mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/cli@0.2.32-beta.287
4385 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Sarah Simionescu
|
1aa6a22d8a |
feat(cli): add --no-browser flag to link command (#3829)
## Summary Adds a `--no-browser` flag to `composio link` (and `composio dev connected-accounts link`) that skips auto-opening the browser and prints the authorization URL for the user to open manually, while still waiting for the connection to become `ACTIVE`. Previously the only way to suppress the browser auto-open was `--no-wait`, which also exits without waiting for authorization. `--no-browser` fills the gap for users (and remote/SSH sessions) who want to click the link themselves but still get the wait-for-ACTIVE confirmation — matching the existing `composio login --no-browser` behavior. ## Changes - New `--no-browser` boolean option on both the root `link` command and the `dev connected-accounts link` variant - `waitForActiveConnection` skips `open()` and tells the user to open the printed URL when the flag is set - The unmanaged-auth dashboard fallback (`ToolRouterV2_NoManagedAuth`) also respects the flag - Root help (`root-help.ts`) documents the new flag - Test: `link gmail --no-browser` waits for ACTIVE and never calls `open` No VHS recording added — this is a small flag addition to an existing command surface, not a new documented workflow. ## Verification - `pnpm typecheck` — passes - `pnpm --filter @composio/cli test` — 81 files, 725 tests pass 🤖 Generated with [Claude Code](https://claude.com/claude-code)@composio/cli@0.2.32-beta.287 |
||
|
Sarah Simionescu
|
ba999577d7 |
fix(cli): use manual authorization copy on link --no-wait paths
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Sarah Simionescu
|
aad2e9a2fd |
fix(cli): drop redirect copy when link runs with --no-browser
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Sarah Simionescu
|
b003baaf1f |
feat(cli): add --no-browser flag to link command
Adds a --no-browser flag to `composio link` (and `composio dev connected-accounts link`) that prints the authorization URL instead of auto-opening the browser, while still waiting for the connection to become ACTIVE. Also respected on the unmanaged-auth dashboard fallback. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
fbcf08136d |
revert(core): defer v1 session alias removal (#3826)
This PR: - reverts https://github.com/ComposioHQ/composio/pull/3780 - restores the TypeScript `composio.create()` and `composio.use()` session aliases, with their runtime and type-test coverage - restores the prior deprecation state for `BaseProvider.wrapMcpServerResponse` - removes the pre-v1 breaking-change changeset so the release PR no longer advertises this removal The v1 API-freeze change should be recreated later as a draft PR and kept out of the merge queue until v1 is ready. |
||
|
jkomyno
|
d5c86d3d6b | fix(release): keep core pre-v1 | ||
|
Anas Khan
|
fa933a6f9b |
fix(ts): point published package homepage links at the next branch (#3821)
```markdown The `homepage` field in every published TypeScript package points at `https://github.com/ComposioHQ/composio/tree/main/ts/packages/<pkg>#readme`. The repository's default branch is `next` and there is no `main` branch, and GitHub does not redirect `tree/<branch>` paths to the default branch when that branch does not exist. As a result each of these homepage links returns a 404 wherever it is surfaced (the package page on npmjs.com, editor/IntelliSense hovers, and `npm view <pkg> homepage`). This repoints each `homepage` to `tree/next/...` so the links resolve. The `repository.url` (plain `.git` URL) and `bugs.url` fields were already correct and are left untouched. The metadata was originally added in #3611; this only corrects the branch in the `homepage` URLs. Fixes # ## Changes - Update the `homepage` field from `tree/main/...` to `tree/next/...` in the 14 published packages that carry one: `@composio/core`, `@composio/slim`, `@composio/experimental`, `@composio/json-schema-to-zod`, and the providers `@composio/anthropic`, `@composio/claude-agent-sdk`, `@composio/cloudflare`, `@composio/google`, `@composio/langchain`, `@composio/llamaindex`, `@composio/mastra`, `@composio/openai`, `@composio/openai-agents`, `@composio/vercel`. - Add a Changeset (patch) covering those 14 published packages. ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? Metadata-only change, so there is no unit test to add. Verified with: - Confirmed the target branch: `git ls-remote --symref origin HEAD` reports `refs/heads/next`, and `git ls-remote --heads origin main` is empty (no `main`). - Confirmed the links resolve: `https://github.com/ComposioHQ/composio/tree/main/ts/packages/core` returns HTTP 404 while `.../tree/next/ts/packages/core` returns HTTP 200 (same for the provider packages). - All 14 edited `package.json` files still parse as valid JSON. - `pnpm exec prettier --check` on the 14 `package.json` files and the changeset: all pass. - `pnpm changeset status --since=origin/next` lists exactly these 14 packages bumping at `patch` (no missing or extra packages), so the changeset CI check is satisfied. Environment: node 26, pnpm 10.28.0. ## Screenshots (if applicable) ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages ## Additional context The `homepage` URLs pin an explicit branch (`tree/<branch>`), so they will break again if the default branch is ever renamed. If you would prefer a branch-agnostic form (for example dropping the `tree/<branch>` segment so the URL tracks the default branch, or linking to the published README), I am happy to switch to that instead; I went with the smallest correct fix of pointing at the actual default branch. ``` Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> |
||
|
Alberto Schiabel
|
3a5e62feb4 |
fix(py): support list-valued schema types in tool signatures (#3815)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3754 - normalizes list-valued JSON Schema `type` fields before scalar type lookups - applies the handling to direct fields and `anyOf`/`oneOf` options - adds regressions for nullable, single, mixed, unknown, and combiner-nested type lists - credits @anxkhn as a Git co-author ## Context JSON Schema Draft 2020-12 and OpenAPI 3.1 allow `type` to be an array. The previous parser passed that list to a dictionary lookup, raising `TypeError: unhashable type: 'list'`. This replacement covers the direct case from #3754 and the same shape nested in a combiner. --------- Co-authored-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> |
||
|
Alberto Schiabel
|
f9c2dc5d00 |
docs: update documentation for new changelog entries (#3816)
## Summary Automated documentation updates triggered by new changelog entries merged to next. Generated by Codex via GitHub Actions. Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
edd0bf0479 |
docs: centralize SDK release notes (#3814)
This PR: - Adds public docs changelog entries for the Python and TypeScript SDK releases since May 15, 2026, including the previously unmigrated Python 0.13.1 entry. - Removes the Python-local changelog and replaces it with canonical changelog links from the repository and Python READMEs. - Retargets the Python release guard to the docs changelog, documents its table contract, and covers prior-version plus PEP 440 version parsing. Validation: - pnpm test:release-workflow - docs: bun run test - docs: bun run lint:links - docs: bun run types:check - docs: bun run build - pnpm exec prettier --check test/release-workflow.test.ts docs/agent-guidance/guides/changelog.md docs/content/changelog/*.mdx Review: - ce-code-review completed with correctness, testing, maintainability, project-standards, agent-native, learnings, and adversarial passes. All actionable findings were fixed; final adversarial re-review found no remaining P0-P2 issue. |
||
|
Alberto Schiabel
|
71255765a5 |
fix(schema): normalize duplicate required entries (#3812)
## Summary - Normalize duplicate JSON Schema `required` entries at the shared `ToolSchema` ingress boundary. - Reapply normalization immediately before direct providers emit vendor schemas (Anthropic, OpenAI, OpenAI Responses, Google, Cloudflare, and OpenAI Agents). - Preserve literal `const`/`default`/`enum`/`examples` values, tolerate aliasing safely, and fail predictably on pathological nesting. - Document the provider-boundary rule in `ts/packages/providers/AGENTS.md`. Co-authored-by: @MatinGathani ## Verification - `pnpm changeset status` - `pnpm --filter @composio/core build` - Focused core and affected-provider Vitest suites (1,151 tests) - `pnpm typecheck` - `pnpm lint` (passes with 71 pre-existing warnings) --------- Co-authored-by: MatinGathani <70268627+matingathani@users.noreply.github.com> |
||
|
Abhishek Patil
|
71862b8f97 |
docs: add support-informed toolkit FAQs (#3692)
## Summary - Ports support-workflows toolkit KB into public toolkit FAQ docs for 85 toolkit FAQ files. - Creates 46 new toolkit FAQ files for toolkits that had KB but no FAQ file yet. - Updates existing toolkit FAQ files without deleting current public answers. ## General docs updates - Clarifies connected-account credential redaction and reconnect/refresh semantics. - Documents Proxy Execute scoped-key and v3.1/current-SDK requirements. - Adds retry risk guidance for non-idempotent direct tool executions. - Adds remote sandbox temporary state/file retention guidance. - Adds Composio Connect vs developer project boundary guidance for MCP app connections. ## Verification - Hygiene grep passed on changed files: `Plain|T-|SUP-|PRO-|Linear|plain.com|linear.app|/Users/|support-workflows|TODO|FIXME|\[eng:|customer`. - `git diff --check` passed. - `bun run lint:links` passed: 0 errored files, 0 errors. - `bun run build` passed. Build emitted the existing Turbopack NFT warning plus toolkit-detail fetch skips because `COMPOSIO_API_KEY` is not set locally. - Render spot checks passed for Gmail, Apollo, SharePoint, Google Calendar, connected accounts, and remote sandbox pages. ## Deferred - PowerPoint KB was not added because the current docs toolkit catalog has no `powerpoint` toolkit slug/page. The KB describes a possible future file-operations toolkit rather than an existing public toolkit page. --------- Co-authored-by: Sarah Simionescu <sarah@composio.dev> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
MatinGathani
|
d5a37efb85 |
fix(python): handle title-less top-level schemas (#3325)
## Summary Fixes `json_schema_to_model` when a top-level JSON schema omits `title` or sets it to `null`. This is the remaining direct-helper path; anonymous nested objects from #2435 are already handled by `schema_converter.py`. - falls back to `GeneratedModel` only when the title is `None`, preserving intentionally empty string titles - adds regression coverage for missing, `null`, and empty titles, model construction, and required-field validation ## Validation - `ruff format --check python/composio/utils/shared.py python/tests/test_schema_parser.py` - `ruff check python/composio/utils/shared.py python/tests/test_schema_parser.py` - `PYTHONPATH="$PWD/python" /Users/jkomyno/work/composio/composio2/.venv/bin/pytest -q python/tests/test_schema_parser.py` This is a follow-up to #2435; it intentionally does not close that already-resolved issue. Co-authored-by: jkomyno <alberto@composio.dev> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
dependabot[bot]
|
09aab1d19f |
chore(deps-dev): bump the npm-development group across 1 directory with 3 updates (#3795)
Bumps the npm-development group with 3 updates in the / directory: [turbo](https://github.com/vercel/turborepo), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [typedoc](https://github.com/TypeStrong/TypeDoc). Updates `turbo` from 2.10.2 to 2.10.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.10.4</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.10.3 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13222">vercel/turborepo#13222</a></li> <li>ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13240">vercel/turborepo#13240</a></li> <li>perf: Use mimalloc as the global allocator by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13237">vercel/turborepo#13237</a></li> <li>perf: Parse yarn v1 lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13241">vercel/turborepo#13241</a></li> <li>ci: Fix cache outputs for Eve app by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13243">vercel/turborepo#13243</a></li> <li>perf: Stop materializing spans for the disabled daemon log layer by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13244">vercel/turborepo#13244</a></li> <li>fix: Keep ancestor-scoped bun dependencies resolvable after prune renames by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13236">vercel/turborepo#13236</a></li> <li>perf: Overlap external dependency hashing with package file hashing by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13234">vercel/turborepo#13234</a></li> <li>perf: Build tracked repo index concurrently with package graph by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13232">vercel/turborepo#13232</a></li> <li>perf: Release tokio runtime at exit so background DNS lookups never stall the user by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13231">vercel/turborepo#13231</a></li> <li>perf: Overhaul pnpm lockfile parsing and dependency closure computation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13228">vercel/turborepo#13228</a></li> <li>feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13227">vercel/turborepo#13227</a></li> <li>feat: Introduce toolchain provider abstraction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13235">vercel/turborepo#13235</a></li> <li>perf: Parse Berry lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13242">vercel/turborepo#13242</a></li> <li>fix: Apply input exclusion globs to the filesystem walk by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13224">vercel/turborepo#13224</a></li> <li>fix: Stop root-directory packages from claiming every file in change mapping by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13225">vercel/turborepo#13225</a></li> <li>chore: Rename turborepo-repository napi package to <code>@turbo/repository</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13226">vercel/turborepo#13226</a></li> <li>perf: Hash git blobs with hardware-accelerated SHA-1 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13245">vercel/turborepo#13245</a></li> <li>release(turborepo): 2.10.4-canary.1 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13247">vercel/turborepo#13247</a></li> <li>feat: Discover Cargo crates as packages by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13248">vercel/turborepo#13248</a></li> <li>perf: Reuse per-package external dependency hashes in run summaries by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13249">vercel/turborepo#13249</a></li> <li>perf: Stat workspace turbo.json files concurrently during discovery by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13251">vercel/turborepo#13251</a></li> <li>chore: Add tracing spans to workspace discovery and globwalk phases by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13252">vercel/turborepo#13252</a></li> <li>fix: Avoid non-reentrant libc calls in concurrent shutdown process scans by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13256">vercel/turborepo#13256</a></li> <li>perf: Memoize resolved task definitions during engine construction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13257">vercel/turborepo#13257</a></li> <li>perf: Compute transitive closures and external dependency hashes concurrently with run setup by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13250">vercel/turborepo#13250</a></li> <li>perf: Probe microfrontends configs in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13262">vercel/turborepo#13262</a></li> <li>feat: Execute Cargo crate tasks via cargo by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13261">vercel/turborepo#13261</a></li> <li>perf: Pre-size engine task collections by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13265">vercel/turborepo#13265</a></li> <li>feat: Expose resolved experimentalCI task configuration in <code>turbo query</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13264">vercel/turborepo#13264</a></li> <li>feat: Derive input and output globs for Cargo tasks by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13263">vercel/turborepo#13263</a></li> <li>perf: Parse large pnpm lockfile sections in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13266">vercel/turborepo#13266</a></li> <li>feat: Hash Cargo external dependencies per-crate by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13267">vercel/turborepo#13267</a></li> <li>ci: Install pnpm 10 in musl containers for Library Release by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13269">vercel/turborepo#13269</a></li> <li>ci: Force pnpm overwrite in Library Release musl containers by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13270">vercel/turborepo#13270</a></li> <li>perf: Defer the untracked-scan barrier to first file-hash use by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13268">vercel/turborepo#13268</a></li> <li>ci: Fetch API-created commit before updating local ref by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13271">vercel/turborepo#13271</a></li> <li>release(library): 0.0.1-canary.22 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13272">vercel/turborepo#13272</a></li> <li>perf: Remove lock and dispatch overhead from task hash precomputation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13273">vercel/turborepo#13273</a></li> <li>fix: Fall back to lockfile detection in <code>@turbo/repository</code> when package manager is undeclared by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13275">vercel/turborepo#13275</a></li> <li>test: Add end-to-end coverage for Cargo workspaces by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13274">vercel/turborepo#13274</a></li> <li>release(library): 0.0.1-canary.23 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13276">vercel/turborepo#13276</a></li> <li>release(turborepo): 2.10.4-canary.2 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13278">vercel/turborepo#13278</a></li> <li>fix: Collapse nested package-manager fallback conditional by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13279">vercel/turborepo#13279</a></li> <li>feat: Make turbo watch Cargo-aware by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13280">vercel/turborepo#13280</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/1506a114e377dd7e1e8e7a7863c42adf94a9f776"><code>1506a11</code></a> publish 2.10.4 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/11a68c705274cc7a408776b576ce7a9e14d6e6df"><code>11a68c7</code></a> fix: Stop flagging relative imports that resolve into node_modules in boundar...</li> <li><a href="https://github.com/vercel/turborepo/commit/947b4784cd1b254e62b663bbdb22891a849b7442"><code>947b478</code></a> fix: Raise the open-file soft limit at startup (<a href="https://redirect.github.com/vercel/turborepo/issues/13282">#13282</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ddc584d788349fc3668e280286f540feee4eb6b9"><code>ddc584d</code></a> feat: Make turbo prune Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13281">#13281</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ff0d50822314c5b388d9b4daa9c6159387752d95"><code>ff0d508</code></a> perf: Skip dependency-closure assembly for toolchains that derive nothing (<a href="https://redirect.github.com/vercel/turborepo/issues/1">#1</a>...</li> <li><a href="https://github.com/vercel/turborepo/commit/39d623e1323ef50e06be0a103082ae29cc545779"><code>39d623e</code></a> feat: Make turbo watch Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13280">#13280</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/af01fdfeb5efe07a7b6843a0b8f5033b59ebbb2c"><code>af01fdf</code></a> fix: Collapse nested package-manager fallback conditional (<a href="https://redirect.github.com/vercel/turborepo/issues/13279">#13279</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/7e02f94f647cb4d527a438313dc4adbe3e8c0df3"><code>7e02f94</code></a> release(turborepo): 2.10.4-canary.2 (<a href="https://redirect.github.com/vercel/turborepo/issues/13278">#13278</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/8e3a59fdb6c71ad24fbbb363db52f88eb9a89116"><code>8e3a59f</code></a> release(library): 0.0.1-canary.23 (<a href="https://redirect.github.com/vercel/turborepo/issues/13276">#13276</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ce18f0a79eb49e9a22c7e6cfa491777c24ed746a"><code>ce18f0a</code></a> test: Add end-to-end coverage for Cargo workspaces (<a href="https://redirect.github.com/vercel/turborepo/issues/13274">#13274</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.10.2...v2.10.4">compare view</a></li> </ul> </details> <br /> Updates `typescript-eslint` from 8.62.1 to 8.63.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's releases</a>.</em></p> <blockquote> <h2>v8.63.0</h2> <h2>8.63.0 (2026-07-06)</h2> <h3>🚀 Features</h3> <ul> <li><strong>eslint-plugin:</strong> [no-misused-promises] detect async usage of a sync dispose usage (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12426">#12426</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12447">#12447</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12446">#12446</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12491">#12491</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12485">#12485</a>)</li> <li><strong>eslint-plugin:</strong> [no-base-to-string] don't flag a shadowed String() call (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12492">#12492</a>)</li> <li><strong>scope-manager:</strong> export ClassStaticBlockScope (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12460">#12460</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Evyatar Daud <a href="https://github.com/StyleShit"><code>@StyleShit</code></a></li> <li>Kristjan <a href="https://github.com/KristjanTammekivi"><code>@KristjanTammekivi</code></a></li> <li>Michael Naumov <a href="https://github.com/mnaoumov"><code>@mnaoumov</code></a></li> <li>Serhii Leniv <a href="https://github.com/Serhii-Leniv"><code>@Serhii-Leniv</code></a></li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's changelog</a>.</em></p> <blockquote> <h2>8.63.0 (2026-07-06)</h2> <p>This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374"><code>290cf6c</code></a> chore(release): publish 8.63.0</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint">compare view</a></li> </ul> </details> <br /> Updates `typedoc` from 0.28.19 to 0.28.20 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/TypeDoc/releases">typedoc's releases</a>.</em></p> <blockquote> <h2>v0.28.20</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md">typedoc's changelog</a>.</em></p> <blockquote> <h2>v0.28.20 (2026-07-05)</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/TypeStrong/typedoc/commit/34d843be0953fc81de0fde14bea8db72d0bbccc6"><code>34d843b</code></a> Update changelog for release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/fbd4a254952c171b9ba7ebbe96c5151e844743be"><code>fbd4a25</code></a> Bump version to 0.28.20</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/93ba157000e4a632bfbf32a0b6f00f8ae57c7c99"><code>93ba157</code></a> Update dependencies in example</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/e8c5df8844edca9800dfc62cee9115ef0fba59ea"><code>e8c5df8</code></a> Remove unnecessary files from distribution</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/392b0dd50a428ea0c732c38c6c263e74cb6200b1"><code>392b0dd</code></a> Update dependencies</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/8510dd48c7778f419f4605146f1a733af27993fa"><code>8510dd4</code></a> Add missing entries in changelog before release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/51dc0521890924269f06e08972c6453299f63cb5"><code>51dc052</code></a> Update change log for 0.28.20 release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/72f20cd87b4ef30aae97b68fcbb42ca19cebdc22"><code>72f20cd</code></a> Merge branch 'fix-locale-sort-group-category-titles' into dev</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/623f2c0bd35b5e89cc79fb5783dac01c6f2530e9"><code>623f2c0</code></a> Fix failing test, accept slightly slower build for now</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/c8bdf14cab0c22dd415b6872cc647c6cf81f917c"><code>c8bdf14</code></a> Minor config tweak to improve dev build time</li> <li>Additional commits viewable in <a href="https://github.com/TypeStrong/TypeDoc/compare/v0.28.19...v0.28.20">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
de0bfa356d |
fix(docs): resolve changelog links and Vercel deploys (#3811)
This PR: - fixes copied changelog date URLs so they stay on `/reference/changelog` and target the selected date - resolves fragment links against the current page while preserving full site-relative links - upgrades the docs app to Vercel-supported `eve@0.18.0` - migrates docs-agent evals from the removed `t.completed()` assertion to `t.succeeded()` - verifies the docs static suite, TypeScript type-check, and production build --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
0de52639c4 |
feat(core)!: remove bare session aliases; freeze MCP SPI (#3780)
## What and why This makes the intended v1 API cleanup real rather than postponing it to v2: - Remove the TypeScript root aliases `composio.create(...)` and `composio.use(...)`. Session creation and reuse now live only at `composio.sessions.create(...)` and `composio.sessions.use(...)`. This is a deliberate breaking change, reflected by a major changeset. - Retain `BaseProvider.wrapMcpServerResponse` as the stable v1 provider SPI. Its earlier deprecation pointed to a method that was never introduced. The scope is intentionally narrow: it does **not** remove unrelated deprecated APIs, and Python keeps its supported `Composio.create/use` API. The TypeScript docs, examples, providers, runtime fixtures, generated SDK reference, and API-reference indexes now use the namespaced TypeScript API. Historical changelog examples are left as history. ## Verification - `pnpm typecheck` - `pnpm --filter @composio/core test -- --run test/core/session.test.ts` (42 files, 1,018 tests) - `pnpm exec eslint ts/packages/core/src/composio.ts` - `pnpm --filter @composio/core generate:docs` - `cd docs && bun run generate:api-index` - `cd docs && bun run types:check` - `git diff --check` and targeted scans for removed TypeScript aliases I also attempted the affected Node and Cloudflare runtime E2E suites. They cannot initialize in this checkout without `COMPOSIO_API_KEY` (and, for Cloudflare, `COMPOSIO_BASE_URL` and `OPENAI_API_KEY`); they did not report a product assertion failure. |
||
|
Alberto Schiabel
|
8a19b75915 |
fix(docs): publish production API URLs and guard against staging leaks (#3770)
## What was wrong The API reference docs were shipping staging URLs to users. There were two separate leaks, both from the same source: the scheduled `docs-update-data` workflow fetches the OpenAPI specs and toolkit data from staging every 5 hours and auto-commits them. The first leak was the curl base URL. `servers[0].url` in `openapi.json` and `openapi-v3.json` rendered as `http://staging-apollo.composio.dev` in every curl example. That is what https://github.com/ComposioHQ/composio/pull/3761 tried to fix. The second leak was in the toolkit data. `toolkits.json` carried 269 `https://staging-backend.composio.dev/api/v1/auth-apps/add` default values, surfaced in the white-labeling and auth-config docs. #3761 never touched this file. ## Which PR caused it Karan asked on Slack whether we could pin down the PR that introduced this. We can. It was https://github.com/ComposioHQ/composio/pull/3426 (commit `a3e58a421`, merged 2026-07-03), which flipped `servers[0].url` from `https://backend.composio.dev` / `PRODUCTION API` to `http://staging-apollo.composio.dev` / `STAGING API` in both specs. It was not a hand-written change. #3426 is itself an auto-generated PR from this same `docs-update-data` workflow, opened by `github-actions[bot]` on the `docs/auto-update-data` branch. The workflow fetched from staging, staging serves the staging server URL in its spec, and the value landed in the committed files where nobody caught it inside a large auto-generated diff. That is the reason the real fix belongs in the generator and the workflow, not in a one-off edit to the JSON. ## Why #3761 was not enough #3761 pinned `spec.servers` to production inside `fetch-openapi.mjs`. That closed the first leak, but three things stayed open. It only covered the OpenAPI specs. The 269 staging hosts in `toolkits.json` come from a different generator, `generate-toolkits.ts`, and stayed live on the docs site. It added no CI guard. The fix was a single line in a generator with nothing asserting it. A later refactor that dropped or reordered that line would republish staging on the next 5-hour regeneration, which is precisely the recurring failure that produced the original report. And it scrubbed the symptom rather than the source. The workflow kept fetching from staging; the pin just rewrote one field afterward. ## The fix I addressed it at four layers, so no single regression brings staging back. **Source.** `docs-update-data.yml` no longer overrides the base URL to staging. The generators default to production, so the docs reflect production. **Generators.** The production URL now lives in one place, `docs/scripts/production-api.mjs`. The toolkit and meta-tools generators sanitize any staging host to production before writing, so a staging fetch can no longer republish staging. **Committed data.** I rewrote the 269 staging hosts already in `toolkits.json` to production. **Guard.** `docs/tests/static/production-urls.test.ts` asserts the OpenAPI `servers` is production and scans both specs and every `public/data/*.json` for any `staging-*.composio.dev` host. It is an independent oracle: it hardcodes the expected value and deliberately does not import the generator constants, so a wrong edit there fails CI instead of moving both sides together. I verified it catches both the original `staging-apollo` and the `staging-backend` leaks. ## One thing to confirm before merge `COMPOSIO_API_KEY` is paired with `COMPOSIO_BASE_URL_STAGING` in every other workflow, so it is most likely a staging key. If that is the case, provision a production-capable key before the next scheduled run. Otherwise that run fails on auth, which is loud and safe, rather than silently republishing staging. The generator sanitizer and the guard keep the output correct regardless of which environment the fetch hits, so there is no risk in the interim. ## Testing - `bun test tests/static/` passes 21 of 21 (16 existing, 5 new). - The shared module loads and all three generators build under bun. - No `staging-*.composio.dev` host remains under `docs/public/`. - `docs-update-data.yml` re-validated as valid YAML. |
||
|
Alberto Schiabel
|
a0f37a7f77 |
fix(core): SSRF guard on URL file inputs + telemetry secret redaction (#3779)
## What & why Two v1 non-negotiable gates from the [SDK road to v1](https://github.com/ComposioHQ/composio) plan are currently red. Both are self-contained and closed here. ### ① SSRF guard on URL file inputs — `@composio/core` `composio.files.upload(url)` and automatic file upload during tool execution did a **raw `fetch()`** on user-supplied URLs (`readFileContentFromURL`, `fileUtils.node.ts`) with no guard. Because URL inputs deliberately bypass the local-path allowlist, a caller — or an LLM-produced tool argument — could point the SDK at internal infrastructure (`http://169.254.169.254/…` cloud metadata, RFC1918 hosts) or a public URL that 3xx-redirects into internal space. New `ssrfGuard.node.ts`: - resolves the host and refuses **private, loopback, link-local (incl. `169.254.169.254`), CGNAT, TEST-NET, benchmarking, multicast, and reserved** ranges (IPv4 + IPv6, incl. IPv4-mapped / NAT64); - validates the **resolved address**, not the hostname string, so decimal/octal/hex IP obfuscation doesn't slip through; - rejects non-`http(s)` schemes; - follows redirects **manually** so every hop is re-validated; - blocked requests throw the new `ComposioBlockedInternalUrlError`. Behaviour for legitimate public URLs is unchanged. Node-only path. Known residual (documented in-file): a DNS-rebinding TOCTOU window between our lookup and `fetch`'s connect — closing it fully needs connect-time IP pinning (a custom dispatcher), out of scope here. ### ② Telemetry secret redaction — `@composio/core` Error telemetry shipped `error.message` / `error.stack` **verbatim** to `telemetry.composio.dev` with zero redaction. New `redact.ts` runs at the single chokepoint (`prepareAndSendErrorTelemetry`) and strips URL query strings, `Authorization` bearer/basic credentials, and secret-like `key=value` pairs (API keys, tokens, client secrets, passwords) before transport. ## Tests - `ssrfGuard.test.ts` — IP classification (v4/v6, mapped, CGNAT, metadata), scheme rejection, resolve-to-internal, "any resolved address internal" pinning bypass, redirect-into-internal, redirect budget. - `redact.test.ts` — URL query, bearer/basic, key/value secrets, quote preservation, benign text untouched. - Updated `fileUtils.test.ts` to mock DNS (hermetic) and expect `redirect: 'manual'`. - `tsc --noEmit` clean; lint clean. ## Notes - `patch` changeset included. - Adds `ComposioBlockedInternalUrlError` to the public error exports. |
||
|
dependabot[bot]
|
4baacbeb77 |
chore(deps): bump the npm-production group across 1 directory with 7 updates (#3799)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
dependabot[bot]
|
78591f7623 |
chore(deps): bump the github-actions group with 5 updates (#3792)
Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.163` | `1.0.170` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.10` | `1.11` | | [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) | `1.0.163` | `1.0.170` | | [actions/stale](https://github.com/actions/stale) | `10.3.0` | `10.4.0` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | Updates `anthropics/claude-code-action` from 1.0.163 to 1.0.170 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.170</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170</a></p> <h2>v1.0.169</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169</a></p> <h2>v1.0.168</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168</a></p> <h2>v1.0.167</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167</a></p> <h2>v1.0.166</h2> <h2>What's Changed</h2> <ul> <li>Drop buffered inline comment when it is posted live (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1405">#1405</a>) by <a href="https://github.com/archievi"><code>@archievi</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li>Use modern noreply email for co-author trailers by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1369">anthropics/claude-code-action#1369</a></li> <li>fix(restore): handle symlinked CLAUDE.md paths during config snapshot by <a href="https://github.com/syf2211"><code>@syf2211</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li>fix: preserve repeated add-dir flags in claude args by <a href="https://github.com/Jerry2003826"><code>@Jerry2003826</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1256">anthropics/claude-code-action#1256</a></li> <li>fix: propagate curl failures in install pipeline by <a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> <li>chore: fix prettier formatting by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1463">anthropics/claude-code-action#1463</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/archievi"><code>@archievi</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li><a href="https://github.com/syf2211"><code>@syf2211</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li><a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166</a></p> <h2>v1.0.165</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165</a></p> <h2>v1.0.164</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/536f2c32a39763739000b0e1ac69ca2647d97ce9"><code>536f2c3</code></a> chore: bump Claude Code to 2.1.206 and Agent SDK to 0.3.206</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/37b464ce72700f7b2c5ff8d2db7fa7b15df792f5"><code>37b464c</code></a> chore: bump Claude Code to 2.1.205 and Agent SDK to 0.3.205</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/ba0aafd4308cbba7165f9f2cdb0cfbed5a3c99ce"><code>ba0aafd</code></a> chore: bump Claude Code to 2.1.204 and Agent SDK to 0.3.204</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0fe28cdb64e23015219b0e478100b7105fd7dfa1"><code>0fe28cd</code></a> chore: bump Claude Code to 2.1.203 and Agent SDK to 0.3.203</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f87768c6d25f92ae6efa7175e223ef77d4cbf97f"><code>f87768c</code></a> chore: bump Claude Code to 2.1.202 and Agent SDK to 0.3.202</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/58a2944bbcf1a73b1ae7960995fffca4fa29b113"><code>58a2944</code></a> chore: fix prettier formatting (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1463">#1463</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/beb753ed7288e960e1519e0bf631be7b502af876"><code>beb753e</code></a> fix: propagate curl failures in install pipeline (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1241">#1241</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/235b39bf21ce5bca22c31b37d171bd6e27cdd743"><code>235b39b</code></a> fix: preserve repeated add-dir flags in claude args (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1256">#1256</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/d060ddc96310109df573e19c7c458b84816c6af6"><code>d060ddc</code></a> fix(restore): handle symlinked CLAUDE.md paths during config snapshot (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1441">#1441</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0f07aee43515c58828104d3f2391785c2c565dd5"><code>0f07aee</code></a> Use modern noreply email for co-author trailers (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1369">#1369</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/769e3bdff9bb7ecfb51bad4c9cba23d6f5fc5ea5...536f2c32a39763739000b0e1ac69ca2647d97ce9">compare view</a></li> </ul> </details> <br /> Updates `openai/codex-action` from 1.10 to 1.11 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's changelog</a>.</em></p> <blockquote> <h1>codex-action Changelog</h1> <h2><a href="https://github.com/openai/codex-action/tree/v1.11">v1.11</a> (2026-07-04)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/116">#116</a> keep the permission profile helper backward compatible</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.10">v1.10</a> (2026-07-02)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/113">#113</a> add Codex permission profile support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a> (2026-06-22)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/85">#85</a> update the internal <code>setup-node</code> pin to <code>v6.3.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a> (2026-04-29)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/91">#91</a> tighten what bots are allowed</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a> (2026-04-24)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/89">#89</a> restrict bot permission bypass</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/77">#77</a> enable GitHub-hosted Linux bubblewrap support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/74">#74</a> harden shell interpolation in action workflows</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/58">#58</a> revert <a href="https://redirect.github.com/openai/codex-action/issues/56">#56</a> and use the latest stable version of Codex CLI again</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/56">#56</a> temporarily set the default version of Codex CLI to <code>0.58.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a> (2025-11-07)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/52">#52</a> add <code>baseUrl</code> to <code>Octokit</code> constructor, if appropriate, for GHE</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a> (2025-11-05)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/47">#47</a> added support for Azure via the new <code>responses-api-endpoint</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/36">#36</a> added <code>effort</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/45">#45</a> pin the commit hash of the <code>actions/setup-node</code> action used by <code>openai/codex-action</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.0">v1.0</a> (2025-10-06)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/openai/codex-action/commit/52fe01ec70a42f454c9d2ebd47598f9fd6893d56"><code>52fe01e</code></a> fix: keep permission profile helper backward compatible (<a href="https://redirect.github.com/openai/codex-action/issues/116">#116</a>)</li> <li><a href="https://github.com/openai/codex-action/commit/0d2a018b4dacc6b0eaa3918e0d2780df6d6fd23e"><code>0d2a018</code></a> docs: update CHANGELOG for v1.10 (<a href="https://redirect.github.com/openai/codex-action/issues/114">#114</a>)</li> <li>See full diff in <a href="https://github.com/openai/codex-action/compare/6b771854be52d8637d060e4b15120b9d746282ab...52fe01ec70a42f454c9d2ebd47598f9fd6893d56">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.163 to 1.0.170 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.170</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170</a></p> <h2>v1.0.169</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169</a></p> <h2>v1.0.168</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168</a></p> <h2>v1.0.167</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167</a></p> <h2>v1.0.166</h2> <h2>What's Changed</h2> <ul> <li>Drop buffered inline comment when it is posted live (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1405">#1405</a>) by <a href="https://github.com/archievi"><code>@archievi</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li>Use modern noreply email for co-author trailers by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1369">anthropics/claude-code-action#1369</a></li> <li>fix(restore): handle symlinked CLAUDE.md paths during config snapshot by <a href="https://github.com/syf2211"><code>@syf2211</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li>fix: preserve repeated add-dir flags in claude args by <a href="https://github.com/Jerry2003826"><code>@Jerry2003826</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1256">anthropics/claude-code-action#1256</a></li> <li>fix: propagate curl failures in install pipeline by <a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> <li>chore: fix prettier formatting by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1463">anthropics/claude-code-action#1463</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/archievi"><code>@archievi</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li><a href="https://github.com/syf2211"><code>@syf2211</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li><a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166</a></p> <h2>v1.0.165</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165</a></p> <h2>v1.0.164</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/536f2c32a39763739000b0e1ac69ca2647d97ce9"><code>536f2c3</code></a> chore: bump Claude Code to 2.1.206 and Agent SDK to 0.3.206</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/37b464ce72700f7b2c5ff8d2db7fa7b15df792f5"><code>37b464c</code></a> chore: bump Claude Code to 2.1.205 and Agent SDK to 0.3.205</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/ba0aafd4308cbba7165f9f2cdb0cfbed5a3c99ce"><code>ba0aafd</code></a> chore: bump Claude Code to 2.1.204 and Agent SDK to 0.3.204</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0fe28cdb64e23015219b0e478100b7105fd7dfa1"><code>0fe28cd</code></a> chore: bump Claude Code to 2.1.203 and Agent SDK to 0.3.203</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f87768c6d25f92ae6efa7175e223ef77d4cbf97f"><code>f87768c</code></a> chore: bump Claude Code to 2.1.202 and Agent SDK to 0.3.202</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/58a2944bbcf1a73b1ae7960995fffca4fa29b113"><code>58a2944</code></a> chore: fix prettier formatting (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1463">#1463</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/beb753ed7288e960e1519e0bf631be7b502af876"><code>beb753e</code></a> fix: propagate curl failures in install pipeline (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1241">#1241</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/235b39bf21ce5bca22c31b37d171bd6e27cdd743"><code>235b39b</code></a> fix: preserve repeated add-dir flags in claude args (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1256">#1256</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/d060ddc96310109df573e19c7c458b84816c6af6"><code>d060ddc</code></a> fix(restore): handle symlinked CLAUDE.md paths during config snapshot (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1441">#1441</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0f07aee43515c58828104d3f2391785c2c565dd5"><code>0f07aee</code></a> Use modern noreply email for co-author trailers (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1369">#1369</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/769e3bdff9bb7ecfb51bad4c9cba23d6f5fc5ea5...536f2c32a39763739000b0e1ac69ca2647d97ce9">compare view</a></li> </ul> </details> <br /> Updates `actions/stale` from 10.3.0 to 10.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/stale/releases">actions/stale's releases</a>.</em></p> <blockquote> <h2>v10.4.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Fixed <code>only-issue-types</code> validation by <a href="https://github.com/trueberryless"><code>@trueberryless</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1342">actions/stale#1342</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/trueberryless"><code>@trueberryless</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10.3.0...v10.4.0">https://github.com/actions/stale/compare/v10.3.0...v10.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629"><code>1e223db</code></a> Bump undici to 6.27.0 via override, clean up stale license files, and version...</li> <li><a href="https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd"><code>9461cb1</code></a> fix: <code>only-issue-types</code> does not affect PRs (<a href="https://redirect.github.com/actions/stale/issues/1338">#1338</a>)</li> <li>See full diff in <a href="https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629">compare view</a></li> </ul> </details> <br /> Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/denoland/setup-deno/releases">denoland/setup-deno's releases</a>.</em></p> <blockquote> <h2>v2.0.5</h2> <h2>What's Changed</h2> <ul> <li>fix: update README and tests by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/85">denoland/setup-deno#85</a></li> <li>2.0.1 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/86">denoland/setup-deno#86</a></li> <li>Add problem matchers for <code>deno lint</code> by <a href="https://github.com/r7kamura"><code>@r7kamura</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/62">denoland/setup-deno#62</a></li> <li>refactor: use GitHub downloads for stable version download by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/91">denoland/setup-deno#91</a></li> <li>2.0.2 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/92">denoland/setup-deno#92</a></li> <li>refactor: convert action to TS and bundle code by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/95">denoland/setup-deno#95</a></li> <li>feat: add "lts" version option by <a href="https://github.com/sebdanielsson"><code>@sebdanielsson</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/97">denoland/setup-deno#97</a></li> <li>feat: add built-in caching via inputs by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/89">denoland/setup-deno#89</a></li> <li>feat: include a hash of deno.lock files in the cache key automatically by <a href="https://github.com/dsherret"><code>@dsherret</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/98">denoland/setup-deno#98</a></li> <li>fix: switch back to package.json as it's necessary for GH actions by <a href="https://github.com/dsherret"><code>@dsherret</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/101">denoland/setup-deno#101</a></li> <li>2.0.3 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/102">denoland/setup-deno#102</a></li> <li>Update actions/checkout by <a href="https://github.com/katayama8000"><code>@katayama8000</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/106">denoland/setup-deno#106</a></li> <li>docs: add lts as possible release-channel output by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/99">denoland/setup-deno#99</a></li> <li>docs: condense Deno version information in one section by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/100">denoland/setup-deno#100</a></li> <li>docs: fix identifier for latest stable release by <a href="https://github.com/Ms2ger"><code>@Ms2ger</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/115">denoland/setup-deno#115</a></li> <li>feat: upgrade Node.js runtime from node20 to node24 by <a href="https://github.com/nikicat"><code>@nikicat</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/123">denoland/setup-deno#123</a></li> <li>2.0.4 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/125">denoland/setup-deno#125</a></li> <li>chore: use versions.json from dl.deno.land by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/130">denoland/setup-deno#130</a></li> <li>2.0.5 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/131">denoland/setup-deno#131</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/r7kamura"><code>@r7kamura</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/62">denoland/setup-deno#62</a></li> <li><a href="https://github.com/csvn"><code>@csvn</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/95">denoland/setup-deno#95</a></li> <li><a href="https://github.com/sebdanielsson"><code>@sebdanielsson</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/97">denoland/setup-deno#97</a></li> <li><a href="https://github.com/katayama8000"><code>@katayama8000</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/106">denoland/setup-deno#106</a></li> <li><a href="https://github.com/Ms2ger"><code>@Ms2ger</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/115">denoland/setup-deno#115</a></li> <li><a href="https://github.com/nikicat"><code>@nikicat</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/123">denoland/setup-deno#123</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/denoland/setup-deno/compare/v2.0.0...v2.0.5">https://github.com/denoland/setup-deno/compare/v2.0.0...v2.0.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/denoland/setup-deno/commit/22d081ff2d3a40755e97629de92e3bcbfa7cf2ed"><code>22d081f</code></a> 2.0.5 (<a href="https://redirect.github.com/denoland/setup-deno/issues/131">#131</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/28c677f5df3d8f072e45566ed931347ae6325d53"><code>28c677f</code></a> chore: use versions.json from dl.deno.land (<a href="https://redirect.github.com/denoland/setup-deno/issues/130">#130</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/ff4860f9d7236f320afa0f82b7e6457384805d05"><code>ff4860f</code></a> 2.0.4 (<a href="https://redirect.github.com/denoland/setup-deno/issues/125">#125</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/6a293fc1a20bd1d541577761b3169054c853c099"><code>6a293fc</code></a> feat: upgrade Node.js runtime from node20 to node24 (<a href="https://redirect.github.com/denoland/setup-deno/issues/123">#123</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/390061ada6be77a29ed6544d545349413e1f645c"><code>390061a</code></a> docs: fix identifier for latest stable release (<a href="https://redirect.github.com/denoland/setup-deno/issues/115">#115</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/bdaa2e4f849cbc8d7b46337cf37db0dc9b321074"><code>bdaa2e4</code></a> docs: condense Deno version information in one section (<a href="https://redirect.github.com/denoland/setup-deno/issues/100">#100</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/e4ff81cdb2791c6378ce29a7fbf02fc798992f78"><code>e4ff81c</code></a> docs: add lts as possible release-channel output (<a href="https://redirect.github.com/denoland/setup-deno/issues/99">#99</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/bac1f7276ce08dba2dadbc204ad8385615bf7bdb"><code>bac1f72</code></a> Update actions/checkout (<a href="https://redirect.github.com/denoland/setup-deno/issues/106">#106</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/2f7698fd116bfedbd1c3cd4119337b5a787ef53a"><code>2f7698f</code></a> 2.0.3 (<a href="https://redirect.github.com/denoland/setup-deno/issues/102">#102</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/ee64dd32002995d8c023a32a49c0085d179610b1"><code>ee64dd3</code></a> fix: switch back to package.json as it's necessary for GH actions (<a href="https://redirect.github.com/denoland/setup-deno/issues/101">#101</a>)</li> <li>Additional commits viewable in <a href="https://github.com/denoland/setup-deno/compare/667a34cdef165d8d2b2e98dde39547c9daac7282...22d081ff2d3a40755e97629de92e3bcbfa7cf2ed">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Rahul Tarak
|
a13c883845 |
docs: package-manager picker for install commands (#3802)
## What Two changes to the docs install experience: **1. Package-manager picker on install code blocks.** New `PackageInstall` client component (`docs/components/package-install.tsx`): the code block's copy button opens a dropdown of package managers. Selecting one rewrites the displayed command and copies it to the clipboard. - TypeScript blocks: npm (default, `npm install`) / pnpm / bun / yarn (`<pm> add`) - Python blocks: uv (default, `uv add`) / pip (`pip install`) - The menu is portaled to `document.body` so it isn't clipped by the `Tabs`/`CodeBlock` overflow containers, and closes on outside click, Escape, or real scroll movement. **2. `@composio/slim` callout in the quickstart.** The quickstart TypeScript install blocks carry display-only `#` comment lines noting that `@composio/core` ships its docs and TypeScript source in the package (inspectable to coding agents) and that `@composio/slim` is the smaller install with the same API. Comment lines are rendered muted and are **never copied** — the picker copies only the command. ## Where Converted every plain `npm install` / `pip install` code block under `docs/content` (quickstart, all provider pages, single-toolkit MCP, custom tools, migration guides, standup example, SDK reference indexes). The TS reference index's manual npm/pnpm/yarn/bun tabs collapse into one picker. The two SDK-reference generators (`ts/packages/core/scripts/generate-docs.ts`, `python/scripts/generate-docs.py`) emit the new component so regeneration keeps it. Flagged upgrade commands (`pip install -U/--upgrade`) and the bun-first examples were left as-is. ## Verification - `bun run types:check` — pass - `bun run build` — pass - `eslint` on touched TS files — clean (remaining repo lint errors are pre-existing on `next`) - Visual check via dev server + browser: comment lines render muted below the command, picker opens npm/pnpm/bun/yarn (uv/pip on Python tabs), selecting a manager rewrites the command, and the clipboard receives exactly the command with no comment lines. Docs-only behavior change; no changeset (generator-script edits don't touch published code). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Rahul Tarak
|
caef908075 |
docs: refresh README(s) (#3801)
## Summary Rewrites the stale root `README.md` against the current docs (structure modeled on [earendil-works/pi](https://github.com/earendil-works/pi)'s README). - **Quickstarts** now use the session-based API (`composio.create()` → `session.tools()`) that the docs treat as canonical, replacing the legacy `composio.tools.get()` flow - **Positioning** matches the docs welcome page: 1000+ pre-authenticated toolkits, per-user sessions, auth, triggers, and a sandbox - **New sections**: CLI install (curl / Homebrew / npm), sessions-via-MCP note, repository layout, minimum runtime versions - **Provider table** merged with package links; adds the Claude Agent SDK providers (both SDKs) and the experimental Pi provider (`@composio/experimental`); documents the Python `composio-gemini`/`composio-google`/`composio-google-adk` split - **Removed**: Rube section (no longer in docs), cover banner (replaced with theme-adaptive brand logomark from brand.composio.dev), master-branch pointer, internal OpenAPI-pull section, private `@composio/ts-builders` listing Docs-only change — no changeset needed. ## Preview Rendered view: [README.md on this branch](https://github.com/ComposioHQ/composio/blob/docs/refresh-root-readme/README.md) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
b07fcada3f |
