mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
@composio/openai@0.10.1
285 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Kshitij Jhunjhunwala
|
d583e7ef6f | fix(cli): harden plugin setup installation | ||
|
dependabot[bot]
|
09aab1d19f |
chore(deps-dev): bump the npm-development group across 1 directory with 3 updates (#3795)
Bumps the npm-development group with 3 updates in the / directory: [turbo](https://github.com/vercel/turborepo), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [typedoc](https://github.com/TypeStrong/TypeDoc). Updates `turbo` from 2.10.2 to 2.10.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.10.4</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.10.3 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13222">vercel/turborepo#13222</a></li> <li>ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13240">vercel/turborepo#13240</a></li> <li>perf: Use mimalloc as the global allocator by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13237">vercel/turborepo#13237</a></li> <li>perf: Parse yarn v1 lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13241">vercel/turborepo#13241</a></li> <li>ci: Fix cache outputs for Eve app by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13243">vercel/turborepo#13243</a></li> <li>perf: Stop materializing spans for the disabled daemon log layer by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13244">vercel/turborepo#13244</a></li> <li>fix: Keep ancestor-scoped bun dependencies resolvable after prune renames by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13236">vercel/turborepo#13236</a></li> <li>perf: Overlap external dependency hashing with package file hashing by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13234">vercel/turborepo#13234</a></li> <li>perf: Build tracked repo index concurrently with package graph by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13232">vercel/turborepo#13232</a></li> <li>perf: Release tokio runtime at exit so background DNS lookups never stall the user by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13231">vercel/turborepo#13231</a></li> <li>perf: Overhaul pnpm lockfile parsing and dependency closure computation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13228">vercel/turborepo#13228</a></li> <li>feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13227">vercel/turborepo#13227</a></li> <li>feat: Introduce toolchain provider abstraction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13235">vercel/turborepo#13235</a></li> <li>perf: Parse Berry lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13242">vercel/turborepo#13242</a></li> <li>fix: Apply input exclusion globs to the filesystem walk by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13224">vercel/turborepo#13224</a></li> <li>fix: Stop root-directory packages from claiming every file in change mapping by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13225">vercel/turborepo#13225</a></li> <li>chore: Rename turborepo-repository napi package to <code>@turbo/repository</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13226">vercel/turborepo#13226</a></li> <li>perf: Hash git blobs with hardware-accelerated SHA-1 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13245">vercel/turborepo#13245</a></li> <li>release(turborepo): 2.10.4-canary.1 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13247">vercel/turborepo#13247</a></li> <li>feat: Discover Cargo crates as packages by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13248">vercel/turborepo#13248</a></li> <li>perf: Reuse per-package external dependency hashes in run summaries by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13249">vercel/turborepo#13249</a></li> <li>perf: Stat workspace turbo.json files concurrently during discovery by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13251">vercel/turborepo#13251</a></li> <li>chore: Add tracing spans to workspace discovery and globwalk phases by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13252">vercel/turborepo#13252</a></li> <li>fix: Avoid non-reentrant libc calls in concurrent shutdown process scans by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13256">vercel/turborepo#13256</a></li> <li>perf: Memoize resolved task definitions during engine construction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13257">vercel/turborepo#13257</a></li> <li>perf: Compute transitive closures and external dependency hashes concurrently with run setup by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13250">vercel/turborepo#13250</a></li> <li>perf: Probe microfrontends configs in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13262">vercel/turborepo#13262</a></li> <li>feat: Execute Cargo crate tasks via cargo by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13261">vercel/turborepo#13261</a></li> <li>perf: Pre-size engine task collections by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13265">vercel/turborepo#13265</a></li> <li>feat: Expose resolved experimentalCI task configuration in <code>turbo query</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13264">vercel/turborepo#13264</a></li> <li>feat: Derive input and output globs for Cargo tasks by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13263">vercel/turborepo#13263</a></li> <li>perf: Parse large pnpm lockfile sections in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13266">vercel/turborepo#13266</a></li> <li>feat: Hash Cargo external dependencies per-crate by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13267">vercel/turborepo#13267</a></li> <li>ci: Install pnpm 10 in musl containers for Library Release by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13269">vercel/turborepo#13269</a></li> <li>ci: Force pnpm overwrite in Library Release musl containers by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13270">vercel/turborepo#13270</a></li> <li>perf: Defer the untracked-scan barrier to first file-hash use by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13268">vercel/turborepo#13268</a></li> <li>ci: Fetch API-created commit before updating local ref by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13271">vercel/turborepo#13271</a></li> <li>release(library): 0.0.1-canary.22 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13272">vercel/turborepo#13272</a></li> <li>perf: Remove lock and dispatch overhead from task hash precomputation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13273">vercel/turborepo#13273</a></li> <li>fix: Fall back to lockfile detection in <code>@turbo/repository</code> when package manager is undeclared by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13275">vercel/turborepo#13275</a></li> <li>test: Add end-to-end coverage for Cargo workspaces by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13274">vercel/turborepo#13274</a></li> <li>release(library): 0.0.1-canary.23 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13276">vercel/turborepo#13276</a></li> <li>release(turborepo): 2.10.4-canary.2 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13278">vercel/turborepo#13278</a></li> <li>fix: Collapse nested package-manager fallback conditional by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13279">vercel/turborepo#13279</a></li> <li>feat: Make turbo watch Cargo-aware by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13280">vercel/turborepo#13280</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/1506a114e377dd7e1e8e7a7863c42adf94a9f776"><code>1506a11</code></a> publish 2.10.4 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/11a68c705274cc7a408776b576ce7a9e14d6e6df"><code>11a68c7</code></a> fix: Stop flagging relative imports that resolve into node_modules in boundar...</li> <li><a href="https://github.com/vercel/turborepo/commit/947b4784cd1b254e62b663bbdb22891a849b7442"><code>947b478</code></a> fix: Raise the open-file soft limit at startup (<a href="https://redirect.github.com/vercel/turborepo/issues/13282">#13282</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ddc584d788349fc3668e280286f540feee4eb6b9"><code>ddc584d</code></a> feat: Make turbo prune Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13281">#13281</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ff0d50822314c5b388d9b4daa9c6159387752d95"><code>ff0d508</code></a> perf: Skip dependency-closure assembly for toolchains that derive nothing (<a href="https://redirect.github.com/vercel/turborepo/issues/1">#1</a>...</li> <li><a href="https://github.com/vercel/turborepo/commit/39d623e1323ef50e06be0a103082ae29cc545779"><code>39d623e</code></a> feat: Make turbo watch Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13280">#13280</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/af01fdfeb5efe07a7b6843a0b8f5033b59ebbb2c"><code>af01fdf</code></a> fix: Collapse nested package-manager fallback conditional (<a href="https://redirect.github.com/vercel/turborepo/issues/13279">#13279</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/7e02f94f647cb4d527a438313dc4adbe3e8c0df3"><code>7e02f94</code></a> release(turborepo): 2.10.4-canary.2 (<a href="https://redirect.github.com/vercel/turborepo/issues/13278">#13278</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/8e3a59fdb6c71ad24fbbb363db52f88eb9a89116"><code>8e3a59f</code></a> release(library): 0.0.1-canary.23 (<a href="https://redirect.github.com/vercel/turborepo/issues/13276">#13276</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ce18f0a79eb49e9a22c7e6cfa491777c24ed746a"><code>ce18f0a</code></a> test: Add end-to-end coverage for Cargo workspaces (<a href="https://redirect.github.com/vercel/turborepo/issues/13274">#13274</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.10.2...v2.10.4">compare view</a></li> </ul> </details> <br /> Updates `typescript-eslint` from 8.62.1 to 8.63.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's releases</a>.</em></p> <blockquote> <h2>v8.63.0</h2> <h2>8.63.0 (2026-07-06)</h2> <h3>🚀 Features</h3> <ul> <li><strong>eslint-plugin:</strong> [no-misused-promises] detect async usage of a sync dispose usage (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12426">#12426</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12447">#12447</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12446">#12446</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12491">#12491</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12485">#12485</a>)</li> <li><strong>eslint-plugin:</strong> [no-base-to-string] don't flag a shadowed String() call (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12492">#12492</a>)</li> <li><strong>scope-manager:</strong> export ClassStaticBlockScope (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12460">#12460</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Evyatar Daud <a href="https://github.com/StyleShit"><code>@StyleShit</code></a></li> <li>Kristjan <a href="https://github.com/KristjanTammekivi"><code>@KristjanTammekivi</code></a></li> <li>Michael Naumov <a href="https://github.com/mnaoumov"><code>@mnaoumov</code></a></li> <li>Serhii Leniv <a href="https://github.com/Serhii-Leniv"><code>@Serhii-Leniv</code></a></li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's changelog</a>.</em></p> <blockquote> <h2>8.63.0 (2026-07-06)</h2> <p>This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374"><code>290cf6c</code></a> chore(release): publish 8.63.0</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint">compare view</a></li> </ul> </details> <br /> Updates `typedoc` from 0.28.19 to 0.28.20 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/TypeDoc/releases">typedoc's releases</a>.</em></p> <blockquote> <h2>v0.28.20</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md">typedoc's changelog</a>.</em></p> <blockquote> <h2>v0.28.20 (2026-07-05)</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/TypeStrong/typedoc/commit/34d843be0953fc81de0fde14bea8db72d0bbccc6"><code>34d843b</code></a> Update changelog for release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/fbd4a254952c171b9ba7ebbe96c5151e844743be"><code>fbd4a25</code></a> Bump version to 0.28.20</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/93ba157000e4a632bfbf32a0b6f00f8ae57c7c99"><code>93ba157</code></a> Update dependencies in example</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/e8c5df8844edca9800dfc62cee9115ef0fba59ea"><code>e8c5df8</code></a> Remove unnecessary files from distribution</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/392b0dd50a428ea0c732c38c6c263e74cb6200b1"><code>392b0dd</code></a> Update dependencies</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/8510dd48c7778f419f4605146f1a733af27993fa"><code>8510dd4</code></a> Add missing entries in changelog before release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/51dc0521890924269f06e08972c6453299f63cb5"><code>51dc052</code></a> Update change log for 0.28.20 release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/72f20cd87b4ef30aae97b68fcbb42ca19cebdc22"><code>72f20cd</code></a> Merge branch 'fix-locale-sort-group-category-titles' into dev</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/623f2c0bd35b5e89cc79fb5783dac01c6f2530e9"><code>623f2c0</code></a> Fix failing test, accept slightly slower build for now</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/c8bdf14cab0c22dd415b6872cc647c6cf81f917c"><code>c8bdf14</code></a> Minor config tweak to improve dev build time</li> <li>Additional commits viewable in <a href="https://github.com/TypeStrong/TypeDoc/compare/v0.28.19...v0.28.20">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4baacbeb77 |
chore(deps): bump the npm-production group across 1 directory with 7 updates (#3799)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
b07fcada3f |
feat(experimental): add Eve provider and iMessage example (#3800)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3642 and credits @shamsharoon for the original Eve provider and iMessage work - rebases the integration onto the current `next` branch and resolves its lockfile conflicts - publishes an isolated `@composio/experimental/eve` entry with the correct Eve 0.12+ peer contract - adds recoverable per-session discovery, native Eve context propagation, and durable approval policies for direct and batched side effects - centralizes circular-safe auth-link extraction across Eve and Pi and replaces dense conditional expressions with named control flow - hardens the iMessage example against `osascript` option injection, unsafe trigger scoping, and third-party prompt injection - preserves completed local-tool results when a mixed local/remote batch loses its remote transport - consolidates the example documentation onto shared components, documents direct model-provider credentials, and clarifies that the browsable source is not yet a standalone fixture - verifies the change with 999 core tests, 32 experimental tests, package builds/typechecks, packed peer-isolation smokes, and a production docs build --------- Co-authored-by: shams haroon <144290365+shamsharoon@users.noreply.github.com> Co-authored-by: shams haroon <shamsharoon7@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: shams haroon <shams@composio.dev> |
||
|
Alberto Schiabel
|
30ba4d2930 |
feat(openai): add executable provider example (#3798)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3790 - makes the OpenAI example executable in direct-tools, Tool Router, smoke, and Cloudflare Workers modes - keeps direct and Tool Router agents in separate files so each execution model is explicit and readable - requires a successful Composio tool execution before either agent can accept a final model response - adds OpenAI to the nightly staging matrix without weakening the existing Mastra coverage - updates two stale experimental OpenAI usages so the complete example package typechecks against current SDK APIs ## Testing - `pnpm --filter openai-example run typecheck` - `pnpm --filter openai-example run lint` (0 errors; 4 pre-existing warnings) - `pnpm --filter openai-example run smoke` (staging: 5 direct tools and 6 Tool Router tools) - `pnpm --filter openai-example run cf:dry-run` - `pnpm run typecheck` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` - `pnpm run typecheck:examples` - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - [branch nightly](https://github.com/ComposioHQ/composio/actions/runs/29079263571): OpenAI and Mastra both passed smoke, direct-tools, and Tool Router against staging ## Post-deploy validation - dispatch `ts.examples-nightly.yml` on `next` after merge and confirm both matrix legs stay green - healthy runs finish within the 20-minute job budget and log successful tool-backed responses for both agent modes - revert this PR if the OpenAI leg blocks the nightly; examples maintainers own the first post-merge run and the next 06:00 UTC schedule --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
76881491d0 |
feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788)
## What Turns the **Mastra** example into an executable reference that doubles as a test, and wires the examples into CI for the first time. First slice of the v1 "executable examples" workstream — the pattern here is the template for the other TS providers, then Python. ## Why Examples under `ts/examples/*` were unverified: the only CI tie-in is `validate-examples.ts`, which is transpile-only (no cross-file types, no lint, no execution) and passes on exactly the schema-conversion regressions we keep hitting in the Mastra provider — all closed but unprotected: - https://github.com/ComposioHQ/composio/issues/2109 (zod→json serialization crash) - https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped while `$ref` kept) - https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema tools crash serialization) ## Changes **Canonical Mastra example** (`ts/examples/mastra`) - `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS` toolkit - `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` → `session.tools()` (drops the deprecated bare `composio.create` alias) - `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers runtime (`export default { fetch }`) - `src/smoke.ts` — deterministic wrapping + tool-router assertions (needs only `COMPOSIO_API_KEY`) - Removed the old Gmail/MCP entries that used deprecated APIs and required auth - Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts` **Real typecheck + lint** (examples previously escaped both) - Example now has a `typecheck` script (Node + Worker tsconfigs); `typecheck:examples` / `lint:examples` scripts added - eslint now covers `ts/examples/**` with type-safety rules kept (`no-explicit-any`) and console noise allowed **Two-tier CI** - `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck → lint → `wrangler deploy --dry-run`. This is the tier that catches the schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces as a **type** error. - `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes against the **staging** backend with secrets; runs the deterministic smoke always and the full agent examples when an LLM key is set. ## Verification Locally against staging: `smoke` passes (5 direct + 6 tool-router tools), `typecheck:examples` and `lint:examples` are green, the Worker `wrangler deploy --dry-run` bundles, and seeded regressions (a type error / an `any`) correctly fail their gate. ## Notes - No changeset — example packages are private/unpublished. - Follow-ups (separate PRs): template the pattern to the other TS providers, then port to `python/examples/*`. |
||
|
Alberto Schiabel
|
72eac88133 |
fix(cli): replace abandoned decompress dependency (GHSA-mp2f-45pm-3cg9) (#3767)
This PR: - replaces `decompress` (unmaintained; the zip-slip fix in the GHSA advisory was never published to npm past 4.2.1) with `extract-zip` across the CLI's four zip-extraction call sites: `install-skill.ts`, `run-companion-modules.ts`, `upgrade-binary.ts`, and `cli-local-tools/bundled-binaries.ts` - `extract-zip` validates each entry resolves inside the target directory before writing, closing the path-traversal issue `pnpm audit` flags as critical - replaces the one `.tgz`-extracting call site (`scripts/_acp-adapters.ts`, used to vendor ACP adapter binaries at build time) with `tar`, since `extract-zip` only handles zip archives - removes `@types/decompress`; both `extract-zip` and `tar` ship their own type definitions - `pnpm audit --prod --audit-level=high` now passes (previously failing on `next`, unrelated to #3766) Verified `extract-zip` and `tar` extract nested directories correctly with a local smoke test (real `.zip`/`.tgz` archives), in addition to the existing `@composio/cli` (724 tests) and `@composio/cli-local-tools` (13 tests) suites passing. |
||
|
Alberto Schiabel
|
58bc93b2d9 |
chore(deps): consolidate dependency updates (#3760)
