mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/cli@0.3.4-beta.355
4860 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 dependabot[bot]
|
389902f0ac |
chore(deps): bump the npm-production group across 1 directory with 25 updates (#4160)
Bumps the npm-production group with 25 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript) | `0.3.221` | `0.3.233` | | [@mastra/mcp](https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp) | `1.15.0` | `1.16.0` | | [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.241` | `6.0.256` | | [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.115.0` | `0.117.1` | | [@google/genai](https://github.com/googleapis/js-genai) | `2.15.0` | `2.17.1` | | [@langchain/core](https://github.com/langchain-ai/langchainjs) | `1.2.4` | `1.2.8` | | [@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core) | `1.4.9` | `1.4.10` | | [@langchain/openai](https://github.com/langchain-ai/langchainjs) | `1.5.5` | `1.5.8` | | [langchain](https://github.com/langchain-ai/langchainjs) | `1.5.4` | `1.5.9` | | [@openai/agents](https://github.com/openai/openai-agents-js) | `0.14.2` | `0.16.0` | | [@langchain/anthropic](https://github.com/langchain-ai/langchainjs) | `1.5.2` | `1.5.6` | | [open](https://github.com/sindresorhus/open) | `11.0.0` | `11.0.1` | | [typebox](https://github.com/sinclairzx81/typebox) | `1.3.10` | `1.3.14` | | [@mastra/schema-compat](https://github.com/mastra-ai/mastra/tree/HEAD/packages/schema-compat) | `1.3.4` | `1.3.7` | | [@ai-sdk/mcp](https://github.com/vercel/ai/tree/HEAD/packages/mcp) | `2.0.24` | `2.0.32` | | [@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai) | `4.0.29` | `4.0.42` | | [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.20.1` | `0.21.3` | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260804.1` | `5.20260815.1` | | [@effect/language-service](https://github.com/Effect-TS/language-service) | `0.87.1` | `0.87.2` | | [@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core) | `1.52.1` | `1.59.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.30.0` | | [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.2` | | [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm) | `11.20.0` | `11.21.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.5` | `4.23.12` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.118.0` | `4.123.0` | Updates `@anthropic-ai/claude-agent-sdk` from 0.3.221 to 0.3.233 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@anthropic-ai/claude-agent-sdk's releases</a>.</em></p> <blockquote> <h2>v0.3.233</h2> <h2>What's changed</h2> <ul> <li>Notification hooks now fire for pending permission prompts on the SDK path, matching the interactive REPL behavior</li> <li>Todo/task-tracking tools (<code>TaskCreate</code>/<code>TaskGet</code>/<code>TaskUpdate</code>/<code>TaskList</code>, <code>TodoWrite</code>) are no longer in the default tool surface on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in the <code>tools</code> option or reference them in <code>allowedTools</code> (or set <code>CLAUDE_CODE_ENABLE_TODO_TOOLS=1</code>) to keep them</li> </ul> <h2>Update</h2> <pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.233 # or yarn add @anthropic-ai/claude-agent-sdk@0.3.233 # or pnpm add @anthropic-ai/claude-agent-sdk@0.3.233 # or bun add @anthropic-ai/claude-agent-sdk@0.3.233 </code></pre> <h2>v0.3.232</h2> <h2>What's changed</h2> <ul> <li>Subagent MCP <code>tool_result</code> frames whose result carries <code>_meta</code> now emit <code>tool_use_result</code> as <code>{ content, _meta }</code> (matching main-loop frames) instead of a bare value</li> <li><code>/context</code> result messages now carry a structured <code>context_usage</code> payload (new <code>SDKContextUsage</code> type), so consumers can render the context-usage card without parsing the markdown table</li> <li><code>vcs_state_changed</code> events now populate the <code>branch</code> field for push operations, sourced from the pushed ref</li> </ul> <h2>Update</h2> <pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.232 # or yarn add @anthropic-ai/claude-agent-sdk@0.3.232 # or pnpm add @anthropic-ai/claude-agent-sdk@0.3.232 # or bun add @anthropic-ai/claude-agent-sdk@0.3.232 </code></pre> <h2>v0.3.231</h2> <h2>What's changed</h2> <ul> <li>Updated to parity with Claude Code v2.1.231</li> </ul> <h2>Update</h2> <pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.231 # or yarn add @anthropic-ai/claude-agent-sdk@0.3.231 # or pnpm add @anthropic-ai/claude-agent-sdk@0.3.231 </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/claude-agent-sdk's changelog</a>.</em></p> <blockquote> <h2>0.3.233</h2> <ul> <li>Notification hooks now fire for pending permission prompts on the SDK path, matching the interactive REPL behavior</li> <li>Todo/task-tracking tools (<code>TaskCreate</code>/<code>TaskGet</code>/<code>TaskUpdate</code>/<code>TaskList</code>, <code>TodoWrite</code>) are no longer in the default tool surface on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in the <code>tools</code> option or reference them in <code>allowedTools</code> (or set <code>CLAUDE_CODE_ENABLE_TODO_TOOLS=1</code>) to keep them</li> </ul> <h2>0.3.232</h2> <ul> <li>Subagent MCP <code>tool_result</code> frames whose result carries <code>_meta</code> now emit <code>tool_use_result</code> as <code>{ content, _meta }</code> (matching main-loop frames) instead of a bare value</li> <li><code>/context</code> result messages now carry a structured <code>context_usage</code> payload (new <code>SDKContextUsage</code> type), so consumers can render the context-usage card without parsing the markdown table</li> <li><code>vcs_state_changed</code> events now populate the <code>branch</code> field for push operations, sourced from the pushed ref</li> </ul> <h2>0.3.231</h2> <ul> <li>Updated to parity with Claude Code v2.1.231</li> </ul> <h2>0.3.230</h2> <ul> <li>Updated to parity with Claude Code v2.1.230</li> </ul> <h2>0.3.229</h2> <ul> <li>Added <code>terminal_slash_commands</code> to the system init message so Remote Control clients can hide terminal-oriented commands</li> <li>Changed conversations whose messages alone exceed the API's 32 MB limit to end the turn with <code>terminal_reason</code> <code>"api_error"</code> instead of <code>"image_error"</code>; <code>StopFailure</code> <code>error_details</code> is <code>"request_body_over_limit: …"</code></li> </ul> <h2>0.3.228</h2> <ul> <li>Agent tool results (<code>AgentOutput</code>): <code>usage.output_tokens_details</code> is now carried through</li> </ul> <h2>0.3.227</h2> <ul> <li>Updated to parity with Claude Code v2.1.227</li> </ul> <h2>0.3.226</h2> <ul> <li>Updated to parity with Claude Code v2.1.226</li> </ul> <h2>0.3.225</h2> <ul> <li>Fixed background subagents in headless/SDK sessions never resuming when a background shell command or Monitor they left running completed, so the subagent never saw the result</li> </ul> <h2>0.3.224</h2> <ul> <li>Added <code>crossSessionInbound</code> and <code>dialogExpiry</code> settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver</li> <li>Added <code>subkind: 'peer-send-message'</code> to the <code>task-notification</code> member of <code>SDKMessageOrigin</code>, marking a notification raised by a cross-session <code>SendMessage</code></li> <li>Added <code>source: 'archive'</code> plugin config variant to <code>Settings</code>, with <code>url</code> and optional <code>sha256</code>, for installing plugins from a zip over HTTPS</li> <li>Added sandbox credential-masking fields to <code>Settings</code>: <code>decode: 'jwt'</code> with <code>maskClaims</code>, <code>extract</code>/<code>onExtractNoMatch</code> on <code>envVars</code>, and <code>awsPairs</code>/<code>sigv4</code> for AWS SigV4 re-signing</li> <li>Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list/get/rename/tag/fork/delete and <code>/resume</code> no longer cross projects</li> </ul> <h2>0.3.223</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/73a28abad0d5015568404ecfe0d9cad3ed479fe3"><code>73a28ab</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/8716a39f83dd7506e6421199caface603d4941ab"><code>8716a39</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/b5321a4b65ec1b034fea19f684e2d8db728875da"><code>b5321a4</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/71dfabbc343457793684e21d3085bb7a5f8c3f46"><code>71dfabb</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/0a2639d6b561af90342d4a98c93f9cc807d0e5ce"><code>0a2639d</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/22847067d63ef74234a0542a302cc3608de5e837"><code>2284706</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/d13c50c54d591cb2355672c8259fbb6e159687f9"><code>d13c50c</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/4cae4b76341d9a17a2e30915cbd84a79aba1b305"><code>4cae4b7</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/86e3e9464ea31b62b94de39412d70ff2b8b5f97b"><code>86e3e94</code></a> chore: Update CHANGELOG.md</li> <li><a href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/064793e6da11fbaf00509ef1ab66f374fb379cbc"><code>064793e</code></a> chore: Update CHANGELOG.md</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.221...v0.3.233">compare view</a></li> </ul> </details> <br /> Updates `@mastra/mcp` from 1.15.0 to 1.16.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mastra-ai/mastra/releases">@mastra/mcp's releases</a>.</em></p> <blockquote> <h2>Mar 25, 2026</h2> <h2>Highlights</h2> <h3>Smarter Model Selection for Observational Memory</h3> <p><code>@mastra/memory</code> now lets you route observer and reflector calls to different models based on input size using <code>ModelByInputTokens</code>. Short inputs can go to a fast, cheap model while longer ones get sent to a more capable one -- all configured declaratively with token thresholds. Tracing shows which model was selected and why.</p> <h3>MongoDB Support for Datasets and Experiments</h3> <p><code>@mastra/mongodb</code> now stores versioned datasets with full item history and time-travel queries, plus experiment results and CRUD. If you're already using <code>MongoDBStore</code>, this works automatically with no extra setup.</p> <h3>Okta Auth and RBAC</h3> <p>New <code>@mastra/auth-okta</code> package brings SSO authentication and role-based access control via Okta. Map Okta groups to Mastra permissions, verify JWTs against Okta's JWKS endpoint, and manage sessions -- or pair Okta RBAC with a different auth provider like Auth0 or Clerk.</p> <h3>Breaking Changes</h3> <ul> <li>None called out in this changelog.</li> </ul> <h2>Changelog</h2> <h3><a href="https://github.com/mastra-ai/mastra/blob/@mastra/core@1.16.0//private/var/folders/d4/mn8gvlx91cz80s_9c4gjr12r0000gn/T/mastra-mastra-ai-mastra-_mastra_core_1.16.0/packages/core/CHANGELOG.md">@mastra/core@1.16.0</a></h3> <h4>Minor Changes</h4> <ul> <li> <p>Added dataset-agent association and experiment status tracking for the Evaluate workflow. (<a href="https://redirect.github.com/mastra-ai/mastra/pull/14470">#14470</a>)</p> <ul> <li><strong>Dataset targeting</strong>: Added <code>targetType</code> and <code>targetIds</code> fields to datasets, enabling association with agents, scorers, or workflows. Datasets can now be linked to multiple entities.</li> <li><strong>Experiment status</strong>: Added <code>status</code> field to experiment results (<code>'needs-review'</code>, <code>'reviewed'</code>, <code>'complete'</code>) for review queue workflow.</li> <li><strong>Dataset experiment routes</strong>: Added API endpoints for triggering experiments from a dataset with configurable target type and target ID.</li> <li><strong>LLM data generation</strong>: Added endpoint for generating dataset items using an LLM with configurable count and prompt.</li> <li><strong>Failure analysis</strong>: Added endpoint for clustering experiment failures and proposing tags using LLM analysis.</li> </ul> </li> <li> <p>Added agent version support for experiments. When triggering an experiment, you can now pass an <code>agentVersion</code> parameter to pin which agent version to use. The agent version is stored with the experiment and returned in experiment responses. (<a href="https://redirect.github.com/mastra-ai/mastra/pull/14562">#14562</a>)</p> <pre lang="ts"><code>const client = new MastraClient(); <p>await client.triggerDatasetExperiment({ datasetId: "my-dataset", targetType: "agent", targetId: "my-agent", version: 3, // pin to dataset version 3 agentVersion: "ver_abc123" // pin to a specific agent version }); </code></pre></p> </li> <li> <p>Added tool suspension handling to the Harness. (<a href="https://redirect.github.com/mastra-ai/mastra/pull/14611">#14611</a>)</p> <p>When a tool calls <code>suspend()</code> during execution, the harness now emits a <code>tool_suspended</code> event, reports <code>agent_end</code> with reason <code>'suspended'</code>, and exposes <code>respondToToolSuspension()</code> to resume execution with user-provided data.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/mastra-ai/mastra/blob/main/packages/mcp/CHANGELOG.md">@mastra/mcp's changelog</a>.</em></p> <blockquote> <h2>1.16.0</h2> <h3>Minor Changes</h3> <ul> <li> <p>Updated the MCP client and server to run on the MCP 2.0 packages. Request context, authentication, logging, and progress behavior are unchanged, so tools that read <code>context.mcp.extra.authInfo</code>, send progress, or use elicitation keep working as before. (<a href="https://redirect.github.com/mastra-ai/mastra/pull/18683">#18683</a>)</p> <p>Tool schemas advertised over MCP no longer declare a draft-07 <code>$schema</code> dialect. The MCP 2.0 default validator rejects that dialect, which previously made tools with output schemas fail on the client.</p> <p><strong>If you pass a custom schema validator</strong></p> <p>The optional <code>jsonSchemaValidator</code> option now takes its validator from the MCP packages. Update the import path:</p> <pre lang="ts"><code>// Before import { CfWorkerJsonSchemaValidator } from '@modelcontextprotocol/sdk/validation/cfworker'; <p>// After import { CfWorkerJsonSchemaValidator } from '<code>@modelcontextprotocol/client/</code>validators/cf-worker';</p> <p>const mcp = new MCPClient({ servers: { weather: { url: new URL('<a href="https://example.com/mcp">https://example.com/mcp</a>'), jsonSchemaValidator: new CfWorkerJsonSchemaValidator() }, }, }); </code></pre></p> <p><strong>If you import MCP protocol types directly</strong></p> <p>Types re-exported by <code>@mastra/mcp</code> (such as <code>ToolAnnotations</code>, <code>LoggingLevel</code>, and the OAuth helpers) are unchanged and need no edits. Only imports that reached past <code>@mastra/mcp</code> into <code>@modelcontextprotocol/sdk</code> need repointing to <code>@modelcontextprotocol/client</code> or <code>@modelcontextprotocol/server</code>.</p> </li> <li> <p>Add opt-in security hardening options to the MCP client. Both options are opt-in; default behavior is unchanged. (<a href="https://redirect.github.com/mastra-ai/mastra/pull/20868">#20868</a>)</p> <ul> <li><code>allowedHosts</code> on HTTP server configs restricts which hosts the client's HTTP requests may target, covering the initial connection, the SSE fallback, and OAuth discovery. On the default fetch path redirect hops are blocked before they are sent; with a custom <code>fetch</code>, the final response URL is validated after the request runs, so custom fetch implementations must enforce redirect policy themselves when preventing outbound contact is required.</li> <li><code>inheritDefaultEnv: false</code> on stdio server configs stops the subprocess from inheriting the SDK's default environment variables; only the entries you list in <code>env</code> are passed.</li> </ul> <pre lang="typescript"><code>const mcp = new MCPClient({ servers: { weather: { url: new URL('https://weather.example/mcp'), allowedHosts: ['weather.example'], }, local: { command: 'npx', args: ['tsx', 'stdio-server.ts'], inheritDefaultEnv: false, env: { WEATHER_API_KEY: process.env.WEATHER_API_KEY! }, }, }, }); </code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mastra-ai/mastra/commit/387c6b7f5a76e34bc3e2a1ec34cd5893abf4dcf4"><code>387c6b7</code></a> chore: version - exit prerelease mode</li> <li><a href="https://github.com/mastra-ai/mastra/commit/361c421ca280e3fe6955ae91625931416bf4a731"><code>361c421</code></a> chore: version packages</li> <li><a href="https://github.com/mastra-ai/mastra/commit/1b1dd7bc0e59b7a8bfabd09a3eec1ccd95b4c2f3"><code>1b1dd7b</code></a> Cache MCP tool definitions and rebuild tools without reconnecting at startup ...</li> <li><a href="https://github.com/mastra-ai/mastra/commit/ac0a3b8bcd5777b803b6b6aba2b6b60026919adc"><code>ac0a3b8</code></a> chore: version packages (alpha) (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/20769">#20769</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/9ba12470c77f1c03642d720ce67e517e878f666e"><code>9ba1247</code></a> fix(mcp): send MCP content text to the model via toModelOutput (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/20176">#20176</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/289f4ce16e3293370440172132c52ee787cbc09f"><code>289f4ce</code></a> fix(core,mcp): coerce sub-agent maxSteps and prevent spurious MCP reconnects ...</li> <li><a href="https://github.com/mastra-ai/mastra/commit/8e23a0b207f34b84bd28f3bf554c6931d8025b97"><code>8e23a0b</code></a> chore: version packages</li> <li><a href="https://github.com/mastra-ai/mastra/commit/e7a5da4ef8e4dd452d2f232961b4e682a85ffe43"><code>e7a5da4</code></a> feat: MCP v2 (draft) (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/18683">#18683</a>)</li> <li><a href="https://github.com/mastra-ai/mastra/commit/c71e3077e69eae3f25aa628e3778f153a9d6ab36"><code>c71e307</code></a> feat(mcp): opt-in allowedHosts URL policy and inheritDefaultEnv stdio isolati...</li> <li><a href="https://github.com/mastra-ai/mastra/commit/03348e6bea7d4b44edb3298e286506afdbcc04f0"><code>03348e6</code></a> chore(deps): update security updates [security] (major) (<a href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/mcp/issues/19265">#19265</a>)</li> <li>Additional commits viewable in <a href="https://github.com/mastra-ai/mastra/commits/@mastra/mcp@1.16.0/packages/mcp">compare view</a></li> </ul> </details> <br /> Updates `ai` from 6.0.241 to 6.0.256 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/releases">ai's releases</a>.</em></p> <blockquote> <h2>ai@6.0.256</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [31205a4] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.46</li> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.174</li> </ul> </li> </ul> <h2>ai@6.0.255</h2> <h3>Patch Changes</h3> <ul> <li>35a94b0: Keep chat status submitted until response content begins streaming.</li> <li>93d24c6: Avoid repeatedly cloning accumulated text in <code>readUIMessageStream</code> while preserving independent snapshots for mutable nested values.</li> <li>1bd1caf: Fix declaration emit for exported values that infer an <code>Output</code> type.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vercel/ai/blob/ai@6.0.256/packages/ai/CHANGELOG.md">ai's changelog</a>.</em></p> <blockquote> <h2>6.0.256</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [31205a4] <ul> <li><code>@ai-sdk/provider-utils</code><a href="https://github.com/4"><code>@4</code></a>.0.46</li> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.174</li> </ul> </li> </ul> <h2>6.0.255</h2> <h3>Patch Changes</h3> <ul> <li>35a94b0: Keep chat status submitted until response content begins streaming.</li> <li>93d24c6: Avoid repeatedly cloning accumulated text in <code>readUIMessageStream</code> while preserving independent snapshots for mutable nested values.</li> <li>1bd1caf: Fix declaration emit for exported values that infer an <code>Output</code> type.</li> </ul> <h2>6.0.254</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies [71e94ad] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.173</li> </ul> </li> </ul> <h2>6.0.253</h2> <h3>Patch Changes</h3> <ul> <li>d91d30b: Preserve reasoning block IDs from UI message streams on reasoning UI parts.</li> <li>Updated dependencies [0ec239b] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.172</li> </ul> </li> </ul> <h2>6.0.252</h2> <h3>Patch Changes</h3> <ul> <li>2f96d3f: Allow providers without reranking model support to satisfy the <code>Provider</code> type.</li> <li>afb1965: Propagate errors thrown by the Chat <code>onFinish</code> callback to the initiating request.