skills/composiohq__composio
1
0
Fork 0
mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
5,348 Commits 338 Branches 1,550 Tags
@composio/cli@0.4.2-beta.398
Commit Graph

105 Commits

Author SHA1 Message Date
Alberto Schiabel 705591451c chore(deps): upgrade CI actions and every outdated dependency (#4381) 
This PR:

- upgrades every CI action to its latest release (only
`changesets/action` had one: v2.1.1 -> v2.1.2, SHA-pinned) and every
outdated dependency across the pnpm workspace, the docs bun workspace,
and all three `uv.lock` files
- moves zod to 4.5.4 everywhere first-party — catalog, docs,
`@composio/json-schema-to-zod`, `@composio/claude-agent-sdk` and the
zod-v4 e2e fixtures; the `*-zod-v3` fixtures stay on 3.25.76 because
that is what they exercise
- moves `@mastra/core` 1.52.1 -> 1.53.0, which is the ceiling rather
than a preference: bisecting `ts/examples/mastra`'s `cf:dry-run` shows
1.54.0 moved the workspace/sandbox subsystem behind
`@mastra/core/agent`, which drags execa (-> `npm-run-path` ->
`unicorn-magic`) into the Workers bundle where esbuild cannot link it.
`@mastra/mcp` is capped at 1.17.2 for the same reason — 1.17.3 wants
`@mastra/core` >=1.64. The docs bun workspace mirrors that cap as an
explicit devDependency plus `overrides` entry, because bun does not
apply overrides to auto-installed peers
- clears every production advisory that has a published fix, so the
audit gate can run without `--ignore`, which does not filter a single
run: it writes the advisory into `auditConfig` and exits 0 whatever else
is outstanding, so the gate was passing over nine advisories
- `qs` -> >=6.16.0, `fast-uri` -> >=3.1.6, `toml` -> the 4.x line, all
via overrides in the existing `# temporary: … drop when` style
- `extract-zip` (GHSA-jmr9-qjv8-65gv) has no fixed version to move to —
2.0.1 is the newest release and GitHub records `first_patched_version`
as null — so it moves to `auditConfig.ignoreGhsas` pointing at the
`extractZipSafely` mitigation that already covers it
- GHSA-866g-f22w-33x8 (`@ai-sdk/provider-utils` 3.x, low) also has
nothing to move to: the advisory names 3.0.98 as patched but the 3.x
line stopped at 3.0.30 and GitHub records no fixed version. It only
enters the tree through `@mastra/core`, which is a peer or dev
dependency of every published package, so all flagged paths are private
examples and e2e fixtures. It goes in `ignoreGhsas` with that rationale
so the un-levelled `pnpm audit --prod` step stops posting a warning
comment on every PR
- widens `@composio/anthropic`'s `@anthropic-ai/sdk` peer range to
include `^0.124.0`, the line its devDependency now tests against (for a
`0.x` caret, `^0.120.0` excluded it); the package is in the changeset
for that reason
- adapts three call sites that upstream broke: `eve` 0.52 moved
`ApprovalContext` to `eve/tools/approval`, `@pierre/diffs` 1.4 gave
`FileDiffProps` a second type parameter, and `fumadocs-openapi` 11.4
fixed the undeclared-tag drop that a docs guard test asserted (the guard
now also asserts the page positively, so it cannot pass vacuously)
- drops the stale `hono` `minimumReleaseAgeExclude` entry (its comment
said to after 2026-08-06) and adds an `undici` `peerDependencyRules`
allowance for openai 7.10's new optional peer

## Context

Some upgrades were deliberately declined, each for a reason recorded
next to the pin:

- `vitest`/`@vitest/ui` stay on 4.1.11 —
`@cloudflare/vitest-pool-workers@0.22.0` (latest) peers on `vitest
^4.1.0`
- `undici` stays on `^7` in core — `pinnedDispatcher.node.ts` documents
that Node's `fetch` rejects undici 8 dispatchers
- the `pnpm` catalog entry stays on `^11` to match the mise-owned
toolchain
- `eve` stays on 0.27.6 in docs — 0.52 changes the `defineAgent` model
definition and the `useEveAgent` helpers, so `agent/agent.ts` and
`components/eve-chat.tsx` fail `types:check`; migrating the docs agent
is its own PR
- `@earendil-works/pi-coding-agent` stays on 0.84.4 — 0.85.x imports
`@earendil-works/pi-server` without declaring it, so `test/pi.test.ts`
fails to load

`declareOperationTags` is kept as a safety net rather than retired, even
though `fumadocs-openapi` 11.4 makes it redundant: removing it changes
how specs are normalised at sync time and is worth its own PR.

Verified locally: `pnpm build:packages`, `pnpm typecheck`, `pnpm test`,
`pnpm typecheck:examples`, `pnpm lint:examples`, `turbo cf:dry-run
--filter='./ts/examples/*'`, `pnpm peers check`, `pnpm audit --prod
--audit-level=high` (exit 0), frozen-lockfile installs for pnpm and bun,
docs `types:check` + 542 static tests, and Python `make chk` + `make
tst` (1790 passed).

https://claude.ai/code/session_018evFic47PFPXuB95uRE1aw
EOF -R ComposioHQ/composio
 2026-09-08 16:15:34 +02:00
Alberto Schiabel 20aaa95c96 ci(ts): verify packed provider compatibility (#4355) 
This PR:

- adds a clean consumer harness that packs core, its internal JSON
Schema dependency, and all ten TypeScript providers
- verifies tarball contents, npm installation, named public exports,
consumer typechecking, provider construction, and a credential-free
`wrapTool` conversion
- covers the current workspace core, one verified minimum-core lane per
provider, and the packed workspace core presented as `1.0.0-beta.0`
- preserves existing 0.x minimum peer ranges while recording the
verified floors separately for the future breaking release
- additively accepts core 1.0 prereleases without claiming stable 1.x
support yet
- widens the Anthropic and OpenAI Agents peer ranges to include the
upstream versions already used by this repository
- runs the gate in TypeScript CI and immediately before Changesets
publishing

The release guard fails before publication and its regression test
verifies build -> compatibility -> publish ordering plus failure
propagation.

## Non-breaking scope

No public API is removed or renamed, and the existing 0.x core peer
floors remain unchanged. All peer-range changes are additive. The gate
reports the nine floor corrections that should be made with the planned
breaking release.

## Validation

- `pnpm run check:provider-compatibility` (12 packed consumer lanes)
- `pnpm run test:provider-compatibility`
- `pnpm run test:release-workflow`
- `pnpm run build:packages` (19 packages)
- focused TypeScript compile and Oxlint checks
- Prettier, Changesets validation, and `git diff --check`
 2026-09-07 12:33:53 +02:00
Alberto Schiabel be8e978c3a fix(toolchain): pin Bun canary for valid macOS signatures (#4315) 
This PR:
- closes #4284
- makes `mise.toml` the editable source of truth for Bun and pins
`1.4.1-canary.1+d9b769812`, the first Bun build whose compiled macOS
binaries carry strictly valid signatures
- maps that revision to the immutable per-platform `@oven/bun-*` npm
tarballs via mise's `http` backend, so mise extracts the exact
checksum-verified binary with no npm lifecycle, Node dependency, or
postinstall script
- installs Bun through mise in CI and Docker E2E images, removing the
independent `bun-version` input and the `oven-sh/setup-bun` channel
- updates the checksum-verified mise installer to `2026.8.15`, reuses it
in the Docker E2E images, and regenerates `mise.lock` with that release
- teaches the preinstall toolchain check to compare the full Bun
revision (via `Bun.version_with_sha`, in-process) when the pinned
version carries build metadata
- verifies the exact `bun --revision`, a strictly valid Bun-compiled
macOS signature, a Linux container install, the release-workflow
contract, and formatting/linting
EOF -R ComposioHQ/composio
 2026-09-03 11:51:22 +02:00
jkomyno 9758571072 chore(deps-dev): update TypeScript tooling 2026-08-28 14:52:53 +02:00
jkomyno e4189aeb57 chore(release): migrate to Changesets v3 2026-08-25 01:01:10 +02:00
dependabot[bot] c0c511bb4b chore(deps-dev): bump the npm-development group with 7 updates (#4133) 
Bumps the npm-development group with 7 updates:

| Package | From | To |
| --- | --- | --- |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `26.1.2` | `26.2.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.77.0` | `1.78.0` |
|
[oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint)
| `1.77.0` | `1.78.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.8` | `2.10.9` |
|
[chrome-devtools-mcp](https://github.com/ChromeDevTools/chrome-devtools-mcp)
| `1.6.0` | `1.7.0` |
|
[@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent)
| `0.83.0` | `0.84.1` |
| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) | `0.29.5`
| `0.31.3` |

Updates `@types/node` from 26.1.2 to 26.2.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.77.0 to 1.78.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.78.0] - 2026-08-10</h2>
<h3>🚀 Features</h3>
<ul>
<li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)
(Mikhail Baev)</li>
<li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)
(Cole Ellison)</li>
<li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match
eslint (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)
(Cole Ellison)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>9573937 linter/typescript: Validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)
(Mikhail Baev)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a>
release(apps): oxlint v1.78.0 &amp;&amp; oxfmt v0.63.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25473">#25473</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/ccb8fe89db08123ff2b86d7fb2f39d0dd6c33df7"><code>ccb8fe8</code></a>
feat(linter/jsdoc): implement <code>no-blank-blocks</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9573937df3cc01f29e1c65bc018ce378ec947e0e"><code>9573937</code></a>
fix(linter/typescript): validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/d4a897ce2290bf853720b4fbf371304bfea2c980"><code>d4a897c</code></a>
feat(linter/eslint): implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/5ab9340637eff80539bca89a494e162e94569358"><code>5ab9340</code></a>
feat(linter/jsx-a11y/anchor-has-content): add options to match eslint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.78.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-plugin-eslint` from 1.77.0 to 1.78.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint-plugin-eslint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.78.0 &amp; oxfmt v0.63.0</h2>
<h2>Table of Contents</h2>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxlint-v1.78.0">Oxlint
v1.78.0</a></li>
<li><a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxfmt-v0.63.0">Oxfmt
v0.63.0</a></li>
</ul>
<h2>Oxlint v1.78.0</h2>
<h3>🚀 Features</h3>
<ul>
<li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25207">#25207</a>)
(Mikhail Baev)</li>
<li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24470">#24470</a>)
(Cole Ellison)</li>
<li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match
eslint (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24571">#24571</a>)
(Cole Ellison)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>b746e00 linter/eslint/no-implicit-coercion: Preserve template
coercion whitespace (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25470">#25470</a>)
(camc314)</li>
<li>a92c541 linter: Preserve source text for JS plugin ignore fixes (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25280">#25280</a>)
(Norcleeh)</li>
<li>675c840 linter/eslint/prefer-promise-reject-errors: Handle
parenthesized calls (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25378">#25378</a>)
(camc314)</li>
<li>1703739 linter/unicorn/new-for-builtins: Ignore optional chains (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25411">#25411</a>)
(tanakalucky)</li>
<li>95ece63 linter/unicorn/prefer-code-point: Downgrade the auto-fix to
dangerous (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25412">#25412</a>)
(leemr)</li>
<li>c451a0e linter/vitest: Validate
<code>consistent-test-filename</code> regex patterns (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25408">#25408</a>)
(Mikhail Baev)</li>
<li>937825c react_compiler: Disable exhaustive memo validation by
default (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25417">#25417</a>)
(Boshen)</li>
<li>f0f7dae linter/eslint/no-unused-vars: Report invalid regex options
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25380">#25380</a>)
(Cameron)</li>
<li>44e73fd linter/unicorn/prefer-array-flat: Fix
<code>concat.apply</code> suggestions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25373">#25373</a>)
(Cameron)</li>
<li>6846a9a linter/react/rules-of-hooks: Detect constructor callbacks
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25377">#25377</a>)
(camc314)</li>
<li>b247a9d linter/unicorn/new-for-builtins: Support
<code>Float16Array</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25382">#25382</a>)
(tanakalucky)</li>
<li>19109cd linter/unicorn/error-message: Support
<code>SuppressedError</code> messages (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25375">#25375</a>)
(camc314)</li>
<li>9c13f5e linter: Assert token lookup invariants (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25368">#25368</a>)
(camc314)</li>
<li>bc35f83 linter/eslint/no-unused-vars: Bound catch parameter lookup
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25367">#25367</a>)
(camc314)</li>
<li>c159fb9 linter/unicorn/switch-case-braces: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25363">#25363</a>)
(camc314)</li>
<li>03b2eb2 linter/unicorn/no-static-only-class: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25361">#25361</a>)
(camc314)</li>
<li>0afc59e linter/unicorn/empty-brace-spaces: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25353">#25353</a>)
(camc314)</li>
<li>2963d98 linter/eslint/no-unreachable-loop: Do not report loops whose
body has a finally block (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25335">#25335</a>)
(Todor Andonov)</li>
<li>589e5fb linter/eslint/no-param-reassign: Validate
<code>ignorePropertyModificationsForRegex</code> property (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25346">#25346</a>)
(Mikhail Baev)</li>
<li>aae5d8b linter/eslint/no-throw-literal: False positive on variable
declared without initializer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25275">#25275</a>)
(cjnoname)</li>
<li>6b1c479 oxlint: Normalize customized rule names (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25316">#25316</a>)
(camc314)</li>
<li>d494eb5 linter/unicorn/consistent-existence-index-check: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25325">#25325</a>)
(camc314)</li>
<li>4266037 linter/typescript/prefer-namespace-keyword: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25322">#25322</a>)
(camc314)</li>
<li>4745b4e linter/typescript/no-namespace: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25321">#25321</a>)
(camc314)</li>
<li>648a481 linter/eslint/one-var: Avoid joining exported declarations
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25314">#25314</a>)
(camc314)</li>
<li>9573937 linter/typescript: Validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25320">#25320</a>)
(Mikhail Baev)</li>
<li>ebf7d18 linter/typescript/consistent-type-definitions: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25281">#25281</a>)
(camc314)</li>
<li>1501ccf linter/typescript/consistent-generic-constructors: Bound
token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25258">#25258</a>)
(camc314)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>8f784f3 linter: Reduce rule config dispatch size (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25461">#25461</a>)
(Boshen)</li>
<li>2de4ec2 linter: Reduce visitor code size (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25441">#25441</a>)
(Boshen)</li>
<li>6fb7f47 linter/unicorn/prefer-export-from: Narrow
<code>ExportFromDeclaration</code> lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25381">#25381</a>)
(camc314)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a>
release(apps): oxlint v1.78.0 &amp;&amp; oxfmt v0.63.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25473">#25473</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/apps_v1.78.0/npm/oxlint-plugin-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `turbo` from 2.10.8 to 2.10.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.10.9</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>chore: Release Turborepo 2.10.8 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13626">vercel/turborepo#13626</a></li>
<li>perf: Walk literal-prefix tree globs without wax compilation by <a
href="https://github.com/charpeni"><code>@​charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13522">vercel/turborepo#13522</a></li>
<li>fix: Accept semver ranges in devEngines.packageManager.version by <a
href="https://github.com/bangseongbeom"><code>@​bangseongbeom</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13623">vercel/turborepo#13623</a></li>
<li>docs: Explain affected package invalidation reasons by <a
href="https://github.com/ghoullier"><code>@​ghoullier</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13594">vercel/turborepo#13594</a></li>
<li>perf(lockfiles): Borrow field-name scalars in the pnpm fast parser
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13648">vercel/turborepo#13648</a></li>
<li>perf(repository): Avoid discarded alias allocation in Relationship
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13650">vercel/turborepo#13650</a></li>
<li>perf(lockfiles): Drop redundant human_name clone for pnpm v7/v9 by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13649">vercel/turborepo#13649</a></li>
<li>perf: Index workspace nodes by name in project_relationships by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13647">vercel/turborepo#13647</a></li>
<li>perf: Share resolution identity lists across identical workspace
closures by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13641">vercel/turborepo#13641</a></li>
<li>docs: Fix duplicated word in runtime dependencies guide summary by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13630">vercel/turborepo#13630</a></li>
<li>refactor: Remove turborepo-lsp dependency on turborepo-lib by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13631">vercel/turborepo#13631</a></li>
<li>perf: Index Bun nested lockfile entries by name for fallback
resolution by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13633">vercel/turborepo#13633</a></li>
<li>perf: Memoize framework inference per package during task hashing by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13634">vercel/turborepo#13634</a></li>
<li>perf: Avoid materializing transient declarations in
external_dependencies by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13646">vercel/turborepo#13646</a></li>
<li>perf: Enable shared closure DP for npm and yarn1 lockfiles by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13635">vercel/turborepo#13635</a></li>
<li>perf: Parse pnpm explicit-key entries in the lockfile fast path by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13640">vercel/turborepo#13640</a></li>
<li>perf: Parallelize resolution fingerprint hashing by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13642">vercel/turborepo#13642</a></li>
<li>perf: Build resolution identity lists in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13643">vercel/turborepo#13643</a></li>
<li>perf: Intern resolution identities as Arc&lt;str&gt; across closures
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13645">vercel/turborepo#13645</a></li>
<li>fix: Compose affected tasks with package filters by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13656">vercel/turborepo#13656</a></li>
<li>docs: Explain worktree cache path isolation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13657">vercel/turborepo#13657</a></li>
<li>fix: Upgrade brace-expansion to 5.0.9 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13658">vercel/turborepo#13658</a></li>
<li>docs: Correct verified inaccuracies in the Turborepo Agent Skill by
<a href="https://github.com/charpeni"><code>@​charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13644">vercel/turborepo#13644</a></li>
<li>chore: Update Next.js to 16.3.0 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13659">vercel/turborepo#13659</a></li>
<li>fix: Don't use <code>eprintln!</code> in the panic hook by <a
href="https://github.com/molofsky"><code>@​molofsky</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13637">vercel/turborepo#13637</a></li>
<li>fix: Invalidate only when Git ignore sources change by <a
href="https://github.com/smasato"><code>@​smasato</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13632">vercel/turborepo#13632</a></li>
<li>docs: Update Geistdocs to 1.19.4 by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13680">vercel/turborepo#13680</a></li>
<li>docs: Exclude Turborepo from its own OSS products menu by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13681">vercel/turborepo#13681</a></li>
<li>docs: Use the geistdocs Turborepo logo in the navbar by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13682">vercel/turborepo#13682</a></li>
<li>docs: Update redirected vercel.com/nextjs.org links to current
targets by <a
href="https://github.com/molebox"><code>@​molebox</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13685">vercel/turborepo#13685</a></li>
<li>refactor: Generalize native command arguments by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13664">vercel/turborepo#13664</a></li>
<li>refactor: Move native contracts to tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13665">vercel/turborepo#13665</a></li>
<li>docs: Fix loadTransformers reference in turbo-codemod README by <a
href="https://github.com/latent-9"><code>@​latent-9</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13683">vercel/turborepo#13683</a></li>
<li>refactor: Model native task execution explicitly by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13666">vercel/turborepo#13666</a></li>
<li>feat: Compose aggregate native task dependencies by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13667">vercel/turborepo#13667</a></li>
<li>fix: Respect aggregate task overrides by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13668">vercel/turborepo#13668</a></li>
<li>test: Stabilize watch task inputs regression test by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13686">vercel/turborepo#13686</a></li>
<li>feat: Parse Python quality tool declarations by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13669">vercel/turborepo#13669</a></li>
<li>feat: Resolve Python quality plans by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13670">vercel/turborepo#13670</a></li>
<li>refactor: Extract uv native task specs by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13671">vercel/turborepo#13671</a></li>
<li>feat: Synthesize Python quality tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13672">vercel/turborepo#13672</a></li>
<li>test: Cover Python quality task commands by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13673">vercel/turborepo#13673</a></li>
<li>feat: Hash Python quality task inputs by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13674">vercel/turborepo#13674</a></li>
<li>test: Cover Python quality task graph by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13675">vercel/turborepo#13675</a></li>
<li>chore: Release Turborepo 2.10.9-canary.1 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13687">vercel/turborepo#13687</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/33237d4be13d7b74768c2cf3353b19cfa8d1af7c"><code>33237d4</code></a>
publish 2.10.9 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/3b0e57f1289b2a6b3d6dd402bce928469d3b25fa"><code>3b0e57f</code></a>
fix: Prevent Windows process cleanup PID reuse (<a
href="https://redirect.github.com/vercel/turborepo/issues/13695">#13695</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/efe4e1bdf665f2950cf89d7968907de36c2f0737"><code>efe4e1b</code></a>
fix: Prune Bun wildcard workspace dev dependencies (<a
href="https://redirect.github.com/vercel/turborepo/issues/13694">#13694</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/a98e5cde97796088c6107684a64a40a967cd1ef0"><code>a98e5cd</code></a>
docs: Document dependency-driven Python tasks (<a
href="https://redirect.github.com/vercel/turborepo/issues/13676">#13676</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/c09a92f526b6dca9ea0243922f680803779759cd"><code>c09a92f</code></a>
chore: Release Turborepo 2.10.9-canary.1 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13687">#13687</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/09bd548dddbff2a29086bdef7cb07b02d5e5458a"><code>09bd548</code></a>
test: Cover Python quality task graph (<a
href="https://redirect.github.com/vercel/turborepo/issues/13675">#13675</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/3584a5fb8edac9efc826fdea57e92088505fc76a"><code>3584a5f</code></a>
feat: Hash Python quality task inputs (<a
href="https://redirect.github.com/vercel/turborepo/issues/13674">#13674</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/0d43ff3cbf5ac8873c646a84b2fd7ae53097e08d"><code>0d43ff3</code></a>
test: Cover Python quality task commands (<a
href="https://redirect.github.com/vercel/turborepo/issues/13673">#13673</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/94708adc6bc19b41805741cc5a15ac5467a481cf"><code>94708ad</code></a>
feat: Synthesize Python quality tasks (<a
href="https://redirect.github.com/vercel/turborepo/issues/13672">#13672</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/e14f04ec6c2dc2791b0a3beb32df7515b31b3d4b"><code>e14f04e</code></a>
refactor: Extract uv native task specs (<a
href="https://redirect.github.com/vercel/turborepo/issues/13671">#13671</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.8...v2.10.9">compare
view</a></li>
</ul>
</details>
<br />

Updates `chrome-devtools-mcp` from 1.6.0 to 1.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/releases">chrome-devtools-mcp's
releases</a>.</em></p>
<blockquote>
<h2>chrome-devtools-mcp: v1.7.0</h2>
<h2><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a>
(2026-08-10)</h2>
<h3>🎉 Features</h3>
<ul>
<li>add a utility function to check for localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li>
<li>Add get_heapsnapshot_object_details MCP tool (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li>
<li>Emit native contexts in snapshot summary (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li>
<li>Filter heap snapshot objects by native context (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li>
<li><strong>telemetry:</strong> log devtools data. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li>
<li><strong>telemetry:</strong> log is_devtools_open with each tool
call. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li>
<li><strong>telemetry:</strong> report whether tool call is made on
localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li>
<li>update lighthouse to 13.4.1 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li>
</ul>
<h3>🛠️ Fixes</h3>
<ul>
<li>bound per-navigation network request retention (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li>
<li><strong>cli:</strong> validate session ids (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li>
<li><strong>cli:</strong> warn about version mismatch between cli and
daemon (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li>
<li><strong>daemon:</strong> preserve hyphenated browser flags in arg
serialization and lazy daemon startup (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li>
<li>dispose heap snapshot workers on context teardown (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li>
<li>do not throw synchronously when a CDP session is gone (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li>
<li>don't throw if Dialog was handled (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li>
<li>downscale viewport screenshots when no viewport is emulated (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li>
<li>improve daemon lifecycle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li>
<li>improve file writing (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li>
<li>include the tab id in <code>get_tab_id</code>'s text response (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li>
<li><strong>memory:</strong> dispose the heap-snapshot worker when
loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li>
<li><strong>performance:</strong> reset trace-running flag when
start_trace setup fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li>
<li>regression after the <a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>
(<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li>
<li>rename maxRetainedSize column (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li>
<li><strong>screenshot:</strong> dispose element handle after
take_screenshot (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li>
<li>toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li>
<li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens
during an action (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li>
</ul>
<h3>📄 Documentation</h3>
<ul>
<li>Add devin cli install instruction to README (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li>
<li>correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li>
<li><strong>skills:</strong> update memory leak debugging skill to use
native MCP tools (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li>
<li>Update Chrome requirement for categoryExperimentalWebmcp (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li>
<li>update security.md (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li>
</ul>
<h3>🏗️ Refactor</h3>
<ul>
<li>clean up McpResponse.handle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/main/CHANGELOG.md">chrome-devtools-mcp's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a>
(2026-08-10)</h2>
<h3>🎉 Features</h3>
<ul>
<li>add a utility function to check for localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li>
<li>Add get_heapsnapshot_object_details MCP tool (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li>
<li>Emit native contexts in snapshot summary (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li>
<li>Filter heap snapshot objects by native context (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li>
<li><strong>telemetry:</strong> log devtools data. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li>
<li><strong>telemetry:</strong> log is_devtools_open with each tool
call. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li>
<li><strong>telemetry:</strong> report whether tool call is made on
localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li>
<li>update lighthouse to 13.4.1 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li>
</ul>
<h3>🛠️ Fixes</h3>
<ul>
<li>bound per-navigation network request retention (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li>
<li><strong>cli:</strong> validate session ids (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li>
<li><strong>cli:</strong> warn about version mismatch between cli and
daemon (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li>
<li><strong>daemon:</strong> preserve hyphenated browser flags in arg
serialization and lazy daemon startup (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li>
<li>dispose heap snapshot workers on context teardown (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li>
<li>do not throw synchronously when a CDP session is gone (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li>
<li>don't throw if Dialog was handled (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li>
<li>downscale viewport screenshots when no viewport is emulated (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li>
<li>improve daemon lifecycle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li>
<li>improve file writing (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li>
<li>include the tab id in <code>get_tab_id</code>'s text response (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li>
<li><strong>memory:</strong> dispose the heap-snapshot worker when
loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li>
<li><strong>performance:</strong> reset trace-running flag when
start_trace setup fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li>
<li>regression after the <a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>
(<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li>
<li>rename maxRetainedSize column (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li>
<li><strong>screenshot:</strong> dispose element handle after
take_screenshot (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li>
<li>toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li>
<li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens
during an action (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li>
</ul>
<h3>📄 Documentation</h3>
<ul>
<li>Add devin cli install instruction to README (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li>
<li>correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li>
<li><strong>skills:</strong> update memory leak debugging skill to use
native MCP tools (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li>
<li>Update Chrome requirement for categoryExperimentalWebmcp (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li>
<li>update security.md (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li>
</ul>
<h3>🏗️ Refactor</h3>
<ul>
<li>clean up McpResponse.handle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li>
<li>introduce Explicit resouce managent (using) (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5b25370c9cd779032c3c9dc9880eca7031c73005">5b25370</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/774d78f5eef5e610407a0c92fa6ec5ed74b027e8"><code>774d78f</code></a>
chore(main): release chrome-devtools-mcp 1.7.0 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2363">#2363</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57"><code>5ddbffd</code></a>
docs: correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753"><code>8028bfe</code></a>
fix: toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d1e4d711aa520c67df045a2f805380e9b3307abd"><code>d1e4d71</code></a>
chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.2 in the
all gr...</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93"><code>744738d</code></a>
fix(memory): dispose the heap-snapshot worker when loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ca66d0f321a57473ae400fa5e82842d4bbffe210"><code>ca66d0f</code></a>
chore(dev-deps): bump devtools-frontend (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2498">#2498</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/2f375c7e592d15ee9d0e1d665a4600a8b20879d0"><code>2f375c7</code></a>
chore: fix Explicit resource management polyfill (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2496">#2496</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/830f78b8ce19f8ee1e1d8c4d812bd9d6e4f48c2f"><code>830f78b</code></a>
chore: re-use connection adapter and dispose devtools unvierse (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2465">#2465</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c96dca1f19711a80308bd0d608fb8d40e29d152"><code>4c96dca</code></a>
ci: add main branch (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2497">#2497</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/71d897b27e7936c1a8911d053e19d92ec2c46655"><code>71d897b</code></a>
chore: add a new profiler scenario for get_console_messages. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2491">#2491</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@earendil-works/pi-coding-agent` from 0.83.0 to 0.84.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/releases">@​earendil-works/pi-coding-agent's
releases</a>.</em></p>
<blockquote>
<h2>v0.84.1</h2>
<h3>New Features</h3>
<ul>
<li><strong>Qwen Token Plan Individual</strong> — Use the built-in
provider for models documented for Individual subscriptions. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
<li><strong>Authentication readiness checks</strong> — Use <code>pi auth
check</code> to verify provider or model credentials, optionally
emitting the resolved credential.</li>
<li><strong>Improved fullscreen interaction</strong> — Select words and
paragraphs with multiple clicks and configure half-page transcript
scrolling. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a>.</li>
<li><strong>Terminating blocked tool calls</strong> — Extension
<code>tool_call</code> handlers can stop all-terminating batches without
another model call. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a>.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added Qwen Token Plan Individual as a built-in provider with its
documented subscription model catalog and the shared international
<code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a>
by <a
href="https://github.com/arasovic"><code>@​arasovic</code></a>).</li>
<li>Added <code>pi auth check</code> provider/model auth preflight with
optional credential output (<a
href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li>
<li>Added <code>terminate</code> support to blocked extension
<code>tool_call</code> events so all-terminating batches can skip the
automatic follow-up model call. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a>
by <a href="https://github.com/muyiyr"><code>@​muyiyr</code></a>).</li>
<li>Added inherited double-click word and whitespace selection,
granularity-aware drag selection, and triple-click paragraph selection
in fullscreen mode (<a
href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>,
<a
href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a>
by <a href="https://github.com/volsa"><code>@​volsa</code></a>).</li>
<li>Added inherited unbound half-page transcript scrolling actions for
fullscreen mode. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Softened the bash tool's <code>PI_*</code> environment guideline in
an attempt to reduce unnecessary inspection commands (<a
href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li>
<li>Reduced worst-case automatic terminal theme detection delay from 200
ms to 100 ms by probing color-scheme and background support
concurrently.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed Bun standalone binaries crashing on startup when the cwd
contains a <code>bunfig.toml</code> with <code>preload</code> by
compiling with <code>--no-compile-autoload-bunfig</code> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a>
by <a
href="https://github.com/geril07"><code>@​geril07</code></a>).</li>
<li>Fixed extension TUI method wrappers recursing indefinitely when
delegating to the original method (<a
href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li>
<li>Fixed right-click not pasting clipboard text in fullscreen mode on
Windows.</li>
<li>Fixed inherited <code>Agent.reset()</code> clearing transcript and
runtime state during active runs; it now rejects until the agent is idle
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a>
by <a
href="https://github.com/wesleyzhangwq"><code>@​wesleyzhangwq</code></a>).</li>
<li>Fixed inherited LaTeX relation, multiplication, and named-operator
spacing, and matrix composition with stacked fractions, operator limits,
and adjacent matrices.</li>
<li>Reduced inherited fullscreen mouse event volume under tmux, Zellij,
and GNU Screen by using button-motion tracking instead of all-motion
tracking.</li>
</ul>
<h2>v0.84.0</h2>
<h3>New Features</h3>
<ul>
<li><strong>Fullscreen TUI mode</strong> — Switch between regular and
fullscreen modes at runtime, with a sticky editor and footer,
independently scrollable transcript, and draggable scrollbars. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#ui--display">UI
&amp; Display</a>.</li>
<li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid
diagrams and terminal-friendly Unicode math in interactive transcripts.
See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#markdown">Markdown
settings</a> and <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/tui/README.md#markdown">TUI
Markdown</a>.</li>
<li><strong>Per-directory context overrides</strong> — Use
<code>AGENTS.override.md</code> to replace context files for a specific
directory. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/usage.md#context-files">Context
Files</a>.</li>
<li><strong>Advanced custom model sampling</strong> — Configure
arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM
<code>thinking_token_budget</code> values. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/models.md#sampling-parameters">Sampling
Parameters</a>.</li>
<li><strong>Baseten provider</strong> — Use built-in Baseten
authentication and model support. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>
<p>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code>
interface to <code>ModelsRequestTransforms</code> because its header
transformation now applies to all authenticated provider requests.</p>
</li>
<li>
<p>Changed JSON and RPC <code>message_update</code> events to emit only
<code>assistantMessageEvent</code> deltas, removing the cumulative
<code>message</code> and <code>assistantMessageEvent.partial</code>
fields that caused quadratic output growth. Clients that need partial
messages must assemble deltas between <code>message_start</code> and
<code>message_end</code>; the latter remains authoritative (<a
href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</p>
</li>
<li>
<p><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns
<code>ProviderHeaders</code> with <code>string | null</code> values and
preserves <code>null</code> header-deletion markers. Extensions that
inspect returned headers must handle <code>null</code>; extensions
forwarding them to pi-ai streams should pass them through unchanged.
This prevents placeholder OpenAI credentials from being sent through
Cloudflare AI Gateway (<a
href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</p>
</li>
<li>
<p>Changed <code>ModelRegistry.refresh()</code> to accept
<code>ModelsRefreshOptions</code> and return
<code>ModelsRefreshResult</code> instead of discarding cancellation and
provider errors.</p>
</li>
<li>
<p>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth
cancellation options rather than catalog refresh options. Call
<code>refresh({ providers: [providerId], signal })</code> separately
when remote freshness is required.</p>
</li>
<li>
<p>Required config-form extension OAuth <code>refreshToken(credentials,
signal)</code> callbacks to accept and honor a concrete abort
signal.</p>
</li>
<li>
<p>Replaced dynamic provider refresh context store access with the
read-only <code>context.stored</code> snapshot and generation-checked
<code>context.publish()</code> transaction.</p>
<p><strong>Providers built with <code>createProvider({ fetchModels
})</code>:</strong> no catalog-publication migration is required. Before
and after, return the fetched models and register the resulting
provider; <code>createProvider()</code> owns restoration, persistence,
and in-memory publication.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@​earendil-works/pi-coding-agent's
changelog</a>.</em></p>
<blockquote>
<h2>[0.84.1] - 2026-08-07</h2>
<h3>New Features</h3>
<ul>
<li><strong>Qwen Token Plan Individual</strong> — Use the built-in
provider for models documented for Individual subscriptions. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
<li><strong>Authentication readiness checks</strong> — Use <code>pi auth
check</code> to verify provider or model credentials, optionally
emitting the resolved credential.</li>
<li><strong>Improved fullscreen interaction</strong> — Select words and
paragraphs with multiple clicks and configure half-page transcript
scrolling. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a>.</li>
<li><strong>Terminating blocked tool calls</strong> — Extension
<code>tool_call</code> handlers can stop all-terminating batches without
another model call. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a>.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added Qwen Token Plan Individual as a built-in provider with its
documented subscription model catalog and the shared international
<code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a>
by <a
href="https://github.com/arasovic"><code>@​arasovic</code></a>).</li>
<li>Added <code>pi auth check</code> provider/model auth preflight with
optional credential output (<a
href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li>
<li>Added <code>terminate</code> support to blocked extension
<code>tool_call</code> events so all-terminating batches can skip the
automatic follow-up model call. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a>
by <a href="https://github.com/muyiyr"><code>@​muyiyr</code></a>).</li>
<li>Added inherited double-click word and whitespace selection,
granularity-aware drag selection, and triple-click paragraph selection
in fullscreen mode (<a
href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>,
<a
href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a>
by <a href="https://github.com/volsa"><code>@​volsa</code></a>).</li>
<li>Added inherited unbound half-page transcript scrolling actions for
fullscreen mode. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Softened the bash tool's <code>PI_*</code> environment guideline in
an attempt to reduce unnecessary inspection commands (<a
href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li>
<li>Reduced worst-case automatic terminal theme detection delay from 200
ms to 100 ms by probing color-scheme and background support
concurrently.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed Bun standalone binaries crashing on startup when the cwd
contains a <code>bunfig.toml</code> with <code>preload</code> by
compiling with <code>--no-compile-autoload-bunfig</code> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a>
by <a
href="https://github.com/geril07"><code>@​geril07</code></a>).</li>
<li>Fixed extension TUI method wrappers recursing indefinitely when
delegating to the original method (<a
href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li>
<li>Fixed right-click not pasting clipboard text in fullscreen mode on
Windows.</li>
<li>Fixed inherited <code>Agent.reset()</code> clearing transcript and
runtime state during active runs; it now rejects until the agent is idle
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a>
by <a
href="https://github.com/wesleyzhangwq"><code>@​wesleyzhangwq</code></a>).</li>
<li>Fixed inherited LaTeX relation, multiplication, and named-operator
spacing, and matrix composition with stacked fractions, operator limits,
and adjacent matrices.</li>
<li>Reduced inherited fullscreen mouse event volume under tmux, Zellij,
and GNU Screen by using button-motion tracking instead of all-motion
tracking.</li>
</ul>
<h2>[0.84.0] - 2026-08-06</h2>
<h3>New Features</h3>
<ul>
<li><strong>Fullscreen TUI mode</strong> — Switch between regular and
fullscreen modes at runtime, with a sticky editor and footer,
independently scrollable transcript, and draggable scrollbars. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#ui-display">UI
&amp; Display</a>.</li>
<li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid
diagrams and terminal-friendly Unicode math in interactive transcripts.
See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#markdown">Markdown
settings</a> and <a
href="https://github.com/earendil-works/pi/blob/main/packages/tui/README.md#markdown">TUI
Markdown</a>.</li>
<li><strong>Per-directory context overrides</strong> — Use
<code>AGENTS.override.md</code> to replace context files for a specific
directory. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context
Files</a>.</li>
<li><strong>Advanced custom model sampling</strong> — Configure
arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM
<code>thinking_token_budget</code> values. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/models.md#sampling-parameters">Sampling
Parameters</a>.</li>
<li><strong>Baseten provider</strong> — Use built-in Baseten
authentication and model support. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code>
interface to <code>ModelsRequestTransforms</code> because its header
transformation now applies to all authenticated provider requests.</li>
<li>Changed JSON and RPC <code>message_update</code> events to emit only
<code>assistantMessageEvent</code> deltas, removing the cumulative
<code>message</code> and <code>assistantMessageEvent.partial</code>
fields that caused quadratic output growth. Clients that need partial
messages must assemble deltas between <code>message_start</code> and
<code>message_end</code>; the latter remains authoritative (<a
href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</li>
<li><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns
<code>ProviderHeaders</code> with <code>string | null</code> values and
preserves <code>null</code> header-deletion markers. Extensions that
inspect returned headers must handle <code>null</code>; extensions
forwarding them to pi-ai streams should pass them through unchanged.
This prevents placeholder OpenAI credentials from being sent through
Cloudflare AI Gateway (<a
href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</li>
<li>Changed <code>ModelRegistry.refresh()</code> to accept
<code>ModelsRefreshOptions</code> and return
<code>ModelsRefreshResult</code> instead of discarding cancellation and
provider errors.</li>
<li>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth
cancellation options rather than catalog refresh options. Call
<code>refresh({ providers: [providerId], signal })</code> separately
when remote freshness is required.</li>
<li>Required config-form extension OAuth <code>refreshToken(credentials,
signal)</code> callbacks to accept and honor a concrete abort
signal.</li>
<li>Replaced dynamic provider refresh context store access with the
read-only <code>context.stored</code> snapshot and generation-checked
<code>context.publish()</code> transac...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-17 18:57:12 +02:00
dependabot[bot] 2cab683f0e chore(deps-dev): bump the npm-development group with 6 updates (#4091) 
Bumps the npm-development group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.2.0` |
`17.3.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.76.0` | `1.77.0` |
|
[oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint)
| `1.76.0` | `1.77.0` |
|
[@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver)
| `7.7.1` | `7.8.0` |
|
[@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent)
| `0.82.1` | `0.83.0` |
| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) |
`0.27.13` | `0.29.5` |