This PR: - consolidates https://github.com/ComposioHQ/composio/pull/3733, https://github.com/ComposioHQ/composio/pull/3735 through https://github.com/ComposioHQ/composio/pull/3744, and https://github.com/ComposioHQ/composio/pull/3752 - refreshes the pnpm workspace dependencies under the existing `minimumReleaseAge` supply-chain gate - keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare workers types 4 where latest majors conflict with the current workspace - keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the workspace catalog to zod 4 - bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock` - updates the SHA-pinned Claude and Codex workflow actions from the Dependabot action group - adds a patch changeset for the versioned package manifests touched by dependency updates - verifies the rollup with frozen pnpm/uv locks, peer checks, audit threshold checks, typecheck, lint, builds, TypeScript tests, and Python `nox -s chk` ## Context `pnpm audit --prod --audit-level=moderate` passes. The remaining production audit item is a low `@ai-sdk/provider-utils` advisory through Mastra transitive dependencies; forcing it higher would require leaving the compatible stable Mastra dependency path. |
||
|
Alberto Schiabel
|
49e4c11427 |
chore(deps): resolve high prod audit advisories via in-range bumps (#3751)
This PR: - refreshes lockfile resolutions for the 17 high `pnpm audit --prod` advisories via `pnpm update -r` — real version bumps within the ranges parents already declare (minimatch 5/9, lodash, fast-uri, picomatch, langsmith, `@hono/node-server`, express-rate-limit, ws), not resolution overrides - bumps the pre-existing #3467 security pin `protobufjs: 7.5.9 -> 7.6.1` in `pnpm-workspace.yaml` (7.5.9 itself is vulnerable to GHSA unbounded-Any DoS) - adds ONE temporary scoped override, `minimatch@>=10.0.0 <10.2.3 -> >=10.2.3`: `@zed-industries/claude-code-acp@0.16.2` (latest) exact-pins vulnerable `minimatch 10.2.1` and no fixed release exists; commented in the file, drop when upstream ships - no `package.json` changes anywhere: none of the vulnerable packages is a direct dependency of any workspace package, so there is nothing to major-bump on our side ## Context Split out of #3748 (CI hardening) so dependency changes land in isolation. **Merge this before #3748** — its new `pnpm audit --prod --audit-level=high` hard gate needs this green baseline, per the plan's "gate lands together with the dependency fix" rule. Verified: `pnpm audit --prod --audit-level=high` exits 0 (remaining: 1 low, 6 moderate); `pnpm install --frozen-lockfile` passes. Dev-path high advisories (vite, undici, flatted, linkify-it, minimatch 3.x) are out of scope — the gate is `--prod`; tracked as backlog. |
||
|
Alberto Schiabel
|
8d5823be87 |
chore(ci): cache turbo, bun, and uv and cancel superseded pr runs (#3747)
This PR: - adds `concurrency` to the ten PR/push CI workflows: superseded **PR** runs are cancelled, while push runs use a per-run group (`github.run_id`) so every commit on `next`/`master` still gets its own run - caches turbo outputs (`.turbo/cache`) via a new opt-in `enable-turbo-cache` input on the `setup-node-pnpm-bun` composite (keyed per job — concurrent jobs save different task graphs), enabled in `ts.build`, `ts.test`, `ts.typecheck`, and all four `ts.test-e2e` jobs - enables turbo caching for `typecheck`, removes the incorrect `dist/` outputs from `test`, hashes root `tsconfig.base.json` in `build`/`typecheck` inputs, and adds `mise.toml`/`mise.lock` to `globalDependencies` so toolchain bumps bust every task hash (addresses the Bugbot finding) - fixes `@composio/slim`'s build to participate in the turbo graph: core moves to slim's `devDependencies` (published `dependencies` unchanged) and the script no longer shells out to `pnpm --filter @composio/core build`, which raced concurrent dependents by wiping `core/dist` mid-build and double-built core on every cold run — slim's `dist` remains byte-identical to core's; no changeset added since the published artifact is unchanged (say the word if policy wants one anyway) - fixes the `py.test` matrix cache to `~/.cache/uv` (it cached `~/.cache/pip` while installing via `uv pip`) and caches `~/.bun/install/cache` in the five docs workflows - adds `turbo.jsonc` to the TS workflows' path filters (previously unwatched) - release/publish workflows are deliberately untouched Measured (same commit, cold first attempt vs `gh run rerun` warm): ts.build 103s → 53s, ts.test 157s → 55s (`turbo test` 24/24 cached in 182ms), ts.typecheck 80s → 43s; py.test legs save a few seconds each (uv was already fast). Warm floor is checkout + mise + pnpm-install overhead. ## Context Implements `plans/001-ci-speed-caching-and-concurrency.md` from the advisor audit on `docs/sdk-v1-decision-records`. Implementation by codex against the plan, then self-reviewed and counter-reviewed; warm-rerun testing surfaced and fixed three latent issues (toolchain files absent from turbo's hash, first-writer-wins cache-key collision across jobs, and the slim out-of-band core rebuild race). |
||
|
Alberto Schiabel
|
03cb181fdb |
chore(deps): roll up dependency bumps (#3711)
This PR: - rolls up https://github.com/ComposioHQ/composio/pull/3695, https://github.com/ComposioHQ/composio/pull/3696, https://github.com/ComposioHQ/composio/pull/3697, and https://github.com/ComposioHQ/composio/pull/3698 into one dependency-bump branch - updates Python dependency metadata for `langchain-openai`, `pyautogen`, and `crewai` - updates npm production dependency metadata for `zod-to-json-schema`, `openai`, and `@modelcontextprotocol/sdk` - refreshes `uv.lock` and `pnpm-lock.yaml` with the repo-pinned package managers - leaves Changesets unchanged because the touched TS package manifests are private/ignored and no published TS SDK package metadata changes - verified with `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, focused TS builds/tests, clean-worktree `pnpm test:examples`, Python import tests, and Python nox checks - note: local `pnpm build:packages` hit a pre-existing broad-build race around `@composio/slim` rebuilding `@composio/core`; focused dependent builds pass --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
cddd66c3ce |
chore(ts): bump Hono, Mastra, and Chrome deps (#3691)
This PR: - bumps `hono`, `@mastra/core`, and `chrome-devtools-mcp` to their current latest published versions - routes the remaining Cloudflare Tool Router Hono consumer through the workspace catalog - updates the `@composio/mastra` `@mastra/core` peer range and adds a patch changeset - fixes `check-peer-deps` to resolve `semver` through the normal package dependency |
||
|
Alberto Schiabel
|
9ffc696a99 |
feat(vercel): support AI SDK v7 (#3683)
This PR:
- widens the `ai` peer dependency of `@composio/vercel` to `^6.0.0 ||
^7.0.0`, adding AI SDK v7 support and dropping the previously-untested
v5 arm
- adds Docker-based Node e2e compatibility suites for AI SDK v6 and v7
under `ts/e2e-tests/runtimes/node/vercel-ai-sdk-v{6,7}`, auto-discovered
by the existing e2e matrix (so PR CI exercises them)
- each installs the packed `@composio/vercel` tarball, typechecks the
provider against the target `ai` major, and asserts runtime tool
wrapping/execution (object inputs, JSON-string normalization via
`normalizeToolArguments`, `ToolSet` shape)
- the v7 suite additionally exercises v7's `ToolExecutionOptions` passed
to `tool.execute`
- ships a `minor` changeset (the peer-range narrowing removes a
previously-supported major)
- breaking:
- `ai@5` is no longer an accepted peer of `@composio/vercel`; v5
consumers should stay on the prior minor
|
||
|
Rahul Tarak
|
d17a268d3f |
docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637)
Integration branch for the next docs release: a **sessions-first
documentation rewrite** — new and rewritten guides, example pages,
interactive components, and docs tooling — plus the supporting SDK
changes that the new docs describe.
The bulk of this PR is docs (~24k lines across ~150 commits); the SDK
changes (~5k lines) back the new guides.
## Documentation (the bulk)
- **Sessions-first restructure** — reorganized navigation and section
structure (incl. the "Sandbox (prev workbench)" section), with
v3-reorganization redirects so old URLs keep resolving.
- **Rewritten core guides** — quickstart, configuring sessions, triggers
(creating + subscribing to events), proxy-execute, toolkits
enable/disable, and common FAQ, rewritten in the house voice.
- **New example pages** — local-sandbox PR reviewer, daily standup bot,
and slack bot, with runnable build-ups.
- **New interactive components & diagrams** — triggers flow animation,
manage-connections visual, connection-refresh visual, and the
terminal-kit components.
- **Docs tooling** — a docs-graph link-graph connectivity checker,
search reprioritization (deprioritize legacy pages), and SDK-reference
regeneration.
## Supporting SDK changes
**`@composio/core` → 0.13.0 (minor)**
- `composio.sessions.create()` as the first-class sessions API
(`composio.create()` kept as an alias).
- **MCP is opt-in:** default `create()` / `use()` return native-tool
sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface
`session.mcp`. _Migration: read `session.mcp` only after creating with
`{ mcp: true }`._
- `session.sandbox` is the canonical resolved config;
`session.workbench` kept as a deprecated alias. `sandbox` is the
preferred session-config key (`workbench` still accepted).
- `connectedAccounts.updateAcl()` graduated from experimental (alias
kept).
- `triggers.parse()` (parse + optionally verify an incoming webhook) and
`triggers.setWebhookSubscription()`.
**`@composio/experimental` → minor** — local-workbench helpers moved
onto the `@composio/experimental/workbench` subpath (out of
`@composio/core/experimental`), keeping the ~14 KB embedded Python
helper out of core. Plus the experimental Pi provider.
**`@composio/slim` → minor.**
**Python → 0.17.0** — mirrors the TS surface: `composio.sessions` mount
(`tool_router` deprecated), `triggers.parse()` /
`set_webhook_subscription()`, the `sandbox` config key, and
`connected_accounts.update_acl()`.
## Review response (#3664)
Addressed the `@composio/core` review:
- **Security:** `triggers.parse()` no longer fails open — a
present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`)
now throws instead of silently skipping verification; omitting it stays
an explicit opt-out (both SDKs).
- Removed snake_case leakage from `transformWebhookSubscription` (+ the
index signature that allowed it).
- **Removed** the TS-only `connectedAccounts.link()` toolkit
auto-resolve (shipped with cancellability / orphaned-auth-config bugs
and was effectively undocumented; to be reintroduced properly later).
- Unified Python error types on `ValidationError`; added `mcp=True`
Python tests; fixed runtime-portability + error-type test assertions.
- Polished deprecation messages; fixed the backwards `/experimental`
`@deprecated` note and the `SessionWithMcp` JSDoc.
## Testing
- **TS:** `@composio/core` + `@composio/experimental` typecheck pass;
vitest green for the touched suites.
- **Python:** `test_tool_router.py` + `test_triggers.py` pass (161
tests).
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev>
Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Sarah Simionescu <sarah@composio.dev>
Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>
|
||
|
Alberto Schiabel
|
f8cd90ce5a |
chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646)
This PR: - uses plain `tsdown` package scripts and a shared typed `tsdown.config.base.ts` so Node 24 builds work without loader flags - switches the repo dev/build toolchain to Node `24.17.0` and pnpm `11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml` - marks the root package as ESM with `type: module`, matching the TypeScript packages - keeps Node `22.22.3` in the runtime/E2E matrices as the minimum supported user runtime - changes the TypeScript build workflow back to a single build on the mise-managed toolchain and broadens path filters for package-manager/build config files - adds pnpm 11 build-script policy with `allowBuilds` and intentionally ignored `sharp` builds - enables tsdown ESM shims for the packaged CLI wrapper so `composio --help` runs under Node 22 and Node 24 Verified locally: - `CI=true pnpm install --frozen-lockfile` - `pnpm lint` - `pnpm run build:packages` - `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter @e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run test:e2e:node` - `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3` and `24.17.0` |
||
|
Alberto Schiabel
|
23f9053804 |
chore(ts): clean up dependencies and bump toolchain (#3623)
This PR: - consolidates and bumps TypeScript/npm dependencies across the monorepo, docs, examples, and e2e fixtures — no runtime behavior changes - **cleanup:** remove the unused `ansis` dependency from `@composio/cli` (`picocolors` is the actual color lib), drop the dead `uuid` catalog entry, catalog `dotenv` + `@types/bun` and repoint drifting examples/e2e onto them, and replace `chalk` with `picocolors` in `@composio/core` (smaller, ESM, already used by the CLI) - **TypeScript 6:** bump `typescript` `5.9 → 6.0.3` everywhere (catalog, CLI test fixtures, docs); drop vestigial `declaration`/`outDir` from the provider `tsconfig.json`s to fix the TS 6 `rootDir` regression (`TS6059`); add `ignoreDeprecations: "6.0"` in docs for the `baseUrl` deprecation - **toolchain:** `tsdown 0.18 → 0.22.3`, `vitest` + `@vitest/ui → 4.1.9`, `publint → 0.3.21`, `wrangler → 4.101.0` (each the latest version within the 3-day `minimumReleaseAge` gate) - **Effect + hono:** `effect 3.21.3`, `@effect/cli 0.75.2`, `@effect/platform 0.96.1`, `platform-bun 0.90.0`, `platform-node-shared 0.60.0`, `language-service 0.86.2`, `@effect/vitest 0.29.0`, `hono 4.12.25`; pin the Effect peer cohort (`printer`/`printer-ansi`/`typeclass`/`rpc`/`sql`/`cluster`/`experimental`/`workflow`) as `@composio/cli` devDeps so the auto-installed peers resolve coherently, and bump `@cloudflare/workers-types` to satisfy `wrangler`'s peer - changesets: `@composio/cli` patch (ansis removal) and `@composio/core` patch (chalk → picocolors) - verified: `build`, `typecheck` (tsgo + real `tsc` 6.0.3), and local tests (excluding e2e) all pass |
||
|
Alberto Schiabel
|
24e647fa16 |
test(ts/e2e): cover claude agent sdk on node current (#3620)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3495 - adds a Node.js `current` e2e suite for `@composio/claude-agent-sdk` - exercises the packaged provider through Claude Agent SDK `createSdkMcpServer` / `query()` with a deterministic local tool - forwards `ANTHROPIC_API_KEY` through Turbo, Docker e2e env passthrough, and the Node e2e workflow |
||
|
Alberto Schiabel
|
025a657597 |
feat(ts): drop CommonJS support (#3494)
This PR moves the TypeScript SDK support floor to the latest Node.js 22 release and uses that as the point where we stop carrying custom CommonJS compatibility machinery. The e2e runtime coverage now exercises the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested against the minimum supported version and the newer runtimes users are likely to adopt next. Because the SDK packages are still on `0.x`, the accompanying changeset uses `minor` bumps while calling out that this is a breaking change inside the existing 0.x line. It also moves pnpm under mise on this Node 22 layer. That belongs here, not in #3493, because the pinned `pnpm@10.28.2` requires Node.js `>=22.13`. Removing Corepack is intentional: Node.js documents that Corepack is no longer distributed starting with Node.js v25, so relying on `corepack enable` would keep a toolchain dependency that is already on the way out of the Node distribution. ## What changed - Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`, `mise.lock`, `toolchain-versions.json`, and root `devEngines`. - Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise the single source of truth for the pnpm version. Removes the root `packageManager` / `devEngines.packageManager` Corepack pin entirely (rather than keeping a second copy of the version that could drift) and removes stale `packageManager` metadata from real TS packages/examples and generators. - Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a `packageManager` field. Without this, Turbo fails workspace resolution (`Could not resolve workspaces -> Missing 'packageManager' field`), which is the only reason the field would otherwise need to stay. - Replaces `corepack enable` in the shared setup action with mise-managed pnpm. The E2E Docker images install bun + pnpm directly from `mise.toml`/`mise.lock` (with `dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay on the base image as the test matrix axis and are disabled via `MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build args are threaded from the host anymore, and bun+pnpm now carry `mise.lock` checksum verification. - Extends the install-time toolchain check to validate pnpm against mise alongside Bun. - Sets the Node E2E matrix and install fallback checks to `22.22.3`, `24.16.0`, and `25.9.0`. - Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts` only and uses the ATTW `esm-only` profile. - Removes explicit `require` / `.cjs` / `.d.cts` package export paths and internal import mappings from the public TS SDK packages. - Marks public TS SDK packages as `type: module` where they were missing it. - Replaces the remaining runtime `require('pusher-js')` with dynamic ESM import. - Deletes the legacy CJS example. - Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop E2E: it verifies `require('@composio/core')` works through Node's native ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`, not a `.cjs` artifact. - Removes `.cjs` / `.cts` handling from example validation and CLI project-language detection. - Updates provider scaffolding so newly generated providers are ESM-only. - Adds a minor changeset warning that CommonJS callers can only rely on Node's native `require(esm)` interop and that custom CommonJS compatibility machinery is gone. ## Bundled behavior changes Two changes here are technically independent of the CommonJS removal but ride along because they touch the same files and ship in the same release cut. Calling them out explicitly so they are not missed in review: - **`PusherUtils` realtime channel auth (`@composio/core`).** Replacing the runtime `require('pusher-js')` with a dynamic ESM `import()` was done alongside conforming `channelAuthorization` to pusher-js's typed `customHandler(params, callback)` contract. The previous `(authOptions) => Promise` shape did not match pusher-js's actual calling convention — it read `endpoint`/`headers`/`params` off an argument that pusher-js never passes — so this also fixes that latent mismatch. New unit tests (`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name` body) and the success / invalid-JSON / network-failure callback paths. - **CLI meta-tool slug list (`@composio/cli`).** Drops `COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from `META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client` alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']` union. The list is declared `satisfies ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at compile time (`pnpm typecheck`) — keeping the stale slugs would be a type error — and needs no separate runtime test. ## Verification - Verified latest Node 22/24/25 releases from the official Node dist index: `22.22.3`, `24.16.0`, `25.9.0` (https://nodejs.org/dist/index.json). - Verified Node docs state Corepack is no longer distributed starting with Node.js v25: https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html - `mise exec -- pnpm --version` -> `10.28.2` - `mise exec -- pnpm install --frozen-lockfile` - `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts` - `mise exec -- pnpm --filter @e2e-tests/utils typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node` - `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck` - `mise exec -- pnpm --filter @composio/cli typecheck` - `mise exec -- pnpm --filter @composio/cli test -- --runInBand` - `mise exec -- pnpm --filter @composio/core typecheck` - `mise exec -- pnpm --filter @composio/core exec vitest run test/utils/pusher.test.ts` - `mise exec -- pnpm run build:packages` - `mise exec -- turbo run build --dry-run` resolves all workspace packages with no root `packageManager` field (pnpm discovered from `pnpm-lock.yaml`). - `mise exec -- pnpm --filter @composio/cli exec vitest run test/src/services/project-environment-detector.test.ts` - `mise exec -- pnpm exec prettier --check ...` - `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also `Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 / bun 1.3.10 from mise. - `docker manifest inspect node:24.16.0-slim` - `docker manifest inspect node:25.9.0-slim` - `bash -n ts/scripts/create-provider.sh && git diff --check` - `ruby -e "require 'yaml'; YAML.load_file('.github/workflows/ts.test-e2e.yml')"` - Tracked example validation in a clean temporary tree: `Validated 21 example packages.` |
||
|
Alberto Schiabel
|
a0bef5d986 |
chore(deps): bump composio client SDKs (TS alpha.74, Py 1.41.0) (#3609)
This PR: - bumps the TS catalog `@composio/client` from `0.1.0-alpha.72` to `0.1.0-alpha.74` (published from ComposioHQ/composio-base-ts#84) and refreshes `pnpm-lock.yaml` - bumps the Python `composio-client` pin from `1.39.0` to `1.41.0` (published from ComposioHQ/composio-base-py#69) - adds a patch changeset for `@composio/core` and `@composio/cli` so the client bump actually ships in the next release ## Context Neither client is auto-bumped in this repo — there is no Stainless→consumer bot, and Dependabot does not touch the pnpm `catalog:` pin (TS) or the exact `composio-client==` pin (Py), so these were a manual catch-up. The Python `1.41.0` PyPI publish initially failed with a `403 Forbidden` (stale `PYPI_TOKEN`); it was re-run successfully before this bump, so `1.41.0` is live on PyPI. |
||
|
Alberto Schiabel
|
6606c0da92 |
fix(ts): upgrade vitest for GHSA-5xrq-8626-4rwp (#3569)
This PR: - closes #3502 - extracts the useful dependency and Cloudflare config slice from https://github.com/ComposioHQ/composio/pull/3503 onto a clean `next` branch - upgrades `vitest` and `@vitest/ui` through the workspace catalog to resolve the critical advisory - switches the Mastra provider test dependency back to the catalog - migrates the Cloudflare Worker Vitest configs to the `cloudflareTest()` plugin API - preserves existing `COMPOSIO_BASE_URL` bindings that were dropped in #3503 - keeps Vitest 4 compatibility fixes scoped to constructor mocks, spy cleanup, and temp-root project detection - leaves Node, `mise`, release docs, and Effect catalog versions unchanged; the commit includes @Dotify71 as `Co-authored-by` Co-authored-by: Dushyant Acharya <dushyantacharya873@gmail.com> |
||
|
Alberto Schiabel
|
44e5458c35 |
feat(core): remove legacy TypeScript custom tools (#3509)
This PR is **part 2 of 3** splitting https://github.com/ComposioHQ/composio/pull/3505 to make the removal of the old 2025 custom tools easier to review. It carries the **TypeScript** slice. - builds on top of https://github.com/ComposioHQ/composio/pull/3508 (stacked — review/merge the Python slice first; this PR's base is `remove-py-custom-tools`) - removes the legacy `composio.tools.createCustomTool(...)` in-memory registry: the plural `CustomTools` model, registry wiring, legacy-only tests/examples/`ts/docs` pages, and stale error/type exports - preserves the 2026 tool-router APIs: `experimental_createTool`, `experimental_createToolkit`, `ToolRouter`, `ToolRouterSession`, and inline custom-tool execution - regenerates the TypeScript SDK reference so raw tool listing no longer describes the removed local registry and points to session-scoped custom tools - adds a `@composio/core` minor changeset ## Notes - The committed SDK reference is **verified self-consistent**: `pnpm --filter @composio/core generate:docs` reproduces it with zero diff. - This slice is a byte-identical subset of #3505 — the three split branches recombine to that PR's exact tree. See #3505 for the original verification logs (`typecheck`, `test`, `lint`, `cf-workers` e2e); CI re-runs per PR. |
||
|
Zen
|
57942e87fd |
fix(security): pin protobufjs to 7.5.5 (Socket.dev critical CVE) (#3467)
# Description Adds a `pnpm.overrides` entry pinning `protobufjs` to **7.5.5** to patch a critical RCE flagged by Socket.dev: | Socket alert | CVE | GHSA | Severity | Patched in | |---|---|---|---|---| | `SOCKET-COMPOSIO-1686` | `CVE-2026-41242` | [`GHSA-xq3m-2v4x-88gg`](https://github.com/advisories/GHSA-xq3m-2v4x-88gg) | Critical | `protobufjs@7.5.5` | ### Why an override `protobufjs@7.5.4` is pulled in transitively by `@google/genai` (via `google-auth-library`) — there are no direct imports of `protobufjs` in `ts/packages/`. The cleanest, minimal-risk fix is a `pnpm.overrides` pin: 7.5.4 -> 7.5.5 is a patch-only release containing the RCE fix. This is the same override pattern hermes uses for its security-pinned deps. # How did I test this PR - `BYPASS_BUN_VERSION_CHECK=1 pnpm install --lockfile-only` regenerated `pnpm-lock.yaml`. Both `protobufjs@7.5.4` references now resolve to `7.5.5`. - `grep -rn "from ['\"]protobufjs" ts/packages/` confirms zero direct imports — pure lockfile change. - Relying on CI for lint / typecheck / unit-test coverage on the lockfile bump. --- Origin: cron-f7c85f82906b / [zen-cron-6352a6575b74](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74) Triggered by: saransh@composio.dev | Source: Socket.dev Vulnerability Auto-Fix Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-6352a6575b74 |
||
|
venkat82
|
42ebff3f6b |
feat(connected-accounts): namespace SHARED-connection surface under experimental
Aligns the TypeScript SDK with the experimental wire shape used by
Shared Connections. The flat accountType / aclConfigForShared options
on connectedAccounts.link() and session.authorize() have moved under a
single experimental block, and connectedAccounts.updateAcl() has moved
off the class onto a top-level experimental_updateAcl(composio, id, opts)
export — same precedent as experimental_createTool /
experimental_createToolkit.
The experimental namespace is the signal that the shape may change in
future releases. Pinning a SHARED connection in a session config and
direct execute by connectedAccountId are unchanged — only the
connection-create / patch / authorize surfaces are namespaced.
Also surfaces the accountType filter on connectedAccounts.list() so
SHARED connections can be listed without dropping to the raw client.
The wire keeps this as a flat query param, so the SDK keeps it flat too.
@composio/client bumped from 0.1.0-alpha.71 -> 0.1.0-alpha.72 so the
generated typed client carries the Experimental namespaces for
link.create, toolRouter.session.link, and connectedAccounts.patch.
Caller migration:
// before
await composio.connectedAccounts.link('user_id', 'auth_config_id', {
accountType: 'SHARED',
aclConfigForShared: { allowAllUsers: true },
});
await composio.connectedAccounts.updateAcl('ca_abc', { allowAllUsers: true });
await session.authorize('github', {
accountType: 'SHARED',
aclConfigForShared: { allowAllUsers: true },
});
// after
await composio.connectedAccounts.link('user_id', 'auth_config_id', {
experimental: {
accountType: 'SHARED',
aclConfigForShared: { allowAllUsers: true },
},
});
await experimental_updateAcl(composio, 'ca_abc', { allowAllUsers: true });
await session.authorize('github', {
experimental: {
accountType: 'SHARED',
aclConfigForShared: { allowAllUsers: true },
},
});
// new — list SHARED connections
const shared = await composio.connectedAccounts.list({
accountType: 'SHARED',
userIds: ['user_creator'],
});
Tests cover: experimental block forwarding (link + authorize), no-op
when omitted, empty-array preservation, typed error mapping for the
PRIVATE-with-ACL case, experimental_updateAcl body construction +
deny-list handling + ValidationError when no fields are provided, and
list(accountType: 'SHARED') flat-filter delegation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
venkat82
|
483af36070 |
feat(connected-accounts): bump @composio/client to alpha.71, drop casts, add tests + error mapping
Now that #77 in composio-base-ts merged and @composio/client@0.1.0-alpha.71 is published with account_type + acl_config_for_shared in the typed surface, all the forward-compat shims come out. Removed: - AclConfigWireShape, LinkCreateBodyWithAcl, ConnectedAccountPatchBodyWithAcl local types - 3x `as unknown as Parameters<typeof X>[N]` casts in ConnectedAccounts.ts + ToolRouterSession.ts Now uses the generated types directly: - ConnectedAccountPatchParams, ConnectedAccountPatchResponse from @composio/client/resources/connected-accounts - LinkCreateParams + LinkCreateParams.ACLConfigForShared from @composio/client/resources/link - SessionLinkParams + SessionLinkParams.ACLConfigForShared from @composio/client/resources/tool-router/session/session Review fixes from #3392 multi-agent review: - P1-1: moved orphaned JSDoc back onto ComposioLegacyConnectedAccountsEndpoint- RetiredError (was stranded above ComposioSharedAccessDeniedError) - P1-2: added empty-array footgun warning to updateAcl() JSDoc — passing `notAllowedUserIds: []` silently clears the deny list - P1-3: changeset reconciled with PR body (Python ships as separate PR) - P2-9: updateAcl() returns ConnectedAccountPatchResponse instead of void, matching sibling update()/refresh() ergonomics - P2-11: clarifying JSDoc on update() pointing at updateAcl() and noting the pre-existing "alias/credentials" doc is inaccurate (this PR doesn't fix it) - P3-12: callbackUrl/alias guards normalized to `!== undefined` (was a mix of `&&` and `!= null`) — empty strings now propagate correctly - P3-17: refine-guard comment on UpdateConnectedAccountAclParamsSchema noting ZodEffects doesn't expose .shape P2-6/P2-7: typed error mapping for ComposioAclOnlyForSharedError (400) wired at three call sites: - ConnectedAccounts.link() — wraps existing ComposioFailedToCreateConnectedAccountLink catch - ConnectedAccounts.updateAcl() — new catch with rethrow fallback - ToolRouterSession.authorize() — new catch with rethrow fallback Substring match on `'acl_config_for_shared is only valid on SHARED'` — verified against apps/apollo/src/lib/connected_accounts/createConnectedAccount.ts in hermes#9902. ComposioSharedAccessDeniedError and ComposioSharedConnectionNotAccessibleError remain exported but not yet thrown — they'll be wrapped when Tools.execute() and ToolRouterSession.create() error-mapping lands in a follow-up. Tests: 12 new behaviour tests in test/connectedAccounts/connectedAccounts.test.ts covering link() ACL forwarding (5), updateAcl() body construction + empty-object refine + AclOnlyForShared mapping (6), and link() error-mapping fallback (1). 911 tests pass (up from 899). Verified: pnpm typecheck clean, pnpm build clean (publint + attw clean). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Rahul Tarak
|
a4c9e0ada2 |
refactor(cli): define local tools as custom toolkits (#3356)
## Summary - Stacks this local-tools PR on top of #3360, which contains the core duplicate custom-toolkit child slug fix. - Refactors `@composio/cli-local-tools` to define bundled local toolkits with core `experimental_createTool` / `experimental_createToolkit` handles instead of hand-rolled schema objects. - Keeps Tool Router v3.1 inline custom toolkit definitions attached to session create/search/execute calls so bundled local tools remain searchable/executable. - Adds CLI/local-tools test coverage for forwarding local custom toolkit payloads and for core custom toolkit handles from the local registry. ## Stack - Base PR: #3360 (`fix(core): qualify custom toolkit child slug lookups`) - This PR should now show only CLI/local-tools changes relative to #3360. ## Tests - `pnpm --filter @composio/core typecheck` - `pnpm --filter @composio/cli-local-tools typecheck` - `pnpm --filter @composio/cli typecheck` - `pnpm --filter @composio/cli-local-tools test` - `pnpm --filter @composio/cli-local-tools build` - `pnpm --filter @composio/cli exec vitest run test/src/commands/tools/tools.search.cmd.test.ts test/src/commands/tools/tools.execute.cmd.test.ts` - `pnpm --filter @composio/core exec vitest run test/models/customTool.test.ts test/models/toolRouter.test.ts test/models/customToolRouting.test.ts` |
||
|
Abir Taheer
|
7c14438385 |
chore: update pnpm-lock.yaml for @composio/client 0.1.0-alpha.70
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dhawal Upadhyay
|
fb8549fce7 |
Bump generated clients for v3.1 (#3348)
## Summary - bump generated TS client to @composio/client 0.1.0-alpha.69 and Python client to composio-client 1.36.0 - page through ToolRouter session tools in TS/Python using the generated v3.1 cursor response - accept generated connected account status REVOKED and fail connection waits immediately for terminal states ## Validation - pnpm --filter @composio/core typecheck - pnpm --filter @composio/core test -- test/tools/tools.test.ts test/models/toolRouter.test.ts test/connectedAccounts/connectedAccounts.test.ts test/connectedAccounts/connectionRequest.test.ts - uv run --frozen ruff check python/composio/core/models/tools.py python/tests/test_tool_execution.py - uv run --frozen pytest python/tests/test_tool_execution.py::TestToolExecution::test_get_raw_tool_router_meta_tools_fetches_all_pages python/tests/test_tool_router.py Note: pnpm install --frozen-lockfile hits the repo preinstall Bun guard locally because this machine has Bun 1.2.10 and the branch expects 1.3.10; dependency sync was completed with --ignore-scripts for local verification. |
||
|
Alberto Schiabel
|
f5c5b84bd3 |
fix(mastra): resolve $ref in tool schemas before applyCompatLayer [PLEN-2244] (#3315)
## Summary Composio tools whose JSON Schema uses internal `$ref` pointers (`#/$defs/...` or the legacy `#/definitions/...`) used to lose all type information when wrapped by `MastraProvider.wrapTool`. The schema would silently round-trip `raw → applyCompatLayer → convertSchemaToZod (drops $ref → permissive anyOf) → zodToJsonSchema (no recovery)`. Customers reported the user-visible surface as *"schema validation error: can't resolve reference"* — AJV (bundled inside `@mastra/schema-compat`) refusing to compile the schema downstream when validating tool input. This PR pre-processes the schema with a new `dereferenceJsonSchema` utility from `@composio/core` *before* it reaches `@mastra/schema-compat`, preserving the type information from `$defs`/`definitions` and avoiding the AJV failure entirely. Closes [PLEN-2244](https://linear.app/composio/issue/PLEN-2244/mastra-provider-schema-validation-error-cant-resolve-reference). ## What changed - **`@composio/core`** — new `dereferenceJsonSchema(schema)` helper (and `JsonSchemaRefResolutionError`): - walks the schema reflectively (no JSON-Schema-keyword allow-list, so future applicators are covered automatically), - inlines internal `$ref` pointers transitively, with a 100-hop depth cap, - shallow-merges sibling keywords next to `$ref` per Draft 2020-12 semantics (siblings win on collision — preserves caller's `description` / `default` / `title`), - breaks recursive cycles with `{ type: 'object', additionalProperties: true }` (matches upstream guidance in [mastra-ai/mastra#15341](https://github.com/mastra-ai/mastra/issues/15341)), - strips `$defs` / `definitions` from the returned root once everything reachable is inlined, - leaves external (`http://`/`https://`) `$ref` pointers untouched so callers can still forward them, - throws `JsonSchemaRefResolutionError` on malformed pointers, missing targets, and over-cap chains. - **`@composio/mastra`** — `wrapTool` now runs `dereferenceJsonSchema` over both `inputParameters` and `outputParameters` before calling `applyCompatLayer`. - **`@mastra/schema-compat`** floor bumped to `^1.2.9` so consumers automatically pick up upstream [PR #15400](https://github.com/mastra-ai/mastra/pull/15400)'s recursive-`$ref` handling and [PR #14530](https://github.com/mastra-ai/mastra/pull/14530)'s Draft-2020-12 AJV switch. - Changeset: `.changeset/fix-mastra-ref-dereference.md` (patch bump for `@composio/core` and `@composio/mastra`). ## Test plan Red → green TDD across two commits — the `test:` commit reproduces PLEN-2244 against the real `@mastra/schema-compat` (no `vi.mock`), the `fix:` commit makes the regression tests pass. - [x] `ts/packages/core/test/utils/jsonSchema.test.ts` — 14 unit tests for `dereferenceJsonSchema` covering: basic resolution, chained refs, container coverage (items / oneOf / anyOf / allOf / not / additionalProperties / patternProperties / prefixItems), legacy `definitions` (Draft 7), `$defs`/`definitions` mixed transitively, sibling-keyword merge per Draft 2020-12, cycle break, `$defs`/`definitions` strip, missing-target error, depth-cap error, external `$ref` preserved, no input mutation, JSON Pointer escape decoding (`~0`/`~1`), array-index pointers. - [x] `ts/packages/providers/mastra/test/mastra-ref.test.ts` — un-mocked integration tests against real `@mastra/schema-compat`: wrapping does not throw, type info from `$defs` survives the round-trip (the `id` field stays `type: 'string'` instead of degrading to permissive `anyOf`), same for Draft-7 `definitions` on output schema, no remaining `$ref` in the produced schemas. - [x] `pnpm --filter @composio/core test` — 852/852 green. - [x] `pnpm --filter @composio/mastra test` — 43/43 green (39 legacy + 4 new). - [x] `pnpm --filter @composio/core --filter @composio/mastra typecheck` — clean. - [x] Existing `mastra.test.ts` (which mocks `@mastra/schema-compat`) is **untouched** and still green. - [x] Secret-hygiene scan: `git diff next..HEAD | grep -E 'sk-[A-Za-z0-9_-]{20,}|OPENAI_API_KEY=[A-Za-z]'` returns empty. ## Why it's a Mastra-only fix The Mastra path is unique in routing JSON Schema through `@mastra/schema-compat`, which embeds AJV. Sibling providers (`openai`, `anthropic`, `vercel`, `langchain`, `google`, `llamaindex`) forward Composio's JSON Schema through `@composio/json-schema-to-zod`, which silently no-ops on unknown nodes. They are not affected today; expanding pre-processing across providers is a separate PR if it ever becomes needed. ## Caveats - The cycle-break sentinel weakens type information for genuinely recursive tool schemas. This is the same trade-off Mastra itself made in [#15341](https://github.com/mastra-ai/mastra/issues/15341); without it the agent crashes entirely. - External `$ref` (`http://`/`https://`) is intentionally left untouched. If a real customer schema ever needs them resolved, that's an incremental follow-up that calls into `@apidevtools/json-schema-ref-parser` only when needed. - The cycle-break currently uses a single sentinel for any cycle; if review prefers the higher-fidelity "keep first expansion, only break on the recursion edge" pattern (mentioned in the research as a refinement), that's a small follow-up. |
||
|
Rahul Tarak
|
b3e5df565e |
fix(cli): patch BetterSwiftAX constants for binary builds (#3347)
## Summary
- Broaden the Beeper iMessage macOS build patch so BetterSwiftAX
`kAX...` constants compile on GitHub `macos-15`/`macos-15-intel`.
- Pin the fixed `platform-imessage` submodule source and add Swift 6.2 /
Peekaboo dependency patching for the CLI binary workflow.
- Package and verify macOS local-tool sidecars plus `release-tag.txt` in
CLI release zips.
- Fix installed beta metadata/upgrade behavior so `--version`, update
checks, and beta-default experimental flags use the installed release
tag.
- Let `LOCAL_*` execution bypass remote auth/project/schema validation.
- Add runtime self-heal for missing installed `local-tools-binaries`: if
an old upgrader installs the fixed beta binary without sidecars, first
local-tool execution downloads the matching release zip, verifies
checksum when available, and restores the sidecars.
## Validation
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build:binary`
- Targeted CLI tests for execute/config/upgrade/version/update-check
paths.
- Packaged binary smoke test confirmed bundled Beeper sidecar works.
- Repair smoke test: copied only the new `composio` binary plus
`release-tag.txt` into a temp install with no `local-tools-binaries`;
`execute LOCAL_BEEPER_IMESSAGE_VERSION -d '{}'` restored sidecars from
`@composio/cli@0.2.29-beta.235` and succeeded.
## Release workflow
- Beta build run `25405049712` succeeded for commit
`9d0910c909b7b257d0f17b6d082980952d1e6c59` and published
`@composio/cli@0.2.29-beta.235`.
- This PR now includes one follow-up commit (`2c32cff4c`) to cover the
old-upgrader/missing-sidecars incremental upgrade path; normal branch CI
and beta build run `25406984535` are running again.
|
||
|
Dhawal Upadhyay
|
82e0038c7c | bump generated clients for v3.1 | ||
|
Rahul Tarak
|
79ac22053f |
feat(cli): add local tools foundation (#3340)
## Summary - Add experimental CLI local tools behind `local_tools` (beta-on, stable-off unless `composio config experimental local_tools on`). - Add reusable `@composio/cli-local-tools` package: declarations, metadata, readiness, command/MCP/native/FFI runtimes, bundled-binary resolution, and Tool Router search/execute/schema integration. - Add first-class local toolkits for: - `BEEPER_IMESSAGE` backed by `imessage-cli` from the ComposioHQ `platform-imessage` fork. - `CHROME_DEVTOOLS` backed by the official `chrome-devtools-mcp@0.24.0` npm/npx package. - `PEEKABOO` backed by upstream Peekaboo CLI. - Remove generated native executables from git: Beeper and Peekaboo binaries are now ignored, pinned via git submodules, and generated during CLI binary release jobs. - Update CLI binary workflow so Linux artifacts skip native sidecars, while macOS artifacts run on macOS runners and build only the matching `darwin-x64` or `darwin-arm64` Beeper/Peekaboo sidecars before packaging. ## Native binary policy - No generated `imessage-cli` or `peekaboo` binary blobs are committed in this PR history. - Beeper source is pinned as `ts/packages/cli-local-tools/vendor/platform-imessage` at `364445a1b3089ad9fe293d5951efe160c5677c42` from `https://github.com/ComposioHQ/platform-imessage`. - Peekaboo source is pinned as `ts/packages/cli-local-tools/vendor/peekaboo` at `31e66e8d02656141d18f60bf3b46b24c2b9bc785` from `https://github.com/steipete/Peekaboo`. - Build commands: - `pnpm --filter @composio/cli-local-tools build:local-tool-binaries -- --target darwin-arm64` - `pnpm --filter @composio/cli-local-tools build:local-tool-binaries -- --target darwin-x64` - Chrome DevTools is an npm/npx integration and is pinned as a dev dependency (`chrome-devtools-mcp@0.24.0`) instead of using native sidecars. ## Validation - `pnpm --filter @composio/cli-local-tools build:local-tool-binaries -- --target darwin-arm64` - `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target darwin-x64` - `pnpm --filter @composio/cli-local-tools build:beeper-imessage -- --target darwin-x64` - `pnpm --filter @composio/cli-local-tools typecheck:tsc` - `pnpm --filter @composio/cli-local-tools test` - `COMPOSIO_REAL_LOCAL_TOOLS_TESTS=1 pnpm --filter @composio/cli-local-tools test -- src/toolkits/beeper-imessage.test.ts src/toolkits/peekaboo.test.ts` - `pnpm --filter @composio/cli typecheck:tsc` - `pnpm --filter @composio/cli build` - `COMPOSIO_CACHE_DIR=<tmp-config-with-local_tools-enabled> bun ts/packages/cli/dist/bin.mjs local-tools doctor --json` - `pnpm turbo build` - Verified rewritten branch has no >1MB objects relative to `origin/next` and no native executable paths in the PR diff. ## Notes / risks - Beeper iMessage and Peekaboo are macOS-only and depend on local permissions. - Peekaboo requires macOS 15+; GUI tools require Screen Recording, Accessibility, and sometimes Automation. - Beeper send/reaction behavior can still depend on upstream Messages automation reliability. - Chrome DevTools can inspect/modify browser contents; avoid sensitive browser sessions. |
||
|
Dhawal Upadhyay
|
fed23cdc56 | fix(tool-router): use generated execute offload params | ||
|
jkomyno
|
cc673b654c |
fix(mastra): resolve $ref in tool schemas before applyCompatLayer [PLEN-2244]
Composio tools whose JSON Schema uses internal `$ref` pointers (`#/$defs/...`
or the legacy `#/definitions/...`) used to lose all type information when
wrapped by `MastraProvider.wrapTool`. The schema went through:
raw JSON Schema (with $ref) → applyCompatLayer
→ convertSchemaToZod (silently drops $ref, becomes a permissive anyOf)
→ zodToJsonSchema (no way to recover the lost types)
Customers reported this surface as "schema validation error: can't resolve
reference" — AJV (bundled inside @mastra/schema-compat) refusing to compile
the schema downstream when validating tool input.
Fix: pre-process the schema with a new `dereferenceJsonSchema` helper before
handing it to `applyCompatLayer`. The helper:
- walks the schema reflectively (no JSON-Schema-keyword allow-list, so future
applicators are covered automatically),
- inlines internal `$ref` pointers transitively, with a 100-hop depth cap,
- shallow-merges sibling keywords next to `$ref` per Draft 2020-12 semantics
(siblings win on collision — preserves caller's `description`/`default`),
- breaks cycles with `{ type: 'object', additionalProperties: true }`,
matching upstream guidance in mastra-ai/mastra#15341,
- strips `$defs`/`definitions` from the returned root once everything
reachable is inlined,
- leaves external (`http://`/`https://`) `$ref` pointers untouched,
- throws `JsonSchemaRefResolutionError` on malformed pointers, missing
targets, or chains over the cap.
Bumps the `@mastra/schema-compat` dependency floor to `^1.2.9` so users also
pick up upstream PR #15400's recursive-`$ref` handling.
The new red regression tests (committed in
|
||
|
Zen Agent
|
1c3276ba8d |
feat(sdk): add workbench sandbox compute tier (sandboxSize / sandbox_size)
Expose `workbench.sandboxSize` (TypeScript) / `workbench.sandbox_size` (Python) on `ToolRouter.create()` so callers can pick the workbench sandbox compute tier (`standard`, `medium`, `large`, `xlarge`). Optional; the server defaults to `standard` (1 vCPU / 1 GB) when omitted, so existing callers keep current behavior. - Bump stainless clients to pick up the field on the wire: - `@composio/client` 0.1.0-alpha.66 -> 0.1.0-alpha.67 - `composio-client` 1.33.0 -> 1.34.0 - TS: extend `ToolRouterCreateSessionConfigSchema.workbench` with `sandboxSize` and forward it as snake_case `sandbox_size`. Export `SandboxSize` type and `SandboxSizeSchema` zod enum. - Python: extend `ToolRouterWorkbenchConfig` TypedDict with `sandbox_size` and forward it on the create payload. Export `SandboxSize` literal alias. - Changeset: `@composio/core` patch. - Tests: cover the snake_case forwarding and zod enum rejection. Docs (Configuring Sessions / Workbench / changelog) are split into a separate PR so they can land alongside the SDK release. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
a10288aa87 | fix(core): restore session.toolkits() pagination (#3193) | ||
|
Rahul Tarak
|
08eccb85de |
feat(cli): migrate API key storage from plaintext to OS keyring (#3202)
## Summary
- Wire `@composio/cli-keyring` into `ComposioUserContext` so the API key
lives in the macOS Keychain / Linux Secret Service instead of plaintext
`~/.composio/user_data.json`
- **Read precedence**: env var (`COMPOSIO_USER_API_KEY`) > OS keyring >
legacy plaintext
- **One-shot migration**: on first run after upgrade, if the keyring is
empty but `user_data.json` has an `api_key`, copy it to the keyring and
strip it from JSON
- **In-process memoization**: keyring read happens once at layer build
(~1.4ms), held in closure for the rest of the process
- **`dangerouslySaveApiKeyInUserConfig`**: opt-in escape hatch in
`~/.composio/config.json` for headless Linux / containers / CI where the
keyring is unavailable
- **`ctx.data` is now a getter**: fixes a pre-existing bug where
mutations via `login()`/`update()` were invisible through the stale
snapshot
- **In-memory mock keyring** for test isolation — tests never touch the
real keychain
## Files changed
| file | what |
|---|---|
| `ts/packages/cli/package.json` | Add `@composio/cli-keyring` workspace
dep |
| `ts/packages/cli/src/models/cli-user-config.ts` |
`dangerously_save_api_key_in_user_config` schema field |
| `ts/packages/cli/src/services/cli-user-config.ts` | Surface new field
on `CliUserConfigResolved` |
| `ts/packages/cli/src/services/user-context.ts` | Keyring-first
read/write/migrate/fallback chain |
| `ts/packages/cli/src/cli-main.ts` | Wire `KeyringLive` into layer
composition |
| `ts/packages/cli-keyring/src/stores/macos-security-ffi.ts` | Fix:
writes via subprocess `-A`, cleanup dead ACL builder code, add base64
encoding |
| `ts/packages/cli/test/__utils__/services/test-layer.ts` | In-memory
mock keyring for test isolation |
| `ts/packages/cli/test/src/commands/login.cmd.test.ts` | Update
assertion: api_key no longer in JSON after login |
## Verified end-to-end
```
$ ./dist/composio version
INFO: Composio API key migrated from user_data.json to the OS keyring
0.2.22
$ cat ~/.composio/user_data.json # no api_key
{"base_url":"...","web_url":"...","org_id":"...","test_user_id":"..."}
$ # Rebuild binary (new hash) → read from keychain → no dialog
$ ./dist/composio whoami
{"email":"rahul@composio.dev",...}
```
## Test plan
- [x] 676 CLI tests passing (676 passed, 1 skipped)
- [x] Login test updated: asserts `api_key` absent from JSON + present
via `ctx.data.apiKey`
- [x] In-memory mock keyring — no real keychain access in tests
- [x] Binary build + FFI roundtrip verified
- [x] Rebuild with new hash → no keychain dialog (allow-any ACL via
`-A`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
**Stack: 2/2** — base PR: `cli/keyring-package` (#3201)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
||
|
Rahul Tarak
|
9d7cf5aca2 |
feat(cli-keyring): add @composio/cli-keyring package (#3201)
## Summary - Cross-platform OS credential storage package for the Composio CLI, structurally modeled on [keyring-rs](https://github.com/open-source-cooperative/keyring-rs) - **macOS FFI backend**: direct `SecItemCopyMatching` via `bun:ffi` — **~1.4ms median reads** (vs 22ms subprocess). Writes delegate to `/usr/bin/security -A` for reliable allow-any ACL - **macOS subprocess fallback**: `/usr/bin/security` for Node/test environments - **Linux backend**: `secret-tool` subprocess with keyring-rs-compatible attribute keys (`{service, username, target}`) - All pointers as `bigint` (`FFIType.u64`) to handle CoreFoundation tagged pointers above `2^53` - `b64:` prefix encoding for cross-backend binary safety - 11-variant `KeyringError` discriminated union matching `keyring-core`'s error model - Effect.ts integration via `@composio/cli-keyring/effect` subpath export (optional peer dep) - `dangerouslySaveApiKeyInUserConfig` escape hatch designed for the CLI migration PR (next in stack) ## Benchmark (100 iterations, Apple Silicon) | operation | subprocess | FFI | speedup | |---|---|---|---| | `getPassword` p50 | 19.95ms | **1.14ms** | **18×** | | `getPassword` p99 | 88.72ms | **7.39ms** | **12×** | ## Test plan - [x] 16 unit tests (errors, entry, shared encoding) — Node vitest - [x] 4 E2E tests against real macOS keychain — gated on `COMPOSIO_KEYRING_E2E=1` - [x] 6 FFI-specific tests — gated on `typeof Bun !== 'undefined'` + E2E flag - [x] `publint` + `attw` clean - [x] `bun build --compile` produces working standalone binary with FFI reads 🤖 Generated with [Claude Code](https://claude.com/claude-code) **Stack: 1/2** — next PR: `cli/keyring-migration` (wires this into the CLI) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
abir
|
7166c8e42d |
fix: regenerate lockfile with pnpm 10.28.0 and fix ruff formatting
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Zen Agent <zen@composio.dev> |
||
|
abir
|
28b8914d58 |
feat: bump client SDKs and simplify types using Stainless SDK
- Bump @composio/client to 0.1.0-alpha.66 (TS) and composio-client to 1.33.0 (Python) - Use SDK types directly: ConnectedAccountPatchResponse, SessionCreateParams.MultiAccount - Move alias into connection param for initiate() (now in SDK's ConnectedAccountCreateParams.Connection) - Simplify link(), authorize() methods — remove inline type casts, use SDK params directly - Remove custom UpdateConnectedAccountResponse Zod schema (replaced by SDK type) - Update tests for new alias location in create params Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Zen Agent <zen@composio.dev> |
||
|
abir
|
55355f6b10 |
chore: bump @composio/client to 0.1.0-alpha.64
New client includes multi_account in SessionCreateParams. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
abir
|
173f1e78f3 |
fix: regenerate pnpm-lock.yaml with pnpm 10.28.0 for CI compatibility
Previous lockfile was corrupted by local pnpm 9.5.0 — missing overrides section and wrong pnpmfileChecksum. Regenerated with pnpm 10.28.0 (matching CI's packageManager version). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
abir
|
3332fe1a65 |
fix: upgrade @composio/client to alpha.63, use typed patch() for update
- Bump @composio/client to 0.1.0-alpha.63 (adds connectedAccounts.patch) - Replace raw client.patch() cast with typed client.connectedAccounts.patch() - Keep minimal casts for alias on create/link (not yet in client types) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Zen Agent <zen@composio.dev> |
||
|
Rahul Tarak
|
efcb8c2436 |
Add tsgo-backed typecheck targets across packages (#3130)
## Summary - Add `tsgo`-based `typecheck` scripts and matching `typecheck:tsc` fallback scripts across the TypeScript packages. - Wire the new `typecheck:tsc` task into Turbo so package-level typecheck checks can run consistently. - Update workspace and lockfile metadata to include `@typescript/native-preview` and the new toolchain wiring. - Remove redundant `baseUrl` settings from package tsconfig files where they are no longer needed. ## Testing - Not run (changes are limited to package scripts, tsconfig wiring, and lockfile updates). - Not run: `pnpm typecheck:tsc` - Not run: `pnpm build` - Not run: package-specific `typecheck` / `typecheck:tsc` commands in `ts/packages/cli`, `ts/packages/core`, `ts/packages/json-schema-to-zod`, and `ts/packages/providers/mastra`. |
||
|
dependabot[bot]
|
a33aa4b0b7 |
chore(deps): bump path-to-regexp
Bumps the npm_and_yarn group with 1 update in the / directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp). Updates `path-to-regexp` from 0.1.12 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13) --- updated-dependencies: - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Rahul Tarak
|
b763753df5 |
[codex] bundle bun support files for standalone binaries (#3059)
## Summary
- bundle the shipped `composio run` companion services with direct
`Bun.build(..., target: "bun")` output instead of reusing the shared
`dist` graph
- rebuild the Claude ACP support files as Bun-bundled runtime assets and
invalidate the cached adapter layout so stale raw files are not reused
- add runtime validation for shipped support files, wire the MCP helper
through the workspace `@composio/json-schema-to-zod` package, and cover
the static-import expectation in tests
## Why
Standalone binaries were still relying on external runtime dependencies
from companion support files. On a clean machine this surfaced as
failures like `Cannot find package 'decompress'` from the generated
companion modules. The fix is to make every shipped support file
self-contained for Bun and package exactly that tree into the binary
archives.
## Validation
- `pnpm run typecheck`
- `pnpm exec vitest run
test/src/services/run-subagent-output-mcp.test.ts
test/src/services/run-subagent-acp.test.ts`
- `pnpm run build:binary:all`
- `pnpm run build:binary:package`
- unpacked `dist/binaries/composio-darwin-aarch64.zip` and verified
`experimental_subAgent(..., { target: "codex", schema: ... })`
- unpacked `dist/binaries/composio-darwin-aarch64.zip` and verified
`experimental_subAgent(..., { target: "claude", schema: ... })`
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
||
|
Rahul Tarak
|
cb02575065 |
fix(cli): harden run subAgent structured output (#3046)
## Summary - harden `composio run` sub-agent structured output by adding an MCP-backed `submit_structured_output` tool, permissive ACP approval, and a repair turn when the agent answers with prose - route all `run` helper logs into the per-run `artifacts/run.log`, print `RUN_LOG_FILE=...` before execution starts, and include `logFilePath` on `subAgent()` responses - keep the run artifact directory and `~/.composio` accessible to sub-agents and cover the new behavior with focused CLI/ACP tests ## Verification - `pnpm --filter @composio/cli typecheck:src` - `pnpm --filter @composio/cli test test/src/commands/run.cmd.test.ts test/src/services/run-subagent-acp.test.ts` - `pnpm --filter @composio/cli exec tsdown --config-loader unrun` - `pnpm --filter @composio/cli run build:binary` - manual `./ts/packages/cli/dist/composio run ...` checks against both `target: "claude"` and `target: "codex"` --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|
Rahul Tarak
|
f4922f9757 |
Add ACP-backed subagent execution to composio run (#3011)
## Summary - Adds a new ACP execution path for `subAgent()` in the CLI `run` command, with fallback to the legacy CLI-based implementation when ACP is unavailable. - Introduces shared subagent helpers plus separate ACP and legacy service modules to keep the invocation logic isolated. - Adds `--acp-only` to force ACP usage and fail instead of falling back. - Updates binary build output so the CLI ships the companion modules needed by the `run` command in both source and compiled forms. - Bumps CLI dependencies to include ACP packages used by the new execution path. ## Testing - `pnpm test ts/packages/cli/test/src/commands/run.cmd.test.ts` - `pnpm test ts/packages/cli/test/src/services/run-subagent-acp.test.ts` - Not run: full repository build or end-to-end CLI validation. |
||
|
Rahul Tarak
|
ae08b37f91 |
feat(cli): add proxy execute (#2995)
## Summary - Adds a new `composio proxy` command plus `run`/consumer flow updates to make local execution and debugging easier. - Improves CLI UX across root help, command hints, input validation, and hidden debug handling. - Introduces experimental custom tools and toolkits support in the TypeScript SDK, with docs and examples. - Refreshes release metadata, changelog, and related docs for the new CLI and SDK behavior. - Updates tests and snapshots to cover the new command flows and validation paths. ## Testing - Not run (changes reviewed from diff and existing test coverage updated in the branch). - Updated/added CLI tests for `proxy`, `run`, `tools.execute`, `tools.info`, `tools.list`, `tools.search`, and related command flows. - Updated snapshot coverage for root help and command output changes. --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Rahul Tarak
|
7633445b47 |
feat(cli): improve consumer command UX and hinting (#2979)
## Summary
This PR continues the consumer CLI work by making the top-level workflow
more coherent around `search`, `link`, `tools`, `execute`, and `run`,
while moving developer-oriented workflows under a dedicated `dev`
namespace.
The main theme is to make the CLI easier for an agent or user to use
directly:
- discover tools semantically with `search`
- inspect toolkit-specific tools with `tools`
- try `execute` earlier, with fast schema-aware failure messages
- use `run` for programmatic multi-step flows without dropping into bash
- keep developer/project scaffolding under `dev`
## What Changed
### Consumer command UX
- added top-level `run` for inline Bun ESNext TS/JS or file execution
- added injected global helpers inside `run`
- `execute(slug, data?)`
- `search(query, options?)`
- updated root help text to better explain the intended flow and
encourage trying `execute` early
- clarified `search` as semantic search across toolkits/apps
- moved `tools list` and `tools info` to top level
- made `tools list` explicitly per-toolkit and non-semantic
- updated `tools info` to give a short summary plus a cached schema
reference instead of dumping raw detail
- cleaned up stale help/hints that still referenced removed command
paths
### New `dev` namespace
- introduced `composio dev ...` for developer/project workflows
- moved developer-focused flows under `dev`, including:
- local init
- playground-user execution
- trigger listening
- logs
- updated help copy so `manage` no longer claims to own `tools` or
`logs`
- reframed `dev` as the place for local scaffolding and project-building
workflows
### Execute improvements
- added schema-aware validation for `execute`
- cached tool definitions under `~/.composio/tool_definitions/`
- stored resolved version metadata with cached schemas
- added version freshness checks and stale-cache refresh behavior
- added a 12-hour version-check window to avoid refetching every
invocation
- invalidated stale cache entries when execution failures indicate the
schema may no longer be trustworthy
- improved validation errors to point at the cached schema file and give
more actionable guidance
- added `--get-schema` to fetch/cache the schema and print a compact
inspection hint
- added `--dry-run` to validate/preview execute calls without running
the remote action
- allowed `-d/--data` to accept JSON, JS-style object literals, `@file`,
or stdin
- added large-output handling that spills very large tool responses to
`/tmp/composio/...` and returns a file reference
### `run` improvements
- defaulted `run` to inline code, with `-f/--file` for file mode
- clarified in help that `run` uses Bun ESNext TS/JS, not Node/CJS
assumptions
- documented the injected helpers and when to use them
- made `run --dry-run` forward preview behavior through injected
`execute(...)`
- wired `run` to reuse consumer auth state and resolved consumer user
context for helper calls
- added AST-aware execute prewarming so static `execute("TOOL", ...)`
calls can prime schema/cache work
### Hint graph and debug tooling
- centralized command hints/examples in a shared registry
- added linked command relationships so hints can be maintained as a
graph instead of scattered hardcoded strings
- added support for variant nodes such as `root.execute.getSchema`
- added a hidden graph dump path for local iteration:
- `composio debug generate-graph`
- hid local-only debug controls from help output while keeping them
usable:
- `--perf-debug`
- `--tool-debug`
### Internal cleanup
- updated many runtime hints to point at current commands instead of
removed paths
- aligned login/whoami/project/toolkit/log output hints with the new
command structure
- refreshed tests and snapshots for the new top-level layout and command
descriptions
## Verification
Ran:
- `pnpm --dir ts/packages/cli build:binary`
- `pnpm --dir ts/packages/cli typecheck`
- `./ts/packages/cli/dist/composio --help`
## Notes
This PR is intentionally focused on the CLI flow and help/hint surface.
It sets up a cleaner split between consumer-facing actions and
developer/project workflows, while also making `execute` and `run` much
more usable for agents.
|
||
|
Dhawal Upadhyay
|
7b58c4a8d6 |
refactor: use official @composio/client types, proxyExecute via client method
- Bump @composio/client to 0.1.0-alpha.62 (adds proxyExecute, custom tool types) - Replace hand-rolled CustomToolDefinition/CustomToolkitDefinition with SessionCreateParams.Experimental.CustomTool/CustomToolkit from client - Type experimentalPayload as SessionCreateParams['experimental'] instead of Record<string, unknown> - Replace raw .post() hack in SessionContext/ToolRouterSession proxyExecute with official client.toolRouter.session.proxyExecute() - proxyParamsTransform now returns official ClientProxyExecuteParams type - Add ToolRouterSessionProxyExecuteResponse (status, data, headers, binaryData) matching ToolProxyResponse from client — consistent with tools.proxyExecute() - Build CustomToolsMap from API response slug/original_slug mapping instead of computing LOCAL_ prefix client-side - Add custom-tools.ts example showing standalone, extension (with proxyExecute), and toolkit tools with OpenAI Agents Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |