mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/cli@0.3.3-beta.340
313 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 jkomyno
|
3c4c025aff | fix(deps): patch undici audit vulnerability | ||
|
jkomyno
|
86cc3cc399 | chore: merge next into dependabot remediation | ||
|
jkomyno
|
9a6d59326f |
Merge branch 'next' into feat/installer-auto-shell-default
Keeps this branch's fixture-driven managed-block reconciler (reconcileManagedPathBlock, pinned byte-for-byte against install.sh's awk rewrite by test/managed-block-fixtures) and drops next's narrower replaceManagedPathBlock/applyFileChanges pair, which it supersedes. Adopts from next: the narrowed unsafe-path character set on both the TS and sh sides, the removal of the $PATH-reachability write skip, the hedged no-shell PATH message, and the COMPOSIO_BIN_DIR command documentation. |
||
|
jkomyno
|
aaa3830f35 | Merge remote-tracking branch 'origin/next' into feat/mise-style-installer-rollout | ||
|
jkomyno
|
fdb366d090 |
Merge branch 'feat/cli-install-shell-flag' into feat/mise-style-installer-rollout
# Conflicts: # install.sh # test/install-sh-release-resolution.test.sh # ts/packages/cli/test/__utils__/services/test-layer.ts # ts/packages/cli/test/src/commands/install.cmd.test.ts |
||
|
dependabot[bot]
|
02c7af88ae |
chore(deps): bump hono from 4.12.31 to 4.12.34 in the npm-security group across 1 directory (#4051)
Bumps the npm-security group with 1 update in the / directory: [hono](https://github.com/honojs/hono). Updates `hono` from 4.12.31 to 4.12.34 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/hono/releases">hono's releases</a>.</em></p> <blockquote> <h2>v4.12.34</h2> <h2>Security fixes</h2> <p>This release includes fixes for the following security issues:</p> <h3><code>memo()</code> retains SSR output across requests, leading to cross-user data disclosure</h3> <p>Affects: <code>hono/jsx</code> (server-side rendering). Fixes <code>memo()</code> reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — <code>useContext()</code>, <code>useRequestContext()</code>, or <code>getContext()</code> — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r</p> <h3>ReDoS in CORS middleware via <code>Access-Control-Request-Headers</code></h3> <p>Affects: <code>hono/cors</code>. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the <code>Access-Control-Request-Headers</code> preflight header when <code>allowHeaders</code> is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239</p> <h3>Algorithmic complexity DoS in Language Middleware</h3> <p>Affects: <code>hono/language</code>. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or <code>Accept-Language</code> header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4</p> <h3>Proxy Helper does not remove response headers listed in the <code>Connection</code> header</h3> <p>Affects: <code>hono/proxy</code>. Fixes <code>proxy()</code> forwarding response headers that the origin's <code>Connection</code> header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9</p> <hr /> <p>Users who use <code>hono/jsx</code> for server-side rendering, <code>hono/cors</code>, <code>hono/language</code>, or <code>hono/proxy</code> are strongly encouraged to upgrade to this version.</p> <h2>v4.12.33</h2> <h2>What's Changed</h2> <ul> <li>fix(cookie): relax name validation when parsing Cookie header in <a href="https://redirect.github.com/honojs/hono/pull/5164">honojs/hono#5164</a></li> <li>chore: bump <code>@hono/node-server</code> in <a href="https://redirect.github.com/honojs/hono/pull/5167">honojs/hono#5167</a></li> <li>fix(jsx): handle useSyncExternalStore subscription and snapshot changes in <a href="https://redirect.github.com/honojs/hono/pull/5166">honojs/hono#5166</a></li> <li>chore: remove undici in favor of global fetch in <a href="https://redirect.github.com/honojs/hono/pull/5168">honojs/hono#5168</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.32...v4.12.33">https://github.com/honojs/hono/compare/v4.12.32...v4.12.33</a></p> <h2>v4.12.32</h2> <h2>What's Changed</h2> <ul> <li>ci: enable reports for type & bundle size check in <a href="https://redirect.github.com/honojs/hono/pull/5148">honojs/hono#5148</a></li> <li>fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in <a href="https://redirect.github.com/honojs/hono/pull/5142">honojs/hono#5142</a></li> <li>fix(sse): emit empty id field to reset Last-Event-ID in <a href="https://redirect.github.com/honojs/hono/pull/5138">honojs/hono#5138</a></li> <li>test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in <a href="https://redirect.github.com/honojs/hono/pull/5145">honojs/hono#5145</a></li> <li>fix: use <code>Object.create(null)</code> when parsing query, headers, and params in <a href="https://redirect.github.com/honojs/hono/pull/5161">honojs/hono#5161</a></li> <li>fix(secure-headers): keep CSP callbacks scoped to their header in <a href="https://redirect.github.com/honojs/hono/pull/5147">honojs/hono#5147</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.32">https://github.com/honojs/hono/compare/v4.12.31...v4.12.32</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/hono/commit/734755ace341607628219ea1dd8ca17f01bf1a5c"><code>734755a</code></a> 4.12.34</li> <li><a href="https://github.com/honojs/hono/commit/9839ff32a349bf088b6ddfa604010879dd2d3a05"><code>9839ff3</code></a> chore: update <code>bun.lock</code> (<a href="https://redirect.github.com/honojs/hono/issues/5182">#5182</a>)</li> <li><a href="https://github.com/honojs/hono/commit/0c45036d6b0ddf42ab2fa44639dc8710825d5c0f"><code>0c45036</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/720b566290793d4358bf39843adcb7cf4da4548f"><code>720b566</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/f70e2c31684387b3231cc38512a31df6ca76a1c7"><code>f70e2c3</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5"><code>93fc250</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/hono/commit/51db3131d5e97076327edaa0afdb60ebb77c264f"><code>51db313</code></a> 4.12.33</li> <li><a href="https://github.com/honojs/hono/commit/aed146364d5c48a8336b8c82fedfabebf8063d07"><code>aed1463</code></a> chore: remove undici in favor of global fetch (<a href="https://redirect.github.com/honojs/hono/issues/5168">#5168</a>)</li> <li><a href="https://github.com/honojs/hono/commit/224d2f5cbf2b4bc2ebb7482d0592149a8d9f0574"><code>224d2f5</code></a> fix(jsx): handle useSyncExternalStore subscription and snapshot changes (<a href="https://redirect.github.com/honojs/hono/issues/5166">#5166</a>)</li> <li><a href="https://github.com/honojs/hono/commit/df653cea0450657977887d56a5188368387456c8"><code>df653ce</code></a> chore: bump <code>@hono/node-server</code> (<a href="https://redirect.github.com/honojs/hono/issues/5167">#5167</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/hono/compare/v4.12.31...v4.12.34">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ComposioHQ/composio/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
f7a4503bbe |
fix(deps): clear high-severity TypeScript audit findings (#4050)
This PR: - follows up on the failed TypeScript audit in https://github.com/ComposioHQ/composio/pull/4048 - adds patched transitive floors for `fast-uri`, `ip-address`, and `brace-expansion` - refreshes `pnpm-lock.yaml` to resolve 3.1.5, 10.4.0, and 5.0.9 respectively - clears all high-severity findings from `pnpm audit --prod --audit-level=high`; one low and one moderate advisory remain below the gate - verifies the affected CLI dependency graph with a frozen install, package build, and 1,072 passing tests (1 skipped) |
||
|
jkomyno
|
611f4e648a | fix(deps): restore Workers-compatible Mastra | ||
|
jkomyno
|
7198144863 | fix(e2e): restore runtime compatibility coverage | ||
|
jkomyno
|
e5c9adabc8 | chore(deps): migrate OpenAI runtime to v7 | ||
|
jkomyno
|
a8d7401b73 | test(openai): cover v6 and v7 consumers | ||
|
jkomyno
|
4ceaede87a | chore(deps): refresh runtime support dependencies | ||
|
jkomyno
|
d1c2e12e33 | chore(deps): refresh agent framework dependencies | ||
|
jkomyno
|
32fdddd197 | chore(deps): align AI SDK dependencies | ||
|
jkomyno
|
a59a409204 | chore(cli): align Effect dependencies | ||
|
jkomyno
|
a850f2c1c1 | chore(deps-dev): refresh development tooling | ||
|
Alberto Schiabel
|
51056129ee |
fix(core): detect filesystem case sensitivity for uploads (#4036)