feat(experimental): add Eve provider and iMessage example (#3800)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3642 and credits @shamsharoon for the original Eve provider and iMessage work - rebases the integration onto the current `next` branch and resolves its lockfile conflicts - publishes an isolated `@composio/experimental/eve` entry with the correct Eve 0.12+ peer contract - adds recoverable per-session discovery, native Eve context propagation, and durable approval policies for direct and batched side effects - centralizes circular-safe auth-link extraction across Eve and Pi and replaces dense conditional expressions with named control flow - hardens the iMessage example against `osascript` option injection, unsafe trigger scoping, and third-party prompt injection - preserves completed local-tool results when a mixed local/remote batch loses its remote transport - consolidates the example documentation onto shared components, documents direct model-provider credentials, and clarifies that the browsable source is not yet a standalone fixture - verifies the change with 999 core tests, 32 experimental tests, package builds/typechecks, packed peer-isolation smokes, and a production docs build --------- Co-authored-by: shams haroon <144290365+shamsharoon@users.noreply.github.com> Co-authored-by: shams haroon <shamsharoon7@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: shams haroon <shams@composio.dev> |
||
|
Alberto Schiabel
|
30ba4d2930 |
feat(openai): add executable provider example (#3798)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3790 - makes the OpenAI example executable in direct-tools, Tool Router, smoke, and Cloudflare Workers modes - keeps direct and Tool Router agents in separate files so each execution model is explicit and readable - requires a successful Composio tool execution before either agent can accept a final model response - adds OpenAI to the nightly staging matrix without weakening the existing Mastra coverage - updates two stale experimental OpenAI usages so the complete example package typechecks against current SDK APIs ## Testing - `pnpm --filter openai-example run typecheck` - `pnpm --filter openai-example run lint` (0 errors; 4 pre-existing warnings) - `pnpm --filter openai-example run smoke` (staging: 5 direct tools and 6 Tool Router tools) - `pnpm --filter openai-example run cf:dry-run` - `pnpm run typecheck` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` - `pnpm run typecheck:examples` - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - [branch nightly](https://github.com/ComposioHQ/composio/actions/runs/29079263571): OpenAI and Mastra both passed smoke, direct-tools, and Tool Router against staging ## Post-deploy validation - dispatch `ts.examples-nightly.yml` on `next` after merge and confirm both matrix legs stay green - healthy runs finish within the 20-minute job budget and log successful tool-backed responses for both agent modes - revert this PR if the OpenAI leg blocks the nightly; examples maintainers own the first post-merge run and the next 06:00 UTC schedule --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
7ae0d7f735 |
chore: remove dead code across repo (#3786)
## What Removes orphaned files and stale config that nothing references — a follow-up to the root `Dockerfile` cleanup (#3783), which surfaced that we'd accumulated dead code. | Removed | Why it's dead | |---|---| | `test-exports.ts` | Throwaway debug script — `console.log`s schema internals and imports from `ts/packages/core/dist/` (a build artifact absent on a clean checkout). Zero references. | | `.codex` | Empty 0-byte file, accidentally committed. Every `.codex` reference in the code means `~/.codex` (the Codex CLI home dir), not this. | | `ts/docs/api/mcp.old.md` | Orphaned `.old` doc, superseded by `ts/docs/api/mcp.md`. Not linked anywhere. | | `pnpm-workspace.yaml` → `ts/packages/wrappers/*` | Workspace glob pointing at a directory that doesn't exist. | | `docs/examples/{app-connections-dashboard, workplace-search, support-agent, background-agent}` | Example dirs not wired into the docs build **and** absent from `docs/decisions/cookbooks-revamp-plan.md` — unlike their siblings (`chat-app`, `pr-review-agent`, …) which are explicitly staged WIP cookbooks. Zero references in the tree. | ## Verification Each item was traced with `git grep` over tracked files (excluding lockfiles / generated data) and confirmed to have no consumers in code, CI, docs nav, or build config. Python side was audited too and is clean (no `.bak`/`.old` files, all scripts/providers/modules wired). ## Note If any of the four `docs/examples/` dirs are undocumented cookbook drafts rather than truly abandoned, shout and I'll restore them — they just aren't referenced or tracked in the revamp plan today. A follow-up PR adds **Knip** (TS) + **Vulture** (Python) to CI so this class of rot gets caught automatically. |
||
|
Alberto Schiabel
|
b0a02c9693 |
feat(examples): make validation provider agnostic (#3790)
This PR: - makes example typecheck, lint, and Workers dry-runs discover packages by script presence instead of a Mastra-only filter - runs the nightly staging suite as a provider matrix, starting with Mastra and failing when a matrix package is missing - keeps direct and Tool Router agents explicit while sharing the Tool Router agent between Node.js and Cloudflare Workers - keeps root ESLint rules in Turbo's lint cache key and documents both Worker secrets ## Testing - `pnpm run typecheck` - `pnpm run typecheck:examples` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` (0 errors; 72 existing warnings) - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - confirmed Turbo includes `eslint.config.mjs` in the Mastra lint task inputs - confirmed a missing provider package fails instead of silently passing the nightly smoke step ## Post-Deploy Monitoring & Validation - after merge, dispatch `ts.examples-nightly.yml` on `next` and confirm the `mastra examples against staging` matrix leg runs smoke, direct-tools, and Tool Router successfully - healthy signal: smoke reports wrapped tools and both agent steps return non-empty output - failure signal: workflow logs contain `SMOKE FAIL`, `Agent returned empty output`, `No projects matched`, or a secret preflight error; revert this PR if the foundation gate begins false-passing or blocking unrelated example work - validation window and owner: the first post-merge dispatch plus the next scheduled 06:00 UTC nightly, owned by the TypeScript examples maintainers --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
shawn-composio
|
ff655168e5 |
docs: embed walkthrough video + scoped API key creation steps (#3785)
## What Updates the **Scoped Project API Key** reference page ([`project-api-key-permissions.mdx`](https://docs.composio.dev/reference/authenticating-to-composio/project-api-key-permissions)): - Embeds a YouTube walkthrough video at the top of the page (using the existing `<YouTube>` MDX component — lazy-loaded iframe, no layout shift). - Adds a short **"Create a scoped API key"** section with dashboard steps (Dashboard → Platform → project → Settings → API Keys → Create API Key). ## Preview <!-- Shawn: drag the localhost screenshot here --> ## Notes - Single-file content change; no component or config edits. <img width="1920" height="956" alt="image" src="https://github.com/user-attachments/assets/9d419ce1-d193-40f6-a669-0a3f2d0dd206" /> <img width="1899" height="985" alt="image" src="https://github.com/user-attachments/assets/ee126ac4-459b-4c08-ad22-2c99116165fb" /> |
||
|
Alberto Schiabel
|
15a03c10fb |
ci: add dead-code detection (knip + vulture + orphaned-CI check) (#3787)
## What Adds a **report-only** `Dead Code` CI workflow that surfaces likely-orphaned code on every PR, across all three surfaces — TypeScript, Python, and GitHub Actions. Follow-up to the root `Dockerfile` cleanup (#3783) and the dead-code sweep in #3786: instead of finding this stuff by hand, catch it automatically. | Surface | Tool | Wiring | |---|---|---| | TypeScript | [**knip**](https://knip.dev) | `knip.json`; runs via `pnpm dlx knip@5`. Finds unused files, exports, types, and dependencies. | | Python | [**vulture**](https://github.com/jendrikseipp/vulture) | `dead_code` nox session + `make dead-code`; allowlist at `python/config/vulture_allowlist.py`. Finds unused functions/classes/variables (complements Ruff's F401/F841). | | GitHub Actions | small bash script | `.github/scripts/check-orphan-ci.sh` — flags reusable workflows and composite actions with no callers. | ## Why report-only (not blocking) Every job writes findings to the run's **Step Summary** and **never fails the build**. These tools carry unavoidable false positives on a library monorepo — public API surface, dynamic imports, import-map targets (e.g. core's `#platform`), framework entry points. A red ❌ on false positives would just train everyone to ignore the check. Once a job's config is refined enough that a clean run is the steady state, it can be flipped to blocking. ## Validation (ran each locally) - **knip**: 0 unused *files* after scoping out the e2e-test workspaces (knip crashes traversing `ts/e2e-tests/**` — pre-existing knip bug, filed via `ignoreWorkspaces`) and build/docs artifacts. Export/dep categories surface advisory items. - **vulture**: clean run (report-only); allowlist suppresses the 3 `TYPE_CHECKING` re-exports in `custom_tool.py`; `build/`/`dist/` excluded. Surfaces 4 genuine minor items (`bases`, `desc`×3). - **orphan-CI script**: finds none — the repo has no orphaned CI plumbing today. - **Pinning**: `jk actions check` clean for this workflow; `actions/checkout` is SHA-pinned, the two local composite actions need no pin. Local usage is documented under **Dead code detection** in `CONTRIBUTING.md`. ## Note on scope These cover TS/Python/GHA — they would *not* have caught the root `Dockerfile` itself (an arbitrary root file no tool tracks). That class stays a manual-review concern; the orphan-CI script is the closest analogue for the CI surface. |
||
|
Alberto Schiabel
|
cbd1a374fd |
fix(examples): give the Mastra agents a step budget so tool-router returns output (#3789)
## What Add `stopWhen: stepCountIs(10)` to both Mastra example agent entries (`src/index.ts`, `src/tool-router.ts`). ## Why The first nightly `workflow_dispatch` run of `ts.examples-nightly` (after #3788 merged) failed on the **tool-router** example with `Agent returned empty output`. `agent.generate(...)` had no step budget, so the multi-step Tool Router flow (router `search` + `multi-execute` meta-tools, then summarize) stopped after the first tool call and produced no final text. The non-empty-output assertion added in #3788 turned that silent no-op into a loud failure — working as intended. Every other tool-router example/e2e in the repo already sets a step budget; this matches the Mastra tool-router e2e reference (`ts/e2e-tests/runtimes/node/mastra-tool-router-zod-v4/e2e.test.ts` → `stopWhen: stepCountIs(10)`). ## Verification - `pnpm run lint:examples` and `pnpm run typecheck:examples` green. - Nightly re-dispatch to confirm the tool-router example now returns non-empty output against staging (follow-up once merged). ## Notes - No changeset — example package is private/unpublished. - `index.ts` passed without the budget but gets the same `stepCountIs(10)` for robustness/consistency. |
||
|
Alberto Schiabel
|
76881491d0 |
feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788)
## What Turns the **Mastra** example into an executable reference that doubles as a test, and wires the examples into CI for the first time. First slice of the v1 "executable examples" workstream — the pattern here is the template for the other TS providers, then Python. ## Why Examples under `ts/examples/*` were unverified: the only CI tie-in is `validate-examples.ts`, which is transpile-only (no cross-file types, no lint, no execution) and passes on exactly the schema-conversion regressions we keep hitting in the Mastra provider — all closed but unprotected: - https://github.com/ComposioHQ/composio/issues/2109 (zod→json serialization crash) - https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped while `$ref` kept) - https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema tools crash serialization) ## Changes **Canonical Mastra example** (`ts/examples/mastra`) - `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS` toolkit - `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` → `session.tools()` (drops the deprecated bare `composio.create` alias) - `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers runtime (`export default { fetch }`) - `src/smoke.ts` — deterministic wrapping + tool-router assertions (needs only `COMPOSIO_API_KEY`) - Removed the old Gmail/MCP entries that used deprecated APIs and required auth - Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts` **Real typecheck + lint** (examples previously escaped both) - Example now has a `typecheck` script (Node + Worker tsconfigs); `typecheck:examples` / `lint:examples` scripts added - eslint now covers `ts/examples/**` with type-safety rules kept (`no-explicit-any`) and console noise allowed **Two-tier CI** - `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck → lint → `wrangler deploy --dry-run`. This is the tier that catches the schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces as a **type** error. - `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes against the **staging** backend with secrets; runs the deterministic smoke always and the full agent examples when an LLM key is set. ## Verification Locally against staging: `smoke` passes (5 direct + 6 tool-router tools), `typecheck:examples` and `lint:examples` are green, the Worker `wrangler deploy --dry-run` bundles, and seeded regressions (a type error / an `any`) correctly fail their gate. ## Notes - No changeset — example packages are private/unpublished. - Follow-ups (separate PRs): template the pattern to the other TS providers, then port to `python/examples/*`. |
||
|
shawn-composio
|
8bd1e415c5 |
chore(docs): remove legacy cookbook examples folder (#3774)
## Summary
Removes the legacy `docs/examples/` cookbook folder — 14 standalone
sample-app folders (`app-connections-dashboard`, `background-agent`,
`chat-app`, `email-support-agent`, `fast-api`, `gmail-labeler`, `hono`,
`pr-review-agent`, `slack-summariser`, `supabase-sql-agent`,
`support-agent`, `tool-generator`, `workplace-search`,
`standup-slackbot`).
This folder was orphaned. The live `/examples` page is sourced from
`content/examples/` (the 3 official examples: `general-agent-with-pi`,
`standup-slackbot`, `local-sandbox-pr-reviewer`), which are
**untouched** by this PR.
## Why it's safe to delete
- No MDX in `content/examples/` uses `<include>` to pull code from
`docs/examples/` — the examples are self-contained.
- `source.config.ts` (`examples = defineDocs({ dir: 'content/examples'
})`) points at `content/examples/`, not `docs/examples/`.
- The `llms.txt` / `llms-full.txt` routes are generated from
`examplesSource` (→ `content/examples/`), so this folder never appeared
in `llms.txt`.
- Nothing in `pnpm-workspace.yaml` or the test scripts references it
(`ts/examples/*` is a different, unrelated folder).
## Changes
- Delete `docs/examples/` (35 files).
- Remove the now-dead `"examples"` entry from `docs/tsconfig.json`
`exclude`.
- Add a note in `docs/decisions/cookbooks-revamp-plan.md` recording the
removal.
## Test plan
- [ ] `/examples` page still renders the 3 official examples
- [ ] `llms.txt` / `llms-full.txt` unchanged (never referenced the
deleted folder)
- [ ] Docs build (`bun run build`) passes
|
||
|
Shawn Esquivel
|
bf806ba7b3 |
docs: embed walkthrough video + add scoped API key creation steps
Add a YouTube walkthrough at the top of the Scoped Project API Key reference page and a short "Create a scoped API key" section with dashboard steps. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
2fcdc43bf9 |
chore: remove dead root Dockerfile and .dockerignore (#3783)
## What Deletes the root `Dockerfile` and `.dockerignore`. ## Why The root `Dockerfile` was **dead code**: - Nothing referenced it — no CI workflow, script, docs, README, or Homebrew tap. The e2e suite has its own Dockerfiles under `ts/e2e-tests/_utils/`. - It had already rotted through the v3 `ts/` monorepo restructure: it pointed at a non-existent root `packages/cli` and pinned an old Node/pnpm toolchain. It couldn't build. - Its `ENTRYPOINT` was just `composio --version` — a smoke/demo image, not a shipped or published artifact. Rather than repair an unused, untested image (which would only rot again with no CI to catch it), we remove it. `.dockerignore` only served that Dockerfile, so it goes too. ## Context Spotted thanks to #3756, which proposed repairing the same file — that surfaced the fact that it was orphaned. Closing that PR in favor of deletion. |
||
|
Abhishek Patil
|
f4d09832fc |
Explain why Google Ads quota errors happen after login (#3778)
## Summary - Add a Google Ads toolkit FAQ entry for quota errors after a successful OAuth login. - Clarify that `RESOURCE_EXHAUSTED` with developer-token rate scope is tied to the Google Ads developer token quota, not the user's connected Ads account. - Recommend retrying after Google's retry window or using a custom OAuth/client setup with a dedicated Google Ads developer token for production workloads. ## Tests - `bun run lint:links` - `bun run test` |
||
|
Jeevesh Jain
|
3ef30b6ca3 |
fix(docs): make favicon eligible for Google search results (#3771)
## Problem Google search results show a generic globe instead of the Composio favicon for docs.composio.dev. ## Root cause The site violated three of Google's favicon guidelines: 1. **`/favicon.ico` returned 404** — the well-known fallback path Google's favicon crawler checks didn't exist (only `app/icon.png` was configured). 2. **The icon was 1350×1350px** — Google wants a square icon that's a multiple of 48px (48, 96, 192, …). 3. **The favicon URL changed on every deploy** — Next.js emits the icon link with a per-deploy content-hash query (`/icon.png?icon.<hash>.png`), so Google never saw a stable URL to index. The favicon shipped in January and still hadn't been picked up. Crawlability was fine (robots.txt allows everything; the icon serves 200 to Googlebot), so these were the only blockers. ## Fix - Add `app/favicon.ico` — multi-resolution ICO (16/32/48px), served by Next.js at the stable `/favicon.ico` path - Resize `app/icon.png` 1350×1350 → **192×192** (multiple of 48; 19.5KB → 6.8KB) - Resize `app/apple-icon.png` → **180×180** (Apple's standard touch-icon size) All generated from the existing logo artwork; background is fully opaque so it renders correctly on Google's white results page. ## Verification Ran the docs dev server locally: - `GET /favicon.ico` → `200 image/x-icon`, valid ICO containing all three embedded sizes - Page head now emits `<link rel="icon" href="/favicon.ico" sizes="48x48">`, `<link rel="icon" href="/icon.png…" sizes="192x192">`, and `<link rel="apple-touch-icon" … sizes="180x180">` After deploy: confirm `curl -sI https://docs.composio.dev/favicon.ico` returns 200, then request re-indexing of the homepage in Search Console. Google typically refreshes a site's favicon within days to ~two weeks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PSoqxdNGZWD2TiuCaJQyVM Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Rahul Tarak
|
f7397e07ca |
docs: mark migration guides legacy + timestamp; surface example code & legacy status in llms output (#3775)
Follow-up doc fixes from a re-audit of the June "Pi Slack-bot friction"
report against the current docs. Low-risk changes across the migration
guides, the example `.md` output, and legacy handling.
## 1. Migration guides: selective legacy + a "Written {date}" stamp
Migration guides are point-in-time documents, but not all are legacy.
Two mechanisms, decoupled:
- **`legacy: true`** (existing Legacy badge) — only on guides that
migrate off something dead: **new-sdk** (deprecated v1 SDK) and
**tool-router-beta** (removed experimental tool router).
- **`written: "{Month YYYY}"`** (new frontmatter field, dates from git
creation) — renders a standalone **"Written {date}"** stamp on *every*
guide, independent of legacy. So current guides (direct-to-sessions,
mcp-servers-to-sessions, toolkit-versioning, the hub) show their date
without being mislabeled legacy.
Files: `source.config.ts` (new `written` field),
`components/legacy-badge.tsx` (plain badge again), docs page (badge +
date row), 6 migration guides.
## 2. Real example code now in the `.md`/llms output
`<FileBuildup>` / `<RepoBrowser>` render an example's actual source
(`bot.ts`, `install.ts`, …) interactively, but they're React components
that don't serialize to markdown — so
`examples/general-agent-with-pi.md` (what an agent fetches) had all the
prose and **no code**. `mdxToCleanMarkdown` now resolves them from the
`FILE_BUILDS` registry. That example's `.md` grows **6.5 KB → 34 KB**
with the real
`createSessionTools`/`proxyExecute`/`waitForConnections`/`verifyWebhook`
code. Also fixes standup-slackbot and local-workbench.
## 3. Legacy pages: flag in `.md`, skip the current-pattern guardrail
`getLLMText` now prepends "Legacy · written {date}" (or "Written {date}"
for current-dated pages) to the `.md`, and **skips the "enforce ONLY the
current patterns" guardrail block on legacy pages** — appending it to a
legacy guide contradicted the guide's own older content (e.g. new-sdk
showing `tools.execute()` as the v3 target).
## 4. Note that `subscribe()` uses Pusher under the hood
Short aside on the triggers subscribe doc, for readers on runtimes that
restrict WebSocket clients.
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Shawn Esquivel
|
f77c9c7cdb |
chore(docs): remove legacy cookbook examples folder
Delete the orphaned docs/examples/ sample-code folder (14 standalone app folders). Nothing referenced it: the live /examples page is sourced from content/examples/, no MDX <include> pulled from it, and it was absent from the source config and the llms.txt/llms-full.txt routes. Also drop the now-dead "examples" entry from docs/tsconfig.json exclude and note the removal in the cookbooks revamp plan. |
||
|
composio-zen[bot]
|
914bccf355 |
docs: fix API reference curl base URL (staging → production) (#3761)
# Description
The curl examples in the API reference docs pointed at **staging**
instead of production.
Reported (Slack): *"Curl in API reference docs points to staging-apollo
instead of backend.composio.dev."*
**Root cause:** the API reference (fumadocs, `docs/lib/openapi.ts`)
renders curl snippets using `servers[0].url` from the committed specs
`docs/public/openapi.json` (v3.1) and `docs/public/openapi-v3.json`
(v3.0). Both had:
```json
"servers": [{ "url": "http://staging-apollo.composio.dev", "description": "STAGING API" }]
```
This is a **recurring** regression, not a one-off stale file. The
scheduled workflow **`.github/workflows/docs-update-data.yml`** (`cron:
'0 */5 * * *'`, plus on Apollo production deploys) deliberately points
`OPENAPI_SPEC_URL` at **staging** (`COMPOSIO_BASE_URL_STAGING`, with a
guard that *fails* if it's production), runs `bun run
scripts/fetch-openapi.mjs`, and auto-commits the regenerated specs via
PR. Staging's spec serves `servers[0].url =
http://staging-apollo.composio.dev` (verified: `GET
https://staging-backend.composio.dev/api/v3{,.1}/openapi.json`), and
`fetch-openapi.mjs` did not override `servers` — so every ~5h the
staging server URL got re-committed (the most recent spec commit
`a3e58a421 docs: update ... API spec ...` came from exactly this
workflow).
The live production backend and the platform-committed apollo spec both
correctly serve `https://backend.composio.dev / PRODUCTION API`.
**Changes:**
- `docs/public/openapi.json` + `docs/public/openapi-v3.json`: set
`servers[0]` to `https://backend.composio.dev` / `PRODUCTION API`.
- `docs/scripts/fetch-openapi.mjs`: pin `spec.servers` to the production
URL in `postProcessSpec`. This is the **durable** fix — because the
update-data workflow fetches from staging, a JSON-only edit would be
reverted within ~5h; pinning in the generator forces the published curl
base URL to production regardless of which environment the source spec
was fetched from.
# How did I test this PR
- **Verified the servers value** in both committed specs (valid JSON):
- `node -e "require('./public/openapi.json').servers"` →
`[{"url":"https://backend.composio.dev","description":"PRODUCTION
API"}]`
- same for `public/openapi-v3.json`
- **Zero residual** `staging-apollo` references under `docs/public`,
`docs/scripts`, `docs/lib`.
- **Confirmed the recurrence mechanism:** read `docs-update-data.yml`
(staging fetch + auto-PR) and confirmed
`staging-backend.composio.dev/api/v3{,.1}/openapi.json` returns
`http://staging-apollo.composio.dev`, while live prod +
`apps/apollo/openapi.json` return `https://backend.composio.dev`. The
`postProcessSpec` pin overrides this in the generator.
- **Generator:** `node --check docs/scripts/fetch-openapi.mjs` → syntax
OK.
- **Docs static tests** (the "Docs - Tests" CI check): `bun test
tests/static/` → 16 pass, 0 fail.
- **CI on this commit:** Docs - Tests ✓, Docs - TypeScript Code
Validation ✓, Docs - Check Links ✓, Secrets Detection ✓, Vercel preview
✓.
- **Codex review:** no correctness issues found.
# Security
- **Trivy** (`fs --scanners vuln,secret --severity CRITICAL,HIGH,MEDIUM
--ignore-unfixed`) on all three changed files → clean (no
vulnerabilities, no secrets).
- **Socket** (dependency/supply-chain): N/A — no dependency or lockfile
changes.
- Note: `security/snyk (Composio)` shows failing, but it's a
**pre-existing repo-wide failure** (errors identically on PRs
#3756–#3761; this change touches no dependencies).
Triggered by: palash@composio.dev | Source: slack
Session: https://zen.corp.composio.io/dashboard/#/chat/zen-e559fb27fb16
Co-authored-by: Zen Agent <zen@composio.dev>
Co-authored-by: palash <palash@composio.dev>
|
||
|
Alberto Schiabel
|
72eac88133 |
fix(cli): replace abandoned decompress dependency (GHSA-mp2f-45pm-3cg9) (#3767)
This PR: - replaces `decompress` (unmaintained; the zip-slip fix in the GHSA advisory was never published to npm past 4.2.1) with `extract-zip` across the CLI's four zip-extraction call sites: `install-skill.ts`, `run-companion-modules.ts`, `upgrade-binary.ts`, and `cli-local-tools/bundled-binaries.ts` - `extract-zip` validates each entry resolves inside the target directory before writing, closing the path-traversal issue `pnpm audit` flags as critical - replaces the one `.tgz`-extracting call site (`scripts/_acp-adapters.ts`, used to vendor ACP adapter binaries at build time) with `tar`, since `extract-zip` only handles zip archives - removes `@types/decompress`; both `extract-zip` and `tar` ship their own type definitions - `pnpm audit --prod --audit-level=high` now passes (previously failing on `next`, unrelated to #3766) Verified `extract-zip` and `tar` extract nested directories correctly with a local smoke test (real `.zip`/`.tgz` archives), in addition to the existing `@composio/cli` (724 tests) and `@composio/cli-local-tools` (13 tests) suites passing.@composio/cli@0.2.32-beta.286 |
||
|
Alberto Schiabel
|
b847a2cfd3 |
fix(core): stop misclassifying local paths starting with "http" as URLs (#3766)
This PR:
- fixes a `startsWith('http')` check in the TypeScript SDK that
misclassified local paths such as `http_export/report.csv` or
`http_backup/.ssh/id_rsa` as URLs
- the misclassification routed those paths through the URL-fetch branch,
which skips both the upload allowlist (`assertPathInsideUploadDirs`) and
the sensitive-path denylist (`assertSafeFileUploadPath`, added in #3763
for GHSA-hp3h-89pf-5q58)
- replaces the naive prefix check with `isHttpUrl()`, a `new
URL()`-based check in `fileUtils.node.ts`, matching the Python SDK's
existing `_is_url()` behavior (`urlparse` + scheme check), which was not
affected by this bug
- updates the three call sites that used the naive check:
`fileUtils.node.ts` (`readFile`, `getFileDataAfterUploadingToS3`) and
`FileToolModifier.node.ts` (`beforeFileUpload` source classification)
- adds a regression test asserting a path like `http_export/.aws/creds`
is still blocked by the sensitive-path denylist rather than routed to
`fetch`
|
||
|
Anas Khan
|
040ffd49a2 |
chore(cli): remove dead duplicate maybe-advice-spans-usage file (#3757)
The captured-errors pretty-printer in the CLI has two files that export the same `maybeAdviseSpansUsage` symbol: - `ts/packages/cli/src/effect-errors/pretty-print/captured-errors/maybe-advise-spans-usage.ts` (the live one, spelled `advise`), re-exported by `captured-errors/index.ts` and consumed by `format-captured-error.ts`. - `ts/packages/cli/src/effect-errors/pretty-print/captured-errors/maybe-advice-spans-usage.ts` (spelled `advice`), which is never exported through the barrel and never imported anywhere. The `advice` file is a leftover from an `advice -> advise` rename: both files were originally introduced identical, and only the `advise` copy was later updated (its leading `''` became `' '` for color-contrast spacing) and wired up. The `advice` copy has since sat as unreferenced dead code that still returns the stale pre-fix value. It ships in the bundle as dead code and is a copy-paste / confusion hazard. This PR deletes it. No linked issue (self-identified cleanup). Fixes # ## Changes - Delete the unused, stale duplicate `ts/packages/cli/src/effect-errors/pretty-print/captured-errors/maybe-advice-spans-usage.ts`. The live `maybe-advise-spans-usage.ts` is unchanged and remains the only exported/imported copy. ## Type of change - [ ] Bug fix - [ ] New feature - [x] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? Confirmed the removed file is unreferenced, then ran the CLI's checks with the deletion in place (local Node 26 / pnpm 10; CI will verify the pinned toolchain): - Unreferenced check: searched the repo for both the path `maybe-advice-spans-usage` and the token `advice` under `ts/packages/cli/src/` -> 0 matches. Only the live `./maybe-advise-spans-usage` is re-exported by `captured-errors/index.ts`, and `format-captured-error.ts` imports `maybeAdviseSpansUsage` through that barrel. - Build workspace deps: `pnpm run build:packages` -> all packages built. - Typecheck (required when touching CLI code, per `ts/packages/cli/AGENTS.md`): `pnpm exec turbo typecheck --filter=@composio/cli --force` -> pass, fully re-executed (no cache). A missing-module error would surface here if anything had imported the deleted file. - Lint: `pnpm exec eslint ts/packages/cli/src/effect-errors --ext .ts` -> clean. - Tests: `pnpm exec vitest run` in `ts/packages/cli` -> 720 passed, 1 skipped, 80 files. No regressions. ## Screenshots (if applicable) N/A. ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [x] I updated documentation as needed (none needed; internal dead code) - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages Tests: not applicable. This is a pure deletion of unreachable code with no behavior change; nothing references the file, so there is nothing to regression-test. The live `maybeAdviseSpansUsage` path is already exercised by the existing effect-errors tests via `format-captured-error`. Changeset: not needed. The CLI package is not published to npm and this is an internal, non-published-surface change. ## Additional context Git history for the curious: both files were introduced identical in `333b03c3b`; the live `maybe-advise-spans-usage.ts` diverged in `fe5acc7d7` (leading `''` -> `' '` for color contrast) and became the wired-up copy, leaving `maybe-advice-spans-usage.ts` behind as the stale duplicate removed here. Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>@composio/cli@0.2.32-beta.285 |
||
|
eeshsaxena
|
3e37f3c7a4 |
test: add unit tests for the mimetypes utility (#3750)
## Summary `composio/utils/mimetypes.py` had no test coverage. This adds a suite for both of its public helpers: **`guess()`** (filename/extension → MIME type): - known extensions resolve correctly (json, html, png, mp4, …) - the lookup table is lower-case, so an upper-case suffix (`photo.PNG`) falls back to the default - unknown / missing extensions return `application/octet-stream` - only the final suffix is used (`archive.tar.gz` == `archive.gz`) - `Path` objects are accepted, not just strings **`get_extension_from_mime_type()`** (MIME type → extension): - direct mappings (`image/png` → `png`, `application/vnd.ms-excel` → `xls`, …) - parameters are stripped (`text/plain; charset=utf-8` → `txt`) and matching is case-insensitive - structured `+suffix` handling: known prefixes win (`application/atom+xml` → `atom`), otherwise the suffix is used (`application/vnd.api+json` → `json`, `application/foo+bar` → `bar`) - subtype fallback (`application/x-custom` → `x-custom`), empty subtype → `txt`, and malformed/empty input → `bin` Tests only — no library code changed. `pytest python/tests/test_mimetypes.py` passes (`32 passed`); `ruff check` / `ruff format --check` are clean. Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
Anas Khan
|
57574e4f7c |
fix(cli): point CLI install URL at the next branch (#3758)
The documented one-line CLI install command curls `install.sh` from the `main` branch: ```bash curl -fsSL https://raw.githubusercontent.com/ComposioHQ/composio/main/install.sh | bash ``` But the repository's default branch is `next` and there is no `main` branch. `raw.githubusercontent.com` does not fall back to the default branch, so the documented command returns HTTP 404 and the install fails for anyone who copies it from `INSTALL.md`. This replaces the `main` branch segment with `next` in the `raw.githubusercontent.com/ComposioHQ/composio/<branch>/install.sh` URL at every documented occurrence, so the install one-liner resolves. It matches the `next` branch already used for the raw asset URL in `README.md`. `install.sh` itself needs no change: it downloads binaries from release assets, not from a branch raw URL. Fixes # <!-- No open issue; self-identified bug. Leave the Fixes line blank, or remove it. --> ### Changes - `INSTALL.md`: update the 5 `.../composio/main/install.sh` URLs to `.../composio/next/install.sh` (One-line Install, Install specific version, and the Troubleshooting / manual-download / environment-variable examples). - `.github/workflows/build-cli-binaries.yml`: same `main` -> `next` update at the 2 URLs inside the `create-install-instructions` job's heredoc, which regenerates `INSTALL.md` as a GitHub Release artifact, so the released copy carries the working URL too and stays consistent with the checked-in file. ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor/Chore - [x] Documentation - [ ] Breaking change <!-- It is a documentation URL fix that also updates the CI job which regenerates that documentation. Marked Documentation; a reviewer may also consider it a Bug fix. --> ### How Has This Been Tested? No application code changed (static Markdown plus a CI heredoc), so no unit test applies. Verified the branch/URL facts directly: ``` # Default branch is next; no main branch exists git ls-remote --symref origin HEAD # -> ref: refs/heads/next git ls-remote --heads origin main next # only refs/heads/next (+ changeset-release/next); no main # The broken vs working URL, live curl -s -o /dev/null -w "%{http_code}" https://raw.githubusercontent.com/ComposioHQ/composio/main/install.sh # 404 curl -s -o /dev/null -w "%{http_code}" https://raw.githubusercontent.com/ComposioHQ/composio/next/install.sh # 200 # After the change: 0 remaining main URLs, 7 next URLs grep -rn "composio/main/install.sh" INSTALL.md .github/workflows/build-cli-binaries.yml # no matches grep -rn "composio/next/install.sh" INSTALL.md .github/workflows/build-cli-binaries.yml # 7 matches # The workflow YAML still parses cleanly after the heredoc edit python -c "import yaml; yaml.safe_load(open('.github/workflows/build-cli-binaries.yml'))" ``` ### Screenshots (if applicable) N/A. ### Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed <!-- YAML re-parses; grep + curl checks above --> - [x] I updated documentation as needed <!-- this change is the documentation fix --> - [ ] I added tests or explain why not applicable <!-- N/A: static docs URL + CI heredoc, no code path to test --> - [ ] I added a changeset if this change affects published packages <!-- N/A: docs + CI only, no published package --> ### Additional context The 14 `github.com/ComposioHQ/composio/tree/main/...` `homepage` fields in `ts/**/package.json` also point at the non-existent `main` branch, but those are published-package metadata (a different URL form that would require a changeset) and are left out to keep this PR single-purpose. They are a reasonable follow-up.@composio/cli@0.2.32-beta.284 |
||
|
Alberto Schiabel
|
fc17c37bf9 |
fix(cli): enforce sensitive-file upload denylist (GHSA-hp3h-89pf-5q58) (#3763)
This PR: - fixes #3746 / GHSA-hp3h-89pf-5q58 — the CLI's tool file-upload path bypassed the sensitive-file denylist - **root cause:** the denylist was enforced at the *caller* layer, so `@composio/cli`'s duplicate upload path (`readFileFromDisk`) read and uploaded any local path a tool argument pointed at — `~/.ssh/id_rsa`, `~/.aws/credentials`, `.env`, etc. — enabling credential exfiltration via `composio execute` / `composio run` (incl. LLM-driven agents hit by prompt injection) - **unified fix:** one canonical guard, exported from `@composio/core` and enforced at the read primitive in every SDK - `core`: the guard now routes fs/path access through the internal `#platform` abstraction (adds a `realpathSync` method), so it carries **no static `node:*` imports** and is exported from the package root: `assertSafeFileUploadPath`, `isBlockedSensitiveFileUploadPath`, `BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS` - `cli`: `readFileFromDisk` calls the shared `assertSafeFileUploadPath` before `fs.readFile`; URLs and `File` objects are unaffected (matches core) - `python`: already routes all uploads through the guarded `FileUploadable.from_path` — no functional change; adds regression tests for parity - supersedes #3755, which exported the then-node-only guard from core's **main** `index.ts` and would have injected `node:fs` into the shared `dist/index.mjs` (the workerd/edge-light entry), likely breaking Cloudflare Workers / Vercel Edge - changesets: `@composio/core` minor (new public exports), `@composio/cli` patch (security fix) ## Verification - core: full suite passes (997), incl. new root-export + realpath-symlink cases - **edge bundle stays clean**: built `dist/index.mjs` has no static `node:*` imports and reaches the platform only via `#platform` - cli: new regression test drives the real `uploadToolInputFiles → readFileFromDisk → guard` chain — `~/.ssh/id_rsa` and `.env` throw `ComposioSensitiveFilePathBlockedError` before any `createPresignedURL` call; a normal file still uploads - python: `test_files.py` + sensitive-path suite pass (145), incl. 3 new `from_path` guard tests - `tsgo` typecheck + eslint clean for core and cli@composio/cli@0.2.32-beta.283 |
||
|
Alberto Schiabel
|
820abb9072 |
fix(sdk): resolve toolkit versions case-insensitively in both SDKs (#3762)
## Summary
Toolkit version maps are keyed by **normalized (lowercase) slugs** on
the *write* side — env vars (`COMPOSIO_TOOLKIT_VERSION_*`) and
user-supplied dicts both get their keys lowercased when the map is
built. But the *lookup* read the map with the **raw slug**. A pin
configured under a different casing (e.g. `{ "GitHub": "20250101_00" }`
or `COMPOSIO_TOOLKIT_VERSION_GITHUB` looked up as `GitHub`) therefore
missed the map and silently fell back to `"latest"`, which
`Tools.execute` then rejects with a version-required error — discarding
the user's explicit pin.
