This PR:
- configures the TS release workflow to request GitHub Actions OIDC ID
tokens
- runs the TS release publish path on Node 24.17.0 so npm supports
trusted publishing
- leaves a TODO to centralize that release runtime in `mise.toml` after
https://github.com/ComposioHQ/composio/pull/3494 lands
- removes the long-lived `NPM_TOKEN` `.npmrc` setup before `changeset
publish`
- adds npm package support metadata (`repository.url`, `bugs.url`, and
`homepage`) for every public TS release workspace that Changesets can
publish
- marks `@composio/cli-local-tools` private so Changesets does not try
to publish it
This PR:
- adds the same `actions/create-github-app-token` setup used by the SDK
docs generator
- checks out the repository with the generated app token
- passes the app token to `peter-evans/create-pull-request`
- uses the app token for the optional reviewer request
- fixes the current `Docs - Update Data` failure where `CI_BOT_TOKEN`
cannot authenticate the git push for `docs/auto-update-data`
- verified with `go run
github.com/rhysd/actionlint/cmd/actionlint@latest
.github/workflows/docs-update-data.yml` and `git diff --check`
This PR:
- simplifies `COMPOSIO_BASE_URL_STAGING` handling by stripping optional
`/api/v3` or `/api/v3.1` suffixes before deriving both docs API
endpoints
- removes the URL-shape branching that rejected the current staging
secret
- keeps the production backend guard so the update-data workflow does
not use `https://backend.composio.dev`
- uses `CI_BOT_TOKEN` for `peter-evans/create-pull-request` and reviewer
requests because `GITHUB_TOKEN` cannot create pull requests in this repo
- verified with `go run
github.com/rhysd/actionlint/cmd/actionlint@latest
.github/workflows/docs-update-data.yml`, `git diff --check`, and shell
URL derivation checks
This PR:
- configures `docs-update-data.yml` to source docs data from
`COMPOSIO_BASE_URL_STAGING`
- fails fast when the staging base URL is missing or does not include
`/api/v3`
- derives v3 and v3.1 OpenAPI URLs from the staging secret so the job
does not fall back to production
- updates the generated data-sync PR copy to say OpenAPI specs are
fetched from staging
- quotes `$GITHUB_OUTPUT` redirects so `actionlint` stays clean
- verified with `go run
github.com/rhysd/actionlint/cmd/actionlint@latest
.github/workflows/docs-update-data.yml`, `git diff --check`, and shell
endpoint derivation checks
## Summary
Permanently stops the recurring *"release published with zero assets →
install/upgrade 404s"* outage
(https://github.com/ComposioHQ/composio/issues/3408,
https://github.com/ComposioHQ/composio/issues/3269; regressions of
https://github.com/ComposioHQ/composio/issues/2625 and
https://github.com/ComposioHQ/composio/issues/1820 — 3 of the last 5
stable releases shipped empty).
**Root cause:** a concurrent-writer race. On a CLI version bump,
`changesets/action` creates an empty `@composio/cli@x.y.z` GitHub
Release in seconds, then the slower `build-cli-binaries.yml` fails its
`gh release create` because the release already exists — so binaries
never attach.
> 🥞 **Stacked on #3415** (`pi/exclude-cli-ts-release-42161920`), which
removes the *second writer* (changesets no longer creates CLI releases).
Review/merge #3415 first; this PR targets that branch. This PR hardens
the now-sole writer so a *partial* build can't publish either, and fixes
the monitoring that hid the failure.
## What changed (`build-cli-binaries.yml` + canary)
- **Draft → verify → publish.** The release is built as a **draft**,
then a gate asserts all 6 canonical assets are present **and** `state ==
"uploaded"` (loud `::error::` + fail otherwise), and only the final step
flips it to published. Drafts fire no `release: published` event and are
excluded from `/releases/latest`, so no install.sh / Homebrew / redirect
consumer can observe an incomplete release.
- **`fail-fast: false`** on the build matrix → a single platform failure
can never publish a partial set (`needs.build.result` is `success` only
if all legs pass).
- **Per-tag job-level `concurrency`** so re-runs / quick pushes can't
interleave uploads on the same tag, without serializing unrelated betas.
- **Beta-safe:** `--prerelease` is set on the draft so betas stay
prereleases through the publish flip.
- **`promote-stable` guard** uses `gh release view --json isDraft` (the
REST tags endpoint 404s on drafts) to resume an existing draft but
refuse an already-published tag.
- **Least privilege:** workflow defaults to `contents: read`; only the
release job opts up to `contents: write`.
- **Canary fix** (`cli.install-health-check.yml`): install the newest
stable **pinned** tag (`npm view @composio/cli version`) instead of the
asset-aware no-arg flow, which self-heals to the last good release and
kept the canary green through every outage.
## Idempotency note
Re-running a run that failed **before publish** is safe (reuse draft +
`--clobber`). An already-**published** tag is refused, not mutated — by
design.
## Testing
- Extended `test/release-workflow.test.ts` (run via `pnpm
test:release-workflow`) to lock in: draft→verify→publish ordering,
`fail-fast: false`, per-tag concurrency, preserved `--prerelease`, and
the pinned-tag canary. ✅ passes.
- `shellcheck` clean on the new `run:` scripts; YAML validated.
`actionlint` runs in CI.
- Runtime verification of the full green path happens on the next
release CI run.
## Out of scope (deferred to their own PRs)
Per reviewer consensus, these are real but *not this bug*: a per-release
npm↔GitHub asset auditor (needs a grace window), the Homebrew trigger
constraint (folds into #3355), `composio upgrade` missing-asset back-off
(https://github.com/ComposioHQ/composio/issues/3269), and a rollback
runbook.
---------
Co-authored-by: Rahul Tarak <cryogenicplanet@gmail.com>
## Summary
Adds missing npm support metadata to `ts/packages/core/package.json` for
the `@composio/core` package:
- **`repository`**: adds full object with `type`, `url`, and `directory`
(monorepo package path)
- **`bugs.url`**: points to
`https://github.com/ComposioHQ/composio/issues`
- **`homepage`**: points to the package README in the repository
## Verification
```sh
npm view @composio/core@0.10.0 repository bugs homepage
# Currently returns empty for all three fields
```
No runtime code, dependencies, tests, or build configuration are
changed.
---------
Co-authored-by: XananasX7 <xananasandy@gmail.com>
Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
This PR:
- fixes
https://github.com/ComposioHQ/composio/actions/runs/27606982132/job/81621371312
- mints the existing release-bot GitHub App token in both SDK docs jobs
- passes the App token to checkout and `peter-evans/create-pull-request`
- uses the same App token for the reviewer-assignment `gh pr edit` step
- keeps the TypeScript and Python docs generation commands unchanged
Verification:
- `git diff --check`
- `ruby -e \"require 'yaml';
YAML.load_file('.github/workflows/generate-sdk-docs.yml'); puts 'yaml
ok'\"`
- `bash .github/scripts/check-action-repos.sh`
- confirmed `RELEASE_BOT_APP_ID` and `RELEASE_BOT_APP_PRIVATE_KEY` exist
in repo secrets
This PR:
- patches the Peekaboo sidecar build to rewrite the resolved
`swift-system` `AT_RESOLVE_BENEATH` Darwin guard before compiling on
GitHub macOS runners
- adds regression coverage for the `swift-system` checkout patch and
includes script tests in `@composio/cli-local-tools` Vitest
- switches the SDK docs sync workflow to
`anthropics/claude-code-action/base-action` so push-triggered automation
does not fail on unsupported event parsing
- moves Claude tool restrictions to `claude_args` and quotes
`$GITHUB_OUTPUT` writes so the workflow passes `actionlint`
- verifies the changed package and workflow with targeted tests, build,
formatting, YAML parsing, and `actionlint`
## Summary
Depends on #3492.
This completes the Phase 2 migration by removing the transitional
version-file layer and making `mise.toml` plus `mise.lock` the
repository toolchain source of truth. It also moves runtime test
matrices into `toolchain-versions.json`, so CI matrix changes are
explicit and reviewable without reintroducing `.nvmrc`, `.dvmrc`,
`.bun-version`, or `.python-version`.
The Node.js e2e matrix now starts at the latest Node 22 LTS line and
also covers the latest Node 24 and Node 25 lines. That removes Node 20
from the well-known e2e versions while keeping us covered on the
runtimes SDK users are moving toward.
## Rationale
Phase 1 introduced mise side by side with the existing version files to
keep the first PR low-risk. Phase 2 removes that compatibility layer so
there is one place to update tool versions. That avoids silent drift
between local setup, GitHub Actions, Docker E2E images, release docs,
and install-time checks.
The composite setup actions now install Node, Bun, Python, and uv
through mise by default, with explicit version overrides only where a
matrix needs them. New GitHub actions added in this PR are pinned by
release commit SHA and include the release version comment.
## What changed
- Deleted the transitional root/version files: `.nvmrc`, `.bun-version`,
`.dvmrc`, root `.python-version`, and `python/.python-version`.
- Removed `idiomatic_version_file_enable_tools` from `mise.toml` and
added a committed `mise.lock` for linux/macOS x64/arm64 tool resolution.
- Replaced `BYPASS_BUN_VERSION_CHECK` with `BYPASS_TOOLCHAIN_CHECK`, and
made Docker E2E image installs use that bypass because they receive
explicit build args instead of installing mise.
- Updated Node/Bun and Python/uv composite actions to default to mise,
remove `*-version-file` inputs, report resolved versions, and cache pnpm
after `corepack enable`.
- Centralized CI runtime matrices in `toolchain-versions.json` for TS
E2E, Python tests, and CLI npm fallback coverage.
- Updated the Node E2E matrix to `22.22.3`, `24.16.0`, and `25.9.0`,
removing Node 20 from the well-known runtime versions.
- Updated workflows, docs, E2E helpers, Dockerfiles, and release
guidance to reference `mise.toml` / `mise.lock`.
## Verification
- Verified latest Node 22/24/25 releases from the official Node dist
index: `22.22.3`, `24.16.0`, `25.9.0`
(https://nodejs.org/dist/index.json).
- `pnpm install --frozen-lockfile`
- `pnpm --filter @e2e-tests/utils typecheck`
- `pnpm --filter @e2e-tests/utils exec tsc --noEmit --target es2022
--module esnext --moduleResolution bundler --types bun
--resolveJsonModule --skipLibCheck --strict scripts/docker-build.ts`
- `bash -n ts/scripts/pre-install.sh && bun run
ts/scripts/pre-install/check-toolchain.ts && BYPASS_TOOLCHAIN_CHECK=1
bash ts/scripts/pre-install.sh`
- `pnpm exec prettier --check ...` on touched YAML/Markdown/TS/JSON
files
- `ruby -e "require \"yaml\"; ARGV.each { |f| YAML.load_file(f) }" ...`
on touched actions/workflows
- `mise lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64 &&
git diff --exit-code mise.lock`
- `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/utils typecheck`
- `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/node-esm-basic
typecheck`
- `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/node-cjs-basic
typecheck`
- `docker manifest inspect node:24.16.0-slim`
- `docker manifest inspect node:25.9.0-slim`
- `git diff --check`
## Problem
The changeset release bot (`ts.release.yml` → `changesets/action`)
authenticated with the **`CI_BOT_TOKEN`** personal access token. That
PAT expired, so **every "TS SDK Release" run since 2026-06-04 failed**
with:
```
HttpError: Bad credentials - https://docs.github.com/rest
```
`changeset version` ran fine, but the GitHub API call to create/update
the "Release: update version" PR failed — so no version PR, no publish.
(This is why 0.2.31 had to be shipped via a manual version bump in
#3538.)
## Fix
Mint a **short-lived GitHub App installation token** with
[`actions/create-github-app-token`](https://github.com/actions/create-github-app-token)
(pinned to `bcd2ba4` / v3.2.0) and use it for both `checkout` and the
`changesets/action` step, instead of the PAT.
Why an App token over a PAT or the default `GITHUB_TOKEN`:
- **No silent expiry** — minted per run; nothing to rotate manually
(exactly what just broke).
- **Triggers downstream workflows** — the default `GITHUB_TOKEN` is
blocked from triggering other workflows, so the version-PR merge would
never kick off `build-cli-binaries.yml` to publish. App-token-created
events *do* trigger them (same as a PAT, better hygiene).
- **Not tied to a personal account.**
(OIDC was considered but doesn't apply here — it authenticates to
*external* services like cloud/npm trusted-publishing, not
GitHub-internal PR/push operations.)
## Required setup before this lands
Create a **GitHub App** (org-owned), installed on this repo, with
repository permissions:
- **Contents: Read & write**
- **Pull requests: Read & write**
Then add two repo secrets:
- `RELEASE_BOT_APP_ID` — the App's ID
- `RELEASE_BOT_APP_PRIVATE_KEY` — a generated private key (full PEM)
Once those exist, the next push to `next` with pending changesets will
regenerate the "Release: update version" PR correctly. `CI_BOT_TOKEN`
can then be deleted.
## Out of scope / follow-up
`docs.sync-connect-clients.yml` also uses `CI_BOT_TOKEN` (as
`GH_TOKEN`). It can be migrated to the same App token in a follow-up;
left untouched here to keep this focused on the release pipeline.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
- Pin every remote GitHub Action used by `.github/workflows` and
`.github/actions` to a full 40-character commit SHA with a version
comment.
- Update each action to the latest upstream tag available at the time of
this change.
- Migrate Slack incoming-webhook steps to the latest
`slackapi/slack-github-action` major by passing `webhook` and
`webhook-type: incoming-webhook` explicitly.
- Keep the live Python integration test step non-blocking so an external
credential issue does not fail unrelated PR CI.
## Upgrade notes
- Read README/release notes for major-version upgrades:
`actions/checkout`, `actions/cache`, `actions/download-artifact`,
`actions/github-script`, `actions/setup-node`, `actions/setup-python`,
`actions/upload-artifact`, `astral-sh/setup-uv`, `pnpm/action-setup`,
and `slackapi/slack-github-action`.
- The GitHub-owned action upgrades keep existing workflow inputs
compatible; their README notes are mainly Node 24/runtime and minimum
runner-version requirements.
- `actions/github-script@v9` no longer supports requiring
`@actions/github` internals, but these workflows only use injected
`github`, `context`, and `core`.
- `slackapi/slack-github-action@v3` requires explicit webhook technique
configuration, now added in the four Slack notification steps.
## Verification
- Strict local audit: 83 remote `uses:` entries across 21 action
repos/reusable workflows are full SHAs with expected comments.
- Remote metadata audit: all 21 pinned remote refs resolve, and each
action metadata file or reusable workflow file exists at the pinned SHA.
- `.github/scripts/check-action-repos.sh`
- `ruby -e 'require "yaml"; Dir[".github/workflows/*.{yml,yaml}",
".github/actions/**/*.yml", ".github/actions/**/*.yaml"].each { |f|
YAML.load_file(f); puts "ok #{f}" }'`
- `git diff --check`
- `go run github.com/rhysd/actionlint/cmd/actionlint@latest -shellcheck=
-pyflakes= -ignore 'label "depot-ubuntu-[^\"]+" is unknown'`
`actionlint` without the ignore only reports the existing custom Depot
runner labels in `cli.test-installation.yml`.
## Summary
- Re-apply the Algolia docs search migration after the previous PR was
merged and reverted.
- Keep the existing Fumadocs search UI while using Algolia API when
search keys are configured, with `/api/search` fallback for local
development and tests.
- Add a first-party Algolia index builder/sync script that creates
section-sized docs records from MDX/OpenAPI/toolkit/changelog content,
configures index relevance settings, and replaces index objects without
relying on Algolia Crawler.
- Add Algolia Insights view/click events and a terminal search relevance
test script.
- Clean search breadcrumbs so results show labels like `Toolkit` and
`Cookbook` instead of duplicated `toolkits > Gmail` formatting.
## Tests
- `cd docs && bun run types:check`
- `cd docs && bun run sync:search --dry-run`
- `cd docs && bunx eslint components/custom-search-dialog.tsx
lib/search-index.ts scripts/sync-algolia-search.ts
scripts/test-algolia-search.ts`
## Notes
- Live Algolia sync requires `ALGOLIA_ADMIN_API_KEY`.
- Live search relevance tests require `ALGOLIA_SEARCH_API_KEY` or
`NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY`.
## Summary
- Switch docs search dialog to Algolia when public Algolia env vars are
configured, with local `/api/search` fallback for development/tests
- Add a shared docs search index builder plus `bun run sync:search` to
publish records to Algolia
- Add a GitHub Actions workflow to dry-run and sync the Algolia index on
`next` docs changes when secrets are configured
- Document required Algolia env vars and sync command
## Tests
- `cd docs && bun run types:check`
- `cd docs && bun run sync:search --dry-run`
- `cd docs && bun test tests/static/`
- `cd docs && bunx eslint components/custom-search-dialog.tsx
lib/search-index.ts scripts/sync-algolia-search.ts`
- `cd docs && bun run build`
## Notes
- `bun run lint` still fails on existing unrelated repo-wide lint errors
in files outside this change (for example `app/global-error.tsx`,
`components/ask-ai-button.tsx`, `components/version-selector.tsx`). The
changed search files pass targeted ESLint.
- Production search requires `NEXT_PUBLIC_ALGOLIA_APP_ID`,
`NEXT_PUBLIC_ALGOLIA_SEARCH_API_KEY`, and optionally
`NEXT_PUBLIC_ALGOLIA_INDEX_NAME` (default `composio_docs`). Index
syncing requires `ALGOLIA_APP_ID`/`ALGOLIA_ADMIN_API_KEY` secrets.
## Summary
- Remove darwin-x64 from local toolkit platform lists (beeper-imessage,
peekaboo, chrome-devtools) and drop the corresponding bundled binary
path entries.
- Skip building native Swift sidecar binaries (peekaboo, imessage-cli,
composio-native-ui) for darwin-x64; remove the bun-darwin-x64 matrix
entry from `build-cli-binaries.yml` so we no longer produce a darwin-x64
CLI bundle.
- Locally force-disable enhanced controls / elicitation on darwin-x64 in
`tool-permissions.ts` even when the backend opts the org in (logs a
debug message).
## Test plan
- [x] `pnpm --filter @composio/cli typecheck`
- [x] `pnpm --filter @composio/cli-local-tools typecheck`
- [ ] CI green on the build workflow (no darwin-x64 job runs)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Scaffold a macOS Swift `composio-native-ui` sidecar with a borderless
floating native overlay and Metal-driven pulsing/liquid-glass visual
treatment.
- Add a hidden/dev `composio dev native-ui` command that spawns the
bundled sidecar from CLI local-tool assets.
- Wire the sidecar into local-tool binary build scripts and CLI binary
release packaging checks for Darwin artifacts.
## Tests
- `pnpm install --frozen-lockfile`
- `pnpm typecheck`
- `pnpm --filter @composio/cli build`
- `pnpm --filter @composio/cli-local-tools build:composio-native-ui --
--target darwin-arm64`
- Manual launch via
`COMPOSIO_LOCAL_TOOLS_BIN_DIR=../cli-local-tools/local-tools-binaries
bun dist/bin.mjs dev native-ui --timeout 35`
## Notes / Risks
- This is a scaffold/prototype and is intentionally opened as a draft
PR.
- The visual effect uses a transparent AppKit panel,
`NSVisualEffectView`, and a Metal overlay. True optical distortion of
arbitrary content behind the window would require a different approach
such as ScreenCaptureKit/backdrop sampling and associated permissions.
- Generated sidecar executables remain ignored; release jobs rebuild
them before packaging artifacts.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Resolve the default CLI install version from GitHub Releases instead
of git tags.
- Require the selected CLI release to include the current platform
archive asset and fall back to older stable CLI releases when the newest
release is missing that asset.
- Add a mocked install.sh regression test covering missing release
assets, ignored beta/provider releases, and tag-only versions with no
release.
## Tests
- `bash -n install.sh test/install-sh-release-resolution.test.sh`
- `pnpm run test:install-sh`
- `git diff --check`
- Parsed `.github/workflows/cli.test-installation.yml` with Ruby YAML
- Parsed `package.json` with Node JSON.parse
- Manual real install smoke test with temporary
HOME/COMPOSIO_INSTALL_DIR selected `@composio/cli@0.2.28`
## Notes
- This prevents the install health check from selecting tag-only
versions like `@composio/cli@0.2.29` when no GitHub release/asset exists
yet.
## Summary
- Broaden the Beeper iMessage macOS build patch so BetterSwiftAX
`kAX...` constants compile on GitHub `macos-15`/`macos-15-intel`.
- Pin the fixed `platform-imessage` submodule source and add Swift 6.2 /
Peekaboo dependency patching for the CLI binary workflow.
- Package and verify macOS local-tool sidecars plus `release-tag.txt` in
CLI release zips.
- Fix installed beta metadata/upgrade behavior so `--version`, update
checks, and beta-default experimental flags use the installed release
tag.
- Let `LOCAL_*` execution bypass remote auth/project/schema validation.
- Add runtime self-heal for missing installed `local-tools-binaries`: if
an old upgrader installs the fixed beta binary without sidecars, first
local-tool execution downloads the matching release zip, verifies
checksum when available, and restores the sidecars.
## Validation
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build:binary`
- Targeted CLI tests for execute/config/upgrade/version/update-check
paths.
- Packaged binary smoke test confirmed bundled Beeper sidecar works.
- Repair smoke test: copied only the new `composio` binary plus
`release-tag.txt` into a temp install with no `local-tools-binaries`;
`execute LOCAL_BEEPER_IMESSAGE_VERSION -d '{}'` restored sidecars from
`@composio/cli@0.2.29-beta.235` and succeeded.
## Release workflow
- Beta build run `25405049712` succeeded for commit
`9d0910c909b7b257d0f17b6d082980952d1e6c59` and published
`@composio/cli@0.2.29-beta.235`.
- This PR now includes one follow-up commit (`2c32cff4c`) to cover the
old-upgrader/missing-sidecars incremental upgrade path; normal branch CI
and beta build run `25406984535` are running again.
## Summary
- Add experimental CLI local tools behind `local_tools` (beta-on,
stable-off unless `composio config experimental local_tools on`).
- Add reusable `@composio/cli-local-tools` package: declarations,
metadata, readiness, command/MCP/native/FFI runtimes, bundled-binary
resolution, and Tool Router search/execute/schema integration.
- Add first-class local toolkits for:
- `BEEPER_IMESSAGE` backed by `imessage-cli` from the ComposioHQ
`platform-imessage` fork.