This PR: - fixes #4024 - supersedes #4025 with target-filesystem detection instead of unconditional case folding - uses `is-fs-case-sensitive` on the nearest existing directory so mixed mounts and case-sensitive filesystem configurations are handled correctly - preserves exact matching on case-sensitive filesystems and falls back to conservative case-insensitive matching when detection fails - keeps Node-only detection behind `#platform` and mirrors its runtime dependency in `@composio/slim`, preserving the workerd-safe bundle and Slim import - adds focused Node, workerd, and matcher regressions plus an `@composio/core` patch changeset - verifies 1,044 core tests, five CLI upload tests, the Slim build/import smoke, typecheck, build, ATTW, publint, lint, formatting, frozen install, and changeset validation |
||
|
jkomyno
|
cf9223879e | test(cli): cover upgrading a running binary | ||
|
jkomyno
|
dadd2f4471 | test(cli): add hermetic installer e2e coverage | ||
|
Kshitij Jhunjhunwala
|
fc9745040a |
feat(cli): make headless composio login agent-friendly (PRDE-1138) (#3945)
## What Closes the PRDE-1138 gap: an unattended agent hitting plain `composio login` in a pipe dead-ended at browser OAuth. Now the default headless path either completes unattended or tells the agent exactly what to run — without ever auto-creating an account for a human. - **Offer**: non-interactive login instructions gain a second hint — "For unattended agents: run `composio login --agent`" — alongside the existing URL + `composio login --poll` flow. - **Perform (reuse only)**: when `~/.composio/agent.json` already holds a READY agent identity, plain headless `composio login` completes unattended by reusing it. New `getStoredReadyAgent` in `services/agents.ts` is the reuse-only counterpart of `getOrSignupReadyAgent` — it never falls back to signup. - **Guardrail** (the design constraint from the ticket): account creation stays exclusively behind the explicit `composio login --agent` / `composio signup` commands. A human piping `composio login` with no stored agent identity gets the same URL instructions as before and no account. Asserted at both unit and E2E level (`/api/signup` is never called on the default path). - `install.sh --agent` login now sets `COMPOSIO_CLI_INVOCATION_ORIGIN=installer` for analytics attribution. - Root `.dockerignore`: host `node_modules` (pnpm store symlinks that break outside the host) no longer enter the e2e image build context; without this, e2e images cannot build from a checkout that has run `pnpm install`. ## Verification - `pnpm typecheck` green; `@composio/cli` suite green — 1001 passed, 1 skipped; `validate:boundaries` clean. - New Docker E2E suite `ts/e2e-tests/cli/agent-signin` (10/10) against a mock `agents.composio.dev` (`COMPOSIO_AGENTS_BASE_URL`): unattended nothing→authenticated (`login --agent` then `whoami` in one container), headless-human guardrail (instructions printed, zero signup calls), stored-identity reuse (login completes + whoami reports `account_type: agent`). No real accounts are created. ## Notes - No VHS recordings: the visible change is piped-mode text output, which VHS interactive recordings don't demonstrate. - No changeset by design (`@composio/cli` is Changesets-ignored); human-facing note added to `ts/packages/cli/CHANGELOG.md` under 0.3.0. |
||
|
Alberto Schiabel
|
2b9571b17f |
fix(core): resolve typedoc against the TS6 compiler API (#3972)
This PR: - restores TypeDoc generation after https://github.com/ComposioHQ/composio/pull/3966 by resolving `@composio/core`'s TypeScript dev dependency from `catalog:ts6` - keeps core typechecking on the root TypeScript 7 compiler while TypeDoc receives the TS6 compiler API - documents the additional compiler-API consumer in the shared TypeScript catalog - commits the regenerated `session-files.mdx` output that could not be produced while the workflow was broken - verifies `generate:docs`, `typecheck`, and `build` for `@composio/core` |
||
|
Kshitij Jhunjhunwala
|
fc1460995b |
feat(cli): make headless composio login agent-friendly (PRDE-1138)
Teach non-interactive login to reuse an existing READY agent identity without creating one implicitly. Preserve explicit --no-browser and --no-wait contracts, and branch on TerminalUI.canPrompt so piping stdout alone remains interactive. Add unattended guidance, installer analytics attribution, and focused unit and Docker E2E coverage. Exclude host node_modules from Docker build contexts. |
||
|
Alberto Schiabel
|
f233e46937 |
chore(repo): migrate eslint to oxlint and typecheck to TypeScript 7 (#3966)
This PR: - replaces ESLint with oxlint across the pnpm workspace and the Bun-based docs site, porting the rules to `.oxlintrc.json` / `docs/.oxlintrc.json` with behavior parity (restricted-syntax selectors kept via `oxlint-plugin-eslint`) - migrates typecheck to TypeScript 7 (`typescript@^7.0.2` catalog) and keeps a TS6 pin for JS compiler API consumers via a named `ts6` pnpm catalog (`ts/scripts/validate-examples.ts`, the `@composio/cli` generate pipeline). The CLI's `typescript` dependency rebinds only the compiler-API import — its typecheck still runs the root TS7 `tsc`, since the alias package only ships a `tsc6` bin (documented in `ts/packages/cli/AGENTS.md`) - removes the `paths` mappings that pointed `@composio/core` (and, in `experimental`, `@composio/json-schema-to-zod` plus core-internal `#`-imports) at sibling `src` directories: under TS7, tsdown's tsgo-based dts step emitted stray `.d.ts` files next to those out-of-root sources on every dependent package build. Workspace deps now resolve through their built dist types, which turbo's `dependsOn: ^build` already guarantees exist — and which the deep-path exports (`@composio/core/*`) always used anyway - renames the cli boundary tooling `eslint-boundaries*` → `lint-boundaries*` and hardens the scanner to reject `oxlint-disable` spellings so the disable manifest cannot be bypassed - rewrites inline `eslint-disable` comments to oxlint rule names (comment-only; no runtime changes), and adds **one new** declared boundary: `tool-file-uploads.ts` needs `no-restricted-imports` disabled for `node:crypto` (MD5 for the presigned-upload checksum is not in Web Crypto), because oxlint also catches dynamic `await import()` where ESLint did not. The manifest grows 46 → 47 deliberately - updates CI path filters, `turbo.jsonc` lint inputs, and the docs typescript-check workflow (renamed to "Docs - Lint and TypeScript Validation" since it now lints too); drops `eslint`, `typescript-eslint`, `eslint-config-next`, and `globals` from the dependency graphs - ships no changeset: I built `@composio/core` and `@composio/anthropic` on this branch and on the pre-migration base and diffed the emitted `dist/**/*.d.mts`. The provider output is byte-identical. Core's output is **semantically identical but not byte-identical**: TS7 changes quote style (`"x"` → `'x'`), object-property and union-member ordering in inferred types, and picks equivalent shorter re-export alias paths for five signatures (e.g. `OpenAI.Beta.Threads.Runs.Run` → `OpenAI.Beta.Threads.Run` — verified both names alias the same type in the shipped typings). Chunk-name hashes shift as a consequence. No type gains, losses, or shape changes; `attw` and `publint` pass on the TS7 build ## Context First of a three-PR split of #3958. The type-safety refactors are stacked on this branch and merge after it: - docs: https://github.com/ComposioHQ/composio/pull/3967 - `@composio/core`: https://github.com/ComposioHQ/composio/pull/3968 |
||
|
Alberto Schiabel
|
503b50ab02 |
chore(deps): refresh SDK, Python, and CI dependencies (#3955)
