## Summary
Permanently stops the recurring *"release published with zero assets →
install/upgrade 404s"* outage
(https://github.com/ComposioHQ/composio/issues/3408,
https://github.com/ComposioHQ/composio/issues/3269; regressions of
https://github.com/ComposioHQ/composio/issues/2625 and
https://github.com/ComposioHQ/composio/issues/1820 — 3 of the last 5
stable releases shipped empty).
**Root cause:** a concurrent-writer race. On a CLI version bump,
`changesets/action` creates an empty `@composio/cli@x.y.z` GitHub
Release in seconds, then the slower `build-cli-binaries.yml` fails its
`gh release create` because the release already exists — so binaries
never attach.
> 🥞 **Stacked on #3415** (`pi/exclude-cli-ts-release-42161920`), which
removes the *second writer* (changesets no longer creates CLI releases).
Review/merge #3415 first; this PR targets that branch. This PR hardens
the now-sole writer so a *partial* build can't publish either, and fixes
the monitoring that hid the failure.
## What changed (`build-cli-binaries.yml` + canary)
- **Draft → verify → publish.** The release is built as a **draft**,
then a gate asserts all 6 canonical assets are present **and** `state ==
"uploaded"` (loud `::error::` + fail otherwise), and only the final step
flips it to published. Drafts fire no `release: published` event and are
excluded from `/releases/latest`, so no install.sh / Homebrew / redirect
consumer can observe an incomplete release.
- **`fail-fast: false`** on the build matrix → a single platform failure
can never publish a partial set (`needs.build.result` is `success` only
if all legs pass).
- **Per-tag job-level `concurrency`** so re-runs / quick pushes can't
interleave uploads on the same tag, without serializing unrelated betas.
- **Beta-safe:** `--prerelease` is set on the draft so betas stay
prereleases through the publish flip.
- **`promote-stable` guard** uses `gh release view --json isDraft` (the
REST tags endpoint 404s on drafts) to resume an existing draft but
refuse an already-published tag.
- **Least privilege:** workflow defaults to `contents: read`; only the
release job opts up to `contents: write`.
- **Canary fix** (`cli.install-health-check.yml`): install the newest
stable **pinned** tag (`npm view @composio/cli version`) instead of the
asset-aware no-arg flow, which self-heals to the last good release and
kept the canary green through every outage.
## Idempotency note
Re-running a run that failed **before publish** is safe (reuse draft +
`--clobber`). An already-**published** tag is refused, not mutated — by
design.
## Testing
- Extended `test/release-workflow.test.ts` (run via `pnpm
test:release-workflow`) to lock in: draft→verify→publish ordering,
`fail-fast: false`, per-tag concurrency, preserved `--prerelease`, and
the pinned-tag canary. ✅ passes.
- `shellcheck` clean on the new `run:` scripts; YAML validated.
`actionlint` runs in CI.
- Runtime verification of the full green path happens on the next
release CI run.
## Out of scope (deferred to their own PRs)
Per reviewer consensus, these are real but *not this bug*: a per-release
npm↔GitHub asset auditor (needs a grace window), the Homebrew trigger
constraint (folds into #3355), `composio upgrade` missing-asset back-off
(https://github.com/ComposioHQ/composio/issues/3269), and a rollback
runbook.
---------
Co-authored-by: Rahul Tarak <cryogenicplanet@gmail.com>
This PR:
- closes#3502
- extracts the useful dependency and Cloudflare config slice from
https://github.com/ComposioHQ/composio/pull/3503 onto a clean `next`
branch
- upgrades `vitest` and `@vitest/ui` through the workspace catalog to
resolve the critical advisory
- switches the Mastra provider test dependency back to the catalog
- migrates the Cloudflare Worker Vitest configs to the
`cloudflareTest()` plugin API
- preserves existing `COMPOSIO_BASE_URL` bindings that were dropped in
#3503
- keeps Vitest 4 compatibility fixes scoped to constructor mocks, spy
cleanup, and temp-root project detection
- leaves Node, `mise`, release docs, and Effect catalog versions
unchanged; the commit includes @Dotify71 as `Co-authored-by`
Co-authored-by: Dushyant Acharya <dushyantacharya873@gmail.com>
## Summary
This PR starts Phase 1 of PLEN-1368 by adding `mise.toml` as the
repo-owned source for the primary toolchain versions:
- Node `20.20.2`
- Bun `1.3.10`
- Deno `2.6.7`
- Python `3.12`
- uv `0.8.19`
It also keeps pnpm corepack-driven through
`package.json#packageManager`, adds `devEngines` for Node/pnpm
visibility, documents the new `mise install && corepack enable && pnpm
install` bootstrap path, ignores `.mise.local.toml`, and fixes stale
release-doc prerequisites.
## Why
The repo already has real toolchain drift, not just duplicated version
strings. The internal release docs had stale Node/Bun/pnpm versions,
Deno is repeated across workflows, Dockerfiles, docs, and e2e helpers,
and Python local setup still has a separate `3.11` venv path while the
repo pins `3.12`.
A composite-action cleanup would improve CI, but it would not solve
local development. `mise.toml` gives us one file that declares the
versions and lets contributors install or switch them with one command.
That is the main value proposition here: make the repo declare its own
toolchain, then let CI consume the same declaration in the next phase.
## Rollout
This is deliberately additive. It does not remove `.nvmrc`,
`.bun-version`, `.python-version`, or `.dvmrc`, and it does not change
CI behavior yet. Contributors who do not use mise can keep working as
before; contributors who do use mise get managed Node/Bun/Deno/Python/uv
immediately.
Phase 2 can migrate the existing composite actions to
`jdx/mise-action@v4`. Phase 3 can remove the legacy version files and
add the lockfile once the transition is complete.
## Out of Scope
- Migrating CI to `jdx/mise-action@v4`
- Removing legacy version files
- Adding `mise.lock`
- Updating nested TS package/example `packageManager` fields that still
say `pnpm@10.28.0`; that is pre-existing metadata drift and should be
handled separately to avoid broadening Phase 1
## Verification
- `git diff --check origin/next...HEAD`
- `mise install && mise current`
- `pnpm --version` -> `10.28.2`
- `pnpm dlx prettier@3.8.1 --check package.json`
Refs: PLEN-1368
## Summary
- Resolve the default CLI install version from GitHub Releases instead
of git tags.
- Require the selected CLI release to include the current platform
archive asset and fall back to older stable CLI releases when the newest
release is missing that asset.
- Add a mocked install.sh regression test covering missing release
assets, ignored beta/provider releases, and tag-only versions with no
release.
## Tests
- `bash -n install.sh test/install-sh-release-resolution.test.sh`
- `pnpm run test:install-sh`
- `git diff --check`
- Parsed `.github/workflows/cli.test-installation.yml` with Ruby YAML
- Parsed `package.json` with Node JSON.parse
- Manual real install smoke test with temporary
HOME/COMPOSIO_INSTALL_DIR selected `@composio/cli@0.2.28`
## Notes
- This prevents the install health check from selecting tag-only
versions like `@composio/cli@0.2.29` when no GitHub release/asset exists
yet.
# Description
Bumps the `packageManager` pin from `pnpm@10.28.0` to `pnpm@10.28.2`,
the smallest release that fixes
[**CVE-2026-24056**](https://nvd.nist.gov/vuln/detail/CVE-2026-24056) —
a symlink
attack in pnpm where installing a malicious `file:` (directory) or
`git:`
dependency that contains a symlink to an absolute path causes pnpm to
copy that target file's contents (e.g. `~/.ssh/id_rsa`, `/etc/passwd`)
into `node_modules`, enabling local data exfiltration on developer
machines and CI runners.
Practical risk for this repo is **LOW** — we only install
registry-pinned dependencies with `minimumReleaseAge: 4320` (72-hour
cooldown) configured in `pnpm-workspace.yaml`, so the attacker would
need a malicious package to (a) be added as a dependency, and (b) sit
unnoticed for 72h. The fix is nevertheless a one-line defensive bump
that aligns this repo with the rest of the monorepo:
| repo | pnpm version | status |
|--------------------|-------------|--------|
| hermes | `10.33.0` | safe |
| composio_dashboard | `10.28.2` | safe |
| frontend | `10.28.2` | safe |
| **composio (this PR)** | `10.28.0` -> `10.28.2` | **fix** |
| metrics.composio.io | `10.18.2` | flagged separately (no CI) |
Discovered during the daily Zen security audit cron.
# How did I test this PR
- Diff is a single character bump (`10.28.0` -> `10.28.2`) in
`package.json` `packageManager`. No code, lockfile, or workflow
changes — `pnpm install` will simply use the newer pnpm via Corepack.
- Verified `composio_dashboard` and `frontend` already pin
`pnpm@10.28.2`
successfully across their CI workflows.
- No GHA file modified, so the pnpm-version reference in
`ts/docs/internal/release.md` (per `CLAUDE.md` maintenance task) does
not need to be updated by this PR.
---
Triggered by: dhawal@composio.dev | Source: cron-48e51eab745f
Session:
https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-16acec0fd729
Origin: cron-48e51eab745f /
[zen-cron-16acec0fd729](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-16acec0fd729)
## Summary
- Add experimental CLI local tools behind `local_tools` (beta-on,
stable-off unless `composio config experimental local_tools on`).
- Add reusable `@composio/cli-local-tools` package: declarations,
metadata, readiness, command/MCP/native/FFI runtimes, bundled-binary
resolution, and Tool Router search/execute/schema integration.
- Add first-class local toolkits for:
- `BEEPER_IMESSAGE` backed by `imessage-cli` from the ComposioHQ
`platform-imessage` fork.
- `CHROME_DEVTOOLS` backed by the official `chrome-devtools-mcp@0.24.0`
npm/npx package.
- `PEEKABOO` backed by upstream Peekaboo CLI.
- Remove generated native executables from git: Beeper and Peekaboo
binaries are now ignored, pinned via git submodules, and generated
during CLI binary release jobs.
- Update CLI binary workflow so Linux artifacts skip native sidecars,
while macOS artifacts run on macOS runners and build only the matching
`darwin-x64` or `darwin-arm64` Beeper/Peekaboo sidecars before
packaging.
## Native binary policy
- No generated `imessage-cli` or `peekaboo` binary blobs are committed
in this PR history.
- Beeper source is pinned as
`ts/packages/cli-local-tools/vendor/platform-imessage` at
`364445a1b3089ad9fe293d5951efe160c5677c42` from
`https://github.com/ComposioHQ/platform-imessage`.
- Peekaboo source is pinned as
`ts/packages/cli-local-tools/vendor/peekaboo` at
`31e66e8d02656141d18f60bf3b46b24c2b9bc785` from
`https://github.com/steipete/Peekaboo`.
- Build commands:
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-x64`
- Chrome DevTools is an npm/npx integration and is pinned as a dev
dependency (`chrome-devtools-mcp@0.24.0`) instead of using native
sidecars.
## Validation
- `pnpm --filter @composio/cli-local-tools build:local-tool-binaries --
--target darwin-arm64`
- `pnpm --filter @composio/cli-local-tools build:peekaboo -- --target
darwin-x64`
- `pnpm --filter @composio/cli-local-tools build:beeper-imessage --
--target darwin-x64`
- `pnpm --filter @composio/cli-local-tools typecheck:tsc`
- `pnpm --filter @composio/cli-local-tools test`
- `COMPOSIO_REAL_LOCAL_TOOLS_TESTS=1 pnpm --filter
@composio/cli-local-tools test -- src/toolkits/beeper-imessage.test.ts
src/toolkits/peekaboo.test.ts`
- `pnpm --filter @composio/cli typecheck:tsc`
- `pnpm --filter @composio/cli build`
- `COMPOSIO_CACHE_DIR=<tmp-config-with-local_tools-enabled> bun
ts/packages/cli/dist/bin.mjs local-tools doctor --json`
- `pnpm turbo build`
- Verified rewritten branch has no >1MB objects relative to
`origin/next` and no native executable paths in the PR diff.
## Notes / risks
- Beeper iMessage and Peekaboo are macOS-only and depend on local
permissions.
- Peekaboo requires macOS 15+; GUI tools require Screen Recording,
Accessibility, and sometimes Automation.
- Beeper send/reaction behavior can still depend on upstream Messages
automation reliability.
- Chrome DevTools can inspect/modify browser contents; avoid sensitive
browser sessions.
Bumps the `packageManager` pin from `pnpm@10.28.0` to `pnpm@10.28.2`,
which is the smallest release that fixes CVE-2026-24056 — a symlink
attack in pnpm where installing a malicious `file:` or `git:` dependency
that contains a symlink to an absolute path causes pnpm to copy the
target file's contents (e.g. `~/.ssh/id_rsa`, `/etc/passwd`) into
`node_modules`, enabling local data exfiltration on dev machines and CI
runners.
Practical risk for this repo is LOW (we only install registry-pinned
deps with `minimumReleaseAge: 4320`), but the fix is a one-line
defensive bump — keeps the SDK CI runners in line with the rest of the
monorepo (hermes already on 10.33.0; composio_dashboard / frontend
already on 10.28.2).
Origin: cron-48e51eab745f / [zen-cron-16acec0fd729](https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-16acec0fd729)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
## Summary
- Add a generated `composio-cli` skill source that can render stable and
beta variants from a single channel-aware definition.
- Introduce build and validation scripts to generate the skill output
and verify channel-specific content, references, and reproducibility.
- Update the CLI packaging workflow to validate skills and package the
correct release-channel build for beta vs stable releases.
- Expand the skill content with clearer top-level CLI guidance,
troubleshooting, developer-project workflows, and beta-only power-user
examples.
- Tighten CLI install/upgrade behavior and add tests covering skill
installation behavior.
- Add example validation to the repo test flow and align example package
metadata with workspace expectations.
## Testing
- Not run locally.
- Added `ts/packages/cli/scripts/validate-skills.ts` checks for
stable/beta markers, channel-specific content, and required reference
files.
- Added `ts/packages/cli/test/src/effects/install-skill.test.ts`
coverage for skill installation behavior.
- Added `ts/scripts/validate-examples.ts` to validate example package
manifests during `pnpm test`.
- CI workflow now runs `pnpm run validate:skills` before packaging CLI
skill files.
## Summary
- Add `tsgo`-based `typecheck` scripts and matching `typecheck:tsc`
fallback scripts across the TypeScript packages.
- Wire the new `typecheck:tsc` task into Turbo so package-level
typecheck checks can run consistently.
- Update workspace and lockfile metadata to include
`@typescript/native-preview` and the new toolchain wiring.
- Remove redundant `baseUrl` settings from package tsconfig files where
they are no longer needed.
## Testing
- Not run (changes are limited to package scripts, tsconfig wiring, and
lockfile updates).
- Not run: `pnpm typecheck:tsc`
- Not run: `pnpm build`
- Not run: package-specific `typecheck` / `typecheck:tsc` commands in
`ts/packages/cli`, `ts/packages/core`, `ts/packages/json-schema-to-zod`,
and `ts/packages/providers/mastra`.
- Add cross-compilation scripts (build-binary-cross.ts, build-all-binaries.ts)
using Bun's --target flag, enabling all platforms to build from ubuntu-latest
- Add package-binaries.ts and generate-checksums.ts for release artifact preparation
- Restructure CI workflow into build + release jobs; release job aggregates
artifacts and generates checksums.txt
- Simplify install.sh: use git ls-remote refspec filter for version detection,
add SHA-256 checksum verification with graceful fallback, use mktemp/trap
for temp file cleanup, remove dead musl detection code
- Add checksum verification to composio upgrade command via fetchChecksums
and verifyChecksum helpers in upgrade-binary.ts
Extend the e2e test infrastructure to support CLI runtime tests alongside
Node.js and Deno. Add a Dockerfile.cli that builds the composio binary
and runs it in a scratch Debian container. Include the first CLI e2e test
for `composio version` with file capture support.
- Add deprecation notices to fern/README.md and fern/CLAUDE.md
- Disable fern CI/CD workflows (publish_docs.yml, preview_docs.yml)
- Remove fern from pnpm workspaces
The new documentation is now in /docs built with Fumadocs.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Alberto Schiabel