Commit Graph

1619 Commits

Author SHA1 Message Date
Malay Vasa 0c944a524a fix(docs): stop reference cards repeating the title as the description
Reference pages fall back to the page title for their meta description.
Pass only a real description to the card, and have the route drop any
description that merely repeats the title.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-16 20:28:03 +05:30
Malay Vasa fc5639c597 Merge remote-tracking branch 'origin/next' into claude/og-images-setup-history-07d9fa 2026-09-16 20:13:10 +05:30
Malay Vasa cb52048028 fix(docs): keep toolkit titles and the home card count stable across pages
- only catalog toolkit pages ("<Name> - Composio Toolkit") get the
  "<Name> Toolkit" card title; the toolkits index and MDX guides keep
  their own titles instead of "Toolkits Toolkit"
- the home card description is a shared constant used by the URL
  builder, so the /docs index page and the root layout produce the same
  image URL and the live app count is never dropped
- update the integration expectation from ?variant=home to the new
  section=home URL

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-16 20:12:05 +05:30
Malay Vasa 84c04f888b feat(docs): redesign social preview cards
Rebuild the /api/og route around a shared shell with a slot per section
(docs, toolkits, API reference, changelog, home) on the docs dark surface,
with a light variant behind theme=light.

- Geist Sans / Mono vendored as TTF (Satori cannot read the site's woff2)
- Composio wordmark and mark sliced from the existing logo SVGs
- toolkit cards link the Composio mark to the toolkit logo; logos only
  load from Composio hosts and use the CDN's dark variant
- reference cards show a REST API pill and version; changelog cards show
  the date once as an eyebrow
- home card counts apps from the live catalog label
- balanced title and description wrapping, faded pixel-grid background
- assets traced for the build via outputFileTracingIncludes

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-16 19:30:00 +05:30
Alberto Schiabel 8bf92435ad Merge branch 'next' into docs/add-atomic-agent-connect 2026-09-16 15:27:51 +02:00
jkomyno e55b642f3c docs: keep trigger subscription sample buildable 2026-09-16 15:22:04 +02:00
jkomyno bc3e981986 Merge remote-tracking branch 'origin/next' into review-pr-4356-docs 2026-09-16 15:19:11 +02:00
jkomyno 2cfcb464d8 docs: clarify generated changelog notes 2026-09-16 15:09:46 +02:00
Alberto Schiabel b39a9b30e1 docs(py): render raises sections and normalize reST in SDK reference (#4491)
This PR:

- fixes the raw `:raises ...:` reST directives leaking into the
generated Python SDK reference, flagged by [Greptile on the
auto-generated docs
PR](https://github.com/ComposioHQ/composio/pull/4479#discussion_r4004672537)
- teaches `python/scripts/generate-docs.py` to parse `:raises Exc:`
docstring fields (plus `:raise`/`:except`/`:throws` synonyms) into a
structured `**Raises**` section, with indented continuation-line support
- normalizes inline reST in all rendered prose:
`:class:`/`:func:`/`:meth:`/`:mod:` roles honor `~` short-name
semantics, and double-backtick literals become single-backtick inline
code
- regenerates `docs/content/reference/sdk-reference/python/` pages
- adds regression tests for raises parsing and reST normalization in
`python/tests/test_generate_docs.py`

## Context

The Python SDK reference pages are generated by
`python/scripts/generate-docs.py` (workflow: `generate-sdk-docs.yml`),
so the fix lives in the generator rather than the MDX — hand-edits would
be overwritten by the next auto-regen PR. Unrecognized `:raises` lines
previously fell through into the `:returns:` description text.
2026-09-16 14:57:04 +02:00
Alberto Schiabel 11de45889a fix(core): contain async Pusher subscription errors (#4448)
## Summary
`PusherService.subscribe` binds `pusher:subscription_error` after the
Pusher subscription call returns. `pusher-js` dispatches this event
asynchronously without catching listener exceptions, so authentication,
permission, server, or network subscription failures could escape as
uncaught exceptions in Node applications.

Fixes #4445

## Changes
- Log asynchronous Pusher subscription errors at the SDK error boundary
instead of throwing from the event callback.
- Add regression coverage that emits `pusher:subscription_error` after
`subscribe()` resolves and verifies that it does not throw.
- Add a patch changeset for the fixed `@composio/core`/`@composio/slim`
package group.

## Type of change
- [x] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [ ] Documentation
- [ ] Breaking change

## How Has This Been Tested?
- Node `v24.17.0` / pnpm `11.8.0`
- `pnpm --filter @composio/core exec vitest run
test/services/pusher.test.ts test/utils/pusher.test.ts` — 2 files, 5
tests passed
- `pnpm --filter @composio/core test` — 55 test files passed; 1,289
tests passed and 2 existing tests reported expected failures; command
exited successfully
- `pnpm --filter @composio/core typecheck`
- `pnpm lint` — passed with existing repository warnings
- `pnpm validate:changesets`
- `pusher-js` `v8.6.0` runtime probe confirmed that an exception thrown
from a `pusher:subscription_error` listener reaches Node's
`uncaughtException` handler; the regression test verifies the SDK
callback no longer throws.

## Screenshots (if applicable)

Not applicable.

## Checklist
- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [x] I updated documentation as needed
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages

## Additional context
This patch is intentionally limited to the live `PusherService` path.
XHR timeout handling is a separate concern and is not included here. The
older unreferenced `PusherUtils` helper is unchanged to keep this fix
scoped to the path used by `Triggers`.
2026-09-16 14:56:45 +02:00
jkomyno c2e70f66a6 fix(py): route establish-time subscription failures through on_subscription_error
pysher performs the channel-auth request synchronously inside
pusher.subscribe(), so an auth rejection raised on the websocket thread
before pusher:subscription_error could ever be bound or fire. The new
on_subscription_error callback was skipped for exactly the failures it
documents, and callers waited out the full connect timeout for a
generic ComposioSDKTimeoutError.

- _connection_handler catches subscribe() failures and routes them
  through the error path (log + callback with {'error': ...}).
- The failure is recorded on the subscription and the connect() wait
  loop re-raises it on its next poll, so subscribe() fails promptly
  with the underlying error and still tears down the pusher.
- Update the Python reference, guide, and docstrings; add regression
  coverage for the handler routing, the failure record, and fast-fail.

Addresses the Cursor Bugbot comment on triggers.py:1023.
2026-09-16 14:54:14 +02:00
Brendan O'Leary 7a63e5acd7 docs: add product architecture guides and KB entry points (#4294)
## Summary

Adds canonical guidance for common Composio product-integration
decisions and makes the main paths easy to find from the Knowledge Base
homepage. This PR is independent of #4258 and #4277 and targets `next`
directly.

## Changes

- Add guides for the Composio skill, consumer-agent architecture,
B2B-agent architecture, and moving from prototype to production
- Expand the white-labeling guide with a minimal setup path and FAQ
- Add five Start here cards to `/kb`, before support topics and toolkit
browsing
- Update OAuth callback examples and add relevant sidebar and quickstart
cross-links

## Type of change

- [x] Documentation

## How Has This Been Tested?

- `bun test tests/static/` (528 passed)
- `bun run lint:links`
- `bun run types:check`
- `bun run lint`
- `bun run build`

## Checklist

- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [x] I updated documentation and structural homepage coverage
- [x] No changeset is required for docs-only changes
2026-09-15 13:26:59 -04:00
Brendan O'Leary a0dbc6fbae docs: clarify OAuth callback URL matching 2026-09-15 15:06:56 +00:00
mukund-composio 788476a526 docs: project API key permissions (#4246)
We've split project API key permissions from a broad **Sessions** into
**Session management** and **Session tool execution**.

I've also removed the v3/v3.1 prefixes to keep things simpler to
understand and remove duplication.

Backend: [#12279](https://github.com/ComposioHQ/platform/pull/12279),
[#12291](https://github.com/ComposioHQ/platform/pull/12291), [production
#12370](https://github.com/ComposioHQ/platform/pull/12370). Dashboard:
[#1384](https://github.com/ComposioHQ/dashboard/pull/1384).
2026-09-15 20:33:39 +05:30
jkomyno 27701dd541 feat(py): add optional on_subscription_error for trigger subscriptions
Mirror the TypeScript API surface from the previous commit:

- Triggers.subscribe accepts an optional on_subscription_error callback,
  threaded through _SubcriptionBuilder.connect and bound to pysher's
  pusher:subscription_error event on the trigger channel.
- TriggerSubscription._handle_subscription_error logs the failure at the
  SDK boundary and invokes the callback with the parsed payload (or
  {'raw': frame} for malformed frames); callback exceptions are
  contained and logged so a faulty handler cannot tear down pysher's
  dispatch thread.
- The parameter is optional; existing callers are unaffected.
- Update the Python triggers reference and the subscribing-to-events
  guide.

Python never bound pusher:subscription_error at all, so subscription
failures after connect() were previously invisible to hosts.
2026-09-15 16:58:37 +02:00
jkomyno 1024d1a48c feat(core): add optional onSubscriptionError callback for trigger subscriptions
- PusherService.subscribe and Triggers.subscribe accept an optional
  onSubscriptionError callback invoked with the raw pusher
  pusher:subscription_error payload, giving hosts a programmatic signal
  for post-resolution subscription failures (previously log-only).
- Exceptions thrown from the callback are contained and logged, never
  rethrown, so a faulty handler cannot crash the host.
- The parameter is optional; existing callers are unaffected.
- Document the new parameter in the TypeScript triggers reference and
  the subscribing-to-events guide; bump the changeset to minor for the
  new API surface.

Applies review finding #1 from the PR #4448 review.
2026-09-15 16:33:00 +02:00
Brendan O'Leary 3f31ef9609 Merge remote-tracking branch 'origin/next' into codex/docs-priority-guides
# Conflicts:
#	docs/tests/static/product-navigation.test.ts
2026-09-15 10:12:04 -04:00
Brendan O'Leary a92d4920f0 docs: finish priority guide integration 2026-09-15 10:08:10 -04:00
Brendan O'Leary e71a9a22b4 docs: broaden harness example category 2026-09-15 09:31:48 -04:00
Mukund 6c2bcc554f docs: correct session proxy permission callout 2026-09-15 18:45:04 +05:30
sosidudku1 5ea73718bc docs: add Atomic Agent to Composio Connect clients
Atomic Agent is a local-first agent (CLI and TUI) that ships a built-in
Composio integration: it connects to the hosted tool router over
Streamable HTTP MCP, so tools are registered at startup as
mcp.composio.*.

Setup is done from the Integrations tab or by adding COMPOSIO_API_KEY to
the agent's .env, so the entry documents that flow rather than the CLI
install used by other terminal agents.
2026-09-15 15:41:13 +03:00
jkomyno 3271679ee0 docs(py): render Raises sections and normalize reST in generated SDK reference
- parse :raises Exc: docstring fields (plus Sphinx synonyms) into a
  structured Raises section instead of leaking raw directives into the
  Returns description
- normalize inline reST in all rendered prose: roles (:class:, :func:,
  :meth:, ...) honor ~ short-name semantics; double-backtick literals
  become single-backtick inline code
- regenerate docs/content/reference/sdk-reference/python/ pages
- add regression tests for raises parsing and reST normalization

Flagged by Greptile on the legacy-repo auto-PR (ComposioHQ/composio#4479).
2026-09-15 13:12:25 +02:00
Mukund cc3c5836a9 docs: recommend write-only access for session creation 2026-09-15 15:58:19 +05:30
Mukund 65255d31ac docs: limit permission updates to session changes and reference labels 2026-09-15 15:54:48 +05:30
Mukund 77004dacdd docs: document session proxy access under session execution only 2026-09-15 13:58:34 +05:30
Mukund b7ac0ec68d docs: focus scoped key guidance on session permissions 2026-09-15 13:53:46 +05:30
Mukund befbd680fe Merge next and refresh scoped key permission guidance 2026-09-15 13:51:09 +05:30
Mukund 61a2674ef5 docs: simplify scoped key permissions and reconcile current routes 2026-09-15 13:49:57 +05:30
jkomyno 9db556c21f docs: auto-generate Python SDK reference 2026-09-14 22:12:59 +00:00
jkomyno 0faaacc48b Merge remote-tracking branch 'origin/next' into docs/tools-direct-examples
# Conflicts:
#	ts/packages/cli/test/src/commands/setup.cmd.test.ts
2026-09-15 00:11:37 +02:00
Kshitij Jhunjhunwala 333b067885 Merge branch 'next' into kj/restore-install-plugin-setup 2026-09-14 13:04:15 -07:00
Kshitij Jhunjhunwala 14e81b00b3 fix(cli): restore automatic plugin setup on install 2026-09-14 12:59:56 -07:00
Brendan O'Leary dcd1ac953f Merge branch 'next' into codex/token-custody-architecture 2026-09-14 12:10:16 -07:00
Brendan O'Leary e7c585ead8 Merge branch 'next' into codex/token-custody-architecture 2026-09-14 11:29:38 -07:00
Brendan O'Leary c42fa6ffe6 docs: use Python and TypeScript examples in token custody guide 2026-09-14 18:26:31 +00:00
DakshM on Exe (exe.dev) 0a1464d5e8 perf(cli): move the compiler and tokenizer out of the executable
`composio --version` goes from 288ms to 199ms, peak RSS from 97.8MB to
77.3MB, and the executable from 85.9MB to 79.7MB. Every command benefits.

A compiled Bun binary parses its whole embedded bundle before the first
line of JavaScript runs, and #4468 had already made sure the TypeScript
compiler and the tokenizer rank table were never *evaluated* unless
`generate`, `run`, or a large `execute` response needed them. They were
still *parsed* on every start: the compiler alone was 44% of the
executable's JavaScript and the o200k rank table another 28%, so
`--version` spent ~75ms reading code it could never call.

Both now ship as companion modules next to the executable, through the
mechanism `composio run` already uses for its own runtime helpers:

- `generation-runtime.mjs` carries `src/generation/*`, the `composio run`
  source rewrites, `typescript`, `@composio/ts-builders` and
  `openapi-typescript`. `generate ts`, `generate py` and `run` load it
  with `loadInstalledCompanionModule`; from a source checkout the loader
  resolves the `.ts` next to `run-companion-modules.ts` instead, so tests
  and `bun run src/bin.ts` need no build step.
- `execute-output-encoder-runtime.mjs` carries `js-tiktoken/lite` and the
  rank table. `execute` loads it only once a response exceeds the 10KB
  byte pre-filter.

A companion bundles its own copy of `effect`, and a fiber cannot run
primitives built by another copy of the runtime, so nothing Effect-shaped
crosses the boundary: the generation companion exposes plain functions
and promises, runs its pipelines on its own runtime, and returns failures
as values that `src/generation/errors.ts` rebuilds as the CLI's own error
classes, stack included. Generated output is byte-identical to #4468 for
`generate ts`, `generate ts --transpiled` and `generate py`.

Both modules join `RUN_COMPANION_MODULE_BASENAMES`, so the build, release
packaging, install verification, `upgrade` and the self-repair download
pick them up unchanged. The three hand-maintained uninstall lists and the
upgrade E2E fixture gain the two file names.

Two smaller startup costs go with it:

- `src/constants.ts` imported `constants` from `@composio/core`'s root
  entry for two strings and two URLs, which evaluated the whole SDK at
  startup (~25ms of module-scope work, mostly zod schemas). The four
  values are spelled out and pinned to core's by a test.
- `tool-file-uploads.ts` imported three core helpers at module scope that
  only a file upload reaches; they are imported on that path now.

The binary build gains a guard: after bundling the companions it bundles
`src/bin.ts` once more unminified and fails if the executable's graph
reaches `typescript`, `js-tiktoken`, core's root entry, `src/generation/*`
or a companion entry. Without it a stray static import would put the
compiler back into the executable with nothing to notice.

Building also surfaced that `assertBundledRuntimeFiles` blanked string
literals to same-length runs of spaces, which made the import patterns'
`^\s*` backtrack quadratically across the compiler's multi-megabyte
embedded lib strings and stalled the build for over ten minutes. String
bodies are dropped now. (The check itself has never matched a specifier,
since the specifiers it looks for are the string literals it removes;
that is left as it was.)

Measured on the pinned toolchain, Bun 1.4.1+4661e494f, linux-x64, best
of 15, telemetry disabled, both binaries built in the same session:

  composio --version       288ms -> 199ms
  tools execute --help     287ms -> 202ms
  peak RSS                 97.8MB -> 77.3MB
  executable               85.9MB -> 79.7MB
  executable JavaScript    8.3MB -> 2.1MB (minified)

The `execute` tail after `execute.tool_call.end` is unchanged for
responses under 10KB (~10ms) and ~20ms slower above it (351 -> 374ms),
which is the on-demand parse of the 2.2MB encoder companion.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wx9gEjuiHux2weiHjdNcDs
2026-09-14 15:52:49 +02:00
Alberto Schiabel 4bea066737 Apply suggestion from @jkomyno 2026-09-14 13:59:40 +02:00
Alberto Schiabel 117f48a331 Apply suggestion from @jkomyno 2026-09-14 13:58:37 +02:00
jkomyno 9a69683efb docs(core): fix tools getInput, proxyExecute, and execute examples
Correct the getInput JSDoc to pass the required text field, rewrite the
proxyExecute example with the real flat parameter shape and explain that
relative endpoints are appended to a base URL that may include a path, and
show where to find the version to pin for tools.execute.
2026-09-14 13:56:26 +02:00
Alberto Schiabel 33bbce2786 Merge branch 'next' into docs/changelog-update-cfeada6 2026-09-14 13:26:15 +02:00
Brendan O'Leary 11706780b3 docs: preserve source tracking on contact links 2026-09-11 17:58:12 +00:00
Brendan O'Leary 4b295a5813 docs: update contact links with CTA placement 2026-09-11 17:53:35 +00:00
Brendan O'Leary 4c0c89b090 Remove fastmode as it isn't in the SDK yet 2026-09-11 09:52:33 -07:00
Brendan O'Leary 1a26ea0869 docs: document unattended agent authentication (#4434)
## Summary

Autonomous coding agents assumed Composio signup required a human,
leaving integrations without credentials or live verification. Add a
prominent guide for the supported `composio login --agent` flow when no
human is available.

Addresses Gauge action `cmtvu1rwe00040ip8mxhszmj1`. Reviewed the
metadata, insights, logs, and diffs for [evidence run
1](https://agents.withgauge.com/composio-aclx/runs/cmtvrts3n001201ea7jwbhu4q)
and [evidence run
2](https://agents.withgauge.com/composio-aclx/runs/cmtvrts3n001401eak0rwndar).
Both assumed signup required human interaction; the second attempted
disposable-email signup before switching to mocks.

## Changes

- Document unattended login, readiness checks, project API-key
extraction, credential handling, constraints, and the human login
fallback.
- Include a live Hacker News tool call and require separate verification
of the requested integration, including provider authorization and
confirmation of write results.
- Link the guide from the agent setup sidebar, quickstart, CLI docs, API
authentication reference, and `llms.txt`.

## Type of change

- [x] Documentation

## How Has This Been Tested?

From `docs/`:

- `bun run test`: 557 passed, 0 failed. Run with loopback access for the
analytics test's local server.
- `bun run lint:links`: 0 errors.
- `bun run lint`: passed with existing warnings.
- `bun run postinstall`: regenerated MDX collections successfully.

All five shell snippets pass `bash -n`. The key-extraction snippet
accepts a valid local fixture and rejects missing, blank, and non-string
keys without printing credentials. `git diff --check` passes. No live
account was provisioned or tool executed for this documentation change.

## Checklist

- [x] I ran linters/tests locally and they passed
- [x] I updated documentation as needed
- [x] I added tests or explain why not applicable: existing docs checks
and focused snippet validation cover this documentation-only change.
- [x] I added a changeset if this change affects published packages: not
applicable; no published package changes.
2026-09-11 08:25:59 -07:00
Brendan O'Leary 03f92ee026 docs: shorten unattended auth sidebar label 2026-09-11 15:20:02 +00:00
Brendan O'Leary 9968ea60ce Update docs/content/docs/security/token-custody.mdx
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-09-11 07:59:45 -07:00
Brendan O'Leary 0536957a38 docs: explain token custody architecture and deployment options 2026-09-11 14:44:44 +00:00
sdkrelease[bot] e265ff838a docs(kb): refresh public support knowledge (#4437)
Automated knowledge-base refresh for `ComposioHQ/support-knowledge`.

- Source commit: `5eac683455ff252a7a3b62f33ab6566445009b52` (unchanged;
rebuilt a stale semantic artifact)
- Regenerated public KB pages and search records
- Reused unchanged vectors and rebuilt the checked semantic artifact
- Ran KB freshness and semantic-artifact verification

Co-authored-by: sohambasu963 <80603154+sohambasu963@users.noreply.github.com>
2026-09-11 16:24:51 +02:00
Brendan O'Leary eb1d1e1d35 Merge branch 'next' into codex/docs-unattended-agent-auth 2026-09-10 16:33:20 -07:00
Brendan O'Leary abb272572b Merge branch 'next' into codex/docs-unattended-agent-auth 2026-09-10 16:22:29 -07:00