</li> <li>Updated dependencies [18b0965]</li> <li>Updated dependencies [451d2c3] <ul> <li><code>@ai-sdk/gateway</code><a href="https://github.com/3"><code>@3</code></a>.0.171</li> </ul> </li> </ul> <h2>6.0.251</h2> <h3>Patch Changes</h3> <ul> <li>d13c2e9: Respect ToolLoopAgent timeouts configured in agent settings.</li> </ul> <h2>6.0.250</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/ai/commit/85464f4e2026d9fc0274424c0171a25742836411"><code>85464f4</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18920">#18920</a>)</li> <li><a href="https://github.com/vercel/ai/commit/4b050c0884f1f3c8f66867e8a91e3c5d70f8ac20"><code>4b050c0</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18865">#18865</a>)</li> <li><a href="https://github.com/vercel/ai/commit/1bd1caf15fd87dd74c2c2e4af70800b3107b9af0"><code>1bd1caf</code></a> [v6.0] fix: declaration emit failure for exported utilities using Prompt and ...</li> <li><a href="https://github.com/vercel/ai/commit/93d24c6d8b664f4bb218d2e725eae3a9d6115f05"><code>93d24c6</code></a> [v6.0] fix: prevent quadratic readUIMessageStream allocation without weakenin...</li> <li><a href="https://github.com/vercel/ai/commit/9190ea8c3766862cb4bf6262a0061a4c3b8e6c2a"><code>9190ea8</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18855">#18855</a>)</li> <li><a href="https://github.com/vercel/ai/commit/35a94b09b323a9b30a7f2c3974e15f00092881a0"><code>35a94b0</code></a> [v6.0] fix: keep chat submitted until response content starts streaming (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18861">#18861</a>)</li> <li><a href="https://github.com/vercel/ai/commit/f8cf14d13c66794cac9be6b024c20e1e316cbf9a"><code>f8cf14d</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18786">#18786</a>)</li> <li><a href="https://github.com/vercel/ai/commit/d91d30b0151c52120a6d791a47c4bfd1da4a4065"><code>d91d30b</code></a> [v6.0] fix: reasoning UI message parts lose their SSE block IDs (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18753">#18753</a>)</li> <li><a href="https://github.com/vercel/ai/commit/1b0361cdd052701c9b043cd2bc87ab3035d4929d"><code>1b0361c</code></a> Version Packages (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18745">#18745</a>)</li> <li><a href="https://github.com/vercel/ai/commit/afb19653c29338697ee7e3697752ebbe96bd62b5"><code>afb1965</code></a> [v6.0] fix: propagate errors thrown by Chat onFinish callbacks (<a href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18736">#18736</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/ai/commits/ai@6.0.256/packages/ai">compare view</a></li> </ul> </details> <br /> Updates `@anthropic-ai/sdk` from 0.115.0 to 0.117.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/anthropic-sdk-typescript/releases">@anthropic-ai/sdk's releases</a>.</em></p> <blockquote> <h2>sdk: v0.117.1</h2> <h2>0.117.1 (2026-08-13)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.0...sdk-v0.117.1">sdk-v0.117.0...sdk-v0.117.1</a></p> <h3>Chores</h3> <ul> <li><strong>ci:</strong> allow manually re-publishing a package to npm from the release workflow (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/af60c1f980557368fb10c3701d8dc8a1fa75d70e">af60c1f</a>)</li> <li><strong>internal:</strong> tag uploaded preview builds with the branch name (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/295">#295</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/228f44ee4848e6a26be27d26093635e2dba783ea">228f44e</a>)</li> </ul> <h2>sdk: v0.117.0</h2> <h2>0.117.0 (2026-08-13)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.117.0">sdk-v0.116.0...sdk-v0.117.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> add output_behavior to dream creation (create a new memory store or update the input store in place) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6a5bd0f34d214759f97d485e46b09203fff3ea99">6a5bd0f</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> include dotfiles when flattening dist during git installs (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/917dbbb40070dbd1f861b16fcf297720d96f691b">917dbbb</a>)</li> <li><strong>client:</strong> add models (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a7bfbb1b31e9d1dffe9a83b90ec1d0dabf5c36db">a7bfbb1</a>)</li> <li><strong>messages:</strong> honor per-request timeout in the non-streaming long-request check (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/272">#272</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/0fdd8a8feb5d16fbb943490a2b1e8ecf915596d6">0fdd8a8</a>)</li> <li><strong>streaming:</strong> apply all message_delta fields when accumulating streamed messages (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/289">#289</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7b82659d70201ae3edab846f1693366db7e62ce3">7b82659</a>)</li> <li><strong>tool-runner:</strong> forward the response container id to the next request (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/271">#271</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5bdee4a8ddd83e2f1c71daa429345b3b0fea4602">5bdee4a</a>)</li> <li><strong>tools:</strong> align path resolution, skill-archive members, and heartbeat bounds with the other SDKs (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/264">#264</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5fbc729c82ec3967c9f76428d0f733b5fa61ddd5">5fbc729</a>)</li> </ul> <h3>Chores</h3> <ul> <li><strong>ci:</strong> run breaking-change detection as a ci.yml job on every push (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/c34c1d53f3227b3978621590e67f5a33f5cad107">c34c1d5</a>)</li> <li><strong>internal:</strong> switch from yarn to pnpm (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/f4eeea09648620d35517513814ffdc3bd3080801">f4eeea0</a>)</li> <li><strong>tools:</strong> escape backslashes in skill archive exclusion patterns (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/311">#311</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/67ede1c665883b7785af3240c749601d7ca19255">67ede1c</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>api:</strong> clarify that user profile name is optional for resold profiles (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1b6fed5868bd16dd92120440d373da22084be237">1b6fed5</a>)</li> </ul> <h2>sdk: v0.116.0</h2> <h2>0.116.0 (2026-08-07)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.115.0...sdk-v0.116.0">sdk-v0.115.0...sdk-v0.116.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> add <code>mid-conversation-tool-changes-2026-07-01</code> beta (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/70e04f689baa233e7cb2fed6bb807562f5595928">70e04f6</a>)</li> <li><strong>api:</strong> add support for session budgets, advisor tool, pinned inference location and skills auto-loading from GitHub (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1336a4a90387a7005f6211b6df5e2b247f4cb6b3">1336a4a</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md">@anthropic-ai/sdk's changelog</a>.</em></p> <blockquote> <h2>0.117.1 (2026-08-13)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.117.0...sdk-v0.117.1">sdk-v0.117.0...sdk-v0.117.1</a></p> <h3>Chores</h3> <ul> <li><strong>ci:</strong> allow manually re-publishing a package to npm from the release workflow (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/af60c1f980557368fb10c3701d8dc8a1fa75d70e">af60c1f</a>)</li> <li><strong>internal:</strong> tag uploaded preview builds with the branch name (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/295">#295</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/228f44ee4848e6a26be27d26093635e2dba783ea">228f44e</a>)</li> </ul> <h2>0.117.0 (2026-08-13)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.116.0...sdk-v0.117.0">sdk-v0.116.0...sdk-v0.117.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> add output_behavior to dream creation (create a new memory store or update the input store in place) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6a5bd0f34d214759f97d485e46b09203fff3ea99">6a5bd0f</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> include dotfiles when flattening dist during git installs (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/917dbbb40070dbd1f861b16fcf297720d96f691b">917dbbb</a>)</li> <li><strong>client:</strong> add models (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a7bfbb1b31e9d1dffe9a83b90ec1d0dabf5c36db">a7bfbb1</a>)</li> <li><strong>messages:</strong> honor per-request timeout in the non-streaming long-request check (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/272">#272</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/0fdd8a8feb5d16fbb943490a2b1e8ecf915596d6">0fdd8a8</a>)</li> <li><strong>streaming:</strong> apply all message_delta fields when accumulating streamed messages (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/289">#289</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/7b82659d70201ae3edab846f1693366db7e62ce3">7b82659</a>)</li> <li><strong>tool-runner:</strong> forward the response container id to the next request (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/271">#271</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5bdee4a8ddd83e2f1c71daa429345b3b0fea4602">5bdee4a</a>)</li> <li><strong>tools:</strong> align path resolution, skill-archive members, and heartbeat bounds with the other SDKs (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/264">#264</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5fbc729c82ec3967c9f76428d0f733b5fa61ddd5">5fbc729</a>)</li> </ul> <h3>Chores</h3> <ul> <li><strong>ci:</strong> run breaking-change detection as a ci.yml job on every push (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/c34c1d53f3227b3978621590e67f5a33f5cad107">c34c1d5</a>)</li> <li><strong>internal:</strong> switch from yarn to pnpm (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/f4eeea09648620d35517513814ffdc3bd3080801">f4eeea0</a>)</li> <li><strong>tools:</strong> escape backslashes in skill archive exclusion patterns (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/311">#311</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/67ede1c665883b7785af3240c749601d7ca19255">67ede1c</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>api:</strong> clarify that user profile name is optional for resold profiles (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1b6fed5868bd16dd92120440d373da22084be237">1b6fed5</a>)</li> </ul> <h2>0.116.0 (2026-08-07)</h2> <p>Full Changelog: <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.115.0...sdk-v0.116.0">sdk-v0.115.0...sdk-v0.116.0</a></p> <h3>Features</h3> <ul> <li><strong>api:</strong> add <code>mid-conversation-tool-changes-2026-07-01</code> beta (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/70e04f689baa233e7cb2fed6bb807562f5595928">70e04f6</a>)</li> <li><strong>api:</strong> add support for session budgets, advisor tool, pinned inference location and skills auto-loading from GitHub (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1336a4a90387a7005f6211b6df5e2b247f4cb6b3">1336a4a</a>)</li> <li><strong>tools:</strong> make bash timeout and abort errors matchable by class (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/259">#259</a>) (<a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/201b12e8acd69d7ab7068fe078f7988ab23897d2">201b12e</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/64a1e8e285bbcc4cef2b15ebcadccd8e5f6987ff"><code>64a1e8e</code></a> chore: release main</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/0281a291359489284c116d1adea6d13aa7a94b6d"><code>0281a29</code></a> chore(ci): allow manually re-publishing a package to npm from the release wor...</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/f3e060b568a09556fea9288b688e1191f28f0935"><code>f3e060b</code></a> chore(internal): tag uploaded preview builds with the branch name (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/295">#295</a>)</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/6fcfb2c3fce958e59750df3e4a8fda969c5ff171"><code>6fcfb2c</code></a> chore: release main</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/1a1af331442d9e9fc4ba172d87e4bc46a48255b1"><code>1a1af33</code></a> codegen metadata</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/d6b8f40ffe75a80a53b1464b8cce05b54ecac40d"><code>d6b8f40</code></a> chore: release main</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/5edda861559d809092bead9617a1073324a64585"><code>5edda86</code></a> chore(tools): escape backslashes in skill archive exclusion patterns (<a href="https://redirect.github.com/anthropics/anthropic-sdk-typescript/issues/311">#311</a>)</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/07cf28ce9d07da7d7c2b96d064d7a370d261c5bc"><code>07cf28c</code></a> chore(internal): switch from yarn to pnpm</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/a751543f5e0ba2096cc49821c351f8b3a82216ab"><code>a751543</code></a> docs(api): clarify that user profile name is optional for resold profiles</li> <li><a href="https://github.com/anthropics/anthropic-sdk-typescript/commit/0c74ed0372883d85378e5f85526d072e12d1997b"><code>0c74ed0</code></a> fix(build): include dotfiles when flattening dist during git installs</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/anthropic-sdk-typescript/compare/sdk-v0.115.0...sdk-v0.117.1">compare view</a></li> </ul> </details> <br /> Updates `@google/genai` from 2.15.0 to 2.17.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/googleapis/js-genai/releases">@google/genai's releases</a>.</em></p> <blockquote> <h2>v2.17.1</h2> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.17.0...v2.17.1">2.17.1</a> (2026-08-13)</h2> <h3>Bug Fixes</h3> <ul> <li>Add gemini-3.7-flash (<a href="https://github.com/googleapis/js-genai/commit/c495e82719486d90561eeb7dc476b9fbaa26077b">c495e82</a>)</li> </ul> <h2>v2.17.0</h2> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.16.0...v2.17.0">2.17.0</a> (2026-08-12)</h2> <h3>Features</h3> <ul> <li>Add interaction_status to LiveServerContent (<a href="https://github.com/googleapis/js-genai/commit/4489991a7c40b22dff75348748048b0b14ac687e">4489991</a>)</li> <li><strong>api:</strong> make the deferred service tier publicly available on Vertex (<a href="https://github.com/googleapis/js-genai/commit/9dafee9cd0f6089221bce5269dbd53fe7fa69806">9dafee9</a>)</li> <li>Make speech_config a structured object. (<a href="https://github.com/googleapis/js-genai/commit/9c9066594a57bda7ee417d79f8ef15c8ed0b333d">9c90665</a>)</li> </ul> <h2>v2.16.0</h2> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.15.0...v2.16.0">2.16.0</a> (2026-08-06)</h2> <h3>Features</h3> <ul> <li>Add the Gemini Robotics ER 2 Preview model (<a href="https://github.com/googleapis/js-genai/commit/5647cedfcf3fc5f862b01fb908d6aae267d8bb91">5647ced</a>)</li> <li>Add TOO_MANY_TOOL_CALLS to FinishReason enum. (<a href="https://github.com/googleapis/js-genai/commit/a7fa5683bc86a3edce347f6259fca8face0df3a4">a7fa568</a>)</li> <li>Add top-level errors array to Interaction resource (iAPI) (<a href="https://github.com/googleapis/js-genai/commit/b9dfd814a16ae985685ebcf5cb99a82625167142">b9dfd81</a>)</li> <li>Make HttpOptions.timeout a per-attempt deadline in the JS GenAI SDK. (<a href="https://github.com/googleapis/js-genai/commit/8268806b3090834870ca6b901bdf289415425bac">8268806</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Add propertyOrdering auto-population for ResponseSchema and ResponseJsonSchema for Dotnet SDK (<a href="https://github.com/googleapis/js-genai/commit/e26542fc58f832e0b88affab5c266fd0c469d01c">e26542f</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@google/genai's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.17.0...v2.17.1">2.17.1</a> (2026-08-13)</h2> <h3>Bug Fixes</h3> <ul> <li>Add gemini-3.7-flash (<a href="https://github.com/googleapis/js-genai/commit/c495e82719486d90561eeb7dc476b9fbaa26077b">c495e82</a>)</li> </ul> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.16.0...v2.17.0">2.17.0</a> (2026-08-12)</h2> <h3>Features</h3> <ul> <li>Add interaction_status to LiveServerContent (<a href="https://github.com/googleapis/js-genai/commit/4489991a7c40b22dff75348748048b0b14ac687e">4489991</a>)</li> <li><strong>api:</strong> make the deferred service tier publicly available on Vertex (<a href="https://github.com/googleapis/js-genai/commit/9dafee9cd0f6089221bce5269dbd53fe7fa69806">9dafee9</a>)</li> <li>Make speech_config a structured object. (<a href="https://github.com/googleapis/js-genai/commit/9c9066594a57bda7ee417d79f8ef15c8ed0b333d">9c90665</a>)</li> </ul> <h2><a href="https://github.com/googleapis/js-genai/compare/v2.15.0...v2.16.0">2.16.0</a> (2026-08-06)</h2> <h3>Features</h3> <ul> <li>Add the Gemini Robotics ER 2 Preview model (<a href="https://github.com/googleapis/js-genai/commit/5647cedfcf3fc5f862b01fb908d6aae267d8bb91">5647ced</a>)</li> <li>Add TOO_MANY_TOOL_CALLS to FinishReason enum. (<a href="https://github.com/googleapis/js-genai/commit/a7fa5683bc86a3edce347f6259fca8face0df3a4">a7fa568</a>)</li> <li>Add top-level errors array to Interaction resource (iAPI) (<a href="https://github.com/googleapis/js-genai/commit/b9dfd814a16ae985685ebcf5cb99a82625167142">b9dfd81</a>)</li> <li>Make HttpOptions.timeout a per-attempt deadline in the JS GenAI SDK. (<a href="https://github.com/googleapis/js-genai/commit/8268806b3090834870ca6b901bdf289415425bac">8268806</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>Add propertyOrdering auto-population for ResponseSchema and ResponseJsonSchema for Dotnet SDK (<a href="https://github.com/googleapis/js-genai/commit/e26542fc58f832e0b88affab5c266fd0c469d01c">e26542f</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/googleapis/js-genai/commit/7736083c6d062ef423a378aecef154aab6def8a2"><code>7736083</code></a> chore(main): release 2.17.1 (<a href="https://redirect.github.com/googleapis/js-genai/issues/1853">#1853</a>)</li> <li><a href="https://github.com/googleapis/js-genai/commit/c495e82719486d90561eeb7dc476b9fbaa26077b"><code>c495e82</code></a> fix: Add gemini 3.7</li> <li><a href="https://github.com/googleapis/js-genai/commit/dec2d3cbbc3c3928520d5c22fbbb2333b00b4ac9"><code>dec2d3c</code></a> chore: Update GCS references to Cloud Storage in descriptions</li> <li><a href="https://github.com/googleapis/js-genai/commit/0e80b4275655ed21cf1c390772da3e22b2a5a1db"><code>0e80b42</code></a> Copybara import of the project:</li> <li><a href="https://github.com/googleapis/js-genai/commit/4d15a7b78f5fceae4dca09f343c065e18f42b282"><code>4d15a7b</code></a> chore: remove deprecated Turn types</li> <li><a href="https://github.com/googleapis/js-genai/commit/49153845ff8968dff7403ce01ebd24e261403cda"><code>4915384</code></a> chore(main): release 2.17.0 (<a href="https://redirect.github.com/googleapis/js-genai/issues/1833">#1833</a>)</li> <li><a href="https://github.com/googleapis/js-genai/commit/9c9066594a57bda7ee417d79f8ef15c8ed0b333d"><code>9c90665</code></a> feat: Make speech_config a structured object.</li> <li><a href="https://github.com/googleapis/js-genai/commit/b98223e26e043c40f41369d9c5eb84a5c776f85c"><code>b98223e</code></a> No public description</li> <li><a href="https://github.com/googleapis/js-genai/commit/4489991a7c40b22dff75348748048b0b14ac687e"><code>4489991</code></a> feat: Add interaction_status to LiveServerContent</li> <li><a href="https://github.com/googleapis/js-genai/commit/9dafee9cd0f6089221bce5269dbd53fe7fa69806"><code>9dafee9</code></a> feat(api): make the deferred service tier publicly available on Vertex</li> <li>Additional commits viewable in <a href="https://github.com/googleapis/js-genai/compare/v2.15.0...v2.17.1">compare view</a></li> </ul> </details> <br /> Updates `@langchain/core` from 1.2.4 to 1.2.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/core's releases</a>.</em></p> <blockquote> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.2.8</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11369">#11369</a> <a href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1"><code>d6ad973</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - fix(langchain): use unified endpoint for gateway</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11342">#11342</a> <a href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a> Thanks <a href="https://github.com/thushanth-bengre-langchain"><code>@thushanth-bengre-langchain</code></a>! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't</p> <p>Retry middleware retried every failure up to <code>maxRetries</code>, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.</p> <p><code>@langchain/core/errors</code> adds <code>stampRetryable(error, retryable)</code> and <code>getRetryable(error)</code>. Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking <code>instanceof</code>. <code>getRetryable</code> returns <code>undefined</code> for errors nobody classified, and both are exported so tool authors can mark their own failures.</p> <p><code>modelRetryMiddleware</code> and <code>toolRetryMiddleware</code> now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call <code>maxRetries</code> so a surrounding retry loop can take over.</p> <p><strong>Behavior change:</strong> errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass <code>retryOn: () => true</code> to restore the old default. A custom <code>onFailedAttempt</code> replaces the built-in handler and opts out of marking.</p> </li> </ul> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.2.7</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11366">#11366</a> <a href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41"><code>c068bbf</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - fix(core,langchain): patch and release core, update peer dependencies</li> </ul> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.2.6</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11344">#11344</a> <a href="https://github.com/langchain-ai/langchainjs/commit/f08e0c6d50156accf95a36469a3e107a5598a3a0"><code>f08e0c6</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - fix: apply [Symbol.hasInstance] method to all comparable properties using .isInstance()</p> <p>We have some internal schemas that rely on <code>z.instanceof()</code>. This uses a strict <code>instanceof</code> check which can conflict if there are multiple versions of core installed. This overrides the <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol/hasInstance">Symbol.hasInstance</a> method to use the same logic as <code>.isInstance()</code> to compare objects at runtime.</p> </li> </ul> <h2><code>@langchain/core</code><a href="https://github.com/1"><code>@1</code></a>.2.5</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11305">#11305</a> <a href="https://github.com/langchain-ai/langchainjs/commit/e654022e291b8dae54504ac2d1a3232332406723"><code>e654022</code></a> Thanks <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a>! - Add LangSmith Gateway environment configuration to OpenAI, Anthropic, and Fireworks chat models.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11295">#11295</a> <a href="https://github.com/langchain-ai/langchainjs/commit/1a1b347d18bc68e842df8badffc987493c81d70a"><code>1a1b347</code></a> Thanks <a href="https://github.com/vladislav-nechakhin"><code>@vladislav-nechakhin</code></a>! - fix(core): pass the mustache escape override per render call</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d0c905ddcc2471d0c89a2f1520d96782253ba5c3"><code>d0c905d</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11370">#11370</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/8ba1fd996ff9efe93e5cb75afa946204c00528a4"><code>8ba1fd9</code></a> fix(aws): classify Bedrock stream-idle timeouts, cover pre-response hang (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11">#11</a>...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a> feat(core): mark errors as retryable or not, and stop retrying the ones that ...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1"><code>d6ad973</code></a> fix(langchain): use unified endpoint for gateway (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11369">#11369</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/3fedf7f1934a592b71da866bd16af886b4e0c00d"><code>3fedf7f</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11367">#11367</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41"><code>c068bbf</code></a> fix(core,langchain): patch and release core, update peer dependencies (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11366">#11366</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/242b986afd9b257ddbedd5d0dcc84f197289faef"><code>242b986</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11361">#11361</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/2d1f7449c95a554d429535abae0115b4f578bbac"><code>2d1f744</code></a> chore(langchain): add missing changeset (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11363">#11363</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/f401396a21285d49804f1dc7e4e2fa2396d5317f"><code>f401396</code></a> feat(langchain): add langsmith gateway to initChatModel (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11362">#11362</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d36ec6a6f4b1c474b0d9f9cb6037ff37f54183bf"><code>d36ec6a</code></a> fix(anthropic): preserve gateway cost on the native stream path (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11359">#11359</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.4...@langchain/core@1.2.8">compare view</a></li> </ul> </details> <br /> Updates `@langchain/langgraph` from 1.4.9 to 1.4.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraphjs/releases">@langchain/langgraph's releases</a>.</em></p> <blockquote> <h2><code>@langchain/langgraph</code><a href="https://github.com/1"><code>@1</code></a>.4.10</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2690">#2690</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0"><code>00f68a1</code></a> Thanks <a href="https://github.com/saad-supports-langchain"><code>@saad-supports-langchain</code></a>! - fix(langgraph): keep <code>context</code> values out of tracer-derived metadata</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md">@langchain/langgraph's changelog</a>.</em></p> <blockquote> <h2>1.4.10</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2690">#2690</a> <a href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0"><code>00f68a1</code></a> Thanks <a href="https://github.com/saad-supports-langchain"><code>@saad-supports-langchain</code></a>! - fix(langgraph): keep <code>context</code> values out of tracer-derived metadata</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/f6b41bf4861322e380e02f746285496e84b0f96b"><code>f6b41bf</code></a> chore: version packages (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2698">#2698</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/00f68a1b002d820b95129bcdaf387d2678ead6f0"><code>00f68a1</code></a> fix(langgraph): keep context values out of tracer-derived metadata (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2690">#2690</a>)</li> <li><a href="https://github.com/langchain-ai/langgraphjs/commit/6ac60da74f6b9e29d20b111a7947ac3060f1d2dd"><code>6ac60da</code></a> chore(deps): bump the langchain group across 1 directory with 5 updates (<a href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2651">#2651</a>)</li> <li>See full diff in <a href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.10/libs/langgraph-core">compare view</a></li> </ul> </details> <br /> Updates `@langchain/openai` from 1.5.5 to 1.5.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">@langchain/openai's releases</a>.</em></p> <blockquote> <h2><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.5.8</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11342">#11342</a> <a href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a> Thanks <a href="https://github.com/thushanth-bengre-langchain"><code>@thushanth-bengre-langchain</code></a>! - feat(openai): mark OpenAI provider errors as retryable or not</p> <p>Builds on <code>stampRetryable</code> in <code>@langchain/core</code> so the retry middleware can tell a transient failure from a deterministic one. Timeouts and rate limits are marked retryable; aborts, context overflow, invalid tool results, bad credentials, and unknown models non-retryable. Anything else stays unmarked and retries as before.</p> <p>Also forwards a per-call <code>maxRetries</code> to the retry loop, so a surrounding retry loop such as <code>modelRetryMiddleware</code> can take over instead of the two multiplying against each other.</p> <p>Errors keep their original class, so <code>instanceof</code> against the <code>openai</code> SDK error types is unaffected.</p> </li> </ul> <h2><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.5.7</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11347">#11347</a> <a href="https://github.com/langchain-ai/langchainjs/commit/3fe4c43ce3399ebf2391ed612d78fedcd3ea5ec6"><code>3fe4c43</code></a> Thanks <a href="https://github.com/talarari"><code>@talarari</code></a>! - fix(openai): include <code>usage</code> in <code>response_metadata</code> when <code>system_fingerprint</code> is absent</li> </ul> <h2><code>@langchain/openai</code><a href="https://github.com/1"><code>@1</code></a>.5.6</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11305">#11305</a> <a href="https://github.com/langchain-ai/langchainjs/commit/e654022e291b8dae54504ac2d1a3232332406723"><code>e654022</code></a> Thanks <a href="https://github.com/jacoblee93"><code>@jacoblee93</code></a>! - Add LangSmith Gateway environment configuration to OpenAI, Anthropic, and Fireworks chat models.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d0c905ddcc2471d0c89a2f1520d96782253ba5c3"><code>d0c905d</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11370">#11370</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/8ba1fd996ff9efe93e5cb75afa946204c00528a4"><code>8ba1fd9</code></a> fix(aws): classify Bedrock stream-idle timeouts, cover pre-response hang (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11">#11</a>...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a> feat(core): mark errors as retryable or not, and stop retrying the ones that ...</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1"><code>d6ad973</code></a> fix(langchain): use unified endpoint for gateway (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11369">#11369</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/3fedf7f1934a592b71da866bd16af886b4e0c00d"><code>3fedf7f</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11367">#11367</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41"><code>c068bbf</code></a> fix(core,langchain): patch and release core, update peer dependencies (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11366">#11366</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/242b986afd9b257ddbedd5d0dcc84f197289faef"><code>242b986</code></a> chore: version packages (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11361">#11361</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/2d1f7449c95a554d429535abae0115b4f578bbac"><code>2d1f744</code></a> chore(langchain): add missing changeset (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11363">#11363</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/f401396a21285d49804f1dc7e4e2fa2396d5317f"><code>f401396</code></a> feat(langchain): add langsmith gateway to initChatModel (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11362">#11362</a>)</li> <li><a href="https://github.com/langchain-ai/langchainjs/commit/d36ec6a6f4b1c474b0d9f9cb6037ff37f54183bf"><code>d36ec6a</code></a> fix(anthropic): preserve gateway cost on the native stream path (<a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11359">#11359</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchainjs/compare/@langchain/openai@1.5.5...@langchain/openai@1.5.8">compare view</a></li> </ul> </details> <br /> Updates `langchain` from 1.5.4 to 1.5.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchainjs/releases">langchain's releases</a>.</em></p> <blockquote> <h2>langchain@1.5.9</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11369">#11369</a> <a href="https://github.com/langchain-ai/langchainjs/commit/d6ad9735640a6c729f81ef79361acc5e83c526f1"><code>d6ad973</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - fix(langchain): use unified endpoint for gateway</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11342">#11342</a> <a href="https://github.com/langchain-ai/langchainjs/commit/3b0e4c48a31811031a460c4d95519a7c1163dc41"><code>3b0e4c4</code></a> Thanks <a href="https://github.com/thushanth-bengre-langchain"><code>@thushanth-bengre-langchain</code></a>! - feat(core): mark errors as retryable or not, and stop retrying the ones that aren't</p> <p>Retry middleware retried every failure up to <code>maxRetries</code>, including deterministic ones like a bad API key or an unknown model. Retries also nest, so a single such failure could cost dozens of API calls.</p> <p><code>@langchain/core/errors</code> adds <code>stampRetryable(error, retryable)</code> and <code>getRetryable(error)</code>. Marking an error leaves its class and shape untouched, so a provider SDK error can be classified without breaking <code>instanceof</code>. <code>getRetryable</code> returns <code>undefined</code> for errors nobody classified, and both are exported so tool authors can mark their own failures.</p> <p><code>modelRetryMiddleware</code> and <code>toolRetryMiddleware</code> now respect the mark by default, and retries stop as soon as one is found rather than each layer spending its own budget. Aborted calls, context overflow, and oversized payloads are marked non-retryable out of the box. Models accept a per-call <code>maxRetries</code> so a surrounding retry loop can take over.</p> <p><strong>Behavior change:</strong> errors marked non-retryable now fail on the first attempt. Unclassified errors — including any from third-party integrations or custom tools — retry exactly as before. Pass <code>retryOn: () => true</code> to restore the old default. A custom <code>onFailedAttempt</code> replaces the built-in handler and opts out of marking.</p> </li> </ul> <h2>langchain@1.5.8</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11366">#11366</a> <a href="https://github.com/langchain-ai/langchainjs/commit/c068bbf8c113132bf16ac7a8add44e486a147b41"><code>c068bbf</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - fix(core,langchain): patch and release core, update peer dependencies</li> </ul> <h2>langchain@1.5.7</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11363">#11363</a> <a href="https://github.com/langchain-ai/langchainjs/commit/2d1f7449c95a554d429535abae0115b4f578bbac"><code>2d1f744</code></a> Thanks <a href="https://github.com/hntrl"><code>@hntrl</code></a>! - feat(langchain): add langsmith gateway to initChatModel- <a href="https://redirect.github.com/langchain-ai/langchainjs/issues/11362">#11362</a></li> </ul> <h2>langchain@1.5.6</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11331">#11331</a> <a href="https://github.com/langchain-ai/langchainjs/commit/18765b002c3819bc4dc42123a293cab27a35ce4f"><code>18765b0</code></a> Thanks <a href="https://github.com/thushanth-bengre-langchain"><code>@thushanth-bengre-langchain</code></a>! - fix(langchain): exclude middleware-internal model calls from the message projection</p> <p>Bookkeeping model calls made by <code>summarizationMiddleware</code> and <code>toolEmulatorMiddleware</code> no longer appear in <code>run.messages</code> or <code>stream({ streamMode: "messages" })</code>, and the summary <code>summarizationMiddleware</code> writes back to state is no longer projected as a new message. These calls remain observable via <code>streamEvents({ version: "v2" })</code>, identified by <code>lc_source</code>.</p> </li> <li> <p><a href="https://redirect.github.com/langchain-ai/langchainjs/pull/11344">#11344</a> <a href="https://github.com/langchain-ai/langchainjs/commit/f08e0c6d50156accf95a36469a3e107... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev>@composio/cli@0.3.4-beta.355 |
||
|
Alberto Schiabel
|
6ba9179b48 |
fix(files): validate URLs from API responses before fetching them (#4146)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/4144 - routes every fetch whose URL comes from an API response through the SSRF guards that already existed — ten sinks, five per SDK: the tool-execution download, both S3 presigned uploads, `RemoteFile.buffer()`/`blob()`, and the Tool Router session file upload - adds `safe_request()` (Python), which follows redirects itself and re-validates each hop, so a validated URL cannot 302 into private space and an S3 307 region redirect still works - makes `RemoteFile.buffer()` (Python) share `_fetch_url_bytes` with the user-supplied-URL path instead of duplicating it — it previously read `response.content` with no size cap, no redirect control, and no target validation - adds `ssrfSafeFetchWhereSupported` (TypeScript): the full guard on Node, a plain `fetch` on workerd, so Tool Router session file transfers keep working in edge runtimes rather than failing closed - documents DNS rebinding as a known residual in both guards - adds tests that assert the guard *runs* — blocked URL, sink never called, nothing written — rather than that a transfer succeeds ## Context `python/AGENTS.md` states the trust boundary: every field of an API response is untrusted input, because the backend may be compromised or the connection MITM'd. Both SDKs enforced that for URLs a *user* passes in (`composio.utils.url_safety`, `ssrfGuard.node.ts`) and left the URLs an API *response* supplies unguarded — backwards relative to the stated model. A response naming an internal address turned the SDK into a request proxy for it, and the fetched bytes were written to disk or returned to the caller, typically into an LLM context. `RemoteFile.buffer()` was the weakest of the ten: four lines above it, `_fetch_from_url` validated its target, refused redirects, and streamed against a 100 MiB cap; `buffer()` did none of the three. The only difference between them was which side of the trust boundary the URL arrived from. Three decisions worth review: - **The guard is unconditional.** Presigned URLs are public, so nothing legitimate should resolve to private space. There is no escape hatch, and no new configuration surface. - **The tool-execution download stays uncapped.** It streams straight to disk, so `_MAX_RESPONSE_SIZE` — a memory-exhaustion bound — does not apply, and tool attachments legitimately exceed it. `RemoteFile.buffer()` *is* capped, because it buffers in memory. - **Uploads follow redirects with re-validation rather than refusing them**, since S3 can answer a PUT with a 307 region redirect. Downloads keep `allow_redirects=False`, matching the existing fetch paths. Python now matches the TypeScript guard's per-hop re-validation, which was the better of the two implementations. Verified locally: `make chk` and `make tst` clean on the Python side; `pnpm -C packages/core test` 1095 passed, typecheck and lint clean. |
||
|
Alberto Schiabel
|
f67d565743 |
refactor(python): consolidate path construction from untrusted input (#4144)
This PR: - centralizes filesystem path construction for API-provided slugs and filenames in `composio.utils.safe_path` - rejects traversal, Windows-invalid names, invalid Unicode, and overlong encoded filenames before creating directories or writing files - normalizes trusted roots consistently and routes both Python download paths through the shared helpers - adds a fail-closed AST guard for new dynamic path construction, including direct `Path(...)` calls - isolates provider initialization from the real home directory and makes the home-write guard report changes without deleting them - removes the obsolete download filename wrapper ## Verification - `pytest -q`: 1,248 passed, 47 skipped - repository-configured Ruff checks and formatting passed for every changed Python file - targeted mypy checks passed for the changed helpers and tests |
||
|
Alberto Schiabel
|
09f76b1c9f |
refactor(cli): eliminate raw environment access (#4134)
This PR: - routes Composio-prefixed runtime configuration through `APP_CONFIG` and normalizes unprefixed host values through `HOST_CONFIG` in `app-config.ts` - removes `loadOptionalAppConfig`-style fallback loading so optional strings, booleans, and CLI flag precedence resolve at the configuration boundary - removes every executable `process.env` reference from CLI source; child commands inherit the ambient environment through `@effect/platform` and receive explicit normalized overrides - preserves arbitrary `CODEX_*`, `CLAUDE_*`, and `OPENCLAW_*` detection through Effect config enumeration without exposing the raw environment map - propagates telemetry debug state through worker arguments instead of mutating the process environment - replaces removable filesystem, OS, subprocess, and error-handling exceptions with Effect services and typed control flow - documents supported and internal CLI environment variables, including their `user_data.json` and `config.json` mappings - reduces registered CLI lint boundaries from 45 to 4; the retained entries are the detached-spawn, Node OS, synchronous preload filesystem, and MD5 checksum implementations - verifies the result with 1,201 passing CLI tests (1 skipped), strict Oxlint, boundary validation, root typechecking across 19 packages, the CLI build, and real `composio run` child-process checks@composio/cli@0.3.4-beta.354 |
||
|
Kshitij Jhunjhunwala
|
40a6db796f |
docs: redesign the Welcome landing around Platform / For You (#4149)
## Summary - Rebuilds the "Two ways to start" hero cards around Composio's Platform and For You products — uses the canonical Composio logo + product-badge lockup (dashboard-parity), and the same product mocks the dashboard onboarding path step uses: a chat composer + client logos for For You, an SDK code panel for Platform. Right link pane matches the width of a feature-grid card exactly. - Restructures the feature grid: whole-card links, product mocks that fade into the card edge with a mask-image, cards live on a single flush `bg-fd-card` surface. Tools mock jumps from an 8×2 grid of 16 tiles to 10×3 = 30 for more impact. Auth becomes a live schematic — one user identity card wired to three connected-account cards via elbow connectors computed from real DOM geometry (new `home-auth-diagram.tsx`). Triggers drops the fake `LIVE` ping in favor of a plain event list, Sandbox drops the workbench chrome + CPU lights for a clean filename + code panel. - Adds a Platform Dashboard link to Reach-for-the-rest so it fills the 3×2 grid. Drops the "Get started / What you get / Reach for the rest" eyebrows and section heading so titles stand on their own. - Copy: `audience` → `product` in `HOME_INTENTS`, so `llms.txt` emits `**Platform**` / `**For You**` alongside the existing headings; matched in `home-navigation.test.ts`. ## Test plan - [ ] Visit \`/docs\` at desktop and mobile widths, in both light and dark themes - [ ] Verify the auth diagram wires stay aligned across widths (dynamic getBoundingClientRect + ResizeObserver) - [ ] \`bun test tests/static/\` - [ ] \`bun run types:check\` 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Kshitij Jhunjhunwala
|
599cebb108 | Merge branch 'next' into claude/platform-for-you-redesign-3c3274 | ||
|
Kshitij Jhunjhunwala
|
2931dacd5b |
docs: emit docs_sidebar_click with sidebar group and depth (#4139)
Evaluating #4099 meant inferring every navigation conclusion from `$pageview` ordering, because the docs app has exactly one `posthog.capture` call and nothing captures sidebar clicks. (`$referring_domain` doesn't help: pageviews are captured manually on client-side route change, so `document.referrer` never updates on internal navigation.) **What the event carries:** `docs_sidebar_click` with `href`, `group` (separator heading), `folder`, `depth`, `position`, and `from_path`. `position` is the row index among visible siblings — a collapsed folder counts as one row, and its children get their own `1..n` sequence — so "clicks land in the top N rows" reads as written. **Why the index comes from the page tree, not the DOM:** separators currently render as `<p>` and folder triggers as `<button>` — fumadocs internals that break on upgrade. `lib/sidebar-nav-index.ts` walks the tree at build time (mirroring `app/llms.txt/route.ts`) and the client does a single delegated listener plus an href lookup. An href that isn't in the index emits nothing rather than a guessed group. `click` and `auxclick` (middle button) are both captured so links opened in a new tab aren't silently dropped. Mounted on the docs, examples, and both reference sidebars. `/toolkits` has no `DocsLayout` sidebar, so there's nothing to instrument there. **Folder-toggle tracking: deferred.** Folder triggers are `<button>`s with no href, so identifying which folder was toggled means matching on text content, and the open/closed state means reading a Radix `data-state` — exactly the DOM guessing this PR avoids. Worth doing if fumadocs gives us a stable hook. **Verification** (from `docs/`): `lint:links`, `test` (219 pass, 10 new), `types:check`, `build` all green; `lint` output matches the `next` baseline exactly. Runtime check against a production build with PostHog pointed at a local sink: - `/docs/triggers` → `group: "Core concepts"`, `folder: null`, `depth: 1`, `position: 4` (its visible row) - `/docs/authentication` (folder row) → `folder: "Authentication"`, `depth: 1`, `position: 3` - `/docs/authentication/manually-authenticating` → `depth: 2`, `position: 1` - middle-click on `/docs/cli` fired; right-click on a sidebar link did not - reference sidebar → `group: null` (that tree has no separators) - clicking an in-body docs link fired a `$pageview` and no `docs_sidebar_click` - built keyless, `process.env.NEXT_PUBLIC_POSTHOG_KEY` is inlined into the effect's guard so no listener is attached; confirmed in the emitted chunk and by the absence of any "You must initialize PostHog before calling posthog.capture" warning after clicking sidebar links 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Kshitij Jhunjhunwala
|
a80460b4da |
fix(docs): keep the Welcome auth diagram drawable at every pane width
The new AuthDiagram sized its hub (`w-36`) and account cards (`w-44`) with fixed widths totalling 320px, but the feature-grid pane is not monotonic in the viewport: ~404px at 1280px, and only ~242px at 640px where the grid goes two-column. Below ~394px viewport the two blocks shrank until they touched, `ex === sx` collapsed every wire into `elbowPath`'s straight-line fallback, and the middle connector became a zero-length, invisible path. The card rendered as three stray tick marks on every iPhone below Pro Max, and the account cards overflowed the clip at 360px. Use proportional widths with caps (`w-[36%] max-w-36` / `w-[52%] max-w-56`) so ~12% of the pane is always reserved as horizontal run for the elbows. Measured after: 29px gap at the 242px worst case, 34px at 360px, 50px at 1280px, no overflow and no degenerate paths anywhere in the range. The account label now hides by container query rather than a viewport breakpoint, which would gate on the wrong axis. Also from review: - Sandbox mock showed `composio.sandbox.run()` in a file chromed `sandbox.ts`. Per content/docs/sandbox/remote.mdx — where the card links — the sandbox is a persistent Python environment driven through COMPOSIO_REMOTE_WORKBENCH with `run_composio_tool` / `invoke_llm`. Rewritten on that real surface and relabelled `sandbox.py`; `WorkbenchVisual` renamed to `SandboxVisual`. - `twilio` is not in public/data/toolkits.json, so the tile advertised an app with no /toolkits page behind it. Swapped for `zendesk`. - The dark logo was `aria-hidden`, so the heading's accessible name lost "Composio" in dark mode only. Both variants now carry the same alt. - Restored the badge style assertions the PR dropped, which still held, and added regression coverage for the diagram widths, the catalog check, and the sandbox surface. - Restored the window resize listener that connection-refresh-visual.tsx keeps alongside its ResizeObserver. - Nits: stale "8×2" comment, redundant fragment, shared the duplicated fade style, renamed the misleading `homeIntentAnchor(title)` parameter. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
d9186c1b15 |
docs: stop restructuring the reference layouts
Extracting buildReferenceTree() existed only so a module-level memo could reuse the tree. The memo is gone, so the extraction was scaffolding for nothing and every reference-layout hunk was pure churn in a PR about adding an event. Both files go back to their shape on next, plus the same four lines the docs and examples layouts already take. The non-test diff is now insertions only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
68c6c0a889 |
docs: build the reference nav index from the tree the layout already awaited
getNavIndex() awaited buildReferenceTree() on its own while Layout had already awaited the same tree for DocsLayout, so the first render built and filtered the reference tree twice. The memo it protected was a module-level singleton with no key, which is what prompted removing the parameter in the first place. Dropping the memo resolves both: the index is one traversal over ~64 nodes built from the tree already in hand, matching how the docs and examples layouts work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
1ccfb8fba7 | Merge branch 'next' into kj/docs-sidebar-instrumentation | ||
|
Kshitij Jhunjhunwala
|
da72336dc2 |
docs: assert sidebar position relatively, drop the unkeyed nav-index cache
The position assertions pinned absolute indices into the live content tree, so adding any page to meta.json failed a test named for traversal semantics with "expected 12, received 13". Assert the invariant instead — a folder occupies one sibling slot, and its children restart at 1 — which stays green when content moves and still fails if position starts threading through folders again. getNavIndex(tree) ignored its argument on every call after the first. The reference tree is only reachable after an await, so it stays memoized, but the signature no longer claims to vary with a parameter it never read. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
dependabot[bot]
|
c0c511bb4b |
chore(deps-dev): bump the npm-development group with 7 updates (#4133)
Bumps the npm-development group with 7 updates: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.77.0` | `1.78.0` | | [oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint) | `1.77.0` | `1.78.0` | | [turbo](https://github.com/vercel/turborepo) | `2.10.8` | `2.10.9` | | [chrome-devtools-mcp](https://github.com/ChromeDevTools/chrome-devtools-mcp) | `1.6.0` | `1.7.0` | | [@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent) | `0.83.0` | `0.84.1` | | [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) | `0.29.5` | `0.31.3` | Updates `@types/node` from 26.1.2 to 26.2.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.77.0 to 1.78.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's changelog</a>.</em></p> <blockquote> <h2>[1.78.0] - 2026-08-10</h2> <h3>🚀 Features</h3> <ul> <li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>) (Mikhail Baev)</li> <li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>) (Cole Ellison)</li> <li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>) (Cole Ellison)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>9573937 linter/typescript: Validate <code>ban-ts-comment</code> description_format (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>) (Mikhail Baev)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a> release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25473">#25473</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/ccb8fe89db08123ff2b86d7fb2f39d0dd6c33df7"><code>ccb8fe8</code></a> feat(linter/jsdoc): implement <code>no-blank-blocks</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/9573937df3cc01f29e1c65bc018ce378ec947e0e"><code>9573937</code></a> fix(linter/typescript): validate <code>ban-ts-comment</code> description_format (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/d4a897ce2290bf853720b4fbf371304bfea2c980"><code>d4a897c</code></a> feat(linter/eslint): implement <code>one-var</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/5ab9340637eff80539bca89a494e162e94569358"><code>5ab9340</code></a> feat(linter/jsx-a11y/anchor-has-content): add options to match eslint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.78.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Updates `oxlint-plugin-eslint` from 1.77.0 to 1.78.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxlint-plugin-eslint's releases</a>.</em></p> <blockquote> <h2>oxlint v1.78.0 & oxfmt v0.63.0</h2> <h2>Table of Contents</h2> <ul> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxlint-v1.78.0">Oxlint v1.78.0</a></li> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxfmt-v0.63.0">Oxfmt v0.63.0</a></li> </ul> <h2>Oxlint v1.78.0</h2> <h3>🚀 Features</h3> <ul> <li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25207">#25207</a>) (Mikhail Baev)</li> <li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24470">#24470</a>) (Cole Ellison)</li> <li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24571">#24571</a>) (Cole Ellison)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>b746e00 linter/eslint/no-implicit-coercion: Preserve template coercion whitespace (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25470">#25470</a>) (camc314)</li> <li>a92c541 linter: Preserve source text for JS plugin ignore fixes (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25280">#25280</a>) (Norcleeh)</li> <li>675c840 linter/eslint/prefer-promise-reject-errors: Handle parenthesized calls (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25378">#25378</a>) (camc314)</li> <li>1703739 linter/unicorn/new-for-builtins: Ignore optional chains (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25411">#25411</a>) (tanakalucky)</li> <li>95ece63 linter/unicorn/prefer-code-point: Downgrade the auto-fix to dangerous (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25412">#25412</a>) (leemr)</li> <li>c451a0e linter/vitest: Validate <code>consistent-test-filename</code> regex patterns (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25408">#25408</a>) (Mikhail Baev)</li> <li>937825c react_compiler: Disable exhaustive memo validation by default (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25417">#25417</a>) (Boshen)</li> <li>f0f7dae linter/eslint/no-unused-vars: Report invalid regex options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25380">#25380</a>) (Cameron)</li> <li>44e73fd linter/unicorn/prefer-array-flat: Fix <code>concat.apply</code> suggestions (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25373">#25373</a>) (Cameron)</li> <li>6846a9a linter/react/rules-of-hooks: Detect constructor callbacks (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25377">#25377</a>) (camc314)</li> <li>b247a9d linter/unicorn/new-for-builtins: Support <code>Float16Array</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25382">#25382</a>) (tanakalucky)</li> <li>19109cd linter/unicorn/error-message: Support <code>SuppressedError</code> messages (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25375">#25375</a>) (camc314)</li> <li>9c13f5e linter: Assert token lookup invariants (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25368">#25368</a>) (camc314)</li> <li>bc35f83 linter/eslint/no-unused-vars: Bound catch parameter lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25367">#25367</a>) (camc314)</li> <li>c159fb9 linter/unicorn/switch-case-braces: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25363">#25363</a>) (camc314)</li> <li>03b2eb2 linter/unicorn/no-static-only-class: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25361">#25361</a>) (camc314)</li> <li>0afc59e linter/unicorn/empty-brace-spaces: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25353">#25353</a>) (camc314)</li> <li>2963d98 linter/eslint/no-unreachable-loop: Do not report loops whose body has a finally block (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25335">#25335</a>) (Todor Andonov)</li> <li>589e5fb linter/eslint/no-param-reassign: Validate <code>ignorePropertyModificationsForRegex</code> property (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25346">#25346</a>) (Mikhail Baev)</li> <li>aae5d8b linter/eslint/no-throw-literal: False positive on variable declared without initializer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25275">#25275</a>) (cjnoname)</li> <li>6b1c479 oxlint: Normalize customized rule names (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25316">#25316</a>) (camc314)</li> <li>d494eb5 linter/unicorn/consistent-existence-index-check: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25325">#25325</a>) (camc314)</li> <li>4266037 linter/typescript/prefer-namespace-keyword: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25322">#25322</a>) (camc314)</li> <li>4745b4e linter/typescript/no-namespace: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25321">#25321</a>) (camc314)</li> <li>648a481 linter/eslint/one-var: Avoid joining exported declarations (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25314">#25314</a>) (camc314)</li> <li>9573937 linter/typescript: Validate <code>ban-ts-comment</code> description_format (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25320">#25320</a>) (Mikhail Baev)</li> <li>ebf7d18 linter/typescript/consistent-type-definitions: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25281">#25281</a>) (camc314)</li> <li>1501ccf linter/typescript/consistent-generic-constructors: Bound token lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25258">#25258</a>) (camc314)</li> </ul> <h3>⚡ Performance</h3> <ul> <li>8f784f3 linter: Reduce rule config dispatch size (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25461">#25461</a>) (Boshen)</li> <li>2de4ec2 linter: Reduce visitor code size (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25441">#25441</a>) (Boshen)</li> <li>6fb7f47 linter/unicorn/prefer-export-from: Narrow <code>ExportFromDeclaration</code> lookup (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25381">#25381</a>) (camc314)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a> release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25473">#25473</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/apps_v1.78.0/npm/oxlint-plugin-eslint">compare view</a></li> </ul> </details> <br /> Updates `turbo` from 2.10.8 to 2.10.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.10.9</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>chore: Release Turborepo 2.10.8 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13626">vercel/turborepo#13626</a></li> <li>perf: Walk literal-prefix tree globs without wax compilation by <a href="https://github.com/charpeni"><code>@charpeni</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13522">vercel/turborepo#13522</a></li> <li>fix: Accept semver ranges in devEngines.packageManager.version by <a href="https://github.com/bangseongbeom"><code>@bangseongbeom</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13623">vercel/turborepo#13623</a></li> <li>docs: Explain affected package invalidation reasons by <a href="https://github.com/ghoullier"><code>@ghoullier</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13594">vercel/turborepo#13594</a></li> <li>perf(lockfiles): Borrow field-name scalars in the pnpm fast parser by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13648">vercel/turborepo#13648</a></li> <li>perf(repository): Avoid discarded alias allocation in Relationship by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13650">vercel/turborepo#13650</a></li> <li>perf(lockfiles): Drop redundant human_name clone for pnpm v7/v9 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13649">vercel/turborepo#13649</a></li> <li>perf: Index workspace nodes by name in project_relationships by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13647">vercel/turborepo#13647</a></li> <li>perf: Share resolution identity lists across identical workspace closures by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13641">vercel/turborepo#13641</a></li> <li>docs: Fix duplicated word in runtime dependencies guide summary by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13630">vercel/turborepo#13630</a></li> <li>refactor: Remove turborepo-lsp dependency on turborepo-lib by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13631">vercel/turborepo#13631</a></li> <li>perf: Index Bun nested lockfile entries by name for fallback resolution by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13633">vercel/turborepo#13633</a></li> <li>perf: Memoize framework inference per package during task hashing by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13634">vercel/turborepo#13634</a></li> <li>perf: Avoid materializing transient declarations in external_dependencies by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13646">vercel/turborepo#13646</a></li> <li>perf: Enable shared closure DP for npm and yarn1 lockfiles by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13635">vercel/turborepo#13635</a></li> <li>perf: Parse pnpm explicit-key entries in the lockfile fast path by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13640">vercel/turborepo#13640</a></li> <li>perf: Parallelize resolution fingerprint hashing by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13642">vercel/turborepo#13642</a></li> <li>perf: Build resolution identity lists in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13643">vercel/turborepo#13643</a></li> <li>perf: Intern resolution identities as Arc<str> across closures by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13645">vercel/turborepo#13645</a></li> <li>fix: Compose affected tasks with package filters by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13656">vercel/turborepo#13656</a></li> <li>docs: Explain worktree cache path isolation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13657">vercel/turborepo#13657</a></li> <li>fix: Upgrade brace-expansion to 5.0.9 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13658">vercel/turborepo#13658</a></li> <li>docs: Correct verified inaccuracies in the Turborepo Agent Skill by <a href="https://github.com/charpeni"><code>@charpeni</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13644">vercel/turborepo#13644</a></li> <li>chore: Update Next.js to 16.3.0 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13659">vercel/turborepo#13659</a></li> <li>fix: Don't use <code>eprintln!