mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/cli@0.2.34-beta.324
294 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Kshitij Jhunjhunwala
|
fc9745040a |
feat(cli): make headless composio login agent-friendly (PRDE-1138) (#3945)
## What Closes the PRDE-1138 gap: an unattended agent hitting plain `composio login` in a pipe dead-ended at browser OAuth. Now the default headless path either completes unattended or tells the agent exactly what to run — without ever auto-creating an account for a human. - **Offer**: non-interactive login instructions gain a second hint — "For unattended agents: run `composio login --agent`" — alongside the existing URL + `composio login --poll` flow. - **Perform (reuse only)**: when `~/.composio/agent.json` already holds a READY agent identity, plain headless `composio login` completes unattended by reusing it. New `getStoredReadyAgent` in `services/agents.ts` is the reuse-only counterpart of `getOrSignupReadyAgent` — it never falls back to signup. - **Guardrail** (the design constraint from the ticket): account creation stays exclusively behind the explicit `composio login --agent` / `composio signup` commands. A human piping `composio login` with no stored agent identity gets the same URL instructions as before and no account. Asserted at both unit and E2E level (`/api/signup` is never called on the default path). - `install.sh --agent` login now sets `COMPOSIO_CLI_INVOCATION_ORIGIN=installer` for analytics attribution. - Root `.dockerignore`: host `node_modules` (pnpm store symlinks that break outside the host) no longer enter the e2e image build context; without this, e2e images cannot build from a checkout that has run `pnpm install`. ## Verification - `pnpm typecheck` green; `@composio/cli` suite green — 1001 passed, 1 skipped; `validate:boundaries` clean. - New Docker E2E suite `ts/e2e-tests/cli/agent-signin` (10/10) against a mock `agents.composio.dev` (`COMPOSIO_AGENTS_BASE_URL`): unattended nothing→authenticated (`login --agent` then `whoami` in one container), headless-human guardrail (instructions printed, zero signup calls), stored-identity reuse (login completes + whoami reports `account_type: agent`). No real accounts are created. ## Notes - No VHS recordings: the visible change is piped-mode text output, which VHS interactive recordings don't demonstrate. - No changeset by design (`@composio/cli` is Changesets-ignored); human-facing note added to `ts/packages/cli/CHANGELOG.md` under 0.3.0. |
||
|
Alberto Schiabel
|
2b9571b17f |
fix(core): resolve typedoc against the TS6 compiler API (#3972)
This PR: - restores TypeDoc generation after https://github.com/ComposioHQ/composio/pull/3966 by resolving `@composio/core`'s TypeScript dev dependency from `catalog:ts6` - keeps core typechecking on the root TypeScript 7 compiler while TypeDoc receives the TS6 compiler API - documents the additional compiler-API consumer in the shared TypeScript catalog - commits the regenerated `session-files.mdx` output that could not be produced while the workflow was broken - verifies `generate:docs`, `typecheck`, and `build` for `@composio/core` |
||
|
Kshitij Jhunjhunwala
|
fc1460995b |
feat(cli): make headless composio login agent-friendly (PRDE-1138)
Teach non-interactive login to reuse an existing READY agent identity without creating one implicitly. Preserve explicit --no-browser and --no-wait contracts, and branch on TerminalUI.canPrompt so piping stdout alone remains interactive. Add unattended guidance, installer analytics attribution, and focused unit and Docker E2E coverage. Exclude host node_modules from Docker build contexts. |
||
|
Alberto Schiabel
|
f233e46937 |
chore(repo): migrate eslint to oxlint and typecheck to TypeScript 7 (#3966)
This PR: - replaces ESLint with oxlint across the pnpm workspace and the Bun-based docs site, porting the rules to `.oxlintrc.json` / `docs/.oxlintrc.json` with behavior parity (restricted-syntax selectors kept via `oxlint-plugin-eslint`) - migrates typecheck to TypeScript 7 (`typescript@^7.0.2` catalog) and keeps a TS6 pin for JS compiler API consumers via a named `ts6` pnpm catalog (`ts/scripts/validate-examples.ts`, the `@composio/cli` generate pipeline). The CLI's `typescript` dependency rebinds only the compiler-API import — its typecheck still runs the root TS7 `tsc`, since the alias package only ships a `tsc6` bin (documented in `ts/packages/cli/AGENTS.md`) - removes the `paths` mappings that pointed `@composio/core` (and, in `experimental`, `@composio/json-schema-to-zod` plus core-internal `#`-imports) at sibling `src` directories: under TS7, tsdown's tsgo-based dts step emitted stray `.d.ts` files next to those out-of-root sources on every dependent package build. Workspace deps now resolve through their built dist types, which turbo's `dependsOn: ^build` already guarantees exist — and which the deep-path exports (`@composio/core/*`) always used anyway - renames the cli boundary tooling `eslint-boundaries*` → `lint-boundaries*` and hardens the scanner to reject `oxlint-disable` spellings so the disable manifest cannot be bypassed - rewrites inline `eslint-disable` comments to oxlint rule names (comment-only; no runtime changes), and adds **one new** declared boundary: `tool-file-uploads.ts` needs `no-restricted-imports` disabled for `node:crypto` (MD5 for the presigned-upload checksum is not in Web Crypto), because oxlint also catches dynamic `await import()` where ESLint did not. The manifest grows 46 → 47 deliberately - updates CI path filters, `turbo.jsonc` lint inputs, and the docs typescript-check workflow (renamed to "Docs - Lint and TypeScript Validation" since it now lints too); drops `eslint`, `typescript-eslint`, `eslint-config-next`, and `globals` from the dependency graphs - ships no changeset: I built `@composio/core` and `@composio/anthropic` on this branch and on the pre-migration base and diffed the emitted `dist/**/*.d.mts`. The provider output is byte-identical. Core's output is **semantically identical but not byte-identical**: TS7 changes quote style (`"x"` → `'x'`), object-property and union-member ordering in inferred types, and picks equivalent shorter re-export alias paths for five signatures (e.g. `OpenAI.Beta.Threads.Runs.Run` → `OpenAI.Beta.Threads.Run` — verified both names alias the same type in the shipped typings). Chunk-name hashes shift as a consequence. No type gains, losses, or shape changes; `attw` and `publint` pass on the TS7 build ## Context First of a three-PR split of #3958. The type-safety refactors are stacked on this branch and merge after it: - docs: https://github.com/ComposioHQ/composio/pull/3967 - `@composio/core`: https://github.com/ComposioHQ/composio/pull/3968 |
||
|
Alberto Schiabel
|
503b50ab02 |
chore(deps): refresh SDK, Python, and CI dependencies (#3955)
This PR: - splits https://github.com/ComposioHQ/composio/pull/3953 in two: this PR carries every dependency and GitHub Actions bump **except** the docs site, which follows in a stacked PR - consolidates and supersedes Dependabot PRs #3915, #3916, and #3934 through #3942 - adopts TypeScript 7.0.2 for primary compilation while retaining the `@typescript/typescript6` API lane that TypeScript-ESLint still requires, following the upstream side-by-side guidance - refreshes Python core and provider dependencies, lockfiles, and the Ruff 0.16 lint configuration - updates every GitHub Action with a verified newer official release, including majors, while retaining immutable commit SHA pins and migrating setup-uv cache pruning - deletes four per-package `eslint.config.mjs` shims: under ESLint 10 the default per-file config lookup re-anchors the root config's globs into each package, so `pnpm lint` stayed green while the CLI's try/catch, `process.env` and node-builtin bans went unenforced - bounds and documents the new `brace-expansion` and `@hono/node-server` security overrides, raising the `@hono/node-server` floor to 2.0.10 to clear GHSA-9mqv-5hh9-4cgg - preserves intentional compatibility fixtures and lanes for AI SDK 6, Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints ## Context The docs site is a separate Bun workspace with its own `bun.lock` and is not a pnpm workspace member, so the two halves share no lockfile and no build. Splitting them keeps the Fumadocs 11 migration (a breaking API change with real refactoring) reviewable on its own, independently of the mechanical version bumps here. The `brace-expansion` override deliberately spans majors: GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with no 1.x or 2.x backport, so narrowing it to the 5.x line puts `brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and `pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the trade-off it buys is recorded inline in `pnpm-workspace.yaml`. Verified on this branch standalone: `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963 tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`. |
||
|
Alberto Schiabel
|
332cb71214 |
fix(ci): clear dependency audit and cli test failures on next (#3898)
This PR: - bumps the transitive `brace-expansion` resolution to 2.1.2 ([GHSA-3jxr-9vmj-r5cp](https://github.com/advisories/GHSA-3jxr-9vmj-r5cp), high) - adds a scoped `js-yaml` override to `>=4.3.0 <5` ([GHSA-52cp-r559-cp3m](https://github.com/advisories/GHSA-52cp-r559-cp3m), high) — `@redocly/openapi-core@1.34.x` (via `openapi-typescript`) exact-pins vulnerable 4.2.0, so a lockfile bump alone cannot reach the patched version - bumps the existing `protobufjs` override 7.6.3 → 7.6.5 ([GHSA-j3f2-48v5-ccww](https://github.com/advisories/GHSA-j3f2-48v5-ccww), moderate) - leaves the low `@ai-sdk/provider-utils` advisory as-is: the advertised patched version 3.0.98 is not published on npm and `@mastra/core` exact-pins 3.0.25 - aligns `analytics.dispatch.test.ts` mocks with the `spawnDetached` contract from https://github.com/ComposioHQ/composio/pull/3880 (`once('spawn')`/`once('error')` with unref-after-confirmation); the test added in https://github.com/ComposioHQ/composio/pull/3881 still asserted the old fire-and-forget `.on('error')` shape Verified locally: `pnpm audit --prod --audit-level=high` exits 0 (1 low remaining), `pnpm install --frozen-lockfile` passes, and the full `@composio/cli` suite passes (934 tests). <!-- codesmith:footer --> --- <a href="https://app.blacksmith.sh/ComposioHQ/codesmith/composio/pr/3898"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img alt="View with Codesmith" src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a> <a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1787212096&installation_model_id=428187&pr_number=3898&repository=ComposioHQ%2Fcomposio&return_to=https%3A%2F%2Fgithub.com%2FComposioHQ%2Fcomposio%2Fpull%2F3898&signature=9d7662095d47fa89940855b0abb67f014a807b522b81ea780b62f6326dc0e807"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with Codesmith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a> <sup>Need help on this PR? Tag <code>/codesmith</code> with what you need. Autofix is disabled.</sup> <!-- codesmith:autofix:disabled --> <!-- /codesmith:footer --> |
||
|
Alberto Schiabel
|
6d5465acd3 |
refactor(cli): seal the CommandDescriptor seam and drop zod for Schema (#3882)
