skills/composiohq__composio
1
0
Fork 0
mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
4,620 Commits 338 Branches 1,550 Tags
@composio/cli@0.3.2-beta.335
Commit Graph

297 Commits

Author SHA1 Message Date
dependabot[bot] 02c7af88ae chore(deps): bump hono from 4.12.31 to 4.12.34 in the npm-security group across 1 directory (#4051) 
Bumps the npm-security group with 1 update in the / directory:
[hono](https://github.com/honojs/hono).

Updates `hono` from 4.12.31 to 4.12.34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/honojs/hono/releases">hono's
releases</a>.</em></p>
<blockquote>
<h2>v4.12.34</h2>
<h2>Security fixes</h2>
<p>This release includes fixes for the following security issues:</p>
<h3><code>memo()</code> retains SSR output across requests, leading to
cross-user data disclosure</h3>
<p>Affects: <code>hono/jsx</code> (server-side rendering). Fixes
<code>memo()</code> reusing a retained render result across requests
when props compare equal, where a component reading request-scoped
values from ambient context — <code>useContext()</code>,
<code>useRequestContext()</code>, or <code>getContext()</code> — could
serve HTML rendered for another user's request, disclosing account data
or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r</p>
<h3>ReDoS in CORS middleware via
<code>Access-Control-Request-Headers</code></h3>
<p>Affects: <code>hono/cors</code>. Fixes a whitespace-tolerant regular
expression with quadratic backtracking used to parse the
<code>Access-Control-Request-Headers</code> preflight header when
<code>allowHeaders</code> is not configured (the default), where a
single preflight request carrying a long whitespace run could consume
seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239</p>
<h3>Algorithmic complexity DoS in Language Middleware</h3>
<p>Affects: <code>hono/language</code>. Fixes quadratic string
processing in language-tag normalization, where a crafted language tag
with a large number of hyphen-separated subtags — supplied via a query
parameter, cookie, or <code>Accept-Language</code> header — could cause
excessive CPU consumption and block the event loop.
GHSA-54fx-42gc-7vw4</p>
<h3>Proxy Helper does not remove response headers listed in the
<code>Connection</code> header</h3>
<p>Affects: <code>hono/proxy</code>. Fixes <code>proxy()</code>
forwarding response headers that the origin's <code>Connection</code>
header designates as connection-scoped, where headers intended only for
the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to
clients, disclosing connection-scoped or internal metadata.
GHSA-79qm-7rj5-m7r9</p>
<hr />
<p>Users who use <code>hono/jsx</code> for server-side rendering,
<code>hono/cors</code>, <code>hono/language</code>, or
<code>hono/proxy</code> are strongly encouraged to upgrade to this
version.</p>
<h2>v4.12.33</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(cookie): relax name validation when parsing Cookie header in <a
href="https://redirect.github.com/honojs/hono/pull/5164">honojs/hono#5164</a></li>
<li>chore: bump <code>@hono/node-server</code> in <a
href="https://redirect.github.com/honojs/hono/pull/5167">honojs/hono#5167</a></li>
<li>fix(jsx): handle useSyncExternalStore subscription and snapshot
changes in <a
href="https://redirect.github.com/honojs/hono/pull/5166">honojs/hono#5166</a></li>
<li>chore: remove undici in favor of global fetch in <a
href="https://redirect.github.com/honojs/hono/pull/5168">honojs/hono#5168</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.32...v4.12.33">https://github.com/honojs/hono/compare/v4.12.32...v4.12.33</a></p>
<h2>v4.12.32</h2>
<h2>What's Changed</h2>
<ul>
<li>ci: enable reports for type &amp; bundle size check in <a
href="https://redirect.github.com/honojs/hono/pull/5148">honojs/hono#5148</a></li>
<li>fix(aws-lambda): add jwt and lambda authorizer types for API Gateway
v2 in <a
href="https://redirect.github.com/honojs/hono/pull/5142">honojs/hono#5142</a></li>
<li>fix(sse): emit empty id field to reset Last-Event-ID in <a
href="https://redirect.github.com/honojs/hono/pull/5138">honojs/hono#5138</a></li>
<li>test(cloudflare-workers): add coverage for onClose, onError, send,
and close in Cloudflare Workers websocket adapter in <a
href="https://redirect.github.com/honojs/hono/pull/5145">honojs/hono#5145</a></li>
<li>fix: use <code>Object.create(null)</code> when parsing query,
headers, and params in <a
href="https://redirect.github.com/honojs/hono/pull/5161">honojs/hono#5161</a></li>
<li>fix(secure-headers): keep CSP callbacks scoped to their header in <a
href="https://redirect.github.com/honojs/hono/pull/5147">honojs/hono#5147</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.32">https://github.com/honojs/hono/compare/v4.12.31...v4.12.32</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/honojs/hono/commit/734755ace341607628219ea1dd8ca17f01bf1a5c"><code>734755a</code></a>
4.12.34</li>
<li><a
href="https://github.com/honojs/hono/commit/9839ff32a349bf088b6ddfa604010879dd2d3a05"><code>9839ff3</code></a>
chore: update <code>bun.lock</code> (<a
href="https://redirect.github.com/honojs/hono/issues/5182">#5182</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f"><code>0c45036</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f"><code>720b566</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7"><code>f70e2c3</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5"><code>93fc250</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/honojs/hono/commit/51db3131d5e97076327edaa0afdb60ebb77c264f"><code>51db313</code></a>
4.12.33</li>
<li><a
href="https://github.com/honojs/hono/commit/aed146364d5c48a8336b8c82fedfabebf8063d07"><code>aed1463</code></a>
chore: remove undici in favor of global fetch (<a
href="https://redirect.github.com/honojs/hono/issues/5168">#5168</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/224d2f5cbf2b4bc2ebb7482d0592149a8d9f0574"><code>224d2f5</code></a>
fix(jsx): handle useSyncExternalStore subscription and snapshot changes
(<a
href="https://redirect.github.com/honojs/hono/issues/5166">#5166</a>)</li>
<li><a
href="https://github.com/honojs/hono/commit/df653cea0450657977887d56a5188368387456c8"><code>df653ce</code></a>
chore: bump <code>@hono/node-server</code> (<a
href="https://redirect.github.com/honojs/hono/issues/5167">#5167</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.34">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=hono&package-manager=npm_and_yarn&previous-version=4.12.31&new-version=4.12.34)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/ComposioHQ/composio/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-04 19:20:31 +05:30
Alberto Schiabel f7a4503bbe fix(deps): clear high-severity TypeScript audit findings (#4050) 
This PR:
- follows up on the failed TypeScript audit in
https://github.com/ComposioHQ/composio/pull/4048
- adds patched transitive floors for `fast-uri`, `ip-address`, and
`brace-expansion`
- refreshes `pnpm-lock.yaml` to resolve 3.1.5, 10.4.0, and 5.0.9
respectively
- clears all high-severity findings from `pnpm audit --prod
--audit-level=high`; one low and one moderate advisory remain below the
gate
- verifies the affected CLI dependency graph with a frozen install,
package build, and 1,072 passing tests (1 skipped)
 2026-08-04 17:23:05 +05:30
Alberto Schiabel 51056129ee fix(core): detect filesystem case sensitivity for uploads (#4036) 
This PR:
- fixes #4024
- supersedes #4025 with target-filesystem detection instead of
unconditional case folding
- uses `is-fs-case-sensitive` on the nearest existing directory so mixed
mounts and case-sensitive filesystem configurations are handled
correctly
- preserves exact matching on case-sensitive filesystems and falls back
to conservative case-insensitive matching when detection fails
- keeps Node-only detection behind `#platform` and mirrors its runtime
dependency in `@composio/slim`, preserving the workerd-safe bundle and
Slim import
- adds focused Node, workerd, and matcher regressions plus an
`@composio/core` patch changeset
- verifies 1,044 core tests, five CLI upload tests, the Slim
build/import smoke, typecheck, build, ATTW, publint, lint, formatting,
frozen install, and changeset validation
 2026-08-03 16:32:40 +05:30
Kshitij Jhunjhunwala fc9745040a feat(cli): make headless composio login agent-friendly (PRDE-1138) (#3945) 
## What

Closes the PRDE-1138 gap: an unattended agent hitting plain `composio
login` in a pipe dead-ended at browser OAuth. Now the default headless
path either completes unattended or tells the agent exactly what to run
— without ever auto-creating an account for a human.

- **Offer**: non-interactive login instructions gain a second hint —
"For unattended agents: run `composio login --agent`" — alongside the
existing URL + `composio login --poll` flow.
- **Perform (reuse only)**: when `~/.composio/agent.json` already holds
a READY agent identity, plain headless `composio login` completes
unattended by reusing it. New `getStoredReadyAgent` in
`services/agents.ts` is the reuse-only counterpart of
`getOrSignupReadyAgent` — it never falls back to signup.
- **Guardrail** (the design constraint from the ticket): account
creation stays exclusively behind the explicit `composio login --agent`
/ `composio signup` commands. A human piping `composio login` with no
stored agent identity gets the same URL instructions as before and no
account. Asserted at both unit and E2E level (`/api/signup` is never
called on the default path).
- `install.sh --agent` login now sets
`COMPOSIO_CLI_INVOCATION_ORIGIN=installer` for analytics attribution.
- Root `.dockerignore`: host `node_modules` (pnpm store symlinks that
break outside the host) no longer enter the e2e image build context;
without this, e2e images cannot build from a checkout that has run `pnpm
install`.

## Verification

- `pnpm typecheck` green; `@composio/cli` suite green — 1001 passed, 1
skipped; `validate:boundaries` clean.
- New Docker E2E suite `ts/e2e-tests/cli/agent-signin` (10/10) against a
mock `agents.composio.dev` (`COMPOSIO_AGENTS_BASE_URL`): unattended
nothing→authenticated (`login --agent` then `whoami` in one container),
headless-human guardrail (instructions printed, zero signup calls),
stored-identity reuse (login completes + whoami reports `account_type:
agent`). No real accounts are created.

## Notes

- No VHS recordings: the visible change is piped-mode text output, which
VHS interactive recordings don't demonstrate.
- No changeset by design (`@composio/cli` is Changesets-ignored);
human-facing note added to `ts/packages/cli/CHANGELOG.md` under 0.3.0.
 2026-07-28 13:48:28 -07:00
Alberto Schiabel 2b9571b17f fix(core): resolve typedoc against the TS6 compiler API (#3972) 
This PR:
- restores TypeDoc generation after
https://github.com/ComposioHQ/composio/pull/3966 by resolving
`@composio/core`'s TypeScript dev dependency from `catalog:ts6`
- keeps core typechecking on the root TypeScript 7 compiler while
TypeDoc receives the TS6 compiler API
- documents the additional compiler-API consumer in the shared
TypeScript catalog
- commits the regenerated `session-files.mdx` output that could not be
produced while the workflow was broken
- verifies `generate:docs`, `typecheck`, and `build` for
`@composio/core`
 2026-07-28 21:03:06 +05:30
Kshitij Jhunjhunwala fc1460995b feat(cli): make headless composio login agent-friendly (PRDE-1138) 
Teach non-interactive login to reuse an existing READY agent identity without creating one implicitly. Preserve explicit --no-browser and --no-wait contracts, and branch on TerminalUI.canPrompt so piping stdout alone remains interactive.