</code> in the panic hook by <a href="https://github.com/molofsky"><code>@molofsky</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13637">vercel/turborepo#13637</a></li> <li>fix: Invalidate only when Git ignore sources change by <a href="https://github.com/smasato"><code>@smasato</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13632">vercel/turborepo#13632</a></li> <li>docs: Update Geistdocs to 1.19.4 by <a href="https://github.com/christopherkindl"><code>@christopherkindl</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13680">vercel/turborepo#13680</a></li> <li>docs: Exclude Turborepo from its own OSS products menu by <a href="https://github.com/christopherkindl"><code>@christopherkindl</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13681">vercel/turborepo#13681</a></li> <li>docs: Use the geistdocs Turborepo logo in the navbar by <a href="https://github.com/christopherkindl"><code>@christopherkindl</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13682">vercel/turborepo#13682</a></li> <li>docs: Update redirected vercel.com/nextjs.org links to current targets by <a href="https://github.com/molebox"><code>@molebox</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13685">vercel/turborepo#13685</a></li> <li>refactor: Generalize native command arguments by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13664">vercel/turborepo#13664</a></li> <li>refactor: Move native contracts to tasks by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13665">vercel/turborepo#13665</a></li> <li>docs: Fix loadTransformers reference in turbo-codemod README by <a href="https://github.com/latent-9"><code>@latent-9</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13683">vercel/turborepo#13683</a></li> <li>refactor: Model native task execution explicitly by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13666">vercel/turborepo#13666</a></li> <li>feat: Compose aggregate native task dependencies by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13667">vercel/turborepo#13667</a></li> <li>fix: Respect aggregate task overrides by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13668">vercel/turborepo#13668</a></li> <li>test: Stabilize watch task inputs regression test by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13686">vercel/turborepo#13686</a></li> <li>feat: Parse Python quality tool declarations by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13669">vercel/turborepo#13669</a></li> <li>feat: Resolve Python quality plans by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13670">vercel/turborepo#13670</a></li> <li>refactor: Extract uv native task specs by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13671">vercel/turborepo#13671</a></li> <li>feat: Synthesize Python quality tasks by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13672">vercel/turborepo#13672</a></li> <li>test: Cover Python quality task commands by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13673">vercel/turborepo#13673</a></li> <li>feat: Hash Python quality task inputs by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13674">vercel/turborepo#13674</a></li> <li>test: Cover Python quality task graph by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13675">vercel/turborepo#13675</a></li> <li>chore: Release Turborepo 2.10.9-canary.1 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13687">vercel/turborepo#13687</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/33237d4be13d7b74768c2cf3353b19cfa8d1af7c"><code>33237d4</code></a> publish 2.10.9 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/3b0e57f1289b2a6b3d6dd402bce928469d3b25fa"><code>3b0e57f</code></a> fix: Prevent Windows process cleanup PID reuse (<a href="https://redirect.github.com/vercel/turborepo/issues/13695">#13695</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/efe4e1bdf665f2950cf89d7968907de36c2f0737"><code>efe4e1b</code></a> fix: Prune Bun wildcard workspace dev dependencies (<a href="https://redirect.github.com/vercel/turborepo/issues/13694">#13694</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/a98e5cde97796088c6107684a64a40a967cd1ef0"><code>a98e5cd</code></a> docs: Document dependency-driven Python tasks (<a href="https://redirect.github.com/vercel/turborepo/issues/13676">#13676</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/c09a92f526b6dca9ea0243922f680803779759cd"><code>c09a92f</code></a> chore: Release Turborepo 2.10.9-canary.1 (<a href="https://redirect.github.com/vercel/turborepo/issues/13687">#13687</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/09bd548dddbff2a29086bdef7cb07b02d5e5458a"><code>09bd548</code></a> test: Cover Python quality task graph (<a href="https://redirect.github.com/vercel/turborepo/issues/13675">#13675</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/3584a5fb8edac9efc826fdea57e92088505fc76a"><code>3584a5f</code></a> feat: Hash Python quality task inputs (<a href="https://redirect.github.com/vercel/turborepo/issues/13674">#13674</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/0d43ff3cbf5ac8873c646a84b2fd7ae53097e08d"><code>0d43ff3</code></a> test: Cover Python quality task commands (<a href="https://redirect.github.com/vercel/turborepo/issues/13673">#13673</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/94708adc6bc19b41805741cc5a15ac5467a481cf"><code>94708ad</code></a> feat: Synthesize Python quality tasks (<a href="https://redirect.github.com/vercel/turborepo/issues/13672">#13672</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/e14f04ec6c2dc2791b0a3beb32df7515b31b3d4b"><code>e14f04e</code></a> refactor: Extract uv native task specs (<a href="https://redirect.github.com/vercel/turborepo/issues/13671">#13671</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.10.8...v2.10.9">compare view</a></li> </ul> </details> <br /> Updates `chrome-devtools-mcp` from 1.6.0 to 1.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/releases">chrome-devtools-mcp's releases</a>.</em></p> <blockquote> <h2>chrome-devtools-mcp: v1.7.0</h2> <h2><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a> (2026-08-10)</h2> <h3>🎉 Features</h3> <ul> <li>add a utility function to check for localhost. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li> <li>Add get_heapsnapshot_object_details MCP tool (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li> <li>Emit native contexts in snapshot summary (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li> <li>Filter heap snapshot objects by native context (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li> <li><strong>telemetry:</strong> log devtools data. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li> <li><strong>telemetry:</strong> log is_devtools_open with each tool call. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li> <li><strong>telemetry:</strong> report whether tool call is made on localhost. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li> <li>update lighthouse to 13.4.1 (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li> </ul> <h3>🛠️ Fixes</h3> <ul> <li>bound per-navigation network request retention (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li> <li><strong>cli:</strong> validate session ids (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li> <li><strong>cli:</strong> warn about version mismatch between cli and daemon (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li> <li><strong>daemon:</strong> preserve hyphenated browser flags in arg serialization and lazy daemon startup (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li> <li>dispose heap snapshot workers on context teardown (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li> <li>do not throw synchronously when a CDP session is gone (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li> <li>don't throw if Dialog was handled (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li> <li>downscale viewport screenshots when no viewport is emulated (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li> <li>improve daemon lifecycle (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li> <li>improve file writing (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li> <li>include the tab id in <code>get_tab_id</code>'s text response (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li> <li><strong>memory:</strong> dispose the heap-snapshot worker when loading fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li> <li><strong>performance:</strong> reset trace-running flag when start_trace setup fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li> <li>regression after the <a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a> (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li> <li>rename maxRetainedSize column (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li> <li><strong>screenshot:</strong> dispose element handle after take_screenshot (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li> <li>toggle lazy loading for source maps. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li> <li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens during an action (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li> </ul> <h3>📄 Documentation</h3> <ul> <li>Add devin cli install instruction to README (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li> <li>correct the user data directory documentation (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li> <li><strong>skills:</strong> update memory leak debugging skill to use native MCP tools (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li> <li>Update Chrome requirement for categoryExperimentalWebmcp (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li> <li>update security.md (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li> </ul> <h3>🏗️ Refactor</h3> <ul> <li>clean up McpResponse.handle (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/main/CHANGELOG.md">chrome-devtools-mcp's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a> (2026-08-10)</h2> <h3>🎉 Features</h3> <ul> <li>add a utility function to check for localhost. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li> <li>Add get_heapsnapshot_object_details MCP tool (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li> <li>Emit native contexts in snapshot summary (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li> <li>Filter heap snapshot objects by native context (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li> <li><strong>telemetry:</strong> log devtools data. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li> <li><strong>telemetry:</strong> log is_devtools_open with each tool call. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li> <li><strong>telemetry:</strong> report whether tool call is made on localhost. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li> <li>update lighthouse to 13.4.1 (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li> </ul> <h3>🛠️ Fixes</h3> <ul> <li>bound per-navigation network request retention (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li> <li><strong>cli:</strong> validate session ids (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li> <li><strong>cli:</strong> warn about version mismatch between cli and daemon (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li> <li><strong>daemon:</strong> preserve hyphenated browser flags in arg serialization and lazy daemon startup (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li> <li>dispose heap snapshot workers on context teardown (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li> <li>do not throw synchronously when a CDP session is gone (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li> <li>don't throw if Dialog was handled (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li> <li>downscale viewport screenshots when no viewport is emulated (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li> <li>improve daemon lifecycle (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li> <li>improve file writing (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li> <li>include the tab id in <code>get_tab_id</code>'s text response (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li> <li><strong>memory:</strong> dispose the heap-snapshot worker when loading fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li> <li><strong>performance:</strong> reset trace-running flag when start_trace setup fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li> <li>regression after the <a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a> (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li> <li>rename maxRetainedSize column (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li> <li><strong>screenshot:</strong> dispose element handle after take_screenshot (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li> <li>toggle lazy loading for source maps. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li> <li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens during an action (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li> </ul> <h3>📄 Documentation</h3> <ul> <li>Add devin cli install instruction to README (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li> <li>correct the user data directory documentation (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li> <li><strong>skills:</strong> update memory leak debugging skill to use native MCP tools (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li> <li>Update Chrome requirement for categoryExperimentalWebmcp (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li> <li>update security.md (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li> </ul> <h3>🏗️ Refactor</h3> <ul> <li>clean up McpResponse.handle (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li> <li>introduce Explicit resouce managent (using) (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>) (<a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5b25370c9cd779032c3c9dc9880eca7031c73005">5b25370</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/774d78f5eef5e610407a0c92fa6ec5ed74b027e8"><code>774d78f</code></a> chore(main): release chrome-devtools-mcp 1.7.0 (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2363">#2363</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57"><code>5ddbffd</code></a> docs: correct the user data directory documentation (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753"><code>8028bfe</code></a> fix: toggle lazy loading for source maps. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d1e4d711aa520c67df045a2f805380e9b3307abd"><code>d1e4d71</code></a> chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.2 in the all gr...</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93"><code>744738d</code></a> fix(memory): dispose the heap-snapshot worker when loading fails (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ca66d0f321a57473ae400fa5e82842d4bbffe210"><code>ca66d0f</code></a> chore(dev-deps): bump devtools-frontend (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2498">#2498</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/2f375c7e592d15ee9d0e1d665a4600a8b20879d0"><code>2f375c7</code></a> chore: fix Explicit resource management polyfill (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2496">#2496</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/830f78b8ce19f8ee1e1d8c4d812bd9d6e4f48c2f"><code>830f78b</code></a> chore: re-use connection adapter and dispose devtools unvierse (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2465">#2465</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c96dca1f19711a80308bd0d608fb8d40e29d152"><code>4c96dca</code></a> ci: add main branch (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2497">#2497</a>)</li> <li><a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/71d897b27e7936c1a8911d053e19d92ec2c46655"><code>71d897b</code></a> chore: add a new profiler scenario for get_console_messages. (<a href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2491">#2491</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">compare view</a></li> </ul> </details> <br /> Updates `@earendil-works/pi-coding-agent` from 0.83.0 to 0.84.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/earendil-works/pi/releases">@earendil-works/pi-coding-agent's releases</a>.</em></p> <blockquote> <h2>v0.84.1</h2> <h3>New Features</h3> <ul> <li><strong>Qwen Token Plan Individual</strong> — Use the built-in provider for models documented for Individual subscriptions. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API Keys</a>.</li> <li><strong>Authentication readiness checks</strong> — Use <code>pi auth check</code> to verify provider or model credentials, optionally emitting the resolved credential.</li> <li><strong>Improved fullscreen interaction</strong> — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI Fullscreen Viewport</a>.</li> <li><strong>Terminating blocked tool calls</strong> — Extension <code>tool_call</code> handlers can stop all-terminating batches without another model call. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool Events</a>.</li> </ul> <h3>Added</h3> <ul> <li>Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international <code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API Keys</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a> by <a href="https://github.com/arasovic"><code>@arasovic</code></a>).</li> <li>Added <code>pi auth check</code> provider/model auth preflight with optional credential output (<a href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li> <li>Added <code>terminate</code> support to blocked extension <code>tool_call</code> events so all-terminating batches can skip the automatic follow-up model call. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool Events</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a> by <a href="https://github.com/muyiyr"><code>@muyiyr</code></a>).</li> <li>Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (<a href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>, <a href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a> by <a href="https://github.com/volsa"><code>@volsa</code></a>).</li> <li>Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See <a href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI Fullscreen Viewport</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li> </ul> <h3>Changed</h3> <ul> <li>Softened the bash tool's <code>PI_*</code> environment guideline in an attempt to reduce unnecessary inspection commands (<a href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li> <li>Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed Bun standalone binaries crashing on startup when the cwd contains a <code>bunfig.toml</code> with <code>preload</code> by compiling with <code>--no-compile-autoload-bunfig</code> (<a href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a> by <a href="https://github.com/geril07"><code>@geril07</code></a>).</li> <li>Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (<a href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li> <li>Fixed right-click not pasting clipboard text in fullscreen mode on Windows.</li> <li>Fixed inherited <code>Agent.reset()</code> clearing transcript and runtime state during active runs; it now rejects until the agent is idle (<a href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a> by <a href="https://github.com/wesleyzhangwq"><code>@wesleyzhangwq</code></a>).</li> <li>Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.</li> <li>Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.</li> </ul> <h2>v0.84.0</h2> <h3>New Features</h3> <ul> <li><strong>Fullscreen TUI mode</strong> — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#ui--display">UI & Display</a>.</li> <li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#markdown">Markdown settings</a> and <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/tui/README.md#markdown">TUI Markdown</a>.</li> <li><strong>Per-directory context overrides</strong> — Use <code>AGENTS.override.md</code> to replace context files for a specific directory. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/usage.md#context-files">Context Files</a>.</li> <li><strong>Advanced custom model sampling</strong> — Configure arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM <code>thinking_token_budget</code> values. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/models.md#sampling-parameters">Sampling Parameters</a>.</li> <li><strong>Baseten provider</strong> — Use built-in Baseten authentication and model support. See <a href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/providers.md#api-keys">API Keys</a>.</li> </ul> <h3>Breaking Changes</h3> <ul> <li> <p>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code> interface to <code>ModelsRequestTransforms</code> because its header transformation now applies to all authenticated provider requests.</p> </li> <li> <p>Changed JSON and RPC <code>message_update</code> events to emit only <code>assistantMessageEvent</code> deltas, removing the cumulative <code>message</code> and <code>assistantMessageEvent.partial</code> fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between <code>message_start</code> and <code>message_end</code>; the latter remains authoritative (<a href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</p> </li> <li> <p><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns <code>ProviderHeaders</code> with <code>string | null</code> values and preserves <code>null</code> header-deletion markers. Extensions that inspect returned headers must handle <code>null</code>; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (<a href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</p> </li> <li> <p>Changed <code>ModelRegistry.refresh()</code> to accept <code>ModelsRefreshOptions</code> and return <code>ModelsRefreshResult</code> instead of discarding cancellation and provider errors.</p> </li> <li> <p>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth cancellation options rather than catalog refresh options. Call <code>refresh({ providers: [providerId], signal })</code> separately when remote freshness is required.</p> </li> <li> <p>Required config-form extension OAuth <code>refreshToken(credentials, signal)</code> callbacks to accept and honor a concrete abort signal.</p> </li> <li> <p>Replaced dynamic provider refresh context store access with the read-only <code>context.stored</code> snapshot and generation-checked <code>context.publish()</code> transaction.</p> <p><strong>Providers built with <code>createProvider({ fetchModels })</code>:</strong> no catalog-publication migration is required. Before and after, return the fetched models and register the resulting provider; <code>createProvider()</code> owns restoration, persistence, and in-memory publication.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@earendil-works/pi-coding-agent's changelog</a>.</em></p> <blockquote> <h2>[0.84.1] - 2026-08-07</h2> <h3>New Features</h3> <ul> <li><strong>Qwen Token Plan Individual</strong> — Use the built-in provider for models documented for Individual subscriptions. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API Keys</a>.</li> <li><strong>Authentication readiness checks</strong> — Use <code>pi auth check</code> to verify provider or model credentials, optionally emitting the resolved credential.</li> <li><strong>Improved fullscreen interaction</strong> — Select words and paragraphs with multiple clicks and configure half-page transcript scrolling. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI Fullscreen Viewport</a>.</li> <li><strong>Terminating blocked tool calls</strong> — Extension <code>tool_call</code> handlers can stop all-terminating batches without another model call. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool Events</a>.</li> </ul> <h3>Added</h3> <ul> <li>Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international <code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API Keys</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a> by <a href="https://github.com/arasovic"><code>@arasovic</code></a>).</li> <li>Added <code>pi auth check</code> provider/model auth preflight with optional credential output (<a href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li> <li>Added <code>terminate</code> support to blocked extension <code>tool_call</code> events so all-terminating batches can skip the automatic follow-up model call. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool Events</a> (<a href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a> by <a href="https://github.com/muyiyr"><code>@muyiyr</code></a>).</li> <li>Added inherited double-click word and whitespace selection, granularity-aware drag selection, and triple-click paragraph selection in fullscreen mode (<a href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>, <a href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a> by <a href="https://github.com/volsa"><code>@volsa</code></a>).</li> <li>Added inherited unbound half-page transcript scrolling actions for fullscreen mode. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI Fullscreen Viewport</a> (<a href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li> </ul> <h3>Changed</h3> <ul> <li>Softened the bash tool's <code>PI_*</code> environment guideline in an attempt to reduce unnecessary inspection commands (<a href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li> <li>Reduced worst-case automatic terminal theme detection delay from 200 ms to 100 ms by probing color-scheme and background support concurrently.</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed Bun standalone binaries crashing on startup when the cwd contains a <code>bunfig.toml</code> with <code>preload</code> by compiling with <code>--no-compile-autoload-bunfig</code> (<a href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a> by <a href="https://github.com/geril07"><code>@geril07</code></a>).</li> <li>Fixed extension TUI method wrappers recursing indefinitely when delegating to the original method (<a href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li> <li>Fixed right-click not pasting clipboard text in fullscreen mode on Windows.</li> <li>Fixed inherited <code>Agent.reset()</code> clearing transcript and runtime state during active runs; it now rejects until the agent is idle (<a href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a> by <a href="https://github.com/wesleyzhangwq"><code>@wesleyzhangwq</code></a>).</li> <li>Fixed inherited LaTeX relation, multiplication, and named-operator spacing, and matrix composition with stacked fractions, operator limits, and adjacent matrices.</li> <li>Reduced inherited fullscreen mouse event volume under tmux, Zellij, and GNU Screen by using button-motion tracking instead of all-motion tracking.</li> </ul> <h2>[0.84.0] - 2026-08-06</h2> <h3>New Features</h3> <ul> <li><strong>Fullscreen TUI mode</strong> — Switch between regular and fullscreen modes at runtime, with a sticky editor and footer, independently scrollable transcript, and draggable scrollbars. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#ui-display">UI & Display</a>.</li> <li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid diagrams and terminal-friendly Unicode math in interactive transcripts. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#markdown">Markdown settings</a> and <a href="https://github.com/earendil-works/pi/blob/main/packages/tui/README.md#markdown">TUI Markdown</a>.</li> <li><strong>Per-directory context overrides</strong> — Use <code>AGENTS.override.md</code> to replace context files for a specific directory. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context Files</a>.</li> <li><strong>Advanced custom model sampling</strong> — Configure arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM <code>thinking_token_budget</code> values. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/models.md#sampling-parameters">Sampling Parameters</a>.</li> <li><strong>Baseten provider</strong> — Use built-in Baseten authentication and model support. See <a href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API Keys</a>.</li> </ul> <h3>Breaking Changes</h3> <ul> <li>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code> interface to <code>ModelsRequestTransforms</code> because its header transformation now applies to all authenticated provider requests.</li> <li>Changed JSON and RPC <code>message_update</code> events to emit only <code>assistantMessageEvent</code> deltas, removing the cumulative <code>message</code> and <code>assistantMessageEvent.partial</code> fields that caused quadratic output growth. Clients that need partial messages must assemble deltas between <code>message_start</code> and <code>message_end</code>; the latter remains authoritative (<a href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</li> <li><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns <code>ProviderHeaders</code> with <code>string | null</code> values and preserves <code>null</code> header-deletion markers. Extensions that inspect returned headers must handle <code>null</code>; extensions forwarding them to pi-ai streams should pass them through unchanged. This prevents placeholder OpenAI credentials from being sent through Cloudflare AI Gateway (<a href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</li> <li>Changed <code>ModelRegistry.refresh()</code> to accept <code>ModelsRefreshOptions</code> and return <code>ModelsRefreshResult</code> instead of discarding cancellation and provider errors.</li> <li>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth cancellation options rather than catalog refresh options. Call <code>refresh({ providers: [providerId], signal })</code> separately when remote freshness is required.</li> <li>Required config-form extension OAuth <code>refreshToken(credentials, signal)</code> callbacks to accept and honor a concrete abort signal.</li> <li>Replaced dynamic provider refresh context store access with the read-only <code>context.stored</code> snapshot and generation-checked <code>context.publish()</code> transac... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>@composio/cli@0.3.4-beta.353 |
||
|
Malay Vasa
|
d47ed21a43 |
docs: expand the Platform code mock with the real quickstart lines
Show the actual six-line quickstart snippet (`import Composio` + `import OpenAIAgentsProvider` + `new Composio({ provider })` + `composio.create(userId)` + `session.tools()` + `new Agent({ … })`), tightened to 11.5px / 1.75 leading so it fits inside the same left-pane height as the For You card.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
||
|
Malay Vasa
|
4a1b8c314a |
docs: redesign the Welcome landing around Platform / For You
Two-ways-to-start hero: cards now lead with the canonical Composio + product-badge lockup (dashboard-parity) and the same product mocks the dashboard onboarding path step uses — a chat composer flanked by client logos for For You, a code panel for Platform. Right link pane width matches a feature-grid card exactly. Features grid: whole-card links restored, each mock fades into the card edge with a mask-image, cards live on a single flush bg-fd-card surface. Tools mock bumps from an 8×2 grid of 16 tiles to 10×3 = 30 for more impact, Auth becomes a live schematic — one user identity card wired to three connected-account cards via elbow connectors computed from real DOM geometry (`home-auth-diagram.tsx`), Triggers drops the fake LIVE ping in favor of a plain event list, Sandbox drops the workbench chrome + CPU lights for a clean filename + code panel. Resources: adds a Platform Dashboard link so the 3×2 grid is complete. Drops the "Get started / What you get / Reach for the rest" eyebrows and section heading — headings stand on their own. Copy: `audience` → `product`, so llms.txt emits `**Platform**` / `**For You**` instead of `**Platform**` / `**For you**`; matched in `home-navigation.test.ts`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
dependabot[bot]
|
7e560fd072 |
chore(deps-dev): bump langchain-openai from 1.4.1 to 1.4.3 in /python in the pip-version group across 1 directory (#4132)
Bumps the pip-version group with 1 update in the /python directory: [langchain-openai](https://github.com/langchain-ai/langchain). Updates `langchain-openai` from 1.4.1 to 1.4.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-openai's releases</a>.</em></p> <blockquote> <h2>langchain-openai==1.4.3</h2> <p>Changes since langchain-openai==1.4.2</p> <p>release(openai): 1.4.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39485">#39485</a>) fix(openai): filter invalid tool calls from content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39366">#39366</a>) chore(openai): update guidance for responses API for OpenAI-compatible providers (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39327">#39327</a>) chore(openai): update docstring for <code>include_response_headers</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39326">#39326</a>)</p> <h2>langchain-openai==1.4.2</h2> <p>Changes since langchain-openai==1.4.1</p> <p>release(openai): 1.4.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39322">#39322</a>) fix(openai): handle <code>ContextWindowExceededError</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39300">#39300</a>) chore: bump the minor-and-patch group across 3 directories with 7 updates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39187">#39187</a>) fix(openai): filter langchain-generated content block IDs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39209">#39209</a>) fix(openai): preserve Responses <code>text</code> options (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39204">#39204</a>) fix(openai): redact MCP <code>authorization</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39155">#39155</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39050">#39050</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/56daacc8dff4103f430b121711f601ae503bddf9"><code>56daacc</code></a> release(openai): 1.4.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39485">#39485</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/24e8d2b5960ce52985d99332d29ab503fc4be5f9"><code>24e8d2b</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39344">#39344</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/9b4ef2ab34bdb6f2313bef3f8ee25202eb089ef2"><code>9b4ef2a</code></a> fix(openai): filter invalid tool calls from content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39366">#39366</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/9f738f5297d14f46f0341f6c2d773cbf12962e82"><code>9f738f5</code></a> fix(core): compat with pydantic 2.14 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39328">#39328</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/d048fbe170573b6e7056b5ef5f78d8451e54abaf"><code>d048fbe</code></a> chore: bump h2 from 4.3.0 to 4.4.1 in /libs/langchain (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39325">#39325</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/a0a434c18550a21ed9137ddc5f0533cb74f8416b"><code>a0a434c</code></a> chore: bump h2 from 4.3.0 to 4.4.1 in /libs/langchain_v1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39324">#39324</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/c318abed446e7d1a0e872a6967b9b17bc6f4761c"><code>c318abe</code></a> fix(text-splitters): raise TypeError for non-dict, non-convertible input to R...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/1499aa9900987c6050670eb1cbd47bc4db0a6d18"><code>1499aa9</code></a> fix(core): stop StructuredPrompt from mutating caller kwargs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39174">#39174</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/0424e03dc71cc487dd11e5fa71d083533cb26816"><code>0424e03</code></a> fix(core): preserve flat tool args schema for <code>RootModel</code> runnables (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39307">#39307</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/bc16168d710d8b594d0bc622c70361876bd9cbda"><code>bc16168</code></a> fix(langchain): preserve history on <code>SummarizationMiddleware</code> summary failure...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-openai==1.4.1...langchain-openai==1.4.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Kshitij Jhunjhunwala
|
be43f1a43f | Merge branch 'kj/docs-sidebar-instrumentation' of https://github.com/ComposioHQ/composio into kj/docs-sidebar-instrumentation | ||
|
Kshitij Jhunjhunwala
|
c0935ff348 |
docs: fix sidebar click gating and make position a visible row index
Review follow-ups on the docs_sidebar_click instrumentation. usePostHog() resolves to the posthog-js module singleton whether or not a provider is mounted, so the `!posthog` guard never fired: with no NEXT_PUBLIC_POSTHOG_KEY the listener still attached and every sidebar click called capture() on an uninitialized instance, logging "You must initialize PostHog before calling posthog.capture". Gate the effect on the same env var components/posthog-provider.tsx gates on. position threaded through folder recursion, so a collapsed folder's hidden children counted as rows: Triggers is the 4th visible row under Core concepts but reported 11, which would inflate any "clicks land in the top N rows" reading — the same inference error this instrumentation exists to remove. Count per level instead, so a folder occupies one row for its siblings and its children get their own 1..n sequence. Making group and position per-level locals also removes the latent collision where a separator nested in a folder reset the counter for the folder's siblings; a test pins that case. Also: capture auxclick (middle button only) so sidebar links opened in a new tab are not missing while Cmd/Ctrl+click ones are counted; a folder with a non-string name now reports folder: null rather than inheriting its parent's label; and both reference layouts memoize the index instead of rebuilding it on every render. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
0fd075ecaf | Merge branch 'next' into kj/docs-sidebar-instrumentation | ||
|
Alberto Schiabel
|
a71b812db1 |
refactor(cli): rename LocalToolkitSlugs.match to longestPrefix (#4145)
## Summary Renames `LocalToolkitSlugs.match` to `longestPrefix` to clear CodeQL code-scanning alert [#113](https://github.com/ComposioHQ/composio/security/code-scanning/113) (`js/regex-injection`, high). ## Why The alert flagged `local.match(toolSlug)` in `toolkit-from-tool-slug.ts` as a regular expression constructed from a command-line argument. It is a false positive: `local` is a `LocalToolkitSlugs` object, and its `match` member is a custom longest-prefix matcher (`makeLongestPrefixMatcher`) that only does `toolSlug.toLowerCase().split('_')` plus `Set` membership lookups — no `RegExp` is ever constructed. CodeQL's `js/regex-injection` sink is keyed on the `match` member name (matching `String.prototype.match`, which coerces a string argument into a `RegExp`), so it could not tell the custom method apart from the string sink. The member name `match` on a non-string object invited exactly that confusion — for the analyzer and for human readers. Renaming it to `longestPrefix` (mirroring the underlying `makeLongestPrefixMatcher` / `longestPrefix` helper) removes the false positive without suppressing anything, and reads more clearly. ## Changes - `services/toolkit-slug-catalog.ts`: interface member and object literal `match` → `longestPrefix` - `effects/toolkit-from-tool-slug.ts`: call site `local.match(...)` → `local.longestPrefix(...)` ## Verification - `pnpm typecheck` — 14/14 packages pass - lint-staged (oxlint + prettier) clean on commit The alert should clear on the next CodeQL scan of the merged commit.@composio/cli@0.3.4-beta.352 |
||
|
Kshitij Jhunjhunwala
|
fe623da434 |
docs: emit docs_sidebar_click with sidebar group and depth
The docs app had exactly one posthog.capture call ($pageview), so any question about how people move through the sidebar had to be answered by reverse-engineering pageview ordering within a session. $referring_domain is no help either: pageviews are captured manually on client-side route change, so document.referrer never updates on internal navigation. Adds a docs_sidebar_click event carrying href, group, folder, depth, position and from_path. Group/folder/depth are derived from the fumadocs page tree at build time and the click handler only does an href lookup — reading them off the rendered sidebar would mean depending on separators being <p> and folder triggers being <button>, which is fumadocs-internal and breaks on upgrade. Mounted on the docs, examples and both reference sidebars. Nothing fires when PostHog is unconfigured, for non-sidebar links, or for an href that is not in the index. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
b297a6ed5e |
docs: restore auth pages to the sidebar as an Authentication folder (#4136)
## What The auth guides and shared connections dropped out of the sidebar in #4099. This puts them back. `authentication.mdx` becomes an `authentication/` folder holding the seven auth guides. `shared-connections` moves into `extending-sessions/`, alongside the other experimental session features. Top-level sidebar row count is unchanged at 20 — the guides are folder children, which fumadocs expands automatically when you're inside the section. ## Changes - `authentication.mdx` → `authentication/index.mdx`, with the 7 guides moved in and a new `meta.json`. `/docs/authentication` keeps its URL. - `shared-connections.mdx` → `extending-sessions/shared-connections.mdx`. - Root `meta.json`: `---Migration and security---` split into `---Migration---` and `---Security and data---`. Different audiences; adds a heading, not a clickable row. - Removed `AUTHENTICATION_GUIDE_URLS` from `app/llms.txt/route.ts`. With the pages back in the page tree, llms.txt emits them automatically and the hand-maintained list was a duplicate. - 8 redirects added. 9 pre-existing redirect destinations repointed so they don't chain through the moved paths. - ~90 inbound links rewritten. ## Verification - `bun run lint:links` — 0 errors - `bun run test` — 207 pass, 0 fail - `bun run types:check` — pass - `bun run lint` — no new warnings - `/llms.txt` contains all 8 URLs exactly once - All 8 old URLs redirect; `/docs/authentication` returns 200 `permanent: true` emits 308, matching every existing redirect in the file. ## Open questions, not addressed here 1. `sessions-vs-direct-execution` carries `legacy: true`, and llms.txt skips legacy sections — so the page that explains *when* to use direct execution is invisible to agents. Same class of issue as #3999. 2. Worth re-running the docs agent eval against this preview. 3. `single-toolkit-mcp` has been deprecated since January and takes ~700 cold search landings a month with no banner on the page. 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Kshitij Jhunjhunwala
|
87abcf8112 |
docs: keep the single "Migration and security" separator
Revert the separator split, and the later ---Security--- rename with it. Each half held exactly one folder whose title near-repeats the heading, so the sidebar read "Migration" / "Migration guides" and "Security" / "Security and data", and llms.txt emitted "## Security" immediately above "### Security and data". content/docs/meta.json is byte-identical to next again; both folders keep their titles. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
4124f713b3 |
docs: stop folders swallowing their siblings in llms.txt; fix auth folder link
Four review fixes on the sidebar restore. Folder headings do not close, so every page emitted after a folder read as one of that folder's children. Making `authentication` a folder mid-list swallowed `triggers` and `skills` into `### Authentication`. Reordering meta.json would fix the output but push Authentication below Skills in the human sidebar, which is what this PR exists to prevent — so walkPageTree now buffers each separator section and flushes its plain pages ahead of its folders. Legacy-separator skipping is unchanged. This also fixes the pre-existing case where `agent-plugins`, `cli` and `composio-connect` read as children of `#### Custom providers`. Drop "index" from authentication/meta.json. Listing it clears `node.index`, so fumadocs renders the folder as a chevron BUTTON plus a duplicate child row instead of a SidebarFolderLink — the row a reader clicks to reach /docs/authentication (1,850 views/month) expanded the folder instead of navigating. Omitting it matches how `providers` and `migration-guide` already render. Verified in the built DOM: an A with href=/docs/authentication, no duplicate row, /docs/authentication.md still emitted exactly once via node.index. Rename the ---Security and data--- separator to ---Security---; it duplicated the folder title directly beneath it, in llms.txt and in the sidebar. Point the last three agent/instructions/context.md bullets at canonical paths rather than redirect-only /docs/authenticating-users/* ones, so that file is internally consistent. Extend the llms.txt section test to assert the nearest preceding heading of any level, and to cover the sibling pages that regressed. It fails against the old walk. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
c3f117e3e8 |
docs: assert llms.txt output directly, leave the example snapshot alone
Two review follow-ups: - Revert docs/lib/standup-bot-source.json. It is an upstream source snapshot that gets regenerated, so editing the doc URL in that code comment only desyncs it and would be clobbered anyway. The permanent redirect covers the stale path. - Strengthen the agent-reachability assertion in start-routing.test.ts. Asserting meta.json membership alone is weaker than the assertion it replaced, which checked a string that actually shipped into llms.txt: a break in the page-tree walk would have gone unnoticed. Import the llms.txt route handler and assert its generated output — each of the 8 guide URLs present exactly once, the 7 auth guides under Core concepts -> Authentication, shared-connections under Guides -> Extend sessions, and no trailing "## Authentication guides" section. Follows the existing tests/static/llms-openapi.test.ts pattern of importing an app route directly, so it runs in `bun run test` with no server. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
5ca29e857e |
docs: restore auth pages to the sidebar as an Authentication folder
PR #4099 dropped 8 auth pages from meta.json. That was a net win for machines (Loop 5 eval: 84/100 vs 77/100, tool-routing failure mode gone) but it made the pages unreachable by clicking. PostHog, weekday-matched and control-adjusted, shows the affected pages down 14-64pp beyond the site-wide baseline drift. Restore human navigation without touching the machine-facing wins: - authentication.mdx becomes authentication/index.mdx and the 7 sibling auth pages move into the folder. /docs/authentication keeps its URL (fumadocs serves index.mdx at the folder route), so Core concepts still shows one row and the top-level sidebar row count stays 20. - shared-connections moves into extending-sessions: it is experimental and is a session capability, not a core auth concept. - "Migration and security" splits into "Migration" and "Security and data" — separator headings, not clickable rows. - Drop AUTHENTICATION_GUIDE_URLS from app/llms.txt/route.ts. The pages are back in the page tree, so they emit automatically under Core concepts -> Authentication; the hardcoded list would now duplicate. - 8 permanent redirects for the old URLs (36-42% Google entry rate on most of them), plus existing redirect destinations repointed so none of them chain. - ~90 inbound links rewritten across content, api-overviews, app, lib and agent instructions. lint:links is the gate: 0 errors. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
71ec523d25 |
feat(examples): live-sweep harness, manifest, and scheduled workflow (#4117)
This PR: - builds on merged PR #4107 - adds `examples-manifest.json`: 93 runnable entrypoints across both SDKs with tiers (unattended / provisioned / bounded / excluded), per-entry timeouts, env contracts, and labeled readiness markers for OAuth flows - adds `harness/run.mjs`: sweeps entries against staging with per-entry Composio traces, negative controls (garbage credentials must fail), a `selftest`, and a baseline/candidate client swap for parity runs - rejects every non-staging `COMPOSIO_BASE_URL` before the harness or provisioning script can send credentials - adds `--llm mock`: LLM examples run against a pinned `@copilotkit/aimock` server with scripted tool-call fixtures (`harness/llm-mock/`) — full sweeps spend zero model tokens while Composio tool execution stays live on staging; 46/48 LLM entries pass mocked, and the two `@openai/agents` entries are marked `llmMock:false` - adds `examples-live.yml`: nightly gc-provision → mock sweep → four-entry live LLM canary; dispatchable per language, client, entry subset, and LLM mode, and bound to the `staging` GitHub environment - accepts separate TypeScript tarball and Python wheel inputs for candidate sweeps, restores exact pre-run workspace files on failure, and rejects empty or partial parity comparisons The configured `COMPOSIO_API_KEY` must belong to a dedicated, disposable staging project. The workflow becomes dispatchable after it exists on the default branch. ## Context Examples historically went stale because nothing executed them. PR #4107 makes them runnable and provisionable; this PR adds the machinery that runs them on a schedule and validates the Stainless→self-managed client swap via baseline/candidate parity sweeps. ```mermaid graph TD M[examples-manifest.json] --> R[harness/run.mjs sweep] P[examples-provision.mjs --gc] -->|COMPOSIO_EXAMPLES_* ids| R R -->|tier 1-3 entries| E[TS + Python examples] A[aimock fixtures] -->|--llm mock| E E -->|live tool execution + traces| C[Composio staging] R --> N[nightly live canary: 4 entries] ``` ## Verification - `env -u COMPOSIO_BASE_URL node harness/run.mjs selftest` - `pnpm test:examples` against a clean tracked snapshot - manifest integrity: 93 unique entry IDs and 93 existing files - JavaScript, Python, JSON, YAML, and embedded Bash syntax checks - `pnpm validate:changesets` |
||
|
Alberto Schiabel
|
b80808606a |
fix(cli): use staging dashboard URL (#4129)
This PR: - updates `constants.STAGING_WEB_URL` so `COMPOSIO_ENVIRONMENT=staging` uses `https://staging-dashboard.composio.dev/` - adds literal regression assertions for map-backed and process-environment config loading - records the user-facing CLI fix in the unreleased changelog Verification: - `pnpm --filter @composio/cli exec vitest run test/src/services/config.test.ts` (23 passed) - `pnpm typecheck` - `pnpm lint:packages` (passes with pre-existing warnings)@composio/cli@0.3.4-beta.351 |
||
|
sdkrelease[bot]
|
fa7ef4add6 |
docs: update toolkits, API spec, and meta tools data (#4123)
## Summary Automated sync of backend data into the docs site. Triggered by: `schedule`. ## What changed - **Toolkit catalog** (`docs/public/data/toolkits.json`, `toolkits-list.json`) — refreshed list of available toolkits, auth schemes, and tools from the backend API - **OpenAPI specs** (`docs/public/openapi.json`, `docs/public/openapi-v3.json`, `docs/public/openapi-webhooks.json`) — latest v3.1 and v3.0 API specifications plus the webhook-events spec, fetched from production - **API reference pages** (`docs/content/reference/api-reference/`, `docs/content/reference/v3/api-reference/`) — regenerated index pages for both API versions - **Meta tools reference** (`docs/public/data/meta-tools.json`, `docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas and reference docs Co-authored-by: Sushmithamallesh <19796925+Sushmithamallesh@users.noreply.github.com> |
||
|
shams haroon
|
6e261d6abf |
docs(custom-mcp): auth config requirement, v3 version pinning gotcha, upsert semantics refresh (#4122)
Custom MCP hardening docs pass from Pelago feedback (Linear PLEN-2931, origin PLEN-2927), verified against platform code on master. - Auth config: state explicitly that registration does not create an auth config; for API-key and DCR OAuth servers creating one (with `is_enabled_for_tool_router: true`) is a required separate step. Also fixed the PATCH example: the update body requires `"type": "custom"` (discriminated union), the previous example would 400. - v3 gotcha: explain the empty-tools-list symptom, `GET /api/v3/tools?toolkit_slug=CUSTOM_...` pins a default version without custom tools; pass `toolkit_versions=latest` or use v3.1. - Upsert semantics refresh (tracks platform #11598): re-registering an owned slug now updates mutable fields (name, logo) in place, identical config is a no-op; `app_url` and `auth_schemes` stay immutable (409, delete + re-register). Updated the registration callout, logo section, delete section, and known gaps. 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
shams haroon
|
1c183990cf |
docs(custom-mcp): auth config is a required step, v3 version pinning, true-upsert semantics
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Azhar
|
c3623cb898 |
fix(cli): nest custom credentials under auth_config.credentials in auth-configs create (#4063)
## Summary The `composio dev auth-configs create` command fails when custom OAuth credentials are spread at the top level of `auth_config`. The API expects those values under `auth_config.credentials`. Fixes #4058 ## Changes - Nests custom credentials under `auth_config.credentials`. - Merges parsed `--scopes` into the same credentials object. - Preserves `credentials: undefined` when neither credentials nor scopes are supplied. - Captures the typed repository request in the CLI test layer and asserts the exact custom OAuth payload. - Records the user-visible fix in the CLI changelog. - Merges the current `next` branch without conflicts. ## Verification - Reproduced on the old implementation: 1 of 8 focused tests failed because `client_id` remained at `auth_config.client_id`. - Verified the fix: 8 of 8 focused auth-config create tests passed. - Full CLI package suite: 120 test files passed; 1,188 tests passed; 1 skipped. - `pnpm typecheck`: 14 tasks passed across the 19 TypeScript packages in scope. - `pnpm run lint:packages`: passed with existing warnings only. - Prettier check on all four changed files: passed. The fresh-worktree CLI suite currently needs a temporary local Vitest alias for the pre-existing `#ssrf_guard` resolver drift. That alias was used only to run the suite and is not part of this PR. ## Release notes `@composio/cli` is excluded from Changesets, so this PR updates `ts/packages/cli/CHANGELOG.md` directly. --------- Co-authored-by: jkomyno <alberto@composio.dev>@composio/cli@0.3.4-beta.350 |
||
|
sdkrelease[bot]
|
7f1ead518c |
docs: update toolkits, API spec, and meta tools data (#4044)
## Summary Automated sync of backend data into the docs site. Triggered by: `schedule`. ## What changed - **Toolkit catalog** (`docs/public/data/toolkits.json`, `toolkits-list.json`) — refreshed list of available toolkits, auth schemes, and tools from the backend API - **OpenAPI specs** (`docs/public/openapi.json`, `docs/public/openapi-v3.json`, `docs/public/openapi-webhooks.json`) — latest v3.1 and v3.0 API specifications plus the webhook-events spec, fetched from production - **API reference pages** (`docs/content/reference/api-reference/`, `docs/content/reference/v3/api-reference/`) — regenerated index pages for both API versions - **Meta tools reference** (`docs/public/data/meta-tools.json`, `docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas and reference docs --------- Co-authored-by: Sushmithamallesh <19796925+Sushmithamallesh@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Kshitij Jhunjhunwala
|
d928d94831 |
docs: restore quickstart framework picker with TypeScript, keep intent-rewrite improvements (#4121)
## Summary - Reverts the quickstart portion of #4099, which replaced the framework picker with a Python-only `uv` flow and left TypeScript readers without a quickstart path (a gap the review on that PR also flagged). - Restores the `QuickstartFlow` picker: OpenAI Agents, Claude Agent SDK, and Vercel AI SDK, each with Python and TypeScript tabs and `PackageInstall` steps. - Keeps the parts of #4099 that made the page better: - Sharper intro and the meta-tools explanation (sessions load app schemas only when the agent needs them). - Agent instructions that handle Connect Links and confirm destructive actions, applied to all six code samples. The Claude Agent SDK TypeScript sample previously shipped with no system prompt. - "What just happened?" section with dual-language session persistence notes (`session.session_id` / `session.sessionId`, `composio.use()`). - Production callout for replacing `user_123` with a stable user ID. - Logs API pointer and the "Adapt the example" cards. - Deletes `docs/tests/static/quickstart.test.ts`, which #4099 added to pin the Python-only structure. ## Validation - All three TypeScript code blocks pass strict type-checking with the docs compiler settings (same check Twoslash runs at build). - Page renders correctly on the local dev server with all three frameworks and both language tabs. - Prose follows the good-docs-writing style guide (no em-dashes, "you" voice, concept-first openings). 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Rahul Tarak
|
205329c3d2 |
docs: restore quickstart framework picker with TypeScript, keep intent-rewrite improvements
Reverts the quickstart portion of #4099, which replaced the framework picker (OpenAI Agents, Claude Agent SDK, Vercel AI SDK with Python and TypeScript tabs) with a Python-only uv flow, leaving TypeScript readers without a quickstart path. Keeps the parts of #4099 that improved the page: - Sharper intro and meta-tools explanation - Agent instructions that handle Connect Links and confirm destructive actions, applied to all six code samples (the Claude Agent SDK TypeScript sample previously had no system prompt) - "What just happened?" section, dual-language session persistence notes - Production callout for replacing user_123 with a stable user ID - Logs API pointer and "Adapt the example" cards Deletes tests/static/quickstart.test.ts, which was added by #4099 to pin the Python-only structure. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
palash-c
|
791853c0f0 |
docs: add Skills page (#4076)
Adds a Skills page under a new **Skills** section in the docs nav. ## What it covers A skill is an execution playbook for one concrete task — the tools it needs, the order to call them in, and the pitfalls that make it fail. The page leads with why that saves work (an agent rediscovering a tool sequence and its failure modes pays for it in tokens and retries), then covers what a skill contains and how to browse the catalog. ## Notes for review - **No cURL examples.** Skills are dashboard-only today — there is no public API. That cuts against the repo's usual preference for machine-readable API docs, so the page calls the absence out explicitly rather than leaving a reader hunting for an endpoint. Happy to revisit when an API lands. - **A screenshot is coming in a follow-up.** The page reads fine without one, but the browsing section would benefit. - Branched off `next` and targets `next`, per `docs/CLAUDE.md`. - Nav placement is a new `---Skills---` section. Open to it living under an existing section instead. ## Verification - `bun run scripts/validate-links.ts` → 0 errors - `bun run build` → exit 0 🤖 Generated with [Claude Code](https://claude.com/claude-code) |
||
|
Palash Kala
|
2bf35e43d5 |
docs(skills): rewrite in the house voice, and show the response
Applied the repo's good-docs-writing skill. The page broke its two hardest rules: em-dashes are banned in this style and the page was built on them (the sibling triggers page has zero), and a page with no example asked the reader to take the whole mechanism on trust. It now shows the search response carrying a plan, so the shape is concrete before the prose explains it. The field names are checked against the schema in composio_actions/utils/schemas.ts: recommended_plan_steps and known_pitfalls are string arrays, difficulty is a string, and all three are optional, present only when a skill covers the use case. The page says so, since anything else would have readers destructure fields that may be absent. Also cut the filler the audit checklist flags and made every definition a sentence rather than a dash fragment. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|
Palash Kala
|
c04f2b9332 |
Merge remote-tracking branch 'origin/next' into docs/developer-skills
# Conflicts: # docs/content/docs/meta.json |
||
|
Kshitij Jhunjhunwala
|
c1fca392de |
docs: restructure onboarding around user intent (#4099)
## Summary - Reframes the docs Welcome page around two intents: build with Composio or use Composio from an existing agent. - Replaces the framework picker with a general Python quickstart and routes other frameworks to focused provider guides. - Adds a shared Agent plugins page for Codex and Claude Code, with CLI-first setup and explicit MCP alternatives. - Simplifies the sidebar into Get Started, Core concepts, Guides, Direct execution (legacy), and Migration and security. - Keeps the Welcome page readable through its `.md` endpoint and clarifies intent routing in `llms.txt`. ## Review order 1. Welcome hero and the two intent cards. 2. Quickstart copy and runnable example. 3. Agent plugins, CLI, and MCP routing. 4. Sidebar grouping and progressive disclosure. 5. Agent-readable Welcome Markdown and regression tests. ## Validation - `bun run test` — 208 passing - `bun run types:check` - `bun run lint:links` — 0 errors - `bun run lint` — passes with pre-existing warnings only - Dashboard badge styles compared against the live product UI ## Deliberately out of scope - Docs eval harnesses or eval result files - Search ranking, agent-index generation, or agent prompt changes - Deleting pre-existing unused hero or quickstart components - Unrelated lint warnings and docs content cleanup This replaces #4085 with a one-commit, docs-only review surface. The earlier PR accumulated implementation experiments and bot commentary that made the intended change difficult to evaluate. |
||
|
Kshitij Jhunjhunwala
|
70b63f943d |
docs: clarify toolkit version defaults (#4108)
## Summary - clarify that the SDK fetching examples default to `latest` - distinguish REST v3 pinned defaults from REST v3.1 latest defaults - replace the blanket production warning with output-consumer guidance ## Root cause The legacy fetching guide used an unqualified `API` statement next to SDK examples. That conflated SDK behavior with two REST API versions and contradicted the current API reference. No SDK package changes or changeset are required. |
||
|
Kshitij Jhunjhunwala
|
aaa31ab8ad |
feat(skills): publish the Composio agent skill (#4084)
## Summary - publish the first-party `composio` skill from the SDK repository - route first by product (Composio For You or Composio Platform), then by the requested job - preserve progressive disclosure, credential safety, and a strict evidence boundary - explain exactly what the CLI, raw MCP, OpenAI/Codex plugin, and Claude Code plugin make discoverable ## Starting point This keeps Palash's generic router design and Soumya's canonical-link and cross-language corrections from temporary-repository PRs [#1](https://github.com/composio-temp/composio-skill/pull/1) ([Glen](https://app.tryglen.com/composio-temp/composio-skill/pull/1)) and [#2](https://github.com/composio-temp/composio-skill/pull/2) ([Glen](https://app.tryglen.com/composio-temp/composio-skill/pull/2)). The maintained copy now lives with Composio's SDK, CLI, and docs source instead of the temporary evaluation repository. ## Installation and discovery Project-scoped, with agent selection when needed: ```bash npx skills add ComposioHQ/composio --skill composio ``` Global, non-interactive install for the detected agent: ```bash npx skills add ComposioHQ/composio --skill composio --global --yes ``` This public skill is installed explicitly. A raw MCP connection exposes tools but does not install a skill. The CLI-owned `composio-cli` skill and the OpenAI plugin-owned `composio-runtime` skill remain separate because they own current CLI operation and hosted-versus-local runtime routing, respectively. The Claude Code plugin does not bundle another skill. ## Dashboard handoff Dashboard Getting Started is one context handled by the generic Platform route, not the skill's identity. When the developer already has the Step 1 `COMPOSIO_API_KEY`, the skill uses that existing project key, never creates or replaces it, avoids `composio dev init`, and inspects the real agent path and user identity before proposing code. ## Forward evaluation Four blind requests were run through fresh agents: 1. Personal Cursor access to Gmail and Google Calendar passed the For You/MCP route and avoided Platform credentials. 2. First-time Python setup initially overexposed advanced options; after progressive-disclosure rules, the replay stayed on the minimum SDK/session/auth path. 3. A GitHub 401 with a working project key remained a narrow provider-auth debugging task and did not restart onboarding. 4. A TypeScript dashboard handoff initially invented repository facts; after the evidence boundary, the replay preserved the key and requested the actual framework and entrypoint. These are manual routing and response-quality evaluations, not reusable eval infrastructure. A live provider/OAuth run remains part of the separate dashboard E2E gate. ## Validation - skill-creator validator: passed - canonical repository validator: 18 skills passed before this documentation-only follow-up - routing smoke test: 18/18 probes passed - isolated local `skills add --copy`: passed - current head CI: pending after the discovery clarification - no SDK package, backend, CLI, database, or release-metadata changes |
||
|
Alberto Schiabel
|
8086ef02cb |
fix(examples): align Python and TypeScript examples with current backend (#4107)
## Summary - Repairs runnable TypeScript and Python examples for current backend requirements, including authenticated MCP endpoints, current transports, valid tool identifiers, provider limits, and resource uniqueness. - Replaces placeholder resource IDs with explicit `COMPOSIO_EXAMPLES_*` configuration and makes failed examples exit loudly. - Adds `scripts/examples-provision.mjs` as an idempotent provisioning check for a disposable examples project. ## Scope - This PR no longer changes the Python SDK runtime or generated-client dependency. - Python remains pinned to the published `composio-client==1.43.0` in `pyproject.toml`, `setup.py`, and `uv.lock`. - The owned 2.x client integration is deferred until that client completes its release guarantees and is explicitly published. - The scheduled live workflow and manifest remain deferred until their runner is tracked. ## Verification - `make chk` - `make tst` (`927 passed, 33 skipped`) - Hosted checks rerun against commit `12691aca7`. |
||
|
Alberto Schiabel
|
0e3b489f9f |
docs(cli): record 0.3.2 and 0.3.3 releases (#4118)
This PR: - records the pending CLI entries under `0.3.3` - restores the missing `0.3.2` boundary from its published source tag - keeps `Unreleased` available for changes after the stable promotion - verifies the release metadata with `pnpm validate:changesets` and `pnpm test:release-workflow`@composio/cli@0.3.4-beta.349 |
||
|
sdkrelease[bot]
|
7e78b720df |
docs: update documentation for new changelog entries (#4116)
## Summary - Consolidates the provider documentation generated for the Python 0.19.0 and TypeScript provider releases. - Documents object-schema handling, dynamic-key validation, omitted/default argument behavior, and provider-specific validation failures. - Supersedes #4115, whose generated patch overlaps this one. ## Verification - `bun run types:check` - `bun run test` - `bun run lint:links` - Adversarial source-backed review with Claude Opus 5 (medium effort) --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
sdkrelease[bot]
|
02196de0b5 |
Release: update version (#4104)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.16.0 ### Minor Changes -@composio/google@0.10.2 @composio/claude-agent-sdk@0.11.0 @composio/core@0.16.0 @composio/slim@0.16.0 @composio/json-schema-to-zod@0.3.0 |
||
|
Alberto Schiabel
|
26ec42a38c |
chore(py): prepare 0.19.0 release (#4114)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/4094 - bumps `composio` and all 12 provider distributions from `0.18.2` to `0.19.0` - keeps `python/composio/__version__.py` and `uv.lock` aligned with package metadata - documents recursive provider argument-presence preservation in the existing cross-SDK changelog - passes the release-workflow guard, Ruff, mypy, provider type inference, and 1,167 Python tests - builds and validates 26 wheel/sdist artifacts with Twine - must be retargeted to `next` after #4094 mergespy@0.19.0 |
||
|
Alberto Schiabel
|
26f380612c |
fix(docs): probe canonical Markdown route (#4113)
This PR: - replaces the removed `/docs/tools-and-toolkits.md` health probe with `/docs/how-composio-works.md` - restores the scheduled docs health check after the tools page moved in the sessions-first rewrite - verifies the canonical endpoint returns `200 text/markdown` - keeps the release stack unchanged |
||
|
Alberto Schiabel
|
fc036563b0 |
fix(py): preserve provider tool arguments (#4094)
This PR: - builds on #4081's cross-SDK JSON Schema conversion contract - closes #4092 and supersedes the narrower CrewAI-only proposal in #4093 - validates and serializes CrewAI, LangChain, and LangGraph arguments without renaming aliases, padding omitted optionals with `None`, dropping explicit nulls, declared defaults, or dynamic extras - forces framework validation for pattern-only and other zero-field Pydantic schemas before tool execution - returns structured CrewAI validation failures The final correctness pass extends presence tracking recursively. It combines each selected Pydantic model's `model_fields_set` with metadata for JSON Schema-declared defaults, including nested objects, arrays, maps, `anyOf`/`oneOf`, overlapping `patternProperties`, and schema-valued `additionalProperties`. It preserves literal `$ref`-shaped instance defaults and keeps dynamic attributes and `model_extra` in their previous plain dict/list form. Repeated dynamic-key materialization is presence-safe and does not turn omitted nullable fields into explicit nulls. ## Verification - Provider serialization and schema converter: 158 passed - Provider, neighboring provider, and parser suites: 219 passed - Full `nox -s chk`: Ruff and mypy passed - Claude Fable 5 high adversarial gate: 359 tests plus union, reference, overlapping-pattern, alias, reserved-key, recursion, and wide/deep payload probes; `VERDICT: SHIP` - `git diff --check` passed Python package versioning remains part of the later Python release workflow; this PR does not require a TypeScript Changeset. Closes #4092. |
||
|
Alberto Schiabel
|
c044aa9577 | Merge branch 'next' into fix/python-provider-argument-serialization | ||
|
Alberto Schiabel
|
862c071750 |
fix(json-schema): support object arguments with dynamic keys (#4081)
This PR: - fixes #4023, where Python provider Pydantic models silently reduced property-less object arguments such as `METABASE_POST_API_CARD.dataset_query` to `{}` - fixes #4064, where the Zod and Effect converters rejected the same free-form object content - fixes #4022, where Google Gemini rejected nested property-bearing schemas that omitted `type: "object"` - supersedes https://github.com/ComposioHQ/composio/pull/4037 with complete Python handling for open, closed, pattern-constrained, and schema-valued dynamic keys - supersedes https://github.com/ComposioHQ/composio/pull/4065 with one cross-SDK contract covering Zod, Effect, Python, CLI validation, and provider boundaries - supersedes https://github.com/ComposioHQ/composio/pull/4077 by incorporating its complete-schema Claude Agent SDK registration and root constraint handling - supersedes https://github.com/ComposioHQ/composio/pull/4047 with its corrected Google-only normalization, including property-map and reserved-key safety - keeps https://github.com/ComposioHQ/composio/pull/4094 as a stacked Python-provider follow-up because framework serialization and CrewAI error handling are downstream of schema conversion - includes minor Changesets for `@composio/core`, `@composio/json-schema-to-zod`, and `@composio/claude-agent-sdk`; the fixed release group also bumps `@composio/slim`, and `@composio/google` carries a patch Changeset A tool argument declared as a bare `{ "type": "object" }` could be rejected, reduced to `{}`, or lose its root constraints depending on the SDK boundary. This PR makes TypeScript and Python agree on free-form objects and dynamic keys, and protects that agreement with a shared corpus. ## Relationship to other work ### Superseded PRs - #4037 fixes the narrow Python property-less-object reproduction by allowing Pydantic extras, but does not enforce `patternProperties`, schema-valued `additionalProperties`, or closed-object rejection. This PR preserves the reported Metabase payload while enforcing the complete object contract. - #4065 fixes property-less objects in the Zod and Effect converters. This PR incorporates that behavior, expands the dynamic-key semantics, and proves parity with Python and the provider-facing paths. - #4077 preserves root constraints through `ToolSchema.parse` and the Claude Agent SDK. This PR incorporates that work and tests it against the same cross-SDK corpus. - #4047 targets #4022. This PR incorporates its Google schema normalization with a structure-aware walker that preserves property maps, instance values, and reserved keys. ### Follow-up and adjacent PRs - #4094 is intentionally separate and stacked on this PR. This PR defines which arguments a JSON Schema accepts and what Pydantic/Zod/Effect preserve. #4094 handles the later framework boundary where CrewAI, LangChain, and LangGraph serialize an already-validated model, restoring aliases, distinguishing absent values from explicit nulls and defaults, preserving dynamic extras, and returning structured CrewAI validation failures. - #4093 is the narrower CrewAI-only proposal for #4092. #4094 incorporates that fix and broadens it to the two other providers that use the same generated Pydantic models, so #4093 is not duplicated here. Keeping #4094 separate leaves this PR focused on the shared cross-SDK conversion contract. It also isolates provider-specific framework hooks and Python error-shape behavior, which have a different compatibility and test surface and do not require TypeScript Changesets. ## What changed - Property-less object schemas are open by default. Their content is accepted and preserved at the root, in nested objects, and in array items. An explicit `additionalProperties: false` still closes them. - Objects that declare `properties` remain strict when `additionalProperties` is omitted. This is Composio's established tool-input behavior. - `ToolSchema.parse` now accepts bare object roots, keeps root `patternProperties`, accepts schema-valued `additionalProperties`, and exposes optional `properties` in its public type. - The Zod and Effect converters apply every matching `patternProperties` schema. A schema-valued `additionalProperties` applies only to keys not claimed by a declared property or pattern. - Python validates dynamic values with Draft 7 JSON Schema before Pydantic materializes defaults. This avoids coercive or incomplete Pydantic representations changing whether input is accepted. - Python supports local JSON Pointer references in dynamic-key schemas. Unresolved, external, and anchored references fail during model construction instead of silently weakening validation. - Accepted Python dynamic keys remain available through both `model_dump()` and attribute access, which is required by agentic providers such as LangChain. - Gemini now exposes free-form object arguments as `Dict[str, Any]` in the generated callable signature. - `@composio/google` adds missing object types before emitting Google GenAI declarations while preserving property maps and instance-valued schema annotations. - The Claude Agent SDK provider registers the complete object schema instead of a raw property map, so root rules reach MCP validation. - The Effect converter reports dynamic-key schema defects while compiling the schema, rather than as input errors blaming the arguments. `@cfworker/json-schema` compiles `patternProperties` keys and resolves `$ref` lazily, so the defect previously reached the caller as an input validation failure. The scope matches Python's: `patternProperties` keys, and references inside a `patternProperties` or schema-valued `additionalProperties` subschema, followed transitively. References elsewhere stay with the interpreter, so a dangling reference in a branch validation never visits keeps working. ## Behavior changes Three existing fail-open paths now reject invalid input: 1. Python agentic providers reject unknown keys when an object declares properties and omits `additionalProperties`, instead of dropping those keys. This also covers a property-less object that sets `additionalProperties: false`, which Python previously left to Pydantic's default `extra="ignore"`. 2. The Claude Agent SDK provider rejects undeclared arguments through MCP validation instead of stripping them and running the tool. 3. The CLI rejects a tool schema whose `patternProperties` key is not a valid regular expression, or whose dynamic-key subschema carries an unresolvable reference, when it compiles the schema. This can fail a call that previously succeeded: the interpreter surfaced such a defect only if validation descended into that part of the schema, so a payload that stayed out of the affected branch ran against a schema that could not fully validate it. Gemini is affected differently: it uses `json_schema_to_pydantic_type` to build a callable signature, but does not use `json_schema_to_model`, so the agentic-provider unknown-key behavior does not apply. ## Cross-SDK contract The TypeScript and Python fixtures contain the same 24 cases and are required to remain byte-identical: ```text ts/packages/core/test/fixtures/json-schema-conversion/object-cases.json python/tests/fixtures/json-schema-conversion/object-cases.json ``` The corpus covers open and closed objects, overlapping patterns, schema-valued additional properties, empty schemas, enums, nested strict containers, false schemas, type unions, local references, JSON integer semantics, default materialization, and intentional Composio strictness. Each case has one shared acceptance result. Converter-specific expected outputs are separate because Zod and Pydantic materialize defaults while Effect validates without transforming output. Any acceptance difference requires an explicit divergence reason. The decoding rules and the cross-language invariants have one definition. `@composio/core` owns the loader at `ts/packages/core/test/fixtures/json-schema-conversion/corpus.ts`, and the Zod, Effect, and CLI suites re-export it rather than each carrying a copy. It reads the corpus through `resolveJsonModule`, which is already enabled in every consumer, so no test project needs `@types/node` to load a fixture. ## Releases and documentation - Three explicit minor Changesets cover `@composio/core`, `@composio/json-schema-to-zod`, and `@composio/claude-agent-sdk`. - `@composio/core` and `@composio/slim` are a fixed Changesets group, so the core Changeset automatically schedules the matching minor release of `@composio/slim`; no duplicate slim Changeset is required. - `@composio/google` has a patch Changeset and requires `@composio/core >=0.16.0 <1.0.0`, preventing installation with older Core versions that lack the shared normalizer. - `@composio/json-schema-to-effect-schema` is private. The CLI and CLI local tools are excluded from Changesets, so the CLI's user-facing fix is recorded in `ts/packages/cli/CHANGELOG.md`. - Python does not use Changesets. It now declares `jsonschema>=4.23.0` directly in both package metadata sources, and the generated `uv.lock` is refreshed with the repository-pinned uv version. - The docs changelog distinguishes Python agentic-provider behavior, Gemini signature behavior, and Claude Agent SDK registration behavior. ## Verification Local verification after the final implementation: - Python: `nox -s tst` (`1002 passed, 34 skipped`) and `nox -s chk` - Gemini provider: `32 passed` with the provider installed editable - TypeScript: core `1088`, Zod `118`, Effect `65`, Claude Agent SDK `24`, Google `14`, and focused CLI validation `9` - Affected TypeScript typechecks - `pnpm validate:changesets` and Changesets status against the PR exact `next` base - Detached Changesets versioning and a strict-peer packed consumer: Core/Slim `0.16.0`, Google `0.10.2`, Zod `0.3.0`, and Claude Agent SDK `0.11.0` - Python sdist and wheel build, with both artifacts passing `twine check` - Prettier, Ruff formatting, `uv lock --check`, byte-identical fixture comparison, and `git diff --check` Closes #4022, #4023, and #4064.@composio/cli@0.3.3 @composio/cli@0.3.3-beta.347 |