This PR: - activates the descriptor-seam rule group: `commands/command-introspection.ts` becomes the only module allowed to import `CommandDescriptor`/`Usage` from `@effect/cli` — the redesign seam the Effect CLI v4 migration will reimplement - routes root command assembly, preflight parsing, help routing, and value-option collection through the seam helpers instead of descriptor walks - replaces the Zod-backed tool-input adapter with an internal `@composio/json-schema-to-effect-schema` compiler backed by the eval-free `@cfworker/json-schema` interpreter - normalizes the OpenAPI and Composio extensions accepted by the previous validator, while preserving typed `ToolInputValidationError` failures, field paths, multi-error reporting, and typo suggestions - extends the descriptor and Zod boundaries to reject static imports, dynamic `import()`, and `require()` bypasses - adds compiler parity tests plus CLI regression coverage for multiple simultaneous field and unknown-key failures - introspection tests pin that the helpers yield identical descriptors and usage strings --- **Stack** (re-slice of https://github.com/ComposioHQ/composio/pull/3859; each PR targets its parent and auto-retargets to `next` as parents merge): 1. https://github.com/ComposioHQ/composio/pull/3877 — guidelines + inert rule groups 2. https://github.com/ComposioHQ/composio/pull/3878 — `new Function()` eval security fix 3. https://github.com/ComposioHQ/composio/pull/3879 — behavioral fix pack 4. https://github.com/ComposioHQ/composio/pull/3880 — platform-imports rule + migration 5. https://github.com/ComposioHQ/composio/pull/3881 — terminal-streams rule + TerminalUI boundary 6. https://github.com/ComposioHQ/composio/pull/3882 — descriptor seam + Zod→Schema ← **this PR** 7. https://github.com/ComposioHQ/composio/pull/3883 — test-tree lint + deterministic suites 8. https://github.com/ComposioHQ/composio/pull/3884 — typed error boundaries + v4 seams 9. https://github.com/ComposioHQ/composio/pull/3885 — try/catch+env ban + boundary ratchet On stacked bases CI runs lint/build and the CLI Docker e2e job; unit tests and typecheck are verified locally per PR and re-verified by full CI when each PR is retargeted to `next`. |
||
|
Alberto Schiabel
|
2dc9ef34d0 |
fix(cli): remove new Function() eval from JSON-ish input parsing (#3878)
This PR:
- removes an in-process arbitrary-code-execution surface:
`parse-json-ish.ts` fell back to `Function("return (…)")()` for any
`tools execute --data`, `listen --params`, or `proxy` body value that
failed JSON and comment-JSON parsing — the CLI is agent-facing and
`--data` also accepts `@file` and stdin, so crafted or prompt-injected
input reached the eval
- lands the parser in its final consolidated shape:
`src/utils/parse-json.ts` parses JSON5 (unquoted keys, single quotes,
trailing commas, comments) without evaluating anything and returns
`Either` with a typed `JsonParsingError`
- consolidates the `effect-errors` read-json duplicates onto the same
parser and swaps `comment-json` for `json5` (the stack's only lockfile
change)
- pins code-execution probes in unit tests (`new Date()`, computed
expressions, `globalThis` writes are rejected, never evaluated)
- intentional narrowing: JS expressions such as `1+1` that only worked
because of the eval now fail with a parse error; proxy bodies that are
not JSON5 records fall back to the raw string
---
**Stack** (re-slice of https://github.com/ComposioHQ/composio/pull/3859;
each PR targets its parent and auto-retargets to `next` as parents
merge):
1. https://github.com/ComposioHQ/composio/pull/3877 — guidelines + inert
rule groups
2. https://github.com/ComposioHQ/composio/pull/3878 — `new Function()`
eval security fix ← **this PR**
3. https://github.com/ComposioHQ/composio/pull/3879 — behavioral fix
pack
4. https://github.com/ComposioHQ/composio/pull/3880 — platform-imports
rule + migration
5. https://github.com/ComposioHQ/composio/pull/3881 — terminal-streams
rule + TerminalUI boundary
6. https://github.com/ComposioHQ/composio/pull/3882 — descriptor seam +
zod→Schema
7. https://github.com/ComposioHQ/composio/pull/3883 — test-tree lint +
deterministic suites
8. https://github.com/ComposioHQ/composio/pull/3884 — typed error
boundaries + v4 seams
9. https://github.com/ComposioHQ/composio/pull/3885 — try/catch+env ban
+ boundary ratchet
On stacked bases CI runs lint/build and the CLI Docker e2e job; unit
tests and typecheck are verified locally per PR and re-verified by full
CI when each PR is retargeted to `next`.
|
||
|
Alberto Schiabel
|
9498679c26 |
fix(release): guard and document CLI releases (#3895)
This PR: - removes the stale `@composio/cli` changeset that wedges `changesets/action` and preserves its release note in the CLI changelog - adds `validate:changesets` before the TypeScript release action and covers ignored-package changesets in the release regression suite - makes the guard read changeset files directly so it also works in shallow and detached CI checkouts - refreshes `mise.lock` after the pinned Python standalone artifacts moved to the 20260718 build - adds the repo-local `cli-release` skill with beta, stable-promotion, verification, and failure-recovery procedures - replaces the contradictory "stable via changeset" contributor guidance with the tested-beta promotion path - extends skill taxonomy, routing probes, and PR path filters so the guard cannot silently drift ## Regression coverage The validator test creates a changeset fixture outside a Git repository, verifies that an ignored CLI package is rejected, then verifies that a normal package changeset passes. This reproduces the shallow-checkout failure without relying on a local `next` ref. ## Verification - `pnpm validate:agent-skills` - `pnpm validate:skill-routing` - `pnpm validate:changesets` - `pnpm test:release-workflow` - `pnpm lint` - `pnpm install --frozen-lockfile` - all 24 TypeScript package test tasks - skill-creator `quick_validate.py` - Prettier check - `git diff --check` - manual beta release [`@composio/cli@0.2.33-beta.294`](https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.2.33-beta.294): 33/33 release and installation jobs passed |
||
|
Kshitij Jhunjhunwala
|
d583e7ef6f | fix(cli): harden plugin setup installation | ||
|
dependabot[bot]
|
09aab1d19f |
chore(deps-dev): bump the npm-development group across 1 directory with 3 updates (#3795)
Bumps the npm-development group with 3 updates in the / directory: [turbo](https://github.com/vercel/turborepo), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [typedoc](https://github.com/TypeStrong/TypeDoc). Updates `turbo` from 2.10.2 to 2.10.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.10.4</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.10.3 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13222">vercel/turborepo#13222</a></li> <li>ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13240">vercel/turborepo#13240</a></li> <li>perf: Use mimalloc as the global allocator by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13237">vercel/turborepo#13237</a></li> <li>perf: Parse yarn v1 lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13241">vercel/turborepo#13241</a></li> <li>ci: Fix cache outputs for Eve app by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13243">vercel/turborepo#13243</a></li> <li>perf: Stop materializing spans for the disabled daemon log layer by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13244">vercel/turborepo#13244</a></li> <li>fix: Keep ancestor-scoped bun dependencies resolvable after prune renames by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13236">vercel/turborepo#13236</a></li> <li>perf: Overlap external dependency hashing with package file hashing by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13234">vercel/turborepo#13234</a></li> <li>perf: Build tracked repo index concurrently with package graph by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13232">vercel/turborepo#13232</a></li> <li>perf: Release tokio runtime at exit so background DNS lookups never stall the user by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13231">vercel/turborepo#13231</a></li> <li>perf: Overhaul pnpm lockfile parsing and dependency closure computation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13228">vercel/turborepo#13228</a></li> <li>feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13227">vercel/turborepo#13227</a></li> <li>feat: Introduce toolchain provider abstraction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13235">vercel/turborepo#13235</a></li> <li>perf: Parse Berry lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13242">vercel/turborepo#13242</a></li> <li>fix: Apply input exclusion globs to the filesystem walk by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13224">vercel/turborepo#13224</a></li> <li>fix: Stop root-directory packages from claiming every file in change mapping by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13225">vercel/turborepo#13225</a></li> <li>chore: Rename turborepo-repository napi package to <code>@turbo/repository</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13226">vercel/turborepo#13226</a></li> <li>perf: Hash git blobs with hardware-accelerated SHA-1 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13245">vercel/turborepo#13245</a></li> <li>release(turborepo): 2.10.4-canary.1 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13247">vercel/turborepo#13247</a></li> <li>feat: Discover Cargo crates as packages by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13248">vercel/turborepo#13248</a></li> <li>perf: Reuse per-package external dependency hashes in run summaries by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13249">vercel/turborepo#13249</a></li> <li>perf: Stat workspace turbo.json files concurrently during discovery by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13251">vercel/turborepo#13251</a></li> <li>chore: Add tracing spans to workspace discovery and globwalk phases by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13252">vercel/turborepo#13252</a></li> <li>fix: Avoid non-reentrant libc calls in concurrent shutdown process scans by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13256">vercel/turborepo#13256</a></li> <li>perf: Memoize resolved task definitions during engine construction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13257">vercel/turborepo#13257</a></li> <li>perf: Compute transitive closures and external dependency hashes concurrently with run setup by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13250">vercel/turborepo#13250</a></li> <li>perf: Probe microfrontends configs in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13262">vercel/turborepo#13262</a></li> <li>feat: Execute Cargo crate tasks via cargo by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13261">vercel/turborepo#13261</a></li> <li>perf: Pre-size engine task collections by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13265">vercel/turborepo#13265</a></li> <li>feat: Expose resolved experimentalCI task configuration in <code>turbo query</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13264">vercel/turborepo#13264</a></li> <li>feat: Derive input and output globs for Cargo tasks by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13263">vercel/turborepo#13263</a></li> <li>perf: Parse large pnpm lockfile sections in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13266">vercel/turborepo#13266</a></li> <li>feat: Hash Cargo external dependencies per-crate by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13267">vercel/turborepo#13267</a></li> <li>ci: Install pnpm 10 in musl containers for Library Release by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13269">vercel/turborepo#13269</a></li> <li>ci: Force pnpm overwrite in Library Release musl containers by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13270">vercel/turborepo#13270</a></li> <li>perf: Defer the untracked-scan barrier to first file-hash use by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13268">vercel/turborepo#13268</a></li> <li>ci: Fetch API-created commit before updating local ref by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13271">vercel/turborepo#13271</a></li> <li>release(library): 0.0.1-canary.22 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13272">vercel/turborepo#13272</a></li> <li>perf: Remove lock and dispatch overhead from task hash precomputation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13273">vercel/turborepo#13273</a></li> <li>fix: Fall back to lockfile detection in <code>@turbo/repository</code> when package manager is undeclared by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13275">vercel/turborepo#13275</a></li> <li>test: Add end-to-end coverage for Cargo workspaces by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13274">vercel/turborepo#13274</a></li> <li>release(library): 0.0.1-canary.23 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13276">vercel/turborepo#13276</a></li> <li>release(turborepo): 2.10.4-canary.2 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13278">vercel/turborepo#13278</a></li> <li>fix: Collapse nested package-manager fallback conditional by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13279">vercel/turborepo#13279</a></li> <li>feat: Make turbo watch Cargo-aware by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13280">vercel/turborepo#13280</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/1506a114e377dd7e1e8e7a7863c42adf94a9f776"><code>1506a11</code></a> publish 2.10.4 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/11a68c705274cc7a408776b576ce7a9e14d6e6df"><code>11a68c7</code></a> fix: Stop flagging relative imports that resolve into node_modules in boundar...</li> <li><a href="https://github.com/vercel/turborepo/commit/947b4784cd1b254e62b663bbdb22891a849b7442"><code>947b478</code></a> fix: Raise the open-file soft limit at startup (<a href="https://redirect.github.com/vercel/turborepo/issues/13282">#13282</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ddc584d788349fc3668e280286f540feee4eb6b9"><code>ddc584d</code></a> feat: Make turbo prune Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13281">#13281</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ff0d50822314c5b388d9b4daa9c6159387752d95"><code>ff0d508</code></a> perf: Skip dependency-closure assembly for toolchains that derive nothing (<a href="https://redirect.github.com/vercel/turborepo/issues/1">#1</a>...</li> <li><a href="https://github.com/vercel/turborepo/commit/39d623e1323ef50e06be0a103082ae29cc545779"><code>39d623e</code></a> feat: Make turbo watch Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13280">#13280</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/af01fdfeb5efe07a7b6843a0b8f5033b59ebbb2c"><code>af01fdf</code></a> fix: Collapse nested package-manager fallback conditional (<a href="https://redirect.github.com/vercel/turborepo/issues/13279">#13279</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/7e02f94f647cb4d527a438313dc4adbe3e8c0df3"><code>7e02f94</code></a> release(turborepo): 2.10.4-canary.2 (<a href="https://redirect.github.com/vercel/turborepo/issues/13278">#13278</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/8e3a59fdb6c71ad24fbbb363db52f88eb9a89116"><code>8e3a59f</code></a> release(library): 0.0.1-canary.23 (<a href="https://redirect.github.com/vercel/turborepo/issues/13276">#13276</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ce18f0a79eb49e9a22c7e6cfa491777c24ed746a"><code>ce18f0a</code></a> test: Add end-to-end coverage for Cargo workspaces (<a href="https://redirect.github.com/vercel/turborepo/issues/13274">#13274</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.10.2...v2.10.4">compare view</a></li> </ul> </details> <br /> Updates `typescript-eslint` from 8.62.1 to 8.63.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's releases</a>.</em></p> <blockquote> <h2>v8.63.0</h2> <h2>8.63.0 (2026-07-06)</h2> <h3>🚀 Features</h3> <ul> <li><strong>eslint-plugin:</strong> [no-misused-promises] detect async usage of a sync dispose usage (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12426">#12426</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12447">#12447</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12446">#12446</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12491">#12491</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12485">#12485</a>)</li> <li><strong>eslint-plugin:</strong> [no-base-to-string] don't flag a shadowed String() call (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12492">#12492</a>)</li> <li><strong>scope-manager:</strong> export ClassStaticBlockScope (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12460">#12460</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Evyatar Daud <a href="https://github.com/StyleShit"><code>@StyleShit</code></a></li> <li>Kristjan <a href="https://github.com/KristjanTammekivi"><code>@KristjanTammekivi</code></a></li> <li>Michael Naumov <a href="https://github.com/mnaoumov"><code>@mnaoumov</code></a></li> <li>Serhii Leniv <a href="https://github.com/Serhii-Leniv"><code>@Serhii-Leniv</code></a></li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's changelog</a>.</em></p> <blockquote> <h2>8.63.0 (2026-07-06)</h2> <p>This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374"><code>290cf6c</code></a> chore(release): publish 8.63.0</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint">compare view</a></li> </ul> </details> <br /> Updates `typedoc` from 0.28.19 to 0.28.20 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/TypeDoc/releases">typedoc's releases</a>.</em></p> <blockquote> <h2>v0.28.20</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md">typedoc's changelog</a>.</em></p> <blockquote> <h2>v0.28.20 (2026-07-05)</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/TypeStrong/typedoc/commit/34d843be0953fc81de0fde14bea8db72d0bbccc6"><code>34d843b</code></a> Update changelog for release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/fbd4a254952c171b9ba7ebbe96c5151e844743be"><code>fbd4a25</code></a> Bump version to 0.28.20</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/93ba157000e4a632bfbf32a0b6f00f8ae57c7c99"><code>93ba157</code></a> Update dependencies in example</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/e8c5df8844edca9800dfc62cee9115ef0fba59ea"><code>e8c5df8</code></a> Remove unnecessary files from distribution</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/392b0dd50a428ea0c732c38c6c263e74cb6200b1"><code>392b0dd</code></a> Update dependencies</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/8510dd48c7778f419f4605146f1a733af27993fa"><code>8510dd4</code></a> Add missing entries in changelog before release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/51dc0521890924269f06e08972c6453299f63cb5"><code>51dc052</code></a> Update change log for 0.28.20 release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/72f20cd87b4ef30aae97b68fcbb42ca19cebdc22"><code>72f20cd</code></a> Merge branch 'fix-locale-sort-group-category-titles' into dev</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/623f2c0bd35b5e89cc79fb5783dac01c6f2530e9"><code>623f2c0</code></a> Fix failing test, accept slightly slower build for now</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/c8bdf14cab0c22dd415b6872cc647c6cf81f917c"><code>c8bdf14</code></a> Minor config tweak to improve dev build time</li> <li>Additional commits viewable in <a href="https://github.com/TypeStrong/TypeDoc/compare/v0.28.19...v0.28.20">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4baacbeb77 |
chore(deps): bump the npm-production group across 1 directory with 7 updates (#3799)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
b07fcada3f |
feat(experimental): add Eve provider and iMessage example (#3800)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3642 and credits @shamsharoon for the original Eve provider and iMessage work - rebases the integration onto the current `next` branch and resolves its lockfile conflicts - publishes an isolated `@composio/experimental/eve` entry with the correct Eve 0.12+ peer contract - adds recoverable per-session discovery, native Eve context propagation, and durable approval policies for direct and batched side effects - centralizes circular-safe auth-link extraction across Eve and Pi and replaces dense conditional expressions with named control flow - hardens the iMessage example against `osascript` option injection, unsafe trigger scoping, and third-party prompt injection - preserves completed local-tool results when a mixed local/remote batch loses its remote transport - consolidates the example documentation onto shared components, documents direct model-provider credentials, and clarifies that the browsable source is not yet a standalone fixture - verifies the change with 999 core tests, 32 experimental tests, package builds/typechecks, packed peer-isolation smokes, and a production docs build --------- Co-authored-by: shams haroon <144290365+shamsharoon@users.noreply.github.com> Co-authored-by: shams haroon <shamsharoon7@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: shams haroon <shams@composio.dev> |
||
|
Alberto Schiabel
|
30ba4d2930 |
feat(openai): add executable provider example (#3798)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3790 - makes the OpenAI example executable in direct-tools, Tool Router, smoke, and Cloudflare Workers modes - keeps direct and Tool Router agents in separate files so each execution model is explicit and readable - requires a successful Composio tool execution before either agent can accept a final model response - adds OpenAI to the nightly staging matrix without weakening the existing Mastra coverage - updates two stale experimental OpenAI usages so the complete example package typechecks against current SDK APIs ## Testing - `pnpm --filter openai-example run typecheck` - `pnpm --filter openai-example run lint` (0 errors; 4 pre-existing warnings) - `pnpm --filter openai-example run smoke` (staging: 5 direct tools and 6 Tool Router tools) - `pnpm --filter openai-example run cf:dry-run` - `pnpm run typecheck` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` - `pnpm run typecheck:examples` - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - [branch nightly](https://github.com/ComposioHQ/composio/actions/runs/29079263571): OpenAI and Mastra both passed smoke, direct-tools, and Tool Router against staging ## Post-deploy validation - dispatch `ts.examples-nightly.yml` on `next` after merge and confirm both matrix legs stay green - healthy runs finish within the 20-minute job budget and log successful tool-backed responses for both agent modes - revert this PR if the OpenAI leg blocks the nightly; examples maintainers own the first post-merge run and the next 06:00 UTC schedule --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
76881491d0 |
feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788)
## What Turns the **Mastra** example into an executable reference that doubles as a test, and wires the examples into CI for the first time. First slice of the v1 "executable examples" workstream — the pattern here is the template for the other TS providers, then Python. ## Why Examples under `ts/examples/*` were unverified: the only CI tie-in is `validate-examples.ts`, which is transpile-only (no cross-file types, no lint, no execution) and passes on exactly the schema-conversion regressions we keep hitting in the Mastra provider — all closed but unprotected: - https://github.com/ComposioHQ/composio/issues/2109 (zod→json serialization crash) - https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped while `$ref` kept) - https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema tools crash serialization) ## Changes **Canonical Mastra example** (`ts/examples/mastra`) - `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS` toolkit - `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` → `session.tools()` (drops the deprecated bare `composio.create` alias) - `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers runtime (`export default { fetch }`) - `src/smoke.ts` — deterministic wrapping + tool-router assertions (needs only `COMPOSIO_API_KEY`) - Removed the old Gmail/MCP entries that used deprecated APIs and required auth - Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts` **Real typecheck + lint** (examples previously escaped both) - Example now has a `typecheck` script (Node + Worker tsconfigs); `typecheck:examples` / `lint:examples` scripts added - eslint now covers `ts/examples/**` with type-safety rules kept (`no-explicit-any`) and console noise allowed **Two-tier CI** - `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck → lint → `wrangler deploy --dry-run`. This is the tier that catches the schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces as a **type** error. - `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes against the **staging** backend with secrets; runs the deterministic smoke always and the full agent examples when an LLM key is set. ## Verification Locally against staging: `smoke` passes (5 direct + 6 tool-router tools), `typecheck:examples` and `lint:examples` are green, the Worker `wrangler deploy --dry-run` bundles, and seeded regressions (a type error / an `any`) correctly fail their gate. ## Notes - No changeset — example packages are private/unpublished. - Follow-ups (separate PRs): template the pattern to the other TS providers, then port to `python/examples/*`. |
||
|
Alberto Schiabel
|
72eac88133 |
fix(cli): replace abandoned decompress dependency (GHSA-mp2f-45pm-3cg9) (#3767)
This PR: - replaces `decompress` (unmaintained; the zip-slip fix in the GHSA advisory was never published to npm past 4.2.1) with `extract-zip` across the CLI's four zip-extraction call sites: `install-skill.ts`, `run-companion-modules.ts`, `upgrade-binary.ts`, and `cli-local-tools/bundled-binaries.ts` - `extract-zip` validates each entry resolves inside the target directory before writing, closing the path-traversal issue `pnpm audit` flags as critical - replaces the one `.tgz`-extracting call site (`scripts/_acp-adapters.ts`, used to vendor ACP adapter binaries at build time) with `tar`, since `extract-zip` only handles zip archives - removes `@types/decompress`; both `extract-zip` and `tar` ship their own type definitions - `pnpm audit --prod --audit-level=high` now passes (previously failing on `next`, unrelated to #3766) Verified `extract-zip` and `tar` extract nested directories correctly with a local smoke test (real `.zip`/`.tgz` archives), in addition to the existing `@composio/cli` (724 tests) and `@composio/cli-local-tools` (13 tests) suites passing. |
||
|
Alberto Schiabel
|
58bc93b2d9 |
chore(deps): consolidate dependency updates (#3760)
This PR: - consolidates https://github.com/ComposioHQ/composio/pull/3733, https://github.com/ComposioHQ/composio/pull/3735 through https://github.com/ComposioHQ/composio/pull/3744, and https://github.com/ComposioHQ/composio/pull/3752 - refreshes the pnpm workspace dependencies under the existing `minimumReleaseAge` supply-chain gate - keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare workers types 4 where latest majors conflict with the current workspace - keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the workspace catalog to zod 4 - bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock` - updates the SHA-pinned Claude and Codex workflow actions from the Dependabot action group - adds a patch changeset for the versioned package manifests touched by dependency updates - verifies the rollup with frozen pnpm/uv locks, peer checks, audit threshold checks, typecheck, lint, builds, TypeScript tests, and Python `nox -s chk` ## Context `pnpm audit --prod --audit-level=moderate` passes. The remaining production audit item is a low `@ai-sdk/provider-utils` advisory through Mastra transitive dependencies; forcing it higher would require leaving the compatible stable Mastra dependency path. |
||
|
Alberto Schiabel
|
49e4c11427 |
chore(deps): resolve high prod audit advisories via in-range bumps (#3751)
This PR: - refreshes lockfile resolutions for the 17 high `pnpm audit --prod` advisories via `pnpm update -r` — real version bumps within the ranges parents already declare (minimatch 5/9, lodash, fast-uri, picomatch, langsmith, `@hono/node-server`, express-rate-limit, ws), not resolution overrides - bumps the pre-existing #3467 security pin `protobufjs: 7.5.9 -> 7.6.1` in `pnpm-workspace.yaml` (7.5.9 itself is vulnerable to GHSA unbounded-Any DoS) - adds ONE temporary scoped override, `minimatch@>=10.0.0 <10.2.3 -> >=10.2.3`: `@zed-industries/claude-code-acp@0.16.2` (latest) exact-pins vulnerable `minimatch 10.2.1` and no fixed release exists; commented in the file, drop when upstream ships - no `package.json` changes anywhere: none of the vulnerable packages is a direct dependency of any workspace package, so there is nothing to major-bump on our side ## Context Split out of #3748 (CI hardening) so dependency changes land in isolation. **Merge this before #3748** — its new `pnpm audit --prod --audit-level=high` hard gate needs this green baseline, per the plan's "gate lands together with the dependency fix" rule. Verified: `pnpm audit --prod --audit-level=high` exits 0 (remaining: 1 low, 6 moderate); `pnpm install --frozen-lockfile` passes. Dev-path high advisories (vite, undici, flatted, linkify-it, minimatch 3.x) are out of scope — the gate is `--prod`; tracked as backlog. |
||
|
Alberto Schiabel
|
8d5823be87 |
chore(ci): cache turbo, bun, and uv and cancel superseded pr runs (#3747)
This PR: - adds `concurrency` to the ten PR/push CI workflows: superseded **PR** runs are cancelled, while push runs use a per-run group (`github.run_id`) so every commit on `next`/`master` still gets its own run - caches turbo outputs (`.turbo/cache`) via a new opt-in `enable-turbo-cache` input on the `setup-node-pnpm-bun` composite (keyed per job — concurrent jobs save different task graphs), enabled in `ts.build`, `ts.test`, `ts.typecheck`, and all four `ts.test-e2e` jobs - enables turbo caching for `typecheck`, removes the incorrect `dist/` outputs from `test`, hashes root `tsconfig.base.json` in `build`/`typecheck` inputs, and adds `mise.toml`/`mise.lock` to `globalDependencies` so toolchain bumps bust every task hash (addresses the Bugbot finding) - fixes `@composio/slim`'s build to participate in the turbo graph: core moves to slim's `devDependencies` (published `dependencies` unchanged) and the script no longer shells out to `pnpm --filter @composio/core build`, which raced concurrent dependents by wiping `core/dist` mid-build and double-built core on every cold run — slim's `dist` remains byte-identical to core's; no changeset added since the published artifact is unchanged (say the word if policy wants one anyway) - fixes the `py.test` matrix cache to `~/.cache/uv` (it cached `~/.cache/pip` while installing via `uv pip`) and caches `~/.bun/install/cache` in the five docs workflows - adds `turbo.jsonc` to the TS workflows' path filters (previously unwatched) - release/publish workflows are deliberately untouched Measured (same commit, cold first attempt vs `gh run rerun` warm): ts.build 103s → 53s, ts.test 157s → 55s (`turbo test` 24/24 cached in 182ms), ts.typecheck 80s → 43s; py.test legs save a few seconds each (uv was already fast). Warm floor is checkout + mise + pnpm-install overhead. ## Context Implements `plans/001-ci-speed-caching-and-concurrency.md` from the advisor audit on `docs/sdk-v1-decision-records`. Implementation by codex against the plan, then self-reviewed and counter-reviewed; warm-rerun testing surfaced and fixed three latent issues (toolchain files absent from turbo's hash, first-writer-wins cache-key collision across jobs, and the slim out-of-band core rebuild race). |
||
|
Alberto Schiabel
|
03cb181fdb |
chore(deps): roll up dependency bumps (#3711)
This PR: - rolls up https://github.com/ComposioHQ/composio/pull/3695, https://github.com/ComposioHQ/composio/pull/3696, https://github.com/ComposioHQ/composio/pull/3697, and https://github.com/ComposioHQ/composio/pull/3698 into one dependency-bump branch - updates Python dependency metadata for `langchain-openai`, `pyautogen`, and `crewai` - updates npm production dependency metadata for `zod-to-json-schema`, `openai`, and `@modelcontextprotocol/sdk` - refreshes `uv.lock` and `pnpm-lock.yaml` with the repo-pinned package managers - leaves Changesets unchanged because the touched TS package manifests are private/ignored and no published TS SDK package metadata changes - verified with `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, focused TS builds/tests, clean-worktree `pnpm test:examples`, Python import tests, and Python nox checks - note: local `pnpm build:packages` hit a pre-existing broad-build race around `@composio/slim` rebuilding `@composio/core`; focused dependent builds pass --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
cddd66c3ce |
chore(ts): bump Hono, Mastra, and Chrome deps (#3691)
This PR: - bumps `hono`, `@mastra/core`, and `chrome-devtools-mcp` to their current latest published versions - routes the remaining Cloudflare Tool Router Hono consumer through the workspace catalog - updates the `@composio/mastra` `@mastra/core` peer range and adds a patch changeset - fixes `check-peer-deps` to resolve `semver` through the normal package dependency |
||
|
Alberto Schiabel
|
9ffc696a99 |
feat(vercel): support AI SDK v7 (#3683)
This PR:
- widens the `ai` peer dependency of `@composio/vercel` to `^6.0.0 ||
^7.0.0`, adding AI SDK v7 support and dropping the previously-untested
v5 arm
- adds Docker-based Node e2e compatibility suites for AI SDK v6 and v7
under `ts/e2e-tests/runtimes/node/vercel-ai-sdk-v{6,7}`, auto-discovered
by the existing e2e matrix (so PR CI exercises them)
- each installs the packed `@composio/vercel` tarball, typechecks the
provider against the target `ai` major, and asserts runtime tool
wrapping/execution (object inputs, JSON-string normalization via
`normalizeToolArguments`, `ToolSet` shape)
- the v7 suite additionally exercises v7's `ToolExecutionOptions` passed
to `tool.execute`
- ships a `minor` changeset (the peer-range narrowing removes a
previously-supported major)
- breaking:
- `ai@5` is no longer an accepted peer of `@composio/vercel`; v5
consumers should stay on the prior minor
|
||
|
Rahul Tarak
|
d17a268d3f |
docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637)
Integration branch for the next docs release: a **sessions-first
documentation rewrite** — new and rewritten guides, example pages,
interactive components, and docs tooling — plus the supporting SDK
changes that the new docs describe.
The bulk of this PR is docs (~24k lines across ~150 commits); the SDK
changes (~5k lines) back the new guides.
## Documentation (the bulk)
- **Sessions-first restructure** — reorganized navigation and section
structure (incl. the "Sandbox (prev workbench)" section), with
v3-reorganization redirects so old URLs keep resolving.
- **Rewritten core guides** — quickstart, configuring sessions, triggers
(creating + subscribing to events), proxy-execute, toolkits
enable/disable, and common FAQ, rewritten in the house voice.
- **New example pages** — local-sandbox PR reviewer, daily standup bot,
and slack bot, with runnable build-ups.
- **New interactive components & diagrams** — triggers flow animation,
manage-connections visual, connection-refresh visual, and the
terminal-kit components.
- **Docs tooling** — a docs-graph link-graph connectivity checker,
search reprioritization (deprioritize legacy pages), and SDK-reference
regeneration.
## Supporting SDK changes
**`@composio/core` → 0.13.0 (minor)**
- `composio.sessions.create()` as the first-class sessions API
(`composio.create()` kept as an alias).
- **MCP is opt-in:** default `create()` / `use()` return native-tool
sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface
`session.mcp`. _Migration: read `session.mcp` only after creating with
`{ mcp: true }`._
- `session.sandbox` is the canonical resolved config;
`session.workbench` kept as a deprecated alias. `sandbox` is the
preferred session-config key (`workbench` still accepted).
- `connectedAccounts.updateAcl()` graduated from experimental (alias
kept).
- `triggers.parse()` (parse + optionally verify an incoming webhook) and
`triggers.setWebhookSubscription()`.
**`@composio/experimental` → minor** — local-workbench helpers moved
onto the `@composio/experimental/workbench` subpath (out of
`@composio/core/experimental`), keeping the ~14 KB embedded Python
helper out of core. Plus the experimental Pi provider.
**`@composio/slim` → minor.**
**Python → 0.17.0** — mirrors the TS surface: `composio.sessions` mount
(`tool_router` deprecated), `triggers.parse()` /
`set_webhook_subscription()`, the `sandbox` config key, and
`connected_accounts.update_acl()`.
## Review response (#3664)
Addressed the `@composio/core` review:
- **Security:** `triggers.parse()` no longer fails open — a
present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`)
now throws instead of silently skipping verification; omitting it stays
an explicit opt-out (both SDKs).
- Removed snake_case leakage from `transformWebhookSubscription` (+ the
index signature that allowed it).
- **Removed** the TS-only `connectedAccounts.link()` toolkit
auto-resolve (shipped with cancellability / orphaned-auth-config bugs
and was effectively undocumented; to be reintroduced properly later).
- Unified Python error types on `ValidationError`; added `mcp=True`
Python tests; fixed runtime-portability + error-type test assertions.
- Polished deprecation messages; fixed the backwards `/experimental`
`@deprecated` note and the `SessionWithMcp` JSDoc.
## Testing
- **TS:** `@composio/core` + `@composio/experimental` typecheck pass;
vitest green for the touched suites.
- **Python:** `test_tool_router.py` + `test_triggers.py` pass (161
tests).
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev>
Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Sarah Simionescu <sarah@composio.dev>
Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>
|
||
|
Alberto Schiabel
|
f8cd90ce5a |
chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646)
This PR: - uses plain `tsdown` package scripts and a shared typed `tsdown.config.base.ts` so Node 24 builds work without loader flags - switches the repo dev/build toolchain to Node `24.17.0` and pnpm `11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml` - marks the root package as ESM with `type: module`, matching the TypeScript packages - keeps Node `22.22.3` in the runtime/E2E matrices as the minimum supported user runtime - changes the TypeScript build workflow back to a single build on the mise-managed toolchain and broadens path filters for package-manager/build config files - adds pnpm 11 build-script policy with `allowBuilds` and intentionally ignored `sharp` builds - enables tsdown ESM shims for the packaged CLI wrapper so `composio --help` runs under Node 22 and Node 24 Verified locally: - `CI=true pnpm install --frozen-lockfile` - `pnpm lint` - `pnpm run build:packages` - `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter @e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run test:e2e:node` - `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3` and `24.17.0` |
||
|
Alberto Schiabel
|
23f9053804 |
chore(ts): clean up dependencies and bump toolchain (#3623)
This PR: - consolidates and bumps TypeScript/npm dependencies across the monorepo, docs, examples, and e2e fixtures — no runtime behavior changes - **cleanup:** remove the unused `ansis` dependency from `@composio/cli` (`picocolors` is the actual color lib), drop the dead `uuid` catalog entry, catalog `dotenv` + `@types/bun` and repoint drifting examples/e2e onto them, and replace `chalk` with `picocolors` in `@composio/core` (smaller, ESM, already used by the CLI) - **TypeScript 6:** bump `typescript` `5.9 → 6.0.3` everywhere (catalog, CLI test fixtures, docs); drop vestigial `declaration`/`outDir` from the provider `tsconfig.json`s to fix the TS 6 `rootDir` regression (`TS6059`); add `ignoreDeprecations: "6.0"` in docs for the `baseUrl` deprecation - **toolchain:** `tsdown 0.18 → 0.22.3`, `vitest` + `@vitest/ui → 4.1.9`, `publint → 0.3.21`, `wrangler → 4.101.0` (each the latest version within the 3-day `minimumReleaseAge` gate) - **Effect + hono:** `effect 3.21.3`, `@effect/cli 0.75.2`, `@effect/platform 0.96.1`, `platform-bun 0.90.0`, `platform-node-shared 0.60.0`, `language-service 0.86.2`, `@effect/vitest 0.29.0`, `hono 4.12.25`; pin the Effect peer cohort (`printer`/`printer-ansi`/`typeclass`/`rpc`/`sql`/`cluster`/`experimental`/`workflow`) as `@composio/cli` devDeps so the auto-installed peers resolve coherently, and bump `@cloudflare/workers-types` to satisfy `wrangler`'s peer - changesets: `@composio/cli` patch (ansis removal) and `@composio/core` patch (chalk → picocolors) - verified: `build`, `typecheck` (tsgo + real `tsc` 6.0.3), and local tests (excluding e2e) all pass |
||
|
Alberto Schiabel
|
24e647fa16 |
test(ts/e2e): cover claude agent sdk on node current (#3620)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3495 - adds a Node.js `current` e2e suite for `@composio/claude-agent-sdk` - exercises the packaged provider through Claude Agent SDK `createSdkMcpServer` / `query()` with a deterministic local tool - forwards `ANTHROPIC_API_KEY` through Turbo, Docker e2e env passthrough, and the Node e2e workflow |
||
|
Alberto Schiabel
|
025a657597 |
feat(ts): drop CommonJS support (#3494)
This PR moves the TypeScript SDK support floor to the latest Node.js 22 release and uses that as the point where we stop carrying custom CommonJS compatibility machinery. The e2e runtime coverage now exercises the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested against the minimum supported version and the newer runtimes users are likely to adopt next. Because the SDK packages are still on `0.x`, the accompanying changeset uses `minor` bumps while calling out that this is a breaking change inside the existing 0.x line. It also moves pnpm under mise on this Node 22 layer. That belongs here, not in #3493, because the pinned `pnpm@10.28.2` requires Node.js `>=22.13`. Removing Corepack is intentional: Node.js documents that Corepack is no longer distributed starting with Node.js v25, so relying on `corepack enable` would keep a toolchain dependency that is already on the way out of the Node distribution. ## What changed - Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`, `mise.lock`, `toolchain-versions.json`, and root `devEngines`. - Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise the single source of truth for the pnpm version. Removes the root `packageManager` / `devEngines.packageManager` Corepack pin entirely (rather than keeping a second copy of the version that could drift) and removes stale `packageManager` metadata from real TS packages/examples and generators. - Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a `packageManager` field. Without this, Turbo fails workspace resolution (`Could not resolve workspaces -> Missing 'packageManager' field`), which is the only reason the field would otherwise need to stay. - Replaces `corepack enable` in the shared setup action with mise-managed pnpm. The E2E Docker images install bun + pnpm directly from `mise.toml`/`mise.lock` (with `dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay on the base image as the test matrix axis and are disabled via `MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build args are threaded from the host anymore, and bun+pnpm now carry `mise.lock` checksum verification. - Extends the install-time toolchain check to validate pnpm against mise alongside Bun. - Sets the Node E2E matrix and install fallback checks to `22.22.3`, `24.16.0`, and `25.9.0`. - Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts` only and uses the ATTW `esm-only` profile. - Removes explicit `require` / `.cjs` / `.d.cts` package export paths and internal import mappings from the public TS SDK packages. - Marks public TS SDK packages as `type: module` where they were missing it. - Replaces the remaining runtime `require('pusher-js')` with dynamic ESM import. - Deletes the legacy CJS example. - Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop E2E: it verifies `require('@composio/core')` works through Node's native ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`, not a `.cjs` artifact. - Removes `.cjs` / `.cts` handling from example validation and CLI project-language detection. - Updates provider scaffolding so newly generated providers are ESM-only. - Adds a minor changeset warning that CommonJS callers can only rely on Node's native `require(esm)` interop and that custom CommonJS compatibility machinery is gone. ## Bundled behavior changes Two changes here are technically independent of the CommonJS removal but ride along because they touch the same files and ship in the same release cut. Calling them out explicitly so they are not missed in review: - **`PusherUtils` realtime channel auth (`@composio/core`).** Replacing the runtime `require('pusher-js')` with a dynamic ESM `import()` was done alongside conforming `channelAuthorization` to pusher-js's typed `customHandler(params, callback)` contract. The previous `(authOptions) => Promise` shape did not match pusher-js's actual calling convention — it read `endpoint`/`headers`/`params` off an argument that pusher-js never passes — so this also fixes that latent mismatch. New unit tests (`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name` body) and the success / invalid-JSON / network-failure callback paths. - **CLI meta-tool slug list (`@composio/cli`).** Drops `COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from `META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client` alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']` union. The list is declared `satisfies ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at compile time (`pnpm typecheck`) — keeping the stale slugs would be a type error — and needs no separate runtime test. ## Verification - Verified latest Node 22/24/25 releases from the official Node dist index: `22.22.3`, `24.16.0`, `25.9.0` (https://nodejs.org/dist/index.json). - Verified Node docs state Corepack is no longer distributed starting with Node.js v25: https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html - `mise exec -- pnpm --version` -> `10.28.2` - `mise exec -- pnpm install --frozen-lockfile` - `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts` - `mise exec -- pnpm --filter @e2e-tests/utils typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node` - `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck` - `mise exec -- pnpm --filter @composio/cli typecheck` - `mise exec -- pnpm --filter @composio/cli test -- --runInBand` - `mise exec -- pnpm --filter @composio/core typecheck` - `mise exec -- pnpm --filter @composio/core exec vitest run test/utils/pusher.test.ts` - `mise exec -- pnpm run build:packages` - `mise exec -- turbo run build --dry-run` resolves all workspace packages with no root `packageManager` field (pnpm discovered from `pnpm-lock.yaml`). - `mise exec -- pnpm --filter @composio/cli exec vitest run test/src/services/project-environment-detector.test.ts` - `mise exec -- pnpm exec prettier --check ...` - `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also `Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 / bun 1.3.10 from mise. - `docker manifest inspect node:24.16.0-slim` - `docker manifest inspect node:25.9.0-slim` - `bash -n ts/scripts/create-provider.sh && git diff --check` - `ruby -e "require 'yaml'; YAML.load_file('.github/workflows/ts.test-e2e.yml')"` - Tracked example validation in a clean temporary tree: `Validated 21 example packages.` |
||
|
Alberto Schiabel
|
a0bef5d986 |
chore(deps): bump composio client SDKs (TS alpha.74, Py 1.41.0) (#3609)
This PR: - bumps the TS catalog `@composio/client` from `0.1.0-alpha.72` to `0.1.0-alpha.74` (published from ComposioHQ/composio-base-ts#84) and refreshes `pnpm-lock.yaml` - bumps the Python `composio-client` pin from `1.39.0` to `1.41.0` (published from ComposioHQ/composio-base-py#69) - adds a patch changeset for `@composio/core` and `@composio/cli` so the client bump actually ships in the next release ## Context Neither client is auto-bumped in this repo — there is no Stainless→consumer bot, and Dependabot does not touch the pnpm `catalog:` pin (TS) or the exact `composio-client==` pin (Py), so these were a manual catch-up. The Python `1.41.0` PyPI publish initially failed with a `403 Forbidden` (stale `PYPI_TOKEN`); it was re-run successfully before this bump, so `1.41.0` is live on PyPI. |
||
|
Alberto Schiabel
|
6606c0da92 |
fix(ts): upgrade vitest for GHSA-5xrq-8626-4rwp (#3569)
This PR: - closes #3502 - extracts the useful dependency and Cloudflare config slice from https://github.com/ComposioHQ/composio/pull/3503 onto a clean `next` branch - upgrades `vitest` and `@vitest/ui` through the workspace catalog to resolve the critical advisory - switches the Mastra provider test dependency back to the catalog - migrates the Cloudflare Worker Vitest configs to the `cloudflareTest()` plugin API - preserves existing `COMPOSIO_BASE_URL` bindings that were dropped in #3503 - keeps Vitest 4 compatibility fixes scoped to constructor mocks, spy cleanup, and temp-root project detection - leaves Node, `mise`, release docs, and Effect catalog versions unchanged; the commit includes @Dotify71 as `Co-authored-by` Co-authored-by: Dushyant Acharya <dushyantacharya873@gmail.com> |
||
|
Alberto Schiabel
|
44e5458c35 |
feat(core): remove legacy TypeScript custom tools (#3509)
This PR is **part 2 of 3** splitting https://github.com/ComposioHQ/composio/pull/3505 to make the removal of the old 2025 custom tools easier to review. It carries the **TypeScript** slice. - builds on top of https://github.com/ComposioHQ/composio/pull/3508 (stacked — review/merge the Python slice first; this PR's base is `remove-py-custom-tools`) - removes the legacy `composio.tools.createCustomTool(...)` in-memory registry: the plural `CustomTools` model, registry wiring, legacy-only tests/examples/`ts/docs` pages, and stale error/type exports - preserves the 2026 tool-router APIs: `experimental_createTool`, `experimental_createToolkit`, `ToolRouter`, `ToolRouterSession`, and inline custom-tool execution - regenerates the TypeScript SDK reference so raw tool listing no longer describes the removed local registry and points to session-scoped custom tools - adds a `@composio/core` minor changeset ## Notes - The committed SDK reference is **verified self-consistent**: `pnpm --filter @composio/core generate:docs` reproduces it with zero diff. - This slice is a byte-identical subset of #3505 — the three split branches recombine to that PR's exact tree. See #3505 for the original verification logs (`typecheck`, `test`, `lint`, `cf-workers` e2e); CI re-runs per PR. |
||
|
Zen
|
57942e87fd |
fix(security): pin protobufjs to 7.5.5 (Socket.dev critical CVE) (#3467)
# Description Adds a `pnpm.overrides` entry pinning `protobufjs` to **7.5.5** to patch a critical RCE flagged by Socket.dev: | Socket alert | CVE | GHSA | Severity | Patched in | |---|---|---|---|---| | `SOCKET-COMPOSIO-1686` | `CVE-2026-41242` | [`GHSA-xq3m-2v4x-88gg`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg) | Critical | `protobufjs@7.5.5` | ### Why an override `protobufjs@7.5.4` is pulled in transitively by `@google/genai` (via `google-auth-library`) — there are no direct imports of `protobufjs` in `ts/packages/`. The cleanest, minimal-risk fix is a `pnpm.overrides` pin: 7.5.4 -> 7.5.5 is a patch-only release containing the RCE fix. This is the same override pattern hermes uses for its security-pinned deps. # How did I test this PR - `BYPASS_BUN_VERSION_CHECK=1 pnpm install --lockfile-only` regenerated `pnpm-lock.yaml`. Both `protobufjs@7.5.4` references now resolve to `7.5.5`. - `grep -rn "from ['\"]protobufjs" ts/packages/` confirms zero direct imports — pure lockfile change. - Relying on CI for lint / typecheck / unit-test coverage on the lockfile bump. --- Origin: cron-f7c85f82906b / [zen-cron-6352a6575b74](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74) Triggered by: saransh@composio.dev | Source: Socket.dev Vulnerability Auto-Fix Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74 |
||
|
venkat82
|
42ebff3f6b |
feat(connected-accounts): namespace SHARED-connection surface under experimental
Aligns the TypeScript SDK with the experimental wire shape used by
Shared Connections. The flat accountType / aclConfigForShared options
on connectedAccounts.link() and session.authorize() have moved under a
single experimental block, and connectedAccounts.updateAcl() has moved
off the class onto a top-level experimental_updateAcl(composio, id, opts)
export — same precedent as experimental_createTool /
experimental_createToolkit.
The experimental namespace is the signal that the shape may change in
future releases. Pinning a SHARED connection in a session config and
direct execute by connectedAccountId are unchanged — only the
connection-create / patch / authorize surfaces are namespaced.
Also surfaces the accountType filter on connectedAccounts.list() so
SHARED connections can be listed without dropping to the raw client.
The wire keeps this as a flat query param, so the SDK keeps it flat too.
@composio/client bumped from 0.1.0-alpha.71 -> 0.1.0-alpha.72 so the
generated typed client carries the Experimental namespaces for
link.create, toolRouter.session.link, and connectedAccounts.patch.
Caller migration:
// before
await composio.connectedAccounts.link('user_id', 'auth_config_id', {
accountType: 'SHARED',
aclConfigForShared: { allowAllUsers: true },
});
await composio.connectedAccounts.updateAcl('ca_abc', { allowAllUsers: true });
await session.authorize('github', {
accountType: 'SHARED',
aclConfigForShared: { allowAllUsers: true },
});
// after
await composio.connectedAccounts.link('user_id', 'auth_config_id', {
experimental: {
accountType: 'SHARED',
aclConfigForShared: { allowAllUsers: true },
},
});
await experimental_updateAcl(composio, 'ca_abc', { allowAllUsers: true });
await session.authorize('github', {
experimental: {
accountType: 'SHARED',
aclConfigForShared: { allowAllUsers: true },
},
});
// new — list SHARED connections
const shared = await composio.connectedAccounts.list({
accountType: 'SHARED',
userIds: ['user_creator'],
});
Tests cover: experimental block forwarding (link + authorize), no-op
when omitted, empty-array preservation, typed error mapping for the
PRIVATE-with-ACL case, experimental_updateAcl body construction +
deny-list handling + ValidationError when no fields are provided, and
list(accountType: 'SHARED') flat-filter delegation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
venkat82
|
483af36070 |
feat(connected-accounts): bump @composio/client to alpha.71, drop casts, add tests + error mapping
Now that #77 in composio-base-ts merged and @composio/client@0.1.0-alpha.71 is published with account_type + acl_config_for_shared in the typed surface, all the forward-compat shims come out. Removed: - AclConfigWireShape, LinkCreateBodyWithAcl, ConnectedAccountPatchBodyWithAcl local types - 3x `as unknown as Parameters<typeof X>[N]` casts in ConnectedAccounts.ts + ToolRouterSession.ts Now uses the generated types directly: - ConnectedAccountPatchParams, ConnectedAccountPatchResponse from @composio/client/resources/connected-accounts - LinkCreateParams + LinkCreateParams.ACLConfigForShared from @composio/client/resources/link - SessionLinkParams + SessionLinkParams.ACLConfigForShared from @composio/client/resources/tool-router/session/session Review fixes from #3392 multi-agent review: - P1-1: moved orphaned JSDoc back onto ComposioLegacyConnectedAccountsEndpoint- RetiredError (was stranded above ComposioSharedAccessDeniedError) - P1-2: added empty-array footgun warning to updateAcl() JSDoc — passing `notAllowedUserIds: []` silently clears the deny list - P1-3: changeset reconciled with PR body (Python ships as separate PR) - P2-9: updateAcl() returns ConnectedAccountPatchResponse instead of void, matching sibling update()/refresh() ergonomics - P2-11: clarifying JSDoc on update() pointing at updateAcl() and noting the pre-existing "alias/credentials" doc is inaccurate (this PR doesn't fix it) - P3-12: callbackUrl/alias guards normalized to `!== undefined` (was a mix of `&&` and `!= null`) — empty strings now propagate correctly - P3-17: refine-guard comment on UpdateConnectedAccountAclParamsSchema noting ZodEffects doesn't expose .shape P2-6/P2-7: typed error mapping for ComposioAclOnlyForSharedError (400) wired at three call sites: - ConnectedAccounts.link() — wraps existing ComposioFailedToCreateConnectedAccountLink catch - ConnectedAccounts.updateAcl() — new catch with rethrow fallback - ToolRouterSession.authorize() — new catch with rethrow fallback Substring match on `'acl_config_for_shared is only valid on SHARED'` — verified against apps/apollo/src/lib/connected_accounts/createConnectedAccount.ts in hermes#9902. ComposioSharedAccessDeniedError and ComposioSharedConnectionNotAccessibleError remain exported but not yet thrown — they'll be wrapped when Tools.execute() and ToolRouterSession.create() error-mapping lands in a follow-up. Tests: 12 new behaviour tests in test/connectedAccounts/connectedAccounts.test.ts covering link() ACL forwarding (5), updateAcl() body construction + empty-object refine + AclOnlyForShared mapping (6), and link() error-mapping fallback (1). 911 tests pass (up from 899). Verified: pnpm typecheck clean, pnpm build clean (publint + attw clean). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Rahul Tarak
|
a4c9e0ada2 |
refactor(cli): define local tools as custom toolkits (#3356)
## Summary - Stacks this local-tools PR on top of #3360, which contains the core duplicate custom-toolkit child slug fix. - Refactors `@composio/cli-local-tools` to define bundled local toolkits with core `experimental_createTool` / `experimental_createToolkit` handles instead of hand-rolled schema objects. - Keeps Tool Router v3.1 inline custom toolkit definitions attached to session create/search/execute calls so bundled local tools remain searchable/executable. - Adds CLI/local-tools test coverage for forwarding local custom toolkit payloads and for core custom toolkit handles from the local registry. ## Stack - Base PR: #3360 (`fix(core): qualify custom toolkit child slug lookups`) - This PR should now show only CLI/local-tools changes relative to #3360. ## Tests - `pnpm --filter @composio/core typecheck` - `pnpm --filter @composio/cli-local-tools typecheck` - `pnpm --filter @composio/cli typecheck` - `pnpm --filter @composio/cli-local-tools test` - `pnpm --filter @composio/cli-local-tools build` - `pnpm --filter @composio/cli exec vitest run test/src/commands/tools/tools.search.cmd.test.ts test/src/commands/tools/tools.execute.cmd.test.ts` - `pnpm --filter @composio/core exec vitest run test/models/customTool.test.ts test/models/toolRouter.test.ts test/models/customToolRouting.test.ts` |
||
|
Abir Taheer
|
7c14438385 |
chore: update pnpm-lock.yaml for @composio/client 0.1.0-alpha.70
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dhawal Upadhyay
|
fb8549fce7 |
Bump generated clients for v3.1 (#3348)
## Summary - bump generated TS client to @composio/client 0.1.0-alpha.69 and Python client to composio-client 1.36.0 - page through ToolRouter session tools in TS/Python using the generated v3.1 cursor response - accept generated connected account status REVOKED and fail connection waits immediately for terminal states ## Validation - pnpm --filter @composio/core typecheck - pnpm --filter @composio/core test -- test/tools/tools.test.ts test/models/toolRouter.test.ts test/connectedAccounts/connectedAccounts.test.ts test/connectedAccounts/connectionRequest.test.ts - uv run --frozen ruff check python/composio/core/models/tools.py python/tests/test_tool_execution.py - uv run --frozen pytest python/tests/test_tool_execution.py::TestToolExecution::test_get_raw_tool_router_meta_tools_fetches_all_pages python/tests/test_tool_router.py Note: pnpm install --frozen-lockfile hits the repo preinstall Bun guard locally because this machine has Bun 1.2.10 and the branch expects 1.3.10; dependency sync was completed with --ignore-scripts for local verification. |
||
|
Alberto Schiabel
|
f5c5b84bd3 |
fix(mastra): resolve $ref in tool schemas before applyCompatLayer [PLEN-2244] (#3315)
## Summary Composio tools whose JSON Schema uses internal `$ref` pointers (`#/$defs/...` or the legacy `#/definitions/...`) used to lose all type information when wrapped by `MastraProvider.wrapTool`. The schema would silently round-trip `raw → applyCompatLayer → convertSchemaToZod (drops $ref → permissive anyOf) → zodToJsonSchema (no recovery)`. Customers reported the user-visible surface as *"schema validation error: can't resolve reference"* — AJV (bundled inside `@mastra/schema-compat`) refusing to compile the schema downstream when validating tool input. This PR pre-processes the schema with a new `dereferenceJsonSchema` utility from `@composio/core` *before* it reaches `@mastra/schema-compat`, preserving the type information from `$defs`/`definitions` and avoiding the AJV failure entirely. Closes [PLEN-2244](https://linear.app/composio/issue/PLEN-2244/mastra-provider-schema-validation-error-cant-resolve-reference). ## What changed - **`@composio/core`** — new `dereferenceJsonSchema(schema)` helper (and `JsonSchemaRefResolutionError`): - walks the schema reflectively (no JSON-Schema-keyword allow-list, so future applicators are covered automatically), - inlines internal `$ref` pointers transitively, with a 100-hop depth cap, - shallow-merges sibling keywords next to `$ref` per Draft 2020-12 semantics (siblings win on collision — preserves caller's `description` / `default` / `title`), - breaks recursive cycles with `{ type: 'object', additionalProperties: true }` (matches upstream guidance in [mastra-ai/mastra#15341](https://github.com/mastra-ai/mastra/issues/15341)), - strips `$defs` / `definitions` from the returned root once everything reachable is inlined, - leaves external (`http://`/`https://`) `$ref` pointers untouched so callers can still forward them, - throws `JsonSchemaRefResolutionError` on malformed pointers, missing targets, and over-cap chains. - **`@composio/mastra`** — `wrapTool` now runs `dereferenceJsonSchema` over both `inputParameters` and `outputParameters` before calling `applyCompatLayer`. - **`@mastra/schema-compat`** floor bumped to `^1.2.9` so consumers automatically pick up upstream [PR #15400](https://github.com/mastra-ai/mastra/pull/15400)'s recursive-`$ref` handling and [PR #14530](https://github.com/mastra-ai/mastra/pull/14530)'s Draft-2020-12 AJV switch. - Changeset: `.changeset/fix-mastra-ref-dereference.md` (patch bump for `@composio/core` and `@composio/mastra`). ## Test plan Red → green TDD across two commits — the `test:` commit reproduces PLEN-2244 against the real `@mastra/schema-compat` (no `vi.mock`), the `fix:` commit makes the regression tests pass. - [x] `ts/packages/core/test/utils/jsonSchema.test.ts` — 14 unit tests for `dereferenceJsonSchema` covering: basic resolution, chained refs, container coverage (items / oneOf / anyOf / allOf / not / additionalProperties / patternProperties / prefixItems), legacy `definitions` (Draft 7), `$defs`/`definitions` mixed transitively, sibling-keyword merge per Draft 2020-12, cycle break, `$defs`/`definitions` strip, missing-target error, depth-cap error, external `$ref` preserved, no input mutation, JSON Pointer escape decoding (`~0`/`~1`), array-index pointers. - [x] `ts/packages/providers/mastra/test/mastra-ref.test.ts` — un-mocked integration tests against real `@mastra/schema-compat`: wrapping does not throw, type info from `$defs` survives the round-trip (the `id` field stays `type: 'string'` instead of degrading to permissive `anyOf`), same for Draft-7 `definitions` on output schema, no remaining `$ref` in the produced schemas. - [x] `pnpm --filter @composio/core test` — 852/852 green. - [x] `pnpm --filter @composio/mastra test` — 43/43 green (39 legacy + 4 new). - [x] `pnpm --filter @composio/core --filter @composio/mastra typecheck` — clean. - [x] Existing `mastra.test.ts` (which mocks `@mastra/schema-compat`) is **untouched** and still green. - [x] Secret-hygiene scan: `git diff next..HEAD | grep -E 'sk-[A-Za-z0-9_-]{20,}|OPENAI_API_KEY=[A-Za-z]'` returns empty. ## Why it's a Mastra-only fix The Mastra path is unique in routing JSON Schema through `@mastra/schema-compat`, which embeds AJV. Sibling providers (`openai`, `anthropic`, `vercel`, `langchain`, `google`, `llamaindex`) forward Composio's JSON Schema through `@composio/json-schema-to-zod`, which silently no-ops on unknown nodes. They are not affected today; expanding pre-processing across providers is a separate PR if it ever becomes needed. ## Caveats - The cycle-break sentinel weakens type information for genuinely recursive tool schemas. This is the same trade-off Mastra itself made in [#15341](https://github.com/mastra-ai/mastra/issues/15341); without it the agent crashes entirely. - External `$ref` (`http://`/`https://`) is intentionally left untouched. If a real customer schema ever needs them resolved, that's an incremental follow-up that calls into `@apidevtools/json-schema-ref-parser` only when needed. - The cycle-break currently uses a single sentinel for any cycle; if review prefers the higher-fidelity "keep first expansion, only break on the recursion edge" pattern (mentioned in the research as a refinement), that's a small follow-up. |
||
|
Rahul Tarak
|
b3e5df565e |
fix(cli): patch BetterSwiftAX constants for binary builds (#3347)
## Summary
- Broaden the Beeper iMessage macOS build patch so BetterSwiftAX
`kAX...` constants compile on GitHub `macos-15`/`macos-15-intel`.
- Pin the fixed `platform-imessage` submodule source and add Swift 6.2 /
Peekaboo dependency patching for the CLI binary workflow.
- Package and verify macOS local-tool sidecars plus `release-tag.txt` in
CLI release zips.
- Fix installed beta metadata/upgrade behavior so `--version`, update
checks, and beta-default experimental flags use the installed release
tag.
- Let `LOCAL_*` execution bypass remote auth/project/schema validation.
- Add runtime self-heal for missing installed `local-tools-binaries`: if
an old upgrader installs the fixed beta binary without sidecars, first
local-tool execution downloads the matching release zip, verifies
checksum when available, and restores the sidecars.
## Validation
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build:binary`
- Targeted CLI tests for execute/config/upgrade/version/update-check
paths.
- Packaged binary smoke test confirmed bundled Beeper sidecar works.
- Repair smoke test: copied only the new `composio` binary plus
`release-tag.txt` into a temp install with no `local-tools-binaries`;
`execute LOCAL_BEEPER_IMESSAGE_VERSION -d '{}'` restored sidecars from
`@composio/cli@0.2.29-beta.235` and succeeded.
## Release workflow
- Beta build run `25405049712` succeeded for commit
`9d0910c909b7b257d0f17b6d082980952d1e6c59` and published
`@composio/cli@0.2.29-beta.235`.
- This PR now includes one follow-up commit (`2c32cff4c`) to cover the
old-upgrader/missing-sidecars incremental upgrade path; normal branch CI
and beta build run `25406984535` are running again.
|
||
|
Dhawal Upadhyay
|
82e0038c7c | bump generated clients for v3.1 | ||
|
Rahul Tarak
|
79ac22053f |
feat(cli): add local tools foundation (#3340)
## Summary - Add experimental CLI local tools behind `local_tools` (beta-on, stable-off unless `composio config experimental local_tools on`). - Add reusable `@composio/cli-local-tools` package: declarations, metadata, readiness, command/MCP/native/FFI runtimes, bundled-binary resolution, and Tool Router search/execute/schema integration. - Add first-class local toolkits for: - `BEEPER_IMESSAGE` backed by `imessage-cli` from the ComposioHQ `platform-imessage` fork. - `CHROME_DEVTOOLS` backed by the official `chrome-devtools-mcp@0.24.0` npm/npx package. - `PEEKABOO` backed by upstream Peekaboo CLI. - Remove generated native executables from git: Beeper and Peekaboo binaries are now ignored, pinned via git submodules, and generated during CLI binary release jobs. - Update CLI binary workflow so Linux artifacts skip native sidecars, while macOS artifacts run on macOS runners and build only the matching `darwin-x64` or `darwin-arm64` Beeper/Peekaboo sidecars before packaging. ## Native binary policy - No generated `imessage-cli` or `peekaboo` binary blobs are committed in this PR history. - Beeper source is pinned as `ts/packages/cli-local-tools/vendor/platform-imessage` at `364445a1b3089ad9fe293d5951efe160c5677c42` from `https://github.com/ComposioHQ/platform-imessage`. - Peekaboo source is pinned as `ts/packages/cli-local-tools/vendor/peekaboo` at `31e66e8d02656141d18f60bf3b46b24c2b9bc785` from `https://github.com/steipete/Peekaboo`. - Build commands: - `pnpm --filter @composio/cli-local-tools build:local-tool-binaries -- --target darwin-arm64` - `pnpm --filter @composio/cli-local-tools build:local-tool-binaries -- --target darwin-x64` - Chrome DevTools is an npm/npx integration and is pinned as a dev dependency (`chrome-devtools-mcp@0.24.0`) instead of using native sidecars. ## Validation - `pnpm --filter @composio/cli-local-tools build:local-tool-binaries -- --target darwin-arm64` - `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target darwin-x64` - `pnpm --filter @composio/cli-local-tools build:beeper-imessage -- --target darwin-x64` - `pnpm --filter @composio/cli-local-tools typecheck:tsc` - `pnpm --filter @composio/cli-local-tools test` - `COMPOSIO_REAL_LOCAL_TOOLS_TESTS=1 pnpm --filter @composio/cli-local-tools test -- src/toolkits/beeper-imessage.test.ts src/toolkits/peekaboo.test.ts` - `pnpm --filter @composio/cli typecheck:tsc` - `pnpm --filter @composio/cli build` - `COMPOSIO_CACHE_DIR=<tmp-config-with-local_tools-enabled> bun ts/packages/cli/dist/bin.mjs local-tools doctor --json` - `pnpm turbo build` - Verified rewritten branch has no >1MB objects relative to `origin/next` and no native executable paths in the PR diff. ## Notes / risks - Beeper iMessage and Peekaboo are macOS-only and depend on local permissions. - Peekaboo requires macOS 15+; GUI tools require Screen Recording, Accessibility, and sometimes Automation. - Beeper send/reaction behavior can still depend on upstream Messages automation reliability. - Chrome DevTools can inspect/modify browser contents; avoid sensitive browser sessions. |
||
|
Dhawal Upadhyay
|
fed23cdc56 | fix(tool-router): use generated execute offload params | ||
|
jkomyno
|
cc673b654c |
fix(mastra): resolve $ref in tool schemas before applyCompatLayer [PLEN-2244]
Composio tools whose JSON Schema uses internal `$ref` pointers (`#/$defs/...`
or the legacy `#/definitions/...`) used to lose all type information when
wrapped by `MastraProvider.wrapTool`. The schema went through:
raw JSON Schema (with $ref) → applyCompatLayer
→ convertSchemaToZod (silently drops $ref, becomes a permissive anyOf)
→ zodToJsonSchema (no way to recover the lost types)
Customers reported this surface as "schema validation error: can't resolve
reference" — AJV (bundled inside @mastra/schema-compat) refusing to compile
the schema downstream when validating tool input.
Fix: pre-process the schema with a new `dereferenceJsonSchema` helper before
handing it to `applyCompatLayer`. The helper:
- walks the schema reflectively (no JSON-Schema-keyword allow-list, so future
applicators are covered automatically),
- inlines internal `$ref` pointers transitively, with a 100-hop depth cap,
- shallow-merges sibling keywords next to `$ref` per Draft 2020-12 semantics
(siblings win on collision — preserves caller's `description`/`default`),
- breaks cycles with `{ type: 'object', additionalProperties: true }`,
matching upstream guidance in mastra-ai/mastra#15341,
- strips `$defs`/`definitions` from the returned root once everything
reachable is inlined,
- leaves external (`http://`/`https://`) `$ref` pointers untouched,
- throws `JsonSchemaRefResolutionError` on malformed pointers, missing
targets, or chains over the cap.
Bumps the `@mastra/schema-compat` dependency floor to `^1.2.9` so users also
pick up upstream PR #15400's recursive-`$ref` handling.
The new red regression tests (committed in
|
||
|
Zen Agent
|
1c3276ba8d |
feat(sdk): add workbench sandbox compute tier (sandboxSize / sandbox_size)
Expose `workbench.sandboxSize` (TypeScript) / `workbench.sandbox_size` (Python) on `ToolRouter.create()` so callers can pick the workbench sandbox compute tier (`standard`, `medium`, `large`, `xlarge`). Optional; the server defaults to `standard` (1 vCPU / 1 GB) when omitted, so existing callers keep current behavior. - Bump stainless clients to pick up the field on the wire: - `@composio/client` 0.1.0-alpha.66 -> 0.1.0-alpha.67 - `composio-client` 1.33.0 -> 1.34.0 - TS: extend `ToolRouterCreateSessionConfigSchema.workbench` with `sandboxSize` and forward it as snake_case `sandbox_size`. Export `SandboxSize` type and `SandboxSizeSchema` zod enum. - Python: extend `ToolRouterWorkbenchConfig` TypedDict with `sandbox_size` and forward it on the create payload. Export `SandboxSize` literal alias. - Changeset: `@composio/core` patch. - Tests: cover the snake_case forwarding and zod enum rejection. Docs (Configuring Sessions / Workbench / changelog) are split into a separate PR so they can land alongside the SDK release. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
a10288aa87 | fix(core): restore session.toolkits() pagination (#3193) | ||
|
Rahul Tarak
|
08eccb85de |
feat(cli): migrate API key storage from plaintext to OS keyring (#3202)
## Summary
- Wire `@composio/cli-keyring` into `ComposioUserContext` so the API key
lives in the macOS Keychain / Linux Secret Service instead of plaintext
`~/.composio/user_data.json`
- **Read precedence**: env var (`COMPOSIO_USER_API_KEY`) > OS keyring >
legacy plaintext
- **One-shot migration**: on first run after upgrade, if the keyring is
empty but `user_data.json` has an `api_key`, copy it to the keyring and
strip it from JSON
- **In-process memoization**: keyring read happens once at layer build
(~1.4ms), held in closure for the rest of the process
- **`dangerouslySaveApiKeyInUserConfig`**: opt-in escape hatch in
`~/.composio/config.json` for headless Linux / containers / CI where the
keyring is unavailable
- **`ctx.data` is now a getter**: fixes a pre-existing bug where
mutations via `login()`/`update()` were invisible through the stale
snapshot
- **In-memory mock keyring** for test isolation — tests never touch the
real keychain
## Files changed
| file | what |
|---|---|
| `ts/packages/cli/package.json` | Add `@composio/cli-keyring` workspace
dep |
| `ts/packages/cli/src/models/cli-user-config.ts` |
`dangerously_save_api_key_in_user_config` schema field |
| `ts/packages/cli/src/services/cli-user-config.ts` | Surface new field
on `CliUserConfigResolved` |
| `ts/packages/cli/src/services/user-context.ts` | Keyring-first
read/write/migrate/fallback chain |
| `ts/packages/cli/src/cli-main.ts` | Wire `KeyringLive` into layer
composition |
| `ts/packages/cli-keyring/src/stores/macos-security-ffi.ts` | Fix:
writes via subprocess `-A`, cleanup dead ACL builder code, add base64
encoding |
| `ts/packages/cli/test/__utils__/services/test-layer.ts` | In-memory
mock keyring for test isolation |
| `ts/packages/cli/test/src/commands/login.cmd.test.ts` | Update
assertion: api_key no longer in JSON after login |
## Verified end-to-end
```
$ ./dist/composio version
INFO: Composio API key migrated from user_data.json to the OS keyring
0.2.22
$ cat ~/.composio/user_data.json # no api_key
{"base_url":"...","web_url":"...","org_id":"...","test_user_id":"..."}
$ # Rebuild binary (new hash) → read from keychain → no dialog
$ ./dist/composio whoami
{"email":"rahul@composio.dev",...}
```
## Test plan
- [x] 676 CLI tests passing (676 passed, 1 skipped)
- [x] Login test updated: asserts `api_key` absent from JSON + present
via `ctx.data.apiKey`
- [x] In-memory mock keyring — no real keychain access in tests
- [x] Binary build + FFI roundtrip verified
- [x] Rebuild with new hash → no keychain dialog (allow-any ACL via
`-A`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
**Stack: 2/2** — base PR: `cli/keyring-package` (#3201)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
||
|
Rahul Tarak
|
9d7cf5aca2 |
feat(cli-keyring): add @composio/cli-keyring package (#3201)
## Summary - Cross-platform OS credential storage package for the Composio CLI, structurally modeled on [keyring-rs](https://github.com/open-source-cooperative/keyring-rs) - **macOS FFI backend**: direct `SecItemCopyMatching` via `bun:ffi` — **~1.4ms median reads** (vs 22ms subprocess). Writes delegate to `/usr/bin/security -A` for reliable allow-any ACL - **macOS subprocess fallback**: `/usr/bin/security` for Node/test environments - **Linux backend**: `secret-tool` subprocess with keyring-rs-compatible attribute keys (`{service, username, target}`) - All pointers as `bigint` (`FFIType.u64`) to handle CoreFoundation tagged pointers above `2^53` - `b64:` prefix encoding for cross-backend binary safety - 11-variant `KeyringError` discriminated union matching `keyring-core`'s error model - Effect.ts integration via `@composio/cli-keyring/effect` subpath export (optional peer dep) - `dangerouslySaveApiKeyInUserConfig` escape hatch designed for the CLI migration PR (next in stack) ## Benchmark (100 iterations, Apple Silicon) | operation | subprocess | FFI | speedup | |---|---|---|---| | `getPassword` p50 | 19.95ms | **1.14ms** | **18×** | | `getPassword` p99 | 88.72ms | **7.39ms** | **12×** | ## Test plan - [x] 16 unit tests (errors, entry, shared encoding) — Node vitest - [x] 4 E2E tests against real macOS keychain — gated on `COMPOSIO_KEYRING_E2E=1` - [x] 6 FFI-specific tests — gated on `typeof Bun !== 'undefined'` + E2E flag - [x] `publint` + `attw` clean - [x] `bun build --compile` produces working standalone binary with FFI reads 🤖 Generated with [Claude Code](https://claude.com/claude-code) **Stack: 1/2** — next PR: `cli/keyring-migration` (wires this into the CLI) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
abir
|
7166c8e42d |
fix: regenerate lockfile with pnpm 10.28.0 and fix ruff formatting
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Zen Agent <zen@composio.dev> |
||
|
abir
|
28b8914d58 |
feat: bump client SDKs and simplify types using Stainless SDK
- Bump @composio/client to 0.1.0-alpha.66 (TS) and composio-client to 1.33.0 (Python) - Use SDK types directly: ConnectedAccountPatchResponse, SessionCreateParams.MultiAccount - Move alias into connection param for initiate() (now in SDK's ConnectedAccountCreateParams.Connection) - Simplify link(), authorize() methods — remove inline type casts, use SDK params directly - Remove custom UpdateConnectedAccountResponse Zod schema (replaced by SDK type) - Update tests for new alias location in create params Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Zen Agent <zen@composio.dev> |
||
|
abir
|
55355f6b10 |
chore: bump @composio/client to 0.1.0-alpha.64
New client includes multi_account in SessionCreateParams. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
abir
|
173f1e78f3 |
fix: regenerate pnpm-lock.yaml with pnpm 10.28.0 for CI compatibility
Previous lockfile was corrupted by local pnpm 9.5.0 — missing overrides section and wrong pnpmfileChecksum. Regenerated with pnpm 10.28.0 (matching CI's packageManager version). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
