composiohq__composio

mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00

Author	SHA1	Message	Date
Alberto Schiabel	fc17c37bf9	fix(cli): enforce sensitive-file upload denylist (GHSA-hp3h-89pf-5q58) (#3763 ) This PR: - fixes #3746 / GHSA-hp3h-89pf-5q58 — the CLI's tool file-upload path bypassed the sensitive-file denylist - root cause: the denylist was enforced at the caller layer, so `@composio/cli`'s duplicate upload path (`readFileFromDisk`) read and uploaded any local path a tool argument pointed at — `~/.ssh/id_rsa`, `~/.aws/credentials`, `.env`, etc. — enabling credential exfiltration via `composio execute` / `composio run` (incl. LLM-driven agents hit by prompt injection) - unified fix: one canonical guard, exported from `@composio/core` and enforced at the read primitive in every SDK - `core`: the guard now routes fs/path access through the internal `#platform` abstraction (adds a `realpathSync` method), so it carries *no static `node:` imports and is exported from the package root: `assertSafeFileUploadPath`, `isBlockedSensitiveFileUploadPath`, `BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS` - `cli`: `readFileFromDisk` calls the shared `assertSafeFileUploadPath` before `fs.readFile`; URLs and `File` objects are unaffected (matches core) - `python`: already routes all uploads through the guarded `FileUploadable.from_path` — no functional change; adds regression tests for parity - supersedes #3755, which exported the then-node-only guard from core's main `index.ts` and would have injected `node:fs` into the shared `dist/index.mjs` (the workerd/edge-light entry), likely breaking Cloudflare Workers / Vercel Edge - changesets: `@composio/core` minor (new public exports), `@composio/cli` patch (security fix) ## Verification - core: full suite passes (997), incl. new root-export + realpath-symlink cases - edge bundle stays clean*: built `dist/index.mjs` has no static `node:` imports and reaches the platform only via `#platform` - cli: new regression test drives the real `uploadToolInputFiles → readFileFromDisk → guard` chain — `~/.ssh/id_rsa` and `.env` throw `ComposioSensitiveFilePathBlockedError` before any `createPresignedURL` call; a normal file still uploads - python: `test_files.py` + sensitive-path suite pass (145), incl. 3 new `from_path` guard tests - `tsgo` typecheck + eslint clean for core and cli @composio/cli@0.2.32-beta.283	2026-07-07 00:30:40 +04:00
Alberto Schiabel	820abb9072	fix(sdk): resolve toolkit versions case-insensitively in both SDKs (#3762 ) ## Summary Toolkit version maps are keyed by normalized (lowercase) slugs on the write side — env vars (`COMPOSIO_TOOLKIT_VERSION_`) and user-supplied dicts both get their keys lowercased when the map is built. But the lookup* read the map with the raw slug. A pin configured under a different casing (e.g. `{ "GitHub": "20250101_00" }` or `COMPOSIO_TOOLKIT_VERSION_GITHUB` looked up as `GitHub`) therefore missed the map and silently fell back to `"latest"`, which `Tools.execute` then rejects with a version-required error — discarding the user's explicit pin. Rather than patch only the read side, this centralizes the normalization rule into a single helper per SDK and routes both the map-building (write) and lookup (read) paths through it, so the two sides can never drift apart again: - Python — `normalize_toolkit_slug()` in `python/composio/utils/toolkit_version.py` - TypeScript — `normalizeToolkitSlug()` in `ts/packages/core/src/utils/toolkitVersion.ts`, imported by `getToolkitVersionsFromEnv` in `sdk.ts` Behavior is now identical across the two SDKs. This supersedes #3759, which patched only the Python read side and left TS diverging. ## Backend verification Confirmed against the backend (staging, 1403 toolkits across 15 pages): every toolkit `slug` is already lowercase (the mixed-case `name` field is display-only). So the primary execute path — which resolves via `tool.toolkit.slug` — was never broken in practice. This change: - hardens the direct-util and mixed-case-config paths (a user passing `{ "GitHub": "…" }` now resolves as expected), and - removes a latent cross-SDK divergence: the TS suite previously asserted `getToolkitVersion` was case-sensitive (`versions.test.ts`), locking in the bug for an input the production code path can't actually produce. That test is flipped to assert case-insensitive resolution. ## Tests - Python (`python/tests/test_toolkit_version.py`): case-insensitive lookup via `get_toolkit_versions` round-trip, and against a raw pre-normalized map. `18 passed`. - TypeScript (`ts/packages/core/test/core/versions.test.ts`): replaced the case-sensitivity assertion with case-insensitive resolution + a write→read round-trip of a mixed-case user pin. Full core suite `997 passed`. - Typecheck (`tsc --noEmit`) clean; `ruff` clean. ## Notes - Changeset added: `@composio/core` patch. - No public API change; the fix is behavioral (case-insensitive) plus an internal shared helper.	2026-07-06 15:30:06 +04:00
Alberto Schiabel	58bc93b2d9	chore(deps): consolidate dependency updates (#3760 ) This PR: - consolidates https://github.com/ComposioHQ/composio/pull/3733, https://github.com/ComposioHQ/composio/pull/3735 through https://github.com/ComposioHQ/composio/pull/3744, and https://github.com/ComposioHQ/composio/pull/3752 - refreshes the pnpm workspace dependencies under the existing `minimumReleaseAge` supply-chain gate - keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare workers types 4 where latest majors conflict with the current workspace - keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the workspace catalog to zod 4 - bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock` - updates the SHA-pinned Claude and Codex workflow actions from the Dependabot action group - adds a patch changeset for the versioned package manifests touched by dependency updates - verifies the rollup with frozen pnpm/uv locks, peer checks, audit threshold checks, typecheck, lint, builds, TypeScript tests, and Python `nox -s chk` ## Context `pnpm audit --prod --audit-level=moderate` passes. The remaining production audit item is a low `@ai-sdk/provider-utils` advisory through Mastra transitive dependencies; forcing it higher would require leaving the compatible stable Mastra dependency path. @composio/cli@0.2.32-beta.282	2026-07-06 14:33:55 +04:00
Alberto Schiabel	d3875f99d1	chore(ci): add least-privilege tokens, fork-pr guards, audit gate (#3748 ) This PR: - depends on #3751 (dependency fixes split out; merge #3751 first or the new audit gate below is red) - adds top-level `permissions: contents: read` to the 23 workflows missing one, with job-level opt-ups only where jobs demonstrably need writes (releases, docs automation PR creation, audit PR comments); the `security.secrets-detection.yml` caller job mirrors the reusable workflow's declared scopes so the secret-scanning check keeps working under the cap - pins the secrets-detection reusable-workflow ref to ComposioHQ/.github@a6c053d (master, post ComposioHQ/.github#12) whose actions are now SHA-pinned, fixing the `startup_failure` every PR was hitting - guards all four E2E jobs in `ts.test-e2e.yml` so dependabot and fork PRs (which get no secrets) skip secret-backed steps with a `::notice` instead of failing red; install/build and the secret-free CLI docker build still run on fork PRs - makes `pnpm audit --prod --audit-level=high` a hard gate in `ts.audit.yml` (the advisory PR-comment flow is unchanged) and adds root `package.json`/`pnpm-lock.yaml`/`pnpm-workspace.yaml` to the audit triggers so manifest-only changes can't bypass it - drops the orphaned job-level `pull-requests: write` from `ts.test.yml` (no step has used the PR API since the #2212 comment step was removed) ## Context Implements `plans/002-ci-hardening-permissions-and-fork-guards.md` (advisor plan, orthogonal to the SDK v1 roadmap). A hard `pnpm audit` gate was tried once before and reverted for blocking unrelated PRs (#2213, `dec0ced78`); it lands now paired with #3751, which clears the high advisories, and it only fails on high/critical advisories in production dependencies. Reviewer notes: - release workflows verified statically: `py.release` publishes via PyPI credentials (no token writes); `ts.release` does all writes via the minted GitHub App token and keeps `id-token: write` - worth a dry run after merge: one fork PR to confirm the four skip notices, and one same-repo Secrets Detection run to confirm no 403 warning (the run on this PR already passed clean) - known follow-ups (deliberately out of scope): dev-dependency high advisories (gate is `--prod`), a scheduled audit run, encoding the permissions convention in `.agents/skills/repo-guidance`, extracting the duplicated guard into a composite action	2026-07-04 12:26:25 +04:00
Alberto Schiabel	49e4c11427	chore(deps): resolve high prod audit advisories via in-range bumps (#3751 ) This PR: - refreshes lockfile resolutions for the 17 high `pnpm audit --prod` advisories via `pnpm update -r` — real version bumps within the ranges parents already declare (minimatch 5/9, lodash, fast-uri, picomatch, langsmith, `@hono/node-server`, express-rate-limit, ws), not resolution overrides - bumps the pre-existing #3467 security pin `protobufjs: 7.5.9 -> 7.6.1` in `pnpm-workspace.yaml` (7.5.9 itself is vulnerable to GHSA unbounded-Any DoS) - adds ONE temporary scoped override, `minimatch@>=10.0.0 <10.2.3 -> >=10.2.3`: `@zed-industries/claude-code-acp@0.16.2` (latest) exact-pins vulnerable `minimatch 10.2.1` and no fixed release exists; commented in the file, drop when upstream ships - no `package.json` changes anywhere: none of the vulnerable packages is a direct dependency of any workspace package, so there is nothing to major-bump on our side ## Context Split out of #3748 (CI hardening) so dependency changes land in isolation. Merge this before #3748 — its new `pnpm audit --prod --audit-level=high` hard gate needs this green baseline, per the plan's "gate lands together with the dependency fix" rule. Verified: `pnpm audit --prod --audit-level=high` exits 0 (remaining: 1 low, 6 moderate); `pnpm install --frozen-lockfile` passes. Dev-path high advisories (vite, undici, flatted, linkify-it, minimatch 3.x) are out of scope — the gate is `--prod`; tracked as backlog.	2026-07-04 10:24:01 +04:00
Alberto Schiabel	8d5823be87	chore(ci): cache turbo, bun, and uv and cancel superseded pr runs (#3747 ) This PR: - adds `concurrency` to the ten PR/push CI workflows: superseded PR runs are cancelled, while push runs use a per-run group (`github.run_id`) so every commit on `next`/`master` still gets its own run - caches turbo outputs (`.turbo/cache`) via a new opt-in `enable-turbo-cache` input on the `setup-node-pnpm-bun` composite (keyed per job — concurrent jobs save different task graphs), enabled in `ts.build`, `ts.test`, `ts.typecheck`, and all four `ts.test-e2e` jobs - enables turbo caching for `typecheck`, removes the incorrect `dist/` outputs from `test`, hashes root `tsconfig.base.json` in `build`/`typecheck` inputs, and adds `mise.toml`/`mise.lock` to `globalDependencies` so toolchain bumps bust every task hash (addresses the Bugbot finding) - fixes `@composio/slim`'s build to participate in the turbo graph: core moves to slim's `devDependencies` (published `dependencies` unchanged) and the script no longer shells out to `pnpm --filter @composio/core build`, which raced concurrent dependents by wiping `core/dist` mid-build and double-built core on every cold run — slim's `dist` remains byte-identical to core's; no changeset added since the published artifact is unchanged (say the word if policy wants one anyway) - fixes the `py.test` matrix cache to `~/.cache/uv` (it cached `~/.cache/pip` while installing via `uv pip`) and caches `~/.bun/install/cache` in the five docs workflows - adds `turbo.jsonc` to the TS workflows' path filters (previously unwatched) - release/publish workflows are deliberately untouched Measured (same commit, cold first attempt vs `gh run rerun` warm): ts.build 103s → 53s, ts.test 157s → 55s (`turbo test` 24/24 cached in 182ms), ts.typecheck 80s → 43s; py.test legs save a few seconds each (uv was already fast). Warm floor is checkout + mise + pnpm-install overhead. ## Context Implements `plans/001-ci-speed-caching-and-concurrency.md` from the advisor audit on `docs/sdk-v1-decision-records`. Implementation by codex against the plan, then self-reviewed and counter-reviewed; warm-rerun testing surfaced and fixed three latent issues (toolchain files absent from turbo's hash, first-writer-wins cache-key collision across jobs, and the slim out-of-band core rebuild race). @composio/cli@0.2.32-beta.281	2026-07-03 22:22:18 +04:00
github-actions[bot]	a3e58a4216	docs: update toolkits, API spec, and meta tools data (#3426 ) ## Summary Automated sync of backend data into the docs site. Triggered by: `workflow_dispatch`. ## What changed - Toolkit catalog (`docs/public/data/toolkits.json`, `toolkits-list.json`) — refreshed list of available toolkits, auth schemes, and tools from the backend API - OpenAPI specs (`docs/public/openapi.json`, `docs/public/openapi-v3.json`) — latest v3.1 and v3.0 API specifications fetched from staging - API reference pages (`docs/content/reference/api-reference/`, `docs/content/reference/v3/api-reference/`) — regenerated index pages for both API versions - Meta tools reference (`docs/public/data/meta-tools.json`, `docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas and reference docs Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>	2026-07-03 17:46:31 +04:00
Alberto Schiabel	8e8ce95eb3	fix(docs): paginate toolkits fetch so the full catalog reaches the site (#3745 ) This PR: - fixes the `docs.composio.dev/toolkits` search returning 0 results for toolkits like Workday that exist in the catalog - paginates `fetchToolkits()` in `generate-toolkits.ts` by following `next_cursor`: `GET /api/v3/toolkits` silently caps `limit` at 1000 per page and defaults to usage ordering, so the previous single-request fetch shipped only the top-1000 toolkits — about half of the ~2.1k catalog - dedupes across pages by slug (pages can overlap when the catalog shifts between cursor fetches) and throws instead of silently truncating if the catalog ever outgrows the page guard, mirroring the dashboard's `listToolkits` procedure - fixes the `docs-update-data.yml` workflow, broken since the sessions-first docs rewrite (https://github.com/ComposioHQ/composio/pull/3637) moved the generated meta-tools MDX to `docs/content/toolkits/meta-tools/`: `create-pull-request` aborted on the stale `docs/content/reference/meta-tools/` pathspec, so every scheduled data sync since then failed at the Create Pull Request step and docs data went stale - updates the request-volume notes in `fetch-with-retry.ts` and `scripts/README.md` (~3000 → ~6500 requests per run); the existing 429 backoff already absorbs the larger run ## Context The toolkits landing page filters a build-time snapshot (`public/data/toolkits-list.json`) client-side, so every toolkit missing from the snapshot is unsearchable and its detail page has no data. The snapshot regenerates via the scheduled `docs-update-data.yml` workflow; with both fixes in place the automated data PR picks up the full catalog and the "Browse N toolkits" count grows from 1000 to the real catalog size. Verified offline by running the script against a stubbed paginated backend (1500 toolkits across 2 pages): all pages are fetched, ordering is preserved, no duplicates. `bun run types:check` and eslint pass. A manual `workflow_dispatch` of the fixed workflow on this branch produced the full-catalog data PR.	2026-07-03 17:40:26 +04:00
Alberto Schiabel	2e42d75259	fix(py): apply skip_default to agentic provider signatures (langchain, langgraph, autogen) (#3730 ) ## Summary Agentic providers honor `schema_config={"skip_defaults": True}` for `args_schema` (defaults stripped, fields become required) but were not applying the same `skip_default` to the function `__signature__`, so the wrapped tool's signature and `args_schema` disagreed about which defaulted params were optional. The sibling `llamaindex` provider already passed it to both. Supersedes #3727. This is the polished version, now that the ag2 migration (#3729) landed and `composio-autogen` imports again — so the autogen case uses a real import instead of the earlier source-load stub, and the parity tests run in CI. ## Changes - langchain / langgraph (original commit by @anxkhn): pass `skip_default=self.skip_default` to `get_signature_format_from_schema_params`. - autogen: same one-line alignment. autogen builds only `__signature__` (no `args_schema`), so it never had the mismatch — but its signature still ignored `skip_defaults`. Aligned for consistency; verified on the signature alone. - tests: `TestAgenticSkipDefaultsParity` guards each provider with `pytest.importorskip`; adds real-import autogen regression tests (no stub). - CI + nox: install `providers/autogen` in the unit-test job (`py.test.yml`) and the nox `tst` session so the autogen parity tests actually run, plus a hard `import composio_autogen` smoke check in CI. ## Why the CI import guard (not just the tests) The `importorskip`-guarded unit tests skip when a provider can't be imported — which is the correct behavior for optional providers, but means they'd silently skip if autogen broke on a fresh install (exactly the failure that #3729 just fixed). The extra `python -c "import composio_autogen"` in the import step is a hard check that fails loudly, so a future dependency breakage can't slip through as a green build. `providers/langchain` + `providers/autogen` co-install cleanly (verified: 59 packages, ag2 0.14.0, no conflict). langgraph continues to skip in CI — its code path is identical to langchain's, which runs. ## Type of change - [x] Bug fix ## How Has This Been Tested? - Base venv (langchain only): langchain parity passes, langgraph + autogen skip (no error). - CI-mirror (langchain + autogen, editable): 4 passed, 2 skipped (langgraph) — autogen tests actually run and pass. - Regression proof, each provider: reverting only the provider line fails the skip-defaults case with `assert 5 is Parameter.empty`; restoring passes. Verified for langchain and autogen. - `ruff check`, `ruff format --check`, `mypy`, and full `tests/test_provider.py` (29 passed, 4 skipped) → clean. `py.test.yml` parses. ## Checklist - [x] I ran linters/tests locally and they passed - [x] I added tests: langchain/langgraph parity + regression, and autogen parity that runs in CI - [ ] Changeset: not applicable — Python-only change. ## Credits Original fix by @anxkhn (#3713 → #3727), preserved as the first commit and co-authored on the follow-up. --------- Co-authored-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>	2026-07-02 15:38:53 +04:00
Alberto Schiabel	5ac2de2431	fix(py): migrate composio-autogen off abandoned pyautogen to ag2 (#3729 ) ## Summary `composio-autogen` fails to import on a fresh install: the provider depended on the abandoned `pyautogen` distribution, whose latest release (`0.10.0`) ships no top-level `autogen` module. The pin `pyautogen>=0.2.19,<0.11` resolves straight to it, so `import composio_autogen` raises `ModuleNotFoundError: No module named 'autogen'`. The autogen 0.2 lineage moved to the `ag2` distribution (`0.14.x`), which provides the same `autogen` package the provider uses (`ConversableAgent`, `autogen.agentchat.register_function`) alongside `autogen-core`. This swaps the dependency. Closes #3728. ## Changes - `providers/autogen/pyproject.toml` and `providers/autogen/setup.py`: `pyautogen>=0.2.19,<0.11` → `ag2>=0.14,<1.0`. `flaml` and `autogen_core` unchanged. No provider code changes — the imports and runtime API are identical across the two distributions. ## Type of change - [x] Bug fix ## How Has This Been Tested? Verified in isolation via `uv run --with ./providers/autogen` (a real fresh install of the provider with its new deps → resolves `ag2 0.14.0`): 1. Import — `import composio_autogen` now succeeds (previously `ModuleNotFoundError`). 2. `wrap_tool` — returns a real `autogen_core.tools.FunctionTool` with the expected signature. 3. `register_tools` → `autogen.agentchat.register_function` — the AG2 runtime path works end to end: - caller (LLM side): `caller.llm_config.tools` advertises the tool, - executor (execution side): the function lands in `executor._function_map`. `flaml==2.6.0` + `autogen-core==0.7.5` resolve cleanly alongside `ag2 0.14` (no conflict). ## Notes / follow-up This class of bug (a provider silently un-importable on fresh install) slipped through because CI never installs or imports the autogen provider — the unit-test job only installs `providers/langchain`. Worth a small follow-up: add a fresh-install import smoke test for the agentic providers so this can't recur silently. Left out here to keep this PR to the dependency fix and avoid adding ag2's install weight to the main test matrix. ## Checklist - [x] I ran the migration verification locally (isolation) and it passed - [ ] Changeset: not applicable — Python-only change.	2026-07-02 15:10:29 +04:00
Alberto Schiabel	e78ed312c6	fix(core): run all parallel OpenAI tool calls from the first choice (#3726 ) This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3712, preserving the original commits by @serhiizghama (kept as author/co-author) - fixes `OpenAIProvider.handleToolCalls` to execute every tool call in an assistant message — it previously only read `tool_calls[0]`, so parallel tool calls (on by default) were dropped and their `tool_call_id`s went unanswered, failing the next request with the "must be followed by tool messages responding to each `tool_call_id`" error - limits execution to the first choice — with `n > 1` the previous loop ran each tool call once per choice and orphaned the `tool_call_id`s belonging to the alternative completions - aligns the Python SDK (`OpenAIProvider.handle_tool_calls`) with the same first-choice behavior so both SDKs stay in parity - fixes the stale `@composio/openai` test that modeled "multiple tool calls" as separate `n` choices rather than one message's `tool_calls` array - clarifies in the changeset that the calls run sequentially, in the order the model returned them (here "parallel" means the model issued several calls in one turn, not concurrent execution), so each `tool_call_id` is answered exactly once and deterministically - adds regression tests (TS + Python): both calls run for parallel tool calls in one message, and only the first choice runs when `n > 1` Full `@composio/core` (996) and `@composio/openai` suites green; Python `handle_tool_calls` tests, Ruff, and mypy clean; `tsc` clean. --------- Co-authored-by: serhiizghama <zmrser@gmail.com>	2026-07-02 13:27:49 +04:00
sdkrelease[bot]	d30c9f24a0	docs: update guides for SDK changes (#3724 ) ## Summary Automated docs update triggered by SDK source changes on `next`. - Claude reviewed the SDK diff and updated guides, FAQs, or examples that reference changed APIs or features. - The docs `@composio/*` dependencies were realigned to their latest published releases so Twoslash snippets and example apps validate against versions users can actually install. ## Review checklist - [ ] Changes accurately reflect the new SDK behavior - [ ] No unrelated docs were modified - [ ] Code examples are correct and complete - [ ] If a documented feature is not published yet, the Twoslash build will fail — wait for the release instead of working around it Generated by Claude Code via GitHub Actions. Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>	2026-07-02 12:33:56 +04:00
Alberto Schiabel	a69c3edea3	fix(triggers): align create() user_id resolution across SDKs (#3723 ) This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3714 — addresses its code-review findings - restores TS/Python parity on slug validation: Python `create()` now validates the slug up-front and raises a new `TriggerTypeNotFound`, mirroring the TS `ComposioTriggerTypeNotFoundError` - switches both SDKs to the native `user_id` upsert field — TS drops the `& { user_id }` intersection and Python drops the `extra_body` shim (both pinned clients already expose the field) - treats a blank/whitespace `userId` (TS) or `user_id`/`connected_account_id` (Python) as missing instead of forwarding it to the backend - documents the error-contract change (`create()` no longer throws `ComposioConnectedAccountNotFoundError` — that case now surfaces from the backend) in the changeset and `ts/docs/api/triggers.md`, and bumps the changeset from `patch` to `minor` - adds Python tests for the 2FA (both-provided) path, unknown-slug, and blank `userId`; tightens the TS auto-resolve assertion and adds an empty-`userId` case ## ⚠️ Release gating Since #3714, `triggers.create()` (both SDKs) relies on the backend resolving the trigger connection from `user_id` on upsert ([ComposioHQ/platform#10932](https://github.com/ComposioHQ/platform/pull/10932)). There is no client-side fallback — reintroducing one would undo #3714's intent, so this is a release-sequencing requirement, not a code change here. - Do not release `@composio/core` or the Python SDK until #10932 is live in all regions. - Self-hosted / on-prem deployments must be on a backend version that includes #10932. ## Review findings addressed \| # \| Finding \| Resolution \| \|---\|---------\|------------\| \| P1-1 \| Coupled to unreleased backend, no fallback \| Documented dependency in changeset; flagged release-gating above (no fallback by design) \| \| P2-2 \| Cross-SDK parity on slug validation \| Kept `getType` in both; added Python `TriggerTypeNotFound` mirroring TS \| \| P2-3 \| `user_id` bridge redundant in both SDKs \| TS uses native field directly; Python uses `user_id=` kwarg \| \| P2-4 \| Error-contract change shipped silently \| Documented in changeset + docs `Throws` section; `minor` bump \| \| P2-5 \| Python missing 2FA (both-provided) test \| Added `test_create_with_user_id_and_connected_account_id` \| \| P3 6–13 \| Cleanups \| undefined-assertion, `none_to_omit`, docstring, `parsedBody.data`, redundant `else`, stale comments, blank-string guard \| ## Verification - TS: `vitest` 59 passed, `typecheck` clean, `eslint`/`prettier` clean - Python: `pytest tests/test_triggers.py` 69 passed, `nox -s chk` (ruff + mypy) clean	2026-07-02 11:40:47 +04:00
Anas Khan	c660007c71	fix(py): handle typeless and empty combiner schemas in openapi signatures (#3710 ) ### Summary `function_signature_from_jsonschema` in `python/composio/utils/openapi.py` builds the `__signature__` for tools wrapped by the `google_adk` provider (`providers/google_adk/composio_google_adk/provider.py:66`). It already falls back to `Any` for a top-level property with no `type`, but the nested combiner helpers do not, so real combiner shapes crash at wrap time: - a `oneOf`/`anyOf` option with no `type` key -> `KeyError: 'type'` - an empty `oneOf`/`anyOf` list -> `TypeError: Cannot take a Union of no types` - an empty `allOf` list -> `KeyError: 'type'` (merges to `{}`) This extends the existing "default to Any" intent to nested options. Follow-up to #3708, which fixed the same bug family in `shared.py` and noted this `openapi.py` case for a separate PR. Fixes # ### Changes - `_type_to_parameter`: read `schema.get("type")` instead of `schema["type"]`; when the type is missing, return `t.Any` (mirrors the top-level fallback). An unknown string type still raises `InvalidSchemaError`. - `_handle_composite_type`: return `t.Any` for an empty option list instead of building an empty `Union`. Empty `allOf` merges to `{}` and resolves to `Any` via the above. - New `python/tests/test_openapi.py` (11 tests): this builder had none. Asserts the five former crashes now resolve to `Any`, and that existing shapes are unchanged. ### Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ### How Has This Been Tested? From `python/`: ``` uv run pytest tests/test_openapi.py -q # 11 passed make chk # ruff + mypy -> clean ``` To confirm the tests guard the fix, the five former crashes (typeless `anyOf`/`oneOf` option, empty `anyOf`/`oneOf`/`allOf`) raise on the unmodified file and now resolve to `Any`; regressions cover `anyOf:[str,null]` -> `Optional[str]`, a 4-member union, enum, array, object, and a typeless property. ### Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed (internal util) - [x] I added tests (new test_openapi.py) - [ ] I added a changeset (Python-only, not needed) Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>	2026-07-02 11:40:35 +04:00
Anas Khan	b0ab8eacff	fix(py): handle 4+ option and typeless anyOf/oneOf unions in tool signatures (#3708 ) ## Summary `get_signature_format_from_schema_params` in `python/composio/utils/shared.py` builds the `__signature__` for the tool wrappers used by the langchain, langgraph, llamaindex, and autogen providers. Its `oneOf`/`anyOf` handling hardcoded a ladder for exactly 1, 2, or 3 union members and raised `ValueError("Invalid 'oneOf' schema")` for any union with four or more options. It also indexed `PYDANTIC_TYPE_TO_PYTHON_TYPE[ptype.get("type")]` directly, so any combiner option missing a `type` key produced `None` and raised `KeyError(None)`. Both shapes are valid JSON Schema and appear in real tool input schemas, so a tool with a 4-way union, or a combiner option without an explicit `type`, makes those four providers raise at tool-wrap time. This replaces the ladder with a single map + `functools.reduce` path that mirrors the existing `_build_union_from_options` in `schema_converter.py`, keeping the 1/2/3-member and nullable `[type, null]` outputs identical to before. Fixes # ## Changes - `python/composio/utils/shared.py`: in `get_signature_format_from_schema_params`, replace the 1/2/3-member `oneOf`/`anyOf` ladder (which raised `ValueError` for 4+ members) with a map-each-option-to-a-Python-type + `functools.reduce` Union build that supports any member count. Unknown/missing option types map to `typing.Any` instead of raising `KeyError`. Adds `from functools import reduce` and removes three now-unnecessary `# type: ignore` comments. - `python/tests/test_schema_parser.py`: add `TestGetSignatureFormatFromSchemaParams` (8 cases) covering 4- and 5-member unions, an `anyOf` option missing `type`, an all-typeless `anyOf`, and regressions for the previously supported single/2/3-member and nullable `[type, null]` shapes. ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? From `python/`: ``` uv run pytest tests/test_schema_parser.py::TestGetSignatureFormatFromSchemaParams -v # 8 passed uv run pytest tests/test_schema_parser.py -q # 75 passed make chk # ruff + mypy -> clean, no new ignores ``` To confirm the tests guard the fix, the new test class was also run against the unmodified `shared.py`: 4 of the 8 fail there (`ValueError`/`KeyError` on the 4+/typeless cases), and all 8 pass with this change. The nullable `anyOf [type, null]` case still resolves to `Union[str, Any, NoneType]` (its pre-existing behavior); collapsing `null` into `Optional` lives in `schema_converter` and is intentionally left out of this minimal fix, with the test documenting current behavior. ## Screenshots (if applicable) N/A ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [x] I added tests or explain why not applicable - [ ] I added a changeset if this change affects published packages ## Additional context No linked issue: this is a self-identified, reproduced bug in the older schema->signature path. The fix deliberately mirrors `schema_converter._build_union_from_options` so the two schema paths agree on N-ary union handling. The same bug family exists in `python/composio/utils/openapi.py` (`function_signature_from_jsonschema`, used by the google_adk provider) but is kept out of this PR to stay single-purpose; happy to follow up on it separately.	2026-07-02 11:39:41 +04:00
Anshu Garg	20a4711ee0	feat(triggers): resolve connection from user_id server-side in create() (#3714 ) ## What `triggers.create()` used to make an extra `connectedAccounts.list()` call to turn a `user_id` into a `connected_account_id` before calling upsert. The backend now resolves the connection from `user_id` directly (picks the first active connection for the user + the trigger's toolkit, parity with tool execution), so the SDK passes `user_id` straight through and drops the round-trip. - TS (`ts/packages/core`): removed the `connectedAccounts.list()` block in `Triggers.create()`. `user_id` was already forwarded to upsert (for 2FA); this just removes the now-redundant lookup. `getType` is kept for an early, clear "trigger type not found" error. `connected_account_id` is passed when the caller pins one. - Python (`python/composio`): dropped `_get_connected_account_for_user`; `user_id` is sent via `extra_body` and `connected_account_id` is omitted when not provided. ## Why The SDK only ever holds a `user_id`, so every `triggers.create()` paid an extra API call to find a connection. The backend change (ComposioHQ/platform#10932) makes trigger upsert accept `user_id` and auto-resolve — this PR consumes that. ## Behavior notes - When `connected_account_id` is omitted, the backend picks the first active connection ordered by `created_at desc`. The TS SDK's old `list()[0]` ordering was unspecified — selection is now deterministic and consistent with tool execution. - "No connected account found" / "connected account not found" now surface from the backend instead of a client-side pre-check. - When 2FA is enabled and `connected_account_id` is pinned, the backend validates that `user_id` owns it (unchanged; `user_id` was already forwarded). - The `extra_body` / `& { user_id }` bridges are still needed only until `@composio/client` / `composio_client` regenerate with `user_id` on the upsert type (the field is already in the OpenAPI contract). ## Tests - TS: `vitest run test/models/triggers.test.ts` → 58 passed (create tests rewritten to assert no `connectedAccounts.list()` call + `user_id` forwarded). - Python: `pytest tests/test_triggers.py` → 66 passed (same). ## Depends on Backend: ComposioHQ/platform#10932 (`feat(apollo): resolve trigger connection from user_id on upsert (PLEN-2580)`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 01:05:07 +04:00
Alberto Schiabel	4c3a321550	fix(core): disable retries on non-idempotent `tools.execute`/`proxyExecute` (#3716 ) This PR: - Closes https://github.com/ComposioHQ/composio/issues/3586 - disables client retries on `tools.execute` and `tools.proxyExecute` — the two non-idempotent writes — so a request that succeeds server-side but times out client-side is no longer silently replayed (the cause of duplicate `GMAIL_SEND_EMAIL` sends) - routes both through a sibling client built with `withOptions({ maxRetries: 0 })`; reads keep the client's default retries (`maxRetries: 2`) - caches that sibling per `Tools` instance (`clientWithoutRetries`) since `withOptions` constructs a fresh client and execute/proxy is the hottest path; mirrors the Python SDK's `client.without_retries` - adds regression tests asserting both paths route through `maxRetries: 0` and that the sibling is built once across multiple executes ## Context The original hang on attachments larger than ~25 KB was a backend defect and has already been fixed server-side. The remaining gap was a cross-SDK parity one: the Python SDK already disabled retries on these non-idempotent writes, but `@composio/core` still inherited the client default of 2 retries (3 attempts total), with no public knob to turn them off. This is the TypeScript parity port — scoped to exactly `tools.execute` / `tools.proxy`, leaving `toolRouter.session.execute` and all reads on their default retry behaviour, matching Python.	2026-06-30 21:53:46 +04:00
Abhishek Patil	0f0ca14a8f	docs: refresh OpenAPI reference (#3699 ) ## Summary - Refresh the checked-in v3.1 and v3 OpenAPI snapshots from the live backend specs using `bun run scripts/fetch-openapi.mjs`. - Regenerate API reference index pages with `bun run generate:api-index`. - Surfaces `DELETE /api/v3.1/tool_router/session/{session_id}` in the Tool Router API reference. - Includes the other upstream generated spec changes from the same auto-fetch, including generated API Keys and Organization Management section indexes. ## Verification - `bun run scripts/fetch-openapi.mjs` - `bun run generate:api-index` - `git diff --check` - `bun run build` ## Notes before merge - This is intentionally the full auto-generated OpenAPI refresh, not the surgical two-file patch. - The generated backend OpenAPI still contains some `internal` wording in descriptions; left as-is to preserve the auto-generated output. - Confirm the newly generated API Keys / Organization Management sections are intended to publish with this refresh. --------- Co-authored-by: jkomyno <alberto@composio.dev>	2026-06-30 09:08:42 +04:00
sdkrelease[bot]	e7291ba997	docs: update Python SDK reference from source (#3703 ) ## Summary Auto-generated Python SDK reference docs from `python/composio/`. Regenerates pages at `docs/content/reference/sdk-reference/python/` to reflect changes in the Python package's public API (new methods, updated signatures, changed types). Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>	2026-06-29 21:54:05 +04:00
Alberto Schiabel	03cb181fdb	chore(deps): roll up dependency bumps (#3711 ) This PR: - rolls up https://github.com/ComposioHQ/composio/pull/3695, https://github.com/ComposioHQ/composio/pull/3696, https://github.com/ComposioHQ/composio/pull/3697, and https://github.com/ComposioHQ/composio/pull/3698 into one dependency-bump branch - updates Python dependency metadata for `langchain-openai`, `pyautogen`, and `crewai` - updates npm production dependency metadata for `zod-to-json-schema`, `openai`, and `@modelcontextprotocol/sdk` - refreshes `uv.lock` and `pnpm-lock.yaml` with the repo-pinned package managers - leaves Changesets unchanged because the touched TS package manifests are private/ignored and no published TS SDK package metadata changes - verified with `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, focused TS builds/tests, clean-worktree `pnpm test:examples`, Python import tests, and Python nox checks - note: local `pnpm build:packages` hit a pre-existing broad-build race around `@composio/slim` rebuilding `@composio/core`; focused dependent builds pass --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> @composio/cli@0.2.32-beta.280	2026-06-29 19:20:15 +04:00
dependabot[bot]	de6a8ce295	chore(deps): bump the github-actions group across 1 directory with 7 updates (#3694 ) Bumps the github-actions group with 7 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [actions/checkout](https://github.com/actions/checkout) \| `6.0.2` \| `7.0.0` \| \| [swift-actions/setup-swift](https://github.com/swift-actions/setup-swift) \| `2.4.0` \| `3` \| \| [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) \| `1.0.140` \| `1.0.159` \| \| [openai/codex-action](https://github.com/openai/codex-action) \| `1.8` \| `1.9` \| \| [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) \| `1.0.140` \| `1.0.159` \| \| [actions/cache](https://github.com/actions/cache) \| `5.0.5` \| `6.1.0` \| \| [actions/setup-python](https://github.com/actions/setup-python) \| `6.2.0` \| `6.3.0` \| Updates `actions/checkout` from 6.0.2 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br /> Updates `swift-actions/setup-swift` from 2.4.0 to 3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/swift-actions/setup-swift/releases">swift-actions/setup-swift's releases</a>.</em></p> <blockquote> <h2>3.0.0 Beta 1</h2> <h2>Beta 1 of using Swiftly to setup Swift</h2> <ul> <li>Now uses Swiftly to set up Swift</li> <li>Added flag <code>skip-verify-signature</code> to disable GPG verification checks</li> </ul> <h2>Features</h2> <ul> <li>Setup Swift more Swiftly 🚀 (setup-swift 3.0) (<a href="https://redirect.github.com/swift-actions/setup-swift/issues/710">#710</a>) <a href="https://github.com/fwal"><code>@fwal</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/swift-actions/setup-swift/commit/364295d9c23900ce04d4e5cc708387921b4e50f9"><code>364295d</code></a> Bump build</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/7ef546c485df71a42699fdc047a6da322da93917"><code>7ef546c</code></a> Update readme</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/3273319f0f0618754506c4c1254da1ec36527312"><code>3273319</code></a> Bump swiftly</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/a90d2583fe1ebfd214260283f072a5fd4fb21ed0"><code>a90d258</code></a> Pass skip flag</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/ded451bd855f0672b0d538b7b00f0f48958284d7"><code>ded451b</code></a> Update workflows</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/0dad4e4b3ad6947c15c7ce23c6193d548ffb067c"><code>0dad4e4</code></a> Merge pull request <a href="https://redirect.github.com/swift-actions/setup-swift/issues/710">#710</a> from swift-actions/next</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/4abecca1bb9fd97e4857628fef56642847a3f8a8"><code>4abecca</code></a> Build</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/0c751509fec030bde17c1c403ee2cd10c61168d9"><code>0c75150</code></a> Formatting</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/7849873cbfe87fdcd1a020cc9cc31d317662e8bb"><code>7849873</code></a> Update gpg handling</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/9005990785b87227ac8641478fa68113afcd07ac"><code>9005990</code></a> Merge branch 'main' into next</li> <li>Additional commits viewable in <a href="https://github.com/swift-actions/setup-swift/compare/7ca6abe6b3b0e8b5421b88be48feee39cbf52c6a...364295d9c23900ce04d4e5cc708387921b4e50f9">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action` from 1.0.140 to 1.0.159 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.159</h2> <h2>What's Changed</h2> <ul> <li>fix: bound app token revocation cleanup by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tarunag10"><code>@tarunag10</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159</a></p> <h2>v1.0.158</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158</a></p> <h2>v1.0.157</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157</a></p> <h2>v1.0.156</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156</a></p> <h2>v1.0.155</h2> <h2>What's Changed</h2> <ul> <li>fix: filter PR reviews and inline review comments to trigger time by <a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li>test: cover format-turns content-type fallbacks and system_other handling by <a href="https://github.com/farmer-data"><code>@farmer-data</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li>fix: allow @ in branch names (valid per git-check-ref-format) by <a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li><a href="https://github.com/farmer-data"><code>@farmer-data</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li><a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155</a></p> <h2>v1.0.154</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154</a></p> <h2>v1.0.153</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153</a></p> <h2>v1.0.152</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152</a></p> <h2>v1.0.151</h2> <h2>What's Changed</h2> <ul> <li>fix: skip workflow validation token exchange failures by <a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151</a></p> <h2>v1.0.150</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/a92e7c70a4da9793dc164451d829089dc057a464"><code>a92e7c7</code></a> chore: bump Claude Code to 2.1.195 and Agent SDK to 0.3.195</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f8076dc00886157bd2e1bd828246d01274b9cb62"><code>f8076dc</code></a> fix: bound app token revocation cleanup (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1437">#1437</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/521136812280ae7ef256e06045655b9da02793f0"><code>5211368</code></a> chore: bump Claude Code to 2.1.193 and Agent SDK to 0.3.193</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d"><code>428971d</code></a> chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/74eedf1a1892082d619c3edb66b9402da6520e7f"><code>74eedf1</code></a> chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/80b31826338489861333dc17217865dfe8085cdc"><code>80b3182</code></a> chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/360be9c8fc5d80cb33661e0ffd33dcef4c7155aa"><code>360be9c</code></a> fix: allow @ in branch names (valid per git-check-ref-format) (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1411">#1411</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92"><code>e452eb9</code></a> test: cover format-turns content-type fallbacks and system_other handling (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1">#1</a>...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6b8063043eb8bc14e8448185a12d6d9dcf07ce55"><code>6b80630</code></a> fix: filter PR reviews and inline review comments to trigger time (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1385">#1385</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/30544b674398ee15c84819bd87caf8a87e8c7b55"><code>30544b6</code></a> chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/fbda2eb1bdc90d319b8d853f5deb53bca199a7c1...a92e7c70a4da9793dc164451d829089dc057a464">compare view</a></li> </ul> </details> <br /> Updates `openai/codex-action` from 1.8 to 1.9 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's changelog</a>.</em></p> <blockquote> <h1>codex-action Changelog</h1> <h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a> (2026-06-22)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/85">#85</a> update the internal <code>setup-node</code> pin to <code>v6.3.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a> (2026-04-29)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/91">#91</a> tighten what bots are allowed</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a> (2026-04-24)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/89">#89</a> restrict bot permission bypass</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/77">#77</a> enable GitHub-hosted Linux bubblewrap support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/74">#74</a> harden shell interpolation in action workflows</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/58">#58</a> revert <a href="https://redirect.github.com/openai/codex-action/issues/56">#56</a> and use the latest stable version of Codex CLI again</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/56">#56</a> temporarily set the default version of Codex CLI to <code>0.58.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a> (2025-11-07)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/52">#52</a> add <code>baseUrl</code> to <code>Octokit</code> constructor, if appropriate, for GHE</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a> (2025-11-05)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/47">#47</a> added support for Azure via the new <code>responses-api-endpoint</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/36">#36</a> added <code>effort</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/45">#45</a> pin the commit hash of the <code>actions/setup-node</code> action used by <code>openai/codex-action</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.0">v1.0</a> (2025-10-06)</h2> <ul> <li>Initial release (OpenAI DevDay 2025!)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/openai/codex-action/commit/10cb888d2ed3b99867f7e7ccff174a861a75aeb6"><code>10cb888</code></a> Update the internal setup-node pin to v6.3.0 (<a href="https://redirect.github.com/openai/codex-action/issues/85">#85</a>)</li> <li><a href="https://github.com/openai/codex-action/commit/9cdb6f3861cdefafeeaec70dfb42687be5ca62d3"><code>9cdb6f3</code></a> docs: clarify PR-controlled project instructions (<a href="https://redirect.github.com/openai/codex-action/issues/101">#101</a>)</li> <li>See full diff in <a href="https://github.com/openai/codex-action/compare/e0fdf01220eb9a88167c4898839d273e3f2609d1...10cb888d2ed3b99867f7e7ccff174a861a75aeb6">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.140 to 1.0.159 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.159</h2> <h2>What's Changed</h2> <ul> <li>fix: bound app token revocation cleanup by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tarunag10"><code>@tarunag10</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159</a></p> <h2>v1.0.158</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158</a></p> <h2>v1.0.157</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157</a></p> <h2>v1.0.156</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156</a></p> <h2>v1.0.155</h2> <h2>What's Changed</h2> <ul> <li>fix: filter PR reviews and inline review comments to trigger time by <a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li>test: cover format-turns content-type fallbacks and system_other handling by <a href="https://github.com/farmer-data"><code>@farmer-data</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li>fix: allow @ in branch names (valid per git-check-ref-format) by <a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li><a href="https://github.com/farmer-data"><code>@farmer-data</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li><a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155</a></p> <h2>v1.0.154</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154</a></p> <h2>v1.0.153</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153</a></p> <h2>v1.0.152</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152</a></p> <h2>v1.0.151</h2> <h2>What's Changed</h2> <ul> <li>fix: skip workflow validation token exchange failures by <a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151</a></p> <h2>v1.0.150</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/a92e7c70a4da9793dc164451d829089dc057a464"><code>a92e7c7</code></a> chore: bump Claude Code to 2.1.195 and Agent SDK to 0.3.195</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f8076dc00886157bd2e1bd828246d01274b9cb62"><code>f8076dc</code></a> fix: bound app token revocation cleanup (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1437">#1437</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/521136812280ae7ef256e06045655b9da02793f0"><code>5211368</code></a> chore: bump Claude Code to 2.1.193 and Agent SDK to 0.3.193</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d"><code>428971d</code></a> chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/74eedf1a1892082d619c3edb66b9402da6520e7f"><code>74eedf1</code></a> chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/80b31826338489861333dc17217865dfe8085cdc"><code>80b3182</code></a> chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/360be9c8fc5d80cb33661e0ffd33dcef4c7155aa"><code>360be9c</code></a> fix: allow @ in branch names (valid per git-check-ref-format) (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1411">#1411</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92"><code>e452eb9</code></a> test: cover format-turns content-type fallbacks and system_other handling (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1">#1</a>...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6b8063043eb8bc14e8448185a12d6d9dcf07ce55"><code>6b80630</code></a> fix: filter PR reviews and inline review comments to trigger time (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1385">#1385</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/30544b674398ee15c84819bd87caf8a87e8c7b55"><code>30544b6</code></a> chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/fbda2eb1bdc90d319b8d853f5deb53bca199a7c1...a92e7c70a4da9793dc164451d829089dc057a464">compare view</a></li> </ul> </details> <br /> Updates `actions/cache` from 5.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-python` from 6.2.0 to 6.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add RHEL support and include Linux distro in cache keys by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li> <li>Fix pip cache error handling on Windows by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li> <li>Upgrade actions dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li>Upgrade dependency versions and test workflow configuration by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li> </ul> <h3>Documentation</h3> <ul> <li>Update advanced-usage.md by <a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li><a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v6.3.0">https://github.com/actions/setup-python/compare/v6...v6.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1"><code>ece7cb0</code></a> Fix pip cache error handling on Windows. (<a href="https://redirect.github.com/actions/setup-python/issues/1040">#1040</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf"><code>1d18d7a</code></a> Update advanced-usage.md (<a href="https://redirect.github.com/actions/setup-python/issues/811">#811</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/d2b357a6a3a3687dd6781a416c0d24fcfd68660e"><code>d2b357a</code></a> Update dependency versions and test workflow configuration (<a href="https://redirect.github.com/actions/setup-python/issues/1322">#1322</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/8f639b1e75c1048640734b2bb46e22cecf136982"><code>8f639b1</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-python/issues/1324">#1324</a> from jasongin/update-actions-cache-5.1.0</li> <li><a href="https://github.com/actions/setup-python/commit/6731c2ba87f530c26324d128c8fdd53499a4d4b0"><code>6731c2b</code></a> Resolve high-severity audit issues</li> <li><a href="https://github.com/actions/setup-python/commit/0cb1a84326b90186fcd211036c65b42819794c87"><code>0cb1a84</code></a> Add RHEL support and include Linux distro in cache keys (<a href="https://redirect.github.com/actions/setup-python/issues/1323">#1323</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/dc6eab6194394e0119523369788b507096f923e2"><code>dc6eab6</code></a> Update dist</li> <li><a href="https://github.com/actions/setup-python/commit/6f4b74bfa2f520a380a620de3615c0dac427f4d3"><code>6f4b74b</code></a> Strict equality</li> <li><a href="https://github.com/actions/setup-python/commit/fa8bde1a9cc6347d06948d66bcd68c598b79eaea"><code>fa8bde1</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied</li> <li><a href="https://github.com/actions/setup-python/commit/c8813ba1bc76ebf779b911ad8ffccbf2e449cb48"><code>c8813ba</code></a> Upgrade <a href="https://github.com/actions"><code>@actions</code></a> dependencies and update licenses (<a href="https://redirect.github.com/actions/setup-python/issues/1303">#1303</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> @composio/cli@0.2.32-beta.279	2026-06-29 15:09:32 +04:00
Alberto Schiabel	aede04995d	ci(docs): keep docs @composio/* deps current on each SDK sync (#3709 ) ## Summary The `Docs - Sync guides on SDK changes` workflow updates docs content when SDK source changes on `next`, but it never touched `docs/package.json`. Because the docs site is a standalone Bun app outside the pnpm workspace — it pins published `@composio/` versions rather than linking workspace source — those pins silently drifted behind the SDK. That drift is what produced the recent breakage in #3705: docs still pinned `@composio/core@0.9.1` while `delete()` shipped in `0.13.1`, so the Twoslash type-check failed and the sync bot worked around it by casting a fake `delete()` onto the session type. ## What this changes In `docs.sdk-change-sync.yml` (gated on the same `has_changes` condition as the rest of the job): - New step* sets up Node/Bun (via the shared `setup-node-pnpm-bun` action) and realigns every `@composio/` dependency in `docs/package.json` to its latest published* release (`npm view <pkg> version` → `^<latest>`), then refreshes `bun.lock` with `bun install`. It scans both `dependencies` and `devDependencies`, is idempotent (no diff → no `bun install`), and warns rather than fails if a version can't be resolved. - `add-paths` now includes `docs/package.json` and `docs/bun.lock` so the realignment lands in the PR. - Content prompt gains a rule: don't add casts/assertions to compile against an API missing from the published package — document released behavior and let the Twoslash build flag the gap. ## Why pin to published (not workspace source) Docs deliberately target what users can `npm install`. Twoslash snippets and the runnable example apps are a contract that the documented API exists in a real release. The PR's existing Twoslash build (`docs-typescript-check.yml`) remains the gate: if a documented feature isn't published yet, the build fails loudly instead of being silently worked around. ## Notes - Complementary to #3705, which fixes the current stale pins by hand; this prevents the drift from recurring. - Validated the bump shell logic locally under `bash` (matching the runner): correctly resolves all 10 `@composio/*` devDeps and is a no-op when already current.	2026-06-29 14:35:02 +04:00
Alberto Schiabel	7fe998c45c	docs: document session delete() and realign docs @composio/* deps (#3705 ) ## Summary Documents session deletion (`session.delete()`) and realigns the docs site's `@composio/` dependencies so the new snippet type-checks against a published SDK. ## Changes - `docs/content/docs/configuring-sessions.mdx`* — adds a `### delete()` section with Python and TypeScript examples and a version-requirement callout (`@composio/core` ≥ `0.13.1` / `composio` ≥ `0.17.1`). - `docs/package.json` + `docs/bun.lock` — bumps `@composio/core` `^0.9.1` → `^0.13.1` (the release that adds `delete()`) and aligns the provider packages to their `^0.10.x`/`^0.11.0` releases (peer `@composio/core >=0.10.0 <1.0.0`). ## Why the dependency bump The docs site type-checks every Twoslash snippet against the `@composio/` versions pinned in `docs/package.json`. Those pins were stale (`@composio/core@0.9.1`), and `delete()` only exists on the `Session` type from `0.13.1`, so the snippet didn't compile. The original sync run worked around this with a `DeletableSession` cast; this PR fixes the root cause by bumping the pins to published releases that expose `delete()` natively and dropping the cast. The full docs build (Twoslash validation) passes against the bump. ## Review checklist - [ ] `delete()` examples accurately reflect the SDK behavior - [ ] Version callout matches the releases that introduce `delete()` - [ ] No unrelated docs were modified ## Notes - Originally produced by the `Docs - Sync guides on SDK changes` run. - Follow-up https://github.com/ComposioHQ/composio/pull/3709 prevents this pin drift from recurring by realigning the docs `@composio/` deps automatically on each SDK sync. --------- Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>	2026-06-29 14:07:34 +04:00
Alberto Schiabel	9bd600a9a2	fix(docs): use app token for SDK docs sync PRs (#3706 ) This PR: - fixes the `Docs - Sync guides on SDK changes` workflow failure from https://github.com/ComposioHQ/composio/actions/runs/28332657149/job/83933412114 - mints the existing release-bot GitHub App token before checkout - uses that token for checkout, `peter-evans/create-pull-request`, and reviewer requests - keeps reviewer assignment non-blocking so a successful docs PR is not failed by reviewer-request edge cases - verifies the workflow file with `ruby -e 'require "yaml"; YAML.load_file(ARGV.fetch(0)); puts "yaml ok"' .github/workflows/docs.sdk-change-sync.yml`, `mise exec -- pnpm exec prettier --check .github/workflows/docs.sdk-change-sync.yml`, and `git diff --check -- .github/workflows/docs.sdk-change-sync.yml`	2026-06-29 12:34:38 +04:00
Alberto Schiabel	bfec5f4789	chore(ci): use GitHub App client ID input (#3707 ) This PR: - replaces the deprecated `app-id` input for `actions/create-github-app-token` with `client-id` - reads the public release bot Client ID from the `RELEASE_BOT_CLIENT_ID` repo variable - keeps `RELEASE_BOT_APP_PRIVATE_KEY` as the only GitHub App secret used by these token steps - updates token generation in docs data sync, SDK reference generation, and TypeScript release workflows - pairs with the one-line update already pushed to https://github.com/ComposioHQ/composio/pull/3706 for the SDK docs sync workflow ## Verification - `rg -n 'app-id:' .github \|\| true` - `rg -n 'client-id:' .github/workflows` - parsed edited workflow YAML with Ruby/Psych - confirmed `RELEASE_BOT_CLIENT_ID` exists as a repo variable - workflow-dispatch smoke run for #3706 passed with `client-id` and no `app-id` deprecation warning: https://github.com/ComposioHQ/composio/actions/runs/28358680527	2026-06-29 12:31:13 +04:00
jkomyno	008316ac18	Revert "chore(ci): use GitHub App client ID input" This reverts commit `7ef3a786d4`.	2026-06-29 12:23:07 +04:00
jkomyno	7ef3a786d4	chore(ci): use GitHub App client ID input	2026-06-29 12:22:01 +04:00
Alberto Schiabel	9901e01a80	feat(py): add tool router session deletion Release Python 0.17.1 with Tool Router session deletion support. py@0.17.1	2026-06-28 22:59:25 +04:00
jkomyno	551790c114	chore(py): sync 0.17.0 lockfile @composio/slim@0.13.1 py@0.17.0	2026-06-27 10:35:44 +04:00
sdkrelease[bot]	156a1eb7b2	Release: update version (#3686 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/vercel@0.11.0 ### Minor Changes - `9ffc696`: Add AI SDK 7 support to `@composio/vercel`. The `ai` peer dependency range is now `^6.0.0 \|\| ^7.0.0` (AI SDK 5 is no longer supported; both v6 and v7 are covered by e2e compatibility tests). ## @composio/core@0.13.1 ### Patch Changes - `605a726`: Add Tool Router session deletion APIs. ## @composio/mastra@0.10.1 ### Patch Changes - `cddd66c`: Update the supported `@mastra/core` peer dependency range. ## @composio/slim@0.13.1 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> @composio/vercel@0.11.0 @composio/mastra@0.10.1 @composio/core@0.13.1	2026-06-27 00:49:27 +04:00
Alberto Schiabel	956f9be9b4	chore(agents): normalize repo guidance skills (#3666 ) This PR: - replaces the duplicated repo-local skill set with the requested canonical `.agents/skills` taxonomy and short router `SKILL.md` files backed by first-level references - makes `.claude/skills` a compatibility symlink to `.agents/skills` and removes hand-maintained Claude skill/rule copies - moves docs agent guidance and decisions into neutral `docs/agent-guidance/` and `docs/decisions/`, with `docs/CLAUDE.md` reduced to a shim - retires CLI Cursor rules after migrating CLI design, Effect source, and client-cache sync guidance into `AGENTS.md` and `cli-command` - adds nested `AGENTS.md` files for TS, core, providers, e2e, Python, Python providers, and docs - adds `pnpm validate:agent-skills` to validate skill frontmatter, taxonomy, references, symlink invariants, stale paths, and command names - implements missing Python `tst` and `snt` nox sessions that existing Makefile targets already exposed - no changeset: repository guidance/tooling only, no published SDK package behavior ## Verification - `pnpm validate:agent-skills` -> `Validated 14 canonical agent skills and guidance invariants.` - `for skill in .agents/skills/*; do python /Users/jkomyno/.codex/skills/.system/skill-creator/scripts/quick_validate.py "$skill" \|\| exit 1; done` -> 14x `Skill is valid!` - `pnpm --dir ts/packages/cli validate:skills` -> `Validated composio-cli skill builds for stable and beta.` - `cd python && uv run nox --list` -> includes `tst` and `snt` - `cd python && uv run nox -s snt` -> 18 passed - `cd python && uv run nox -s tst -- tests/test_imports.py` -> 8 passed - `git diff --check` / `git diff --cached --check` -> clean - stale reference search for retired docs/Claude/Cursor paths -> no matches ## Forward Tests - TypeScript core bug: loaded `bug-fixing`, `typescript-sdk`, `typescript-testing`; found correct root/ts/core `AGENTS.md` route. - Python provider: loaded `python-providers`, `python-testing`; found missing nox sessions, fixed here. - CLI command: loaded `cli-command`; found recording/changeset wording gaps, fixed here. - Cross-SDK drift: loaded `cross-sdk-parity`; again found Python nox drift, fixed here. - Docs + decision: loaded `docs-decisions`; found decision template/index and Twoslash path gaps, fixed here. ## Notes The first normal `git commit` attempt hit a lint-staged/Git stash limitation while replacing `.claude/skills/` with a symlink (`path ... beyond a symbolic link`). The final commit used `--no-verify` after the validators and formatting checks above passed. @composio/cli@0.2.32-beta.278	2026-06-27 00:35:57 +04:00
sdkrelease[bot]	02e9e1ab13	docs: update TypeScript SDK reference from source (#3685 ) ## Summary Auto-generated TypeScript SDK reference docs from `ts/packages/core/src/`. Regenerates pages at `docs/content/reference/sdk-reference/typescript/` to reflect changes in the core package's public API (new methods, updated signatures, changed types). Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>	2026-06-27 00:35:36 +04:00
Alberto Schiabel	cddd66c3ce	chore(ts): bump Hono, Mastra, and Chrome deps (#3691 ) This PR: - bumps `hono`, `@mastra/core`, and `chrome-devtools-mcp` to their current latest published versions - routes the remaining Cloudflare Tool Router Hono consumer through the workspace catalog - updates the `@composio/mastra` `@mastra/core` peer range and adds a patch changeset - fixes `check-peer-deps` to resolve `semver` through the normal package dependency @composio/cli@0.2.32-beta.277	2026-06-26 20:45:25 +04:00
Alberto Schiabel	e7bb45f449	fix(py): normalize generated SDK doc examples (#3689 ) This PR: - normalizes Python SDK reference examples generated from source docstrings - rewrites the `Triggers.parse()` docstring so the generated Flask/FastAPI examples are copy-pasteable - strips nested Markdown fences before wrapping generated examples in MDX code fences - regenerates `docs/content/reference/sdk-reference/python/` - adds regression coverage for the `Triggers.parse()` generated example and fenced example normalization - does not include a changeset because this only changes docs generation, generated docs, and tests ## Verification - `cd python && .venv/bin/python -m pytest tests/test_generate_docs.py -q` - `cd python && .venv/bin/ruff check --config config/ruff.toml composio/core/models/triggers.py scripts/generate-docs.py tests/test_generate_docs.py` - `cd python && .venv/bin/ruff format --check --config config/ruff.toml composio/core/models/triggers.py scripts/generate-docs.py tests/test_generate_docs.py` - `cd python && .venv/bin/python scripts/generate-docs.py` - `cd docs && bun install --frozen-lockfile` - `cd docs && bun run types:check`	2026-06-26 15:12:15 +04:00
Alberto Schiabel	acf8a9ca1f	test(cli): cover fish completion install idempotency (#3688 ) This PR: - follows up on https://github.com/ComposioHQ/composio/pull/3440 and credits Deepak Singh Kandari / @aptsalt from the original implementation - builds on the fish completion fix already merged in https://github.com/ComposioHQ/composio/pull/3162 - references https://github.com/ComposioHQ/composio/issues/3147 - adds regression coverage for running `composio install --completions` twice under fish - verifies `config.fish` keeps a single PATH marker and never receives completion markers - verifies `~/.config/fish/completions/composio.fish` keeps one completion marker ## Testing - `MISE_TRUSTED_CONFIG_PATHS=$PWD mise exec -- pnpm --filter @composio/cli exec vitest run test/src/commands/install.cmd.test.ts` - `MISE_TRUSTED_CONFIG_PATHS=$PWD mise exec -- pnpm --filter @composio/cli typecheck:test` - `git diff --check origin/next...HEAD` Co-authored-by: Deepak Singh Kandari <deepaksinghkandari07@gmail.com> @composio/cli@0.2.32-beta.276	2026-06-26 14:26:20 +04:00
Rahul Tarak	ea2e02071a	docs: fast-search with mercury-2 (#3687 ) ## Summary - Switch the docs Eve agent from the AI Gateway `openai/gpt-5.4-mini` string to an Inception Labs Mercury 2 OpenAI-compatible chat model. - Keep tool calling on the chat-completions path and pass Mercury's `reasoning_effort=medium` through the AI SDK OpenAI adapter. - Add `DOCS_AGENT_MODEL_FLOW` so the same agent can run either `mercury` or the old AI Gateway flow for eval comparisons. - Add docs-agent eve evals covering grounded docs answers, docs retrieval, citations, and account-specific support refusal. - Replace the docs-agent retriever with an in-process BM25-style lexical ranker that returns bounded full content for the top results, so Mercury gets rich context in one fast tool call instead of a serial `search_docs` → `read_doc` round trip. - Precompute BM25 term counts/document frequencies into the generated `agent/lib/docs-index.ts` snapshot at build time, removing deployed cold-start corpus construction while keeping retrieval in-process. - Add opt-in search perf logging (`DOCS_AGENT_SEARCH_PERF_LOG=1`, optional `DOCS_AGENT_SEARCH_LOG_QUERY=1`) with timings for tokenization, corpus load/cache, ranking, hydration, total duration, corpus source, and top URLs. - Add `eval:agent` and `eval:agent:flows` scripts; `eval:agent:flows` can run local model-flow comparisons or remote target comparisons via `DOCS_AGENT_EVAL_TARGETS`. - Add `INCEPTION_API_KEY` / optional Mercury and gateway model knobs to `docs/.env.example`, and move `@ai-sdk/openai` to runtime dependencies for the agent import. ## Notes - This is intentionally an experiment to see how Mercury's diffusion model behaves with Eve tool calling (`search_docs` and `read_doc`). - Preview/runtime environments need `INCEPTION_API_KEY`; `INCEPTION_MODEL` and `INCEPTION_BASE_URL` are optional overrides. - The custom fetch prevents accidentally falling back to `OPENAI_API_KEY` against Inception's endpoint. - The docs search is lexical/in-memory, not vector search. The slow path was mostly serial model/tool round trips and cold index construction, not embedding lookup. - The generated BM25 snapshot is process-local once loaded: warm for the lifetime of the running Node/Vercel function instance, and reset on cold starts, redeploys, or process restarts. The expensive term-count corpus is now built at docs build time. - Perf logs omit raw user queries by default; set `DOCS_AGENT_SEARCH_LOG_QUERY=1` only when you explicitly want raw query/term logging. - Local A/B-style eval run: ```bash DOCS_AGENT_EVAL_FLOWS=gateway,mercury bun run eval:agent:flows -- --strict ``` - Live target comparison: ```bash DOCS_AGENT_EVAL_TARGETS=baseline=https://<prod>,mercury=https://<preview> bun run eval:agent:flows -- --strict ``` ## Tests - `bunx eslint scripts/build-agent-index.ts agent/lib/docs.ts agent/tools/search_docs.ts` - `bun scripts/build-agent-index.ts` (wrote 133 pages + 1000 toolkits + 1139 BM25 rows) - `DOCS_AGENT_SEARCH_PERF_LOG=1 EVE_FORCE_BUNDLE=1 bun -e "const tool=(await import('./agent/tools/search_docs.ts?log=' + Date.now())).default; await tool.execute({query:'create a session with github tools'}); await tool.execute({query:'auth config connected account'});"` (logs cold and warm timing JSON) - `EVE_FORCE_BUNDLE=1 bun -e "const tool=(await import('./agent/tools/search_docs.ts?bundle=' + Date.now())).default; const started=performance.now(); const r=await tool.execute({query:'create a session with github tools'}); console.log(r.retrieval, r.results[0].url, r.results[0].content.length, Math.round(performance.now()-started)+'ms');"` (precomputed bundle path, ~12ms) - `bun -e "const tool=(await import('./agent/tools/search_docs.ts?live=' + Date.now())).default; const started=performance.now(); const r=await tool.execute({query:'create a session with github tools'}); console.log(r.retrieval, r.results[0].url, r.results[0].content.length, Math.round(performance.now()-started)+'ms');"` (live-content path, ~34ms) - `EVE_FORCE_BUNDLE=1 bun -e "const tool=(await import('./agent/tools/search_docs.ts')).default; await tool.execute({query:'create a session with github tools'}); const started=performance.now(); const r=await tool.execute({query:'auth config connected account'}); console.log(r.results[0].url, r.results[0].content.length, Math.round(performance.now()-started)+'ms');"` (warm path ~2ms) - `PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH ./node_modules/.bin/eve info --json` (reports `status: ready`, `model: inception/mercury-2`, `errors: 0`) - `DOCS_AGENT_MODEL_FLOW=gateway PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH ./node_modules/.bin/eve info --json` (reports `status: ready`, `model: openai/gpt-5.4-mini`, `errors: 0`) - `PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH ./node_modules/.bin/eve eval --list` - `PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH bun scripts/eval-agent-flows.ts --list` - `bun test tests/static/` (16 passed) - `bun run types:check` currently fails on existing docs type-generation errors in `app/(home)/docs/changelog/[...slug]/page.tsx`, `app/(home)/examples/[[...slug]]/page.tsx`, `app/(home)/toolkits/[[...slug]]/page.tsx`, `app/llms.mdx/[[...slug]]/route.ts`, `lib/search-index.ts`, and `lib/source.ts`; no new eval or `docs/agent/agent.ts` errors were reported. ## Not run - Real live model evals, because this local environment does not have `INCEPTION_API_KEY` or AI Gateway credentials. ## Latest update - Added default eager docs retrieval in the Eve HTTP channel: the server runs the same BM25 search on the user's message before the first model step and injects the results as one-turn context. - Kept `search_docs` and `read_doc` available so Mercury can still search/read more when the eager context is weak, ambiguous, or missing. - Added `DOCS_AGENT_EAGER_SEARCH=0` as an escape hatch and labeled perf logs with `invocation: "eager_context" \| "tool"`. - Updated the loading copy from “Searching the docs…” to “Thinking with the docs…” so UI latency is not attributed solely to the search call. ## Latest tests - `bun run lint -- agent/channels/eve.ts agent/tools/search_docs.ts agent/lib/docs-search.ts components/eve-chat.tsx evals/docs-agent/grounded-answers.eval.ts` - `PATH=/Users/cryogenicplanet/.vite-plus/js_runtime/node/24.15.0/bin:$PATH node_modules/eve/bin/eve.js info --json` (reports `status: ready`, `errors: 0`) - `DOCS_AGENT_SEARCH_PERF_LOG=1 EVE_FORCE_BUNDLE=1 bun -e "import { searchDocs } from './agent/lib/docs-search'; const r = searchDocs('How do I create a session in Composio? Keep it brief.', { invocation: 'eager_context' }); console.log(JSON.stringify({count:r.results.length, top:r.results[0]?.url, content: !!r.results[0]?.content}, null, 2));"` - `DOCS_AGENT_SEARCH_PERF_LOG=1 bun -e "import { searchDocs } from './agent/lib/docs-search'; searchDocs('How do I create a session in Composio? Keep it brief.', { invocation: 'eager_context' }); searchDocs('How do I create a session in Composio? Keep it brief.', { invocation: 'tool' });"` - `bun run types:check` still fails only on the pre-existing docs type-generation issues listed above. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-26 03:17:57 -07:00
Alberto Schiabel	9ffc696a99	feat(vercel): support AI SDK v7 (#3683 ) This PR: - widens the `ai` peer dependency of `@composio/vercel` to `^6.0.0 \|\| ^7.0.0`, adding AI SDK v7 support and dropping the previously-untested v5 arm - adds Docker-based Node e2e compatibility suites for AI SDK v6 and v7 under `ts/e2e-tests/runtimes/node/vercel-ai-sdk-v{6,7}`, auto-discovered by the existing e2e matrix (so PR CI exercises them) - each installs the packed `@composio/vercel` tarball, typechecks the provider against the target `ai` major, and asserts runtime tool wrapping/execution (object inputs, JSON-string normalization via `normalizeToolArguments`, `ToolSet` shape) - the v7 suite additionally exercises v7's `ToolExecutionOptions` passed to `tool.execute` - ships a `minor` changeset (the peer-range narrowing removes a previously-supported major) - breaking: - `ai@5` is no longer an accepted peer of `@composio/vercel`; v5 consumers should stay on the prior minor	2026-06-26 14:08:09 +04:00
Rahul Tarak	61feaf277b	fix(docs): point Algolia search at renamed docs_composio index (#3684 ) ## The bug The live Algolia index was renamed to `docs_composio`, but every default in the repo still pointed at the old `docs_composio_dev_62hi9pqz1l_pages` in three places: 1. `.github/workflows/docs-search-sync.yml` — `ALGOLIA_INDEX_NAME` fallback 2. `docs/lib/search-index.ts` — `ALGOLIA_DEFAULT_INDEX_NAME` (used by the sync script) 3. `docs/components/custom-search-dialog.tsx` — client query fallback (×2) So unless the `ALGOLIA_INDEX_NAME` Actions variable happened to be set, the docs-search-sync workflow rebuilt the dead old index on every push to `next`, while the live site queried a different one. Net effect: search index updates never showed up. ## The fix Repoint the default to `docs_composio` in all three spots (+ README / CLAUDE.md docs). The env overrides still take precedence, so nothing breaks if a variable is set. ## Env to set (so it actually publishes & reads the right index) The code now defaults to `docs_composio`, so the only things that must be configured: GitHub Actions (repo → Settings → Secrets and variables → Actions): - `ALGOLIA_ADMIN_API_KEY` (secret, required) — without it the workflow skips the sync. - `ALGOLIA_APP_ID` (variable, optional) — defaults to `62HI9PQZ1L`. - `ALGOLIA_INDEX_NAME` (variable, optional) — now defaults to `docs_composio`; set only to override. Vercel (Production env) — for the live search to query the same index: - `NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY` (required; without it the client falls back to `/api/search`) - `NEXT_PUBLIC_ALGOLIA_APP_ID` = `62HI9PQZ1L` (optional, defaulted) - `NEXT_PUBLIC_ALGOLIA_INDEX_NAME` = `docs_composio` (optional now that the default matches; set it to be explicit) > If `NEXT_PUBLIC_ALGOLIA_INDEX_NAME` was previously set to the old name in Vercel, update or remove it — otherwise the client keeps reading the old index regardless of this PR. ## Testing - `bun run types:check` passes. - `grep` confirms no remaining references to the old index name. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-26 01:52:34 -07:00
Abir Taheer	605a7263ab	Add tool router session deletion (#3679 ) ## Summary Explain the motivation and context for this change. Link to any related issues. Fixes # ## Changes - - ## Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? Describe the tests you ran and instructions so reviewers can reproduce. Include any relevant config/versions. ## Screenshots (if applicable) ## Checklist - [ ] I have read the Code of Conduct and this PR adheres to it - [ ] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [ ] I added tests or explain why not applicable - [ ] I added a changeset if this change affects published packages ## Additional context --------- Co-authored-by: jkomyno <alberto@composio.dev>	2026-06-26 12:38:28 +04:00
Rahul Tarak	b0b7fac9d9	docs: featured examples gallery + fix title selection (#3682 ) ## What Reworks the `/examples` index into a Modal-style featured gallery, styled to the Composio brand (pulled from `~/composio/landing`): flat editorial cards, sharp corners, mono uppercase category tags in accent colors, the signature brand offset-shadow on hover, and real toolkit logos on white chips. \| Light \| Dark \| \|---\|---\| \| Big `font-sans` hero, filter pills with live counts, responsive card grid \| Same, brand-consistent \| ### Highlights - `<ExamplesGallery>` — hero, category filter pills (Featured / General agents / Background agents / Coding agents) with live counts, responsive 1–3 col grid, staggered load-in. - Data-driven from frontmatter. Card title/description come from each page's own `title`/`description`. Presentation metadata lives in a new optional `gallery` block in the frontmatter schema: ```yaml gallery: categories: [General agents, Background agents] logos: [slack] featured: true order: 0 ``` Examples can belong to multiple category lanes (the Pi bot is both General + Background). - The index route renders the gallery; nested example pages keep the standard docs renderer. ### Drive-by fix `PageActions` lifts a full-width row over the page title (`-mt-12`) to place the "Copy page" button beside it. That invisible overlay sat on top of the title and blocked selecting/copying it. Fixed by making the overlay `pointer-events-none` and re-enabling them only on the button wrapper. Affects every docs page. ## Testing - `bun run types:check` passes. - Verified in light + dark: titles/descriptions match page frontmatter, multi-tag cards, filter counts, logo visibility (GitHub on white chips), title now selectable, Copy button still clickable. ## Notes - Category lanes are a fixed enum in two spots (`source.config.ts` enum + `CATEGORY_STYLES` color map in `examples-gallery.tsx`) — adding a new lane is a two-place edit. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-26 01:24:25 -07:00
Alberto Schiabel	20bf1b6345	chore(ts): quiet tsdown build warnings (#3665 ) This PR: - migrates shared tsdown dependency config from deprecated `external` / `noExternal` aliases to `deps.neverBundle` / `deps.alwaysBundle` - disables noisy Rolldown plugin timing and ineffective dynamic-import diagnostics in shared config while keeping build checks enabled - fixes the `json-schema-to-zod` `JSONSchema7TypeName` import so it stays type-only - keeps the CLI bundle graph aligned with `next` while quieting the dynamic-import warning through `checks.ineffectiveDynamicImport: false` - makes the Node file E2Es treat the current external storage `Unauthorized` upload response as an explicit `UPLOAD_UNAVAILABLE`/skip outcome instead of failing unrelated SDK build PRs Verification: - `pnpm build` - build log scan for `WARN`, deprecated `external` / `noExternal`, `deps.onlyBundle`, `PLUGIN_TIMINGS`, and `INEFFECTIVE_DYNAMIC_IMPORT` - `pnpm --dir ts/packages/cli test -- --runInBand` - `pnpm --dir ts/e2e-tests/runtimes/node/file-roundtrip typecheck` - `pnpm --dir ts/e2e-tests/runtimes/node/tool-router-files typecheck` - `pnpm lint:packages` - CI: TypeScript build/typecheck/test and Node 22/24/25, Deno, Cloudflare, and CLI e2e are green on the latest commit @composio/cli@0.2.32-beta.275	2026-06-26 12:17:33 +04:00
Rahul Tarak	9df19b46cc	chore(python): release 0.17.0 (#3678 ) Python SDK 0.17.0 (mirrors the TS `@composio/core` 0.13.0 surface). `make bump` (minor) bumped `pyproject.toml` + all provider packages to 0.17.0; this PR also syncs `composio/__version__.py` and adds the `## [0.17.0]` CHANGELOG entry so the release guard (`__version__` == `pyproject` == `CHANGELOG[0]`) passes — verified locally (`release workflow test passed`). ## 0.17.0 surface - `triggers.parse()` (parse + optionally verify a webhook; empty `verify_secret` now raises instead of silently skipping) and `triggers.set_webhook_subscription()` - `composio.sessions` is the canonical sessions mount; `composio.tool_router` deprecated alias - MCP is opt-in (`mcp=True`); default sessions return native tools - Prefer the `sandbox` session config key (`workbench` still accepted) - `connected_accounts.update_acl()` (graduated from experimental) Merging this triggers the Python publish. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-25 19:28:20 -07:00
sdkrelease[bot]	d102ab03ca	Release: update version (#3676 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.13.0 ### Minor Changes - `d17a268`: Add the first-class `composio.sessions.create()` API while keeping `composio.create()` as an alias, expose the experimental shared-connection ACL patch helper as `connectedAccounts.updateAcl()` while keeping `experimental.updateAcl()` as an alias, and include SDK docs/source in the published package. MCP is now opt-in. Sessions return native tools by default; the hosted MCP endpoint is only surfaced on the type when you create the session with `{ mcp: true }`. The default `create()` / `use()` now return `SessionWithoutMcp` (the runtime object is unchanged — `session.mcp` still exists at runtime — but it is no longer in the type). Migration: read `session.mcp` only after creating with `{ mcp: true }`. - `d17a268`: Surface the resolved workbench config on Tool Router sessions. - `Session.workbench` is now populated from the API response (on create/retrieve/attach/update). It exposes the resolved workbench config, e.g. `session.workbench?.enable` (defaults to `true` server-side). This lets callers create a session with the remote workbench disabled (`workbench: { enable: false }`) and detect that state — the foundation for running code in a sandbox you own via the experimental `@composio/experimental/workbench` helpers. ### Patch Changes - `d17a268`: Prefer `sandbox` for session code-execution configuration while continuing to accept the existing `workbench` alias. - `d17a268`: Add `triggers.parse()` to parse and optionally verify incoming webhook requests. - `d17a268`: Add `triggers.setWebhookSubscription()` to create or update the project webhook subscription from the TypeScript SDK. ## @composio/experimental@0.1.0 ### Minor Changes - `d17a268`: Add the experimental BYO local workbench helpers on the new `@composio/experimental/workbench` subpath. These let you run a Composio Tool Router session in a sandbox you own instead of Composio's hosted remote sandbox: - `experimental_createLocalWorkbenchSession(composio, session)` takes a caller-created session and returns `{ helperSource, env }`. It throws unless the session was created with `workbench: { enable: false }` (a local sandbox and the remote workbench cannot both run for one session). - `experimental_createWorkbenchEnv(options)` builds the environment variables the in-sandbox helper needs to reach Composio. - `experimental_createPythonWorkbenchHelperSource(options)` returns the Python helper source. The local workbench assumes code runs in the developer's sandbox and exposes Apollo-parity Python helpers for `run_composio_tool`, `invoke_llm`, `web_search`, and `proxy_execute`. > Security caveat: the helper authenticates with the developer's full _project_ API key, injected into the sandbox env as `COMPOSIO_API_KEY`. Any code or tool output running in the sandbox can read and exfiltrate it — treat the sandbox as your security boundary and rotate the key. A session-scoped `x-session-access-key` (so the long-lived project key never enters the sandbox) is the planned follow-up. - `d17a268`: Add an experimental package with a Pi coding-agent provider, static Composio tool wrapping, and dynamic Tool Router session helpers. ### Patch Changes - `d17a268`: Add `proxy_execute` to the experimental local workbench helper. The in-sandbox helper from `experimental_createLocalWorkbenchSession` (`@composio/experimental/workbench`) now exposes `proxy_execute(method, endpoint, toolkit, query_params=None, body=None, headers=None)` alongside `run_composio_tool`, `invoke_llm`, and `web_search`, so a local sandbox can make authenticated direct API calls to a connected toolkit when no pre-built tool exists. It posts to the public `…/session/{id}/proxy_execute` route with the session's project API key, and always returns a `(data, error)` tuple. ## @composio/slim@0.13.0 ### Minor Changes - `d17a268`: Add a slim Composio core package that mirrors the built `@composio/core` runtime and types without publishing the packaged `docs/` or `src/` trees. ## @composio/cli@0.3.1 ### Patch Changes - Updated dependencies [`d17a268`] - Updated dependencies [`d17a268`] - Updated dependencies [`d17a268`] - Updated dependencies [`d17a268`] - Updated dependencies [`d17a268`] - @composio/core@0.13.0 - @composio/cli-local-tools@0.1.1 ## @composio/cli-local-tools@0.1.1 ### Patch Changes - Updated dependencies [`d17a268`] - Updated dependencies [`d17a268`] - Updated dependencies [`d17a268`] - Updated dependencies [`d17a268`] - Updated dependencies [`d17a268`] - @composio/core@0.13.0 Co-authored-by: Rahul Tarak <cryogenicplanet@gmail.com> @composio/core@0.13.0	2026-06-25 18:54:17 -07:00
Sarah Simionescu	d2e273ba4c	fix(release): register slim+experimental in root workspaces (unblocks changeset release) (#3675 ) ## Why The changeset release on `next` (run after #3637 merged) failed, so no "Release: update version" PR was created and nothing published: ``` 🦋 error Found changeset add-slim-package for package @composio/slim which is not in the workspace ``` ## Root cause Changesets' package discovery (`@manypkg/get-packages`) reads the root `package.json` `workspaces` field, which was stale — it was missing `ts/packages/slim` and `ts/packages/experimental`. Both are present in `pnpm-workspace.yaml`, so pnpm/turbo saw them but changesets did not, and `changeset version` aborts entirely when a changeset references an undiscovered package. ## Fix - `package.json`: add `ts/packages/experimental` + `ts/packages/slim` to `workspaces`. - `.changeset/config.json`: `fixed` `@composio/core` ↔ `@composio/slim` so slim always ships the same version as core (slim mirrors the built core runtime). ## Verified locally `changeset version` now resolves cleanly: \| package \| version \| \|---\|---\| \| @composio/core \| 0.13.0 \| \| @composio/slim \| 0.13.0 (1-1 with core) \| \| @composio/experimental \| 0.1.0 \| Merging this re-triggers the TS SDK Release workflow, which will create the Version Packages PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code)	2026-06-25 18:43:26 -07:00
Rahul Tarak	97e40b7071	fix(release): register slim+experimental in root workspaces; fix slim to core version The changeset release on `next` aborted with "Found changeset add-slim-package for package @composio/slim which is not in the workspace", blocking the Version Packages PR and all publishes. Root cause: changesets' package discovery (@manypkg/get-packages) reads the root package.json `workspaces` field, which was stale — missing `ts/packages/slim` and `ts/packages/experimental` (both present in pnpm-workspace.yaml, so pnpm saw them but changesets did not). - package.json: add ts/packages/experimental and ts/packages/slim to workspaces - .changeset/config.json: fix @composio/slim to @composio/core so slim always ships the same version as core (slim mirrors the built core runtime) Verified `changeset version` now resolves: core 0.13.0, slim 0.13.0, experimental 0.1.0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-25 18:40:30 -07:00
Rahul Tarak	d17a268d3f	docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637 ) Integration branch for the next docs release: a sessions-first documentation rewrite — new and rewritten guides, example pages, interactive components, and docs tooling — plus the supporting SDK changes that the new docs describe. The bulk of this PR is docs (~24k lines across ~150 commits); the SDK changes (~5k lines) back the new guides. ## Documentation (the bulk) - Sessions-first restructure — reorganized navigation and section structure (incl. the "Sandbox (prev workbench)" section), with v3-reorganization redirects so old URLs keep resolving. - Rewritten core guides — quickstart, configuring sessions, triggers (creating + subscribing to events), proxy-execute, toolkits enable/disable, and common FAQ, rewritten in the house voice. - New example pages — local-sandbox PR reviewer, daily standup bot, and slack bot, with runnable build-ups. - New interactive components & diagrams — triggers flow animation, manage-connections visual, connection-refresh visual, and the terminal-kit components. - Docs tooling — a docs-graph link-graph connectivity checker, search reprioritization (deprioritize legacy pages), and SDK-reference regeneration. ## Supporting SDK changes `@composio/core` → 0.13.0 (minor) - `composio.sessions.create()` as the first-class sessions API (`composio.create()` kept as an alias). - MCP is opt-in: default `create()` / `use()` return native-tool sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface `session.mcp`. _Migration: read `session.mcp` only after creating with `{ mcp: true }`._ - `session.sandbox` is the canonical resolved config; `session.workbench` kept as a deprecated alias. `sandbox` is the preferred session-config key (`workbench` still accepted). - `connectedAccounts.updateAcl()` graduated from experimental (alias kept). - `triggers.parse()` (parse + optionally verify an incoming webhook) and `triggers.setWebhookSubscription()`. `@composio/experimental` → minor — local-workbench helpers moved onto the `@composio/experimental/workbench` subpath (out of `@composio/core/experimental`), keeping the ~14 KB embedded Python helper out of core. Plus the experimental Pi provider. `@composio/slim` → minor. Python → 0.17.0 — mirrors the TS surface: `composio.sessions` mount (`tool_router` deprecated), `triggers.parse()` / `set_webhook_subscription()`, the `sandbox` config key, and `connected_accounts.update_acl()`. ## Review response (#3664) Addressed the `@composio/core` review: - Security: `triggers.parse()` no longer fails open — a present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`) now throws instead of silently skipping verification; omitting it stays an explicit opt-out (both SDKs). - Removed snake_case leakage from `transformWebhookSubscription` (+ the index signature that allowed it). - Removed the TS-only `connectedAccounts.link()` toolkit auto-resolve (shipped with cancellability / orphaned-auth-config bugs and was effectively undocumented; to be reintroduced properly later). - Unified Python error types on `ValidationError`; added `mcp=True` Python tests; fixed runtime-portability + error-type test assertions. - Polished deprecation messages; fixed the backwards `/experimental` `@deprecated` note and the `SessionWithMcp` JSDoc. ## Testing - TS: `@composio/core` + `@composio/experimental` typecheck pass; vitest green for the touched suites. - Python: `test_tool_router.py` + `test_triggers.py` pass (161 tests). --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev> Co-authored-by: Malay Vasa <malayvasa@gmail.com> Co-authored-by: Sarah Simionescu <sarah@composio.dev> Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>	2026-06-25 18:27:43 -07:00
palash-c	eeca911392	Revert "docs: add Security and Data section (#3525 )" (#3668 )	2026-06-25 09:07:24 -07:00
palash-c	a098e39b18	docs: add Security and Data section (Security + Data retention) (#3525 ) Adds a Security and Data docs section (below Triggers and webhooks) with two pages: - Security (`/docs/security/overview`) — posture, compliance and the [Trust Center](https://trust.composio.dev), org/project isolation, credential protection (AES-256-GCM at rest, TLS), token redaction, webhook signing, responsibilities, and vulnerability reporting. - Data retention (`/docs/security/data-retention`) — what Composio stores, 1-year retention, the per-project Log storage → "Don't store data" option (Composio keeps an audit record but does not store tool-call payloads), an honest "Where your data goes" section (data still flows to the destination provider and sub-processors during execution; links the [Trust Center sub-processor list](https://trust.composio.dev/subprocessors)), and a contact-sales path for contractual arrangements. Includes a redacted dashboard screenshot. Note: "Don't store data" controls what Composio retains; it is not framed as a zero-data-retention guarantee. 🤖 Generated with [Claude Code](https://claude.com/claude-code)	2026-06-25 20:08:48 +05:30
Palash Kala	ad8b10dc48	docs(security): drop file-TTL configurability line (control not shipped yet) Keep the default 1-hour file TTL description; remove the per-project Settings → File TTL configurability sentence until that dashboard control ships. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-25 19:20:08 +05:30
Palash Kala	a072697252	docs(security): tie file payloads in object storage to the file TTL Split the "Where your data goes" file/trigger bullet: file payloads live in object storage only for the file TTL (1h default) then expire, distinct from trigger destinations which receive events in real time. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-25 19:17:52 +05:30

1 2 3 4 5 ...

4342 Commits