Add unattended guidance, installer analytics attribution, and focused unit and Docker E2E coverage. Exclude host node_modules from Docker build contexts.
 2026-07-28 20:13:57 +05:30
Alberto Schiabel f233e46937 chore(repo): migrate eslint to oxlint and typecheck to TypeScript 7 (#3966) 
This PR:

- replaces ESLint with oxlint across the pnpm workspace and the
Bun-based docs site, porting the rules to `.oxlintrc.json` /
`docs/.oxlintrc.json` with behavior parity (restricted-syntax selectors
kept via `oxlint-plugin-eslint`)
- migrates typecheck to TypeScript 7 (`typescript@^7.0.2` catalog) and
keeps a TS6 pin for JS compiler API consumers via a named `ts6` pnpm
catalog (`ts/scripts/validate-examples.ts`, the `@composio/cli` generate
pipeline). The CLI's `typescript` dependency rebinds only the
compiler-API import — its typecheck still runs the root TS7 `tsc`, since
the alias package only ships a `tsc6` bin (documented in
`ts/packages/cli/AGENTS.md`)
- removes the `paths` mappings that pointed `@composio/core` (and, in
`experimental`, `@composio/json-schema-to-zod` plus core-internal
`#`-imports) at sibling `src` directories: under TS7, tsdown's
tsgo-based dts step emitted stray `.d.ts` files next to those
out-of-root sources on every dependent package build. Workspace deps now
resolve through their built dist types, which turbo's `dependsOn:
^build` already guarantees exist — and which the deep-path exports
(`@composio/core/*`) always used anyway
- renames the cli boundary tooling `eslint-boundaries*` →
`lint-boundaries*` and hardens the scanner to reject `oxlint-disable`
spellings so the disable manifest cannot be bypassed
- rewrites inline `eslint-disable` comments to oxlint rule names
(comment-only; no runtime changes), and adds **one new** declared
boundary: `tool-file-uploads.ts` needs `no-restricted-imports` disabled
for `node:crypto` (MD5 for the presigned-upload checksum is not in Web
Crypto), because oxlint also catches dynamic `await import()` where
ESLint did not. The manifest grows 46 → 47 deliberately
- updates CI path filters, `turbo.jsonc` lint inputs, and the docs
typescript-check workflow (renamed to "Docs - Lint and TypeScript
Validation" since it now lints too); drops `eslint`,
`typescript-eslint`, `eslint-config-next`, and `globals` from the
dependency graphs
- ships no changeset: I built `@composio/core` and `@composio/anthropic`
on this branch and on the pre-migration base and diffed the emitted
`dist/**/*.d.mts`. The provider output is byte-identical. Core's output
is **semantically identical but not byte-identical**: TS7 changes quote
style (`"x"` → `'x'`), object-property and union-member ordering in
inferred types, and picks equivalent shorter re-export alias paths for
five signatures (e.g. `OpenAI.Beta.Threads.Runs.Run` →
`OpenAI.Beta.Threads.Run` — verified both names alias the same type in
the shipped typings). Chunk-name hashes shift as a consequence. No type
gains, losses, or shape changes; `attw` and `publint` pass on the TS7
build

## Context

First of a three-PR split of #3958. The type-safety refactors are
stacked on this branch and merge after it:

- docs: https://github.com/ComposioHQ/composio/pull/3967
- `@composio/core`: https://github.com/ComposioHQ/composio/pull/3968
 2026-07-28 19:16:57 +05:30
Alberto Schiabel 503b50ab02 chore(deps): refresh SDK, Python, and CI dependencies (#3955) 
This PR:

- splits https://github.com/ComposioHQ/composio/pull/3953 in two: this
PR carries every dependency and GitHub Actions bump **except** the docs
site, which follows in a stacked PR
- consolidates and supersedes Dependabot PRs #3915, #3916, and #3934
through #3942
- adopts TypeScript 7.0.2 for primary compilation while retaining the
`@typescript/typescript6` API lane that TypeScript-ESLint still
requires, following the upstream side-by-side guidance
- refreshes Python core and provider dependencies, lockfiles, and the
Ruff 0.16 lint configuration
- updates every GitHub Action with a verified newer official release,
including majors, while retaining immutable commit SHA pins and
migrating setup-uv cache pruning
- deletes four per-package `eslint.config.mjs` shims: under ESLint 10
the default per-file config lookup re-anchors the root config's globs
into each package, so `pnpm lint` stayed green while the CLI's
try/catch, `process.env` and node-builtin bans went unenforced
- bounds and documents the new `brace-expansion` and `@hono/node-server`
security overrides, raising the `@hono/node-server` floor to 2.0.10 to
clear GHSA-9mqv-5hh9-4cgg
- preserves intentional compatibility fixtures and lanes for AI SDK 6,
Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints

## Context

The docs site is a separate Bun workspace with its own `bun.lock` and is
not a pnpm workspace member, so the two halves share no lockfile and no
build. Splitting them keeps the Fumadocs 11 migration (a breaking API
change with real refactoring) reviewable on its own, independently of
the mechanical version bumps here.

The `brace-expansion` override deliberately spans majors:
GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with
no 1.x or 2.x backport, so narrowing it to the 5.x line puts
`brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and
`pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the
trade-off it buys is recorded inline in `pnpm-workspace.yaml`.

Verified on this branch standalone: `pnpm install --frozen-lockfile`,
`pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963
tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`.
 2026-07-27 17:57:29 +05:30
Alberto Schiabel 332cb71214 fix(ci): clear dependency audit and cli test failures on next (#3898) 
This PR:

- bumps the transitive `brace-expansion` resolution to 2.1.2
([GHSA-3jxr-9vmj-r5cp](https://github.com/advisories/GHSA-3jxr-9vmj-r5cp),
high)
- adds a scoped `js-yaml` override to `>=4.3.0 <5`
([GHSA-52cp-r559-cp3m](https://github.com/advisories/GHSA-52cp-r559-cp3m),
high) — `@redocly/openapi-core@1.34.x` (via `openapi-typescript`)
exact-pins vulnerable 4.2.0, so a lockfile bump alone cannot reach the
patched version
- bumps the existing `protobufjs` override 7.6.3 → 7.6.5
([GHSA-j3f2-48v5-ccww](https://github.com/advisories/GHSA-j3f2-48v5-ccww),
moderate)
- leaves the low `@ai-sdk/provider-utils` advisory as-is: the advertised
patched version 3.0.98 is not published on npm and `@mastra/core`
exact-pins 3.0.25
- aligns `analytics.dispatch.test.ts` mocks with the `spawnDetached`
contract from https://github.com/ComposioHQ/composio/pull/3880
(`once('spawn')`/`once('error')` with unref-after-confirmation); the
test added in https://github.com/ComposioHQ/composio/pull/3881 still
asserted the old fire-and-forget `.on('error')` shape

Verified locally: `pnpm audit --prod --audit-level=high` exits 0 (1 low
remaining), `pnpm install --frozen-lockfile` passes, and the full
`@composio/cli` suite passes (934 tests).

<!-- codesmith:footer -->
---
<a
href="https://app.blacksmith.sh/ComposioHQ/codesmith/composio/pr/3898"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img
alt="View with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a>
<a
href="https://backend.blacksmith.sh/track/enable-autofix?expires=1787212096&installation_model_id=428187&pr_number=3898&repository=ComposioHQ%2Fcomposio&return_to=https%3A%2F%2Fgithub.com%2FComposioHQ%2Fcomposio%2Fpull%2F3898&signature=9d7662095d47fa89940855b0abb67f014a807b522b81ea780b62f6326dc0e807"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img
alt="Autofix with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a>
<sup>Need help on this PR? Tag <code>/codesmith</code> with what you
need. Autofix is disabled.</sup>

<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->
 2026-07-21 12:09:07 +04:00
Alberto Schiabel 6d5465acd3 refactor(cli): seal the CommandDescriptor seam and drop zod for Schema (#3882) 
This PR:
- activates the descriptor-seam rule group:
`commands/command-introspection.ts` becomes the only module allowed to
import `CommandDescriptor`/`Usage` from `@effect/cli` — the redesign
seam the Effect CLI v4 migration will reimplement
- routes root command assembly, preflight parsing, help routing, and
value-option collection through the seam helpers instead of descriptor
walks
- replaces the Zod-backed tool-input adapter with an internal
`@composio/json-schema-to-effect-schema` compiler backed by the
eval-free `@cfworker/json-schema` interpreter
- normalizes the OpenAPI and Composio extensions accepted by the
previous validator, while preserving typed `ToolInputValidationError`
failures, field paths, multi-error reporting, and typo suggestions
- extends the descriptor and Zod boundaries to reject static imports,
dynamic `import()`, and `require()` bypasses
- adds compiler parity tests plus CLI regression coverage for multiple
simultaneous field and unknown-key failures
- introspection tests pin that the helpers yield identical descriptors
and usage strings

---

**Stack** (re-slice of https://github.com/ComposioHQ/composio/pull/3859;
each PR targets its parent and auto-retargets to `next` as parents
merge):

1. https://github.com/ComposioHQ/composio/pull/3877 — guidelines + inert
rule groups
2. https://github.com/ComposioHQ/composio/pull/3878 — `new Function()`
eval security fix
3. https://github.com/ComposioHQ/composio/pull/3879 — behavioral fix
pack
4. https://github.com/ComposioHQ/composio/pull/3880 — platform-imports
rule + migration
5. https://github.com/ComposioHQ/composio/pull/3881 — terminal-streams
rule + TerminalUI boundary
6. https://github.com/ComposioHQ/composio/pull/3882 — descriptor seam +
Zod→Schema ← **this PR**
7. https://github.com/ComposioHQ/composio/pull/3883 — test-tree lint +
deterministic suites
8. https://github.com/ComposioHQ/composio/pull/3884 — typed error
boundaries + v4 seams
9. https://github.com/ComposioHQ/composio/pull/3885 — try/catch+env ban
+ boundary ratchet

On stacked bases CI runs lint/build and the CLI Docker e2e job; unit
tests and typecheck are verified locally per PR and re-verified by full
CI when each PR is retargeted to `next`.
 2026-07-21 11:25:58 +04:00
Alberto Schiabel 2dc9ef34d0 fix(cli): remove new Function() eval from JSON-ish input parsing (#3878) 
This PR:
- removes an in-process arbitrary-code-execution surface:
`parse-json-ish.ts` fell back to `Function("return (…)")()` for any
`tools execute --data`, `listen --params`, or `proxy` body value that
failed JSON and comment-JSON parsing — the CLI is agent-facing and
`--data` also accepts `@file` and stdin, so crafted or prompt-injected
input reached the eval
- lands the parser in its final consolidated shape:
`src/utils/parse-json.ts` parses JSON5 (unquoted keys, single quotes,
trailing commas, comments) without evaluating anything and returns
`Either` with a typed `JsonParsingError`
- consolidates the `effect-errors` read-json duplicates onto the same
parser and swaps `comment-json` for `json5` (the stack's only lockfile
change)
- pins code-execution probes in unit tests (`new Date()`, computed
expressions, `globalThis` writes are rejected, never evaluated)
- intentional narrowing: JS expressions such as `1+1` that only worked
because of the eval now fail with a parse error; proxy bodies that are
not JSON5 records fall back to the raw string
---

**Stack** (re-slice of https://github.com/ComposioHQ/composio/pull/3859;
each PR targets its parent and auto-retargets to `next` as parents
merge):

1. https://github.com/ComposioHQ/composio/pull/3877 — guidelines + inert
rule groups
2. https://github.com/ComposioHQ/composio/pull/3878 — `new Function()`
eval security fix ← **this PR**
3. https://github.com/ComposioHQ/composio/pull/3879 — behavioral fix
pack
4. https://github.com/ComposioHQ/composio/pull/3880 — platform-imports
rule + migration
5. https://github.com/ComposioHQ/composio/pull/3881 — terminal-streams
rule + TerminalUI boundary
6. https://github.com/ComposioHQ/composio/pull/3882 — descriptor seam +
zod→Schema
7. https://github.com/ComposioHQ/composio/pull/3883 — test-tree lint +
deterministic suites
8. https://github.com/ComposioHQ/composio/pull/3884 — typed error
boundaries + v4 seams
9. https://github.com/ComposioHQ/composio/pull/3885 — try/catch+env ban
+ boundary ratchet

On stacked bases CI runs lint/build and the CLI Docker e2e job; unit
tests and typecheck are verified locally per PR and re-verified by full
CI when each PR is retargeted to `next`.
 2026-07-21 11:14:55 +04:00
Alberto Schiabel 9498679c26 fix(release): guard and document CLI releases (#3895) 
This PR:
- removes the stale `@composio/cli` changeset that wedges
`changesets/action` and preserves its release note in the CLI changelog
- adds `validate:changesets` before the TypeScript release action and
covers ignored-package changesets in the release regression suite
- makes the guard read changeset files directly so it also works in
shallow and detached CI checkouts
- refreshes `mise.lock` after the pinned Python standalone artifacts
moved to the 20260718 build
- adds the repo-local `cli-release` skill with beta, stable-promotion,
verification, and failure-recovery procedures
- replaces the contradictory "stable via changeset" contributor guidance
with the tested-beta promotion path
- extends skill taxonomy, routing probes, and PR path filters so the
guard cannot silently drift

## Regression coverage

The validator test creates a changeset fixture outside a Git repository,
verifies that an ignored CLI package is rejected, then verifies that a
normal package changeset passes. This reproduces the shallow-checkout
failure without relying on a local `next` ref.