Rather than patch only the read side, this **centralizes the
normalization rule** into a single helper per SDK and routes **both**
the map-building (write) and lookup (read) paths through it, so the two
sides can never drift apart again:
- **Python** — `normalize_toolkit_slug()` in
`python/composio/utils/toolkit_version.py`
- **TypeScript** — `normalizeToolkitSlug()` in
`ts/packages/core/src/utils/toolkitVersion.ts`, imported by
`getToolkitVersionsFromEnv` in `sdk.ts`
Behavior is now identical across the two SDKs. This **supersedes
#3759**, which patched only the Python read side and left TS diverging.
## Backend verification
Confirmed against the backend (staging, **1403 toolkits across 15
pages**): every toolkit `slug` is already lowercase (the mixed-case
`name` field is display-only). So the *primary* execute path — which
resolves via `tool.toolkit.slug` — was never broken in practice. This
change:
- **hardens** the direct-util and mixed-case-config paths (a user
passing `{ "GitHub": "…" }` now resolves as expected), and
- **removes a latent cross-SDK divergence**: the TS suite previously
asserted `getToolkitVersion` was *case-sensitive* (`versions.test.ts`),
locking in the bug for an input the production code path can't actually
produce. That test is flipped to assert case-insensitive resolution.
## Tests
- **Python** (`python/tests/test_toolkit_version.py`): case-insensitive
lookup via `get_toolkit_versions` round-trip, and against a raw
pre-normalized map. `18 passed`.
- **TypeScript** (`ts/packages/core/test/core/versions.test.ts`):
replaced the case-sensitivity assertion with case-insensitive resolution
+ a write→read round-trip of a mixed-case user pin. Full core suite `997
passed`.
- Typecheck (`tsc --noEmit`) clean; `ruff` clean.
## Notes
- Changeset added: `@composio/core` patch.
- No public API change; the fix is behavioral (case-insensitive) plus an
internal shared helper.
|
||
|
Alberto Schiabel
|
58bc93b2d9 |
chore(deps): consolidate dependency updates (#3760)
This PR: - consolidates https://github.com/ComposioHQ/composio/pull/3733, https://github.com/ComposioHQ/composio/pull/3735 through https://github.com/ComposioHQ/composio/pull/3744, and https://github.com/ComposioHQ/composio/pull/3752 - refreshes the pnpm workspace dependencies under the existing `minimumReleaseAge` supply-chain gate - keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare workers types 4 where latest majors conflict with the current workspace - keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the workspace catalog to zod 4 - bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock` - updates the SHA-pinned Claude and Codex workflow actions from the Dependabot action group - adds a patch changeset for the versioned package manifests touched by dependency updates - verifies the rollup with frozen pnpm/uv locks, peer checks, audit threshold checks, typecheck, lint, builds, TypeScript tests, and Python `nox -s chk` ## Context `pnpm audit --prod --audit-level=moderate` passes. The remaining production audit item is a low `@ai-sdk/provider-utils` advisory through Mastra transitive dependencies; forcing it higher would require leaving the compatible stable Mastra dependency path.@composio/cli@0.2.32-beta.282 |
||
|
Alberto Schiabel
|
d3875f99d1 |
chore(ci): add least-privilege tokens, fork-pr guards, audit gate (#3748)
This PR: - depends on #3751 (dependency fixes split out; **merge #3751 first** or the new audit gate below is red) - adds top-level `permissions: contents: read` to the 23 workflows missing one, with job-level opt-ups only where jobs demonstrably need writes (releases, docs automation PR creation, audit PR comments); the `security.secrets-detection.yml` caller job mirrors the reusable workflow's declared scopes so the secret-scanning check keeps working under the cap - pins the secrets-detection reusable-workflow ref to ComposioHQ/.github@a6c053d (master, post ComposioHQ/.github#12) whose actions are now SHA-pinned, fixing the `startup_failure` every PR was hitting - guards all four E2E jobs in `ts.test-e2e.yml` so dependabot and fork PRs (which get no secrets) skip secret-backed steps with a `::notice` instead of failing red; install/build and the secret-free CLI docker build still run on fork PRs - makes `pnpm audit --prod --audit-level=high` a hard gate in `ts.audit.yml` (the advisory PR-comment flow is unchanged) and adds root `package.json`/`pnpm-lock.yaml`/`pnpm-workspace.yaml` to the audit triggers so manifest-only changes can't bypass it - drops the orphaned job-level `pull-requests: write` from `ts.test.yml` (no step has used the PR API since the #2212 comment step was removed) ## Context Implements `plans/002-ci-hardening-permissions-and-fork-guards.md` (advisor plan, orthogonal to the SDK v1 roadmap). A hard `pnpm audit` gate was tried once before and reverted for blocking unrelated PRs (#2213, `dec0ced78`); it lands now paired with #3751, which clears the high advisories, and it only fails on high/critical advisories in production dependencies. Reviewer notes: - release workflows verified statically: `py.release` publishes via PyPI credentials (no token writes); `ts.release` does all writes via the minted GitHub App token and keeps `id-token: write` - worth a dry run after merge: one fork PR to confirm the four skip notices, and one same-repo Secrets Detection run to confirm no 403 warning (the run on this PR already passed clean) - known follow-ups (deliberately out of scope): dev-dependency high advisories (gate is `--prod`), a scheduled audit run, encoding the permissions convention in `.agents/skills/repo-guidance`, extracting the duplicated guard into a composite action |
||
|
Alberto Schiabel
|
49e4c11427 |
chore(deps): resolve high prod audit advisories via in-range bumps (#3751)
This PR: - refreshes lockfile resolutions for the 17 high `pnpm audit --prod` advisories via `pnpm update -r` — real version bumps within the ranges parents already declare (minimatch 5/9, lodash, fast-uri, picomatch, langsmith, `@hono/node-server`, express-rate-limit, ws), not resolution overrides - bumps the pre-existing #3467 security pin `protobufjs: 7.5.9 -> 7.6.1` in `pnpm-workspace.yaml` (7.5.9 itself is vulnerable to GHSA unbounded-Any DoS) - adds ONE temporary scoped override, `minimatch@>=10.0.0 <10.2.3 -> >=10.2.3`: `@zed-industries/claude-code-acp@0.16.2` (latest) exact-pins vulnerable `minimatch 10.2.1` and no fixed release exists; commented in the file, drop when upstream ships - no `package.json` changes anywhere: none of the vulnerable packages is a direct dependency of any workspace package, so there is nothing to major-bump on our side ## Context Split out of #3748 (CI hardening) so dependency changes land in isolation. **Merge this before #3748** — its new `pnpm audit --prod --audit-level=high` hard gate needs this green baseline, per the plan's "gate lands together with the dependency fix" rule. Verified: `pnpm audit --prod --audit-level=high` exits 0 (remaining: 1 low, 6 moderate); `pnpm install --frozen-lockfile` passes. Dev-path high advisories (vite, undici, flatted, linkify-it, minimatch 3.x) are out of scope — the gate is `--prod`; tracked as backlog. |
||
|
Alberto Schiabel
|
8d5823be87 |
chore(ci): cache turbo, bun, and uv and cancel superseded pr runs (#3747)
This PR: - adds `concurrency` to the ten PR/push CI workflows: superseded **PR** runs are cancelled, while push runs use a per-run group (`github.run_id`) so every commit on `next`/`master` still gets its own run - caches turbo outputs (`.turbo/cache`) via a new opt-in `enable-turbo-cache` input on the `setup-node-pnpm-bun` composite (keyed per job — concurrent jobs save different task graphs), enabled in `ts.build`, `ts.test`, `ts.typecheck`, and all four `ts.test-e2e` jobs - enables turbo caching for `typecheck`, removes the incorrect `dist/` outputs from `test`, hashes root `tsconfig.base.json` in `build`/`typecheck` inputs, and adds `mise.toml`/`mise.lock` to `globalDependencies` so toolchain bumps bust every task hash (addresses the Bugbot finding) - fixes `@composio/slim`'s build to participate in the turbo graph: core moves to slim's `devDependencies` (published `dependencies` unchanged) and the script no longer shells out to `pnpm --filter @composio/core build`, which raced concurrent dependents by wiping `core/dist` mid-build and double-built core on every cold run — slim's `dist` remains byte-identical to core's; no changeset added since the published artifact is unchanged (say the word if policy wants one anyway) - fixes the `py.test` matrix cache to `~/.cache/uv` (it cached `~/.cache/pip` while installing via `uv pip`) and caches `~/.bun/install/cache` in the five docs workflows - adds `turbo.jsonc` to the TS workflows' path filters (previously unwatched) - release/publish workflows are deliberately untouched Measured (same commit, cold first attempt vs `gh run rerun` warm): ts.build 103s → 53s, ts.test 157s → 55s (`turbo test` 24/24 cached in 182ms), ts.typecheck 80s → 43s; py.test legs save a few seconds each (uv was already fast). Warm floor is checkout + mise + pnpm-install overhead. ## Context Implements `plans/001-ci-speed-caching-and-concurrency.md` from the advisor audit on `docs/sdk-v1-decision-records`. Implementation by codex against the plan, then self-reviewed and counter-reviewed; warm-rerun testing surfaced and fixed three latent issues (toolchain files absent from turbo's hash, first-writer-wins cache-key collision across jobs, and the slim out-of-band core rebuild race).@composio/cli@0.2.32-beta.281 |
||
|
github-actions[bot]
|
a3e58a4216 |
docs: update toolkits, API spec, and meta tools data (#3426)
## Summary Automated sync of backend data into the docs site. Triggered by: `workflow_dispatch`. ## What changed - **Toolkit catalog** (`docs/public/data/toolkits.json`, `toolkits-list.json`) — refreshed list of available toolkits, auth schemes, and tools from the backend API - **OpenAPI specs** (`docs/public/openapi.json`, `docs/public/openapi-v3.json`) — latest v3.1 and v3.0 API specifications fetched from staging - **API reference pages** (`docs/content/reference/api-reference/`, `docs/content/reference/v3/api-reference/`) — regenerated index pages for both API versions - **Meta tools reference** (`docs/public/data/meta-tools.json`, `docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas and reference docs Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |