$ref` still see a hard error. 2. **`@composio/mastra`** — opt `wrapTool` into sentinel mode for both `inputParameters` and `outputParameters` and emit one `logger.warn` per `(toolSlug, ref)` pair via a provider-scoped dedup `Set`. The warning names the tool / toolkit / pointer and links to https://github.com/ComposioHQ/composio/issues/3307. ### Why not centralize the dereferencing in `Tools.ts`? - Mastra is the only provider that wraps `outputParameters`. Vercel / OpenAI / Anthropic / Google bind tool input schemas to function-calling APIs that ignore output shapes. - Centralized dereferencing would silently mutate `tools.get()`'s public output shape for callers iterating raw schemas. - PLEN-2244 set the precedent — the provider that owns the validation contract pre-processes its own schemas. This PR mirrors that boundary. ### API-side follow-up The proper long-term fix is for the Composio API to emit a top-level `$defs` block alongside any `$ref` it produces. That belongs in a separate backend ticket — the SDK fix is intentionally independent so we don't block on a backend rollout. The SDK now degrades gracefully regardless of which API version it talks to. ## Test plan Red-green TDD — every new test was confirmed red against the pre-fix `dereferenceJsonSchema` / `MastraProvider`, then green after the fix. - [x] **Core** — 9 new cases in `ts/packages/core/test/utils/jsonSchema.test.ts` under `describe("with onUnresolved: 'sentinel' lenient mode")` covering: missing-target, missing-key, malformed-pointer (non-`#/` ref), mixed schema (resolvable + dangling siblings), `onReplace` reasons, safety-cap-still-throws (chain & node depth), explicit `'throw'` matches default, `onReplace` not called in strict mode. - [x] **Mastra** — new file `ts/packages/providers/mastra/test/mastra-dangling-defs.test.ts` (6 cases, un-mocked `@mastra/schema-compat`): replicates the exact `GMAIL_FETCH_EMAILS.outputParameters` shape; verifies no throw, no surviving `$ref` in the produced schema, exactly one warn per `(slug, ref)` pair across repeat wraps, a separate warn per slug, symmetric tolerance on `inputParameters`, and a regression guard for resolvable `$defs` (PLEN-2244 contract). - [x] **Regression** — all 908 core tests, all 39 existing `mastra.test.ts` cases, and all 3 `mastra-ref.test.ts` cases continue to pass. Full TS workspace test run: 14 packages green, 1322 tests total. - [x] `pnpm typecheck` passes in both `@composio/core` and `@composio/mastra`. - [x] `pnpm lint` on touched files produces no new warnings. - [ ] **Manual** (post-merge, against live API): `composio.tools.get(userId, { tools: ['GMAIL_FETCH_EMAILS'] })` returns a `MastraTool` whose `outputSchema` is defined; SDK logs exactly one warning per process per `(slug, ref)` pair. ## Files ``` ts/packages/core/src/index.ts # new type exports ts/packages/core/src/utils/jsonSchema.ts # opts + lenient branch ts/packages/core/test/utils/jsonSchema.test.ts # 9 new cases ts/packages/providers/mastra/src/index.ts # opt-in + dedup warn ts/packages/providers/mastra/test/mastra-dangling-defs.test.ts # 6 new cases .changeset/fix-mastra-dangling-defs-ref.md # core/mastra patch plans/fix-mastra-dangling-defs-ref.md # design + acceptance log ``` --------- Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
Alberto Schiabel
|
07160d14fa |
feat(toolchain): introduce mise.toml as single source of truth (#3492)
## Summary This PR starts Phase 1 of PLEN-1368 by adding `mise.toml` as the repo-owned source for the primary toolchain versions: - Node `20.20.2` - Bun `1.3.10` - Deno `2.6.7` - Python `3.12` - uv `0.8.19` It also keeps pnpm corepack-driven through `package.json#packageManager`, adds `devEngines` for Node/pnpm visibility, documents the new `mise install && corepack enable && pnpm install` bootstrap path, ignores `.mise.local.toml`, and fixes stale release-doc prerequisites. ## Why The repo already has real toolchain drift, not just duplicated version strings. The internal release docs had stale Node/Bun/pnpm versions, Deno is repeated across workflows, Dockerfiles, docs, and e2e helpers, and Python local setup still has a separate `3.11` venv path while the repo pins `3.12`. A composite-action cleanup would improve CI, but it would not solve local development. `mise.toml` gives us one file that declares the versions and lets contributors install or switch them with one command. That is the main value proposition here: make the repo declare its own toolchain, then let CI consume the same declaration in the next phase. ## Rollout This is deliberately additive. It does not remove `.nvmrc`, `.bun-version`, `.python-version`, or `.dvmrc`, and it does not change CI behavior yet. Contributors who do not use mise can keep working as before; contributors who do use mise get managed Node/Bun/Deno/Python/uv immediately. Phase 2 can migrate the existing composite actions to `jdx/mise-action@v4`. Phase 3 can remove the legacy version files and add the lockfile once the transition is complete. ## Out of Scope - Migrating CI to `jdx/mise-action@v4` - Removing legacy version files - Adding `mise.lock` - Updating nested TS package/example `packageManager` fields that still say `pnpm@10.28.0`; that is pre-existing metadata drift and should be handled separately to avoid broadening Phase 1 ## Verification - `git diff --check origin/next...HEAD` - `mise install && mise current` - `pnpm --version` -> `10.28.2` - `pnpm dlx prettier@3.8.1 --check package.json` Refs: PLEN-1368 |
||
|
palash-c
|
f4ac55652b |
changelog: link Workbench session reference to the sessions doc (#3519)
Small follow-up to #3517 (merged). Adds a docs link to the **Workbench** changelog item — the only outstanding ask from the review thread (Karan/Palash): > Code execution through the remote workbench … now runs only inside a [Composio session](https://docs.composio.dev/docs/how-composio-works). No other changes; the rest of the entry is as merged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
palash-c
|
17525ecb67 |
changelog: api security updates (2026-06-04) (#3517)
