mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/cli@0.2.32-beta.279
4322 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 dependabot[bot]
|
de6a8ce295 |
chore(deps): bump the github-actions group across 1 directory with 7 updates (#3694)
Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` | | [swift-actions/setup-swift](https://github.com/swift-actions/setup-swift) | `2.4.0` | `3` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.140` | `1.0.159` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.8` | `1.9` | | [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) | `1.0.140` | `1.0.159` | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` | Updates `actions/checkout` from 6.0.2 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br /> Updates `swift-actions/setup-swift` from 2.4.0 to 3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/swift-actions/setup-swift/releases">swift-actions/setup-swift's releases</a>.</em></p> <blockquote> <h2>3.0.0 Beta 1</h2> <h2>Beta 1 of using Swiftly to setup Swift</h2> <ul> <li>Now uses Swiftly to set up Swift</li> <li>Added flag <code>skip-verify-signature</code> to disable GPG verification checks</li> </ul> <h2>Features</h2> <ul> <li>Setup Swift more Swiftly 🚀 (setup-swift 3.0) (<a href="https://redirect.github.com/swift-actions/setup-swift/issues/710">#710</a>) <a href="https://github.com/fwal"><code>@fwal</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/swift-actions/setup-swift/commit/364295d9c23900ce04d4e5cc708387921b4e50f9"><code>364295d</code></a> Bump build</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/7ef546c485df71a42699fdc047a6da322da93917"><code>7ef546c</code></a> Update readme</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/3273319f0f0618754506c4c1254da1ec36527312"><code>3273319</code></a> Bump swiftly</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/a90d2583fe1ebfd214260283f072a5fd4fb21ed0"><code>a90d258</code></a> Pass skip flag</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/ded451bd855f0672b0d538b7b00f0f48958284d7"><code>ded451b</code></a> Update workflows</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/0dad4e4b3ad6947c15c7ce23c6193d548ffb067c"><code>0dad4e4</code></a> Merge pull request <a href="https://redirect.github.com/swift-actions/setup-swift/issues/710">#710</a> from swift-actions/next</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/4abecca1bb9fd97e4857628fef56642847a3f8a8"><code>4abecca</code></a> Build</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/0c751509fec030bde17c1c403ee2cd10c61168d9"><code>0c75150</code></a> Formatting</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/7849873cbfe87fdcd1a020cc9cc31d317662e8bb"><code>7849873</code></a> Update gpg handling</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/9005990785b87227ac8641478fa68113afcd07ac"><code>9005990</code></a> Merge branch 'main' into next</li> <li>Additional commits viewable in <a href="https://github.com/swift-actions/setup-swift/compare/7ca6abe6b3b0e8b5421b88be48feee39cbf52c6a...364295d9c23900ce04d4e5cc708387921b4e50f9">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action` from 1.0.140 to 1.0.159 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.159</h2> <h2>What's Changed</h2> <ul> <li>fix: bound app token revocation cleanup by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tarunag10"><code>@tarunag10</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159</a></p> <h2>v1.0.158</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158</a></p> <h2>v1.0.157</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157</a></p> <h2>v1.0.156</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156</a></p> <h2>v1.0.155</h2> <h2>What's Changed</h2> <ul> <li>fix: filter PR reviews and inline review comments to trigger time by <a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li>test: cover format-turns content-type fallbacks and system_other handling by <a href="https://github.com/farmer-data"><code>@farmer-data</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li>fix: allow @ in branch names (valid per git-check-ref-format) by <a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li><a href="https://github.com/farmer-data"><code>@farmer-data</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li><a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155</a></p> <h2>v1.0.154</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154</a></p> <h2>v1.0.153</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153</a></p> <h2>v1.0.152</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152</a></p> <h2>v1.0.151</h2> <h2>What's Changed</h2> <ul> <li>fix: skip workflow validation token exchange failures by <a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151</a></p> <h2>v1.0.150</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/a92e7c70a4da9793dc164451d829089dc057a464"><code>a92e7c7</code></a> chore: bump Claude Code to 2.1.195 and Agent SDK to 0.3.195</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f8076dc00886157bd2e1bd828246d01274b9cb62"><code>f8076dc</code></a> fix: bound app token revocation cleanup (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1437">#1437</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/521136812280ae7ef256e06045655b9da02793f0"><code>5211368</code></a> chore: bump Claude Code to 2.1.193 and Agent SDK to 0.3.193</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d"><code>428971d</code></a> chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/74eedf1a1892082d619c3edb66b9402da6520e7f"><code>74eedf1</code></a> chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/80b31826338489861333dc17217865dfe8085cdc"><code>80b3182</code></a> chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/360be9c8fc5d80cb33661e0ffd33dcef4c7155aa"><code>360be9c</code></a> fix: allow @ in branch names (valid per git-check-ref-format) (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1411">#1411</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92"><code>e452eb9</code></a> test: cover format-turns content-type fallbacks and system_other handling (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1">#1</a>...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6b8063043eb8bc14e8448185a12d6d9dcf07ce55"><code>6b80630</code></a> fix: filter PR reviews and inline review comments to trigger time (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1385">#1385</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/30544b674398ee15c84819bd87caf8a87e8c7b55"><code>30544b6</code></a> chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/fbda2eb1bdc90d319b8d853f5deb53bca199a7c1...a92e7c70a4da9793dc164451d829089dc057a464">compare view</a></li> </ul> </details> <br /> Updates `openai/codex-action` from 1.8 to 1.9 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's changelog</a>.</em></p> <blockquote> <h1>codex-action Changelog</h1> <h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a> (2026-06-22)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/85">#85</a> update the internal <code>setup-node</code> pin to <code>v6.3.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a> (2026-04-29)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/91">#91</a> tighten what bots are allowed</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a> (2026-04-24)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/89">#89</a> restrict bot permission bypass</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/77">#77</a> enable GitHub-hosted Linux bubblewrap support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/74">#74</a> harden shell interpolation in action workflows</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/58">#58</a> revert <a href="https://redirect.github.com/openai/codex-action/issues/56">#56</a> and use the latest stable version of Codex CLI again</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/56">#56</a> temporarily set the default version of Codex CLI to <code>0.58.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a> (2025-11-07)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/52">#52</a> add <code>baseUrl</code> to <code>Octokit</code> constructor, if appropriate, for GHE</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a> (2025-11-05)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/47">#47</a> added support for Azure via the new <code>responses-api-endpoint</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/36">#36</a> added <code>effort</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/45">#45</a> pin the commit hash of the <code>actions/setup-node</code> action used by <code>openai/codex-action</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.0">v1.0</a> (2025-10-06)</h2> <ul> <li>Initial release (OpenAI DevDay 2025!)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/openai/codex-action/commit/10cb888d2ed3b99867f7e7ccff174a861a75aeb6"><code>10cb888</code></a> Update the internal setup-node pin to v6.3.0 (<a href="https://redirect.github.com/openai/codex-action/issues/85">#85</a>)</li> <li><a href="https://github.com/openai/codex-action/commit/9cdb6f3861cdefafeeaec70dfb42687be5ca62d3"><code>9cdb6f3</code></a> docs: clarify PR-controlled project instructions (<a href="https://redirect.github.com/openai/codex-action/issues/101">#101</a>)</li> <li>See full diff in <a href="https://github.com/openai/codex-action/compare/e0fdf01220eb9a88167c4898839d273e3f2609d1...10cb888d2ed3b99867f7e7ccff174a861a75aeb6">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.140 to 1.0.159 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.159</h2> <h2>What's Changed</h2> <ul> <li>fix: bound app token revocation cleanup by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tarunag10"><code>@tarunag10</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159</a></p> <h2>v1.0.158</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158</a></p> <h2>v1.0.157</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157</a></p> <h2>v1.0.156</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156</a></p> <h2>v1.0.155</h2> <h2>What's Changed</h2> <ul> <li>fix: filter PR reviews and inline review comments to trigger time by <a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li>test: cover format-turns content-type fallbacks and system_other handling by <a href="https://github.com/farmer-data"><code>@farmer-data</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li>fix: allow @ in branch names (valid per git-check-ref-format) by <a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li><a href="https://github.com/farmer-data"><code>@farmer-data</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li><a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155</a></p> <h2>v1.0.154</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154</a></p> <h2>v1.0.153</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153</a></p> <h2>v1.0.152</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152</a></p> <h2>v1.0.151</h2> <h2>What's Changed</h2> <ul> <li>fix: skip workflow validation token exchange failures by <a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151</a></p> <h2>v1.0.150</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/a92e7c70a4da9793dc164451d829089dc057a464"><code>a92e7c7</code></a> chore: bump Claude Code to 2.1.195 and Agent SDK to 0.3.195</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f8076dc00886157bd2e1bd828246d01274b9cb62"><code>f8076dc</code></a> fix: bound app token revocation cleanup (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1437">#1437</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/521136812280ae7ef256e06045655b9da02793f0"><code>5211368</code></a> chore: bump Claude Code to 2.1.193 and Agent SDK to 0.3.193</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d"><code>428971d</code></a> chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/74eedf1a1892082d619c3edb66b9402da6520e7f"><code>74eedf1</code></a> chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/80b31826338489861333dc17217865dfe8085cdc"><code>80b3182</code></a> chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/360be9c8fc5d80cb33661e0ffd33dcef4c7155aa"><code>360be9c</code></a> fix: allow @ in branch names (valid per git-check-ref-format) (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1411">#1411</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92"><code>e452eb9</code></a> test: cover format-turns content-type fallbacks and system_other handling (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1">#1</a>...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6b8063043eb8bc14e8448185a12d6d9dcf07ce55"><code>6b80630</code></a> fix: filter PR reviews and inline review comments to trigger time (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1385">#1385</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/30544b674398ee15c84819bd87caf8a87e8c7b55"><code>30544b6</code></a> chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/fbda2eb1bdc90d319b8d853f5deb53bca199a7c1...a92e7c70a4da9793dc164451d829089dc057a464">compare view</a></li> </ul> </details> <br /> Updates `actions/cache` from 5.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-python` from 6.2.0 to 6.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add RHEL support and include Linux distro in cache keys by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li> <li>Fix pip cache error handling on Windows by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li> <li>Upgrade actions dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li>Upgrade dependency versions and test workflow configuration by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li> </ul> <h3>Documentation</h3> <ul> <li>Update advanced-usage.md by <a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li><a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v6.3.0">https://github.com/actions/setup-python/compare/v6...v6.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1"><code>ece7cb0</code></a> Fix pip cache error handling on Windows. (<a href="https://redirect.github.com/actions/setup-python/issues/1040">#1040</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf"><code>1d18d7a</code></a> Update advanced-usage.md (<a href="https://redirect.github.com/actions/setup-python/issues/811">#811</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/d2b357a6a3a3687dd6781a416c0d24fcfd68660e"><code>d2b357a</code></a> Update dependency versions and test workflow configuration (<a href="https://redirect.github.com/actions/setup-python/issues/1322">#1322</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/8f639b1e75c1048640734b2bb46e22cecf136982"><code>8f639b1</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-python/issues/1324">#1324</a> from jasongin/update-actions-cache-5.1.0</li> <li><a href="https://github.com/actions/setup-python/commit/6731c2ba87f530c26324d128c8fdd53499a4d4b0"><code>6731c2b</code></a> Resolve high-severity audit issues</li> <li><a href="https://github.com/actions/setup-python/commit/0cb1a84326b90186fcd211036c65b42819794c87"><code>0cb1a84</code></a> Add RHEL support and include Linux distro in cache keys (<a href="https://redirect.github.com/actions/setup-python/issues/1323">#1323</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/dc6eab6194394e0119523369788b507096f923e2"><code>dc6eab6</code></a> Update dist</li> <li><a href="https://github.com/actions/setup-python/commit/6f4b74bfa2f520a380a620de3615c0dac427f4d3"><code>6f4b74b</code></a> Strict equality</li> <li><a href="https://github.com/actions/setup-python/commit/fa8bde1a9cc6347d06948d66bcd68c598b79eaea"><code>fa8bde1</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied</li> <li><a href="https://github.com/actions/setup-python/commit/c8813ba1bc76ebf779b911ad8ffccbf2e449cb48"><code>c8813ba</code></a> Upgrade <a href="https://github.com/actions"><code>@actions</code></a> dependencies and update licenses (<a href="https://redirect.github.com/actions/setup-python/issues/1303">#1303</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev>@composio/cli@0.2.32-beta.279 |
||
|
Alberto Schiabel
|
aede04995d |
ci(docs): keep docs @composio/* deps current on each SDK sync (#3709)
## Summary The `Docs - Sync guides on SDK changes` workflow updates docs **content** when SDK source changes on `next`, but it never touched `docs/package.json`. Because the docs site is a standalone Bun app **outside** the pnpm workspace — it pins *published* `@composio/*` versions rather than linking workspace source — those pins silently drifted behind the SDK. That drift is what produced the recent breakage in #3705: docs still pinned `@composio/core@0.9.1` while `delete()` shipped in `0.13.1`, so the Twoslash type-check failed and the sync bot worked around it by casting a fake `delete()` onto the session type. ## What this changes In `docs.sdk-change-sync.yml` (gated on the same `has_changes` condition as the rest of the job): - **New step** sets up Node/Bun (via the shared `setup-node-pnpm-bun` action) and realigns every `@composio/*` dependency in `docs/package.json` to its **latest published** release (`npm view <pkg> version` → `^<latest>`), then refreshes `bun.lock` with `bun install`. It scans both `dependencies` and `devDependencies`, is idempotent (no diff → no `bun install`), and warns rather than fails if a version can't be resolved. - **`add-paths`** now includes `docs/package.json` and `docs/bun.lock` so the realignment lands in the PR. - **Content prompt** gains a rule: don't add casts/assertions to compile against an API missing from the published package — document released behavior and let the Twoslash build flag the gap. ## Why pin to *published* (not workspace source) Docs deliberately target what users can `npm install`. Twoslash snippets and the runnable example apps are a contract that the documented API exists in a real release. The PR's existing Twoslash build (`docs-typescript-check.yml`) remains the gate: if a documented feature isn't published yet, the build fails loudly instead of being silently worked around. ## Notes - Complementary to #3705, which fixes the *current* stale pins by hand; this prevents the drift from recurring. - Validated the bump shell logic locally under `bash` (matching the runner): correctly resolves all 10 `@composio/*` devDeps and is a no-op when already current. |
||
|
Alberto Schiabel
|
7fe998c45c |
docs: document session delete() and realign docs @composio/* deps (#3705)
## Summary Documents session deletion (`session.delete()`) and realigns the docs site's `@composio/*` dependencies so the new snippet type-checks against a published SDK. ## Changes - **`docs/content/docs/configuring-sessions.mdx`** — adds a `### delete()` section with Python and TypeScript examples and a version-requirement callout (`@composio/core` ≥ `0.13.1` / `composio` ≥ `0.17.1`). - **`docs/package.json` + `docs/bun.lock`** — bumps `@composio/core` `^0.9.1` → `^0.13.1` (the release that adds `delete()`) and aligns the provider packages to their `^0.10.x`/`^0.11.0` releases (peer `@composio/core >=0.10.0 <1.0.0`). ## Why the dependency bump The docs site type-checks every Twoslash snippet against the `@composio/*` versions pinned in `docs/package.json`. Those pins were stale (`@composio/core@0.9.1`), and `delete()` only exists on the `Session` type from `0.13.1`, so the snippet didn't compile. The original sync run worked around this with a `DeletableSession` cast; this PR fixes the root cause by bumping the pins to published releases that expose `delete()` natively and dropping the cast. The full docs build (Twoslash validation) passes against the bump. ## Review checklist - [ ] `delete()` examples accurately reflect the SDK behavior - [ ] Version callout matches the releases that introduce `delete()` - [ ] No unrelated docs were modified ## Notes - Originally produced by the `Docs - Sync guides on SDK changes` run. - Follow-up https://github.com/ComposioHQ/composio/pull/3709 prevents this pin drift from recurring by realigning the docs `@composio/*` deps automatically on each SDK sync. --------- Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
Alberto Schiabel
|
9bd600a9a2 |
fix(docs): use app token for SDK docs sync PRs (#3706)
This PR: - fixes the `Docs - Sync guides on SDK changes` workflow failure from https://github.com/ComposioHQ/composio/actions/runs/28332657149/job/83933412114 - mints the existing release-bot GitHub App token before checkout - uses that token for checkout, `peter-evans/create-pull-request`, and reviewer requests - keeps reviewer assignment non-blocking so a successful docs PR is not failed by reviewer-request edge cases - verifies the workflow file with `ruby -e 'require "yaml"; YAML.load_file(ARGV.fetch(0)); puts "yaml ok"' .github/workflows/docs.sdk-change-sync.yml`, `mise exec -- pnpm exec prettier --check .github/workflows/docs.sdk-change-sync.yml`, and `git diff --check -- .github/workflows/docs.sdk-change-sync.yml` |
||
|
Alberto Schiabel
|
bfec5f4789 |
chore(ci): use GitHub App client ID input (#3707)
This PR: - replaces the deprecated `app-id` input for `actions/create-github-app-token` with `client-id` - reads the public release bot Client ID from the `RELEASE_BOT_CLIENT_ID` repo variable - keeps `RELEASE_BOT_APP_PRIVATE_KEY` as the only GitHub App secret used by these token steps - updates token generation in docs data sync, SDK reference generation, and TypeScript release workflows - pairs with the one-line update already pushed to https://github.com/ComposioHQ/composio/pull/3706 for the SDK docs sync workflow ## Verification - `rg -n 'app-id:' .github || true` - `rg -n 'client-id:' .github/workflows` - parsed edited workflow YAML with Ruby/Psych - confirmed `RELEASE_BOT_CLIENT_ID` exists as a repo variable - workflow-dispatch smoke run for #3706 passed with `client-id` and no `app-id` deprecation warning: https://github.com/ComposioHQ/composio/actions/runs/28358680527 |
||
|
jkomyno
|
008316ac18 |
Revert "chore(ci): use GitHub App client ID input"
This reverts commit
|
||
|
jkomyno
|
7ef3a786d4 | chore(ci): use GitHub App client ID input | ||
|
Alberto Schiabel
|
9901e01a80 |
feat(py): add tool router session deletion
Release Python 0.17.1 with Tool Router session deletion support.py@0.17.1 |
||
|
jkomyno
|
551790c114 | chore(py): sync 0.17.0 lockfile @composio/slim@0.13.1 py@0.17.0 | ||
|
sdkrelease[bot]
|
156a1eb7b2 |
Release: update version (#3686)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/vercel@0.11.0 ### Minor Changes -@composio/vercel@0.11.0 @composio/mastra@0.10.1 @composio/core@0.13.1 |
||
|
Alberto Schiabel
|
956f9be9b4 |
chore(agents): normalize repo guidance skills (#3666)
This PR: - replaces the duplicated repo-local skill set with the requested canonical `.agents/skills` taxonomy and short router `SKILL.md` files backed by first-level references - makes `.claude/skills` a compatibility symlink to `.agents/skills` and removes hand-maintained Claude skill/rule copies - moves docs agent guidance and decisions into neutral `docs/agent-guidance/` and `docs/decisions/`, with `docs/CLAUDE.md` reduced to a shim - retires CLI Cursor rules after migrating CLI design, Effect source, and client-cache sync guidance into `AGENTS.md` and `cli-command` - adds nested `AGENTS.md` files for TS, core, providers, e2e, Python, Python providers, and docs - adds `pnpm validate:agent-skills` to validate skill frontmatter, taxonomy, references, symlink invariants, stale paths, and command names - implements missing Python `tst` and `snt` nox sessions that existing Makefile targets already exposed - no changeset: repository guidance/tooling only, no published SDK package behavior ## Verification - `pnpm validate:agent-skills` -> `Validated 14 canonical agent skills and guidance invariants.` - `for skill in .agents/skills/*; do python /Users/jkomyno/.codex/skills/.system/skill-creator/scripts/quick_validate.py "$skill" || exit 1; done` -> 14x `Skill is valid!` - `pnpm --dir ts/packages/cli validate:skills` -> `Validated composio-cli skill builds for stable and beta.` - `cd python && uv run nox --list` -> includes `tst` and `snt` - `cd python && uv run nox -s snt` -> 18 passed - `cd python && uv run nox -s tst -- tests/test_imports.py` -> 8 passed - `git diff --check` / `git diff --cached --check` -> clean - stale reference search for retired docs/Claude/Cursor paths -> no matches ## Forward Tests - TypeScript core bug: loaded `bug-fixing`, `typescript-sdk`, `typescript-testing`; found correct root/ts/core `AGENTS.md` route. - Python provider: loaded `python-providers`, `python-testing`; found missing nox sessions, fixed here. - CLI command: loaded `cli-command`; found recording/changeset wording gaps, fixed here. - Cross-SDK drift: loaded `cross-sdk-parity`; again found Python nox drift, fixed here. - Docs + decision: loaded `docs-decisions`; found decision template/index and Twoslash path gaps, fixed here. ## Notes The first normal `git commit` attempt hit a lint-staged/Git stash limitation while replacing `.claude/skills/` with a symlink (`path ... beyond a symbolic link`). The final commit used `--no-verify` after the validators and formatting checks above passed.@composio/cli@0.2.32-beta.278 |
||
|
sdkrelease[bot]
|
02e9e1ab13 |
docs: update TypeScript SDK reference from source (#3685)
## Summary Auto-generated TypeScript SDK reference docs from `ts/packages/core/src/`. Regenerates pages at `docs/content/reference/sdk-reference/typescript/` to reflect changes in the core package's public API (new methods, updated signatures, changed types). Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
Alberto Schiabel
|
cddd66c3ce |
chore(ts): bump Hono, Mastra, and Chrome deps (#3691)
This PR: - bumps `hono`, `@mastra/core`, and `chrome-devtools-mcp` to their current latest published versions - routes the remaining Cloudflare Tool Router Hono consumer through the workspace catalog - updates the `@composio/mastra` `@mastra/core` peer range and adds a patch changeset - fixes `check-peer-deps` to resolve `semver` through the normal package dependency@composio/cli@0.2.32-beta.277 |
||
|
Alberto Schiabel
|
e7bb45f449 |
fix(py): normalize generated SDK doc examples (#3689)
This PR: - normalizes Python SDK reference examples generated from source docstrings - rewrites the `Triggers.parse()` docstring so the generated Flask/FastAPI examples are copy-pasteable - strips nested Markdown fences before wrapping generated examples in MDX code fences - regenerates `docs/content/reference/sdk-reference/python/` - adds regression coverage for the `Triggers.parse()` generated example and fenced example normalization - does not include a changeset because this only changes docs generation, generated docs, and tests ## Verification - `cd python && .venv/bin/python -m pytest tests/test_generate_docs.py -q` - `cd python && .venv/bin/ruff check --config config/ruff.toml composio/core/models/triggers.py scripts/generate-docs.py tests/test_generate_docs.py` - `cd python && .venv/bin/ruff format --check --config config/ruff.toml composio/core/models/triggers.py scripts/generate-docs.py tests/test_generate_docs.py` - `cd python && .venv/bin/python scripts/generate-docs.py` - `cd docs && bun install --frozen-lockfile` - `cd docs && bun run types:check` |
||
|
Alberto Schiabel
|
acf8a9ca1f |
test(cli): cover fish completion install idempotency (#3688)
This PR: - follows up on https://github.com/ComposioHQ/composio/pull/3440 and credits Deepak Singh Kandari / @aptsalt from the original implementation - builds on the fish completion fix already merged in https://github.com/ComposioHQ/composio/pull/3162 - references https://github.com/ComposioHQ/composio/issues/3147 - adds regression coverage for running `composio install --completions` twice under fish - verifies `config.fish` keeps a single PATH marker and never receives completion markers - verifies `~/.config/fish/completions/composio.fish` keeps one completion marker ## Testing - `MISE_TRUSTED_CONFIG_PATHS=$PWD mise exec -- pnpm --filter @composio/cli exec vitest run test/src/commands/install.cmd.test.ts` - `MISE_TRUSTED_CONFIG_PATHS=$PWD mise exec -- pnpm --filter @composio/cli typecheck:test` - `git diff --check origin/next...HEAD` Co-authored-by: Deepak Singh Kandari <deepaksinghkandari07@gmail.com>@composio/cli@0.2.32-beta.276 |
||
|
Rahul Tarak
|
ea2e02071a |
docs: fast-search with mercury-2 (#3687)
## Summary
- Switch the docs Eve agent from the AI Gateway `openai/gpt-5.4-mini`
string to an Inception Labs Mercury 2 OpenAI-compatible chat model.
- Keep tool calling on the chat-completions path and pass Mercury's
`reasoning_effort=medium` through the AI SDK OpenAI adapter.
- Add `DOCS_AGENT_MODEL_FLOW` so the same agent can run either `mercury`
or the old AI Gateway flow for eval comparisons.
- Add docs-agent eve evals covering grounded docs answers, docs
retrieval, citations, and account-specific support refusal.
- Replace the docs-agent retriever with an in-process BM25-style lexical
ranker that returns bounded full content for the top results, so Mercury
gets rich context in one fast tool call instead of a serial
`search_docs` → `read_doc` round trip.
- Precompute BM25 term counts/document frequencies into the generated
`agent/lib/docs-index.ts` snapshot at build time, removing deployed
cold-start corpus construction while keeping retrieval in-process.
- Add opt-in search perf logging (`DOCS_AGENT_SEARCH_PERF_LOG=1`,
optional `DOCS_AGENT_SEARCH_LOG_QUERY=1`) with timings for tokenization,
corpus load/cache, ranking, hydration, total duration, corpus source,
and top URLs.
- Add `eval:agent` and `eval:agent:flows` scripts; `eval:agent:flows`
can run local model-flow comparisons or remote target comparisons via
`DOCS_AGENT_EVAL_TARGETS`.
- Add `INCEPTION_API_KEY` / optional Mercury and gateway model knobs to
`docs/.env.example`, and move `@ai-sdk/openai` to runtime dependencies
for the agent import.
## Notes
- This is intentionally an experiment to see how Mercury's diffusion
model behaves with Eve tool calling (`search_docs` and `read_doc`).
- Preview/runtime environments need `INCEPTION_API_KEY`;
`INCEPTION_MODEL` and `INCEPTION_BASE_URL` are optional overrides.
- The custom fetch prevents accidentally falling back to
`OPENAI_API_KEY` against Inception's endpoint.
- The docs search is lexical/in-memory, not vector search. The slow path
was mostly serial model/tool round trips and cold index construction,
not embedding lookup.
- The generated BM25 snapshot is process-local once loaded: warm for the
lifetime of the running Node/Vercel function instance, and reset on cold
starts, redeploys, or process restarts. The expensive term-count corpus
is now built at docs build time.
- Perf logs omit raw user queries by default; set
`DOCS_AGENT_SEARCH_LOG_QUERY=1` only when you explicitly want raw
query/term logging.
- Local A/B-style eval run:
```bash
DOCS_AGENT_EVAL_FLOWS=gateway,mercury bun run eval:agent:flows --
--strict
```
- Live target comparison:
```bash
DOCS_AGENT_EVAL_TARGETS=baseline=https://<prod>,mercury=https://<preview>
bun run eval:agent:flows -- --strict
```
## Tests
- `bunx eslint scripts/build-agent-index.ts agent/lib/docs.ts
agent/tools/search_docs.ts`
- `bun scripts/build-agent-index.ts` (wrote 133 pages + 1000 toolkits +
1139 BM25 rows)
- `DOCS_AGENT_SEARCH_PERF_LOG=1 EVE_FORCE_BUNDLE=1 bun -e "const
tool=(await import('./agent/tools/search_docs.ts?log=' +
Date.now())).default; await tool.execute({query:'create a session with
github tools'}); await tool.execute({query:'auth config connected
account'});"` (logs cold and warm timing JSON)
- `EVE_FORCE_BUNDLE=1 bun -e "const tool=(await
import('./agent/tools/search_docs.ts?bundle=' + Date.now())).default;
const started=performance.now(); const r=await
tool.execute({query:'create a session with github tools'});
console.log(r.retrieval, r.results[0].url, r.results[0].content.length,
Math.round(performance.now()-started)+'ms');"` (precomputed bundle path,
~12ms)
- `bun -e "const tool=(await import('./agent/tools/search_docs.ts?live='
+ Date.now())).default; const started=performance.now(); const r=await
tool.execute({query:'create a session with github tools'});
console.log(r.retrieval, r.results[0].url, r.results[0].content.length,
Math.round(performance.now()-started)+'ms');"` (live-content path,
~34ms)
- `EVE_FORCE_BUNDLE=1 bun -e "const tool=(await
import('./agent/tools/search_docs.ts')).default; await
tool.execute({query:'create a session with github tools'}); const
started=performance.now(); const r=await tool.execute({query:'auth
config connected account'}); console.log(r.results[0].url,
r.results[0].content.length,
Math.round(performance.now()-started)+'ms');"` (warm path ~2ms)
-
`PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH
./node_modules/.bin/eve info --json` (reports `status: ready`, `model:
inception/mercury-2`, `errors: 0`)
- `DOCS_AGENT_MODEL_FLOW=gateway
PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH
./node_modules/.bin/eve info --json` (reports `status: ready`, `model:
openai/gpt-5.4-mini`, `errors: 0`)
-
`PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH
./node_modules/.bin/eve eval --list`
-
`PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH
bun scripts/eval-agent-flows.ts --list`
- `bun test tests/static/` (16 passed)
- `bun run types:check` currently fails on existing docs type-generation
errors in `app/(home)/docs/changelog/[...slug]/page.tsx`,
`app/(home)/examples/[[...slug]]/page.tsx`,
`app/(home)/toolkits/[[...slug]]/page.tsx`,
`app/llms.mdx/[[...slug]]/route.ts`, `lib/search-index.ts`, and
`lib/source.ts`; no new eval or `docs/agent/agent.ts` errors were
reported.
## Not run
- Real live model evals, because this local environment does not have
`INCEPTION_API_KEY` or AI Gateway credentials.
## Latest update
- Added default eager docs retrieval in the Eve HTTP channel: the server
runs the same BM25 search on the user's message before the first model
step and injects the results as one-turn context.
- Kept `search_docs` and `read_doc` available so Mercury can still
search/read more when the eager context is weak, ambiguous, or missing.
- Added `DOCS_AGENT_EAGER_SEARCH=0` as an escape hatch and labeled perf
logs with `invocation: "eager_context" | "tool"`.
- Updated the loading copy from “Searching the docs…” to “Thinking with
the docs…” so UI latency is not attributed solely to the search call.
## Latest tests
- `bun run lint -- agent/channels/eve.ts agent/tools/search_docs.ts
agent/lib/docs-search.ts components/eve-chat.tsx
evals/docs-agent/grounded-answers.eval.ts`
-
`PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH
node_modules/eve/bin/eve.js info --json` (reports `status: ready`,
`errors: 0`)
- `DOCS_AGENT_SEARCH_PERF_LOG=1 EVE_FORCE_BUNDLE=1 bun -e "import {
searchDocs } from './agent/lib/docs-search'; const r = searchDocs('How
do I create a session in Composio? Keep it brief.', { invocation:
'eager_context' }); console.log(JSON.stringify({count:r.results.length,
top:r.results[0]?.url, content: !!r.results[0]?.content}, null, 2));"`
- `DOCS_AGENT_SEARCH_PERF_LOG=1 bun -e "import { searchDocs } from
'./agent/lib/docs-search'; searchDocs('How do I create a session in
Composio? Keep it brief.', { invocation: 'eager_context' });
searchDocs('How do I create a session in Composio? Keep it brief.', {
invocation: 'tool' });"`
- `bun run types:check` still fails only on the pre-existing docs
type-generation issues listed above.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Alberto Schiabel
|
9ffc696a99 |
feat(vercel): support AI SDK v7 (#3683)
This PR:
- widens the `ai` peer dependency of `@composio/vercel` to `^6.0.0 ||
^7.0.0`, adding AI SDK v7 support and dropping the previously-untested
v5 arm
- adds Docker-based Node e2e compatibility suites for AI SDK v6 and v7
under `ts/e2e-tests/runtimes/node/vercel-ai-sdk-v{6,7}`, auto-discovered
by the existing e2e matrix (so PR CI exercises them)
- each installs the packed `@composio/vercel` tarball, typechecks the
provider against the target `ai` major, and asserts runtime tool
wrapping/execution (object inputs, JSON-string normalization via
`normalizeToolArguments`, `ToolSet` shape)
- the v7 suite additionally exercises v7's `ToolExecutionOptions` passed
to `tool.execute`
- ships a `minor` changeset (the peer-range narrowing removes a
previously-supported major)
- breaking:
- `ai@5` is no longer an accepted peer of `@composio/vercel`; v5
consumers should stay on the prior minor
|
||
|
Rahul Tarak
|
61feaf277b |
fix(docs): point Algolia search at renamed docs_composio index (#3684)
## The bug The live Algolia index was renamed to **`docs_composio`**, but every default in the repo still pointed at the old **`docs_composio_dev_62hi9pqz1l_pages`** in three places: 1. `.github/workflows/docs-search-sync.yml` — `ALGOLIA_INDEX_NAME` fallback 2. `docs/lib/search-index.ts` — `ALGOLIA_DEFAULT_INDEX_NAME` (used by the sync script) 3. `docs/components/custom-search-dialog.tsx` — client query fallback (×2) So unless the `ALGOLIA_INDEX_NAME` Actions variable happened to be set, the **docs-search-sync** workflow rebuilt the dead old index on every push to `next`, while the live site queried a different one. Net effect: search index updates never showed up. ## The fix Repoint the default to `docs_composio` in all three spots (+ README / CLAUDE.md docs). The env overrides still take precedence, so nothing breaks if a variable is set. ## Env to set (so it actually publishes & reads the right index) The code now defaults to `docs_composio`, so the only things that **must** be configured: **GitHub Actions (repo → Settings → Secrets and variables → Actions):** - `ALGOLIA_ADMIN_API_KEY` *(secret, required)* — without it the workflow skips the sync. - `ALGOLIA_APP_ID` *(variable, optional)* — defaults to `62HI9PQZ1L`. - `ALGOLIA_INDEX_NAME` *(variable, optional)* — now defaults to `docs_composio`; set only to override. **Vercel (Production env) — for the live search to query the same index:** - `NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY` *(required; without it the client falls back to `/api/search`)* - `NEXT_PUBLIC_ALGOLIA_APP_ID` = `62HI9PQZ1L` *(optional, defaulted)* - `NEXT_PUBLIC_ALGOLIA_INDEX_NAME` = `docs_composio` *(optional now that the default matches; set it to be explicit)* > If `NEXT_PUBLIC_ALGOLIA_INDEX_NAME` was previously set to the old name in Vercel, update or remove it — otherwise the client keeps reading the old index regardless of this PR. ## Testing - `bun run types:check` passes. - `grep` confirms no remaining references to the old index name. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Abir Taheer
|
605a7263ab |
Add tool router session deletion (#3679)
## Summary Explain the motivation and context for this change. Link to any related issues. Fixes # ## Changes - - ## Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? Describe the tests you ran and instructions so reviewers can reproduce. Include any relevant config/versions. ## Screenshots (if applicable) ## Checklist - [ ] I have read the Code of Conduct and this PR adheres to it - [ ] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [ ] I added tests or explain why not applicable - [ ] I added a changeset if this change affects published packages ## Additional context --------- Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Rahul Tarak
|
b0b7fac9d9 |
docs: featured examples gallery + fix title selection (#3682)
## What
Reworks the `/examples` index into a Modal-style **featured gallery**,
styled to the Composio brand (pulled from `~/composio/landing`): flat
editorial cards, sharp corners, mono uppercase category tags in accent
colors, the signature brand offset-shadow on hover, and real toolkit
logos on white chips.
| Light | Dark |
|---|---|
| Big `font-sans` hero, filter pills with live counts, responsive card
grid | Same, brand-consistent |
### Highlights
- **`<ExamplesGallery>`** — hero, category filter pills (Featured /
General agents / Background agents / Coding agents) with live counts,
responsive 1–3 col grid, staggered load-in.
- **Data-driven from frontmatter.** Card title/description come from
each page's own `title`/`description`. Presentation metadata lives in a
new optional `gallery` block in the frontmatter schema:
```yaml
gallery:
categories: [General agents, Background agents]
logos: [slack]
featured: true
order: 0
```
Examples can belong to **multiple category lanes** (the Pi bot is both
General + Background).
- The index route renders the gallery; nested example pages keep the
standard docs renderer.
### Drive-by fix
`PageActions` lifts a **full-width** row over the page title (`-mt-12`)
to place the "Copy page" button beside it. That invisible overlay sat on
top of the title and blocked selecting/copying it. Fixed by making the
overlay `pointer-events-none` and re-enabling them only on the button
wrapper. Affects every docs page.
## Testing
- `bun run types:check` passes.
- Verified in light + dark: titles/descriptions match page frontmatter,
multi-tag cards, filter counts, logo visibility (GitHub on white chips),
title now selectable, Copy button still clickable.
## Notes
- Category lanes are a fixed enum in two spots (`source.config.ts` enum
+ `CATEGORY_STYLES` color map in `examples-gallery.tsx`) — adding a new
lane is a two-place edit.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Alberto Schiabel
|
20bf1b6345 |
chore(ts): quiet tsdown build warnings (#3665)
This PR: - migrates shared tsdown dependency config from deprecated `external` / `noExternal` aliases to `deps.neverBundle` / `deps.alwaysBundle` - disables noisy Rolldown plugin timing and ineffective dynamic-import diagnostics in shared config while keeping build checks enabled - fixes the `json-schema-to-zod` `JSONSchema7TypeName` import so it stays type-only - keeps the CLI bundle graph aligned with `next` while quieting the dynamic-import warning through `checks.ineffectiveDynamicImport: false` - makes the Node file E2Es treat the current external storage `Unauthorized` upload response as an explicit `UPLOAD_UNAVAILABLE`/skip outcome instead of failing unrelated SDK build PRs Verification: - `pnpm build` - build log scan for `WARN`, deprecated `external` / `noExternal`, `deps.onlyBundle`, `PLUGIN_TIMINGS`, and `INEFFECTIVE_DYNAMIC_IMPORT` - `pnpm --dir ts/packages/cli test -- --runInBand` - `pnpm --dir ts/e2e-tests/runtimes/node/file-roundtrip typecheck` - `pnpm --dir ts/e2e-tests/runtimes/node/tool-router-files typecheck` - `pnpm lint:packages` - CI: TypeScript build/typecheck/test and Node 22/24/25, Deno, Cloudflare, and CLI e2e are green on the latest commit@composio/cli@0.2.32-beta.275 |
||
|
Rahul Tarak
|
9df19b46cc |
chore(python): release 0.17.0 (#3678)
Python SDK 0.17.0 (mirrors the TS `@composio/core` 0.13.0 surface). `make bump` (minor) bumped `pyproject.toml` + all provider packages to 0.17.0; this PR also syncs `composio/__version__.py` and adds the `## [0.17.0]` CHANGELOG entry so the release guard (`__version__` == `pyproject` == `CHANGELOG[0]`) passes — verified locally (`release workflow test passed`). ## 0.17.0 surface - `triggers.parse()` (parse + optionally verify a webhook; empty `verify_secret` now raises instead of silently skipping) and `triggers.set_webhook_subscription()` - `composio.sessions` is the canonical sessions mount; `composio.tool_router` deprecated alias - MCP is opt-in (`mcp=True`); default sessions return native tools - Prefer the `sandbox` session config key (`workbench` still accepted) - `connected_accounts.update_acl()` (graduated from experimental) Merging this triggers the Python publish. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
sdkrelease[bot]
|
d102ab03ca |
Release: update version (#3676)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.13.0 ### Minor Changes -@composio/core@0.13.0 |
||
|
Sarah Simionescu
|
d2e273ba4c |
fix(release): register slim+experimental in root workspaces (unblocks changeset release) (#3675)
## Why The changeset release on `next` (run after #3637 merged) **failed**, so no "Release: update version" PR was created and nothing published: ``` 🦋 error Found changeset add-slim-package for package @composio/slim which is not in the workspace ``` ## Root cause Changesets' package discovery (`@manypkg/get-packages`) reads the **root `package.json` `workspaces`** field, which was stale — it was missing `ts/packages/slim` and `ts/packages/experimental`. Both are present in `pnpm-workspace.yaml`, so pnpm/turbo saw them but changesets did not, and `changeset version` aborts entirely when a changeset references an undiscovered package. ## Fix - `package.json`: add `ts/packages/experimental` + `ts/packages/slim` to `workspaces`. - `.changeset/config.json`: `fixed` `@composio/core` ↔ `@composio/slim` so slim always ships the **same version as core** (slim mirrors the built core runtime). ## Verified locally `changeset version` now resolves cleanly: | package | version | |---|---| | @composio/core | 0.13.0 | | @composio/slim | 0.13.0 (1-1 with core) | | @composio/experimental | 0.1.0 | Merging this re-triggers the TS SDK Release workflow, which will create the Version Packages PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Rahul Tarak
|
97e40b7071 |
fix(release): register slim+experimental in root workspaces; fix slim to core version
The changeset release on `next` aborted with "Found changeset add-slim-package for package @composio/slim which is not in the workspace", blocking the Version Packages PR and all publishes. Root cause: changesets' package discovery (@manypkg/get-packages) reads the root package.json `workspaces` field, which was stale — missing `ts/packages/slim` and `ts/packages/experimental` (both present in pnpm-workspace.yaml, so pnpm saw them but changesets did not). - package.json: add ts/packages/experimental and ts/packages/slim to workspaces - .changeset/config.json: fix @composio/slim to @composio/core so slim always ships the same version as core (slim mirrors the built core runtime) Verified `changeset version` now resolves: core 0.13.0, slim 0.13.0, experimental 0.1.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Rahul Tarak
|
d17a268d3f |
docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637)
Integration branch for the next docs release: a **sessions-first
documentation rewrite** — new and rewritten guides, example pages,
interactive components, and docs tooling — plus the supporting SDK
changes that the new docs describe.
The bulk of this PR is docs (~24k lines across ~150 commits); the SDK
changes (~5k lines) back the new guides.
## Documentation (the bulk)
- **Sessions-first restructure** — reorganized navigation and section
structure (incl. the "Sandbox (prev workbench)" section), with
v3-reorganization redirects so old URLs keep resolving.
- **Rewritten core guides** — quickstart, configuring sessions, triggers
(creating + subscribing to events), proxy-execute, toolkits
enable/disable, and common FAQ, rewritten in the house voice.
- **New example pages** — local-sandbox PR reviewer, daily standup bot,
and slack bot, with runnable build-ups.
- **New interactive components & diagrams** — triggers flow animation,
manage-connections visual, connection-refresh visual, and the
terminal-kit components.
- **Docs tooling** — a docs-graph link-graph connectivity checker,
search reprioritization (deprioritize legacy pages), and SDK-reference
regeneration.
## Supporting SDK changes
**`@composio/core` → 0.13.0 (minor)**
- `composio.sessions.create()` as the first-class sessions API
(`composio.create()` kept as an alias).
- **MCP is opt-in:** default `create()` / `use()` return native-tool
sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface
`session.mcp`. _Migration: read `session.mcp` only after creating with
`{ mcp: true }`._
- `session.sandbox` is the canonical resolved config;
`session.workbench` kept as a deprecated alias. `sandbox` is the
preferred session-config key (`workbench` still accepted).
- `connectedAccounts.updateAcl()` graduated from experimental (alias
kept).
- `triggers.parse()` (parse + optionally verify an incoming webhook) and
`triggers.setWebhookSubscription()`.
**`@composio/experimental` → minor** — local-workbench helpers moved
onto the `@composio/experimental/workbench` subpath (out of
`@composio/core/experimental`), keeping the ~14 KB embedded Python
helper out of core. Plus the experimental Pi provider.
**`@composio/slim` → minor.**
**Python → 0.17.0** — mirrors the TS surface: `composio.sessions` mount
(`tool_router` deprecated), `triggers.parse()` /
`set_webhook_subscription()`, the `sandbox` config key, and
`connected_accounts.update_acl()`.
## Review response (#3664)
Addressed the `@composio/core` review:
- **Security:** `triggers.parse()` no longer fails open — a
present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`)
now throws instead of silently skipping verification; omitting it stays
an explicit opt-out (both SDKs).
- Removed snake_case leakage from `transformWebhookSubscription` (+ the
index signature that allowed it).
- **Removed** the TS-only `connectedAccounts.link()` toolkit
auto-resolve (shipped with cancellability / orphaned-auth-config bugs
and was effectively undocumented; to be reintroduced properly later).
- Unified Python error types on `ValidationError`; added `mcp=True`
Python tests; fixed runtime-portability + error-type test assertions.
- Polished deprecation messages; fixed the backwards `/experimental`
`@deprecated` note and the `SessionWithMcp` JSDoc.
## Testing
- **TS:** `@composio/core` + `@composio/experimental` typecheck pass;
vitest green for the touched suites.
- **Python:** `test_tool_router.py` + `test_triggers.py` pass (161
tests).
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev>
Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Sarah Simionescu <sarah@composio.dev>
Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>
|
||
|
palash-c
|
eeca911392 | Revert "docs: add Security and Data section (#3525)" (#3668) | ||
|
palash-c
|
a098e39b18 |
docs: add Security and Data section (Security + Data retention) (#3525)
Adds a **Security and Data** docs section (below Triggers and webhooks) with two pages: - **Security** (`/docs/security/overview`) — posture, compliance and the [Trust Center](https://trust.composio.dev), org/project isolation, credential protection (AES-256-GCM at rest, TLS), token redaction, webhook signing, responsibilities, and vulnerability reporting. - **Data retention** (`/docs/security/data-retention`) — what Composio stores, **1-year** retention, the per-project **Log storage → "Don't store data"** option (Composio keeps an audit record but does not store tool-call payloads), an honest **"Where your data goes"** section (data still flows to the destination provider and sub-processors during execution; links the [Trust Center sub-processor list](https://trust.composio.dev/subprocessors)), and a contact-sales path for contractual arrangements. Includes a redacted dashboard screenshot. Note: "Don't store data" controls what Composio retains; it is not framed as a zero-data-retention guarantee. 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Palash Kala
|
ad8b10dc48 |
docs(security): drop file-TTL configurability line (control not shipped yet)
Keep the default 1-hour file TTL description; remove the per-project Settings → File TTL configurability sentence until that dashboard control ships. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Palash Kala
|
a072697252 |
docs(security): tie file payloads in object storage to the file TTL
Split the "Where your data goes" file/trigger bullet: file payloads live in object storage only for the file TTL (1h default) then expire, distinct from trigger destinations which receive events in real time. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Palash Kala
|
63e5755507 |
docs(security): clarify Log storage toggle semantics + file TTL
Per the data-storage/privacy review: - Document that the Log storage setting is forward-looking (pause/resume): switching to "Don't store data" stops storing new payloads but does NOT delete logs already stored, and switching back does not backfill the gap. - Add file availability: tool-execution files are presigned URLs with a default 1-hour TTL, configurable 1-24h per project in Settings. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
palash-c
|
81ce48001a |
docs: improve & correct the Rate Limits reference page (#3638)
New docs page: **Rate limits & usage** (`docs/content/docs/rate-limits.mdx`, registered under "Other topics"). Closes the recurring "rate limits / suspension / SLA" support questions (Plain SUP-807 theme) with one canonical, honest answer. All numbers/headers verified against `apps/apollo/src/lib/ratelimit/` (constants.ts + middleware.ts): - **Platform limits:** per-org, fixed 1-min window; live limit in `X-RateLimit` / `-Remaining` / `-Window-Size`; `429` + `Retry-After` on exceed. Plan defaults (Hobby/Starter 2k, Growth 10k, Enterprise effectively unlimited) shown as **defaults with the header as authoritative**. - **No automated suspension** — throttle only; the only hard block is a manual `403`. - **Upstream provider 429s** (Gmail/Slack/Ads) distinguished from platform limits → BYO-OAuth (custom auth) for prod. - **Multi-tenant**: single account + `userId` per end-user is recommended. - Honest gaps: **no public status page / health webhook invented**; SLA routed to Enterprise. Approach informed by how Nango/OpenAI/Stripe/GitHub document limits (mechanism + headers as the contract, not a brittle per-plan matrix). ### Before merge - [ ] **Confirm the Vercel preview build is green.** Local `bun run build` could not be run this session due to an environment-level `bun` `CouldntReadCurrentDirectory` fault (reproduced across worktrees, unrelated to this change). The page **compiled + typechecked** via `node next build`, and it contains **no twoslash code blocks** (only python/json/bash fences), so the usual compile-break risk is absent — but please let the preview confirm full static generation. - [ ] Sanity-check the plan-default numbers are OK to publish (they're real but can drift; the doc labels them defaults and points to the header as source of truth). - [ ] Decide whether to add a real status-page link if/when one exists (currently omitted on purpose). - [ ] Preview: `docs-git-docs-rate-limits-usage.preview.composio.dev` |
||
|
palash-c
|
6ab797c88f |
changelog: PostHog region is now a per-connection field (#3593)
Adds a changelog entry: the PostHog **region** (`us`/`eu`) is now a per-connection field instead of an auth-config field. Existing connections were migrated (default `us` stays default; non-default values carried over), so no user action and no re-auth. Pairs with the customer FYI email (Linear PRO-310) and Mercury PR #24717 (field relabel "Region" + corrected `us`/`eu` description). ### Before merge - [ ] Preview renders + appears in the changelog index: `docs-git-changelog-06-17-26-posthog-region.preview.composio.dev` - [ ] Links resolve in preview (Link/Initiate API refs, PostHog toolkit docs) - [ ] Publish date `2026-06-17` still correct at merge time - [ ] Mercury PR #24717 merged (so the dashboard field already reads "Region" / `us`,`eu`) Local `bun run build` green (1412/1412 static pages). |
||
|
Alberto Schiabel
|
de2657c30d |
fix(ts-builders): mark @composio/ts-builders private (do not publish to npm) (#3663)
Replaces #3662 with the opposite (correct) approach: keep `@composio/ts-builders` **internal/unpublished**, not public. This PR: - marks `@composio/ts-builders` as `private: true` so changesets stops attempting to publish it to npm ## Why `@composio/ts-builders` is an internal AST-builder helper consumed **only** by `@composio/cli` (`"@composio/ts-builders": "workspace:*"`). `@composio/cli` is itself `private: true` and is distributed as **bundled Bun binaries via GitHub releases**, not as an npm package — so it bundles its workspace deps and never resolves them from npm. **No package published to npm depends on `ts-builders`.** It was simply missing `private: true`. With the repo-wide changeset `access` default of `restricted` and no `publishConfig.access: public` opt-in, the first-ever publish 404'd in the 2026-06-25 release: ``` E404 404 Not Found - PUT https://registry.npmjs.org/@composio%2fts-builders ``` ## Consistent with existing CLI-only helpers `@composio/cli-keyring` and `@composio/cli-local-tools` are already set up exactly this way — `private: true`, consumed by the CLI via `workspace:*`, intentionally **not on npm**. `ts-builders` now matches them. ## Effect - `changeset publish` skips private packages, so future release runs no longer fail on `ts-builders`. - The CLI keeps consuming it through the workspace (bundled into the binary); npm resolution is never involved. - The 14 packages already published on 2026-06-25 don't reference `ts-builders`, so the published dependency graph is already self-consistent — this only stops the spurious publish failure going forward. No version bump and no `publishConfig` needed.@composio/ts-builders@0.2.0 |
||
|
sdkrelease[bot]
|
9764ce33ff |
Release: update version (#3616)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.12.0 ### Minor Changes -@composio/core@0.12.0 @composio/json-schema-to-zod@0.2.0 @composio/claude-agent-sdk@0.10.0 @composio/cli-keyring@0.2.0 @composio/cli-local-tools@0.1.0 @composio/cloudflare@0.10.0 @composio/vercel@0.10.0 @composio/google@0.10.0 @composio/openai@0.10.0 @composio/mastra@0.10.0 @composio/anthropic@0.10.0 @composio/llamaindex@0.10.0 @composio/langchain@0.10.0 @composio/openai-agents@0.10.0 @composio/cli@0.2.32-beta.274 |
||
|
Alberto Schiabel
|
6e7fc24d93 |
fix(ts): disable publint pack under Turbo to fix flaky build ENOENT (#3661)
This PR: - fixes the intermittent `E2E Test CLI (scratch)` → **Build** failure seen on the changeset release PR #3616, where `@composio/anthropic#build` died with: ``` Error: ENOENT: no such file or directory, open '/tmp/tsdown-pack-XXXXXX/composio-anthropic-0.10.0.tgz' ``` - gates `publint` with `!isTurboTask` in `tsdown.config.base.ts`, mirroring the existing ATTW workaround, so neither publish-readiness check packs a tarball under Turbo ## Root cause `tsdown.config.base.ts` already disabled **ATTW** under Turbo to dodge a "tarball path bug for scoped packages", but left **publint** enabled with `pack: 'pnpm'`. In tsdown the pack is shared and runs whenever *either* check is enabled: ```js if (publintConfigs.length || attwConfigs.length) { const tarball = await packTarball(pkg.packageJsonPath); // pnpm pack → temp dir → readdir → readFile ... } ``` So disabling ATTW alone did **not** stop the pack — publint kept triggering it, and with it the intermittent `readdir`-then-`readFile` race where the packed `.tgz` is gone by the time `readFile` runs. It's flaky: this run it hit `@composio/anthropic` while 14 sibling scoped packages packed fine. ## Fix `publint.enabled: true` → `publint.enabled: !isTurboTask`. With both ATTW and publint disabled under Turbo, `packTarball()` is never called in workspace/CI builds, eliminating the race. Direct package builds (no `TURBO_HASH`) keep running both checks with packing — where the bug does not occur. ## Verification (local, `--force` to bypass cache) - **Turbo build before:** `[publint]` runs for every package (packs the tarball) → race surface present. - **Turbo build after:** `0` publint runs, `3 successful, 3 total`, all `🙏 Build succeeded!` → pack step gone. - **Direct build after** (`env -u TURBO_HASH pnpm build` in `providers/anthropic`): both `✔ [attw]` and `✔ [publint]` run and pass → coverage retained off-Turbo. |
||
|
Alberto Schiabel
|
0ece269c73 |
docs(py): complete 0.16.0 CHANGELOG before release (#3660)
This PR: - completes the Python `0.16.0` CHANGELOG entry, which previously documented only the version + dependency bump even though six user-facing fixes landed on the unreleased `0.16.0` since the entry was written (`py@0.15.0..HEAD`) - refreshes the `0.16.0` date to its actual release date (`2026-06-25`) - is a prerequisite for tagging `py@0.16.0` and publishing to PyPI — PyPI is currently at `0.15.0`; `0.16.0` was bumped in-repo but never tagged or published, and no further version bump was made for the six follow-up fixes ## Context `0.16.0` is unreleased (PyPI's latest stable is `0.15.0`, there is no `py@0.16.0` tag), and `pyproject.toml` / `__version__.py` were never bumped past `0.16.0`. So these six fixes belong to `0.16.0`, not a new version. The newly documented changes: - file `$ref`/`$defs` dereferencing so auto upload/download flags behind a reference aren't dropped (e.g. `GMAIL_GET_ATTACHMENT`) - disabling retries on non-idempotent `tools.execute()` / `tools.proxy()` writes to prevent duplicate side effects - bounded `(connect, read)` timeouts on session file transfers and presigned S3 paths - centralized provider-visible tool schema aliasing across Anthropic, Claude Agent SDK, Gemini, Google ADK, and OpenAI Agents - deep-copying the OpenAI Agents tool schema before stripping `examples`/`default` Plus the already-noted `composio-client` `1.39.0` → `1.41.0` bump and the dependency-range / uv-lock refresh. Once merged, release with: \`\`\`bash git tag py@0.16.0 <merge-commit> && git push origin py@0.16.0 \`\`\`py@0.16.0 |
||
|
Alberto Schiabel
|
f6b5505739 | fix(core): preserve SDK reference types | ||
|
github-actions[bot]
|
4312e0cae3 |
docs: update documentation for new changelog entries (#3458)
## Summary Automated documentation updates triggered by new changelog entries merged to next. Generated by Codex via GitHub Actions. Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
Sarah Simionescu
|
417d614ef9 |
ci: add bump-homebrew-tap workflow (#3355)
## Summary - New workflow that auto-bumps the Homebrew formula in [ComposioHQ/homebrew-tap](https://github.com/ComposioHQ/homebrew-tap) whenever a stable CLI release is published. - Triggers on `release: published` for tags matching `@composio/cli@*`. Skips beta/rc/alpha tags. Also exposes `workflow_dispatch` for manual replay. - Pulls SHA256s from the release's `checksums.txt`, edits `Formula/composio.rb` in the tap repo, and commits/pushes (no-op if already current). ## Setup required before this can run - Create a fine-grained PAT scoped to `ComposioHQ/homebrew-tap` only, with `Contents: read/write`. - Add it as a repo secret named `HOMEBREW_TAP_TOKEN` in this repo. Without that secret the checkout step will fail; the workflow won't break anything else. ## Test plan - [ ] Land this PR - [ ] Add `HOMEBREW_TAP_TOKEN` secret - [ ] Manually run via `workflow_dispatch` with tag `@composio/cli@0.2.28` — should be a no-op (formula already at 0.2.28) - [ ] Verify next CLI release auto-bumps the formula --------- Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
31315357dd |
fix(py): correct without_retries rationale, preserve strict validation, pin copy() contract (#3658)
Review follow-up to #3657 (squash-merged before these review fixes could land on it). No behaviour change to the retry scoping itself — this tightens correctness, docs, and test coverage around the `without_retries` mechanism. - **Correct the `without_retries` caching rationale.** The previous docstring justified caching with "each clone creates a new `ContextVar`, and dynamically-created `ContextVar`s are never garbage-collected." That is false for this code path: `request_ctx` is only ever `.get()`, never `.set()`, so it is reclaimed by refcounting on drop (measured: 500k get-only clones leak ~0 KiB; the CPython leak only occurs with `.set()`). Caching is kept because it avoids constructing a fresh `HttpClient` on every `execute`/`proxy` (the hottest path) — the real, stated justification now. - **Preserve `_strict_response_validation` on the clone.** The Stainless-generated `copy()` drops it, so the no-retry sibling silently reverted to the default (`False`) even when the parent had it enabled. The `copy()` override now threads it through `_extra_kwargs` alongside `provider`, so the sibling differs from the parent only in `max_retries`. - **Document the scope boundary.** The `without_retries` docstring now states that only `tools.execute` / `tools.proxy` are de-retried; other non-idempotent writes (`auth_configs.create`/`update`/`delete`, `mcp.update`/`delete`, `connected_accounts.delete`/`refresh`, `link.create`) keep the default retries (most are naturally idempotent on retry; the durable fix is backend idempotency keys). - **Add regression coverage:** the clone preserves `_strict_response_validation`, plus contract guards pinning the Stainless `copy`/`_extra_kwargs`/`with_options` internals the override relies on — so a `composio_client` regen that breaks the contract fails as an obvious assertion rather than a cryptic `TypeError`. - Minor: fix the `x-sdk-version` `"unknwon"` → `"unknown"` typo and tighten `te.Self` typing on the cache field/property. No changeset (Python-only change; changesets are TypeScript-only). |
||
|
venkat82
|
0c17fcd9fe |
docs: correct enum-rename slugs in 2026-03-28 changelog (#3391)
## Summary Follow-up to #2941. The "Renamed enum slugs" section of the 2026-03-28 changelog (`docs/content/changelog/03-28-26-tool-consolidation-enum-renames.mdx`) lists 347 Old Enum → New Enum pairs that don't line up with the actual class-name-derived slugs delivered by mercury PR #17949 (commit `12d585aa7e`, "fix: rename low-usage action class names to cleaner slugs"). This PR replaces that section with the verified table. ### How slugs are formed ```python enum = inflection.underscore(cls.__name__).upper() slug = enum if enum.startswith(TOOLKIT) else f"{TOOLKIT}_{enum}" ``` Slug is derived from the **class name** of the action, not the file name and not the `name` attribute. (Source: `mercury/tools/_base/action.py` `set_metadata` / `set_tool`.) ### Audit results vs. existing docs section | Category | Count | |---|---| | Original docs pairs that match PR #17949 exactly | 291 | | Pairs with **wrong New Enum** (PR's actual new differs) | 1 | | Pairs whose **old class never existed** in any commit | 5 | | Pairs that refer to renames done in **other PRs** (or tool removals) | 20 | | Pairs claiming a rename **that never happened** (old class still present at HEAD with original slug) | 30 | | **Real PR #17949 renames missing from docs and still valid at HEAD** | **1,153** | | Total entries originally listed | 347 | | Total entries in this rewrite | **1,445** | ### Notable corrections - `SUPABASE_UPDATES_PROJECT_S_SUPAVISOR_CONFIG` → docs said `SUPABASE_UPDATE_SUPAVISOR_CONFIG`; **actual** is `SUPABASE_UPDATE_PROJECT_SUPAVISOR_CONFIG` (class `UpdateProjectSupavisorConfig` at `apps/supabase/actions/generated/updates_project_s_supavisor_config.py`). - `SLACK_DELETE_MESSAGE` is **not a real slug**. The chat-deletion action is class `DeletesAMessageFromAChat`, slug `SLACK_DELETES_A_MESSAGE_FROM_A_CHAT`. Removed from the table. - All eight `PIPEDRIVE_*A_*` entries (`ADD_A_DEAL`, `ADD_A_NOTE`, `DELETE_A_PERSON`, `GET_DETAILS_OF_A_PERSON`, `LIST_PARTICIPANTS_OF_A_DEAL`, `UPDATE_A_DEAL`, `UPDATE_A_LEAD`, `UPDATE_A_PERSON`) still exist at HEAD with their original slugs — removed from the renames table. - 14 Slack entries that claimed renames (e.g. `SLACK_FETCH_TEAM_INFO` → `SLACK_GET_TEAM_INFO`) were never executed; class names still match the original slug. Removed. - Whole toolkits previously omitted that PR #17949 actually renamed and that remain valid at HEAD: PostHog (179), Trello (63), Salesforce (41), Vercel (39), Twitter (36), Google Analytics (25), Dropbox (18), Icypeas (5), Reddit (2), YouTube (2), Apollo, Facebook, Hyperbrowser, Telegram (1 each). ### Front-matter description / intro paragraphs Updated count from "1,545 enum slugs across 24 toolkits" → "1,445 enum slugs across 37 toolkits" to match the rewritten table. ### Out of scope This PR does **not** change the "Deprecated tools" or "Consolidated (removed) tools" sections — those describe a different consolidation effort and are unrelated to the class-rename audit. ## Test plan - [ ] Spot-check 10–20 random entries from the rewritten table against the actual class definition in `mercury` (`apps/<toolkit>/actions/`) to confirm `inflection.underscore(cls.__name__).upper()` matches the listed New Enum. - [ ] Confirm `<Accordions>...</Accordions>` block renders correctly on `docs.composio.dev` preview. - [ ] Confirm none of the 30 "rename never happened" entries listed in the audit show up in the new table. --------- Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
Alberto Schiabel
|
09b552aa03 |
fix(py): disable retries on non-idempotent tool writes to prevent duplicate side effects (#3657)
This PR: - stops the Python SDK from silently retrying `tools.execute` and `tools.proxy`, which are non-idempotent POST writes. The Stainless-generated client retries POSTs by default (`max_retries=2`) on read timeouts, 429, 5xx, and connection errors. A read timeout is unsafe to retry — the request may already be in flight on the backend — so a retry can duplicate the side effect, e.g. send an email twice. Reported in https://github.com/ComposioHQ/composio/issues/3586 - routes both write paths through a new `client.without_retries` — a cached, retry-disabled (`max_retries=0`) clone of the `HttpClient`. Reads and lists keep the default retries, so resilience is unchanged for idempotent calls - overrides `HttpClient.copy()` to re-inject the required `provider` keyword and re-aliases `with_options`, since the generated `copy()` rebuilds via `self.__class__(...)` without `provider` — previously `with_options(max_retries=0)` raised `TypeError` on the subclass - caches the no-retry sibling instead of cloning per call: each clone creates a new `ContextVar`, and dynamically-created `ContextVar`s are never garbage-collected - adds `tests/test_no_retry_writes.py`: writes hit the transport exactly once on a retryable 5xx, reads still retry-then-succeed (proving the scoping), and a regression guard for the `copy()` override - interim fix only — the durable solution is idempotency keys, tracked in https://github.com/ComposioHQ/composio/issues/3654 (gated on backend support), which supersedes this once available No changeset (Python-only change; changesets are TypeScript-only). |
||
|
ly-wang19
|
95b7b7f649 |
fix(openai_agents): deep-copy tool schema before stripping examples/default (#3632)
## Problem `OpenAIAgentsProvider.wrap_tool` mutates the caller's `Tool.input_parameters`. It shallow-copies the schema and then strips keys from the nested property dicts **in place**: ```python modified_schema = tool.input_parameters.copy() # shallow copy modified_schema["additionalProperties"] = False _remove_examples_from_schema(modified_schema) # del prop["examples"/"pattern"/"default"] ``` `_remove_examples_from_schema` recurses into `schema["properties"][*]` and does `del prop_value["examples"]`, `del prop_value["pattern"]`, `del prop_value["default"]`. Because `dict.copy()` is shallow, `modified_schema["properties"]` (and every nested property dict) is the **same object** as the original, so those deletions strip `examples`/`pattern`/**`default`** out of the caller's `Tool.input_parameters`. Since essentially every Composio tool carries `default`/`examples` on its properties, wrapping a tool silently corrupts its schema. Wrapping the same `Tool` twice, reusing it with another provider, or inspecting it after wrapping then sees the defaults gone. This is the only wrap path using a shallow `.copy()` + nested mutation — the rest of the codebase deep-copies before mutating schemas, e.g. `composio/utils/shared.py` (`schema = copy.deepcopy(schema)`, with the docstring *"The schema is deep-copied before any mutation so the caller's original is never modified."*) and `Tools._get` (`tool.model_copy(deep=True)`). ## Fix Deep-copy the schema before mutating (`copy.deepcopy(tool.input_parameters)`), so `_remove_examples_from_schema` only edits the provider-local copy. One-line change + `import copy`. ## Test Added `python/providers/openai_agents/tests/test_provider.py::test_wrap_tool_does_not_mutate_input_parameters` — builds a tool whose properties carry `default`/`examples`/`pattern`, snapshots `input_parameters`, calls `wrap_tool`, and asserts both sides of the contract: - the caller's original `Tool.input_parameters` is unchanged - the returned `FunctionTool.params_json_schema` is still normalized for OpenAI Agents (`additionalProperties: false`, with `default`/`examples`/`pattern` stripped) - **Before:** the assertion fails — `owner` loses `default`/`examples`, `repo` loses `pattern`. - **After:** `Tool.input_parameters` is untouched while the wrapped schema remains sanitized. Verification: - `uv run pytest python/providers/openai_agents/tests/test_provider.py -q` → **1 passed** - `uv run ruff check python/providers/openai_agents/composio_openai_agents/provider.py python/providers/openai_agents/tests/test_provider.py` → clean - `uv run ruff format --check python/providers/openai_agents/composio_openai_agents/provider.py python/providers/openai_agents/tests/test_provider.py` → clean Co-authored-by: ly-wang19 <ly-wang19@users.noreply.github.com> |
||
|
Alberto Schiabel
|
d94a49ff43 |
fix(py): centralize tool schema aliasing (#3652)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3625, https://github.com/ComposioHQ/composio/pull/3629, and the Python SDK/provider-side fix proposed by https://github.com/ComposioHQ/composio/pull/3504 - adds `alias_tool_input_schema` / `restore_tool_arguments` for provider-visible schemas and backend argument restoration - keeps `substitute_reserved_python_keywords` / `reinstate_reserved_python_keywords` as compatibility wrappers - preserves the existing Python keyword alias style (`from` -> `from_rs`), aliases invalid Python parameter names like `$top`, avoids leading-underscore aliases so Pydantic-backed providers can build models, and caps aliases at 64 characters for Anthropic-style tool schema validators - dereferences internal `$ref` / `$defs` before aliasing so referenced object properties are exposed through the same safe provider-visible names - restores Gemini manual `handle_response` arguments with the per-tool alias map before execution - wraps Google ADK tools with aliased callable signatures and restores original backend argument names - wraps Anthropic and Claude Agent SDK tool schemas with the same shared alias map and restores original backend argument names before execution - fixes the package-local Claude Agent SDK provider tests so they run without `pytest-asyncio` and keep using the provider-visible schema conversion hook - adds dependency-light core tests for helper behavior, `$ref` aliasing, Pydantic model compatibility, Gemini manual response, Google ADK wrapping, Anthropic wrapping, and Claude Agent SDK wrapping Local validation: - `uv run --project python pytest python/tests/test_tool_schema_aliasing.py python/tests/test_schema_parser.py python/tests/test_json_schema.py python/tests/test_imports.py -q` -> 112 passed - `PYTHONPATH=python uv run --project python --with-editable ./python/providers/claude_agent_sdk pytest python/providers/claude_agent_sdk/tests/test_provider.py -q --timeout=20` -> 16 passed - `uv run --project python --with-editable ./python/providers/langchain pytest --ignore-glob='python/tests/test_type_inference*.py' python/tests/ -q` -> 742 passed, 31 skipped - `uv run --project python --with-editable ./python --with-editable ./python/providers/langchain python <LangChain $top wrap smoke>` -> wrapped args schema field `param_top` - `uv run --project python --with-editable ./python --with-editable ./python/providers/langgraph python <LangGraph $top wrap smoke>` -> wrapped args schema field `param_top` - `uv run --project python ruff check --config python/config/ruff.toml python/composio/utils/shared.py python/tests/test_tool_schema_aliasing.py` -> passed - `uv run --project python ruff format --check --config python/config/ruff.toml python/composio/utils/shared.py python/tests/test_tool_schema_aliasing.py` -> passed - `git diff --check` -> passed Note: #3500's hosted MCP emission-layer report is already closed; this PR covers the Python SDK/provider surface rather than changing hosted MCP schema emission. |
||
|
Alberto Schiabel
|
aeeb471c63 |
fix(py): resolve $ref/$defs so file flags behind a reference aren't dropped (#3653)
## Problem
Tools whose parameter schemas express their file fields through a
`$ref`/`$defs` indirection lose auto file handling. With
`dangerously_allow_auto_upload_download_files=True`, a
`file_downloadable` output behind a `$ref` is never downloaded (the raw
`{name, mimetype, s3url}` object is passed through), and a
`file_uploadable` input behind a `$ref` is never staged — silently, with
no error.
`GMAIL_GET_ATTACHMENT` is the canonical shape — the flag sits two `$ref`
hops deep:
```
data → $ref → #/$defs/GetAttachmentResponse → file → $ref → #/$defs/FileDownloadable (file_downloadable: true)
```
**Root cause:** the hand-rolled walkers in
`composio/core/models/_files.py` (`_has_file_property`,
`_substitute_file_upload_value`, `_substitute_file_download_value`, …)
recurse through `properties`/`anyOf`/`oneOf`/`allOf`/`items` but **never
dereference `$ref`**, so a flagged node reachable only through a
reference is invisible to them.
Fixes https://github.com/ComposioHQ/composio/issues/3506
## Approach
Rather than teach each walker to dereference — which means threading a
root schema through ~10 methods, re-deriving `$ref` handling in each,
and risking unbounded recursion on cyclic schemas — this introduces a
single **`dereference_json_schema`** utility and inlines references
**once at the `FileHelper` boundary** (`process_file_uploadable_schema`,
`substitute_file_uploads`, `substitute_file_downloads`). The walkers
stay reference-agnostic.
This mirrors the TypeScript SDK's `dereferenceJsonSchema` (the
counterpart fix in #3566 for the TS twin of this bug, #3307) so both
SDKs share one behavioral contract. Resolving once at the boundary also
gives every walker `$ref` support for free — including keywords they
never special-cased (`additionalProperties`, `patternProperties`,
`prefixItems`, `not`), because the resolver walks containers
reflectively.
## What's in the utility (`composio/utils/json_schema.py`)
Faithful port of the TS guards:
- **Cycle safety** — breaks both `$ref` cycles and live-object identity
cycles with a permissive `{type: object, additionalProperties: true}`
sentinel. (A per-node lazy resolver without threaded cycle tracking
infinite-loops on a self-referential schema; there's a regression test
for exactly this.)
- **Depth caps** — `MAX_REF_CHAIN_DEPTH=100` / `MAX_NODE_DEPTH=512`
raise a typed `JSONSchemaRefResolutionError` instead of exhausting the
interpreter (with a `RecursionError` backstop converted to the same
typed error).
- **Sibling-keyword merge** — Draft 2020-12 semantics (siblings win on
collision), so a `description`/`default` next to a `$ref` survives.
- **External-ref passthrough** — `http(s)://` refs are left untouched
and logged once for audit.
- **`sentinel` mode** — a dangling `$ref` (an API schema that emits
`$ref` with no `$defs` block,
https://github.com/ComposioHQ/composio/issues/3307) degrades to the
permissive sentinel + an LLM-visible hint, instead of aborting the tool
call. The `FileHelper` uses this mode for API-sourced schemas.
- **Non-mutating** — returns a new schema; `$defs`/`definitions` are
stripped from the inlined root.
## Tests
- `python/tests/test_json_schema.py` — 30 cases mirroring the TS
`jsonSchema.test.ts` contract (chains, reflective container walk, legacy
`definitions`, sibling merge, cycles, depth caps, pointer-escape
decoding, array-index pointers, full `sentinel`-mode suite).
- `python/tests/test_files.py` — end-to-end regressions through the
public methods: download/upload behind `$ref`/`$defs` (the #3506 repro),
the LLM-facing input transform, graceful degradation of a dangling
`$ref`, and a **self-referential schema that must not recurse
infinitely**.
- `nox -s chk` (ruff + mypy) green; `nox -s tst` for the file/execution
suites green.
## Notes
Supersedes #3545 (third-party PR that fixed the same bug by threading
`root_schema` through each walker). That diagnosis was correct; this
takes the centralized route consistent with the TS SDK and adds the
cycle/depth guards. No changeset — Python-package change.
|
||
|
Xiaoju
|
dd40a9bb6f |
fix(py): bound file transfer requests with timeouts (#3563)
## Summary - add bounded `(connect, read)` timeouts to Python SDK session file downloads and uploads - add the same timeout coverage to presigned S3 upload/download paths used by file helpers - convert timeout/request failures into the SDK's existing file errors and cover them with tests Fixes #3560 Fixes #3561 Fixes #3562 ## Changes - `RemoteFile.buffer()` now uses the existing file transfer timeout constants and preserves file context on request failures - `ToolRouterSessionFilesMount.upload()` and S3 upload helpers now bound presigned `PUT` requests - `FileDownloadable.download()` now bounds streaming `GET` requests, wraps streaming read failures, and closes the response - added regression tests for request timeouts and timeout arguments - added a changeset for the published SDK change ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? - [x] `D:\anaconda3\envs\yolov12\python.exe -m ruff check python\composio\core\models\tool_router_session_files.py python\composio\core\models\_files.py python\tests\test_tool_router_session_files.py python\tests\test_files.py` - [x] `D:\anaconda3\envs\yolov12\python.exe -m ruff format --check python\composio\core\models\tool_router_session_files.py python\composio\core\models\_files.py python\tests\test_tool_router_session_files.py python\tests\test_files.py` - [x] `COMPOSIO_CACHE_DIR=<repo>\.tmp-composio-cache D:\anaconda3\envs\yolov12\python.exe -m pytest python\tests\test_tool_router_session_files.py python\tests\test_files.py::TestUploadBytesToS3 python\tests\test_files.py::TestFileDownloadablePathTraversal::test_safe_filename_passes_through python\tests\test_files.py::TestFileDownloadablePathTraversal::test_download_uses_timeout python\tests\test_files.py::TestFileDownloadablePathTraversal::test_download_timeout_raises_error python\tests\test_files.py::TestFileDownloadablePathTraversal::test_download_stream_timeout_raises_error` Note: I also ran the full `python\tests\test_tool_router_session_files.py python\tests\test_files.py` pair locally. The new and related tests passed, but the full run has one pre-existing Windows-specific failure in `TestFileDownloadablePathTraversal::test_empty_name_safe_fails_at_write_time`: opening a directory for writing raises `PermissionError` on Windows instead of the test's expected `IsADirectoryError`. ## Screenshots (if applicable) N/A ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages ## Additional context This keeps the existing `(5s connect, 60s read)` timeout convention already used by the Python SDK's URL fetch helpers. --------- Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
507318d56a |
fix(anthropic): harden tool property-key sanitizer (#3650)
This PR (builds on https://github.com/ComposioHQ/composio/pull/3649, already merged) hardens the Anthropic tool property-key sanitizer from a multi-agent review, then extracts the mechanism into a reusable core util. **Touches two packages:** `@composio/core` (new util) and `@composio/anthropic` (consumes it). ### Correctness / robustness - **Prototype-safe restoration** — reverse maps and the rebuilt argument object are `Object.create(null)`, so a tool call using a key matching an `Object.prototype` member (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, …) no longer throws a `TypeError` or silently corrupts the backend payload, and `Object.prototype` is never mutated. - **Full schema coverage** — illegal keys are sanitized wherever they appear: `allOf`/`anyOf`/`oneOf`, `not`/`if`/`then`/`else`, `prefixItems`, `additionalProperties`/`patternProperties`, `$defs`/`definitions`. Renames inside composition keywords fold into the value level they share and restore correctly (a mixed array/object `anyOf` resolves by value type at restore time). - **`$ref` keys restored** — `wrapTool` now dereferences internal `$ref`/`$defs` (lenient `sentinel` mode) before sanitizing, so keys reachable only through a reference are both made compliant and restored. - **Depth cap (512)** on sanitization and restoration — a pathologically deep schema/argument fails with a clear error instead of overflowing the stack. - **Empty / all-illegal keys** become a deterministic non-empty alias instead of `''` (which would itself violate `{1,64}`). - **Collision loop** — replaced a latent non-terminating fixed point with a counter that always makes progress. ### Architecture - **Extracted to core** — `sanitizeSchemaPropertyKeys(schema, policy)` / `restoreOriginalKeys` / `mappingHasRenames` (+ `KeyMapping` / `KeySanitizationPolicy`) now live in `@composio/core`, alongside `normalizeToolArguments`. The traversal, collision handling, prototype guard and depth cap are provider-agnostic; the Anthropic constraint is injected as a `KeySanitizationPolicy` defined in the provider's `sanitize-keys.ts`, which also re-exports a policy-bound `sanitizeSchemaPropertyKeys` plus core's restore side so call sites import from one place. - **`wrapTool` → `executeToolCall` contract** documented (same provider instance) and instrumented with `debug` logs on the rewrite/restore paths; re-wrapping a slug refreshes or clears its mapping. - Dropped the inaccurate "mirrors the Python SDK" comment and two `as unknown as` casts. ### Known limitations Both cases below leave a value reaching the backend un-restored — still strictly better than the whole `tools` array 400-ing. - **Dynamic-key positions.** After dereferencing, only genuinely dynamic-key positions remain rewrite-only (not restored): `additionalProperties`, `patternProperties`, and `contains`. These can't be tied to a concrete value location without per-key schema association. - **Composition-branch key collisions.** When sibling `allOf`/`anyOf`/`oneOf` branches fold into their shared value level, two branches that sanitize different illegal keys to the *same* alias — or one branch whose alias equals a legitimately-named property in another branch — keep only the first-seen reverse mapping, so an argument satisfying the other branch restores to the wrong original name. Recovering which branch a runtime value matched needs full schema evaluation against the value; these collisions are rare in OpenAPI-derived schemas. (Documented on `mergeMappingInto`.) ### Testing Locally verified: `tsc --noEmit` clean on the core util and provider sources (0 own-file diagnostics); ESLint clean; Prettier-formatted; the full `@composio/core` (951) and `@composio/anthropic` (51) vitest suites pass after a fresh `pnpm --filter @composio/core build` (the earlier `picocolors` caveat from #3649 was a stale `@composio/core/dist`; rebuilding core clears it). **Please confirm CI is green before merging.** |
||
|
Alberto Schiabel
|
f254d1333a |
docs: update contributing guide for current repo (#3651)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3535 and credits @eldar702 for the original `CONTRIBUTING.md` refresh - closes https://github.com/ComposioHQ/composio/issues/3487 - refreshes the repo layout around `ts/`, `python/`, `docs/`, and root release/install tests - documents the current `mise.toml` toolchain and removes stale Corepack, `.nvmrc`, `.bun-version`, and top-level `packages/` guidance - replaces the strict file-header requirement with current TypeScript/Python coding standards - adds current TypeScript e2e, Python, docs-site, changeset, and release-doc pointers - verifies documented paths, package scripts, Python make targets, Prettier, and whitespace checks locally Co-authored-by: Eldar Shlomi <eldarshlomi7@gmail.com> |
||
|
Zen
|
dfd7a0846d |
feat(core): add AbortSignal cancellation to public SDK methods + ComposioRequestCancelledError (#3463)
# Description
Add per-request cancellation to every public SDK method via
`AbortSignal`, and surface caller-initiated aborts as a typed
`ComposioRequestCancelledError`.
## API
For `tools.get` and `tools.execute`, pass `signal` directly in the
options bag (3rd arg) alongside modifiers — no placeholder needed:
```typescript
// Timeout a slow search
const tools = await composio.tools.get('user_1', {
search: 'send email',
}, { signal: AbortSignal.timeout(5_000) });
// Cancel an execution, with modifiers
const result = await composio.tools.execute('TOOL', body, {
signal: AbortSignal.timeout(10_000),
beforeExecute: ({ params }) => params,
});
// Detect cancellation
try {
await composio.tools.execute(slug, body, { signal: AbortSignal.timeout(5_000) });
} catch (err) {
if (err instanceof ComposioRequestCancelledError) return;
throw err;
}
```
For other methods, pass as a trailing argument:
```typescript
await composio.authConfigs.list(query, { signal: AbortSignal.timeout(5_000) });
await composio.connectedAccounts.get(id, { signal: AbortSignal.timeout(5_000) });
```
## Cancellation contract
- `withCancellation()` normalizes any abort error into
`ComposioRequestCancelledError` (code `TS-SDK::REQUEST_CANCELLED`)
- `isRequestAbortError()` detects `APIUserAbortError` via `instanceof`
(required because `.name === "Error"` at runtime), with fallbacks for
dual-package hazard and generic `AbortError`
- Catch-and-wrap paths in `execute` / `getRawComposioToolBySlug` /
`toolkits.get` re-throw cancellation before domain error wrapping
- **Post-execute safety**: if the signal fires after the remote tool
already executed, the result is returned (not thrown) — prevents callers
from retrying non-idempotent operations
- Custom-tool cancellation is cooperative: signal is exposed via the
`ctx` arg so user code can wire it into `fetch`
## Coverage
Tools, Toolkits, AuthConfigs, ConnectedAccounts, Triggers, MCP,
ToolRouter, ToolRouterSession — every public method that does HTTP I/O.
# How did I test this PR
- `pnpm exec vitest run` — 666 tests pass (25 pre-existing fileModifiers
failures unchanged)
- `pnpm typecheck` — 11/11 clean
- CI: Typecheck, Build, Audit, Test, all 5 E2E runtimes (Node
20.18/20.19/22.12, Deno, Cloudflare), secrets scan — all green
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: jkomyno <alberto@composio.dev>
|