This PR: - splits https://github.com/ComposioHQ/composio/pull/3953 in two: this PR carries every dependency and GitHub Actions bump **except** the docs site, which follows in a stacked PR - consolidates and supersedes Dependabot PRs #3915, #3916, and #3934 through #3942 - adopts TypeScript 7.0.2 for primary compilation while retaining the `@typescript/typescript6` API lane that TypeScript-ESLint still requires, following the upstream side-by-side guidance - refreshes Python core and provider dependencies, lockfiles, and the Ruff 0.16 lint configuration - updates every GitHub Action with a verified newer official release, including majors, while retaining immutable commit SHA pins and migrating setup-uv cache pruning - deletes four per-package `eslint.config.mjs` shims: under ESLint 10 the default per-file config lookup re-anchors the root config's globs into each package, so `pnpm lint` stayed green while the CLI's try/catch, `process.env` and node-builtin bans went unenforced - bounds and documents the new `brace-expansion` and `@hono/node-server` security overrides, raising the `@hono/node-server` floor to 2.0.10 to clear GHSA-9mqv-5hh9-4cgg - preserves intentional compatibility fixtures and lanes for AI SDK 6, Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints ## Context The docs site is a separate Bun workspace with its own `bun.lock` and is not a pnpm workspace member, so the two halves share no lockfile and no build. Splitting them keeps the Fumadocs 11 migration (a breaking API change with real refactoring) reviewable on its own, independently of the mechanical version bumps here. The `brace-expansion` override deliberately spans majors: GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with no 1.x or 2.x backport, so narrowing it to the 5.x line puts `brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and `pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the trade-off it buys is recorded inline in `pnpm-workspace.yaml`. Verified on this branch standalone: `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963 tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`. |
||
|
Alberto Schiabel
|
332cb71214 |
fix(ci): clear dependency audit and cli test failures on next (#3898)
This PR: - bumps the transitive `brace-expansion` resolution to 2.1.2 ([GHSA-3jxr-9vmj-r5cp](https://github.com/advisories/GHSA-3jxr-9vmj-r5cp), high) - adds a scoped `js-yaml` override to `>=4.3.0 <5` ([GHSA-52cp-r559-cp3m](https://github.com/advisories/GHSA-52cp-r559-cp3m), high) — `@redocly/openapi-core@1.34.x` (via `openapi-typescript`) exact-pins vulnerable 4.2.0, so a lockfile bump alone cannot reach the patched version - bumps the existing `protobufjs` override 7.6.3 → 7.6.5 ([GHSA-j3f2-48v5-ccww](https://github.com/advisories/GHSA-j3f2-48v5-ccww), moderate) - leaves the low `@ai-sdk/provider-utils` advisory as-is: the advertised patched version 3.0.98 is not published on npm and `@mastra/core` exact-pins 3.0.25 - aligns `analytics.dispatch.test.ts` mocks with the `spawnDetached` contract from https://github.com/ComposioHQ/composio/pull/3880 (`once('spawn')`/`once('error')` with unref-after-confirmation); the test added in https://github.com/ComposioHQ/composio/pull/3881 still asserted the old fire-and-forget `.on('error')` shape Verified locally: `pnpm audit --prod --audit-level=high` exits 0 (1 low remaining), `pnpm install --frozen-lockfile` passes, and the full `@composio/cli` suite passes (934 tests). <!-- codesmith:footer --> --- <a href="https://app.blacksmith.sh/ComposioHQ/codesmith/composio/pr/3898"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img alt="View with Codesmith" src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a> <a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1787212096&installation_model_id=428187&pr_number=3898&repository=ComposioHQ%2Fcomposio&return_to=https%3A%2F%2Fgithub.com%2FComposioHQ%2Fcomposio%2Fpull%2F3898&signature=9d7662095d47fa89940855b0abb67f014a807b522b81ea780b62f6326dc0e807"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with Codesmith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a> <sup>Need help on this PR? Tag <code>/codesmith</code> with what you need. Autofix is disabled.</sup> <!-- codesmith:autofix:disabled --> <!-- /codesmith:footer --> |
||
|
Alberto Schiabel
|
6d5465acd3 |
refactor(cli): seal the CommandDescriptor seam and drop zod for Schema (#3882)
This PR: - activates the descriptor-seam rule group: `commands/command-introspection.ts` becomes the only module allowed to import `CommandDescriptor`/`Usage` from `@effect/cli` — the redesign seam the Effect CLI v4 migration will reimplement - routes root command assembly, preflight parsing, help routing, and value-option collection through the seam helpers instead of descriptor walks - replaces the Zod-backed tool-input adapter with an internal `@composio/json-schema-to-effect-schema` compiler backed by the eval-free `@cfworker/json-schema` interpreter - normalizes the OpenAPI and Composio extensions accepted by the previous validator, while preserving typed `ToolInputValidationError` failures, field paths, multi-error reporting, and typo suggestions - extends the descriptor and Zod boundaries to reject static imports, dynamic `import()`, and `require()` bypasses - adds compiler parity tests plus CLI regression coverage for multiple simultaneous field and unknown-key failures - introspection tests pin that the helpers yield identical descriptors and usage strings --- **Stack** (re-slice of https://github.com/ComposioHQ/composio/pull/3859; each PR targets its parent and auto-retargets to `next` as parents merge): 1. https://github.com/ComposioHQ/composio/pull/3877 — guidelines + inert rule groups 2. https://github.com/ComposioHQ/composio/pull/3878 — `new Function()` eval security fix 3. https://github.com/ComposioHQ/composio/pull/3879 — behavioral fix pack 4. https://github.com/ComposioHQ/composio/pull/3880 — platform-imports rule + migration 5. https://github.com/ComposioHQ/composio/pull/3881 — terminal-streams rule + TerminalUI boundary 6. https://github.com/ComposioHQ/composio/pull/3882 — descriptor seam + Zod→Schema ← **this PR** 7. https://github.com/ComposioHQ/composio/pull/3883 — test-tree lint + deterministic suites 8. https://github.com/ComposioHQ/composio/pull/3884 — typed error boundaries + v4 seams 9. https://github.com/ComposioHQ/composio/pull/3885 — try/catch+env ban + boundary ratchet On stacked bases CI runs lint/build and the CLI Docker e2e job; unit tests and typecheck are verified locally per PR and re-verified by full CI when each PR is retargeted to `next`. |
||
|
Alberto Schiabel
|
2dc9ef34d0 |
fix(cli): remove new Function() eval from JSON-ish input parsing (#3878)
This PR:
- removes an in-process arbitrary-code-execution surface:
`parse-json-ish.ts` fell back to `Function("return (…)")()` for any
`tools execute --data`, `listen --params`, or `proxy` body value that
failed JSON and comment-JSON parsing — the CLI is agent-facing and
`--data` also accepts `@file` and stdin, so crafted or prompt-injected
input reached the eval
- lands the parser in its final consolidated shape:
`src/utils/parse-json.ts` parses JSON5 (unquoted keys, single quotes,
trailing commas, comments) without evaluating anything and returns
`Either` with a typed `JsonParsingError`
- consolidates the `effect-errors` read-json duplicates onto the same
parser and swaps `comment-json` for `json5` (the stack's only lockfile
change)
- pins code-execution probes in unit tests (`new Date()`, computed
expressions, `globalThis` writes are rejected, never evaluated)
- intentional narrowing: JS expressions such as `1+1` that only worked
because of the eval now fail with a parse error; proxy bodies that are
not JSON5 records fall back to the raw string
---
**Stack** (re-slice of https://github.com/ComposioHQ/composio/pull/3859;
each PR targets its parent and auto-retargets to `next` as parents
merge):
1. https://github.com/ComposioHQ/composio/pull/3877 — guidelines + inert
rule groups
2. https://github.com/ComposioHQ/composio/pull/3878 — `new Function()`
eval security fix ← **this PR**
3. https://github.com/ComposioHQ/composio/pull/3879 — behavioral fix
pack
4. https://github.com/ComposioHQ/composio/pull/3880 — platform-imports
rule + migration
5. https://github.com/ComposioHQ/composio/pull/3881 — terminal-streams
rule + TerminalUI boundary
6. https://github.com/ComposioHQ/composio/pull/3882 — descriptor seam +
zod→Schema
7. https://github.com/ComposioHQ/composio/pull/3883 — test-tree lint +
deterministic suites
8. https://github.com/ComposioHQ/composio/pull/3884 — typed error
boundaries + v4 seams
9. https://github.com/ComposioHQ/composio/pull/3885 — try/catch+env ban
+ boundary ratchet
On stacked bases CI runs lint/build and the CLI Docker e2e job; unit
tests and typecheck are verified locally per PR and re-verified by full
CI when each PR is retargeted to `next`.
|
||
|
Alberto Schiabel
|
9498679c26 |
fix(release): guard and document CLI releases (#3895)
This PR: - removes the stale `@composio/cli` changeset that wedges `changesets/action` and preserves its release note in the CLI changelog - adds `validate:changesets` before the TypeScript release action and covers ignored-package changesets in the release regression suite - makes the guard read changeset files directly so it also works in shallow and detached CI checkouts - refreshes `mise.lock` after the pinned Python standalone artifacts moved to the 20260718 build - adds the repo-local `cli-release` skill with beta, stable-promotion, verification, and failure-recovery procedures - replaces the contradictory "stable via changeset" contributor guidance with the tested-beta promotion path - extends skill taxonomy, routing probes, and PR path filters so the guard cannot silently drift ## Regression coverage The validator test creates a changeset fixture outside a Git repository, verifies that an ignored CLI package is rejected, then verifies that a normal package changeset passes. This reproduces the shallow-checkout failure without relying on a local `next` ref. ## Verification - `pnpm validate:agent-skills` - `pnpm validate:skill-routing` - `pnpm validate:changesets` - `pnpm test:release-workflow` - `pnpm lint` - `pnpm install --frozen-lockfile` - all 24 TypeScript package test tasks - skill-creator `quick_validate.py` - Prettier check - `git diff --check` - manual beta release [`@composio/cli@0.2.33-beta.294`](https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.2.33-beta.294): 33/33 release and installation jobs passed |
||
|
Kshitij Jhunjhunwala
|
d583e7ef6f | fix(cli): harden plugin setup installation | ||
|
dependabot[bot]
|
09aab1d19f |
chore(deps-dev): bump the npm-development group across 1 directory with 3 updates (#3795)
Bumps the npm-development group with 3 updates in the / directory: [turbo](https://github.com/vercel/turborepo), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [typedoc](https://github.com/TypeStrong/TypeDoc). Updates `turbo` from 2.10.2 to 2.10.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.10.4</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.10.3 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13222">vercel/turborepo#13222</a></li> <li>ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13240">vercel/turborepo#13240</a></li> <li>perf: Use mimalloc as the global allocator by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13237">vercel/turborepo#13237</a></li> <li>perf: Parse yarn v1 lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13241">vercel/turborepo#13241</a></li> <li>ci: Fix cache outputs for Eve app by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13243">vercel/turborepo#13243</a></li> <li>perf: Stop materializing spans for the disabled daemon log layer by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13244">vercel/turborepo#13244</a></li> <li>fix: Keep ancestor-scoped bun dependencies resolvable after prune renames by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13236">vercel/turborepo#13236</a></li> <li>perf: Overlap external dependency hashing with package file hashing by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13234">vercel/turborepo#13234</a></li> <li>perf: Build tracked repo index concurrently with package graph by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13232">vercel/turborepo#13232</a></li> <li>perf: Release tokio runtime at exit so background DNS lookups never stall the user by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13231">vercel/turborepo#13231</a></li> <li>perf: Overhaul pnpm lockfile parsing and dependency closure computation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13228">vercel/turborepo#13228</a></li> <li>feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13227">vercel/turborepo#13227</a></li> <li>feat: Introduce toolchain provider abstraction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13235">vercel/turborepo#13235</a></li> <li>perf: Parse Berry lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13242">vercel/turborepo#13242</a></li> <li>fix: Apply input exclusion globs to the filesystem walk by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13224">vercel/turborepo#13224</a></li> <li>fix: Stop root-directory packages from claiming every file in change mapping by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13225">vercel/turborepo#13225</a></li> <li>chore: Rename turborepo-repository napi package to <code>@turbo/repository</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13226">vercel/turborepo#13226</a></li> <li>perf: Hash git blobs with hardware-accelerated SHA-1 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13245">vercel/turborepo#13245</a></li> <li>release(turborepo): 2.10.4-canary.1 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13247">vercel/turborepo#13247</a></li> <li>feat: Discover Cargo crates as packages by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13248">vercel/turborepo#13248</a></li> <li>perf: Reuse per-package external dependency hashes in run summaries by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13249">vercel/turborepo#13249</a></li> <li>perf: Stat workspace turbo.json files concurrently during discovery by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13251">vercel/turborepo#13251</a></li> <li>chore: Add tracing spans to workspace discovery and globwalk phases by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13252">vercel/turborepo#13252</a></li> <li>fix: Avoid non-reentrant libc calls in concurrent shutdown process scans by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13256">vercel/turborepo#13256</a></li> <li>perf: Memoize resolved task definitions during engine construction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13257">vercel/turborepo#13257</a></li> <li>perf: Compute transitive closures and external dependency hashes concurrently with run setup by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13250">vercel/turborepo#13250</a></li> <li>perf: Probe microfrontends configs in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13262">vercel/turborepo#13262</a></li> <li>feat: Execute Cargo crate tasks via cargo by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13261">vercel/turborepo#13261</a></li> <li>perf: Pre-size engine task collections by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13265">vercel/turborepo#13265</a></li> <li>feat: Expose resolved experimentalCI task configuration in <code>turbo query</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13264">vercel/turborepo#13264</a></li> <li>feat: Derive input and output globs for Cargo tasks by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13263">vercel/turborepo#13263</a></li> <li>perf: Parse large pnpm lockfile sections in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13266">vercel/turborepo#13266</a></li> <li>feat: Hash Cargo external dependencies per-crate by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13267">vercel/turborepo#13267</a></li> <li>ci: Install pnpm 10 in musl containers for Library Release by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13269">vercel/turborepo#13269</a></li> <li>ci: Force pnpm overwrite in Library Release musl containers by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13270">vercel/turborepo#13270</a></li> <li>perf: Defer the untracked-scan barrier to first file-hash use by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13268">vercel/turborepo#13268</a></li> <li>ci: Fetch API-created commit before updating local ref by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13271">vercel/turborepo#13271</a></li> <li>release(library): 0.0.1-canary.22 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13272">vercel/turborepo#13272</a></li> <li>perf: Remove lock and dispatch overhead from task hash precomputation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13273">vercel/turborepo#13273</a></li> <li>fix: Fall back to lockfile detection in <code>@turbo/repository</code> when package manager is undeclared by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13275">vercel/turborepo#13275</a></li> <li>test: Add end-to-end coverage for Cargo workspaces by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13274">vercel/turborepo#13274</a></li> <li>release(library): 0.0.1-canary.23 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13276">vercel/turborepo#13276</a></li> <li>release(turborepo): 2.10.4-canary.2 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13278">vercel/turborepo#13278</a></li> <li>fix: Collapse nested package-manager fallback conditional by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13279">vercel/turborepo#13279</a></li> <li>feat: Make turbo watch Cargo-aware by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13280">vercel/turborepo#13280</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/1506a114e377dd7e1e8e7a7863c42adf94a9f776"><code>1506a11</code></a> publish 2.10.4 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/11a68c705274cc7a408776b576ce7a9e14d6e6df"><code>11a68c7</code></a> fix: Stop flagging relative imports that resolve into node_modules in boundar...</li> <li><a href="https://github.com/vercel/turborepo/commit/947b4784cd1b254e62b663bbdb22891a849b7442"><code>947b478</code></a> fix: Raise the open-file soft limit at startup (<a href="https://redirect.github.com/vercel/turborepo/issues/13282">#13282</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ddc584d788349fc3668e280286f540feee4eb6b9"><code>ddc584d</code></a> feat: Make turbo prune Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13281">#13281</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ff0d50822314c5b388d9b4daa9c6159387752d95"><code>ff0d508</code></a> perf: Skip dependency-closure assembly for toolchains that derive nothing (<a href="https://redirect.github.com/vercel/turborepo/issues/1">#1</a>...</li> <li><a href="https://github.com/vercel/turborepo/commit/39d623e1323ef50e06be0a103082ae29cc545779"><code>39d623e</code></a> feat: Make turbo watch Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13280">#13280</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/af01fdfeb5efe07a7b6843a0b8f5033b59ebbb2c"><code>af01fdf</code></a> fix: Collapse nested package-manager fallback conditional (<a href="https://redirect.github.com/vercel/turborepo/issues/13279">#13279</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/7e02f94f647cb4d527a438313dc4adbe3e8c0df3"><code>7e02f94</code></a> release(turborepo): 2.10.4-canary.2 (<a href="https://redirect.github.com/vercel/turborepo/issues/13278">#13278</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/8e3a59fdb6c71ad24fbbb363db52f88eb9a89116"><code>8e3a59f</code></a> release(library): 0.0.1-canary.23 (<a href="https://redirect.github.com/vercel/turborepo/issues/13276">#13276</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ce18f0a79eb49e9a22c7e6cfa491777c24ed746a"><code>ce18f0a</code></a> test: Add end-to-end coverage for Cargo workspaces (<a href="https://redirect.github.com/vercel/turborepo/issues/13274">#13274</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.10.2...v2.10.4">compare view</a></li> </ul> </details> <br /> Updates `typescript-eslint` from 8.62.1 to 8.63.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's releases</a>.</em></p> <blockquote> <h2>v8.63.0</h2> <h2>8.63.0 (2026-07-06)</h2> <h3>🚀 Features</h3> <ul> <li><strong>eslint-plugin:</strong> [no-misused-promises] detect async usage of a sync dispose usage (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12426">#12426</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12447">#12447</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12446">#12446</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12491">#12491</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12485">#12485</a>)</li> <li><strong>eslint-plugin:</strong> [no-base-to-string] don't flag a shadowed String() call (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12492">#12492</a>)</li> <li><strong>scope-manager:</strong> export ClassStaticBlockScope (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12460">#12460</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Evyatar Daud <a href="https://github.com/StyleShit"><code>@StyleShit</code></a></li> <li>Kristjan <a href="https://github.com/KristjanTammekivi"><code>@KristjanTammekivi</code></a></li> <li>Michael Naumov <a href="https://github.com/mnaoumov"><code>@mnaoumov</code></a></li> <li>Serhii Leniv <a href="https://github.com/Serhii-Leniv"><code>@Serhii-Leniv</code></a></li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's changelog</a>.</em></p> <blockquote> <h2>8.63.0 (2026-07-06)</h2> <p>This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374"><code>290cf6c</code></a> chore(release): publish 8.63.0</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint">compare view</a></li> </ul> </details> <br /> Updates `typedoc` from 0.28.19 to 0.28.20 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/TypeDoc/releases">typedoc's releases</a>.</em></p> <blockquote> <h2>v0.28.20</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md">typedoc's changelog</a>.</em></p> <blockquote> <h2>v0.28.20 (2026-07-05)</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/TypeStrong/typedoc/commit/34d843be0953fc81de0fde14bea8db72d0bbccc6"><code>34d843b</code></a> Update changelog for release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/fbd4a254952c171b9ba7ebbe96c5151e844743be"><code>fbd4a25</code></a> Bump version to 0.28.20</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/93ba157000e4a632bfbf32a0b6f00f8ae57c7c99"><code>93ba157</code></a> Update dependencies in example</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/e8c5df8844edca9800dfc62cee9115ef0fba59ea"><code>e8c5df8</code></a> Remove unnecessary files from distribution</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/392b0dd50a428ea0c732c38c6c263e74cb6200b1"><code>392b0dd</code></a> Update dependencies</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/8510dd48c7778f419f4605146f1a733af27993fa"><code>8510dd4</code></a> Add missing entries in changelog before release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/51dc0521890924269f06e08972c6453299f63cb5"><code>51dc052</code></a> Update change log for 0.28.20 release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/72f20cd87b4ef30aae97b68fcbb42ca19cebdc22"><code>72f20cd</code></a> Merge branch 'fix-locale-sort-group-category-titles' into dev</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/623f2c0bd35b5e89cc79fb5783dac01c6f2530e9"><code>623f2c0</code></a> Fix failing test, accept slightly slower build for now</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/c8bdf14cab0c22dd415b6872cc647c6cf81f917c"><code>c8bdf14</code></a> Minor config tweak to improve dev build time</li> <li>Additional commits viewable in <a href="https://github.com/TypeStrong/TypeDoc/compare/v0.28.19...v0.28.20">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4baacbeb77 |
chore(deps): bump the npm-production group across 1 directory with 7 updates (#3799)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
b07fcada3f |
feat(experimental): add Eve provider and iMessage example (#3800)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3642 and credits @shamsharoon for the original Eve provider and iMessage work - rebases the integration onto the current `next` branch and resolves its lockfile conflicts - publishes an isolated `@composio/experimental/eve` entry with the correct Eve 0.12+ peer contract - adds recoverable per-session discovery, native Eve context propagation, and durable approval policies for direct and batched side effects - centralizes circular-safe auth-link extraction across Eve and Pi and replaces dense conditional expressions with named control flow - hardens the iMessage example against `osascript` option injection, unsafe trigger scoping, and third-party prompt injection - preserves completed local-tool results when a mixed local/remote batch loses its remote transport - consolidates the example documentation onto shared components, documents direct model-provider credentials, and clarifies that the browsable source is not yet a standalone fixture - verifies the change with 999 core tests, 32 experimental tests, package builds/typechecks, packed peer-isolation smokes, and a production docs build --------- Co-authored-by: shams haroon <144290365+shamsharoon@users.noreply.github.com> Co-authored-by: shams haroon <shamsharoon7@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: shams haroon <shams@composio.dev> |
||
|
Alberto Schiabel
|
30ba4d2930 |
feat(openai): add executable provider example (#3798)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3790 - makes the OpenAI example executable in direct-tools, Tool Router, smoke, and Cloudflare Workers modes - keeps direct and Tool Router agents in separate files so each execution model is explicit and readable - requires a successful Composio tool execution before either agent can accept a final model response - adds OpenAI to the nightly staging matrix without weakening the existing Mastra coverage - updates two stale experimental OpenAI usages so the complete example package typechecks against current SDK APIs ## Testing - `pnpm --filter openai-example run typecheck` - `pnpm --filter openai-example run lint` (0 errors; 4 pre-existing warnings) - `pnpm --filter openai-example run smoke` (staging: 5 direct tools and 6 Tool Router tools) - `pnpm --filter openai-example run cf:dry-run` - `pnpm run typecheck` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` - `pnpm run typecheck:examples` - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - [branch nightly](https://github.com/ComposioHQ/composio/actions/runs/29079263571): OpenAI and Mastra both passed smoke, direct-tools, and Tool Router against staging ## Post-deploy validation - dispatch `ts.examples-nightly.yml` on `next` after merge and confirm both matrix legs stay green - healthy runs finish within the 20-minute job budget and log successful tool-backed responses for both agent modes - revert this PR if the OpenAI leg blocks the nightly; examples maintainers own the first post-merge run and the next 06:00 UTC schedule --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
76881491d0 |
feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788)
## What Turns the **Mastra** example into an executable reference that doubles as a test, and wires the examples into CI for the first time. First slice of the v1 "executable examples" workstream — the pattern here is the template for the other TS providers, then Python. ## Why Examples under `ts/examples/*` were unverified: the only CI tie-in is `validate-examples.ts`, which is transpile-only (no cross-file types, no lint, no execution) and passes on exactly the schema-conversion regressions we keep hitting in the Mastra provider — all closed but unprotected: - https://github.com/ComposioHQ/composio/issues/2109 (zod→json serialization crash) - https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped while `$ref` kept) - https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema tools crash serialization) ## Changes **Canonical Mastra example** (`ts/examples/mastra`) - `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS` toolkit - `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` → `session.tools()` (drops the deprecated bare `composio.create` alias) - `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers runtime (`export default { fetch }`) - `src/smoke.ts` — deterministic wrapping + tool-router assertions (needs only `COMPOSIO_API_KEY`) - Removed the old Gmail/MCP entries that used deprecated APIs and required auth - Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts` **Real typecheck + lint** (examples previously escaped both) - Example now has a `typecheck` script (Node + Worker tsconfigs); `typecheck:examples` / `lint:examples` scripts added - eslint now covers `ts/examples/**` with type-safety rules kept (`no-explicit-any`) and console noise allowed **Two-tier CI** - `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck → lint → `wrangler deploy --dry-run`. This is the tier that catches the schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces as a **type** error. - `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes against the **staging** backend with secrets; runs the deterministic smoke always and the full agent examples when an LLM key is set. ## Verification Locally against staging: `smoke` passes (5 direct + 6 tool-router tools), `typecheck:examples` and `lint:examples` are green, the Worker `wrangler deploy --dry-run` bundles, and seeded regressions (a type error / an `any`) correctly fail their gate. ## Notes - No changeset — example packages are private/unpublished. - Follow-ups (separate PRs): template the pattern to the other TS providers, then port to `python/examples/*`. |
||
|
Alberto Schiabel
|
72eac88133 |
fix(cli): replace abandoned decompress dependency (GHSA-mp2f-45pm-3cg9) (#3767)
This PR: - replaces `decompress` (unmaintained; the zip-slip fix in the GHSA advisory was never published to npm past 4.2.1) with `extract-zip` across the CLI's four zip-extraction call sites: `install-skill.ts`, `run-companion-modules.ts`, `upgrade-binary.ts`, and `cli-local-tools/bundled-binaries.ts` - `extract-zip` validates each entry resolves inside the target directory before writing, closing the path-traversal issue `pnpm audit` flags as critical - replaces the one `.tgz`-extracting call site (`scripts/_acp-adapters.ts`, used to vendor ACP adapter binaries at build time) with `tar`, since `extract-zip` only handles zip archives - removes `@types/decompress`; both `extract-zip` and `tar` ship their own type definitions - `pnpm audit --prod --audit-level=high` now passes (previously failing on `next`, unrelated to #3766) Verified `extract-zip` and `tar` extract nested directories correctly with a local smoke test (real `.zip`/`.tgz` archives), in addition to the existing `@composio/cli` (724 tests) and `@composio/cli-local-tools` (13 tests) suites passing. |
||
|
Alberto Schiabel
|
58bc93b2d9 |
chore(deps): consolidate dependency updates (#3760)
This PR: - consolidates https://github.com/ComposioHQ/composio/pull/3733, https://github.com/ComposioHQ/composio/pull/3735 through https://github.com/ComposioHQ/composio/pull/3744, and https://github.com/ComposioHQ/composio/pull/3752 - refreshes the pnpm workspace dependencies under the existing `minimumReleaseAge` supply-chain gate - keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare workers types 4 where latest majors conflict with the current workspace - keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the workspace catalog to zod 4 - bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock` - updates the SHA-pinned Claude and Codex workflow actions from the Dependabot action group - adds a patch changeset for the versioned package manifests touched by dependency updates - verifies the rollup with frozen pnpm/uv locks, peer checks, audit threshold checks, typecheck, lint, builds, TypeScript tests, and Python `nox -s chk` ## Context `pnpm audit --prod --audit-level=moderate` passes. The remaining production audit item is a low `@ai-sdk/provider-utils` advisory through Mastra transitive dependencies; forcing it higher would require leaving the compatible stable Mastra dependency path. |
||
|
Alberto Schiabel
|
49e4c11427 |
chore(deps): resolve high prod audit advisories via in-range bumps (#3751)
This PR: - refreshes lockfile resolutions for the 17 high `pnpm audit --prod` advisories via `pnpm update -r` — real version bumps within the ranges parents already declare (minimatch 5/9, lodash, fast-uri, picomatch, langsmith, `@hono/node-server`, express-rate-limit, ws), not resolution overrides - bumps the pre-existing #3467 security pin `protobufjs: 7.5.9 -> 7.6.1` in `pnpm-workspace.yaml` (7.5.9 itself is vulnerable to GHSA unbounded-Any DoS) - adds ONE temporary scoped override, `minimatch@>=10.0.0 <10.2.3 -> >=10.2.3`: `@zed-industries/claude-code-acp@0.16.2` (latest) exact-pins vulnerable `minimatch 10.2.1` and no fixed release exists; commented in the file, drop when upstream ships - no `package.json` changes anywhere: none of the vulnerable packages is a direct dependency of any workspace package, so there is nothing to major-bump on our side ## Context Split out of #3748 (CI hardening) so dependency changes land in isolation. **Merge this before #3748** — its new `pnpm audit --prod --audit-level=high` hard gate needs this green baseline, per the plan's "gate lands together with the dependency fix" rule. Verified: `pnpm audit --prod --audit-level=high` exits 0 (remaining: 1 low, 6 moderate); `pnpm install --frozen-lockfile` passes. Dev-path high advisories (vite, undici, flatted, linkify-it, minimatch 3.x) are out of scope — the gate is `--prod`; tracked as backlog. |
||
|
Alberto Schiabel
|
8d5823be87 |
chore(ci): cache turbo, bun, and uv and cancel superseded pr runs (#3747)
This PR: - adds `concurrency` to the ten PR/push CI workflows: superseded **PR** runs are cancelled, while push runs use a per-run group (`github.run_id`) so every commit on `next`/`master` still gets its own run - caches turbo outputs (`.turbo/cache`) via a new opt-in `enable-turbo-cache` input on the `setup-node-pnpm-bun` composite (keyed per job — concurrent jobs save different task graphs), enabled in `ts.build`, `ts.test`, `ts.typecheck`, and all four `ts.test-e2e` jobs - enables turbo caching for `typecheck`, removes the incorrect `dist/` outputs from `test`, hashes root `tsconfig.base.json` in `build`/`typecheck` inputs, and adds `mise.toml`/`mise.lock` to `globalDependencies` so toolchain bumps bust every task hash (addresses the Bugbot finding) - fixes `@composio/slim`'s build to participate in the turbo graph: core moves to slim's `devDependencies` (published `dependencies` unchanged) and the script no longer shells out to `pnpm --filter @composio/core build`, which raced concurrent dependents by wiping `core/dist` mid-build and double-built core on every cold run — slim's `dist` remains byte-identical to core's; no changeset added since the published artifact is unchanged (say the word if policy wants one anyway) - fixes the `py.test` matrix cache to `~/.cache/uv` (it cached `~/.cache/pip` while installing via `uv pip`) and caches `~/.bun/install/cache` in the five docs workflows - adds `turbo.jsonc` to the TS workflows' path filters (previously unwatched) - release/publish workflows are deliberately untouched Measured (same commit, cold first attempt vs `gh run rerun` warm): ts.build 103s → 53s, ts.test 157s → 55s (`turbo test` 24/24 cached in 182ms), ts.typecheck 80s → 43s; py.test legs save a few seconds each (uv was already fast). Warm floor is checkout + mise + pnpm-install overhead. ## Context Implements `plans/001-ci-speed-caching-and-concurrency.md` from the advisor audit on `docs/sdk-v1-decision-records`. Implementation by codex against the plan, then self-reviewed and counter-reviewed; warm-rerun testing surfaced and fixed three latent issues (toolchain files absent from turbo's hash, first-writer-wins cache-key collision across jobs, and the slim out-of-band core rebuild race). |
||
|
Alberto Schiabel
|
03cb181fdb |
chore(deps): roll up dependency bumps (#3711)
This PR: - rolls up https://github.com/ComposioHQ/composio/pull/3695, https://github.com/ComposioHQ/composio/pull/3696, https://github.com/ComposioHQ/composio/pull/3697, and https://github.com/ComposioHQ/composio/pull/3698 into one dependency-bump branch - updates Python dependency metadata for `langchain-openai`, `pyautogen`, and `crewai` - updates npm production dependency metadata for `zod-to-json-schema`, `openai`, and `@modelcontextprotocol/sdk` - refreshes `uv.lock` and `pnpm-lock.yaml` with the repo-pinned package managers - leaves Changesets unchanged because the touched TS package manifests are private/ignored and no published TS SDK package metadata changes - verified with `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, focused TS builds/tests, clean-worktree `pnpm test:examples`, Python import tests, and Python nox checks - note: local `pnpm build:packages` hit a pre-existing broad-build race around `@composio/slim` rebuilding `@composio/core`; focused dependent builds pass --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
cddd66c3ce |
chore(ts): bump Hono, Mastra, and Chrome deps (#3691)
This PR: - bumps `hono`, `@mastra/core`, and `chrome-devtools-mcp` to their current latest published versions - routes the remaining Cloudflare Tool Router Hono consumer through the workspace catalog - updates the `@composio/mastra` `@mastra/core` peer range and adds a patch changeset - fixes `check-peer-deps` to resolve `semver` through the normal package dependency |
||
|
Alberto Schiabel
|
9ffc696a99 |
feat(vercel): support AI SDK v7 (#3683)
This PR:
- widens the `ai` peer dependency of `@composio/vercel` to `^6.0.0 ||
^7.0.0`, adding AI SDK v7 support and dropping the previously-untested
v5 arm
- adds Docker-based Node e2e compatibility suites for AI SDK v6 and v7
under `ts/e2e-tests/runtimes/node/vercel-ai-sdk-v{6,7}`, auto-discovered
by the existing e2e matrix (so PR CI exercises them)
- each installs the packed `@composio/vercel` tarball, typechecks the
provider against the target `ai` major, and asserts runtime tool
wrapping/execution (object inputs, JSON-string normalization via
`normalizeToolArguments`, `ToolSet` shape)
- the v7 suite additionally exercises v7's `ToolExecutionOptions` passed
to `tool.execute`
- ships a `minor` changeset (the peer-range narrowing removes a
previously-supported major)
- breaking:
- `ai@5` is no longer an accepted peer of `@composio/vercel`; v5
consumers should stay on the prior minor
|
||
|
Rahul Tarak
|
d17a268d3f |
docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637)
Integration branch for the next docs release: a **sessions-first
documentation rewrite** — new and rewritten guides, example pages,
interactive components, and docs tooling — plus the supporting SDK
changes that the new docs describe.
The bulk of this PR is docs (~24k lines across ~150 commits); the SDK
changes (~5k lines) back the new guides.
## Documentation (the bulk)
- **Sessions-first restructure** — reorganized navigation and section
structure (incl. the "Sandbox (prev workbench)" section), with
v3-reorganization redirects so old URLs keep resolving.
- **Rewritten core guides** — quickstart, configuring sessions, triggers
(creating + subscribing to events), proxy-execute, toolkits
enable/disable, and common FAQ, rewritten in the house voice.
- **New example pages** — local-sandbox PR reviewer, daily standup bot,
and slack bot, with runnable build-ups.
- **New interactive components & diagrams** — triggers flow animation,
manage-connections visual, connection-refresh visual, and the
terminal-kit components.
- **Docs tooling** — a docs-graph link-graph connectivity checker,
search reprioritization (deprioritize legacy pages), and SDK-reference
regeneration.
## Supporting SDK changes
**`@composio/core` → 0.13.0 (minor)**
- `composio.sessions.create()` as the first-class sessions API
(`composio.create()` kept as an alias).
- **MCP is opt-in:** default `create()` / `use()` return native-tool
sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface
`session.mcp`. _Migration: read `session.mcp` only after creating with
`{ mcp: true }`._
- `session.sandbox` is the canonical resolved config;
`session.workbench` kept as a deprecated alias. `sandbox` is the
preferred session-config key (`workbench` still accepted).
- `connectedAccounts.updateAcl()` graduated from experimental (alias
kept).
- `triggers.parse()` (parse + optionally verify an incoming webhook) and
`triggers.setWebhookSubscription()`.
**`@composio/experimental` → minor** — local-workbench helpers moved
onto the `@composio/experimental/workbench` subpath (out of
`@composio/core/experimental`), keeping the ~14 KB embedded Python
helper out of core. Plus the experimental Pi provider.
**`@composio/slim` → minor.**
**Python → 0.17.0** — mirrors the TS surface: `composio.sessions` mount
(`tool_router` deprecated), `triggers.parse()` /
`set_webhook_subscription()`, the `sandbox` config key, and
`connected_accounts.update_acl()`.
## Review response (#3664)
Addressed the `@composio/core` review:
- **Security:** `triggers.parse()` no longer fails open — a
present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`)
now throws instead of silently skipping verification; omitting it stays
an explicit opt-out (both SDKs).
- Removed snake_case leakage from `transformWebhookSubscription` (+ the
index signature that allowed it).
- **Removed** the TS-only `connectedAccounts.link()` toolkit
auto-resolve (shipped with cancellability / orphaned-auth-config bugs
and was effectively undocumented; to be reintroduced properly later).
- Unified Python error types on `ValidationError`; added `mcp=True`
Python tests; fixed runtime-portability + error-type test assertions.
- Polished deprecation messages; fixed the backwards `/experimental`
`@deprecated` note and the `SessionWithMcp` JSDoc.
## Testing
- **TS:** `@composio/core` + `@composio/experimental` typecheck pass;
vitest green for the touched suites.
- **Python:** `test_tool_router.py` + `test_triggers.py` pass (161
tests).
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev>
Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Sarah Simionescu <sarah@composio.dev>
Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>
|
||
|
Alberto Schiabel
|
f8cd90ce5a |
chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646)
This PR: - uses plain `tsdown` package scripts and a shared typed `tsdown.config.base.ts` so Node 24 builds work without loader flags - switches the repo dev/build toolchain to Node `24.17.0` and pnpm `11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml` - marks the root package as ESM with `type: module`, matching the TypeScript packages - keeps Node `22.22.3` in the runtime/E2E matrices as the minimum supported user runtime - changes the TypeScript build workflow back to a single build on the mise-managed toolchain and broadens path filters for package-manager/build config files - adds pnpm 11 build-script policy with `allowBuilds` and intentionally ignored `sharp` builds - enables tsdown ESM shims for the packaged CLI wrapper so `composio --help` runs under Node 22 and Node 24 Verified locally: - `CI=true pnpm install --frozen-lockfile` - `pnpm lint` - `pnpm run build:packages` - `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter @e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run test:e2e:node` - `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3` and `24.17.0` |
||
|
Alberto Schiabel
|
23f9053804 |
chore(ts): clean up dependencies and bump toolchain (#3623)
This PR: - consolidates and bumps TypeScript/npm dependencies across the monorepo, docs, examples, and e2e fixtures — no runtime behavior changes - **cleanup:** remove the unused `ansis` dependency from `@composio/cli` (`picocolors` is the actual color lib), drop the dead `uuid` catalog entry, catalog `dotenv` + `@types/bun` and repoint drifting examples/e2e onto them, and replace `chalk` with `picocolors` in `@composio/core` (smaller, ESM, already used by the CLI) - **TypeScript 6:** bump `typescript` `5.9 → 6.0.3` everywhere (catalog, CLI test fixtures, docs); drop vestigial `declaration`/`outDir` from the provider `tsconfig.json`s to fix the TS 6 `rootDir` regression (`TS6059`); add `ignoreDeprecations: "6.0"` in docs for the `baseUrl` deprecation - **toolchain:** `tsdown 0.18 → 0.22.3`, `vitest` + `@vitest/ui → 4.1.9`, `publint → 0.3.21`, `wrangler → 4.101.0` (each the latest version within the 3-day `minimumReleaseAge` gate) - **Effect + hono:** `effect 3.21.3`, `@effect/cli 0.75.2`, `@effect/platform 0.96.1`, `platform-bun 0.90.0`, `platform-node-shared 0.60.0`, `language-service 0.86.2`, `@effect/vitest 0.29.0`, `hono 4.12.25`; pin the Effect peer cohort (`printer`/`printer-ansi`/`typeclass`/`rpc`/`sql`/`cluster`/`experimental`/`workflow`) as `@composio/cli` devDeps so the auto-installed peers resolve coherently, and bump `@cloudflare/workers-types` to satisfy `wrangler`'s peer - changesets: `@composio/cli` patch (ansis removal) and `@composio/core` patch (chalk → picocolors) - verified: `build`, `typecheck` (tsgo + real `tsc` 6.0.3), and local tests (excluding e2e) all pass |
||
|
Alberto Schiabel
|
24e647fa16 |
test(ts/e2e): cover claude agent sdk on node current (#3620)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3495 - adds a Node.js `current` e2e suite for `@composio/claude-agent-sdk` - exercises the packaged provider through Claude Agent SDK `createSdkMcpServer` / `query()` with a deterministic local tool - forwards `ANTHROPIC_API_KEY` through Turbo, Docker e2e env passthrough, and the Node e2e workflow |
||
|
Alberto Schiabel
|
025a657597 |
feat(ts): drop CommonJS support (#3494)
This PR moves the TypeScript SDK support floor to the latest Node.js 22 release and uses that as the point where we stop carrying custom CommonJS compatibility machinery. The e2e runtime coverage now exercises the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested against the minimum supported version and the newer runtimes users are likely to adopt next. Because the SDK packages are still on `0.x`, the accompanying changeset uses `minor` bumps while calling out that this is a breaking change inside the existing 0.x line. It also moves pnpm under mise on this Node 22 layer. That belongs here, not in #3493, because the pinned `pnpm@10.28.2` requires Node.js `>=22.13`. Removing Corepack is intentional: Node.js documents that Corepack is no longer distributed starting with Node.js v25, so relying on `corepack enable` would keep a toolchain dependency that is already on the way out of the Node distribution. ## What changed - Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`, `mise.lock`, `toolchain-versions.json`, and root `devEngines`. - Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise the single source of truth for the pnpm version. Removes the root `packageManager` / `devEngines.packageManager` Corepack pin entirely (rather than keeping a second copy of the version that could drift) and removes stale `packageManager` metadata from real TS packages/examples and generators. - Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a `packageManager` field. Without this, Turbo fails workspace resolution (`Could not resolve workspaces -> Missing 'packageManager' field`), which is the only reason the field would otherwise need to stay. - Replaces `corepack enable` in the shared setup action with mise-managed pnpm. The E2E Docker images install bun + pnpm directly from `mise.toml`/`mise.lock` (with `dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay on the base image as the test matrix axis and are disabled via `MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build