Adds one concise changelog entry: `docs/content/changelog/06-04-26-security-reliability-hardening.mdx`. Summarizes the post-incident wave of changes, link-forward (no migration-guide links), matching the existing `docs/content/changelog/*.mdx` format. Source of truth + rationale live in Linear PRO-255 (Customer Comms). ### What it covers - **Auth / API keys:** MCP auth required, cookie/session auth removed on v3.1, non-recoverable keys, **scoped API keys** (Proxy Execute opt-in at creation, off by default), auto-added IP allowlists, **MFA available for Dashboard sign-in (off by default)**. - **Connections:** managed-OAuth `initiate` → `link` (Jul 3 cutover), token redaction across **managed + custom** auth configs, Proxy Execute for provider actions. - **Webhooks / Endpoints:** public-URL + signed deliveries; `/api/rerouted/v1` and `/v2` retired (`410`). - **Dashboard:** `platform.composio.dev` → `dashboard.composio.dev` redirect, restoration-period `401`s (API/SDK stay functional), MCP configs view removed (use the MCP API / move to Composio sessions). ### Before merge (reviewer checks) - [ ] Confirm links resolve: Proxy Execute, Webhook Subscriptions API, MCP API reference, Composio sessions. - [ ] Re-confirm live state: MFA is opt-in (not required); destructive-tool denylist was re-enabled. - [ ] Confirm the per-project two-factor toggle is intentionally excluded (distinct from Dashboard MFA). - [ ] Confirm publish date (`2026-06-04`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Rahul Tarak <cryogenicplanet@gmail.com> |
||
|
dependabot[bot]
|
145a0985b8 |
chore(deps): bump next from 16.2.1 to 16.2.6 in /docs in the npm_and_yarn group across 1 directory (#3497)
Bumps the npm_and_yarn group with 1 update in the /docs directory: [next](https://github.com/vercel/next.js). Updates `next` from 16.2.1 to 16.2.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.2.6</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6">GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - <strong>Incomplete Fix Follow-Up</strong></a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5">GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n</a></li> </ul> <p><strong>Moderate:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q">GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h">GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh">GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7">GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses</a></li> </ul> <p><strong>Low:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949">GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq">GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned</a></li> </ul> <h3>Core Changes</h3> <ul> <li>fix: preserve HTTP access fallbacks during prerender recovery (<a href="https://redirect.github.com/vercel/next.js/issues/92231">#92231</a>)</li> <li>Fix fallback route params case in app-page handler (<a href="https://redirect.github.com/vercel/next.js/issues/91737">#91737</a>)</li> <li>Fix invalid HTML response for route-level RSC requests in deployment adapter (<a href="https://redirect.github.com/vercel/next.js/issues/91541">#91541</a>)</li> <li>Patch setHeader for direct route handlers (<a href="https://redirect.github.com/vercel/next.js/issues/93101">#93101</a>)</li> <li>Include deployment id in <code>cacheHandlers</code> keys (<a href="https://redirect.github.com/vercel/next.js/issues/93453">#93453</a>)</li> <li>Fix double-encoding of URL pathname parts in client param parsing (<a href="https://redirect.github.com/vercel/next.js/issues/93491">#93491</a>)</li> </ul> <h2>v16.2.5</h2> <blockquote> <p>[!NOTE] This release contains security fixes and backported bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Security Fixes</h3> <p>The following advisories have been addressed:</p> <p><strong>High:</strong></p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj">GHSA-8h8q-6873-q5fj: Denial of Service with Server Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f">GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx">GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv">GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r">GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/ee6e79b1792a4d401ddf2480f40a83549fe8e722"><code>ee6e79b</code></a> v16.2.6</li> <li><a href="https://github.com/vercel/next.js/commit/afa053d9eb9c2a68c7eba43e84fe6bed8babcd45"><code>afa053d</code></a> Turbopack: Match proxy matchers with webpack implementation (<a href="https://redirect.github.com/vercel/next.js/issues/93594">#93594</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/97a154e5bbee0cb1ac3fb8aa4db66ac36e796e3d"><code>97a154e</code></a> Turbopack: Fix middleware matcher suffix (<a href="https://redirect.github.com/vercel/next.js/issues/93590">#93590</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/83899bc89103d4df1479e065c7c1e09d4698a7b6"><code>83899bc</code></a> [backport] Disable build caches for production/staging/force-preview deploys ...</li> <li><a href="https://github.com/vercel/next.js/commit/7b222b90954d607fc28a34e9b360a9b1636bc206"><code>7b222b9</code></a> [backport][test] Pin package manager to patch versions (<a href="https://redirect.github.com/vercel/next.js/issues/93595">#93595</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/a8dc24f1fe23d4a22d24fac734837f7c824138f7"><code>a8dc24f</code></a> [backport] Turbopack: more strict vergen setup (<a href="https://redirect.github.com/vercel/next.js/issues/93587">#93587</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/766148f9cd48c0e218acafcd0f15defc14871bf4"><code>766148f</code></a> v16.2.5</li> <li><a href="https://github.com/vercel/next.js/commit/0dd94836a8b43209fcfefa448c141683c22c1a27"><code>0dd9483</code></a> fix: add explicit checks for RSC header (<a href="https://redirect.github.com/vercel/next.js/issues/83">#83</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/98">#98</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/d166096c399c4fc4e09cd2d1bf26dca6579a855d"><code>d166096</code></a> fix proxy matching for segment prefetch URLs (<a href="https://redirect.github.com/vercel/next.js/issues/89">#89</a>) (<a href="https://redirect.github.com/vercel/next.js/issues/96">#96</a>)</li> <li><a href="https://github.com/vercel/next.js/commit/9d50c0b7190f59c470308578e12882788819f14c"><code>9d50c0b</code></a> Strip next-resume header from incoming requests (<a href="https://redirect.github.com/vercel/next.js/issues/92">#92</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v16.2.1...v16.2.6">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ComposioHQ/composio/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Rahul Tarak
|
22a9171981 |
fix(core): defer telemetry sends (#3447)
## Summary - Defer telemetry batch processing via microtask scheduling so reaching the batch size no longer starts telemetry network work inline with SDK calls. - Defer SDK init/error telemetry sends and make `flush()` wait for both deferred sends and pending batches. - Remove stale blocking TODOs and add regression coverage for deferred batch/error telemetry behavior. Fixes #3442 ## Tests - `pnpm --filter @composio/json-schema-to-zod build` - `pnpm --filter @composio/core typecheck` - `pnpm --dir ts/packages/core exec vitest run test/telemetry/TelemetryService.test.ts` - `pnpm --filter @composio/core test` - `pnpm exec eslint ts/packages/core/src/telemetry/BatchProcessor.ts ts/packages/core/src/telemetry/Telemetry.ts ts/packages/core/src/services/telemetry/TelemetryService.ts` ## CI - GitHub checks are pending on PR creation; initial `gh pr checks 3447` showed required jobs queued/in progress. |
||
|
Zen
|
57942e87fd |
fix(security): pin protobufjs to 7.5.5 (Socket.dev critical CVE) (#3467)
# Description Adds a `pnpm.overrides` entry pinning `protobufjs` to **7.5.5** to patch a critical RCE flagged by Socket.dev: | Socket alert | CVE | GHSA | Severity | Patched in | |---|---|---|---|---| | `SOCKET-COMPOSIO-1686` | `CVE-2026-41242` | [`GHSA-xq3m-2v4x-88gg`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg) | Critical | `protobufjs@7.5.5` | ### Why an override `protobufjs@7.5.4` is pulled in transitively by `@google/genai` (via `google-auth-library`) — there are no direct imports of `protobufjs` in `ts/packages/`. The cleanest, minimal-risk fix is a `pnpm.overrides` pin: 7.5.4 -> 7.5.5 is a patch-only release containing the RCE fix. This is the same override pattern hermes uses for its security-pinned deps. # How did I test this PR - `BYPASS_BUN_VERSION_CHECK=1 pnpm install --lockfile-only` regenerated `pnpm-lock.yaml`. Both `protobufjs@7.5.4` references now resolve to `7.5.5`. - `grep -rn "from ['\"]protobufjs" ts/packages/` confirms zero direct imports — pure lockfile change. - Relying on CI for lint / typecheck / unit-test coverage on the lockfile bump. --- Origin: cron-f7c85f82906b / [zen-cron-6352a6575b74](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74) Triggered by: saransh@composio.dev | Source: Socket.dev Vulnerability Auto-Fix Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74 |
||
|
Zen
|
eb62bf16bc |
fix(security): bump authlib to 1.7.2 (GHSA-wvwj-cvrp-7pv5) (#3469)
# Description Resolves one of the four critical CVEs in this repo reported by Socket.dev. ## Vulnerabilities Fixed | Alert ID | Severity | Package | Fix | |----------|----------|---------|-----| | GHSA-wvwj-cvrp-7pv5 | critical | `authlib@1.6.0` | bumped to `1.7.2` | GHSA: https://github.com/advisories/GHSA-wvwj-cvrp-7pv5 (Authlib JWS JWK Header Injection: Signature Verification Bypass) Applied via `uv lock --upgrade-package authlib`. The command also resyncs the workspace `composio*` package versions in `uv.lock` to `0.13.1` (the value already in each workspace's `pyproject.toml`) — the lockfile had drifted to `0.14.0`. Adds `joserfc` as a transitive dependency of authlib 1.7.x. # How did I test this PR - `uv lock --upgrade-package authlib` reported `Updated authlib v1.6.0 -> v1.7.2` (no other dep upgrades beyond the workspace re-sync). - `git diff uv.lock` (59 lines) is scoped to: `authlib` version bump, new `joserfc` entry, and `composio*` workspace version corrections. - No `pyproject.toml` source changes. - CI on this PR will run a real `uv sync` + tests against the new lockfile. ## Unresolved (out of scope for this run) | Alert ID | Severity | Package | Reason | |----------|----------|---------|--------| | GHSA-jjhc-v7c2-5hh6 | critical | `litellm@1.72.0` | Patched in `1.83.0` (large minor bump; needs human review for behavior changes) | | GHSA-xq3m-2v4x-88gg | critical | `protobufjs@7.5.4` | Socket Fix on `pnpm-lock.yaml` cascaded into unrelated `zod@3 → zod@4` resolution shifts across many `@llamaindex/*` and `@modelcontextprotocol/sdk` consumers. Needs human review to land cleanly. | | GHSA-c67j-w6g6-q2cm | critical | `langchain-core@1.1.1` | Patched in `0.3.81` / `1.2.5`. The latest 1.x bump `1.1.1 → 1.4.0` is a minor but pulled in `langchain-protocol` as a new dep — left for human-reviewed bump. | Plus 618 `cve` / `obfuscatedFile` alerts at `high` severity across transitive deps remain — addressed in subsequent runs. --- *Auto-generated by Socket.dev security cron* Origin: cron-socket-tier1-weekly / [zen-cron-9b6a4e268d91](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-9b6a4e268d91) Triggered by: saransh@composio.dev | Source: cron Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-9b6a4e268d91 Co-authored-by: zen-cron <noreply@composio.dev> |
||
|
yosinn1-blip
|
832c65ee1d |
fix: correct typos 'sucessfull' and 'satus' in callbackUrl JSDoc (#3478)
## Summary Fixes #3475 Two typos in the JSDoc comment for `CreateConnectedAccountLinkOptionsSchema.callbackUrl` in `ts/packages/core/src/types/connectedAccounts.types.ts`: - `sucessfull` → `successful` - `satus=failed` → `status=failed` |
||
|
Rahul Tarak
|
cf13e17817 |
Fix fish completion install paths (#3162)
## Summary - Route fish shell completions to `~/.config/fish/completions/composio.fish` instead of writing them into the rc file. - Keep fish PATH setup in `~/.config/fish/config.fish` while writing completion blocks to the dedicated completions file. - Sanitize fish completion lines to strip description text that can break parsing, including multiline descriptions. - Add tests covering fish install behavior and fish completion sanitization. Closes #3147 ## Testing - `pnpm test --filter ts/packages/cli/test/src/commands/install.cmd.test.ts` - `pnpm test --filter ts/packages/cli/test/src/effects/shell-completions.test.ts` - Not run: full repository test suite |
||
|
Malay Vasa
|
e1ec52bbca |
docs: dark mode, navbar polish, scroll reset, platform→dashboard rename (#3465)
## Summary - **Dark/light theme switcher** in the navbar. Drops `forcedTheme: 'light'` so the toggle actually flips themes; sidebar footer toggle stays disabled so there's only one switcher. - **Dark mode color pass.** `--composio-brand` lifts to a muted `#5B8BF0` (the deep `#0007cd` brand reads as unlit text on `#0f0f0f`). Card / muted greys nudge to `#1c1c1c` / `#1f1f1f`. Borders drop from 10% white to 6% so card edges sit back. `--border` / `--sidebar-border` follow suit. - **Square navbar.** Search input and the new theme toggle render with `border-radius: 0` to match the rest of the navbar. - **Welcome-page scroll reset.** New `ScrollReset` client component wired into the root layout. Next.js App Router skips its built-in scroll reset when the new route resolves to the same dynamic `page.tsx` segment — every link from the welcome page to a `/docs/*` page hits this case, so users were landing mid-page on the new route. Now `usePathname()` change ⇒ `window.scrollTo(0, 0)` (skips first render and any hash-bearing navigation). - **`platform.composio.dev` → `dashboard.composio.dev`** across docs content + the direct-execution LLM guardrail (28 files). `docs/public/openapi*.json` left alone — auto-generated, and the surviving reference is literally to the legacy dashboard. ## Test plan - [ ] Toggle theme from the navbar; verify both light and dark render - [ ] In dark mode, confirm "Docs" nav active state, chip icons, "CONNECTED" labels, and Ask AI button read clearly against `#0f0f0f` - [ ] Scroll to the bottom of `/docs`, click any link in HomeResources / HomeSurfaces / HomeFeatures — the new page should land at scroll 0 - [ ] Click a TOC `#anchor` link inside a docs page — should still scroll to the anchor (not get clobbered to 0) - [ ] Spot-check a few rewritten URLs in cookbooks / quickstart — all `platform.composio.dev` should now be `dashboard.composio.dev` 🤖 Generated with [Claude Code](https://claude.com/claude-code)@composio/cli@0.2.31-beta.256 |
||
|
Malay Vasa
|
d84557ca21 |
docs: rework welcome page with v2 hero and homepage sections (#3464)
## Summary Reworks the docs welcome page (`/docs`) into a two-column hero with an animated agent chat mock + tool overlay, plus four restructured homepage sections. ### Hero (`DocsHeroV2`) - Left: headline (`Start building with Composio.`), short sub, brand-blue chip column (Quickstart, API reference, Toolkits). - Right (lg+ only): mock chat panel with the v1 hero's per-agent skin (`Claude Cowork` / `ChatGPT Codex` / `Your AI Agent`), step-by-step timeline-driven animation (user prompt → thinking dots → tool-trail items → assistant response), and a floating "active tool" card layered over the chat's left edge. - L-shape SVG connector between chat and overlay: muted grey resting state + brand-blue glow + bright line that re-draw via `pathLength` on every tool change. - Mock chat hidden below lg. ### Homepage sections - **`HomeFeatures`** — `Everything you need to ship production agents.` 2×2 grid with bespoke visuals per pillar: 8×2 toolkit grid with `+1K` cell, sessions panel (`USER_ID` + connected apps), triggers feed (`LIVE` indicator + recent events), and a workbench mock with animated 4×2 CPU lights. `auto-rows-fr` on `sm:` so cards equalize on tablet/desktop but breathe on mobile. - **`HomeSurfaces`** — `Three ways to use Composio.` bento: Developer card spans full width (`md:col-span-3`) and shows 8 provider logos (Anthropic, OpenAI, Vercel AI, Google, LangChain, CrewAI, LlamaIndex, Mastra). Row 2: For You (with Claude / Codex / Cursor / Windsurf / OpenClaw client logos), CLI (with `curl ... | bash` install snippet and functional copy button), Agents. - **`HomeResources`** — `Reach for the rest.` six-card footer row with Quickstart, API reference, Cookbooks, Changelog, Toolkits, Troubleshooting. ### Other - Ports the landing-page hero into `components/landing-hero/` (kept under the original `DocsHero` for easy revert; commented out, V2 wired in). - Theme-aware `--hero-*` CSS vars for chat-skin colors so the chat reads in both light and dark. - Removes the old `Works with your stack` provider grid (the providers now live inside the Developer surface card). ## Test plan - [ ] Verify hero animation cycles through 3 examples on desktop - [ ] Verify L-shape connector pulses in brand blue on every tool change - [ ] Verify chat mock is hidden on mobile and left column reads on its own - [ ] Verify dark mode (chat skins, connector, card surfaces, code blocks) - [ ] Verify CLI install copy button copies and toggles the icon to ✓ - [ ] Verify all chip / card hrefs resolve 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Rahul Tarak
|
3411c39adc |
docs: update CLI and reference navigation (#3462)
## Summary - Rework the CLI docs around Composio for You / Claude Code usage, with sections for knowledge work, `run`/sub-agents, trigger listening, developer workflows, and unsupported direct CLI embedding. - Move CLI into the top of Other topics and remove single-toolkit MCP from the Docs sidebar. - Move Changelog into Reference after Errors, with a grouped single-page changelog, scroll-based date anchors, and redirects from old `/docs/changelog` URLs. - Add the Claude logo to the “Open in Claude” page action. ## Tests - `cd docs && bun run lint:links` - `cd docs && bun test tests/static/navigation.test.ts` - `cd docs && bun run build` |
||
|
Rahul Tarak
|
e842e68e4b |
docs: merge and group guide content (#3456)
## Summary - Stack this PR on top of #3455 (`docs/love-fixes`). - Rework the former Core Concepts / Getting Started / Guides / Features area into a smaller set of sections: - Build with sessions - Authenticate users - Triggers and webhooks - Direct Tool Execution Guides (Legacy) - Other topics - Move conceptual session pages (`how-composio-works`, users/sessions, tools/toolkits, authentication, workbench, triggers) into the appropriate grouped sections. - Merge duplicated custom-auth content into `Managed vs custom auth` (`/docs/custom-app-vs-managed-app`) and redirect the old `/docs/using-custom-auth-configuration` URL. - Trim repeated OAuth-app setup from white-labeling docs so that page focuses on branding, callback-domain routing, and post-auth redirect UX. - Clean up “What to read next” cards so non-legacy pages no longer point at direct-execution docs and first point to the next item in their section where possible. - Fix the session lifecycle contradiction in `how-composio-works` so it matches the current persisted/reusable session model. ## Checks - `cd docs && bun run lint:links` - `cd docs && bun test tests/static/navigation.test.ts` |
||
|
Rahul Tarak
|
9acfa852b2 |
docs: tidy welcome page, fix playground link, hide ugly Ask AI tab (#3455)
## Summary Three small docs polishes: - **Hide the disgusting "Ask AI" side tab.** The Decimal widget renders its own `.decimal-widget-sidebar-tab` launcher (vertical pill with sideways text) on every page. We already trigger the widget from our own "Ask AI" button in the nav, so the third-party launcher is redundant *and* ugly. Hidden via CSS in `app/global.css`. - **Fix the Playground nav link.** It pointed at `platform.composio.dev/auth?next_page=/tool-router` — which (a) hits a dead host now that platform has moved to `dashboard.composio.dev`, and (b) lost the playground's connect check on the redirect. Repointed to `https://dashboard.composio.dev/~/project/playground`, which is the dashboard's smart-resolver route: it handles login (`?next=`), looks up `last_visited` / default org+project, and lands the user on `/{org}/{project}/playground` with the connect step intact. Same fix applied to the toolkits landing CTA and the welcome-page Playground card. - **Trim the welcome page.** Dropped the duplicated intro Cards row, the "Get Started" / "Explore" / "Features" / "Community" headers, and the secondary Features grid. Now it's: intro → AIToolsBanner → Quickstart → Toolkits + Playground → Providers. Much cleaner. ## Test plan - [ ] `bun run scripts/validate-links.ts` passes (already verified locally — 0 errors) - [ ] On preview deploy, the side "Ask AI" tab is gone - [ ] Clicking "Playground" in the nav (logged out) lands on login → playground; (logged in) lands on `/{org}/{project}/playground` - [ ] Welcome page renders without missing-icon errors 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Rahul Tarak
|
18c3b98de6 |
docs: reapply Algolia docs search (#3454)
## Summary - Re-apply the Algolia docs search migration after the previous PR was merged and reverted. - Keep the existing Fumadocs search UI while using Algolia API when search keys are configured, with `/api/search` fallback for local development and tests. - Add a first-party Algolia index builder/sync script that creates section-sized docs records from MDX/OpenAPI/toolkit/changelog content, configures index relevance settings, and replaces index objects without relying on Algolia Crawler. - Add Algolia Insights view/click events and a terminal search relevance test script. - Clean search breadcrumbs so results show labels like `Toolkit` and `Cookbook` instead of duplicated `toolkits > Gmail` formatting. ## Tests - `cd docs && bun run types:check` - `cd docs && bun run sync:search --dry-run` - `cd docs && bunx eslint components/custom-search-dialog.tsx lib/search-index.ts scripts/sync-algolia-search.ts scripts/test-algolia-search.ts` ## Notes - Live Algolia sync requires `ALGOLIA_ADMIN_API_KEY`. - Live search relevance tests require `ALGOLIA_SEARCH_API_KEY` or `NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY`. |
||
|
Rahul Tarak
|
1692bbee7a |
fix(cli): make output more LLM friendly (#3450)
## Summary - Route Effect pretty logger output to stderr and share a TTY-based interactive detector for human-only CLI UI. - Gate upgrade notices and default browser login waiting on interactive stdio; non-interactive `composio login` now emits session JSON and exits. - Stream `composio run` helper/subagent logs to stderr (or only to the run log with `--logs-off`) without polluting stdout. - Add a CLI patch changeset. ## Tests - `pnpm -C ts/packages/cli exec vitest run test/src/services/update-check.test.ts test/src/commands/login.cmd.test.ts test/src/commands/run.cmd.test.ts` - `pnpm --filter @composio/cli typecheck` - `pnpm typecheck` - `pnpm exec eslint ts/packages/cli/src/utils/stdio.ts ts/packages/cli/src/services/terminal-ui.ts ts/packages/cli/src/services/update-check.ts ts/packages/cli/src/cli-main.ts ts/packages/cli/src/commands/login.cmd.ts ts/packages/cli/src/commands/run.cmd.ts ts/packages/cli/src/services/run-helpers-runtime.ts --no-warn-ignored` - `pnpm exec prettier --check ts/packages/cli/src/utils/stdio.ts ts/packages/cli/src/services/terminal-ui.ts ts/packages/cli/src/services/update-check.ts ts/packages/cli/src/cli-main.ts ts/packages/cli/src/commands/login.cmd.ts ts/packages/cli/src/commands/run.cmd.ts ts/packages/cli/src/services/run-helpers-runtime.ts ts/packages/cli/test/src/services/update-check.test.ts ts/packages/cli/test/src/commands/login.cmd.test.ts` ## Notes - Initial targeted `pnpm --filter @composio/cli test -- ...` ran the full CLI suite and failed before building `@composio/cli-keyring`; after building/installing workspace deps, the targeted Vitest command above passed.@composio/cli@0.2.31-beta.255 |
||
|
Rahul Tarak
|
5f400fc5f7 |
Revert "docs: migrate search to Algolia" (#3453)
Reverts ComposioHQ/composio#3452 |
||
|
Rahul Tarak
|
7bd3e0669c |
docs: migrate search to Algolia (#3452)
## Summary - Switch docs search dialog to Algolia when public Algolia env vars are configured, with local `/api/search` fallback for development/tests - Add a shared docs search index builder plus `bun run sync:search` to publish records to Algolia - Add a GitHub Actions workflow to dry-run and sync the Algolia index on `next` docs changes when secrets are configured - Document required Algolia env vars and sync command ## Tests - `cd docs && bun run types:check` - `cd docs && bun run sync:search --dry-run` - `cd docs && bun test tests/static/` - `cd docs && bunx eslint components/custom-search-dialog.tsx lib/search-index.ts scripts/sync-algolia-search.ts` - `cd docs && bun run build` ## Notes - `bun run lint` still fails on existing unrelated repo-wide lint errors in files outside this change (for example `app/global-error.tsx`, `components/ask-ai-button.tsx`, `components/version-selector.tsx`). The changed search files pass targeted ESLint. - Production search requires `NEXT_PUBLIC_ALGOLIA_APP_ID`, `NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY`, and optionally `NEXT_PUBLIC_ALGOLIA_INDEX_NAME` (default `composio_docs`). Index syncing requires `ALGOLIA_APP_ID`/`ALGOLIA_ADMIN_API_KEY` secrets. |
||
|
Rahul Tarak
|
afa118c8fb |
fix(cli): make permission allows expire after one hour (#3449)
## Summary - Rename the permission prompt action from “Allow for session” to “Allow for 1 hr” in browser and native UI flows. - Cache allow decisions with a 1-hour expiry in `tool-permissions-cache.json`, with an in-memory fast path and stale-entry pruning. - Preserve existing permission snapshot cache behavior while keeping cached allow decisions across CLI invocations until expiry. ## Tests - `pnpm install --frozen-lockfile --ignore-scripts` - `pnpm build:packages` - `cd ts/packages/cli && pnpm run typecheck` ## Notes - The decision enum remains `allow_session` for compatibility with existing backend/native callback payloads; only the UX/caching semantics now expose and enforce a 1-hour duration.@composio/cli@0.2.31-beta.254 |
||
|
Alberto Schiabel
|
4367513f82 |
fix(python): guard enhance_schema_descriptions against empty schemas (#3398)
Stacked on #3397 · refs https://github.com/ComposioHQ/composio/issues/3354 ## Summary The TS fix in #3397 handled the reported case (`output_parameters: {}` from MCP toolkits) by normalizing empty schemas at `transformToolCases`. While verifying the Python SDK didn't have the equivalent Zod check, I found an **adjacent** crash on the input side. The Python SDK does not have the same Pydantic check** — `composio_client` types `input_parameters` / `output_parameters` as `Dict[str, Optional[object]]`, which accepts `{}` trivially. However, `Tools._get()` pipes every fetched tool's `input_parameters` unconditionally through `FileHelper.enhance_schema_descriptions` (`python/composio/core/models/tools.py:361-363`), which does: ```python for _param, _schema in schema["properties"].items(): ``` That crashes with `KeyError: 'properties'` on `schema={}`. Not reachable for the specific `granola_mcp` tools in the original report (they all have populated `input_parameters`), but it's the same API contract — any MCP tool with no required inputs would hit this through the public `Composio.tools.get(...)` call. The sibling `FileHelper.process_file_uploadable_schema` (`_files.py:760`) already guards this with `if "properties" not in schema: return schema`. This applies the same guard to `enhance_schema_descriptions`. ## Fix ```diff def enhance_schema_descriptions(self, schema: t.Dict) -> t.Dict: ... + if "properties" not in schema: + return schema required = schema.get("required") or [] for _param, _schema in schema["properties"].items(): ``` ## Testing Red → green confirmed locally. New `TestEnhanceSchemaDescriptionsEmptySchema` class in `tests/test_files.py` covers: 1. `schema={}` → returns `{}` (the bug repro). 2. Schema with metadata but no `properties` key → returned unchanged (mirrors the sibling method). 3. Schema with `properties: {}` (empty dict) → already works today; pinning behavior. 4. Populated schema → still enhanced (regression guard for the type-hint / required-marker enhancement). Cases 1–2 **fail on `next`** with `KeyError: 'properties'`. All 4 pass with the guard. Full `tests/test_files.py` stays green (116 tests). ```bash cd python .venv/bin/python -m pytest tests/test_files.py::TestEnhanceSchemaDescriptionsEmptySchema -v # → 4 passed .venv/bin/python -m pytest tests/test_files.py -q # → 116 passed ``` ## Stacked PR notes - Base: `jkomyno/fix-mcp-empty-output-parameters` (#3397). - This PR's diff against that base shows **only** the Python changes (`_files.py` + `tests/test_files.py`). - After #3397 merges, this should be retargeted to `next` (or rebased automatically by GitHub). --------- Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
Rahul Tarak
|
eb51b923bb |
feat(cli): send x-cli-session-id header on every request (#3430)
## Summary - Pulls the per-cwd CLI session id (already generated by `getCurrentCwdSessionId()` and used as `cli_session_id` on analytics events) and attaches it as the `x-cli-session-id` header on every request from the composio client. - Backend reads the header off `requestInfo`, threads it through `enrichSessionInfo`, and writes `session_info.cli_session_id` on every tool execution log row. Companion hermes PR: ComposioHQ/hermes#9990 ## Why The CLI already tracks a stable per-cwd session id for analytics, but tool execution logs are blind to it — there's no way to filter the logs UI / retool back to a single CLI session. Wiring the header through lets us group all tool calls from one CLI workflow together. ## Test plan - [x] `pnpm --filter @composio/cli typecheck` clean - [ ] Run `composio tools execute <slug>` against a build with the hermes companion deployed, confirm ClickHouse tool log has `session_info.cli_session_id` - [ ] Confirm header is absent (and log field absent) when no cwd session is cached 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>@composio/cli@0.2.31-beta.253 |
||
|
Alberto Schiabel
|
1ba66ca045 |
fix(core): normalize empty output_parameters so MCP tools can execute [PLEN-2450] (#3397)
Closes [PLEN-2450](https://linear.app/composio/issue/PLEN-2450/toolsexecute-fails-for-all-mcp-toolkits-strict-zod-validation-rejects) · refs https://github.com/ComposioHQ/composio/issues/3354 ## Summary `composio.tools.execute('<MCP_TOOL>', ...)` currently throws a `ZodError` for **every** tool from an MCP-backed toolkit (`granola_mcp`, `apify_mcp`, `tavily_mcp`, …) on `@composio/core` 0.6.x–0.9.x. The reporter on #3354 confirmed all three versions hit the identical failure; users are working around it by dropping to `@composio/client` and losing modifiers, custom-tool routing, version checks, and provider wrapping. **Root cause** (`ts/packages/core/src/models/Tools.ts` + `src/types/tool.types.ts`): - `tools.execute` and `tools.get` both run the API response through `transformToolCases → ToolSchema.parse`. - `ParametersSchema` requires `{ type: 'object', properties: {...} }`. - The API returns `output_parameters: {}` for MCP tools that have no declared output schema, so the validator throws. **Fix:** a tiny module-private `normalizeRawToolParameters` helper applied to both `input_parameters` and `output_parameters` inside `transformToolCases`. `null` / `undefined` / `{}` all map to `undefined`; everything else passes through to strict Zod validation. This: - Preserves the existing `outputParameters: undefined` ⇒ "no declared schema" contract — `outputParameters` was already optional in the public `Tool` type, so no public API change. - Fixes both `tools.execute` and `tools.list` (single funnel covers both paths). - Doesn't relax `ParametersSchema` — tools that actually declare a schema remain strictly validated. - Forward-compatible for every present / future `*_mcp` toolkit with no toolkit allow-list. ## Testing Red → green confirmed locally. New `describe('MCP-shaped tool metadata (PLEN-2450)')` block in `tools.test.ts` covers: 1. `getRawComposioToolBySlug` does not throw `ZodError` for `output_parameters: {}`. 2. Empty `output_parameters` is normalized to `undefined` on the transformed `Tool`. 3. Both-empty edge case (`input_parameters: {}` + `output_parameters: {}`). 4. `tools.list` path also tolerates empty `output_parameters`. 5. End-to-end `tools.execute` succeeds against an MCP-shaped fixture. All five tests **fail** on `next` without the helper (reproducing the exact `ZodError` from the report) and **pass** with it. Full `@composio/core` suite: **904 / 904 green**. ```bash cd ts/packages/core pnpm vitest run tools.test -t "MCP-shaped tool metadata" # → PASS (5) FAIL (0) pnpm vitest run # → PASS (904) FAIL (0) ``` ## Test plan - [x] Red phase confirmed: 5 new tests fail with the exact `ZodError` from the report. - [x] Green phase confirmed: 5 new tests pass after the helper lands. - [x] Full `@composio/core` test suite stays green (904 tests). - [x] `pnpm typecheck` clean. - [ ] Optional live sanity: build a tarball and run the reporter's `repro.mjs` against a sandbox user (`pg-test-9f4d0df7-…`) — not blocking; the mocked end-to-end test pins the same path. ## Follow-ups (out of scope) - **Python SDK** — verify whether `composio` Python has the same over-strict Pydantic check and apply the equivalent normalization if so. > Note: not proposing an API-side change. `output_parameters: {}` is the correct JSON Schema for "no declared schema" (the empty schema validates anything); the bug was the SDK's Zod validator being over-strict, not the API. The fix belongs at the SDK layer, where it now lives. Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
Rahul Tarak
|
5555dee25c |
feat(cli): refresh approval fallback page (#3431)
## Summary - Refresh the browser fallback tool-approval page with the Composio CLI landing page visual language: light dithered background, mono terminal card, and brand-blue actions. - Serve the approval HTML directly from the temporary `127.0.0.1` callback server instead of writing/opening a `file://` page, so approval buttons call back to the active CLI process with relative local routes. - Keep the native macOS sidecar as the preferred prompt when available; the browser prompt remains the fallback when the sidecar is missing or fails before returning a decision. - Add a CLI patch changeset. ## Tests - `pnpm exec eslint ts/packages/cli/src/services/tool-permissions.ts` - `pnpm --filter @composio/cli typecheck:src` - `git diff --check` ## Notes - Initially `typecheck:src` failed before workspace package build artifacts existed in the fresh worktree; after building required workspace dependencies it passed. --------- Co-authored-by: Malay Vasa <malayvasa@gmail.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>@composio/cli@0.2.31-beta.252 |
||
|
palash-c
|
dc052f5c0e |
docs: add Shared Connections page under Authentication (#3406)
## Summary New documentation page at `/docs/auth-configuration/shared-connections` covering the `accountType` and per-user ACL surface added to `@composio/core@0.9.1` and `composio==0.14.0`. ## What's covered - **SHARED vs PRIVATE** — comparison table; what each means for who can use the connection and how it's resolved - **Creating a SHARED connection** — `link()` with `accountType: 'SHARED'` and an initial ACL - **ACL resolution rule** — 4-step deny-wins ordering + a *"common patterns"* table (only-creator, allow-all, targeted-allow, everyone-except-N, combined) - **Updating the ACL** — `updateAcl()` with PATCH semantics, plus an explicit footgun warning about `notAllowedUserIds: []` clearing the deny list - **Using a shared connection** — pinning into a tool-router session via `connectedAccounts`, or direct execute via `connectedAccountId` - **Inspecting the ACL** — `get()` returns `accountType` + `aclConfigForShared`; the latter is `undefined` when the caller isn't authorised to see it - **Error handling** — table mapping `ComposioAclOnlyForSharedError`, `ComposioSharedAccessDeniedError`, and `ComposioSharedConnectionNotAccessibleError` to their trigger conditions, with try/except examples ## Other changes - **`docs/package.json`**: bump `@composio/core` from `^0.9.0` to `^0.9.1`. The published `0.9.1` is what carries the new typed surface; without this bump, twoslash type-checks against `0.9.0` and the new fields show as unknown properties. - **`docs/content/docs/auth-configuration/meta.json`**: insert `shared-connections` into the Authentication sidebar between `connected-accounts` and `migrating-initiate-to-link`. ## Sanitization Followed the same scrub conventions the SDK PRs landed on: - No Hermes / Apollo PR references - No internal backend error code names - No JSONB / storage-layer details - No *"project member"* wording (users don't belong to a project entity); used `userId` and the pinning mechanism instead - *"API key caller"* instead of *"project/org API key"* ## Test plan - [x] `bun run build` — 1411 pages generated, no twoslash errors against the published `@composio/core@0.9.1` - [x] Manual link audit — `/docs/configuring-sessions`, `/docs/managing-multiple-connected-accounts`, `/docs/auth-configuration/connected-accounts`, and the internal `#using-a-shared-connection` anchor all resolve - [ ] Preview deploy spot-check — confirm the Cards icons (`Database`, `Plug`, `Wrench`) render and the sidebar shows the new entry under Authentication 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Shrey Singla
|
93b67e8b2f |
fix(ts-sdk): handle file upload list unions (#3374)
## Summary
This updates the TypeScript SDK's automatic file upload/download
modifier to handle tool schemas that accept either a single file or a
list of files.
Tools can expose file inputs as a composed schema such as:
```json
{
"anyOf": [
{ "type": "object", "file_uploadable": true },
{ "type": "array", "items": { "type": "object", "file_uploadable": true } }
]
}
```
When auto-upload is enabled, the SDK presents those file-uploadable
objects to models as file path strings. If the model supplies a list of
local paths, the old upload resolver selected the first file-bearing
branch, usually the single-file branch, and left the list unchanged.
That means the backend could receive local paths instead of staged `{
name, mimetype, s3key }` descriptors.
## Changes
- Adds runtime-shape-aware composed-schema selection for file
upload/download modifiers.
- Chooses the array branch for list values while preserving single-file
behavior for string/File values.
- Preserves the existing fallback behavior: if no runtime shape matches,
use the first file-bearing variant.
- Keeps `anyOf`, `oneOf`, and `allOf` on the same composed-schema path
used by the SDK today.
- Adds regression coverage for single-file vs multi-file unions, array
item unions, and download parity.
- Adds a patch changeset for `@composio/core`.
## Why
Some file-capable tool schemas are backward compatible at the API level
by accepting both a single file and multiple files. The TypeScript SDK
should transform a list of local paths into a list of staged file
descriptors, just as it already does for direct array schemas.
## Verification
- `pnpm --filter @composio/core exec prettier --check
src/utils/modifiers/FileToolModifier.node.ts
test/tools/fileModifiers.test.ts`
Blocked locally:
- `pnpm --filter @composio/core test -- fileModifiers.test.ts` fails
before collecting tests because this workspace cannot resolve the
unbuilt `@composio/json-schema-to-zod` package entry.
- `pnpm --filter @composio/core typecheck:tsc` is also blocked by
existing local generated-client/workspace dependency errors unrelated to
this patch.
---------
Co-authored-by: Zen <zen@composio.dev>
|
||
|
Alberto Schiabel
|
5dcb363446 |
docs(py): add 0.13.1 entry to CHANGELOG (#3427)
Adds a `0.13.1` entry to `python/CHANGELOG.md` covering the changes accumulated on `next` since the last Python release (`py@0.13.0`, May 7). The CHANGELOG had been quietly abandoned since `0.8.11` (Sept 2025); rather than try to backfill the 4-minor gap, this PR draws a line and adds a banner pointing readers at the git log for that window. Future releases start fresh from here. ## What's in 0.13.1 - **SHARED connected accounts (experimental)** — `composio.experimental.update_acl`, `experimental={...}` on `link()` / `session.authorize()`, `account_type` filter on `list()`. Mirrors `@composio/core@0.10.0` shipping in #3425. - **`initiate()` deprecation warning** — gated on response `Deprecation` header (RFC 9745) instead of `auth_scheme`, eliminating false positives for custom auth configs and non-OAuth schemes. - **Schema converter** — preserves nullability on `null`-only `anyOf` blocks. - **Dep bump** — `composio-client` 1.36.0 → 1.39.0. ## Release plan Documentation only — does NOT trigger a release on its own. The Python release flow is tag-triggered: ```bash # After this PR merges and after #3425 ships: git tag py@0.13.1 <next HEAD sha> git push origin py@0.13.1 ``` That fires `.github/workflows/py.release.yml` which builds and publishes to PyPI. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>py@0.13.1 |
||
|
Shrey Singla
|
fccec8b143 |
fix(python-sdk): handle file upload list unions (#3373)
## Summary
This updates the Python SDK's automatic file upload/download
substitution so it can handle tool schemas that accept either a single
file or a list of files.
Tools can expose file inputs as a union such as:
```json
{
"anyOf": [
{ "type": "object", "file_uploadable": true },
{ "type": "array", "items": { "type": "object", "file_uploadable": true } }
]
}
```
When auto-upload is enabled, the SDK presents those file-uploadable
objects to models as file path strings. If the model supplies a list of
local paths, the old resolver selected the first file-bearing union
branch, usually the single-file branch, and attempted to upload the
entire Python list as one path. That fails before the backend ever
receives the intended list of staged file descriptors.
## Changes
- Refactors upload substitution into a value/schema recursive walker via
`_substitute_file_upload_value`.
- Adds the same value/schema traversal shape for downloads via
`_substitute_file_download_value`.
- Selects composed-schema variants by runtime shape when possible, so
list values choose array branches and string/dict values keep the
single-value behavior.
- Preserves the existing fallback behavior: if no runtime shape matches,
use the first file-bearing variant.
- Treats `anyOf`, `oneOf`, and `allOf` consistently with the SDK's
existing composed-schema convention.
- Preserves root request/response dict mutation behavior for existing
call sites.
- Adds regression coverage for single-file vs multi-file unions, nested
array-item unions, download parity, and first-match fallback.
## Why
This is needed for file-capable tool schemas that are backward
compatible at the API level by accepting both a single file and multiple
files. The Python SDK should transform a list of local paths into a list
of staged `{name, mimetype, s3key}` descriptors, just as it already does
for direct array schemas.
## Verification
- `python -m ruff check python/tests/test_files.py
python/composio/core/models/_files.py`
- `python -m pytest python/tests/test_files.py -q` -> 119 passed
- `python -m pytest python/tests/test_files.py
python/tests/test_auto_upload_download_files.py
python/tests/test_upload_dir_allowlist.py
python/tests/test_tool_router_session_files.py -q` -> 166 passed
- Manual playground verification with a Gmail send using two local
attachments: both files were staged and sent successfully as an
attachment array.
Note: a full local `python/tests` run still has three unrelated failures
because `composio_langchain` is not installed in this environment; the
affected file-upload suites pass.
---------
Co-authored-by: Zen <zen@composio.dev>
|