Updates `lint-staged` from 17.2.0 to 17.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/releases">lint-staged's
releases</a>.</em></p>
<blockquote>
<h2>v17.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a>
- It is now possible to run multiple tasks in parallel for a single glob
by configuring it with an array of tasks (which run sequentially), and
then placing another array inside it (where the tasks will run in
parallel). The following demonstrates the order tasks will start in:</p>
<pre lang="json"><code>{
&quot;*.ts&quot;: [&quot;first&quot;, &quot;second&quot;,
[&quot;third&quot;, &quot;third&quot;], &quot;fourth&quot;]
}
</code></pre>
<p>As a concrete example, <em>lint-staged</em>'s own configuration
is:</p>
<pre lang="js"><code>/** @type {import('./lib/index.js').Configuration}
*/
export default {
  &quot;*&quot;: [
    [
      &quot;oxfmt --check --no-error-on-unmatched-pattern&quot;,
      &quot;oxlint --no-error-on-unmatched-pattern&quot;,
    ],
  ],
  &quot;*.ts&quot;: () =&gt; &quot;tsc&quot;,
};
</code></pre>
<p>which means:</p>
<ol>
<li>for all staged files, run the two commands in parallel with staged
filenames appended, for example:
<ul>
<li><code>oxfmt --check --no-error-on-unmatched-pattern
lib/index.js</code></li>
<li><code>oxlint --no-error-on-unmatched-pattern
lib/index.js</code></li>
</ul>
</li>
<li>additionally, if any <code>*.ts</code> files are staged, run
<code>tsc</code> without appending any arguments</li>
<li>The two sets of commands also run in parallel</li>
</ol>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
- During an in-progress merge, files that are unchanged from the branch
being merged are now skipped. Technically, files are only included if
there are staged changes against both <code>HEAD</code> and
<code>MERGE_HEAD</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md">lint-staged's
changelog</a>.</em></p>
<blockquote>
<h2>17.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a>
- It is now possible to run multiple tasks in parallel for a single glob
by configuring it with an array of tasks (which run sequentially), and
then placing another array inside it (where the tasks will run in
parallel). The following demonstrates the order tasks will start in:</p>
<pre lang="json"><code>{
&quot;*.ts&quot;: [&quot;first&quot;, &quot;second&quot;,
[&quot;third&quot;, &quot;third&quot;], &quot;fourth&quot;]
}
</code></pre>
<p>As a concrete example, <em>lint-staged</em>'s own configuration
is:</p>
<pre lang="js"><code>/** @type {import('./lib/index.js').Configuration}
*/
export default {
  &quot;*&quot;: [
    [
      &quot;oxfmt --check --no-error-on-unmatched-pattern&quot;,
      &quot;oxlint --no-error-on-unmatched-pattern&quot;,
    ],
  ],
  &quot;*.ts&quot;: () =&gt; &quot;tsc&quot;,
};
</code></pre>
<p>which means:</p>
<ol>
<li>for all staged files, run the two commands in parallel with staged
filenames appended, for example:
<ul>
<li><code>oxfmt --check --no-error-on-unmatched-pattern
lib/index.js</code></li>
<li><code>oxlint --no-error-on-unmatched-pattern
lib/index.js</code></li>
</ul>
</li>
<li>additionally, if any <code>*.ts</code> files are staged, run
<code>tsc</code> without appending any arguments</li>
<li>The two sets of commands also run in parallel</li>
</ol>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
- During an in-progress merge, files that are unchanged from the branch
being merged are now skipped. Technically, files are only included if
there are staged changes against both <code>HEAD</code> and
<code>MERGE_HEAD</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/d15344350d914f5ce24df2c85f3ffebb9b387f3b"><code>d153443</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1828">#1828</a>
from lint-staged/changeset-release/main</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/5162c149bbfa09b8a5ad4d37c647d63946568ca8"><code>5162c14</code></a>
chore(changeset): release</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/a4db9a4c32f108d1397436752be7e9dda956baa2"><code>a4db9a4</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1831">#1831</a>
from lint-staged/linter-updates</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/ea96cab0109ab44a5b2562927b890648ee32b4cc"><code>ea96cab</code></a>
style: enable oxlint &quot;suspicious&quot; category</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/2fae00778cea0c99da9bcb8bad4718dce08ea04e"><code>2fae007</code></a>
style: add <code>@e18e/eslint-plugin</code></li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/2280c38a09ff4ca4db60320b5879e0029527afaa"><code>2280c38</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1829">#1829</a>
from lint-staged/fix-merge-conflict-files</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/1453ae6ae0e05275d714ad0cad7cd090885f504d"><code>1453ae6</code></a>
test: relax assertion so that it passes in worktree</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
fix: lint only files changed against HEAD and MERGE_HEAD, during a
merge</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/dedfc31007aed50e1c9c5591a11085cb485ba41c"><code>dedfc31</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1825">#1825</a>
from lint-staged/parallel-tasks-inside-sequence</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/286e25cef9fde2fb6e77d2312fd91ac99020d69d"><code>286e25c</code></a>
feat: allow running parallel tasks by nesting arrays</li>
<li>Additional commits viewable in <a
href="https://github.com/lint-staged/lint-staged/compare/v17.2.0...v17.3.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.76.0 to 1.77.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.27.0 &amp;&amp; oxfmt v0.12.0</h2>
<h1>Oxlint v1.27.0</h1>
<h3>🚀 Features</h3>
<ul>
<li>222a8f0 linter/plugins: Implement
<code>SourceCode#isSpaceBetween</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15498">#15498</a>)
(overlookmotel)</li>
<li>2f9735d linter/plugins: Implement
<code>context.languageOptions</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15486">#15486</a>)
(overlookmotel)</li>
<li>bc731ff linter/plugins: Stub out all <code>Context</code> APIs (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15479">#15479</a>)
(overlookmotel)</li>
<li>5822cb4 linter/plugins: Add <code>extend</code> method to
<code>FILE_CONTEXT</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15477">#15477</a>)
(overlookmotel)</li>
<li>7b1e6f3 apps: Add pure rust binaries and release to github (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15469">#15469</a>)
(Boshen)</li>
<li>2a89b43 linter: Introduce debug assertions after fixes to assert
validity (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15389">#15389</a>)
(camc314)</li>
<li>ad3c45a editor: Add <code>oxc.path.node</code> option (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15040">#15040</a>)
(Sysix)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>6f3cd77 linter/no-var: Incorrect warning for blocks (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15504">#15504</a>)
(Hamir Mahal)</li>
<li>6957fb9 linter/plugins: Do not allow access to
<code>Context#id</code> in <code>createOnce</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15489">#15489</a>)
(overlookmotel)</li>
<li>7409630 linter/plugins: Allow access to <code>cwd</code> in
<code>createOnce</code> in ESLint interop mode (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15488">#15488</a>)
(overlookmotel)</li>
<li>732205e parser: Reject <code>using</code> / <code>await using</code>
in a switch <code>case</code> / <code>default</code> clause (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15225">#15225</a>)
(sapphi-red)</li>
<li>a17ca32 linter/plugins: Replace <code>Context</code> class (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15448">#15448</a>)
(overlookmotel)</li>
<li>ecf2f7b language_server: Fail gracefully when tsgolint executable
not found (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15436">#15436</a>)
(camc314)</li>
<li>3c8d3a7 lang-server: Improve logging in failure case for tsgolint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15299">#15299</a>)
(camc314)</li>
<li>ef71410 linter: Use jsx if source type is JS in fix debug assertion
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15434">#15434</a>)
(camc314)</li>
<li>e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15426">#15426</a>)
(camc314)</li>
<li>6565dbe linter/switch-case-braces: Skip comments when searching for
<code>:</code> token (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15425">#15425</a>)
(camc314)</li>
<li>85bd19a linter/prefer-class-fields: Insert value after type
annotation in fixer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15423">#15423</a>)
(camc314)</li>
<li>fde753e linter/plugins: Block access to
<code>context.settings</code> in <code>createOnce</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15394">#15394</a>)
(overlookmotel)</li>
<li>ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper
in invalid positions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15388">#15388</a>)
(camc314)</li>
<li>dac2a9c linter/no-template-curly-in-string: Remove fixer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15387">#15387</a>)
(camc314)</li>
<li>989b8e3 linter/no-var: Only fix to <code>const</code> if the var has
an initializer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15385">#15385</a>)
(camc314)</li>
<li>cc403f5 linter/plugins: Return empty object for unimplemented
parserServices (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15364">#15364</a>)
(magic-akari)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>25d577e language_server: Start tools in parallel (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15500">#15500</a>)
(Sysix)</li>
<li>3c57291 linter/plugins: Optimize loops (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15449">#15449</a>)
(overlookmotel)</li>
<li>3166233 linter/plugins: Remove <code>Arc</code>s (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15431">#15431</a>)
(overlookmotel)</li>
<li>9de1322 linter/plugins: Lazily deserialize settings JSON (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15395">#15395</a>)
(overlookmotel)</li>
<li>3049ec2 linter/plugins: Optimize <code>deepFreezeSettings</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15392">#15392</a>)
(overlookmotel)</li>
<li>444ebfd linter/plugins: Use single object for
<code>parserServices</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15378">#15378</a>)
(overlookmotel)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>97d2104 linter: Update comment in lint.rs about default value for
tsconfig path (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15530">#15530</a>)
(Connor Shea)</li>
<li>2c6bd9e linter: Always refer as &quot;ES2015&quot; instead of
&quot;ES6&quot; (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15411">#15411</a>)
(sapphi-red)</li>
<li>a0c5203 linter/import/named: Update &quot;ES7&quot; comment in
examples (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15410">#15410</a>)
(sapphi-red)</li>
<li>3dc24b5 linter,minifier: Always refer as &quot;ES Modules&quot;
instead of &quot;ES6 Modules&quot; (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15409">#15409</a>)
(sapphi-red)</li>
<li>2ad77fb linter/no-this-before-super: Correct &quot;Why is this
bad?&quot; section (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15408">#15408</a>)
(sapphi-red)</li>
<li>57f0ce1 linter: Add backquotes where appropriate (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15407">#15407</a>)
(sapphi-red)</li>
</ul>
<h1>Oxfmt v0.12.0</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.77.0] - 2026-08-03</h2>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>5c0fa61 linter/eslint/no-warning-comments: Unify config structs and
remove manual options docs (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25151">#25151</a>)
(Mikhail Baev)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>9dc7756 linter/typescript/no-unnecessary-condition: Clarify options
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)
(camc314)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a>
release(apps): oxlint v1.77.0 &amp;&amp; oxfmt v0.62.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25251">#25251</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/5c0fa61ddbd098fea5101dff356dc9b67adbee95"><code>5c0fa61</code></a>
fix(linter/eslint/no-warning-comments): unify config structs and remove
manua...</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9dc77567291db6ebd0641284f80bf50163c6a257"><code>9dc7756</code></a>
docs(linter/typescript/no-unnecessary-condition): clarify options (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.77.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-plugin-eslint` from 1.76.0 to 1.77.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a>
release(apps): oxlint v1.77.0 &amp;&amp; oxfmt v0.62.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25251">#25251</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/apps_v1.77.0/npm/oxlint-plugin-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/semver` from 7.7.1 to 7.8.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver">compare
view</a></li>
</ul>
</details>
<br />