- `CHROME_DEVTOOLS` backed by the official `chrome-devtools-mcp@0.24.0`
npm/npx package.
- `PEEKABOO` backed by upstream Peekaboo CLI.
- Remove generated native executables from git: Beeper and Peekaboo
binaries are now ignored, pinned via git submodules, and generated
during CLI binary release jobs.
- Update CLI binary workflow so Linux artifacts skip native sidecars,
while macOS artifacts run on macOS runners and build only the matching
`darwin-x64` or `darwin-arm64` Beeper/Peekaboo sidecars before
packaging.
## Native binary policy
- No generated `imessage-cli` or `peekaboo` binary blobs are committed
in this PR history.
- Beeper source is pinned as
`ts/packages/cli-local-tools/vendor/platform-imessage` at
`364445a1b3089ad9fe293d5951efe160c5677c42` from
`https://github.com/ComposioHQ/platform-imessage`.
- Peekaboo source is pinned as
`ts/packages/cli-local-tools/vendor/peekaboo` at
`31e66e8d02656141d18f60bf3b46b24c2b9bc785` from
`https://github.com/steipete/Peekaboo`.
- Build commands:
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-x64`
- Chrome DevTools is an npm/npx integration and is pinned as a dev
dependency (`chrome-devtools-mcp@0.24.0`) instead of using native
sidecars.
## Validation
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `COMPOSIO_REAL_LOCAL_TOOLS_TESTS=1 pnpm --filter
@composio/cli-local-tools test -- src/toolkits/beeper-imessage.test.ts
src/toolkits/peekaboo.test.ts`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build`
- `COMPOSIO_CACHE_DIR=<tmp-config-with-local_tools-enabled> bun
ts/packages/cli/dist/bin.mjs local-tools doctor --json`
- `pnpm turbo build`
- Verified rewritten branch has no >1MB objects relative to
`origin/next` and no native executable paths in the PR diff.
## Notes / risks
- Beeper iMessage and Peekaboo are macOS-only and depend on local
permissions.
- Peekaboo requires macOS 15+; GUI tools require Screen Recording,
Accessibility, and sometimes Automation.
- Beeper send/reaction behavior can still depend on upstream Messages
automation reliability.
- Chrome DevTools can inspect/modify browser contents; avoid sensitive
browser sessions.
## Summary
- Update issue triage classifier guidance so hosted integration/tool
bugs that are not SDK/CLI/docs/Python code defects route to `support`.
- Add GitHub #3291 / `SPOTIFY_GET_PLAYLIST_ITEMS` as an explicit example
that should be `support` + bug and forwarded to Plain.
- Clarify broken existing tools are never `tool-request`, and should
route to Plain when they need backend/tool-catalog/support follow-up.
## Tests
- `ruby -e "require 'yaml'; data =
YAML.load_file('.github/workflows/issue-triage.yml'); abort 'bad name'
unless data['name'] == 'Issue Triage'; puts 'YAML OK'"`
## Notes
- The existing workflow already forwards `support` issues to Plain; this
change makes the classifier choose that path for non-SDK hosted tool
bugs.
## Summary
- add a `support` triage category for product/support/configuration
issues that are not SDK bugs
- avoid applying `bug`/`ts` labels or assigning Alberto for
support-classified issues
- create/use a `support` GitHub label and forward support issues to
Plain via the GraphQL API when `PLAIN_API_KEY` is configured
## Tests
- `ruby -e 'require "yaml";
YAML.load_file(".github/workflows/issue-triage.yml"); puts "yaml
ok"'`\n- `git diff --check`\n\n## Notes\n- Plain forwarding uses
`secrets.PLAIN_API_KEY` and optional `vars.PLAIN_SUPPORT_EMAIL`
(defaults to `github-support@composio.dev`).\n- `actionlint` was not
installed locally, so workflow syntax validation was limited to YAML
parsing.
## Summary
- Normalize triage output so bug reports are never classified as
`tool-request`.
- Treat broken existing integrations or tools as bugs instead of new
integration requests.
- Preserve existing label, assignee, and auto-close behavior for genuine
tool requests.
## Testing
- Not run (workflow-only change).
- Reviewed the updated triage logic to confirm bug reports fall back to
`other` when the classifier emits `tool-request`.
- Verified the issue comment and close-path behavior remain unchanged
for valid tool requests.
## Summary
- Adds `decimal-pr-bot[bot]`, `github-actions[bot]`, `dependabot[bot]`,
and `zen-agent` to `allowed_bots` in both `.github/workflows/claude.yml`
and `.github/workflows/claude-code-doc-review.yml`.
- So Claude review runs on PRs opened by our CI bots (docs/SDK
auto-update, dep bumps) and by the decimal and zen agents.
Motivation: #3224 (decimal-pr-bot) did not get a Claude review because
it wasn't in the allowlist.
## Test plan
- [ ] Merge and confirm Claude review fires on the next
`github-actions[bot]` docs-update PR.
- [ ] Retrigger Claude on #3224 (or wait for the next decimal-pr-bot PR)
and confirm it runs.
- [ ] Confirm it runs on the next dependabot PR.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
- Add a new GitHub issue triage workflow that classifies incoming issues
with Claude Sonnet into `docs`, `py`, `ts`, `cli`, `tool-request`, or
`other`.
- Automatically applies labels and assignees for the matching area, and
closes `tool-request` issues after posting a redirect comment.
- Update `CODEOWNERS` to reflect current ownership for docs, TS, and
Python.
- Tighten the stale workflow messaging and close issues immediately
after the stale period.
## Testing
- Not run (workflow and config changes only).
- Verified the new workflow YAML is syntactically structured and uses
strict JSON classification output.
- Reviewed the stale workflow diff to confirm the stale/close timing and
message text changes.
macOS runners ship bash 3.2 which lacks mapfile, causing
"command not found" failures in the bundled support files test.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- Add a generated `composio-cli` skill source that can render stable and
beta variants from a single channel-aware definition.
- Introduce build and validation scripts to generate the skill output
and verify channel-specific content, references, and reproducibility.
- Update the CLI packaging workflow to validate skills and package the
correct release-channel build for beta vs stable releases.
- Expand the skill content with clearer top-level CLI guidance,
troubleshooting, developer-project workflows, and beta-only power-user
examples.
- Tighten CLI install/upgrade behavior and add tests covering skill
installation behavior.
- Add example validation to the repo test flow and align example package
metadata with workspace expectations.
## Testing
- Not run locally.
- Added `ts/packages/cli/scripts/validate-skills.ts` checks for
stable/beta markers, channel-specific content, and required reference
files.
- Added `ts/packages/cli/test/src/effects/install-skill.test.ts`
coverage for skill installation behavior.
- Added `ts/scripts/validate-examples.ts` to validate example package
manifests during `pnpm test`.
- CI workflow now runs `pnpm run validate:skills` before packaging CLI
skill files.
## Summary
- Adds a persisted CLI user config file for experimental feature flags,
artifact directory overrides, and experimental subagent target
selection.
- Wires config-aware command visibility into root command construction,
help text, and validation error handling so experimental commands only
appear when enabled.
- Updates runtime helpers and session artifact resolution to honor the
new CLI config values.
- Expands installation workflow checks and adds tests for the new CLI
config service.
## Testing
- `pnpm test ts/packages/cli/test/src/services/cli-user-config.test.ts`
- `pnpm test ts/packages/cli/test/src/commands/$default.cmd.test.ts`
- Not run: full repo test suite
- Not run: install workflow end-to-end in this environment
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- **Auto-beta on push to `next`**: any merge touching
`ts/packages/cli/**` automatically builds binaries and creates a
`@composio/cli@X.Y.Z-beta.<run_number>` prerelease. Version = latest
stable + patch bump.
- **Stable on version bump**: if `ts/packages/cli/package.json` version
changed in the push commit (i.e. changeset "Release: update version"
merge), creates a stable release instead.
- **`workflow_dispatch` build-beta**: build a beta from any branch on
demand.
- **`workflow_dispatch` promote-stable**: promote an existing beta tag
to stable (unchanged).
- Removes the old PR-title-gated flow (`pull_request` trigger with title
check).
## Test plan
- [ ] Merge into `next` with a CLI change → verify beta release is
created
- [ ] Trigger `workflow_dispatch` with `build-beta` on a feature branch
→ verify beta release
- [ ] Merge a changeset "Release: update version" PR → verify stable
release is created
- [ ] Trigger `workflow_dispatch` with `promote-stable` + existing beta
tag → verify stable release
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When triggered by repository_dispatch, github.actor is a bot that
can't be added as a reviewer, causing the workflow to fail. Fall back
to adding Sushmithamallesh and use continue-on-error so the workflow
always succeeds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The indented PY heredoc delimiters weren't matched because <<'PY'
requires an unindented terminator. Replace with python3 -c one-liners.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- Add support for beta CLI releases in the binary publish workflow,
including beta tag validation and promotion to stable from an existing
prerelease tag.
- Update `composio upgrade` to support a `--beta` flag that stays on the
prerelease channel.
- Refresh release documentation and CLI README to describe the new
beta/stable release model.
- Expand upgrade binary tests to cover prerelease resolution and
channel-specific behavior.
## Testing
- Not run (PR content generation only).
- Checked the workflow and CLI changes for beta/stable tag handling
paths.
- Reviewed updated release documentation for the new promotion flow.
## Summary
- replace runtime MCP SDK path resolution with static imports in the
structured-output helper
- ensure the helper works when shipped next to the standalone CLI binary
without repo-local node_modules
## Verification
- pnpm --filter @composio/cli run typecheck:src
- pnpm --filter @composio/cli test
test/src/services/run-subagent-acp.test.ts
- built and executed the bundled helper from a temp directory outside
the repo
## What changed
- make `build:binary:cross` emit the `run-subagent-*.mjs` companion
modules alongside the compiled CLI binary
- update the `Build CLI Binaries` workflow to include those companion
modules in the published release archives
- make `install.sh` copy companion modules when they are present, while
remaining backward compatible with older archives that only contain
`composio`
- fix the CLI installation workflow assertions to match the actual
installer behavior and paths
## Why
`composio run` launches a separate Bun runtime that imports the
`run-subagent-*` helpers from disk. The main binary alone is not
sufficient. The previous release workflow zipped only the `composio`
binary, so prerelease assets installed successfully but failed at
runtime with missing-module errors.
The installation test workflow also had stale expectations for
`~/.composio/bin/composio` and `COMPOSIO_INSTALL`, which caused false
negatives even when installation itself succeeded.
## Impact
- newly built CLI release assets will contain the files required for
`composio run`
- `install.sh` will install sidecars for new releases and ignore them
for older releases
- the installation workflow will validate the real install layout
instead of the stale `bin/` path
## Validation
- `pnpm --filter @composio/cli run build:binary:cross --target
bun-darwin-arm64` from the existing checkout emitted:
- `dist/binaries/composio-darwin-aarch64`
- `dist/binaries/companions/run-subagent-shared.mjs`
- `dist/binaries/companions/run-subagent-acp.mjs`
- `dist/binaries/companions/run-subagent-legacy.mjs`
- simulated the GitHub Actions archive step and verified the zip
contains `composio` plus all three companion modules
- earlier local binary/package validation on the main fix branch
confirmed the extracted binary runs `composio run
'console.log("hello")'` successfully once those files are packaged
## Summary
- **Skill installer**: New `installSkill` effect that downloads and
installs the `composio-cli` skill for Claude Code during `composio
login`. Downloads `composio-skill.zip` from the matching GitHub release,
extracts to `~/.agents/skills/composio-cli/`, and creates a symlink at
`~/.claude/skills/composio-cli`. Non-fatal — wrapped in
`installSkillSafe` so failures don't block login. Adds
`--no-skill-install` flag to skip.
- **Root help improvements**: Added `composio files` subcommand help,
richer examples (multi-query search, parallel execute, multi-step `run`
scripts), and inline FILES section in main help output.
- **Contextual help on errors**: When a CLI command fails or receives
unknown arguments, the relevant subcommand help text is now printed
alongside the error message.
- **Session artifacts hardening**: `resolveArtifactsRoot()` now respects
`COMPOSIO_SESSION_DIR` / `COMPOSIO_CACHE_DIR` env vars and falls back to
`os.tmpdir()`. All filesystem operations (mkdirSync, appendFileSync,
writeFileSync) are wrapped in try/catch to avoid crashes in sandboxed
environments.
- **Analytics dir creation**: Wrapped `mkdirSync` for the analytics
directory in try/catch (non-fatal in sandboxed environments).
- **Consumer cache hardening**: Added error handling for cache
read/write in sandboxed environments.
- **FetchHttpClient layer**: Added `FetchHttpClient.layer` to production
layers so `installSkill` HTTP requests work correctly.
- **Symlink fix**: Fixed stale/broken symlink handling in
`install-skill.ts` — uses `lstatSync` instead of `existsSync` to
correctly detect and remove broken symlinks and directories.
- **TS fix**: Changed `detectMaster` parameter type from
`NodeJS.ProcessEnv` to `Record<string, string | undefined>` to avoid
type conflict from bun env augmentation.
- **Cleanup**: Removed accidentally committed `workdir/temp.md`.
## Test plan
- [ ] `composio login` installs skill to
`~/.agents/skills/composio-cli/` and creates symlink at
`~/.claude/skills/composio-cli`
- [ ] `composio login --no-skill-install` skips skill installation
- [ ] `composio --help` shows updated examples and FILES section
- [ ] Passing an unknown flag to a command prints contextual help
alongside error
- [ ] CLI works in sandboxed environments where `$TMPDIR` or
`~/.composio/` may not be writable
- [ ] `pnpm typecheck` passes with no errors
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Alberto Schiabel