## Verification

- `pnpm validate:agent-skills`
- `pnpm validate:skill-routing`
- `pnpm validate:changesets`
- `pnpm test:release-workflow`
- `pnpm lint`
- `pnpm install --frozen-lockfile`
- all 24 TypeScript package test tasks
- skill-creator `quick_validate.py`
- Prettier check
- `git diff --check`
- manual beta release
[`@composio/cli@0.2.33-beta.294`](https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.2.33-beta.294):
33/33 release and installation jobs passed
 2026-07-20 23:17:03 +04:00
Kshitij Jhunjhunwala d583e7ef6f fix(cli): harden plugin setup installation 2026-07-13 15:19:38 -07:00
dependabot[bot] 09aab1d19f chore(deps-dev): bump the npm-development group across 1 directory with 3 updates (#3795) 
Bumps the npm-development group with 3 updates in the / directory:
[turbo](https://github.com/vercel/turborepo),
[typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)
and [typedoc](https://github.com/TypeStrong/TypeDoc).

Updates `turbo` from 2.10.2 to 2.10.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.10.4</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>release(turborepo): 2.10.3 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13222">vercel/turborepo#13222</a></li>
<li>ci: Retry Windows nextest aborts from transient 0xc0000142 spawn
failures by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13240">vercel/turborepo#13240</a></li>
<li>perf: Use mimalloc as the global allocator by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13237">vercel/turborepo#13237</a></li>
<li>perf: Parse yarn v1 lockfiles in a single pass by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13241">vercel/turborepo#13241</a></li>
<li>ci: Fix cache outputs for Eve app by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13243">vercel/turborepo#13243</a></li>
<li>perf: Stop materializing spans for the disabled daemon log layer by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13244">vercel/turborepo#13244</a></li>
<li>fix: Keep ancestor-scoped bun dependencies resolvable after prune
renames by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13236">vercel/turborepo#13236</a></li>
<li>perf: Overlap external dependency hashing with package file hashing
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13234">vercel/turborepo#13234</a></li>
<li>perf: Build tracked repo index concurrently with package graph by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13232">vercel/turborepo#13232</a></li>
<li>perf: Release tokio runtime at exit so background DNS lookups never
stall the user by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13231">vercel/turborepo#13231</a></li>
<li>perf: Overhaul pnpm lockfile parsing and dependency closure
computation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13228">vercel/turborepo#13228</a></li>
<li>feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13227">vercel/turborepo#13227</a></li>
<li>feat: Introduce toolchain provider abstraction by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13235">vercel/turborepo#13235</a></li>
<li>perf: Parse Berry lockfiles in a single pass by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13242">vercel/turborepo#13242</a></li>
<li>fix: Apply input exclusion globs to the filesystem walk by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13224">vercel/turborepo#13224</a></li>
<li>fix: Stop root-directory packages from claiming every file in change
mapping by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13225">vercel/turborepo#13225</a></li>
<li>chore: Rename turborepo-repository napi package to
<code>@​turbo/repository</code> by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13226">vercel/turborepo#13226</a></li>
<li>perf: Hash git blobs with hardware-accelerated SHA-1 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13245">vercel/turborepo#13245</a></li>
<li>release(turborepo): 2.10.4-canary.1 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13247">vercel/turborepo#13247</a></li>
<li>feat: Discover Cargo crates as packages by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13248">vercel/turborepo#13248</a></li>
<li>perf: Reuse per-package external dependency hashes in run summaries
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13249">vercel/turborepo#13249</a></li>
<li>perf: Stat workspace turbo.json files concurrently during discovery
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13251">vercel/turborepo#13251</a></li>
<li>chore: Add tracing spans to workspace discovery and globwalk phases
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13252">vercel/turborepo#13252</a></li>
<li>fix: Avoid non-reentrant libc calls in concurrent shutdown process
scans by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13256">vercel/turborepo#13256</a></li>
<li>perf: Memoize resolved task definitions during engine construction
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13257">vercel/turborepo#13257</a></li>
<li>perf: Compute transitive closures and external dependency hashes
concurrently with run setup by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13250">vercel/turborepo#13250</a></li>
<li>perf: Probe microfrontends configs in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13262">vercel/turborepo#13262</a></li>
<li>feat: Execute Cargo crate tasks via cargo by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13261">vercel/turborepo#13261</a></li>
<li>perf: Pre-size engine task collections by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13265">vercel/turborepo#13265</a></li>
<li>feat: Expose resolved experimentalCI task configuration in
<code>turbo query</code> by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13264">vercel/turborepo#13264</a></li>
<li>feat: Derive input and output globs for Cargo tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13263">vercel/turborepo#13263</a></li>
<li>perf: Parse large pnpm lockfile sections in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13266">vercel/turborepo#13266</a></li>
<li>feat: Hash Cargo external dependencies per-crate by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13267">vercel/turborepo#13267</a></li>
<li>ci: Install pnpm 10 in musl containers for Library Release by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13269">vercel/turborepo#13269</a></li>
<li>ci: Force pnpm overwrite in Library Release musl containers by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13270">vercel/turborepo#13270</a></li>
<li>perf: Defer the untracked-scan barrier to first file-hash use by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13268">vercel/turborepo#13268</a></li>
<li>ci: Fetch API-created commit before updating local ref by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13271">vercel/turborepo#13271</a></li>
<li>release(library): 0.0.1-canary.22 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13272">vercel/turborepo#13272</a></li>
<li>perf: Remove lock and dispatch overhead from task hash
precomputation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13273">vercel/turborepo#13273</a></li>
<li>fix: Fall back to lockfile detection in
<code>@​turbo/repository</code> when package manager is undeclared by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13275">vercel/turborepo#13275</a></li>
<li>test: Add end-to-end coverage for Cargo workspaces by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13274">vercel/turborepo#13274</a></li>
<li>release(library): 0.0.1-canary.23 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13276">vercel/turborepo#13276</a></li>
<li>release(turborepo): 2.10.4-canary.2 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13278">vercel/turborepo#13278</a></li>
<li>fix: Collapse nested package-manager fallback conditional by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13279">vercel/turborepo#13279</a></li>
<li>feat: Make turbo watch Cargo-aware by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13280">vercel/turborepo#13280</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/1506a114e377dd7e1e8e7a7863c42adf94a9f776"><code>1506a11</code></a>
publish 2.10.4 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/11a68c705274cc7a408776b576ce7a9e14d6e6df"><code>11a68c7</code></a>
fix: Stop flagging relative imports that resolve into node_modules in
boundar...</li>
<li><a
href="https://github.com/vercel/turborepo/commit/947b4784cd1b254e62b663bbdb22891a849b7442"><code>947b478</code></a>
fix: Raise the open-file soft limit at startup (<a
href="https://redirect.github.com/vercel/turborepo/issues/13282">#13282</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/ddc584d788349fc3668e280286f540feee4eb6b9"><code>ddc584d</code></a>
feat: Make turbo prune Cargo-aware (<a
href="https://redirect.github.com/vercel/turborepo/issues/13281">#13281</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/ff0d50822314c5b388d9b4daa9c6159387752d95"><code>ff0d508</code></a>
perf: Skip dependency-closure assembly for toolchains that derive
nothing (<a
href="https://redirect.github.com/vercel/turborepo/issues/1">#1</a>...</li>
<li><a
href="https://github.com/vercel/turborepo/commit/39d623e1323ef50e06be0a103082ae29cc545779"><code>39d623e</code></a>
feat: Make turbo watch Cargo-aware (<a
href="https://redirect.github.com/vercel/turborepo/issues/13280">#13280</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/af01fdfeb5efe07a7b6843a0b8f5033b59ebbb2c"><code>af01fdf</code></a>
fix: Collapse nested package-manager fallback conditional (<a
href="https://redirect.github.com/vercel/turborepo/issues/13279">#13279</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/7e02f94f647cb4d527a438313dc4adbe3e8c0df3"><code>7e02f94</code></a>
release(turborepo): 2.10.4-canary.2 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13278">#13278</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/8e3a59fdb6c71ad24fbbb363db52f88eb9a89116"><code>8e3a59f</code></a>
release(library): 0.0.1-canary.23 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13276">#13276</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/ce18f0a79eb49e9a22c7e6cfa491777c24ed746a"><code>ce18f0a</code></a>
test: Add end-to-end coverage for Cargo workspaces (<a
href="https://redirect.github.com/vercel/turborepo/issues/13274">#13274</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.2...v2.10.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `typescript-eslint` from 8.62.1 to 8.63.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's
releases</a>.</em></p>
<blockquote>
<h2>v8.63.0</h2>
<h2>8.63.0 (2026-07-06)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-misused-promises] detect async
usage of a sync dispose usage (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12426">#12426</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [method-signature-style] suggest
converting readonly function properties instead of emitting invalid
syntax (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12447">#12447</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12446">#12446</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
handle optional-chained calls to overloaded functions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12491">#12491</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12485">#12485</a>)</li>
<li><strong>eslint-plugin:</strong> [no-base-to-string] don't flag a
shadowed String() call (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12492">#12492</a>)</li>
<li><strong>scope-manager:</strong> export ClassStaticBlockScope (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12460">#12460</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Kristjan <a
href="https://github.com/KristjanTammekivi"><code>@​KristjanTammekivi</code></a></li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov"><code>@​mnaoumov</code></a></li>
<li>Serhii Leniv <a
href="https://github.com/Serhii-Leniv"><code>@​Serhii-Leniv</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's
changelog</a>.</em></p>
<blockquote>
<h2>8.63.0 (2026-07-06)</h2>
<p>This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374"><code>290cf6c</code></a>
chore(release): publish 8.63.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `typedoc` from 0.28.19 to 0.28.20
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/TypeStrong/TypeDoc/releases">typedoc's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.20</h2>
<h3>Features</h3>
<ul>
<li>Group/category section headings (<code>&lt;h2&gt;</code>) in the
default theme now include an <code>id</code> attribute so they can be
linked to via fragment identifiers (e.g.
<code>modules.html#classes</code>), <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li>
<li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert
variable/type references as a re-export instead of a new symbol, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li>
<li>API: Introduced <code>generateOutputsBegin</code> and
<code>generateOutputsEnd</code> events on <code>Application</code> for
plugin use.</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>When <code>--emit none</code> is used, TypeDoc will now report
warnings about missing relative paths previously reported when
rendering, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li>
<li>Improved performance via asynchronously performing git and file
write operations, more performant JSX rendering, and source code
bundling, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li>
<li>A <code>@hidden</code> tag on a constructor parameter-property will
now only hide the property, not both the property and the parameter, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li>
<li>Custom <code>@group</code> and <code>@category</code> titles with
the same sort weight are now ordered consistently with the
<code>alphabetical</code> reflection sort, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li>
</ul>
<h3>Thanks!</h3>
<ul>
<li><a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a></li>
<li><a
href="https://github.com/jonathanhefner"><code>@​jonathanhefner</code></a></li>
<li><a
href="https://github.com/kcastellino"><code>@​kcastellino</code></a></li>
<li><a href="https://github.com/Metbcy"><code>@​Metbcy</code></a></li>
<li><a
href="https://github.com/StoneCypher"><code>@​StoneCypher</code></a></li>
<li><a
href="https://github.com/wotan-allfather"><code>@​wotan-allfather</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md">typedoc's
changelog</a>.</em></p>
<blockquote>
<h2>v0.28.20 (2026-07-05)</h2>
<h3>Features</h3>
<ul>
<li>Group/category section headings (<code>&lt;h2&gt;</code>) in the
default theme now include an <code>id</code> attribute so they can be
linked to via fragment identifiers (e.g.
<code>modules.html#classes</code>), <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li>
<li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert
variable/type references as a re-export instead of a new symbol, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li>
<li>API: Introduced <code>generateOutputsBegin</code> and
<code>generateOutputsEnd</code> events on <code>Application</code> for
plugin use.</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>When <code>--emit none</code> is used, TypeDoc will now report
warnings about missing relative paths previously reported when
rendering, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li>
<li>Improved performance via asynchronously performing git and file
write operations, more performant JSX rendering, and source code
bundling, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li>
<li>A <code>@hidden</code> tag on a constructor parameter-property will
now only hide the property, not both the property and the parameter, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li>
<li>Custom <code>@group</code> and <code>@category</code> titles with
the same sort weight are now ordered consistently with the
<code>alphabetical</code> reflection sort, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li>
</ul>
<h3>Thanks!</h3>
<ul>
<li><a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a></li>
<li><a
href="https://github.com/jonathanhefner"><code>@​jonathanhefner</code></a></li>
<li><a
href="https://github.com/kcastellino"><code>@​kcastellino</code></a></li>
<li><a href="https://github.com/Metbcy"><code>@​Metbcy</code></a></li>
<li><a
href="https://github.com/StoneCypher"><code>@​StoneCypher</code></a></li>
<li><a
href="https://github.com/wotan-allfather"><code>@​wotan-allfather</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/34d843be0953fc81de0fde14bea8db72d0bbccc6"><code>34d843b</code></a>
Update changelog for release</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/fbd4a254952c171b9ba7ebbe96c5151e844743be"><code>fbd4a25</code></a>
Bump version to 0.28.20</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/93ba157000e4a632bfbf32a0b6f00f8ae57c7c99"><code>93ba157</code></a>
Update dependencies in example</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/e8c5df8844edca9800dfc62cee9115ef0fba59ea"><code>e8c5df8</code></a>
Remove unnecessary files from distribution</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/392b0dd50a428ea0c732c38c6c263e74cb6200b1"><code>392b0dd</code></a>
Update dependencies</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/8510dd48c7778f419f4605146f1a733af27993fa"><code>8510dd4</code></a>
Add missing entries in changelog before release</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/51dc0521890924269f06e08972c6453299f63cb5"><code>51dc052</code></a>
Update change log for 0.28.20 release</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/72f20cd87b4ef30aae97b68fcbb42ca19cebdc22"><code>72f20cd</code></a>
Merge branch 'fix-locale-sort-group-category-titles' into dev</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/623f2c0bd35b5e89cc79fb5783dac01c6f2530e9"><code>623f2c0</code></a>
Fix failing test, accept slightly slower build for now</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/c8bdf14cab0c22dd415b6872cc647c6cf81f917c"><code>c8bdf14</code></a>
Minor config tweak to improve dev build time</li>
<li>Additional commits viewable in <a
href="https://github.com/TypeStrong/TypeDoc/compare/v0.28.19...v0.28.20">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-13 13:54:29 +04:00
dependabot[bot] 4baacbeb77 chore(deps): bump the npm-production group across 1 directory with 7 updates (#3799) 
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
 2026-07-10 19:06:45 +04:00
Alberto Schiabel b07fcada3f feat(experimental): add Eve provider and iMessage example (#3800) 
This PR:

- supersedes https://github.com/ComposioHQ/composio/pull/3642 and
credits @shamsharoon for the original Eve provider and iMessage work
- rebases the integration onto the current `next` branch and resolves
its lockfile conflicts
- publishes an isolated `@composio/experimental/eve` entry with the
correct Eve 0.12+ peer contract
- adds recoverable per-session discovery, native Eve context
propagation, and durable approval policies for direct and batched side
effects
- centralizes circular-safe auth-link extraction across Eve and Pi and
replaces dense conditional expressions with named control flow
- hardens the iMessage example against `osascript` option injection,
unsafe trigger scoping, and third-party prompt injection
- preserves completed local-tool results when a mixed local/remote batch
loses its remote transport
- consolidates the example documentation onto shared components,
documents direct model-provider credentials, and clarifies that the
browsable source is not yet a standalone fixture
- verifies the change with 999 core tests, 32 experimental tests,
package builds/typechecks, packed peer-isolation smokes, and a
production docs build

---------

Co-authored-by: shams haroon <144290365+shamsharoon@users.noreply.github.com>
Co-authored-by: shams haroon <shamsharoon7@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: shams haroon <shams@composio.dev>
 2026-07-10 16:57:11 +04:00
Alberto Schiabel 30ba4d2930 feat(openai): add executable provider example (#3798) 
This PR:

- builds on top of https://github.com/ComposioHQ/composio/pull/3790
- makes the OpenAI example executable in direct-tools, Tool Router,
smoke, and Cloudflare Workers modes
- keeps direct and Tool Router agents in separate files so each
execution model is explicit and readable
- requires a successful Composio tool execution before either agent can
accept a final model response
- adds OpenAI to the nightly staging matrix without weakening the
existing Mastra coverage
- updates two stale experimental OpenAI usages so the complete example
package typechecks against current SDK APIs

## Testing

- `pnpm --filter openai-example run typecheck`
- `pnpm --filter openai-example run lint` (0 errors; 4 pre-existing
warnings)
- `pnpm --filter openai-example run smoke` (staging: 5 direct tools and
6 Tool Router tools)
- `pnpm --filter openai-example run cf:dry-run`
- `pnpm run typecheck`
- `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx`
- `pnpm run typecheck:examples`
- `pnpm run lint:examples`
- `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'`
- [branch
nightly](https://github.com/ComposioHQ/composio/actions/runs/29079263571):
OpenAI and Mastra both passed smoke, direct-tools, and Tool Router
against staging

## Post-deploy validation

- dispatch `ts.examples-nightly.yml` on `next` after merge and confirm
both matrix legs stay green
- healthy runs finish within the 20-minute job budget and log successful
tool-backed responses for both agent modes
- revert this PR if the OpenAI leg blocks the nightly; examples
maintainers own the first post-merge run and the next 06:00 UTC schedule

---

[![Compound
Engineering](https://img.shields.io/badge/Built_with-Compound_Engineering-6366f1)](https://github.com/EveryInc/compound-engineering-plugin)
![Codex](https://img.shields.io/badge/GPT--5-000000)
 2026-07-10 13:41:59 +04:00
Alberto Schiabel 76881491d0 feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788) 
## What

Turns the **Mastra** example into an executable reference that doubles
as a test, and wires the examples into CI for the first time. First
slice of the v1 "executable examples" workstream — the pattern here is
the template for the other TS providers, then Python.

## Why

Examples under `ts/examples/*` were unverified: the only CI tie-in is
`validate-examples.ts`, which is transpile-only (no cross-file types, no
lint, no execution) and passes on exactly the schema-conversion
regressions we keep hitting in the Mastra provider — all closed but
unprotected:

- https://github.com/ComposioHQ/composio/issues/2109 (zod→json
serialization crash)
- https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped
while `$ref` kept)
- https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema
tools crash serialization)

## Changes

**Canonical Mastra example** (`ts/examples/mastra`)
- `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS`
toolkit
- `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` →
`session.tools()` (drops the deprecated bare `composio.create` alias)
- `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers
runtime (`export default { fetch }`)
- `src/smoke.ts` — deterministic wrapping + tool-router assertions
(needs only `COMPOSIO_API_KEY`)
- Removed the old Gmail/MCP entries that used deprecated APIs and
required auth
- Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts`

**Real typecheck + lint** (examples previously escaped both)
- Example now has a `typecheck` script (Node + Worker tsconfigs);
`typecheck:examples` / `lint:examples` scripts added
- eslint now covers `ts/examples/**` with type-safety rules kept
(`no-explicit-any`) and console noise allowed

**Two-tier CI**
- `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck
→ lint → `wrangler deploy --dry-run`. This is the tier that catches the
schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces
as a **type** error.
- `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes
against the **staging** backend with secrets; runs the deterministic
smoke always and the full agent examples when an LLM key is set.

## Verification

Locally against staging: `smoke` passes (5 direct + 6 tool-router
tools), `typecheck:examples` and `lint:examples` are green, the Worker
`wrangler deploy --dry-run` bundles, and seeded regressions (a type
error / an `any`) correctly fail their gate.

## Notes

- No changeset — example packages are private/unpublished.
- Follow-ups (separate PRs): template the pattern to the other TS
providers, then port to `python/examples/*`.
 2026-07-10 01:40:03 +04:00
Alberto Schiabel 72eac88133 fix(cli): replace abandoned decompress dependency (GHSA-mp2f-45pm-3cg9) (#3767) 
This PR:
- replaces `decompress` (unmaintained; the zip-slip fix in the GHSA
advisory was never published to npm past 4.2.1) with `extract-zip`
across the CLI's four zip-extraction call sites: `install-skill.ts`,
`run-companion-modules.ts`, `upgrade-binary.ts`, and
`cli-local-tools/bundled-binaries.ts`
- `extract-zip` validates each entry resolves inside the target
directory before writing, closing the path-traversal issue `pnpm audit`
flags as critical
- replaces the one `.tgz`-extracting call site
(`scripts/_acp-adapters.ts`, used to vendor ACP adapter binaries at
build time) with `tar`, since `extract-zip` only handles zip archives
- removes `@types/decompress`; both `extract-zip` and `tar` ship their
own type definitions
- `pnpm audit --prod --audit-level=high` now passes (previously failing
on `next`, unrelated to #3766)

Verified `extract-zip` and `tar` extract nested directories correctly
with a local smoke test (real `.zip`/`.tgz` archives), in addition to
the existing `@composio/cli` (724 tests) and `@composio/cli-local-tools`
(13 tests) suites passing.
 2026-07-07 18:58:17 +04:00
Alberto Schiabel 58bc93b2d9 chore(deps): consolidate dependency updates (#3760) 
This PR:
- consolidates https://github.com/ComposioHQ/composio/pull/3733,
https://github.com/ComposioHQ/composio/pull/3735 through
https://github.com/ComposioHQ/composio/pull/3744, and
https://github.com/ComposioHQ/composio/pull/3752
- refreshes the pnpm workspace dependencies under the existing
`minimumReleaseAge` supply-chain gate
- keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare
workers types 4 where latest majors conflict with the current workspace
- keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the
workspace catalog to zod 4
- bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock`
- updates the SHA-pinned Claude and Codex workflow actions from the
Dependabot action group
- adds a patch changeset for the versioned package manifests touched by
dependency updates
- verifies the rollup with frozen pnpm/uv locks, peer checks, audit
threshold checks, typecheck, lint, builds, TypeScript tests, and Python
`nox -s chk`

## Context

`pnpm audit --prod --audit-level=moderate` passes. The remaining
production audit item is a low `@ai-sdk/provider-utils` advisory through
Mastra transitive dependencies; forcing it higher would require leaving
the compatible stable Mastra dependency path.
 2026-07-06 14:33:55 +04:00
Alberto Schiabel 49e4c11427 chore(deps): resolve high prod audit advisories via in-range bumps (#3751) 
This PR:

- refreshes lockfile resolutions for the 17 high `pnpm audit --prod`
advisories via `pnpm update -r` — real version bumps within the ranges
parents already declare (minimatch 5/9, lodash, fast-uri, picomatch,
langsmith, `@hono/node-server`, express-rate-limit, ws), not resolution
overrides
- bumps the pre-existing #3467 security pin `protobufjs: 7.5.9 -> 7.6.1`
in `pnpm-workspace.yaml` (7.5.9 itself is vulnerable to GHSA
unbounded-Any DoS)
- adds ONE temporary scoped override, `minimatch@>=10.0.0 <10.2.3 ->
>=10.2.3`: `@zed-industries/claude-code-acp@0.16.2` (latest) exact-pins
vulnerable `minimatch 10.2.1` and no fixed release exists; commented in
the file, drop when upstream ships
- no `package.json` changes anywhere: none of the vulnerable packages is
a direct dependency of any workspace package, so there is nothing to
major-bump on our side

## Context

Split out of #3748 (CI hardening) so dependency changes land in
isolation. **Merge this before #3748** — its new `pnpm audit --prod
--audit-level=high` hard gate needs this green baseline, per the plan's
"gate lands together with the dependency fix" rule.

Verified: `pnpm audit --prod --audit-level=high` exits 0 (remaining: 1
low, 6 moderate); `pnpm install --frozen-lockfile` passes. Dev-path high
advisories (vite, undici, flatted, linkify-it, minimatch 3.x) are out of
scope — the gate is `--prod`; tracked as backlog.
 2026-07-04 10:24:01 +04:00
Alberto Schiabel 8d5823be87 chore(ci): cache turbo, bun, and uv and cancel superseded pr runs (#3747) 
This PR:

- adds `concurrency` to the ten PR/push CI workflows: superseded **PR**
runs are cancelled, while push runs use a per-run group
(`github.run_id`) so every commit on `next`/`master` still gets its own
run
- caches turbo outputs (`.turbo/cache`) via a new opt-in
`enable-turbo-cache` input on the `setup-node-pnpm-bun` composite (keyed
per job — concurrent jobs save different task graphs), enabled in
`ts.build`, `ts.test`, `ts.typecheck`, and all four `ts.test-e2e` jobs
- enables turbo caching for `typecheck`, removes the incorrect `dist/`
outputs from `test`, hashes root `tsconfig.base.json` in
`build`/`typecheck` inputs, and adds `mise.toml`/`mise.lock` to
`globalDependencies` so toolchain bumps bust every task hash (addresses
the Bugbot finding)
- fixes `@composio/slim`'s build to participate in the turbo graph: core
moves to slim's `devDependencies` (published `dependencies` unchanged)
and the script no longer shells out to `pnpm --filter @composio/core
build`, which raced concurrent dependents by wiping `core/dist`
mid-build and double-built core on every cold run — slim's `dist`
remains byte-identical to core's; no changeset added since the published
artifact is unchanged (say the word if policy wants one anyway)
- fixes the `py.test` matrix cache to `~/.cache/uv` (it cached
`~/.cache/pip` while installing via `uv pip`) and caches
`~/.bun/install/cache` in the five docs workflows
- adds `turbo.jsonc` to the TS workflows' path filters (previously
unwatched)
- release/publish workflows are deliberately untouched

Measured (same commit, cold first attempt vs `gh run rerun` warm):
ts.build 103s → 53s, ts.test 157s → 55s (`turbo test` 24/24 cached in
182ms), ts.typecheck 80s → 43s; py.test legs save a few seconds each (uv
was already fast). Warm floor is checkout + mise + pnpm-install
overhead.

## Context

Implements `plans/001-ci-speed-caching-and-concurrency.md` from the
advisor audit on `docs/sdk-v1-decision-records`. Implementation by codex
against the plan, then self-reviewed and counter-reviewed; warm-rerun
testing surfaced and fixed three latent issues (toolchain files absent
from turbo's hash, first-writer-wins cache-key collision across jobs,
and the slim out-of-band core rebuild race).
 2026-07-03 22:22:18 +04:00
Alberto Schiabel 03cb181fdb chore(deps): roll up dependency bumps (#3711) 
This PR:
- rolls up https://github.com/ComposioHQ/composio/pull/3695,
https://github.com/ComposioHQ/composio/pull/3696,
https://github.com/ComposioHQ/composio/pull/3697, and
https://github.com/ComposioHQ/composio/pull/3698 into one
dependency-bump branch
- updates Python dependency metadata for `langchain-openai`,
`pyautogen`, and `crewai`
- updates npm production dependency metadata for `zod-to-json-schema`,
`openai`, and `@modelcontextprotocol/sdk`
- refreshes `uv.lock` and `pnpm-lock.yaml` with the repo-pinned package
managers
- leaves Changesets unchanged because the touched TS package manifests
are private/ignored and no published TS SDK package metadata changes
- verified with `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm
typecheck`, focused TS builds/tests, clean-worktree `pnpm
test:examples`, Python import tests, and Python nox checks
- note: local `pnpm build:packages` hit a pre-existing broad-build race
around `@composio/slim` rebuilding `@composio/core`; focused dependent
builds pass

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-29 19:20:15 +04:00
Alberto Schiabel cddd66c3ce chore(ts): bump Hono, Mastra, and Chrome deps (#3691) 
This PR:
- bumps `hono`, `@mastra/core`, and `chrome-devtools-mcp` to their
current latest published versions
- routes the remaining Cloudflare Tool Router Hono consumer through the
workspace catalog
- updates the `@composio/mastra` `@mastra/core` peer range and adds a
patch changeset
- fixes `check-peer-deps` to resolve `semver` through the normal package
dependency
 2026-06-26 20:45:25 +04:00
Alberto Schiabel 9ffc696a99 feat(vercel): support AI SDK v7 (#3683) 
This PR:

- widens the `ai` peer dependency of `@composio/vercel` to `^6.0.0 ||
^7.0.0`, adding AI SDK v7 support and dropping the previously-untested
v5 arm
- adds Docker-based Node e2e compatibility suites for AI SDK v6 and v7
under `ts/e2e-tests/runtimes/node/vercel-ai-sdk-v{6,7}`, auto-discovered
by the existing e2e matrix (so PR CI exercises them)
- each installs the packed `@composio/vercel` tarball, typechecks the
provider against the target `ai` major, and asserts runtime tool
wrapping/execution (object inputs, JSON-string normalization via
`normalizeToolArguments`, `ToolSet` shape)
- the v7 suite additionally exercises v7's `ToolExecutionOptions` passed
to `tool.execute`
- ships a `minor` changeset (the peer-range narrowing removes a
previously-supported major)
- breaking:
- `ai@5` is no longer an accepted peer of `@composio/vercel`; v5
consumers should stay on the prior minor
 2026-06-26 14:08:09 +04:00
Rahul Tarak d17a268d3f docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637) 
Integration branch for the next docs release: a **sessions-first
documentation rewrite** — new and rewritten guides, example pages,
interactive components, and docs tooling — plus the supporting SDK
changes that the new docs describe.

The bulk of this PR is docs (~24k lines across ~150 commits); the SDK
changes (~5k lines) back the new guides.

## Documentation (the bulk)

- **Sessions-first restructure** — reorganized navigation and section
structure (incl. the "Sandbox (prev workbench)" section), with
v3-reorganization redirects so old URLs keep resolving.
- **Rewritten core guides** — quickstart, configuring sessions, triggers
(creating + subscribing to events), proxy-execute, toolkits
enable/disable, and common FAQ, rewritten in the house voice.
- **New example pages** — local-sandbox PR reviewer, daily standup bot,
and slack bot, with runnable build-ups.
- **New interactive components & diagrams** — triggers flow animation,
manage-connections visual, connection-refresh visual, and the
terminal-kit components.
- **Docs tooling** — a docs-graph link-graph connectivity checker,
search reprioritization (deprioritize legacy pages), and SDK-reference
regeneration.

## Supporting SDK changes

**`@composio/core` → 0.13.0 (minor)**
- `composio.sessions.create()` as the first-class sessions API
(`composio.create()` kept as an alias).
- **MCP is opt-in:** default `create()` / `use()` return native-tool
sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface
`session.mcp`. _Migration: read `session.mcp` only after creating with
`{ mcp: true }`._
- `session.sandbox` is the canonical resolved config;
`session.workbench` kept as a deprecated alias. `sandbox` is the
preferred session-config key (`workbench` still accepted).
- `connectedAccounts.updateAcl()` graduated from experimental (alias
kept).
- `triggers.parse()` (parse + optionally verify an incoming webhook) and
`triggers.setWebhookSubscription()`.

**`@composio/experimental` → minor** — local-workbench helpers moved
onto the `@composio/experimental/workbench` subpath (out of
`@composio/core/experimental`), keeping the ~14 KB embedded Python
helper out of core. Plus the experimental Pi provider.

**`@composio/slim` → minor.**

**Python → 0.17.0** — mirrors the TS surface: `composio.sessions` mount
(`tool_router` deprecated), `triggers.parse()` /
`set_webhook_subscription()`, the `sandbox` config key, and
`connected_accounts.update_acl()`.

## Review response (#3664)

Addressed the `@composio/core` review:
- **Security:** `triggers.parse()` no longer fails open — a
present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`)
now throws instead of silently skipping verification; omitting it stays
an explicit opt-out (both SDKs).
- Removed snake_case leakage from `transformWebhookSubscription` (+ the
index signature that allowed it).
- **Removed** the TS-only `connectedAccounts.link()` toolkit
auto-resolve (shipped with cancellability / orphaned-auth-config bugs
and was effectively undocumented; to be reintroduced properly later).
- Unified Python error types on `ValidationError`; added `mcp=True`
Python tests; fixed runtime-portability + error-type test assertions.
- Polished deprecation messages; fixed the backwards `/experimental`
`@deprecated` note and the `SessionWithMcp` JSDoc.

## Testing

- **TS:** `@composio/core` + `@composio/experimental` typecheck pass;
vitest green for the touched suites.
- **Python:** `test_tool_router.py` + `test_triggers.py` pass (161
tests).

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev>
Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Sarah Simionescu <sarah@composio.dev>
Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>
 2026-06-25 18:27:43 -07:00
Alberto Schiabel f8cd90ce5a chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646) 
This PR:

- uses plain `tsdown` package scripts and a shared typed
`tsdown.config.base.ts` so Node 24 builds work without loader flags
- switches the repo dev/build toolchain to Node `24.17.0` and pnpm
`11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml`
- marks the root package as ESM with `type: module`, matching the
TypeScript packages
- keeps Node `22.22.3` in the runtime/E2E matrices as the minimum
supported user runtime
- changes the TypeScript build workflow back to a single build on the
mise-managed toolchain and broadens path filters for
package-manager/build config files
- adds pnpm 11 build-script policy with `allowBuilds` and intentionally
ignored `sharp` builds
- enables tsdown ESM shims for the packaged CLI wrapper so `composio
--help` runs under Node 22 and Node 24

Verified locally:

- `CI=true pnpm install --frozen-lockfile`
- `pnpm lint`
- `pnpm run build:packages`
- `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter
@e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run
test:e2e:node`
- `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3`
and `24.17.0`
 2026-06-24 18:58:11 +04:00
Alberto Schiabel 23f9053804 chore(ts): clean up dependencies and bump toolchain (#3623) 
This PR:

- consolidates and bumps TypeScript/npm dependencies across the
monorepo, docs, examples, and e2e fixtures — no runtime behavior changes
- **cleanup:** remove the unused `ansis` dependency from `@composio/cli`
(`picocolors` is the actual color lib), drop the dead `uuid` catalog
entry, catalog `dotenv` + `@types/bun` and repoint drifting examples/e2e
onto them, and replace `chalk` with `picocolors` in `@composio/core`
(smaller, ESM, already used by the CLI)
- **TypeScript 6:** bump `typescript` `5.9 → 6.0.3` everywhere (catalog,
CLI test fixtures, docs); drop vestigial `declaration`/`outDir` from the
provider `tsconfig.json`s to fix the TS 6 `rootDir` regression
(`TS6059`); add `ignoreDeprecations: "6.0"` in docs for the `baseUrl`
deprecation
- **toolchain:** `tsdown 0.18 → 0.22.3`, `vitest` + `@vitest/ui →
4.1.9`, `publint → 0.3.21`, `wrangler → 4.101.0` (each the latest
version within the 3-day `minimumReleaseAge` gate)
- **Effect + hono:** `effect 3.21.3`, `@effect/cli 0.75.2`,
`@effect/platform 0.96.1`, `platform-bun 0.90.0`, `platform-node-shared
0.60.0`, `language-service 0.86.2`, `@effect/vitest 0.29.0`, `hono
4.12.25`; pin the Effect peer cohort
(`printer`/`printer-ansi`/`typeclass`/`rpc`/`sql`/`cluster`/`experimental`/`workflow`)
as `@composio/cli` devDeps so the auto-installed peers resolve
coherently, and bump `@cloudflare/workers-types` to satisfy `wrangler`'s
peer
- changesets: `@composio/cli` patch (ansis removal) and `@composio/core`
patch (chalk → picocolors)
- verified: `build`, `typecheck` (tsgo + real `tsc` 6.0.3), and local
tests (excluding e2e) all pass
 2026-06-21 00:54:27 +04:00
Alberto Schiabel 24e647fa16 test(ts/e2e): cover claude agent sdk on node current (#3620) 
This PR:
- builds on top of https://github.com/ComposioHQ/composio/pull/3495
- adds a Node.js `current` e2e suite for `@composio/claude-agent-sdk`
- exercises the packaged provider through Claude Agent SDK
`createSdkMcpServer` / `query()` with a deterministic local tool
- forwards `ANTHROPIC_API_KEY` through Turbo, Docker e2e env
passthrough, and the Node e2e workflow
 2026-06-20 02:08:34 +04:00
Alberto Schiabel 025a657597 feat(ts): drop CommonJS support (#3494) 
This PR moves the TypeScript SDK support floor to the latest Node.js 22
release and uses that as the point where we stop carrying custom
CommonJS compatibility machinery. The e2e runtime coverage now exercises
the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested
against the minimum supported version and the newer runtimes users are
likely to adopt next.

Because the SDK packages are still on `0.x`, the accompanying changeset
uses `minor` bumps while calling out that this is a breaking change
inside the existing 0.x line.

It also moves pnpm under mise on this Node 22 layer. That belongs here,
not in #3493, because the pinned `pnpm@10.28.2` requires Node.js
`>=22.13`. Removing Corepack is intentional: Node.js documents that
Corepack is no longer distributed starting with Node.js v25, so relying
on `corepack enable` would keep a toolchain dependency that is already
on the way out of the Node distribution.