Updates `@earendil-works/pi-coding-agent` from 0.82.1 to 0.83.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/releases">@​earendil-works/pi-coding-agent's
releases</a>.</em></p>
<blockquote>
<h2>v0.83.0</h2>
<h3>New Features</h3>
<ul>
<li><strong>Credential export for external clients</strong> — <code>pi
auth print-api-key</code> and <code>pi auth print-bearer-token</code>
export configured credentials with automatic OAuth refresh and
minimum-validity enforcement.</li>
<li><strong>Headless OpenRouter sign-in</strong> — Complete
<code>/login</code> over SSH by pasting the redirect URL or
authorization code when the loopback callback is unavailable. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li>
<li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5
through GitHub Copilot with adaptive thinking and a 1M context window.
See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs
including <code>Type.Base</code>, <code>Type.Awaited</code>,
<code>Type.Promise</code>, <code>Type.AsyncIterator</code>,
<code>Type.Iterator</code>, <code>Type.Options</code>, and
<code>Value.Mutate</code>, while fixing compiled validation of nullable
array tool arguments. Extensions using removed APIs must migrate to
supported TypeBox APIs. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#dependencies">Package
Dependencies</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a>
by <a
href="https://github.com/petrroll"><code>@​petrroll</code></a>).</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added <code>pi auth print-api-key</code> and <code>pi auth
print-bearer-token</code> commands for exporting configured credentials
to external clients, including automatic OAuth refresh and configurable
minimum token validity (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
<li>Exposed the session's resolved model scope as
<code>ctx.scopedModels</code> to extensions. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension
Context</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a>
by <a href="https://github.com/pungggi"><code>@​pungggi</code></a>, <a
href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li>
<li>Added inherited per-request <code>fetch</code> injection for
supported text and image provider transports.</li>
<li>Added the inherited <code>&quot;pending&quot;</code> stop reason for
partial streaming messages. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom
Provider Stream Pattern</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a>
by <a
href="https://github.com/lucasmeijer"><code>@​lucasmeijer</code></a>).</li>
<li>Added inherited raw provider stop reasons across Google, Anthropic,
Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons
now surface as provider errors instead of successful stops (<a
href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li>
<li>Added manual redirect URL and authorization-code entry to OpenRouter
login for remote and headless environments. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a>
by <a
href="https://github.com/rgarcia"><code>@​rgarcia</code></a>).</li>
<li>Added inherited Claude Opus 5 support for GitHub Copilot with
adaptive thinking and a 1M context window. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a>
by <a
href="https://github.com/jay-aye-see-kay"><code>@​jay-aye-see-kay</code></a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Changed inherited OAuth credential resolution to refresh tokens with
less than five minutes of validity remaining instead of waiting until
expiration (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Added a status line when the tool output expansion is toggled (<a
href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li>
<li>Fixed file-backed <code>SYSTEM.md</code> and
<code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive
startup context listing. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#system-prompt-files">System
Prompt Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li>
<li>Fixed context files loading twice when a linked Git worktree is
nested under its main repository. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#context-files">Context
Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a>
by <a
href="https://github.com/arajkumar"><code>@​arajkumar</code></a>).</li>
<li>Fixed llama.cpp streamed responses reporting zero token usage and
leaving session context accounting empty. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a>
by <a
href="https://github.com/SteveImmanuel"><code>@​SteveImmanuel</code></a>).</li>
<li>Fixed session replacement and committed tree navigation during an
active response to abort and persist the outgoing turn instead of
leaving dangling tool calls. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#sessions">Sessions</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a>
by <a
href="https://github.com/tmustier"><code>@​tmustier</code></a>).</li>
<li>Fixed failed Git package installs leaving partial directories that
blocked clean retries. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#install-and-manage">Install
and Manage</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a>
by <a
href="https://github.com/haoqixu"><code>@​haoqixu</code></a>).</li>
<li>Fixed the <code>/model</code> selector retaining a stale selection
while filtering instead of highlighting the top match (<a
href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed direct RPC bash commands bypassing extension
<code>user_bash</code> handlers. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#user-bash-events">User
Bash Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li>
<li>Fixed skills, prompts, and themes losing package source metadata
after extensions reload resources. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#resource-events">Resource
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li>
<li>Fixed cancellation of concurrently running user bash commands so
every active command is aborted (<a
href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed duplicate messages appearing when extensions switch sessions
during interactive startup (<a
href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed inherited Qwen Token Plan reasoning models to send their
service-specific thinking controls and supported reasoning-effort levels
(<a
href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>,
<a
href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li>
<li>Fixed inherited Z.AI output limits being sent through an unsupported
parameter. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md">Providers</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a>
by <a
href="https://github.com/HyeokjaeLee"><code>@​HyeokjaeLee</code></a>).</li>
<li>Fixed explicitly configured Amazon Bedrock profiles being overridden
by ambient AWS access keys. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon
Bedrock</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed inherited image fallback paths overflowing narrow terminals,
shortened home-directory paths, and made absolute paths clickable when
terminal hyperlinks are available (<a
href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li>
<li>Fixed inherited OpenAI-compatible tool calls losing their function
arguments when malformed deltas also contain an empty
<code>custom</code> object (<a
href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a>
by <a
href="https://github.com/sunnyyoung"><code>@​sunnyyoung</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@​earendil-works/pi-coding-agent's
changelog</a>.</em></p>
<blockquote>
<h2>[0.83.0] - 2026-07-29</h2>
<h3>New Features</h3>
<ul>
<li><strong>Credential export for external clients</strong> — <code>pi
auth print-api-key</code> and <code>pi auth print-bearer-token</code>
export configured credentials with automatic OAuth refresh and
minimum-validity enforcement.</li>
<li><strong>Headless OpenRouter sign-in</strong> — Complete
<code>/login</code> over SSH by pasting the redirect URL or
authorization code when the loopback callback is unavailable. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li>
<li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5
through GitHub Copilot with adaptive thinking and a 1M context window.
See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs
including <code>Type.Base</code>, <code>Type.Awaited</code>,
<code>Type.Promise</code>, <code>Type.AsyncIterator</code>,
<code>Type.Iterator</code>, <code>Type.Options</code>, and
<code>Value.Mutate</code>, while fixing compiled validation of nullable
array tool arguments. Extensions using removed APIs must migrate to
supported TypeBox APIs. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#dependencies">Package
Dependencies</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a>
by <a
href="https://github.com/petrroll"><code>@​petrroll</code></a>).</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added <code>pi auth print-api-key</code> and <code>pi auth
print-bearer-token</code> commands for exporting configured credentials
to external clients, including automatic OAuth refresh and configurable
minimum token validity (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
<li>Exposed the session's resolved model scope as
<code>ctx.scopedModels</code> to extensions. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension
Context</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a>
by <a href="https://github.com/pungggi"><code>@​pungggi</code></a>, <a
href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li>
<li>Added inherited per-request <code>fetch</code> injection for
supported text and image provider transports.</li>
<li>Added the inherited <code>&quot;pending&quot;</code> stop reason for
partial streaming messages. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom
Provider Stream Pattern</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a>
by <a
href="https://github.com/lucasmeijer"><code>@​lucasmeijer</code></a>).</li>
<li>Added inherited raw provider stop reasons across Google, Anthropic,
Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons
now surface as provider errors instead of successful stops (<a
href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li>
<li>Added manual redirect URL and authorization-code entry to OpenRouter
login for remote and headless environments. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a>
by <a
href="https://github.com/rgarcia"><code>@​rgarcia</code></a>).</li>
<li>Added inherited Claude Opus 5 support for GitHub Copilot with
adaptive thinking and a 1M context window. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a>
by <a
href="https://github.com/jay-aye-see-kay"><code>@​jay-aye-see-kay</code></a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Changed inherited OAuth credential resolution to refresh tokens with
less than five minutes of validity remaining instead of waiting until
expiration (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Added a status line when the tool output expansion is toggled (<a
href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li>
<li>Fixed file-backed <code>SYSTEM.md</code> and
<code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive
startup context listing. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#system-prompt-files">System
Prompt Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li>
<li>Fixed context files loading twice when a linked Git worktree is
nested under its main repository. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context
Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a>
by <a
href="https://github.com/arajkumar"><code>@​arajkumar</code></a>).</li>
<li>Fixed llama.cpp streamed responses reporting zero token usage and
leaving session context accounting empty. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a>
by <a
href="https://github.com/SteveImmanuel"><code>@​SteveImmanuel</code></a>).</li>
<li>Fixed session replacement and committed tree navigation during an
active response to abort and persist the outgoing turn instead of
leaving dangling tool calls. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#sessions">Sessions</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a>
by <a
href="https://github.com/tmustier"><code>@​tmustier</code></a>).</li>
<li>Fixed failed Git package installs leaving partial directories that
blocked clean retries. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#install-and-manage">Install
and Manage</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a>
by <a
href="https://github.com/haoqixu"><code>@​haoqixu</code></a>).</li>
<li>Fixed the <code>/model</code> selector retaining a stale selection
while filtering instead of highlighting the top match (<a
href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed direct RPC bash commands bypassing extension
<code>user_bash</code> handlers. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#user-bash-events">User
Bash Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li>
<li>Fixed skills, prompts, and themes losing package source metadata
after extensions reload resources. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#resource-events">Resource
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li>
<li>Fixed cancellation of concurrently running user bash commands so
every active command is aborted (<a
href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed duplicate messages appearing when extensions switch sessions
during interactive startup (<a
href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed inherited Qwen Token Plan reasoning models to send their
service-specific thinking controls and supported reasoning-effort levels
(<a
href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>,
<a
href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li>
<li>Fixed inherited Z.AI output limits being sent through an unsupported
parameter. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md">Providers</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a>
by <a
href="https://github.com/HyeokjaeLee"><code>@​HyeokjaeLee</code></a>).</li>
<li>Fixed explicitly configured Amazon Bedrock profiles being overridden
by ambient AWS access keys. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon
Bedrock</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed inherited image fallback paths overflowing narrow terminals,
shortened home-directory paths, and made absolute paths clickable when
terminal hyperlinks are available (<a
href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li>
<li>Fixed inherited OpenAI-compatible tool calls losing their function
arguments when malformed deltas also contain an empty
<code>custom</code> object (<a
href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a>
by <a
href="https://github.com/sunnyyoung"><code>@​sunnyyoung</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/earendil-works/pi/commit/845d6ff1f6643aba440341cce877ce1c43ebbc39"><code>845d6ff</code></a>
Release v0.83.0</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f0499a63ff5563ff041c689f680ecbf01436a5e2"><code>f0499a6</code></a>
docs: audit changelogs since v0.82.1</li>
<li><a
href="https://github.com/earendil-works/pi/commit/bff5ab71743b442efa234dbed369e0a96da791f3"><code>bff5ab7</code></a>
fix(coding-agent): show system prompt files in startup context (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7266">#7266</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/cced6a21da273b26ee4a23a803680614bbe8dd1e"><code>cced6a2</code></a>
fix(coding-agent): stop loading AGENTS.md twice in nested git worktrees
(<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7221">#7221</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f9476a61e557bfdce2fbf3ffeaad0988fe47c184"><code>f9476a6</code></a>
fix(ai): update TypeBox nullable array validation (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7243">#7243</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/0c32e83a352a4284133b2544f730a23814948ac3"><code>0c32e83</code></a>
fix(coding-agent): enable streaming usage for llama.cpp provider (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7258">#7258</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/47ca25fcd8535b80710fad5be758f1f2cf81443c"><code>47ca25f</code></a>
Revert &quot;fix(coding-agent): build-check-test (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)&quot;</li>
<li><a
href="https://github.com/earendil-works/pi/commit/0d008b746892ad33d3fe15c0c4bc86a14369e0e8"><code>0d008b7</code></a>
fix(coding-agent): show tool expansion status</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f14519551682cd0fddac2e4b4e8b1f333667e94c"><code>f145195</code></a>
fix(coding-agent): build-check-test (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/cefa40ed8f8dbcd6ffd67b5e7a0eaa75a5050d1a"><code>cefa40e</code></a>
***WIP it's a PoC *** fix(coding-agent): guard tree navigation during
respons...</li>
<li>Additional commits viewable in <a
href="https://github.com/earendil-works/pi/commits/v0.83.0/packages/coding-agent">compare
view</a></li>
</ul>
</details>
<br />

Updates `eve` from 0.27.13 to 0.29.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/eve/releases">eve's
releases</a>.</em></p>
<blockquote>
<h2>eve@0.29.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>c0dc572: Rename the TUI <code>/new</code> command to
<code>/reset</code> so session reset uses the same name across the
client, HTTP, channel, and TUI APIs.</li>
<li>3dce30a: Add manual session compaction through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/compact</code> command. Compaction preserves the session, queues
behind an active turn, and does not send synthetic model input.</li>
<li>910805e: Make a single <code>Esc</code> cancel the running turn in
the eve dev TUI when no message is queued. Queued messages still use
<code>Esc</code> to steer the oldest message into the next turn.</li>
<li>9c51755: Connection search and discovered connection tools now use
the same <code>defineDynamic</code> and <code>defineTool</code> pipeline
as authored tools. Dynamic tool maps now reject entries that omit
<code>defineTool</code> instead of accepting unsupported raw
objects.</li>
<li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with
consistent integration categories and category-specific browsing labels.
MCP connections are now named explicitly, and the flow more clearly
explains channels, extensions, and observability integrations.</li>
<li>0c28eb7: Allow declared subagents to export
<code>defineDynamic</code> from <code>agent.ts</code>. Session and turn
resolvers can now return an agent configuration to expose it or nil to
omit it from direct and Workflow delegation.</li>
<li>f3bb60d: Add manual session-context clearing through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/clear</code> command. Clearing removes model-message history
while preserving the session, agent configuration, durable state,
limits, and sandbox.</li>
<li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command
cooperatively cancels a running turn from either the live streaming
input or the idle prompt while preserving the session and settled
context.</li>
</ul>
<h2>eve@0.29.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>e90a8c2: Launch local or deployed eve applications as stable ACP v1
agents with <code>eve acp [url]</code>, including streamed messages,
tool activity, human input, cancellation, concurrent sessions, and
verified Vercel authentication.</li>
<li>cec672d: Add guided Discord setup through <code>eve add
channel/discord</code>, including Vercel Connect provisioning, trigger
attachment, interactions endpoint configuration, slash-command
registration, and channel scaffolding.</li>
<li>ed328e7: Render registry item titles with their exact
registry-provided casing by loading manifests for each page of catalog
results.</li>
<li>c875a67: Update the generated <code>AGENTS.md</code> to direct
coding agents to the eve registry for discovering and installing
integrations.</li>
<li>5153b13: Add JSON output to <code>eve registry list</code> and
<code>eve registry search</code> for scripts that inspect registry
catalogs.</li>
<li>155d46a: Connection registry items now configure their Vercel
Connect connector during <code>eve add</code>, and registry setup
commands close their IPC channel after reporting an outcome so
<code>/add</code> returns instead of remaining stuck.</li>
<li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a
finite, cursor-consistent session event prefix that can hydrate
server-rendered applications.</li>
<li>67bfc76: Resolve sandbox skill roots and seed-file paths through the
same <code>$HOME</code> resolver the file tools use, so the skills
location is spelled once instead of twice.</li>
<li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and
any surviving workflow processes before the CLI exits. Persisted
workflow messages now reach the ready worker during restart instead of
being rejected while the file watcher starts.</li>
<li>731464f: Give the local trace spool's on-disk layout a single owner:
the shared trace reader now exposes the listing and segment-read
primitives that <code>eve traces</code> and the <code>/traces</code>
viewer both use, and payload formatting is shared between the detail
panel and the conversation view.</li>
<li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line
geometry from one prefix-sum helper so scroll, click, and wheel math
cannot disagree, and reset the view through a single factory when the
viewed trace changes.</li>
<li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's
colors instead of forcing a hardcoded black/grey truecolor palette. It
probes the terminal's default background (OSC 11) and derives its card
surfaces from your own theme — subtly elevated bands on dark and light
backgrounds alike, with red bands for failures, and card titles that
invert to black on light backgrounds so they stay legible. Terminals
that don't answer the probe get a clean gutter-rail rendering drawn
entirely with the shared TUI theme.</li>
<li>f5d0533: Derive the dev TUI's slash-command suggestion window from
the command registry instead of a hand-maintained constant, and collapse
the duplicated cursor step in the terminal line-wrap loop.</li>
</ul>
<h2>eve@0.29.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>22bfa02: Add guided Photon setup through <code>eve add
channel/photon-imessage</code>, including project creation, phone
registration, Vercel Connect or portable credentials, and channel
scaffolding.</li>
<li>0c0de19: Add an opt-in experimental steering policy to Chat SDK
sends that cancels an active turn before delivering its replacement
message.</li>
<li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class
Photon iMessage channel with lazy credentials, Vercel OIDC webhook
verification, and automatic eve session routing.</li>
<li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in
<code>read_file</code>, <code>write_file</code>, <code>glob</code>, and
<code>grep</code> tools so agents can directly access packaged skill
references advertised in their prompt.</li>
<li>bf01952: Local trace spans now capture model and tool payloads: the
system prompt, prompt messages, and response text/reasoning/tool calls
on model spans, and call arguments/results on tool spans, each capped at
32 KB with provider transport metadata stripped. Set
<code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the
spool.</li>
<li>680db59: Provider-executed tool calls (like a gateway's
<code>web_search</code>) now show up in local traces: their calls and
results are captured on the model span and the <code>/traces</code>
viewer renders them as tool cards, with oversized outputs truncated to
stay valid JSON.</li>
<li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time,
so views rendering large single-line payloads (long tool results, big
JSON) no longer stall on every repaint.</li>
<li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto
one shared lifecycle. A <code>vercel</code> lookup killed by a signal
(for example Ctrl-C during setup) now reports a cancellation failure
instead of resolving as a success with truncated output.</li>
<li>7703448: The local trace spool reader behind <code>eve traces</code>
moved into a shared internal module; command behavior is unchanged.</li>
<li>2d87acb: Subagent turn spans now record the dispatch that created
them —
<code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>,
<code>agent.parent.call_id</code>, and
<code>agent.subagent.name</code> — so a parent turn that fans out to
several children can
be attributed to the exact tool call behind each one.</li>
<li>3c846bc: The <code>/traces</code> viewer supports drag-to-select:
dragging with the mouse highlights text and releasing copies it to the
clipboard (OSC 52 with tmux passthrough, plus the platform clipboard
command) with a confirmation toast. Clicks now act on release so drags
never toggle cards, and Esc cancels an in-flight selection.</li>
<li>3645c6e: The <code>/traces</code> viewer frame breathes: padding
rows around the title and above the footer hints, the copy toast floats
top-right as a small surface with a left edge bar, and the scroll wheel
scrolls the attributes drawer when the pointer is over it.</li>
<li>8858403: The local tracing subsystem (spool writer/reader,
retention, the zero-config local OTel runtime, and agent span capture)
moved from <code>src/harness</code> into its own
<code>src/tracing</code> module; no behavior change.</li>
<li>9adb455: Adds a <code>/traces</code> command to the dev TUI: a
full-screen live viewer over the local trace spool that re-tells each
trace as a chat-style conversation — system prompt, user and assistant
messages, and tool calls render as expandable cards (arrow keys or mouse
click to expand/collapse), with a right-side metadata drawer. Subagent
turns are badged with their dispatch lineage
(<code>subagent:&lt;name&gt;</code>), and the viewer opens on the trace
containing the current session — including windowed sessions and
subagent children recorded into a parent's trace. Expanded cards scroll
line-by-line so content taller than the viewport is fully readable.
Model spans with errors, token usage, or tool calls (but no text) now
appear as cards instead of disappearing. Terminal escape sequences in
trace payloads are stripped at render time. Tool-call arguments and
results are captured without stripping domain-level
<code>providerOptions</code>/<code>providerMetadata</code> keys. A
single prompt message over 32 KiB is truncated at the text level so the
serialized JSON stays parseable. Local spans capture system prompt,
prompt messages, responses, reasoning, and tool arguments/results
(<code>EVE_TRACES_CONTENT=off</code> to disable); long conversations
truncate oldest messages first with an omission marker.</li>
<li>275271d: Subagent runs now record into the trace of the session that
dispatched them instead of a disconnected trace of their own, and
<code>eve traces</code> resolves either session id to it. Local traces
also open a real <code>agent.session</code> root span rather than a
synthesized parent, so an authored OTel sampler's root rule decides
whether a session is sampled, and a session long enough to outgrow one
trace rolls into numbered windows that <code>eve traces
&lt;session-id&gt;</code> lists oldest first. Rows whose lifetime
outlives the worker that opened them — <code>agent.session</code> and
<code>agent.turn</code> — now show the extent of their descendants
instead of <code>0ms</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/eve/blob/main/packages/eve/CHANGELOG.md">eve's
changelog</a>.</em></p>
<blockquote>
<h2>0.29.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>c0dc572: Rename the TUI <code>/new</code> command to
<code>/reset</code> so session reset uses the same name across the
client, HTTP, channel, and TUI APIs.</li>
<li>3dce30a: Add manual session compaction through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/compact</code> command. Compaction preserves the session, queues
behind an active turn, and does not send synthetic model input.</li>
<li>910805e: Make a single <code>Esc</code> cancel the running turn in
the eve dev TUI when no message is queued. Queued messages still use
<code>Esc</code> to steer the oldest message into the next turn.</li>
<li>9c51755: Connection search and discovered connection tools now use
the same <code>defineDynamic</code> and <code>defineTool</code> pipeline
as authored tools. Dynamic tool maps now reject entries that omit
<code>defineTool</code> instead of accepting unsupported raw
objects.</li>
<li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with
consistent integration categories and category-specific browsing labels.
MCP connections are now named explicitly, and the flow more clearly
explains channels, extensions, and observability integrations.</li>
<li>0c28eb7: Allow declared subagents to export
<code>defineDynamic</code> from <code>agent.ts</code>. Session and turn
resolvers can now return an agent configuration to expose it or nil to
omit it from direct and Workflow delegation.</li>
<li>f3bb60d: Add manual session-context clearing through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/clear</code> command. Clearing removes model-message history
while preserving the session, agent configuration, durable state,
limits, and sandbox.</li>
<li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command
cooperatively cancels a running turn from either the live streaming
input or the idle prompt while preserving the session and settled
context.</li>
</ul>
<h2>0.29.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>e90a8c2: Launch local or deployed eve applications as stable ACP v1
agents with <code>eve acp [url]</code>, including streamed messages,
tool activity, human input, cancellation, concurrent sessions, and
verified Vercel authentication.</li>
<li>cec672d: Add guided Discord setup through <code>eve add
channel/discord</code>, including Vercel Connect provisioning, trigger
attachment, interactions endpoint configuration, slash-command
registration, and channel scaffolding.</li>
<li>ed328e7: Render registry item titles with their exact
registry-provided casing by loading manifests for each page of catalog
results.</li>
<li>c875a67: Update the generated <code>AGENTS.md</code> to direct
coding agents to the eve registry for discovering and installing
integrations.</li>
<li>5153b13: Add JSON output to <code>eve registry list</code> and
<code>eve registry search</code> for scripts that inspect registry
catalogs.</li>
<li>155d46a: Connection registry items now configure their Vercel
Connect connector during <code>eve add</code>, and registry setup
commands close their IPC channel after reporting an outcome so
<code>/add</code> returns instead of remaining stuck.</li>
<li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a
finite, cursor-consistent session event prefix that can hydrate
server-rendered applications.</li>
<li>67bfc76: Resolve sandbox skill roots and seed-file paths through the
same <code>$HOME</code> resolver the file tools use, so the skills
location is spelled once instead of twice.</li>
<li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and
any surviving workflow processes before the CLI exits. Persisted
workflow messages now reach the ready worker during restart instead of
being rejected while the file watcher starts.</li>
<li>731464f: Give the local trace spool's on-disk layout a single owner:
the shared trace reader now exposes the listing and segment-read
primitives that <code>eve traces</code> and the <code>/traces</code>
viewer both use, and payload formatting is shared between the detail
panel and the conversation view.</li>
<li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line
geometry from one prefix-sum helper so scroll, click, and wheel math
cannot disagree, and reset the view through a single factory when the
viewed trace changes.</li>
<li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's
colors instead of forcing a hardcoded black/grey truecolor palette. It
probes the terminal's default background (OSC 11) and derives its card
surfaces from your own theme — subtly elevated bands on dark and light
backgrounds alike, with red bands for failures, and card titles that
invert to black on light backgrounds so they stay legible. Terminals
that don't answer the probe get a clean gutter-rail rendering drawn
entirely with the shared TUI theme.</li>
<li>f5d0533: Derive the dev TUI's slash-command suggestion window from
the command registry instead of a hand-maintained constant, and collapse
the duplicated cursor step in the terminal line-wrap loop.</li>
</ul>
<h2>0.29.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>22bfa02: Add guided Photon setup through <code>eve add
channel/photon-imessage</code>, including project creation, phone
registration, Vercel Connect or portable credentials, and channel
scaffolding.</li>
<li>0c0de19: Add an opt-in experimental steering policy to Chat SDK
sends that cancels an active turn before delivering its replacement
message.</li>
<li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class
Photon iMessage channel with lazy credentials, Vercel OIDC webhook
verification, and automatic eve session routing.</li>
<li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in
<code>read_file</code>, <code>write_file</code>, <code>glob</code>, and
<code>grep</code> tools so agents can directly access packaged skill
references advertised in their prompt.</li>
<li>bf01952: Local trace spans now capture model and tool payloads: the
system prompt, prompt messages, and response text/reasoning/tool calls
on model spans, and call arguments/results on tool spans, each capped at
32 KB with provider transport metadata stripped. Set
<code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the
spool.</li>
<li>680db59: Provider-executed tool calls (like a gateway's
<code>web_search</code>) now show up in local traces: their calls and
results are captured on the model span and the <code>/traces</code>
viewer renders them as tool cards, with oversized outputs truncated to
stay valid JSON.</li>
<li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time,
so views rendering large single-line payloads (long tool results, big
JSON) no longer stall on every repaint.</li>
<li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto
one shared lifecycle. A <code>vercel</code> lookup killed by a signal
(for example Ctrl-C during setup) now reports a cancellation failure
instead of resolving as a success with truncated output.</li>
<li>7703448: The local trace spool reader behind <code>eve traces</code>
moved into a shared internal module; command behavior is unchanged.</li>
<li>2d87acb: Subagent turn spans now record the dispatch that created
them —
<code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>,
<code>agent.parent.call_id</code>, and
<code>agent.subagent.name</code> — so a parent turn that fans out to
several children can
be attributed to the exact tool call behind each one.</li>
<li>3c846bc: The <code>/traces</code> viewer supports drag-to-select:
dragging with the mouse highlights text and releasing copies it to the
clipboard (OSC 52 with tmux passthrough, plus the platform clipboard
command) with a confirmation toast. Clicks now act on release so drags
never toggle cards, and Esc cancels an in-flight selection.</li>
<li>3645c6e: The <code>/traces</code> viewer frame breathes: padding
rows around the title and above the footer hints, the copy toast floats
top-right as a small surface with a left edge bar, and the scroll wheel
scrolls the attributes drawer when the pointer is over it.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/eve/commit/8988139097d1e1a1f1aca9b2828e63408848fccf"><code>8988139</code></a>
Version Packages (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1497">#1497</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/c0dc57240ec850b0f73075f0e3cc900c6e07640a"><code>c0dc572</code></a>
feat(tui): rename /new command to /reset (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1513">#1513</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/910805e8a825a34ba90c0a22a59dc1d787967976"><code>910805e</code></a>
feat(tui): cancel with one Esc press (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1514">#1514</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/ac7d3c66f8c43ce1008d88cedd5254bfec1301e1"><code>ac7d3c6</code></a>
feat(tui): add /cancel command (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1512">#1512</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/f3bb60dd53fa56e955c6ea71cbf72533cfe618e1"><code>f3bb60d</code></a>
feat: add manual session context clearing (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1511">#1511</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/3dce30a18d24644d85b6120d79eaf4d304beaf4b"><code>3dce30a</code></a>
feat: add manual session compaction (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1508">#1508</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/9c517555e870231af00df799523bffd9fc00df71"><code>9c51755</code></a>
refactor(eve): use public dynamic definitions for connection tools (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1505">#1505</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/0c28eb7e886c1a69ee20a5229682509d5413e140"><code>0c28eb7</code></a>
feat(eve): support dynamic subagents (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1485">#1485</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/84aa6715dbf6b6d696b7f567744711f4526b183f"><code>84aa671</code></a>
fix(eve): clarify add flow categories (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1494">#1494</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/ab86523b3e07f05f415c9c784232b3875b17b16f"><code>ab86523</code></a>
feat(eve): agent-handle lifecycle contracts (three-phase handles, turn
outcom...</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/eve/commits/eve@0.29.5/packages/eve">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-07 16:53:51 +05:30
jkomyno 86cc3cc399 chore: merge next into dependabot remediation 2026-08-05 21:29:53 +05:30
jkomyno 9a6d59326f Merge branch 'next' into feat/installer-auto-shell-default 
Keeps this branch's fixture-driven managed-block reconciler
(reconcileManagedPathBlock, pinned byte-for-byte against install.sh's awk
rewrite by test/managed-block-fixtures) and drops next's narrower
replaceManagedPathBlock/applyFileChanges pair, which it supersedes.

Adopts from next: the narrowed unsafe-path character set on both the TS and
sh sides, the removal of the $PATH-reachability write skip, the hedged
no-shell PATH message, and the COMPOSIO_BIN_DIR command documentation.
 2026-08-05 19:12:05 +05:30
jkomyno fdb366d090 Merge branch 'feat/cli-install-shell-flag' into feat/mise-style-installer-rollout 
# Conflicts:
#	install.sh
#	test/install-sh-release-resolution.test.sh
#	ts/packages/cli/test/__utils__/services/test-layer.ts
#	ts/packages/cli/test/src/commands/install.cmd.test.ts
 2026-08-04 20:02:22 +05:30
Alberto Schiabel 1503786358 refactor(core): forbid explicit any and type JSON Schema recursively (#3968) 
This PR:

- is refreshed directly onto the current next branch now that #3966 and
#3967 have merged; the PR contains only its intended type-safety work
- enforces no explicit any through the standard .oxlintrc.json, pnpm
lint, and plain oxlint --fix in lint-staged; docs remain covered by
their nested configuration
- replaces the loose JSONSchemaProperty in @composio/core with a
concrete recursive interface, removing explicit any reachable through
Tool.inputParameters and Tool.outputParameters
- includes a minor changeset documenting the type narrowing for
properties, default, and enum consumers
- adds a compile-only public-contract test for recursive schemas,
known-key validation, extension keywords, and Tool reachability
- removes explicit any from FileToolModifier, ts-builders, core and CLI
tests, provider tests, and json-schema-to-zod tests
- keeps TypeScript ESLint-parity rules enabled and closes the
tool-router example lint/typecheck gap
- makes no lockfile changes and no runtime behavior changes

## Context

Final PR from the original #3958 split. The migration foundations are
already on next via #3966 and #3967, so this branch no longer carries a
stacked base commit.
 2026-08-03 22:24:57 +05:30
jkomyno a850f2c1c1 chore(deps-dev): refresh development tooling 2026-08-03 17:04:43 +05:30
jkomyno 94c21f2ed1 fix(cli): install bundles with atomic replacement 2026-08-01 19:10:03 +05:30
jkomyno dadd2f4471 test(cli): add hermetic installer e2e coverage 2026-08-01 16:15:24 +05:30
Alberto Schiabel f233e46937 chore(repo): migrate eslint to oxlint and typecheck to TypeScript 7 (#3966) 
This PR:

- replaces ESLint with oxlint across the pnpm workspace and the
Bun-based docs site, porting the rules to `.oxlintrc.json` /
`docs/.oxlintrc.json` with behavior parity (restricted-syntax selectors
kept via `oxlint-plugin-eslint`)
- migrates typecheck to TypeScript 7 (`typescript@^7.0.2` catalog) and
keeps a TS6 pin for JS compiler API consumers via a named `ts6` pnpm
catalog (`ts/scripts/validate-examples.ts`, the `@composio/cli` generate
pipeline). The CLI's `typescript` dependency rebinds only the
compiler-API import — its typecheck still runs the root TS7 `tsc`, since
the alias package only ships a `tsc6` bin (documented in
`ts/packages/cli/AGENTS.md`)
- removes the `paths` mappings that pointed `@composio/core` (and, in
`experimental`, `@composio/json-schema-to-zod` plus core-internal
`#`-imports) at sibling `src` directories: under TS7, tsdown's
tsgo-based dts step emitted stray `.d.ts` files next to those
out-of-root sources on every dependent package build. Workspace deps now
resolve through their built dist types, which turbo's `dependsOn:
^build` already guarantees exist — and which the deep-path exports
(`@composio/core/*`) always used anyway
- renames the cli boundary tooling `eslint-boundaries*` →
`lint-boundaries*` and hardens the scanner to reject `oxlint-disable`
spellings so the disable manifest cannot be bypassed
- rewrites inline `eslint-disable` comments to oxlint rule names
(comment-only; no runtime changes), and adds **one new** declared
boundary: `tool-file-uploads.ts` needs `no-restricted-imports` disabled
for `node:crypto` (MD5 for the presigned-upload checksum is not in Web
Crypto), because oxlint also catches dynamic `await import()` where
ESLint did not. The manifest grows 46 → 47 deliberately
- updates CI path filters, `turbo.jsonc` lint inputs, and the docs
typescript-check workflow (renamed to "Docs - Lint and TypeScript
Validation" since it now lints too); drops `eslint`,
`typescript-eslint`, `eslint-config-next`, and `globals` from the
dependency graphs
- ships no changeset: I built `@composio/core` and `@composio/anthropic`
on this branch and on the pre-migration base and diffed the emitted
`dist/**/*.d.mts`. The provider output is byte-identical. Core's output
is **semantically identical but not byte-identical**: TS7 changes quote
style (`"x"` → `'x'`), object-property and union-member ordering in
inferred types, and picks equivalent shorter re-export alias paths for
five signatures (e.g. `OpenAI.Beta.Threads.Runs.Run` →
`OpenAI.Beta.Threads.Run` — verified both names alias the same type in
the shipped typings). Chunk-name hashes shift as a consequence. No type
gains, losses, or shape changes; `attw` and `publint` pass on the TS7
build

## Context

First of a three-PR split of #3958. The type-safety refactors are
stacked on this branch and merge after it:

- docs: https://github.com/ComposioHQ/composio/pull/3967
- `@composio/core`: https://github.com/ComposioHQ/composio/pull/3968
 2026-07-28 19:16:57 +05:30
Alberto Schiabel 503b50ab02 chore(deps): refresh SDK, Python, and CI dependencies (#3955) 
This PR:

- splits https://github.com/ComposioHQ/composio/pull/3953 in two: this
PR carries every dependency and GitHub Actions bump **except** the docs
site, which follows in a stacked PR
- consolidates and supersedes Dependabot PRs #3915, #3916, and #3934
through #3942
- adopts TypeScript 7.0.2 for primary compilation while retaining the
`@typescript/typescript6` API lane that TypeScript-ESLint still
requires, following the upstream side-by-side guidance
- refreshes Python core and provider dependencies, lockfiles, and the
Ruff 0.16 lint configuration
- updates every GitHub Action with a verified newer official release,
including majors, while retaining immutable commit SHA pins and
migrating setup-uv cache pruning
- deletes four per-package `eslint.config.mjs` shims: under ESLint 10
the default per-file config lookup re-anchors the root config's globs
into each package, so `pnpm lint` stayed green while the CLI's
try/catch, `process.env` and node-builtin bans went unenforced
- bounds and documents the new `brace-expansion` and `@hono/node-server`
security overrides, raising the `@hono/node-server` floor to 2.0.10 to
clear GHSA-9mqv-5hh9-4cgg
- preserves intentional compatibility fixtures and lanes for AI SDK 6,
Zod 3, TypeScript 5.8, Mastra AI SDK 5, and Python provider constraints

## Context

The docs site is a separate Bun workspace with its own `bun.lock` and is
not a pnpm workspace member, so the two halves share no lockfile and no
build. Splitting them keeps the Fumadocs 11 migration (a breaking API
change with real refactoring) reviewable on its own, independently of
the mechanical version bumps here.

The `brace-expansion` override deliberately spans majors:
GHSA-mh99-v99m-4gvg (HIGH) is published as a single `<=5.0.7` range with
no 1.x or 2.x backport, so narrowing it to the 5.x line puts
`brace-expansion` 2.1.2 back under `core>minimatch>brace-expansion` and
`pnpm audit --prod --audit-level=high` exits 1. Verified both ways; the
trade-off it buys is recorded inline in `pnpm-workspace.yaml`.

Verified on this branch standalone: `pnpm install --frozen-lockfile`,
`pnpm lint`, `pnpm typecheck`, `pnpm build:packages`, `pnpm test` (963
tests, 26/26 tasks), and `pnpm audit --prod --audit-level=high`.
 2026-07-27 17:57:29 +05:30
Alberto Schiabel 6d5465acd3 refactor(cli): seal the CommandDescriptor seam and drop zod for Schema (#3882) 
This PR:
- activates the descriptor-seam rule group:
`commands/command-introspection.ts` becomes the only module allowed to
import `CommandDescriptor`/`Usage` from `@effect/cli` — the redesign
seam the Effect CLI v4 migration will reimplement
- routes root command assembly, preflight parsing, help routing, and
value-option collection through the seam helpers instead of descriptor
walks
- replaces the Zod-backed tool-input adapter with an internal
`@composio/json-schema-to-effect-schema` compiler backed by the
eval-free `@cfworker/json-schema` interpreter
- normalizes the OpenAPI and Composio extensions accepted by the
previous validator, while preserving typed `ToolInputValidationError`
failures, field paths, multi-error reporting, and typo suggestions
- extends the descriptor and Zod boundaries to reject static imports,
dynamic `import()`, and `require()` bypasses
- adds compiler parity tests plus CLI regression coverage for multiple
simultaneous field and unknown-key failures
- introspection tests pin that the helpers yield identical descriptors
and usage strings

---

**Stack** (re-slice of https://github.com/ComposioHQ/composio/pull/3859;
each PR targets its parent and auto-retargets to `next` as parents
merge):

1. https://github.com/ComposioHQ/composio/pull/3877 — guidelines + inert
rule groups
2. https://github.com/ComposioHQ/composio/pull/3878 — `new Function()`
eval security fix
3. https://github.com/ComposioHQ/composio/pull/3879 — behavioral fix
pack
4. https://github.com/ComposioHQ/composio/pull/3880 — platform-imports
rule + migration
5. https://github.com/ComposioHQ/composio/pull/3881 — terminal-streams
rule + TerminalUI boundary
6. https://github.com/ComposioHQ/composio/pull/3882 — descriptor seam +
Zod→Schema ← **this PR**
7. https://github.com/ComposioHQ/composio/pull/3883 — test-tree lint +
deterministic suites
8. https://github.com/ComposioHQ/composio/pull/3884 — typed error
boundaries + v4 seams
9. https://github.com/ComposioHQ/composio/pull/3885 — try/catch+env ban
+ boundary ratchet

On stacked bases CI runs lint/build and the CLI Docker e2e job; unit
tests and typecheck are verified locally per PR and re-verified by full
CI when each PR is retargeted to `next`.
 2026-07-21 11:25:58 +04:00
Alberto Schiabel 9498679c26 fix(release): guard and document CLI releases (#3895) 
This PR:
- removes the stale `@composio/cli` changeset that wedges
`changesets/action` and preserves its release note in the CLI changelog
- adds `validate:changesets` before the TypeScript release action and
covers ignored-package changesets in the release regression suite
- makes the guard read changeset files directly so it also works in
shallow and detached CI checkouts
- refreshes `mise.lock` after the pinned Python standalone artifacts
moved to the 20260718 build
- adds the repo-local `cli-release` skill with beta, stable-promotion,
verification, and failure-recovery procedures
- replaces the contradictory "stable via changeset" contributor guidance
with the tested-beta promotion path
- extends skill taxonomy, routing probes, and PR path filters so the
guard cannot silently drift

## Regression coverage

The validator test creates a changeset fixture outside a Git repository,
verifies that an ignored CLI package is rejected, then verifies that a
normal package changeset passes. This reproduces the shallow-checkout
failure without relying on a local `next` ref.

## Verification

- `pnpm validate:agent-skills`
- `pnpm validate:skill-routing`
- `pnpm validate:changesets`
- `pnpm test:release-workflow`
- `pnpm lint`
- `pnpm install --frozen-lockfile`
- all 24 TypeScript package test tasks
- skill-creator `quick_validate.py`
- Prettier check
- `git diff --check`
- manual beta release
[`@composio/cli@0.2.33-beta.294`](https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.2.33-beta.294):
33/33 release and installation jobs passed
 2026-07-20 23:17:03 +04:00
dependabot[bot] 09aab1d19f chore(deps-dev): bump the npm-development group across 1 directory with 3 updates (#3795) 
Bumps the npm-development group with 3 updates in the / directory:
[turbo](https://github.com/vercel/turborepo),
[typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)
and [typedoc](https://github.com/TypeStrong/TypeDoc).

Updates `turbo` from 2.10.2 to 2.10.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.10.4</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>release(turborepo): 2.10.3 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13222">vercel/turborepo#13222</a></li>
<li>ci: Retry Windows nextest aborts from transient 0xc0000142 spawn
failures by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13240">vercel/turborepo#13240</a></li>
<li>perf: Use mimalloc as the global allocator by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13237">vercel/turborepo#13237</a></li>
<li>perf: Parse yarn v1 lockfiles in a single pass by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13241">vercel/turborepo#13241</a></li>
<li>ci: Fix cache outputs for Eve app by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13243">vercel/turborepo#13243</a></li>
<li>perf: Stop materializing spans for the disabled daemon log layer by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13244">vercel/turborepo#13244</a></li>
<li>fix: Keep ancestor-scoped bun dependencies resolvable after prune
renames by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13236">vercel/turborepo#13236</a></li>
<li>perf: Overlap external dependency hashing with package file hashing
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13234">vercel/turborepo#13234</a></li>
<li>perf: Build tracked repo index concurrently with package graph by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13232">vercel/turborepo#13232</a></li>
<li>perf: Release tokio runtime at exit so background DNS lookups never
stall the user by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13231">vercel/turborepo#13231</a></li>
<li>perf: Overhaul pnpm lockfile parsing and dependency closure
computation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13228">vercel/turborepo#13228</a></li>
<li>feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13227">vercel/turborepo#13227</a></li>
<li>feat: Introduce toolchain provider abstraction by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13235">vercel/turborepo#13235</a></li>
<li>perf: Parse Berry lockfiles in a single pass by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13242">vercel/turborepo#13242</a></li>
<li>fix: Apply input exclusion globs to the filesystem walk by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13224">vercel/turborepo#13224</a></li>
<li>fix: Stop root-directory packages from claiming every file in change
mapping by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13225">vercel/turborepo#13225</a></li>
<li>chore: Rename turborepo-repository napi package to
<code>@​turbo/repository</code> by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13226">vercel/turborepo#13226</a></li>
<li>perf: Hash git blobs with hardware-accelerated SHA-1 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13245">vercel/turborepo#13245</a></li>
<li>release(turborepo): 2.10.4-canary.1 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13247">vercel/turborepo#13247</a></li>
<li>feat: Discover Cargo crates as packages by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13248">vercel/turborepo#13248</a></li>
<li>perf: Reuse per-package external dependency hashes in run summaries
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13249">vercel/turborepo#13249</a></li>
<li>perf: Stat workspace turbo.json files concurrently during discovery
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13251">vercel/turborepo#13251</a></li>
<li>chore: Add tracing spans to workspace discovery and globwalk phases
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13252">vercel/turborepo#13252</a></li>
<li>fix: Avoid non-reentrant libc calls in concurrent shutdown process
scans by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13256">vercel/turborepo#13256</a></li>
<li>perf: Memoize resolved task definitions during engine construction
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13257">vercel/turborepo#13257</a></li>
<li>perf: Compute transitive closures and external dependency hashes
concurrently with run setup by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13250">vercel/turborepo#13250</a></li>
<li>perf: Probe microfrontends configs in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13262">vercel/turborepo#13262</a></li>
<li>feat: Execute Cargo crate tasks via cargo by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13261">vercel/turborepo#13261</a></li>
<li>perf: Pre-size engine task collections by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13265">vercel/turborepo#13265</a></li>
<li>feat: Expose resolved experimentalCI task configuration in
<code>turbo query</code> by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13264">vercel/turborepo#13264</a></li>
<li>feat: Derive input and output globs for Cargo tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13263">vercel/turborepo#13263</a></li>
<li>perf: Parse large pnpm lockfile sections in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13266">vercel/turborepo#13266</a></li>
<li>feat: Hash Cargo external dependencies per-crate by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13267">vercel/turborepo#13267</a></li>
<li>ci: Install pnpm 10 in musl containers for Library Release by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13269">vercel/turborepo#13269</a></li>
<li>ci: Force pnpm overwrite in Library Release musl containers by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13270">vercel/turborepo#13270</a></li>
<li>perf: Defer the untracked-scan barrier to first file-hash use by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13268">vercel/turborepo#13268</a></li>
<li>ci: Fetch API-created commit before updating local ref by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13271">vercel/turborepo#13271</a></li>
<li>release(library): 0.0.1-canary.22 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13272">vercel/turborepo#13272</a></li>
<li>perf: Remove lock and dispatch overhead from task hash
precomputation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13273">vercel/turborepo#13273</a></li>
<li>fix: Fall back to lockfile detection in
<code>@​turbo/repository</code> when package manager is undeclared by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13275">vercel/turborepo#13275</a></li>
<li>test: Add end-to-end coverage for Cargo workspaces by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13274">vercel/turborepo#13274</a></li>
<li>release(library): 0.0.1-canary.23 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13276">vercel/turborepo#13276</a></li>
<li>release(turborepo): 2.10.4-canary.2 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13278">vercel/turborepo#13278</a></li>
<li>fix: Collapse nested package-manager fallback conditional by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13279">vercel/turborepo#13279</a></li>
<li>feat: Make turbo watch Cargo-aware by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13280">vercel/turborepo#13280</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/1506a114e377dd7e1e8e7a7863c42adf94a9f776"><code>1506a11</code></a>
publish 2.10.4 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/11a68c705274cc7a408776b576ce7a9e14d6e6df"><code>11a68c7</code></a>
fix: Stop flagging relative imports that resolve into node_modules in
boundar...</li>
<li><a
href="https://github.com/vercel/turborepo/commit/947b4784cd1b254e62b663bbdb22891a849b7442"><code>947b478</code></a>
fix: Raise the open-file soft limit at startup (<a
href="https://redirect.github.com/vercel/turborepo/issues/13282">#13282</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/ddc584d788349fc3668e280286f540feee4eb6b9"><code>ddc584d</code></a>
feat: Make turbo prune Cargo-aware (<a
href="https://redirect.github.com/vercel/turborepo/issues/13281">#13281</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/ff0d50822314c5b388d9b4daa9c6159387752d95"><code>ff0d508</code></a>
perf: Skip dependency-closure assembly for toolchains that derive
nothing (<a
href="https://redirect.github.com/vercel/turborepo/issues/1">#1</a>...</li>
<li><a
href="https://github.com/vercel/turborepo/commit/39d623e1323ef50e06be0a103082ae29cc545779"><code>39d623e</code></a>
feat: Make turbo watch Cargo-aware (<a
href="https://redirect.github.com/vercel/turborepo/issues/13280">#13280</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/af01fdfeb5efe07a7b6843a0b8f5033b59ebbb2c"><code>af01fdf</code></a>
fix: Collapse nested package-manager fallback conditional (<a
href="https://redirect.github.com/vercel/turborepo/issues/13279">#13279</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/7e02f94f647cb4d527a438313dc4adbe3e8c0df3"><code>7e02f94</code></a>
release(turborepo): 2.10.4-canary.2 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13278">#13278</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/8e3a59fdb6c71ad24fbbb363db52f88eb9a89116"><code>8e3a59f</code></a>
release(library): 0.0.1-canary.23 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13276">#13276</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/ce18f0a79eb49e9a22c7e6cfa491777c24ed746a"><code>ce18f0a</code></a>
test: Add end-to-end coverage for Cargo workspaces (<a
href="https://redirect.github.com/vercel/turborepo/issues/13274">#13274</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.2...v2.10.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `typescript-eslint` from 8.62.1 to 8.63.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's
releases</a>.</em></p>
<blockquote>
<h2>v8.63.0</h2>
<h2>8.63.0 (2026-07-06)</h2>
<h3>🚀 Features</h3>
<ul>
<li><strong>eslint-plugin:</strong> [no-misused-promises] detect async
usage of a sync dispose usage (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12426">#12426</a>)</li>
</ul>
<h3>🩹 Fixes</h3>
<ul>
<li><strong>eslint-plugin:</strong> [method-signature-style] suggest
converting readonly function properties instead of emitting invalid
syntax (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12447">#12447</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12446">#12446</a>)</li>
<li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion]
handle optional-chained calls to overloaded functions (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12491">#12491</a>,
<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12485">#12485</a>)</li>
<li><strong>eslint-plugin:</strong> [no-base-to-string] don't flag a
shadowed String() call (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12492">#12492</a>)</li>
<li><strong>scope-manager:</strong> export ClassStaticBlockScope (<a
href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12460">#12460</a>)</li>
</ul>
<h3>❤️ Thank You</h3>
<ul>
<li>Evyatar Daud <a
href="https://github.com/StyleShit"><code>@​StyleShit</code></a></li>
<li>Kristjan <a
href="https://github.com/KristjanTammekivi"><code>@​KristjanTammekivi</code></a></li>
<li>Michael Naumov <a
href="https://github.com/mnaoumov"><code>@​mnaoumov</code></a></li>
<li>Serhii Leniv <a
href="https://github.com/Serhii-Leniv"><code>@​Serhii-Leniv</code></a></li>
<li>송재욱</li>
</ul>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's
changelog</a>.</em></p>
<blockquote>
<h2>8.63.0 (2026-07-06)</h2>
<p>This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.</p>
<p>See <a
href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub
Releases</a> for more information.</p>
<p>You can read about our <a
href="https://typescript-eslint.io/users/versioning">versioning
strategy</a> and <a
href="https://typescript-eslint.io/users/releases">releases</a> on our
website.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374"><code>290cf6c</code></a>
chore(release): publish 8.63.0</li>
<li>See full diff in <a
href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `typedoc` from 0.28.19 to 0.28.20
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/TypeStrong/TypeDoc/releases">typedoc's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.20</h2>
<h3>Features</h3>
<ul>
<li>Group/category section headings (<code>&lt;h2&gt;</code>) in the
default theme now include an <code>id</code> attribute so they can be
linked to via fragment identifiers (e.g.
<code>modules.html#classes</code>), <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li>
<li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert
variable/type references as a re-export instead of a new symbol, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li>
<li>API: Introduced <code>generateOutputsBegin</code> and
<code>generateOutputsEnd</code> events on <code>Application</code> for
plugin use.</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>When <code>--emit none</code> is used, TypeDoc will now report
warnings about missing relative paths previously reported when
rendering, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li>
<li>Improved performance via asynchronously performing git and file
write operations, more performant JSX rendering, and source code
bundling, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li>
<li>A <code>@hidden</code> tag on a constructor parameter-property will
now only hide the property, not both the property and the parameter, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li>
<li>Custom <code>@group</code> and <code>@category</code> titles with
the same sort weight are now ordered consistently with the
<code>alphabetical</code> reflection sort, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li>
</ul>
<h3>Thanks!</h3>
<ul>
<li><a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a></li>
<li><a
href="https://github.com/jonathanhefner"><code>@​jonathanhefner</code></a></li>
<li><a
href="https://github.com/kcastellino"><code>@​kcastellino</code></a></li>
<li><a href="https://github.com/Metbcy"><code>@​Metbcy</code></a></li>
<li><a
href="https://github.com/StoneCypher"><code>@​StoneCypher</code></a></li>
<li><a
href="https://github.com/wotan-allfather"><code>@​wotan-allfather</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md">typedoc's
changelog</a>.</em></p>
<blockquote>
<h2>v0.28.20 (2026-07-05)</h2>
<h3>Features</h3>
<ul>
<li>Group/category section headings (<code>&lt;h2&gt;</code>) in the
default theme now include an <code>id</code> attribute so they can be
linked to via fragment identifiers (e.g.
<code>modules.html#classes</code>), <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li>
<li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert
variable/type references as a re-export instead of a new symbol, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li>
<li>API: Introduced <code>generateOutputsBegin</code> and
<code>generateOutputsEnd</code> events on <code>Application</code> for
plugin use.</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>When <code>--emit none</code> is used, TypeDoc will now report
warnings about missing relative paths previously reported when
rendering, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li>
<li>Improved performance via asynchronously performing git and file
write operations, more performant JSX rendering, and source code
bundling, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li>
<li>A <code>@hidden</code> tag on a constructor parameter-property will
now only hide the property, not both the property and the parameter, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li>
<li>Custom <code>@group</code> and <code>@category</code> titles with
the same sort weight are now ordered consistently with the
<code>alphabetical</code> reflection sort, <a
href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li>
</ul>
<h3>Thanks!</h3>
<ul>
<li><a
href="https://github.com/greymoth-jp"><code>@​greymoth-jp</code></a></li>
<li><a
href="https://github.com/jonathanhefner"><code>@​jonathanhefner</code></a></li>
<li><a
href="https://github.com/kcastellino"><code>@​kcastellino</code></a></li>
<li><a href="https://github.com/Metbcy"><code>@​Metbcy</code></a></li>
<li><a
href="https://github.com/StoneCypher"><code>@​StoneCypher</code></a></li>
<li><a
href="https://github.com/wotan-allfather"><code>@​wotan-allfather</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/34d843be0953fc81de0fde14bea8db72d0bbccc6"><code>34d843b</code></a>
Update changelog for release</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/fbd4a254952c171b9ba7ebbe96c5151e844743be"><code>fbd4a25</code></a>
Bump version to 0.28.20</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/93ba157000e4a632bfbf32a0b6f00f8ae57c7c99"><code>93ba157</code></a>
Update dependencies in example</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/e8c5df8844edca9800dfc62cee9115ef0fba59ea"><code>e8c5df8</code></a>
Remove unnecessary files from distribution</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/392b0dd50a428ea0c732c38c6c263e74cb6200b1"><code>392b0dd</code></a>
Update dependencies</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/8510dd48c7778f419f4605146f1a733af27993fa"><code>8510dd4</code></a>
Add missing entries in changelog before release</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/51dc0521890924269f06e08972c6453299f63cb5"><code>51dc052</code></a>
Update change log for 0.28.20 release</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/72f20cd87b4ef30aae97b68fcbb42ca19cebdc22"><code>72f20cd</code></a>
Merge branch 'fix-locale-sort-group-category-titles' into dev</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/623f2c0bd35b5e89cc79fb5783dac01c6f2530e9"><code>623f2c0</code></a>
Fix failing test, accept slightly slower build for now</li>
<li><a
href="https://github.com/TypeStrong/typedoc/commit/c8bdf14cab0c22dd415b6872cc647c6cf81f917c"><code>c8bdf14</code></a>
Minor config tweak to improve dev build time</li>
<li>Additional commits viewable in <a
href="https://github.com/TypeStrong/TypeDoc/compare/v0.28.19...v0.28.20">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-13 13:54:29 +04:00
Alberto Schiabel b0a02c9693 feat(examples): make validation provider agnostic (#3790) 
This PR:

- makes example typecheck, lint, and Workers dry-runs discover packages
by script presence instead of a Mastra-only filter
- runs the nightly staging suite as a provider matrix, starting with
Mastra and failing when a matrix package is missing
- keeps direct and Tool Router agents explicit while sharing the Tool
Router agent between Node.js and Cloudflare Workers
- keeps root ESLint rules in Turbo's lint cache key and documents both
Worker secrets

## Testing

- `pnpm run typecheck`
- `pnpm run typecheck:examples`
- `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` (0 errors; 72
existing warnings)
- `pnpm run lint:examples`
- `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'`
- confirmed Turbo includes `eslint.config.mjs` in the Mastra lint task
inputs
- confirmed a missing provider package fails instead of silently passing
the nightly smoke step

## Post-Deploy Monitoring & Validation

- after merge, dispatch `ts.examples-nightly.yml` on `next` and confirm
the `mastra examples against staging` matrix leg runs smoke,
direct-tools, and Tool Router successfully
- healthy signal: smoke reports wrapped tools and both agent steps
return non-empty output
- failure signal: workflow logs contain `SMOKE FAIL`, `Agent returned
empty output`, `No projects matched`, or a secret preflight error;
revert this PR if the foundation gate begins false-passing or blocking
unrelated example work
- validation window and owner: the first post-merge dispatch plus the
next scheduled 06:00 UTC nightly, owned by the TypeScript examples
maintainers

---

[![Compound
Engineering](https://img.shields.io/badge/Compound-Engineering-6C5CE7)](https://github.com/EveryInc/compound-engineering-plugin)
![Codex](https://img.shields.io/badge/GPT--5-000000)
 2026-07-10 11:42:59 +04:00
Alberto Schiabel 76881491d0 feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788) 
## What

Turns the **Mastra** example into an executable reference that doubles
as a test, and wires the examples into CI for the first time. First
slice of the v1 "executable examples" workstream — the pattern here is
the template for the other TS providers, then Python.

## Why

Examples under `ts/examples/*` were unverified: the only CI tie-in is
`validate-examples.ts`, which is transpile-only (no cross-file types, no
lint, no execution) and passes on exactly the schema-conversion
regressions we keep hitting in the Mastra provider — all closed but
unprotected:

- https://github.com/ComposioHQ/composio/issues/2109 (zod→json
serialization crash)
- https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped
while `$ref` kept)
- https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema
tools crash serialization)

## Changes

**Canonical Mastra example** (`ts/examples/mastra`)
- `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS`
toolkit
- `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` →
`session.tools()` (drops the deprecated bare `composio.create` alias)
- `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers
runtime (`export default { fetch }`)
- `src/smoke.ts` — deterministic wrapping + tool-router assertions
(needs only `COMPOSIO_API_KEY`)
- Removed the old Gmail/MCP entries that used deprecated APIs and
required auth
- Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts`

**Real typecheck + lint** (examples previously escaped both)
- Example now has a `typecheck` script (Node + Worker tsconfigs);
`typecheck:examples` / `lint:examples` scripts added
- eslint now covers `ts/examples/**` with type-safety rules kept
(`no-explicit-any`) and console noise allowed

**Two-tier CI**
- `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck
→ lint → `wrangler deploy --dry-run`. This is the tier that catches the
schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces
as a **type** error.
- `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes
against the **staging** backend with secrets; runs the deterministic
smoke always and the full agent examples when an LLM key is set.

## Verification

Locally against staging: `smoke` passes (5 direct + 6 tool-router
tools), `typecheck:examples` and `lint:examples` are green, the Worker
`wrangler deploy --dry-run` bundles, and seeded regressions (a type
error / an `any`) correctly fail their gate.

## Notes

- No changeset — example packages are private/unpublished.
- Follow-ups (separate PRs): template the pattern to the other TS
providers, then port to `python/examples/*`.
 2026-07-10 01:40:03 +04:00
Alberto Schiabel 58bc93b2d9 chore(deps): consolidate dependency updates (#3760) 
This PR:
- consolidates https://github.com/ComposioHQ/composio/pull/3733,
https://github.com/ComposioHQ/composio/pull/3735 through
https://github.com/ComposioHQ/composio/pull/3744, and
https://github.com/ComposioHQ/composio/pull/3752
- refreshes the pnpm workspace dependencies under the existing
`minimumReleaseAge` supply-chain gate
- keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare
workers types 4 where latest majors conflict with the current workspace
- keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the
workspace catalog to zod 4
- bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock`
- updates the SHA-pinned Claude and Codex workflow actions from the
Dependabot action group
- adds a patch changeset for the versioned package manifests touched by
dependency updates
- verifies the rollup with frozen pnpm/uv locks, peer checks, audit
threshold checks, typecheck, lint, builds, TypeScript tests, and Python
`nox -s chk`

## Context

`pnpm audit --prod --audit-level=moderate` passes. The remaining
production audit item is a low `@ai-sdk/provider-utils` advisory through
Mastra transitive dependencies; forcing it higher would require leaving
the compatible stable Mastra dependency path.
 2026-07-06 14:33:55 +04:00
Alberto Schiabel 956f9be9b4 chore(agents): normalize repo guidance skills (#3666) 
This PR:
- replaces the duplicated repo-local skill set with the requested
canonical `.agents/skills` taxonomy and short router `SKILL.md` files
backed by first-level references
- makes `.claude/skills` a compatibility symlink to `.agents/skills` and
removes hand-maintained Claude skill/rule copies
- moves docs agent guidance and decisions into neutral
`docs/agent-guidance/` and `docs/decisions/`, with `docs/CLAUDE.md`
reduced to a shim
- retires CLI Cursor rules after migrating CLI design, Effect source,
and client-cache sync guidance into `AGENTS.md` and `cli-command`
- adds nested `AGENTS.md` files for TS, core, providers, e2e, Python,
Python providers, and docs
- adds `pnpm validate:agent-skills` to validate skill frontmatter,
taxonomy, references, symlink invariants, stale paths, and command names
- implements missing Python `tst` and `snt` nox sessions that existing
Makefile targets already exposed
- no changeset: repository guidance/tooling only, no published SDK
package behavior

## Verification
- `pnpm validate:agent-skills` -> `Validated 14 canonical agent skills
and guidance invariants.`
- `for skill in .agents/skills/*; do python
/Users/jkomyno/.codex/skills/.system/skill-creator/scripts/quick_validate.py
"$skill" || exit 1; done` -> 14x `Skill is valid!`
- `pnpm --dir ts/packages/cli validate:skills` -> `Validated
composio-cli skill builds for stable and beta.`
- `cd python && uv run nox --list` -> includes `tst` and `snt`
- `cd python && uv run nox -s snt` -> 18 passed
- `cd python && uv run nox -s tst -- tests/test_imports.py` -> 8 passed
- `git diff --check` / `git diff --cached --check` -> clean
- stale reference search for retired docs/Claude/Cursor paths -> no
matches

## Forward Tests
- TypeScript core bug: loaded `bug-fixing`, `typescript-sdk`,
`typescript-testing`; found correct root/ts/core `AGENTS.md` route.
- Python provider: loaded `python-providers`, `python-testing`; found
missing nox sessions, fixed here.
- CLI command: loaded `cli-command`; found recording/changeset wording
gaps, fixed here.
- Cross-SDK drift: loaded `cross-sdk-parity`; again found Python nox
drift, fixed here.
- Docs + decision: loaded `docs-decisions`; found decision
template/index and Twoslash path gaps, fixed here.

## Notes
The first normal `git commit` attempt hit a lint-staged/Git stash
limitation while replacing `.claude/skills/` with a symlink (`path ...
beyond a symbolic link`). The final commit used `--no-verify` after the
validators and formatting checks above passed.
 2026-06-27 00:35:57 +04:00
Rahul Tarak 97e40b7071 fix(release): register slim+experimental in root workspaces; fix slim to core version 
The changeset release on `next` aborted with "Found changeset add-slim-package
for package @composio/slim which is not in the workspace", blocking the Version
Packages PR and all publishes.

Root cause: changesets' package discovery (@manypkg/get-packages) reads the
root package.json `workspaces` field, which was stale — missing
`ts/packages/slim` and `ts/packages/experimental` (both present in
pnpm-workspace.yaml, so pnpm saw them but changesets did not).

- package.json: add ts/packages/experimental and ts/packages/slim to workspaces
- .changeset/config.json: fix @composio/slim to @composio/core so slim always
  ships the same version as core (slim mirrors the built core runtime)

Verified `changeset version` now resolves: core 0.13.0, slim 0.13.0,
experimental 0.1.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-25 18:40:30 -07:00
Alberto Schiabel f8cd90ce5a chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646) 
This PR:

- uses plain `tsdown` package scripts and a shared typed
`tsdown.config.base.ts` so Node 24 builds work without loader flags
- switches the repo dev/build toolchain to Node `24.17.0` and pnpm
`11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml`
- marks the root package as ESM with `type: module`, matching the
TypeScript packages
- keeps Node `22.22.3` in the runtime/E2E matrices as the minimum
supported user runtime
- changes the TypeScript build workflow back to a single build on the
mise-managed toolchain and broadens path filters for
package-manager/build config files
- adds pnpm 11 build-script policy with `allowBuilds` and intentionally
ignored `sharp` builds
- enables tsdown ESM shims for the packaged CLI wrapper so `composio
--help` runs under Node 22 and Node 24

Verified locally:

- `CI=true pnpm install --frozen-lockfile`
- `pnpm lint`
- `pnpm run build:packages`
- `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter
@e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run
test:e2e:node`
- `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3`
and `24.17.0`
 2026-06-24 18:58:11 +04:00
Alberto Schiabel 23f9053804 chore(ts): clean up dependencies and bump toolchain (#3623) 
This PR:

- consolidates and bumps TypeScript/npm dependencies across the
monorepo, docs, examples, and e2e fixtures — no runtime behavior changes
- **cleanup:** remove the unused `ansis` dependency from `@composio/cli`
(`picocolors` is the actual color lib), drop the dead `uuid` catalog
entry, catalog `dotenv` + `@types/bun` and repoint drifting examples/e2e
onto them, and replace `chalk` with `picocolors` in `@composio/core`
(smaller, ESM, already used by the CLI)
- **TypeScript 6:** bump `typescript` `5.9 → 6.0.3` everywhere (catalog,
CLI test fixtures, docs); drop vestigial `declaration`/`outDir` from the
provider `tsconfig.json`s to fix the TS 6 `rootDir` regression
(`TS6059`); add `ignoreDeprecations: "6.0"` in docs for the `baseUrl`
deprecation
- **toolchain:** `tsdown 0.18 → 0.22.3`, `vitest` + `@vitest/ui →
4.1.9`, `publint → 0.3.21`, `wrangler → 4.101.0` (each the latest
version within the 3-day `minimumReleaseAge` gate)
- **Effect + hono:** `effect 3.21.3`, `@effect/cli 0.75.2`,
`@effect/platform 0.96.1`, `platform-bun 0.90.0`, `platform-node-shared
0.60.0`, `language-service 0.86.2`, `@effect/vitest 0.29.0`, `hono
4.12.25`; pin the Effect peer cohort
(`printer`/`printer-ansi`/`typeclass`/`rpc`/`sql`/`cluster`/`experimental`/`workflow`)
as `@composio/cli` devDeps so the auto-installed peers resolve
coherently, and bump `@cloudflare/workers-types` to satisfy `wrangler`'s
peer
- changesets: `@composio/cli` patch (ansis removal) and `@composio/core`
patch (chalk → picocolors)
- verified: `build`, `typecheck` (tsgo + real `tsc` 6.0.3), and local
tests (excluding e2e) all pass
 2026-06-21 00:54:27 +04:00
Alberto Schiabel 31449b25a3 fix(release): register @composio/ts-builders in root workspaces (#3617) 
This PR:

- fixes the `next TS SDK Release` workflow failing at `changeset
version` with `Found changeset drop-commonjs-entrypoints for package
@composio/ts-builders which is not in the workspace`
- adds `ts/packages/ts-builders` to the `workspaces` array in the root
`package.json`

`@manypkg/get-packages` (used by changesets) detects the root
`workspaces` field and treats the repo as a yarn workspace, so it
ignores `pnpm-workspace.yaml` entirely. `@composio/ts-builders` was only
registered in `pnpm-workspace.yaml`, so changesets never saw it. The
mismatch was latent until PR #3494 became the first changeset to bump
that package.

Verified `pnpm exec changeset status` now succeeds and lists all 16
packages, including `@composio/ts-builders`.
 2026-06-19 23:39:58 +04:00
Alberto Schiabel 025a657597 feat(ts): drop CommonJS support (#3494) 
This PR moves the TypeScript SDK support floor to the latest Node.js 22
release and uses that as the point where we stop carrying custom
CommonJS compatibility machinery. The e2e runtime coverage now exercises
the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested
against the minimum supported version and the newer runtimes users are
likely to adopt next.

Because the SDK packages are still on `0.x`, the accompanying changeset
uses `minor` bumps while calling out that this is a breaking change
inside the existing 0.x line.

It also moves pnpm under mise on this Node 22 layer. That belongs here,
not in #3493, because the pinned `pnpm@10.28.2` requires Node.js
`>=22.13`. Removing Corepack is intentional: Node.js documents that
Corepack is no longer distributed starting with Node.js v25, so relying
on `corepack enable` would keep a toolchain dependency that is already
on the way out of the Node distribution.

## What changed

- Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`,
`mise.lock`, `toolchain-versions.json`, and root `devEngines`.
- Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise
the single source of truth for the pnpm version. Removes the root
`packageManager` / `devEngines.packageManager` Corepack pin entirely
(rather than keeping a second copy of the version that could drift) and
removes stale `packageManager` metadata from real TS packages/examples
and generators.
- Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so
Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a
`packageManager` field. Without this, Turbo fails workspace resolution
(`Could not resolve workspaces -> Missing 'packageManager' field`),
which is the only reason the field would otherwise need to stay.
- Replaces `corepack enable` in the shared setup action with
mise-managed pnpm. The E2E Docker images install bun + pnpm directly
from `mise.toml`/`mise.lock` (with
`dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay
on the base image as the test matrix axis and are disabled via
`MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are
symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build
args are threaded from the host anymore, and bun+pnpm now carry
`mise.lock` checksum verification.
- Extends the install-time toolchain check to validate pnpm against mise
alongside Bun.
- Sets the Node E2E matrix and install fallback checks to `22.22.3`,
`24.16.0`, and `25.9.0`.
- Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts`
only and uses the ATTW `esm-only` profile.
- Removes explicit `require` / `.cjs` / `.d.cts` package export paths
and internal import mappings from the public TS SDK packages.
- Marks public TS SDK packages as `type: module` where they were missing
it.
- Replaces the remaining runtime `require('pusher-js')` with dynamic ESM
import.
- Deletes the legacy CJS example.
- Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop
E2E: it verifies `require('@composio/core')` works through Node's native
ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`,
not a `.cjs` artifact.
- Removes `.cjs` / `.cts` handling from example validation and CLI
project-language detection.
- Updates provider scaffolding so newly generated providers are
ESM-only.
- Adds a minor changeset warning that CommonJS callers can only rely on
Node's native `require(esm)` interop and that custom CommonJS
compatibility machinery is gone.

## Bundled behavior changes

Two changes here are technically independent of the CommonJS removal but
ride along because they touch the same files and ship in the same
release cut. Calling them out explicitly so they are not missed in
review:

- **`PusherUtils` realtime channel auth (`@composio/core`).** Replacing
the runtime `require('pusher-js')` with a dynamic ESM `import()` was
done alongside conforming `channelAuthorization` to pusher-js's typed
`customHandler(params, callback)` contract. The previous `(authOptions)
=> Promise` shape did not match pusher-js's actual calling convention —
it read `endpoint`/`headers`/`params` off an argument that pusher-js
never passes — so this also fixes that latent mismatch. New unit tests
(`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request
shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name`
body) and the success / invalid-JSON / network-failure callback paths.
- **CLI meta-tool slug list (`@composio/cli`).** Drops
`COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from
`META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client`
alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']`
union. The list is declared `satisfies
ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at
compile time (`pnpm typecheck`) — keeping the stale slugs would be a
type error — and needs no separate runtime test.

## Verification

- Verified latest Node 22/24/25 releases from the official Node dist
index: `22.22.3`, `24.16.0`, `25.9.0`
(https://nodejs.org/dist/index.json).
- Verified Node docs state Corepack is no longer distributed starting
with Node.js v25:
https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html
- `mise exec -- pnpm --version` -> `10.28.2`
- `mise exec -- pnpm install --frozen-lockfile`
- `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts`
- `mise exec -- pnpm --filter @e2e-tests/utils typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node`
- `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck`
- `mise exec -- pnpm --filter @composio/cli typecheck`
- `mise exec -- pnpm --filter @composio/cli test -- --runInBand`
- `mise exec -- pnpm --filter @composio/core typecheck`
- `mise exec -- pnpm --filter @composio/core exec vitest run
test/utils/pusher.test.ts`
- `mise exec -- pnpm run build:packages`
- `mise exec -- turbo run build --dry-run` resolves all workspace
packages with no root `packageManager` field (pnpm discovered from
`pnpm-lock.yaml`).
- `mise exec -- pnpm --filter @composio/cli exec vitest run
test/src/services/project-environment-detector.test.ts`
- `mise exec -- pnpm exec prettier --check ...`
- `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg
NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also
`Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build
green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 /
bun 1.3.10 from mise.
- `docker manifest inspect node:24.16.0-slim`
- `docker manifest inspect node:25.9.0-slim`
- `bash -n ts/scripts/create-provider.sh && git diff --check`
- `ruby -e "require 'yaml';
YAML.load_file('.github/workflows/ts.test-e2e.yml')"`
- Tracked example validation in a clean temporary tree: `Validated 21
example packages.`
 2026-06-19 22:22:17 +04:00
Alberto Schiabel 08f7072110 fix(ci): make CLI releases reliably ship binary assets (#3515) 
## Summary

Permanently stops the recurring *"release published with zero assets →
install/upgrade 404s"* outage
(https://github.com/ComposioHQ/composio/issues/3408,
https://github.com/ComposioHQ/composio/issues/3269; regressions of
https://github.com/ComposioHQ/composio/issues/2625 and
https://github.com/ComposioHQ/composio/issues/1820 — 3 of the last 5
stable releases shipped empty).

**Root cause:** a concurrent-writer race. On a CLI version bump,
`changesets/action` creates an empty `@composio/cli@x.y.z` GitHub
Release in seconds, then the slower `build-cli-binaries.yml` fails its
`gh release create` because the release already exists — so binaries
never attach.

> 🥞 **Stacked on #3415** (`pi/exclude-cli-ts-release-42161920`), which
removes the *second writer* (changesets no longer creates CLI releases).
Review/merge #3415 first; this PR targets that branch. This PR hardens
the now-sole writer so a *partial* build can't publish either, and fixes
the monitoring that hid the failure.

## What changed (`build-cli-binaries.yml` + canary)

- **Draft → verify → publish.** The release is built as a **draft**,
then a gate asserts all 6 canonical assets are present **and** `state ==
"uploaded"` (loud `::error::` + fail otherwise), and only the final step
flips it to published. Drafts fire no `release: published` event and are
excluded from `/releases/latest`, so no install.sh / Homebrew / redirect
consumer can observe an incomplete release.
- **`fail-fast: false`** on the build matrix → a single platform failure
can never publish a partial set (`needs.build.result` is `success` only
if all legs pass).
- **Per-tag job-level `concurrency`** so re-runs / quick pushes can't
interleave uploads on the same tag, without serializing unrelated betas.
- **Beta-safe:** `--prerelease` is set on the draft so betas stay
prereleases through the publish flip.
- **`promote-stable` guard** uses `gh release view --json isDraft` (the
REST tags endpoint 404s on drafts) to resume an existing draft but
refuse an already-published tag.
- **Least privilege:** workflow defaults to `contents: read`; only the
release job opts up to `contents: write`.
- **Canary fix** (`cli.install-health-check.yml`): install the newest
stable **pinned** tag (`npm view @composio/cli version`) instead of the
asset-aware no-arg flow, which self-heals to the last good release and
kept the canary green through every outage.

## Idempotency note

Re-running a run that failed **before publish** is safe (reuse draft +
`--clobber`). An already-**published** tag is refused, not mutated — by
design.

## Testing

- Extended `test/release-workflow.test.ts` (run via `pnpm
test:release-workflow`) to lock in: draft→verify→publish ordering,
`fail-fast: false`, per-tag concurrency, preserved `--prerelease`, and
the pinned-tag canary. ✅ passes.
- `shellcheck` clean on the new `run:` scripts; YAML validated.
`actionlint` runs in CI.
- Runtime verification of the full green path happens on the next
release CI run.

## Out of scope (deferred to their own PRs)

Per reviewer consensus, these are real but *not this bug*: a per-release
npm↔GitHub asset auditor (needs a grace window), the Homebrew trigger
constraint (folds into #3355), `composio upgrade` missing-asset back-off
(https://github.com/ComposioHQ/composio/issues/3269), and a rollback
runbook.

---------

Co-authored-by: Rahul Tarak <cryogenicplanet@gmail.com>
 2026-06-16 15:07:23 +04:00
Alberto Schiabel 6606c0da92 fix(ts): upgrade vitest for GHSA-5xrq-8626-4rwp (#3569) 
This PR:

- closes #3502
- extracts the useful dependency and Cloudflare config slice from
https://github.com/ComposioHQ/composio/pull/3503 onto a clean `next`
branch
- upgrades `vitest` and `@vitest/ui` through the workspace catalog to
resolve the critical advisory
- switches the Mastra provider test dependency back to the catalog
- migrates the Cloudflare Worker Vitest configs to the
`cloudflareTest()` plugin API
- preserves existing `COMPOSIO_BASE_URL` bindings that were dropped in
#3503
- keeps Vitest 4 compatibility fixes scoped to constructor mocks, spy
cleanup, and temp-root project detection
- leaves Node, `mise`, release docs, and Effect catalog versions
unchanged; the commit includes @Dotify71 as `Co-authored-by`

Co-authored-by: Dushyant Acharya <dushyantacharya873@gmail.com>
 2026-06-15 19:38:51 +04:00
Alberto Schiabel 07160d14fa feat(toolchain): introduce mise.toml as single source of truth (#3492) 
## Summary

This PR starts Phase 1 of PLEN-1368 by adding `mise.toml` as the
repo-owned source for the primary toolchain versions:

- Node `20.20.2`
- Bun `1.3.10`
- Deno `2.6.7`
- Python `3.12`
- uv `0.8.19`

It also keeps pnpm corepack-driven through
`package.json#packageManager`, adds `devEngines` for Node/pnpm
visibility, documents the new `mise install && corepack enable && pnpm
install` bootstrap path, ignores `.mise.local.toml`, and fixes stale
release-doc prerequisites.

## Why

The repo already has real toolchain drift, not just duplicated version
strings. The internal release docs had stale Node/Bun/pnpm versions,
Deno is repeated across workflows, Dockerfiles, docs, and e2e helpers,
and Python local setup still has a separate `3.11` venv path while the
repo pins `3.12`.

A composite-action cleanup would improve CI, but it would not solve
local development. `mise.toml` gives us one file that declares the
versions and lets contributors install or switch them with one command.
That is the main value proposition here: make the repo declare its own
toolchain, then let CI consume the same declaration in the next phase.

## Rollout

This is deliberately additive. It does not remove `.nvmrc`,
`.bun-version`, `.python-version`, or `.dvmrc`, and it does not change
CI behavior yet. Contributors who do not use mise can keep working as
before; contributors who do use mise get managed Node/Bun/Deno/Python/uv
immediately.

Phase 2 can migrate the existing composite actions to
`jdx/mise-action@v4`. Phase 3 can remove the legacy version files and
add the lockfile once the transition is complete.

## Out of Scope

- Migrating CI to `jdx/mise-action@v4`
- Removing legacy version files
- Adding `mise.lock`
- Updating nested TS package/example `packageManager` fields that still
say `pnpm@10.28.0`; that is pre-existing metadata drift and should be
handled separately to avoid broadening Phase 1

## Verification

- `git diff --check origin/next...HEAD`
- `mise install && mise current`
- `pnpm --version` -> `10.28.2`
- `pnpm dlx prettier@3.8.1 --check package.json`

Refs: PLEN-1368
 2026-06-04 23:50:59 -07:00
Rahul Tarak 99324d5a0d fix(install): resolve latest CLI release from assets (#3411) 
## Summary
- Resolve the default CLI install version from GitHub Releases instead
of git tags.
- Require the selected CLI release to include the current platform
archive asset and fall back to older stable CLI releases when the newest
release is missing that asset.
- Add a mocked install.sh regression test covering missing release
assets, ignored beta/provider releases, and tag-only versions with no
release.

## Tests
- `bash -n install.sh test/install-sh-release-resolution.test.sh`
- `pnpm run test:install-sh`
- `git diff --check`
- Parsed `.github/workflows/cli.test-installation.yml` with Ruby YAML
- Parsed `package.json` with Node JSON.parse
- Manual real install smoke test with temporary
HOME/COMPOSIO_INSTALL_DIR selected `@composio/cli@0.2.28`

## Notes
- This prevents the install health check from selecting tag-only
versions like `@composio/cli@0.2.29` when no GitHub release/asset exists
yet.
 2026-05-12 13:36:41 -07:00
Alberto Schiabel 3e3a7ef72d chore(deps): bump pnpm 10.28.0 -> 10.28.2 (CVE-2026-24056) (#3311) 
# Description

Bumps the `packageManager` pin from `pnpm@10.28.0` to `pnpm@10.28.2`,
the smallest release that fixes
[**CVE-2026-24056**](https://nvd.nist.gov/vuln/detail/CVE-2026-24056) —
a symlink
attack in pnpm where installing a malicious `file:` (directory) or
`git:`
dependency that contains a symlink to an absolute path causes pnpm to
copy that target file's contents (e.g. `~/.ssh/id_rsa`, `/etc/passwd`)
into `node_modules`, enabling local data exfiltration on developer
machines and CI runners.

Practical risk for this repo is **LOW** — we only install
registry-pinned dependencies with `minimumReleaseAge: 4320` (72-hour
cooldown) configured in `pnpm-workspace.yaml`, so the attacker would
need a malicious package to (a) be added as a dependency, and (b) sit
unnoticed for 72h. The fix is nevertheless a one-line defensive bump
that aligns this repo with the rest of the monorepo:

| repo               | pnpm version | status |
|--------------------|-------------|--------|
| hermes             | `10.33.0`   | safe   |
| composio_dashboard | `10.28.2`   | safe   |
| frontend           | `10.28.2`   | safe   |
| **composio (this PR)** | `10.28.0` -> `10.28.2` | **fix** |
| metrics.composio.io | `10.18.2`  | flagged separately (no CI) |

Discovered during the daily Zen security audit cron.

# How did I test this PR

- Diff is a single character bump (`10.28.0` -> `10.28.2`) in
  `package.json` `packageManager`. No code, lockfile, or workflow
  changes — `pnpm install` will simply use the newer pnpm via Corepack.
- Verified `composio_dashboard` and `frontend` already pin
`pnpm@10.28.2`
  successfully across their CI workflows.
- No GHA file modified, so the pnpm-version reference in
  `ts/docs/internal/release.md` (per `CLAUDE.md` maintenance task) does
  not need to be updated by this PR.

---

Triggered by: dhawal@composio.dev | Source: cron-48e51eab745f
Session:
https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-16acec0fd729
Origin: cron-48e51eab745f /
[zen-cron-16acec0fd729](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-16acec0fd729)
 2026-05-07 14:38:37 +02:00
Rahul Tarak 79ac22053f feat(cli): add local tools foundation (#3340) 
## Summary
- Add experimental CLI local tools behind `local_tools` (beta-on,
stable-off unless `composio config experimental local_tools on`).
- Add reusable `@composio/cli-local-tools` package: declarations,
metadata, readiness, command/MCP/native/FFI runtimes, bundled-binary
resolution, and Tool Router search/execute/schema integration.
- Add first-class local toolkits for:
- `BEEPER_IMESSAGE` backed by `imessage-cli` from the ComposioHQ
`platform-imessage` fork.
- `CHROME_DEVTOOLS` backed by the official `chrome-devtools-mcp@0.24.0`
npm/npx package.
  - `PEEKABOO` backed by upstream Peekaboo CLI.
- Remove generated native executables from git: Beeper and Peekaboo
binaries are now ignored, pinned via git submodules, and generated
during CLI binary release jobs.
- Update CLI binary workflow so Linux artifacts skip native sidecars,
while macOS artifacts run on macOS runners and build only the matching
`darwin-x64` or `darwin-arm64` Beeper/Peekaboo sidecars before
packaging.

## Native binary policy
- No generated `imessage-cli` or `peekaboo` binary blobs are committed
in this PR history.
- Beeper source is pinned as
`ts/packages/cli-local-tools/vendor/platform-imessage` at
`364445a1b3089ad9fe293d5951efe160c5677c42` from
`https://github.com/ComposioHQ/platform-imessage`.
- Peekaboo source is pinned as
`ts/packages/cli-local-tools/vendor/peekaboo` at
`31e66e8d02656141d18f60bf3b46b24c2b9bc785` from
`https://github.com/steipete/Peekaboo`.
- Build commands:
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-x64`
- Chrome DevTools is an npm/npx integration and is pinned as a dev
dependency (`chrome-devtools-mcp@0.24.0`) instead of using native
sidecars.

## Validation
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `COMPOSIO_REAL_LOCAL_TOOLS_TESTS=1 pnpm --filter
@composio/cli-local-tools test -- src/toolkits/beeper-imessage.test.ts
src/toolkits/peekaboo.test.ts`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build`
- `COMPOSIO_CACHE_DIR=<tmp-config-with-local_tools-enabled> bun
ts/packages/cli/dist/bin.mjs local-tools doctor --json`
- `pnpm turbo build`
- Verified rewritten branch has no >1MB objects relative to
`origin/next` and no native executable paths in the PR diff.

## Notes / risks
- Beeper iMessage and Peekaboo are macOS-only and depend on local
permissions.
- Peekaboo requires macOS 15+; GUI tools require Screen Recording,
Accessibility, and sometimes Automation.
- Beeper send/reaction behavior can still depend on upstream Messages
automation reliability.
- Chrome DevTools can inspect/modify browser contents; avoid sensitive
browser sessions.
 2026-05-05 00:10:38 -07:00
Zen Agent f9c1da1e14 chore(deps): bump pnpm 10.28.0 -> 10.28.2 (CVE-2026-24056) 
Bumps the `packageManager` pin from `pnpm@10.28.0` to `pnpm@10.28.2`,
which is the smallest release that fixes CVE-2026-24056 — a symlink
attack in pnpm where installing a malicious `file:` or `git:` dependency
that contains a symlink to an absolute path causes pnpm to copy the
target file's contents (e.g. `~/.ssh/id_rsa`, `/etc/passwd`) into
`node_modules`, enabling local data exfiltration on dev machines and CI
runners.

Practical risk for this repo is LOW (we only install registry-pinned
deps with `minimumReleaseAge: 4320`), but the fix is a one-line
defensive bump — keeps the SDK CI runners in line with the rest of the
monorepo (hermes already on 10.33.0; composio_dashboard / frontend
already on 10.28.2).

Origin: cron-48e51eab745f / [zen-cron-16acec0fd729](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-16acec0fd729)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-04-28 23:40:13 +00:00
Rahul Tarak a8071e0d35 Add channel-aware Composio CLI skill builds (#3127) 
## Summary
- Add a generated `composio-cli` skill source that can render stable and
beta variants from a single channel-aware definition.
- Introduce build and validation scripts to generate the skill output
and verify channel-specific content, references, and reproducibility.
- Update the CLI packaging workflow to validate skills and package the
correct release-channel build for beta vs stable releases.
- Expand the skill content with clearer top-level CLI guidance,
troubleshooting, developer-project workflows, and beta-only power-user
examples.
- Tighten CLI install/upgrade behavior and add tests covering skill
installation behavior.
- Add example validation to the repo test flow and align example package
metadata with workspace expectations.

## Testing
- Not run locally.
- Added `ts/packages/cli/scripts/validate-skills.ts` checks for
stable/beta markers, channel-specific content, and required reference
files.
- Added `ts/packages/cli/test/src/effects/install-skill.test.ts`
coverage for skill installation behavior.
- Added `ts/scripts/validate-examples.ts` to validate example package
manifests during `pnpm test`.
- CI workflow now runs `pnpm run validate:skills` before packaging CLI
skill files.
 2026-04-07 01:02:45 -07:00
Rahul Tarak efcb8c2436 Add tsgo-backed typecheck targets across packages (#3130) 
## Summary
- Add `tsgo`-based `typecheck` scripts and matching `typecheck:tsc`
fallback scripts across the TypeScript packages.
- Wire the new `typecheck:tsc` task into Turbo so package-level
typecheck checks can run consistently.
- Update workspace and lockfile metadata to include
`@typescript/native-preview` and the new toolchain wiring.
- Remove redundant `baseUrl` settings from package tsconfig files where
they are no longer needed.

## Testing
- Not run (changes are limited to package scripts, tsconfig wiring, and
lockfile updates).
- Not run: `pnpm typecheck:tsc`
- Not run: `pnpm build`
- Not run: package-specific `typecheck` / `typecheck:tsc` commands in
`ts/packages/cli`, `ts/packages/core`, `ts/packages/json-schema-to-zod`,
and `ts/packages/providers/mastra`.
 2026-04-07 00:43:52 -07:00
jkomyno 5b8e7abdf3 feat(cli): add checksums, cross-compilation, and simplified install 
- Add cross-compilation scripts (build-binary-cross.ts, build-all-binaries.ts)
  using Bun's --target flag, enabling all platforms to build from ubuntu-latest
- Add package-binaries.ts and generate-checksums.ts for release artifact preparation
- Restructure CI workflow into build + release jobs; release job aggregates
  artifacts and generates checksums.txt
- Simplify install.sh: use git ls-remote refspec filter for version detection,
  add SHA-256 checksum verification with graceful fallback, use mktemp/trap
  for temp file cleanup, remove dead musl detection code
- Add checksum verification to composio upgrade command via fetchChecksums
  and verifyChecksum helpers in upgrade-binary.ts
 2026-02-27 18:19:30 +04:00
jkomyno 83043403b7 chore: bump Turborepo 2026-02-26 21:22:46 +04:00
Musthaq Ahamad 4fda636aba chore(cli): migrate binary release tags and docs (#2719) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-02-25 16:29:04 -08:00
jkomyno 4d51efc8e8 chore(cli): rename build:bin to build:binary 2026-02-23 13:11:52 +04:00
jkomyno 63119535fb chore: address cursorbot 2026-02-19 02:14:16 +04:00
jkomyno 5519752ba4 feat(ts/e2e): add CLI runtime support and composio version e2e test 
Extend the e2e test infrastructure to support CLI runtime tests alongside
Node.js and Deno. Add a Dockerfile.cli that builds the composio binary
and runs it in a scratch Debian container. Include the first CLI e2e test
for `composio version` with file capture support.
 2026-02-18 15:20:23 +04:00
jkomyno 63aa197d0f feat(ts/e2e): add e2e tests for Deno 2026-02-01 12:21:20 +04:00
Sushmithamallesh 5cda128e57 chore(docs): deprecate fern documentation system 
- Add deprecation notices to fern/README.md and fern/CLAUDE.md
- Disable fern CI/CD workflows (publish_docs.yml, preview_docs.yml)
- Remove fern from pnpm workspaces

The new documentation is now in /docs built with Fumadocs.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-28 11:49:55 -08:00
jkomyno 6aa99bc80f feat(ts/e2e): use bun:test for "pnpm test:e2e:node"; optimize Dockerfile.node 2026-01-26 23:28:01 +04:00
Alberto Schiabel d80cd28f46 feat(ci): QoL improvements (#2404) 
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
 2026-01-20 11:25:12 +05:30
Alberto Schiabel ded64beb75 feat(ts): support Cloudflare Workers + refactor build pipeline with tsdown + introduce e2e tests (#2360) 
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
 2026-01-13 13:02:58 +05:30
Alberto Schiabel 37a89abe57 feat(ts): upgrade Vercel provider to support AI v6 (#2314) 
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
 2026-01-12 18:24:28 +05:30
Alberto Schiabel 9a4465d87b feat(core): add Anthropic Claude Code Agents provider (#2285) 
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
 2025-12-23 11:18:29 +05:30