args are threaded from the host anymore, and bun+pnpm now carry `mise.lock` checksum verification. - Extends the install-time toolchain check to validate pnpm against mise alongside Bun. - Sets the Node E2E matrix and install fallback checks to `22.22.3`, `24.16.0`, and `25.9.0`. - Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts` only and uses the ATTW `esm-only` profile. - Removes explicit `require` / `.cjs` / `.d.cts` package export paths and internal import mappings from the public TS SDK packages. - Marks public TS SDK packages as `type: module` where they were missing it. - Replaces the remaining runtime `require('pusher-js')` with dynamic ESM import. - Deletes the legacy CJS example. - Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop E2E: it verifies `require('@composio/core')` works through Node's native ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`, not a `.cjs` artifact. - Removes `.cjs` / `.cts` handling from example validation and CLI project-language detection. - Updates provider scaffolding so newly generated providers are ESM-only. - Adds a minor changeset warning that CommonJS callers can only rely on Node's native `require(esm)` interop and that custom CommonJS compatibility machinery is gone. ## Bundled behavior changes Two changes here are technically independent of the CommonJS removal but ride along because they touch the same files and ship in the same release cut. Calling them out explicitly so they are not missed in review: - **`PusherUtils` realtime channel auth (`@composio/core`).** Replacing the runtime `require('pusher-js')` with a dynamic ESM `import()` was done alongside conforming `channelAuthorization` to pusher-js's typed `customHandler(params, callback)` contract. The previous `(authOptions) => Promise` shape did not match pusher-js's actual calling convention — it read `endpoint`/`headers`/`params` off an argument that pusher-js never passes — so this also fixes that latent mismatch. New unit tests (`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name` body) and the success / invalid-JSON / network-failure callback paths. - **CLI meta-tool slug list (`@composio/cli`).** Drops `COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from `META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client` alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']` union. The list is declared `satisfies ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at compile time (`pnpm typecheck`) — keeping the stale slugs would be a type error — and needs no separate runtime test. ## Verification - Verified latest Node 22/24/25 releases from the official Node dist index: `22.22.3`, `24.16.0`, `25.9.0` (https://nodejs.org/dist/index.json). - Verified Node docs state Corepack is no longer distributed starting with Node.js v25: https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html - `mise exec -- pnpm --version` -> `10.28.2` - `mise exec -- pnpm install --frozen-lockfile` - `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts` - `mise exec -- pnpm --filter @e2e-tests/utils typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node` - `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck` - `mise exec -- pnpm --filter @composio/cli typecheck` - `mise exec -- pnpm --filter @composio/cli test -- --runInBand` - `mise exec -- pnpm --filter @composio/core typecheck` - `mise exec -- pnpm --filter @composio/core exec vitest run test/utils/pusher.test.ts` - `mise exec -- pnpm run build:packages` - `mise exec -- turbo run build --dry-run` resolves all workspace packages with no root `packageManager` field (pnpm discovered from `pnpm-lock.yaml`). - `mise exec -- pnpm --filter @composio/cli exec vitest run test/src/services/project-environment-detector.test.ts` - `mise exec -- pnpm exec prettier --check ...` - `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also `Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 / bun 1.3.10 from mise. - `docker manifest inspect node:24.16.0-slim` - `docker manifest inspect node:25.9.0-slim` - `bash -n ts/scripts/create-provider.sh && git diff --check` - `ruby -e "require 'yaml'; YAML.load_file('.github/workflows/ts.test-e2e.yml')"` - Tracked example validation in a clean temporary tree: `Validated 21 example packages.` |
||
|
Alberto Schiabel
|
a0bef5d986 |
chore(deps): bump composio client SDKs (TS alpha.74, Py 1.41.0) (#3609)
This PR: - bumps the TS catalog `@composio/client` from `0.1.0-alpha.72` to `0.1.0-alpha.74` (published from ComposioHQ/composio-base-ts#84) and refreshes `pnpm-lock.yaml` - bumps the Python `composio-client` pin from `1.39.0` to `1.41.0` (published from ComposioHQ/composio-base-py#69) - adds a patch changeset for `@composio/core` and `@composio/cli` so the client bump actually ships in the next release ## Context Neither client is auto-bumped in this repo — there is no Stainless→consumer bot, and Dependabot does not touch the pnpm `catalog:` pin (TS) or the exact `composio-client==` pin (Py), so these were a manual catch-up. The Python `1.41.0` PyPI publish initially failed with a `403 Forbidden` (stale `PYPI_TOKEN`); it was re-run successfully before this bump, so `1.41.0` is live on PyPI. |
||
|
Alberto Schiabel
|
6606c0da92 |
fix(ts): upgrade vitest for GHSA-5xrq-8626-4rwp (#3569)
This PR: - closes #3502 - extracts the useful dependency and Cloudflare config slice from https://github.com/ComposioHQ/composio/pull/3503 onto a clean `next` branch - upgrades `vitest` and `@vitest/ui` through the workspace catalog to resolve the critical advisory - switches the Mastra provider test dependency back to the catalog - migrates the Cloudflare Worker Vitest configs to the `cloudflareTest()` plugin API - preserves existing `COMPOSIO_BASE_URL` bindings that were dropped in #3503 - keeps Vitest 4 compatibility fixes scoped to constructor mocks, spy cleanup, and temp-root project detection - leaves Node, `mise`, release docs, and Effect catalog versions unchanged; the commit includes @Dotify71 as `Co-authored-by` Co-authored-by: Dushyant Acharya <dushyantacharya873@gmail.com> |
||
|
Alberto Schiabel
|
44e5458c35 |
feat(core): remove legacy TypeScript custom tools (#3509)
This PR is **part 2 of 3** splitting https://github.com/ComposioHQ/composio/pull/3505 to make the removal of the old 2025 custom tools easier to review. It carries the **TypeScript** slice. - builds on top of https://github.com/ComposioHQ/composio/pull/3508 (stacked — review/merge the Python slice first; this PR's base is `remove-py-custom-tools`) - removes the legacy `composio.tools.createCustomTool(...)` in-memory registry: the plural `CustomTools` model, registry wiring, legacy-only tests/examples/`ts/docs` pages, and stale error/type exports - preserves the 2026 tool-router APIs: `experimental_createTool`, `experimental_createToolkit`, `ToolRouter`, `ToolRouterSession`, and inline custom-tool execution - regenerates the TypeScript SDK reference so raw tool listing no longer describes the removed local registry and points to session-scoped custom tools - adds a `@composio/core` minor changeset ## Notes - The committed SDK reference is **verified self-consistent**: `pnpm --filter @composio/core generate:docs` reproduces it with zero diff. - This slice is a byte-identical subset of #3505 — the three split branches recombine to that PR's exact tree. See #3505 for the original verification logs (`typecheck`, `test`, `lint`, `cf-workers` e2e); CI re-runs per PR. |
||
|
Zen
|
57942e87fd |
fix(security): pin protobufjs to 7.5.5 (Socket.dev critical CVE) (#3467)
# Description Adds a `pnpm.overrides` entry pinning `protobufjs` to **7.5.5** to patch a critical RCE flagged by Socket.dev: | Socket alert | CVE | GHSA | Severity | Patched in | |---|---|---|---|---| | `SOCKET-COMPOSIO-1686` | `CVE-2026-41242` | [`GHSA-xq3m-2v4x-88gg`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg) | Critical | `protobufjs@7.5.5` | ### Why an override `protobufjs@7.5.4` is pulled in transitively by `@google/genai` (via `google-auth-library`) — there are no direct imports of `protobufjs` in `ts/packages/`. The cleanest, minimal-risk fix is a `pnpm.overrides` pin: 7.5.4 -> 7.5.5 is a patch-only release containing the RCE fix. This is the same override pattern hermes uses for its security-pinned deps. # How did I test this PR - `BYPASS_BUN_VERSION_CHECK=1 pnpm install --lockfile-only` regenerated `pnpm-lock.yaml`. Both `protobufjs@7.5.4` references now resolve to `7.5.5`. - `grep -rn "from ['\"]protobufjs" ts/packages/` confirms zero direct imports — pure lockfile change. - Relying on CI for lint / typecheck / unit-test coverage on the lockfile bump. --- Origin: cron-f7c85f82906b / [zen-cron-6352a6575b74](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74) Triggered by: saransh@composio.dev | Source: Socket.dev Vulnerability Auto-Fix Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74 |