## What changed

- Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`,
`mise.lock`, `toolchain-versions.json`, and root `devEngines`.
- Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise
the single source of truth for the pnpm version. Removes the root
`packageManager` / `devEngines.packageManager` Corepack pin entirely
(rather than keeping a second copy of the version that could drift) and
removes stale `packageManager` metadata from real TS packages/examples
and generators.
- Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so
Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a
`packageManager` field. Without this, Turbo fails workspace resolution
(`Could not resolve workspaces -> Missing 'packageManager' field`),
which is the only reason the field would otherwise need to stay.
- Replaces `corepack enable` in the shared setup action with
mise-managed pnpm. The E2E Docker images install bun + pnpm directly
from `mise.toml`/`mise.lock` (with
`dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay
on the base image as the test matrix axis and are disabled via
`MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are
symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build
args are threaded from the host anymore, and bun+pnpm now carry
`mise.lock` checksum verification.
- Extends the install-time toolchain check to validate pnpm against mise
alongside Bun.
- Sets the Node E2E matrix and install fallback checks to `22.22.3`,
`24.16.0`, and `25.9.0`.
- Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts`
only and uses the ATTW `esm-only` profile.
- Removes explicit `require` / `.cjs` / `.d.cts` package export paths
and internal import mappings from the public TS SDK packages.
- Marks public TS SDK packages as `type: module` where they were missing
it.
- Replaces the remaining runtime `require('pusher-js')` with dynamic ESM
import.
- Deletes the legacy CJS example.
- Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop
E2E: it verifies `require('@composio/core')` works through Node's native
ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`,
not a `.cjs` artifact.
- Removes `.cjs` / `.cts` handling from example validation and CLI
project-language detection.
- Updates provider scaffolding so newly generated providers are
ESM-only.
- Adds a minor changeset warning that CommonJS callers can only rely on
Node's native `require(esm)` interop and that custom CommonJS
compatibility machinery is gone.

## Bundled behavior changes

Two changes here are technically independent of the CommonJS removal but
ride along because they touch the same files and ship in the same
release cut. Calling them out explicitly so they are not missed in
review:

- **`PusherUtils` realtime channel auth (`@composio/core`).** Replacing
the runtime `require('pusher-js')` with a dynamic ESM `import()` was
done alongside conforming `channelAuthorization` to pusher-js's typed
`customHandler(params, callback)` contract. The previous `(authOptions)
=> Promise` shape did not match pusher-js's actual calling convention —
it read `endpoint`/`headers`/`params` off an argument that pusher-js
never passes — so this also fixes that latent mismatch. New unit tests
(`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request
shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name`
body) and the success / invalid-JSON / network-failure callback paths.
- **CLI meta-tool slug list (`@composio/cli`).** Drops
`COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from
`META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client`
alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']`
union. The list is declared `satisfies
ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at
compile time (`pnpm typecheck`) — keeping the stale slugs would be a
type error — and needs no separate runtime test.

## Verification

- Verified latest Node 22/24/25 releases from the official Node dist
index: `22.22.3`, `24.16.0`, `25.9.0`
(https://nodejs.org/dist/index.json).
- Verified Node docs state Corepack is no longer distributed starting
with Node.js v25:
https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html
- `mise exec -- pnpm --version` -> `10.28.2`
- `mise exec -- pnpm install --frozen-lockfile`
- `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts`
- `mise exec -- pnpm --filter @e2e-tests/utils typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node`
- `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck`
- `mise exec -- pnpm --filter @composio/cli typecheck`
- `mise exec -- pnpm --filter @composio/cli test -- --runInBand`
- `mise exec -- pnpm --filter @composio/core typecheck`
- `mise exec -- pnpm --filter @composio/core exec vitest run
test/utils/pusher.test.ts`
- `mise exec -- pnpm run build:packages`
- `mise exec -- turbo run build --dry-run` resolves all workspace
packages with no root `packageManager` field (pnpm discovered from
`pnpm-lock.yaml`).
- `mise exec -- pnpm --filter @composio/cli exec vitest run
test/src/services/project-environment-detector.test.ts`
- `mise exec -- pnpm exec prettier --check ...`
- `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg
NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also
`Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build
green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 /
bun 1.3.10 from mise.
- `docker manifest inspect node:24.16.0-slim`
- `docker manifest inspect node:25.9.0-slim`
- `bash -n ts/scripts/create-provider.sh && git diff --check`
- `ruby -e "require 'yaml';
YAML.load_file('.github/workflows/ts.test-e2e.yml')"`
- Tracked example validation in a clean temporary tree: `Validated 21
example packages.`
 2026-06-19 22:22:17 +04:00
Alberto Schiabel a0bef5d986 chore(deps): bump composio client SDKs (TS alpha.74, Py 1.41.0) (#3609) 
This PR:

- bumps the TS catalog `@composio/client` from `0.1.0-alpha.72` to
`0.1.0-alpha.74` (published from ComposioHQ/composio-base-ts#84) and
refreshes `pnpm-lock.yaml`
- bumps the Python `composio-client` pin from `1.39.0` to `1.41.0`
(published from ComposioHQ/composio-base-py#69)
- adds a patch changeset for `@composio/core` and `@composio/cli` so the
client bump actually ships in the next release

## Context

Neither client is auto-bumped in this repo — there is no
Stainless→consumer bot, and Dependabot does not touch the pnpm
`catalog:` pin (TS) or the exact `composio-client==` pin (Py), so these
were a manual catch-up. The Python `1.41.0` PyPI publish initially
failed with a `403 Forbidden` (stale `PYPI_TOKEN`); it was re-run
successfully before this bump, so `1.41.0` is live on PyPI.
 2026-06-19 18:42:59 +04:00
Alberto Schiabel 6606c0da92 fix(ts): upgrade vitest for GHSA-5xrq-8626-4rwp (#3569) 
This PR:

- closes #3502
- extracts the useful dependency and Cloudflare config slice from
https://github.com/ComposioHQ/composio/pull/3503 onto a clean `next`
branch
- upgrades `vitest` and `@vitest/ui` through the workspace catalog to
resolve the critical advisory
- switches the Mastra provider test dependency back to the catalog
- migrates the Cloudflare Worker Vitest configs to the
`cloudflareTest()` plugin API
- preserves existing `COMPOSIO_BASE_URL` bindings that were dropped in
#3503
- keeps Vitest 4 compatibility fixes scoped to constructor mocks, spy
cleanup, and temp-root project detection
- leaves Node, `mise`, release docs, and Effect catalog versions
unchanged; the commit includes @Dotify71 as `Co-authored-by`

Co-authored-by: Dushyant Acharya <dushyantacharya873@gmail.com>
 2026-06-15 19:38:51 +04:00
Alberto Schiabel 44e5458c35 feat(core): remove legacy TypeScript custom tools (#3509) 
This PR is **part 2 of 3** splitting
https://github.com/ComposioHQ/composio/pull/3505 to make the removal of
the old 2025 custom tools easier to review. It carries the
**TypeScript** slice.

- builds on top of https://github.com/ComposioHQ/composio/pull/3508
(stacked — review/merge the Python slice first; this PR's base is
`remove-py-custom-tools`)
- removes the legacy `composio.tools.createCustomTool(...)` in-memory
registry: the plural `CustomTools` model, registry wiring, legacy-only
tests/examples/`ts/docs` pages, and stale error/type exports
- preserves the 2026 tool-router APIs: `experimental_createTool`,
`experimental_createToolkit`, `ToolRouter`, `ToolRouterSession`, and
inline custom-tool execution
- regenerates the TypeScript SDK reference so raw tool listing no longer
describes the removed local registry and points to session-scoped custom
tools
- adds a `@composio/core` minor changeset

## Notes

- The committed SDK reference is **verified self-consistent**: `pnpm
--filter @composio/core generate:docs` reproduces it with zero diff.
- This slice is a byte-identical subset of #3505 — the three split
branches recombine to that PR's exact tree. See #3505 for the original
verification logs (`typecheck`, `test`, `lint`, `cf-workers` e2e); CI
re-runs per PR.
 2026-06-04 23:53:58 -07:00
Zen 57942e87fd fix(security): pin protobufjs to 7.5.5 (Socket.dev critical CVE) (#3467) 
# Description

Adds a `pnpm.overrides` entry pinning `protobufjs` to **7.5.5** to patch
a critical RCE flagged by Socket.dev:

| Socket alert | CVE | GHSA | Severity | Patched in |
|---|---|---|---|---|
| `SOCKET-COMPOSIO-1686` | `CVE-2026-41242` |
[`GHSA-xq3m-2v4x-88gg`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg)
| Critical | `protobufjs@7.5.5` |

### Why an override

`protobufjs@7.5.4` is pulled in transitively by `@google/genai` (via
`google-auth-library`) — there are no direct imports of `protobufjs` in
`ts/packages/`. The cleanest, minimal-risk fix is a `pnpm.overrides`
pin: 7.5.4 -> 7.5.5 is a patch-only release containing the RCE fix.

This is the same override pattern hermes uses for its security-pinned
deps.

# How did I test this PR

- `BYPASS_BUN_VERSION_CHECK=1 pnpm install --lockfile-only` regenerated
`pnpm-lock.yaml`. Both `protobufjs@7.5.4` references now resolve to
`7.5.5`.
- `grep -rn "from ['\"]protobufjs" ts/packages/` confirms zero direct
imports — pure lockfile change.
- Relying on CI for lint / typecheck / unit-test coverage on the
lockfile bump.

---

Origin: cron-f7c85f82906b /
[zen-cron-6352a6575b74](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74)
Triggered by: saransh@composio.dev | Source: Socket.dev Vulnerability
Auto-Fix
Session:
https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74
 2026-05-26 14:28:17 +04:00
venkat82 42ebff3f6b feat(connected-accounts): namespace SHARED-connection surface under experimental 
Aligns the TypeScript SDK with the experimental wire shape used by
Shared Connections. The flat accountType / aclConfigForShared options
on connectedAccounts.link() and session.authorize() have moved under a
single experimental block, and connectedAccounts.updateAcl() has moved
off the class onto a top-level experimental_updateAcl(composio, id, opts)
export — same precedent as experimental_createTool /
experimental_createToolkit.

The experimental namespace is the signal that the shape may change in
future releases. Pinning a SHARED connection in a session config and
direct execute by connectedAccountId are unchanged — only the
connection-create / patch / authorize surfaces are namespaced.

Also surfaces the accountType filter on connectedAccounts.list() so
SHARED connections can be listed without dropping to the raw client.
The wire keeps this as a flat query param, so the SDK keeps it flat too.

@composio/client bumped from 0.1.0-alpha.71 -> 0.1.0-alpha.72 so the
generated typed client carries the Experimental namespaces for
link.create, toolRouter.session.link, and connectedAccounts.patch.

Caller migration:

  // before
  await composio.connectedAccounts.link('user_id', 'auth_config_id', {
    accountType: 'SHARED',
    aclConfigForShared: { allowAllUsers: true },
  });
  await composio.connectedAccounts.updateAcl('ca_abc', { allowAllUsers: true });
  await session.authorize('github', {
    accountType: 'SHARED',
    aclConfigForShared: { allowAllUsers: true },
  });

  // after
  await composio.connectedAccounts.link('user_id', 'auth_config_id', {
    experimental: {
      accountType: 'SHARED',
      aclConfigForShared: { allowAllUsers: true },
    },
  });
  await experimental_updateAcl(composio, 'ca_abc', { allowAllUsers: true });
  await session.authorize('github', {
    experimental: {
      accountType: 'SHARED',
      aclConfigForShared: { allowAllUsers: true },
    },
  });

  // new — list SHARED connections
  const shared = await composio.connectedAccounts.list({
    accountType: 'SHARED',
    userIds: ['user_creator'],
  });

Tests cover: experimental block forwarding (link + authorize), no-op
when omitted, empty-array preservation, typed error mapping for the
PRIVATE-with-ACL case, experimental_updateAcl body construction +
deny-list handling + ValidationError when no fields are provided, and
list(accountType: 'SHARED') flat-filter delegation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 16:16:56 +05:30
venkat82 483af36070 feat(connected-accounts): bump @composio/client to alpha.71, drop casts, add tests + error mapping 
Now that #77 in composio-base-ts merged and @composio/client@0.1.0-alpha.71 is
published with account_type + acl_config_for_shared in the typed surface,
all the forward-compat shims come out.

Removed:
- AclConfigWireShape, LinkCreateBodyWithAcl, ConnectedAccountPatchBodyWithAcl
  local types
- 3x `as unknown as Parameters<typeof X>[N]` casts in ConnectedAccounts.ts +
  ToolRouterSession.ts

Now uses the generated types directly:
- ConnectedAccountPatchParams, ConnectedAccountPatchResponse from
  @composio/client/resources/connected-accounts
- LinkCreateParams + LinkCreateParams.ACLConfigForShared from
  @composio/client/resources/link
- SessionLinkParams + SessionLinkParams.ACLConfigForShared from
  @composio/client/resources/tool-router/session/session

Review fixes from #3392 multi-agent review:

- P1-1: moved orphaned JSDoc back onto ComposioLegacyConnectedAccountsEndpoint-
  RetiredError (was stranded above ComposioSharedAccessDeniedError)
- P1-2: added empty-array footgun warning to updateAcl() JSDoc — passing
  `notAllowedUserIds: []` silently clears the deny list
- P1-3: changeset reconciled with PR body (Python ships as separate PR)
- P2-9: updateAcl() returns ConnectedAccountPatchResponse instead of void,
  matching sibling update()/refresh() ergonomics
- P2-11: clarifying JSDoc on update() pointing at updateAcl() and noting the
  pre-existing "alias/credentials" doc is inaccurate (this PR doesn't fix it)
- P3-12: callbackUrl/alias guards normalized to `!== undefined` (was a mix
  of `&&` and `!= null`) — empty strings now propagate correctly
- P3-17: refine-guard comment on UpdateConnectedAccountAclParamsSchema noting
  ZodEffects doesn't expose .shape

P2-6/P2-7: typed error mapping for ComposioAclOnlyForSharedError (400)
wired at three call sites:
- ConnectedAccounts.link()    — wraps existing
  ComposioFailedToCreateConnectedAccountLink catch
- ConnectedAccounts.updateAcl() — new catch with rethrow fallback
- ToolRouterSession.authorize() — new catch with rethrow fallback

Substring match on `'acl_config_for_shared is only valid on SHARED'` —
verified against apps/apollo/src/lib/connected_accounts/createConnectedAccount.ts
in hermes#9902. ComposioSharedAccessDeniedError and
ComposioSharedConnectionNotAccessibleError remain exported but not yet
thrown — they'll be wrapped when Tools.execute() and ToolRouterSession.create()
error-mapping lands in a follow-up.

Tests: 12 new behaviour tests in test/connectedAccounts/connectedAccounts.test.ts
covering link() ACL forwarding (5), updateAcl() body construction + empty-object
refine + AclOnlyForShared mapping (6), and link() error-mapping fallback (1).
911 tests pass (up from 899).

Verified: pnpm typecheck clean, pnpm build clean (publint + attw clean).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-11 23:55:13 +05:30
Rahul Tarak a4c9e0ada2 refactor(cli): define local tools as custom toolkits (#3356) 
## Summary
- Stacks this local-tools PR on top of #3360, which contains the core
duplicate custom-toolkit child slug fix.
- Refactors `@composio/cli-local-tools` to define bundled local toolkits
with core `experimental_createTool` / `experimental_createToolkit`
handles instead of hand-rolled schema objects.
- Keeps Tool Router v3.1 inline custom toolkit definitions attached to
session create/search/execute calls so bundled local tools remain
searchable/executable.
- Adds CLI/local-tools test coverage for forwarding local custom toolkit
payloads and for core custom toolkit handles from the local registry.

## Stack
- Base PR: #3360 (`fix(core): qualify custom toolkit child slug
lookups`)
- This PR should now show only CLI/local-tools changes relative to
#3360.

## Tests
- `pnpm --filter @composio/core typecheck`
- `pnpm --filter @composio/cli-local-tools typecheck`
- `pnpm --filter @composio/cli typecheck`
- `pnpm --filter @composio/cli-local-tools test`
- `pnpm --filter @composio/cli-local-tools build`
- `pnpm --filter @composio/cli exec vitest run
test/src/commands/tools/tools.search.cmd.test.ts
test/src/commands/tools/tools.execute.cmd.test.ts`
- `pnpm --filter @composio/core exec vitest run
test/models/customTool.test.ts test/models/toolRouter.test.ts
test/models/customToolRouting.test.ts`
 2026-05-07 05:29:06 -07:00
Abir Taheer 7c14438385 chore: update pnpm-lock.yaml for @composio/client 0.1.0-alpha.70 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-05-06 21:53:35 -07:00
Dhawal Upadhyay fb8549fce7 Bump generated clients for v3.1 (#3348) 
## Summary
- bump generated TS client to @composio/client 0.1.0-alpha.69 and Python
client to composio-client 1.36.0
- page through ToolRouter session tools in TS/Python using the generated
v3.1 cursor response
- accept generated connected account status REVOKED and fail connection
waits immediately for terminal states

## Validation
- pnpm --filter @composio/core typecheck
- pnpm --filter @composio/core test -- test/tools/tools.test.ts
test/models/toolRouter.test.ts
test/connectedAccounts/connectedAccounts.test.ts
test/connectedAccounts/connectionRequest.test.ts
- uv run --frozen ruff check python/composio/core/models/tools.py
python/tests/test_tool_execution.py
- uv run --frozen pytest
python/tests/test_tool_execution.py::TestToolExecution::test_get_raw_tool_router_meta_tools_fetches_all_pages
python/tests/test_tool_router.py

Note: pnpm install --frozen-lockfile hits the repo preinstall Bun guard
locally because this machine has Bun 1.2.10 and the branch expects
1.3.10; dependency sync was completed with --ignore-scripts for local
verification.
 2026-05-06 16:10:38 +05:30
Alberto Schiabel f5c5b84bd3 fix(mastra): resolve $ref in tool schemas before applyCompatLayer [PLEN-2244] (#3315) 
## Summary

Composio tools whose JSON Schema uses internal `$ref` pointers
(`#/$defs/...` or the legacy `#/definitions/...`) used to lose all type
information when wrapped by `MastraProvider.wrapTool`. The schema would
silently round-trip `raw → applyCompatLayer → convertSchemaToZod (drops
$ref → permissive anyOf) → zodToJsonSchema (no recovery)`. Customers
reported the user-visible surface as *"schema validation error: can't
resolve reference"* — AJV (bundled inside `@mastra/schema-compat`)
refusing to compile the schema downstream when validating tool input.

This PR pre-processes the schema with a new `dereferenceJsonSchema`
utility from `@composio/core` *before* it reaches
`@mastra/schema-compat`, preserving the type information from
`$defs`/`definitions` and avoiding the AJV failure entirely.

Closes
[PLEN-2244](https://linear.app/composio/issue/PLEN-2244/mastra-provider-schema-validation-error-cant-resolve-reference).

## What changed

- **`@composio/core`** — new `dereferenceJsonSchema(schema)` helper (and
`JsonSchemaRefResolutionError`):
- walks the schema reflectively (no JSON-Schema-keyword allow-list, so
future applicators are covered automatically),
- inlines internal `$ref` pointers transitively, with a 100-hop depth
cap,
- shallow-merges sibling keywords next to `$ref` per Draft 2020-12
semantics (siblings win on collision — preserves caller's `description`
/ `default` / `title`),
- breaks recursive cycles with `{ type: 'object', additionalProperties:
true }` (matches upstream guidance in
[mastra-ai/mastra#15341](https://github.com/mastra-ai/mastra/issues/15341)),
- strips `$defs` / `definitions` from the returned root once everything
reachable is inlined,
- leaves external (`http://`/`https://`) `$ref` pointers untouched so
callers can still forward them,
- throws `JsonSchemaRefResolutionError` on malformed pointers, missing
targets, and over-cap chains.
- **`@composio/mastra`** — `wrapTool` now runs `dereferenceJsonSchema`
over both `inputParameters` and `outputParameters` before calling
`applyCompatLayer`.
- **`@mastra/schema-compat`** floor bumped to `^1.2.9` so consumers
automatically pick up upstream [PR
#15400](https://github.com/mastra-ai/mastra/pull/15400)'s
recursive-`$ref` handling and [PR
#14530](https://github.com/mastra-ai/mastra/pull/14530)'s Draft-2020-12
AJV switch.
- Changeset: `.changeset/fix-mastra-ref-dereference.md` (patch bump for
`@composio/core` and `@composio/mastra`).

## Test plan

Red → green TDD across two commits — the `test:` commit reproduces
PLEN-2244 against the real `@mastra/schema-compat` (no `vi.mock`), the
`fix:` commit makes the regression tests pass.

- [x] `ts/packages/core/test/utils/jsonSchema.test.ts` — 14 unit tests
for `dereferenceJsonSchema` covering: basic resolution, chained refs,
container coverage (items / oneOf / anyOf / allOf / not /
additionalProperties / patternProperties / prefixItems), legacy
`definitions` (Draft 7), `$defs`/`definitions` mixed transitively,
sibling-keyword merge per Draft 2020-12, cycle break,
`$defs`/`definitions` strip, missing-target error, depth-cap error,
external `$ref` preserved, no input mutation, JSON Pointer escape
decoding (`~0`/`~1`), array-index pointers.
- [x] `ts/packages/providers/mastra/test/mastra-ref.test.ts` — un-mocked
integration tests against real `@mastra/schema-compat`: wrapping does
not throw, type info from `$defs` survives the round-trip (the `id`
field stays `type: 'string'` instead of degrading to permissive
`anyOf`), same for Draft-7 `definitions` on output schema, no remaining
`$ref` in the produced schemas.
- [x] `pnpm --filter @composio/core test` — 852/852 green.
- [x] `pnpm --filter @composio/mastra test` — 43/43 green (39 legacy + 4
new).
- [x] `pnpm --filter @composio/core --filter @composio/mastra typecheck`
— clean.
- [x] Existing `mastra.test.ts` (which mocks `@mastra/schema-compat`) is
**untouched** and still green.
- [x] Secret-hygiene scan: `git diff next..HEAD | grep -E
'sk-[A-Za-z0-9_-]{20,}|OPENAI_API_KEY=[A-Za-z]'` returns empty.

## Why it's a Mastra-only fix

The Mastra path is unique in routing JSON Schema through
`@mastra/schema-compat`, which embeds AJV. Sibling providers (`openai`,
`anthropic`, `vercel`, `langchain`, `google`, `llamaindex`) forward
Composio's JSON Schema through `@composio/json-schema-to-zod`, which
silently no-ops on unknown nodes. They are not affected today; expanding
pre-processing across providers is a separate PR if it ever becomes
needed.

## Caveats

- The cycle-break sentinel weakens type information for genuinely
recursive tool schemas. This is the same trade-off Mastra itself made in
[#15341](https://github.com/mastra-ai/mastra/issues/15341); without it
the agent crashes entirely.
- External `$ref` (`http://`/`https://`) is intentionally left
untouched. If a real customer schema ever needs them resolved, that's an
incremental follow-up that calls into
`@apidevtools/json-schema-ref-parser` only when needed.
- The cycle-break currently uses a single sentinel for any cycle; if
review prefers the higher-fidelity "keep first expansion, only break on
the recursion edge" pattern (mentioned in the research as a refinement),
that's a small follow-up.
 2026-05-06 11:17:57 +02:00
Rahul Tarak b3e5df565e fix(cli): patch BetterSwiftAX constants for binary builds (#3347) 
## Summary
- Broaden the Beeper iMessage macOS build patch so BetterSwiftAX
`kAX...` constants compile on GitHub `macos-15`/`macos-15-intel`.
- Pin the fixed `platform-imessage` submodule source and add Swift 6.2 /
Peekaboo dependency patching for the CLI binary workflow.
- Package and verify macOS local-tool sidecars plus `release-tag.txt` in
CLI release zips.
- Fix installed beta metadata/upgrade behavior so `--version`, update
checks, and beta-default experimental flags use the installed release
tag.
- Let `LOCAL_*` execution bypass remote auth/project/schema validation.
- Add runtime self-heal for missing installed `local-tools-binaries`: if
an old upgrader installs the fixed beta binary without sidecars, first
local-tool execution downloads the matching release zip, verifies
checksum when available, and restores the sidecars.

## Validation
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build:binary`
- Targeted CLI tests for execute/config/upgrade/version/update-check
paths.
- Packaged binary smoke test confirmed bundled Beeper sidecar works.
- Repair smoke test: copied only the new `composio` binary plus
`release-tag.txt` into a temp install with no `local-tools-binaries`;
`execute LOCAL_BEEPER_IMESSAGE_VERSION -d '{}'` restored sidecars from
`@composio/cli@0.2.29-beta.235` and succeeded.

## Release workflow
- Beta build run `25405049712` succeeded for commit
`9d0910c909b7b257d0f17b6d082980952d1e6c59` and published
`@composio/cli@0.2.29-beta.235`.
- This PR now includes one follow-up commit (`2c32cff4c`) to cover the
old-upgrader/missing-sidecars incremental upgrade path; normal branch CI
and beta build run `25406984535` are running again.
 2026-05-05 16:45:50 -07:00
Dhawal Upadhyay 82e0038c7c bump generated clients for v3.1 2026-05-05 14:44:43 +05:30
Rahul Tarak 79ac22053f feat(cli): add local tools foundation (#3340) 
## Summary
- Add experimental CLI local tools behind `local_tools` (beta-on,
stable-off unless `composio config experimental local_tools on`).
- Add reusable `@composio/cli-local-tools` package: declarations,
metadata, readiness, command/MCP/native/FFI runtimes, bundled-binary
resolution, and Tool Router search/execute/schema integration.
- Add first-class local toolkits for:
- `BEEPER_IMESSAGE` backed by `imessage-cli` from the ComposioHQ
`platform-imessage` fork.
- `CHROME_DEVTOOLS` backed by the official `chrome-devtools-mcp@0.24.0`
npm/npx package.
  - `PEEKABOO` backed by upstream Peekaboo CLI.
- Remove generated native executables from git: Beeper and Peekaboo
binaries are now ignored, pinned via git submodules, and generated
during CLI binary release jobs.
- Update CLI binary workflow so Linux artifacts skip native sidecars,
while macOS artifacts run on macOS runners and build only the matching
`darwin-x64` or `darwin-arm64` Beeper/Peekaboo sidecars before
packaging.

## Native binary policy
- No generated `imessage-cli` or `peekaboo` binary blobs are committed
in this PR history.
- Beeper source is pinned as
`ts/packages/cli-local-tools/vendor/platform-imessage` at
`364445a1b3089ad9fe293d5951efe160c5677c42` from
`https://github.com/ComposioHQ/platform-imessage`.
- Peekaboo source is pinned as
`ts/packages/cli-local-tools/vendor/peekaboo` at
`31e66e8d02656141d18f60bf3b46b24c2b9bc785` from
`https://github.com/steipete/Peekaboo`.
- Build commands:
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-x64`
- Chrome DevTools is an npm/npx integration and is pinned as a dev
dependency (`chrome-devtools-mcp@0.24.0`) instead of using native
sidecars.

## Validation
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `COMPOSIO_REAL_LOCAL_TOOLS_TESTS=1 pnpm --filter
@composio/cli-local-tools test -- src/toolkits/beeper-imessage.test.ts
src/toolkits/peekaboo.test.ts`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build`
- `COMPOSIO_CACHE_DIR=<tmp-config-with-local_tools-enabled> bun
ts/packages/cli/dist/bin.mjs local-tools doctor --json`
- `pnpm turbo build`
- Verified rewritten branch has no >1MB objects relative to
`origin/next` and no native executable paths in the PR diff.

## Notes / risks
- Beeper iMessage and Peekaboo are macOS-only and depend on local
permissions.
- Peekaboo requires macOS 15+; GUI tools require Screen Recording,
Accessibility, and sometimes Automation.
- Beeper send/reaction behavior can still depend on upstream Messages
automation reliability.
- Chrome DevTools can inspect/modify browser contents; avoid sensitive
browser sessions.
 2026-05-05 00:10:38 -07:00
Dhawal Upadhyay fed23cdc56 fix(tool-router): use generated execute offload params 2026-04-30 17:52:44 +05:30
jkomyno cc673b654c fix(mastra): resolve $ref in tool schemas before applyCompatLayer [PLEN-2244] 
Composio tools whose JSON Schema uses internal `$ref` pointers (`#/$defs/...`
or the legacy `#/definitions/...`) used to lose all type information when
wrapped by `MastraProvider.wrapTool`. The schema went through:

  raw JSON Schema (with $ref) → applyCompatLayer
    → convertSchemaToZod  (silently drops $ref, becomes a permissive anyOf)
    → zodToJsonSchema     (no way to recover the lost types)

Customers reported this surface as "schema validation error: can't resolve
reference" — AJV (bundled inside @mastra/schema-compat) refusing to compile
the schema downstream when validating tool input.

Fix: pre-process the schema with a new `dereferenceJsonSchema` helper before
handing it to `applyCompatLayer`. The helper:

- walks the schema reflectively (no JSON-Schema-keyword allow-list, so future
  applicators are covered automatically),
- inlines internal `$ref` pointers transitively, with a 100-hop depth cap,
- shallow-merges sibling keywords next to `$ref` per Draft 2020-12 semantics
  (siblings win on collision — preserves caller's `description`/`default`),
- breaks cycles with `{ type: 'object', additionalProperties: true }`,
  matching upstream guidance in mastra-ai/mastra#15341,
- strips `$defs`/`definitions` from the returned root once everything
  reachable is inlined,
- leaves external (`http://`/`https://`) `$ref` pointers untouched,
- throws `JsonSchemaRefResolutionError` on malformed pointers, missing
  targets, or chains over the cap.

Bumps the `@mastra/schema-compat` dependency floor to `^1.2.9` so users also
pick up upstream PR #15400's recursive-`$ref` handling.

The new red regression tests (committed in 5300bf8ba) now pass.
 2026-04-30 01:33:30 +02:00
Zen Agent 1c3276ba8d feat(sdk): add workbench sandbox compute tier (sandboxSize / sandbox_size) 
Expose `workbench.sandboxSize` (TypeScript) / `workbench.sandbox_size`
(Python) on `ToolRouter.create()` so callers can pick the workbench
sandbox compute tier (`standard`, `medium`, `large`, `xlarge`).
Optional; the server defaults to `standard` (1 vCPU / 1 GB) when
omitted, so existing callers keep current behavior.

- Bump stainless clients to pick up the field on the wire:
  - `@composio/client` 0.1.0-alpha.66 -> 0.1.0-alpha.67
  - `composio-client` 1.33.0 -> 1.34.0
- TS: extend `ToolRouterCreateSessionConfigSchema.workbench` with
  `sandboxSize` and forward it as snake_case `sandbox_size`. Export
  `SandboxSize` type and `SandboxSizeSchema` zod enum.
- Python: extend `ToolRouterWorkbenchConfig` TypedDict with
  `sandbox_size` and forward it on the create payload. Export
  `SandboxSize` literal alias.
- Changeset: `@composio/core` patch.
- Tests: cover the snake_case forwarding and zod enum rejection.

Docs (Configuring Sessions / Workbench / changelog) are split into a
separate PR so they can land alongside the SDK release.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-28 11:47:42 +00:00
Alberto Schiabel a10288aa87 fix(core): restore session.toolkits() pagination (#3193) 2026-04-16 12:02:23 -07:00
Rahul Tarak 08eccb85de feat(cli): migrate API key storage from plaintext to OS keyring (#3202) 
## Summary

- Wire `@composio/cli-keyring` into `ComposioUserContext` so the API key
lives in the macOS Keychain / Linux Secret Service instead of plaintext
`~/.composio/user_data.json`
- **Read precedence**: env var (`COMPOSIO_USER_API_KEY`) > OS keyring >
legacy plaintext
- **One-shot migration**: on first run after upgrade, if the keyring is
empty but `user_data.json` has an `api_key`, copy it to the keyring and
strip it from JSON
- **In-process memoization**: keyring read happens once at layer build
(~1.4ms), held in closure for the rest of the process
- **`dangerouslySaveApiKeyInUserConfig`**: opt-in escape hatch in
`~/.composio/config.json` for headless Linux / containers / CI where the
keyring is unavailable
- **`ctx.data` is now a getter**: fixes a pre-existing bug where
mutations via `login()`/`update()` were invisible through the stale
snapshot
- **In-memory mock keyring** for test isolation — tests never touch the
real keychain

## Files changed

| file | what |
|---|---|
| `ts/packages/cli/package.json` | Add `@composio/cli-keyring` workspace
dep |
| `ts/packages/cli/src/models/cli-user-config.ts` |
`dangerously_save_api_key_in_user_config` schema field |
| `ts/packages/cli/src/services/cli-user-config.ts` | Surface new field
on `CliUserConfigResolved` |
| `ts/packages/cli/src/services/user-context.ts` | Keyring-first
read/write/migrate/fallback chain |
| `ts/packages/cli/src/cli-main.ts` | Wire `KeyringLive` into layer
composition |
| `ts/packages/cli-keyring/src/stores/macos-security-ffi.ts` | Fix:
writes via subprocess `-A`, cleanup dead ACL builder code, add base64
encoding |
| `ts/packages/cli/test/__utils__/services/test-layer.ts` | In-memory
mock keyring for test isolation |
| `ts/packages/cli/test/src/commands/login.cmd.test.ts` | Update
assertion: api_key no longer in JSON after login |

## Verified end-to-end

```
$ ./dist/composio version
INFO: Composio API key migrated from user_data.json to the OS keyring
0.2.22

$ cat ~/.composio/user_data.json   # no api_key
{"base_url":"...","web_url":"...","org_id":"...","test_user_id":"..."}

$ # Rebuild binary (new hash) → read from keychain → no dialog
$ ./dist/composio whoami
{"email":"rahul@composio.dev",...}
```

## Test plan

- [x] 676 CLI tests passing (676 passed, 1 skipped)
- [x] Login test updated: asserts `api_key` absent from JSON + present
via `ctx.data.apiKey`
- [x] In-memory mock keyring — no real keychain access in tests
- [x] Binary build + FFI roundtrip verified
- [x] Rebuild with new hash → no keychain dialog (allow-any ACL via
`-A`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

**Stack: 2/2** — base PR: `cli/keyring-package` (#3201)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-14 00:13:41 -07:00
Rahul Tarak 9d7cf5aca2 feat(cli-keyring): add @composio/cli-keyring package (#3201) 
## Summary

- Cross-platform OS credential storage package for the Composio CLI,
structurally modeled on
[keyring-rs](https://github.com/open-source-cooperative/keyring-rs)
- **macOS FFI backend**: direct `SecItemCopyMatching` via `bun:ffi` —
**~1.4ms median reads** (vs 22ms subprocess). Writes delegate to
`/usr/bin/security -A` for reliable allow-any ACL
- **macOS subprocess fallback**: `/usr/bin/security` for Node/test
environments
- **Linux backend**: `secret-tool` subprocess with keyring-rs-compatible
attribute keys (`{service, username, target}`)
- All pointers as `bigint` (`FFIType.u64`) to handle CoreFoundation
tagged pointers above `2^53`
- `b64:` prefix encoding for cross-backend binary safety
- 11-variant `KeyringError` discriminated union matching
`keyring-core`'s error model
- Effect.ts integration via `@composio/cli-keyring/effect` subpath
export (optional peer dep)
- `dangerouslySaveApiKeyInUserConfig` escape hatch designed for the CLI
migration PR (next in stack)

## Benchmark (100 iterations, Apple Silicon)

| operation | subprocess | FFI | speedup |
|---|---|---|---|
| `getPassword` p50 | 19.95ms | **1.14ms** | **18×** |
| `getPassword` p99 | 88.72ms | **7.39ms** | **12×** |

## Test plan

- [x] 16 unit tests (errors, entry, shared encoding) — Node vitest
- [x] 4 E2E tests against real macOS keychain — gated on
`COMPOSIO_KEYRING_E2E=1`
- [x] 6 FFI-specific tests — gated on `typeof Bun !== 'undefined'` + E2E
flag
- [x] `publint` + `attw` clean
- [x] `bun build --compile` produces working standalone binary with FFI
reads

🤖 Generated with [Claude Code](https://claude.com/claude-code)

**Stack: 1/2** — next PR: `cli/keyring-migration` (wires this into the
CLI)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 23:55:30 -07:00
abir 7166c8e42d fix: regenerate lockfile with pnpm 10.28.0 and fix ruff formatting 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-authored-by: Zen Agent <zen@composio.dev>
 2026-04-10 02:18:23 +00:00