mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
mcp-example@0.1.2
5111 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Kshitij Jhunjhunwala
|
c7bd7107ff |
feat(cli): install Claude and Codex plugins with composio setup (#3835)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3807 while preserving Kshitij's original commits and authorship - lets users configure the public Composio plugin for Claude Code, Codex, or every detected host with `composio setup` - centralizes host-specific commands, JSON keys, scope rules, and skill policy in a typed adapter map - requires explicit `--yes` approval outside an interactive terminal and keeps action-command stdout empty - accepts only canonical HTTPS marketplace sources, requires Claude's user-scoped plugin, and verifies a readable release-matched skill - preflights every selected host before mutation, reinstalls plugins after marketplace repair, and reports partial completion if a later host fails - fails closed on native inspection errors or malformed JSON and bounds host subprocesses to two minutes - verifies final native state so successful subprocess exits cannot masquerade as a ready setup - uses Effect filesystem and path services throughout the touched installer source and tests ## Validation - `pnpm typecheck`: 12 tasks passed across the TypeScript workspace - `pnpm --filter @composio/cli test`: 83 files passed; 760 tests passed; 1 skipped - focused installer regressions: 18 passed - focused ESLint, direct `node:fs` / `node:path` audit, and `git diff --check`: clean - Docker CLI E2E: Claude and Codex install once, remain idempotent on rerun, and fail clearly when no host is available ## Known release artifact The VHS recording remains deferred until the clean-home real-host smoke test because recording this workflow mutates external agent-host state. The deterministic Docker E2E covers the packaged CLI boundary in the meantime.@composio/cli@0.2.32-beta.288 |
||
|
Kshitij Jhunjhunwala
|
fb10f57ba7 |
feat(cli): install plugins from the CLI installer (#3840)
## Summary - run plugin setup automatically from the canonical `install.sh` flow after shell integration - configure every detected Claude Code and Codex host through the setup engine from #3835 - add `composio setup --if-present` so installer automation succeeds when no supported host is installed - support `--no-plugins` and `COMPOSIO_INSTALL_PLUGINS=0` as explicit opt-outs - fail visibly with an exact retry command when a detected host cannot be configured ## Stack This is a deliberately small follow-up to #3835 and targets `jk/cli-plugin-setup-review`. It should be rebased onto `next` after #3835 merges. ## Behavior The installer invokes the newly installed binary directly, so it does not depend on the current shell reloading `PATH`: ```bash "$exe" setup --target auto --yes --if-present ``` No detected host is a successful no-op. A detected host setup failure leaves the CLI installed but fails the installer with `composio setup --target auto --yes` as the retry path. ## Validation - install.sh release-resolution, automatic setup, opt-out, and setup-failure harness passed - focused setup suite: 25 tests passed - full CLI suite: 83 files passed; 761 tests passed; 1 skipped - direct CLI source and test typechecks passed - stable and beta skill validation passed - focused ESLint, shell syntax checks, and `git diff --check` passed - packaged setup E2E updated for the no-host installer path; local launch is blocked by missing `mise`, so scratch-container CI is the authoritative packaged check ## Recording No VHS recording: this is installer orchestration plus a non-interactive automation flag, covered at the shell-installer and packaged CLI boundaries. |
||
|
Kshitij Jhunjhunwala
|
cb75ddd02b | fix(cli): preserve unmanaged skills on uninstall | ||
|
Kshitij Jhunjhunwala
|
ca3b25d238 | fix(cli): approve all setup mutations | ||
|
Kshitij Jhunjhunwala
|
c8b1ddeb64 | fix(cli): confirm managed skill removal | ||
|
Kshitij Jhunjhunwala
|
692dec45e7 | fix(cli): preserve explicit setup PATH errors | ||
|
Kshitij Jhunjhunwala
|
f09141455c | fix(cli): require all explicit setup targets | ||
|
Kshitij Jhunjhunwala
|
82341643a4 | feat(cli): add plugin uninstall flow | ||
|
Kshitij Jhunjhunwala
|
b148eda4e6 | fix(cli): prompt only for missing plugins | ||
|
Kshitij Jhunjhunwala
|
b3b3f4efc0 | fix(cli): simplify plugin setup status | ||
|
Kshitij Jhunjhunwala
|
fb5e97749d | feat(cli): install detected agent plugins | ||
|
jkomyno
|
506c402e36 | test(cli): prove plugin setup idempotence | ||
|
Sarah Simionescu
|
b953eab001 | Merge branch 'next' into jk/cli-plugin-setup-review | ||
|
jkomyno
|
33b5a2a60a |
refactor(cli): use Effect platform for skill installs
Replace direct Node filesystem and path access throughout the touched installer paths and tests. Preserve cleanup and replacement guarantees with focused lifecycle coverage. |
||
|
jkomyno
|
a14ee316a6 | refactor(cli): use Effect filesystem for setup skill | ||
|
jkomyno
|
b6e7dc5e40 | fix(cli): preserve setup timeout failures | ||
|
jkomyno
|
42db6d13e1 |
fix(cli): simplify and harden plugin setup
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev> |
||
|
Aditya Painuli
|
1ea8ad9b3f |
docs: migrate AutoGen provider examples to ag2's LLMConfig API (#3833)
## Summary
The AutoGen provider examples still used the legacy
`llm_config={"config_list": [...]}` dict form, which ag2 0.14 (the
distribution `composio-autogen` depends on since #3729) only keeps for
backport compatibility and marks deprecated in
`LLMConfig.ensure_config`. The install command also pulled
`autogen-agentchat` (Microsoft's next-gen AutoGen package), which the
provider never imports, while the `ag2` distribution the examples
actually import from was only installed transitively.
Fixes #3831
## Changes
- `docs/content/docs/providers/autogen.mdx`: example migrated to
`LLMConfig({...})`, install line changed to `composio composio_autogen
ag2`, added `ag2` keyword and a one-line note that the provider runs on
the ag2 distribution
- `python/providers/autogen/README.md`: same quickstart and install
fixes
- `python/providers/autogen/autogen_demo.py`: same `LLMConfig` migration
`initiate_chat` is left as is: it isn't deprecated in ag2 0.14, and it's
the flow `register_tools` (caller/executor) is verified against.
## Type of change
- [ ] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [x] Documentation
- [ ] Breaking change
## How Has This Been Tested?
- Verified in a fresh venv with the local `composio` +
`composio-autogen` packages and `ag2==0.14.0`: the updated example
constructs both agents, wraps a Composio tool via `AutogenProvider`,
registers it with `register_tools`, and executes it through the
executor's function map
- `uv run nox -s chk` (ruff + mypy): green
- `ruff format --check providers/autogen/`: clean
- Docs: `bun run build` and `bun run lint:links` from `docs/`: green
## Screenshots (if applicable)
## Checklist
- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [x] I updated documentation as needed
- [ ] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages
## Additional context
No changeset added: docs and Python-only change, no published TypeScript
package affected. No tests added: example/docs change with no runtime
code paths; the updated example was exercised manually against ag2 0.14
as described above.
---------
Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
|
||
|
Alberto Schiabel
|
782f1df5c7 |
fix(ci): validate Python release metadata (#3824)
This PR: - validates Python package versions and release-note coverage before a `py@*` tag can build or publish artifacts - runs the existing repository release-workflow guard in the tag-release workflow - installs the pinned Node, pnpm, and Bun toolchain only for the metadata validation step - prevents a tag from publishing artifacts whose package, runtime, provider, or docs versions drift apart Validation: - `pnpm test:release-workflow` - `pnpm exec prettier --check .github/workflows/py.release.yml` |
||
|
Alberto Schiabel
|
c4071feab4 |
fix(py): guard URL uploads and redact telemetry (#3823)
This PR: - ports the TypeScript SDK's public-network guard to Python URL file uploads - rejects non-HTTP(S), private, loopback, link-local, reserved, and mixed DNS targets before a request is made - applies the guard to both `FileUploadable.from_url()` and Tool Router session-file URL uploads - redacts URL queries, Authorization credentials, and secret-like key/value pairs before error telemetry leaves the process - adds focused SSRF and redaction regressions alongside the existing file-upload coverage Validation: - `uv run --frozen pytest tests/test_url_safety.py tests/test_redaction.py tests/test_files.py -q` - `uv run --frozen ruff check …` - `uv run --frozen ruff format --check …` |
||
|
Kshitij Jhunjhunwala
|
b4dbab5060 | fix(cli): verify plugin setup state | ||
|
Kshitij Jhunjhunwala
|
3ae0f18b06 | fix(cli): honor packaged release tag in setup | ||
|
Kshitij Jhunjhunwala
|
28c9dd7dc7 | fix(cli): match setup skill to running release | ||
|
Kshitij Jhunjhunwala
|
b5af47c3a6 | Merge branch 'next' into kj/cli-plugin-setup | ||
|
Sarah Simionescu
|
1aa6a22d8a |
feat(cli): add --no-browser flag to link command (#3829)
## Summary Adds a `--no-browser` flag to `composio link` (and `composio dev connected-accounts link`) that skips auto-opening the browser and prints the authorization URL for the user to open manually, while still waiting for the connection to become `ACTIVE`. Previously the only way to suppress the browser auto-open was `--no-wait`, which also exits without waiting for authorization. `--no-browser` fills the gap for users (and remote/SSH sessions) who want to click the link themselves but still get the wait-for-ACTIVE confirmation — matching the existing `composio login --no-browser` behavior. ## Changes - New `--no-browser` boolean option on both the root `link` command and the `dev connected-accounts link` variant - `waitForActiveConnection` skips `open()` and tells the user to open the printed URL when the flag is set - The unmanaged-auth dashboard fallback (`ToolRouterV2_NoManagedAuth`) also respects the flag - Root help (`root-help.ts`) documents the new flag - Test: `link gmail --no-browser` waits for ACTIVE and never calls `open` No VHS recording added — this is a small flag addition to an existing command surface, not a new documented workflow. ## Verification - `pnpm typecheck` — passes - `pnpm --filter @composio/cli test` — 81 files, 725 tests pass 🤖 Generated with [Claude Code](https://claude.com/claude-code)@composio/cli@0.2.32-beta.287 |
||
|
Sarah Simionescu
|
ba999577d7 |
fix(cli): use manual authorization copy on link --no-wait paths
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Sarah Simionescu
|
aad2e9a2fd |
fix(cli): drop redirect copy when link runs with --no-browser
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
d583e7ef6f | fix(cli): harden plugin setup installation | ||
|
Sarah Simionescu
|
b003baaf1f |
feat(cli): add --no-browser flag to link command
Adds a --no-browser flag to `composio link` (and `composio dev connected-accounts link`) that prints the authorization URL instead of auto-opening the browser, while still waiting for the connection to become ACTIVE. Also respected on the unmanaged-auth dashboard fallback. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Kshitij Jhunjhunwala
|
f2beb2f259 | feat(cli): install agent plugins with composio setup | ||
|
Alberto Schiabel
|
fbcf08136d |
revert(core): defer v1 session alias removal (#3826)
This PR: - reverts https://github.com/ComposioHQ/composio/pull/3780 - restores the TypeScript `composio.create()` and `composio.use()` session aliases, with their runtime and type-test coverage - restores the prior deprecation state for `BaseProvider.wrapMcpServerResponse` - removes the pre-v1 breaking-change changeset so the release PR no longer advertises this removal The v1 API-freeze change should be recreated later as a draft PR and kept out of the merge queue until v1 is ready. |
||
|
jkomyno
|
d5c86d3d6b | fix(release): keep core pre-v1 | ||
|
Anas Khan
|
fa933a6f9b |
fix(ts): point published package homepage links at the next branch (#3821)
```markdown The `homepage` field in every published TypeScript package points at `https://github.com/ComposioHQ/composio/tree/main/ts/packages/<pkg>#readme`. The repository's default branch is `next` and there is no `main` branch, and GitHub does not redirect `tree/<branch>` paths to the default branch when that branch does not exist. As a result each of these homepage links returns a 404 wherever it is surfaced (the package page on npmjs.com, editor/IntelliSense hovers, and `npm view <pkg> homepage`). This repoints each `homepage` to `tree/next/...` so the links resolve. The `repository.url` (plain `.git` URL) and `bugs.url` fields were already correct and are left untouched. The metadata was originally added in #3611; this only corrects the branch in the `homepage` URLs. Fixes # ## Changes - Update the `homepage` field from `tree/main/...` to `tree/next/...` in the 14 published packages that carry one: `@composio/core`, `@composio/slim`, `@composio/experimental`, `@composio/json-schema-to-zod`, and the providers `@composio/anthropic`, `@composio/claude-agent-sdk`, `@composio/cloudflare`, `@composio/google`, `@composio/langchain`, `@composio/llamaindex`, `@composio/mastra`, `@composio/openai`, `@composio/openai-agents`, `@composio/vercel`. - Add a Changeset (patch) covering those 14 published packages. ## Type of change - [x] Bug fix - [ ] New feature - [ ] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? Metadata-only change, so there is no unit test to add. Verified with: - Confirmed the target branch: `git ls-remote --symref origin HEAD` reports `refs/heads/next`, and `git ls-remote --heads origin main` is empty (no `main`). - Confirmed the links resolve: `https://github.com/ComposioHQ/composio/tree/main/ts/packages/core` returns HTTP 404 while `.../tree/next/ts/packages/core` returns HTTP 200 (same for the provider packages). - All 14 edited `package.json` files still parse as valid JSON. - `pnpm exec prettier --check` on the 14 `package.json` files and the changeset: all pass. - `pnpm changeset status --since=origin/next` lists exactly these 14 packages bumping at `patch` (no missing or extra packages), so the changeset CI check is satisfied. Environment: node 26, pnpm 10.28.0. ## Screenshots (if applicable) ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [ ] I updated documentation as needed - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages ## Additional context The `homepage` URLs pin an explicit branch (`tree/<branch>`), so they will break again if the default branch is ever renamed. If you would prefer a branch-agnostic form (for example dropping the `tree/<branch>` segment so the URL tracks the default branch, or linking to the published README), I am happy to switch to that instead; I went with the smallest correct fix of pointing at the actual default branch. ``` Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> |
||
|
Alberto Schiabel
|
3a5e62feb4 |
fix(py): support list-valued schema types in tool signatures (#3815)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3754 - normalizes list-valued JSON Schema `type` fields before scalar type lookups - applies the handling to direct fields and `anyOf`/`oneOf` options - adds regressions for nullable, single, mixed, unknown, and combiner-nested type lists - credits @anxkhn as a Git co-author ## Context JSON Schema Draft 2020-12 and OpenAPI 3.1 allow `type` to be an array. The previous parser passed that list to a dictionary lookup, raising `TypeError: unhashable type: 'list'`. This replacement covers the direct case from #3754 and the same shape nested in a combiner. --------- Co-authored-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> |
||
|
Alberto Schiabel
|
f9c2dc5d00 |
docs: update documentation for new changelog entries (#3816)
## Summary Automated documentation updates triggered by new changelog entries merged to next. Generated by Codex via GitHub Actions. Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
edd0bf0479 |
docs: centralize SDK release notes (#3814)
This PR: - Adds public docs changelog entries for the Python and TypeScript SDK releases since May 15, 2026, including the previously unmigrated Python 0.13.1 entry. - Removes the Python-local changelog and replaces it with canonical changelog links from the repository and Python READMEs. - Retargets the Python release guard to the docs changelog, documents its table contract, and covers prior-version plus PEP 440 version parsing. Validation: - pnpm test:release-workflow - docs: bun run test - docs: bun run lint:links - docs: bun run types:check - docs: bun run build - pnpm exec prettier --check test/release-workflow.test.ts docs/agent-guidance/guides/changelog.md docs/content/changelog/*.mdx Review: - ce-code-review completed with correctness, testing, maintainability, project-standards, agent-native, learnings, and adversarial passes. All actionable findings were fixed; final adversarial re-review found no remaining P0-P2 issue. |
||
|
Alberto Schiabel
|
71255765a5 |
fix(schema): normalize duplicate required entries (#3812)
## Summary - Normalize duplicate JSON Schema `required` entries at the shared `ToolSchema` ingress boundary. - Reapply normalization immediately before direct providers emit vendor schemas (Anthropic, OpenAI, OpenAI Responses, Google, Cloudflare, and OpenAI Agents). - Preserve literal `const`/`default`/`enum`/`examples` values, tolerate aliasing safely, and fail predictably on pathological nesting. - Document the provider-boundary rule in `ts/packages/providers/AGENTS.md`. Co-authored-by: @MatinGathani ## Verification - `pnpm changeset status` - `pnpm --filter @composio/core build` - Focused core and affected-provider Vitest suites (1,151 tests) - `pnpm typecheck` - `pnpm lint` (passes with 71 pre-existing warnings) --------- Co-authored-by: MatinGathani <70268627+matingathani@users.noreply.github.com> |
||
|
Abhishek Patil
|
71862b8f97 |
docs: add support-informed toolkit FAQs (#3692)
## Summary - Ports support-workflows toolkit KB into public toolkit FAQ docs for 85 toolkit FAQ files. - Creates 46 new toolkit FAQ files for toolkits that had KB but no FAQ file yet. - Updates existing toolkit FAQ files without deleting current public answers. ## General docs updates - Clarifies connected-account credential redaction and reconnect/refresh semantics. - Documents Proxy Execute scoped-key and v3.1/current-SDK requirements. - Adds retry risk guidance for non-idempotent direct tool executions. - Adds remote sandbox temporary state/file retention guidance. - Adds Composio Connect vs developer project boundary guidance for MCP app connections. ## Verification - Hygiene grep passed on changed files: `Plain|T-|SUP-|PRO-|Linear|plain.com|linear.app|/Users/|support-workflows|TODO|FIXME|\[eng:|customer`. - `git diff --check` passed. - `bun run lint:links` passed: 0 errored files, 0 errors. - `bun run build` passed. Build emitted the existing Turbopack NFT warning plus toolkit-detail fetch skips because `COMPOSIO_API_KEY` is not set locally. - Render spot checks passed for Gmail, Apollo, SharePoint, Google Calendar, connected accounts, and remote sandbox pages. ## Deferred - PowerPoint KB was not added because the current docs toolkit catalog has no `powerpoint` toolkit slug/page. The KB describes a possible future file-operations toolkit rather than an existing public toolkit page. --------- Co-authored-by: Sarah Simionescu <sarah@composio.dev> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
MatinGathani
|
d5a37efb85 |
fix(python): handle title-less top-level schemas (#3325)
## Summary Fixes `json_schema_to_model` when a top-level JSON schema omits `title` or sets it to `null`. This is the remaining direct-helper path; anonymous nested objects from #2435 are already handled by `schema_converter.py`. - falls back to `GeneratedModel` only when the title is `None`, preserving intentionally empty string titles - adds regression coverage for missing, `null`, and empty titles, model construction, and required-field validation ## Validation - `ruff format --check python/composio/utils/shared.py python/tests/test_schema_parser.py` - `ruff check python/composio/utils/shared.py python/tests/test_schema_parser.py` - `PYTHONPATH="$PWD/python" /Users/jkomyno/work/composio/composio2/.venv/bin/pytest -q python/tests/test_schema_parser.py` This is a follow-up to #2435; it intentionally does not close that already-resolved issue. Co-authored-by: jkomyno <alberto@composio.dev> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
dependabot[bot]
|
09aab1d19f |
chore(deps-dev): bump the npm-development group across 1 directory with 3 updates (#3795)
Bumps the npm-development group with 3 updates in the / directory: [turbo](https://github.com/vercel/turborepo), [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) and [typedoc](https://github.com/TypeStrong/TypeDoc). Updates `turbo` from 2.10.2 to 2.10.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/turborepo/releases">turbo's releases</a>.</em></p> <blockquote> <h2>Turborepo v2.10.4</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <h3>Changelog</h3> <ul> <li>release(turborepo): 2.10.3 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13222">vercel/turborepo#13222</a></li> <li>ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13240">vercel/turborepo#13240</a></li> <li>perf: Use mimalloc as the global allocator by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13237">vercel/turborepo#13237</a></li> <li>perf: Parse yarn v1 lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13241">vercel/turborepo#13241</a></li> <li>ci: Fix cache outputs for Eve app by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13243">vercel/turborepo#13243</a></li> <li>perf: Stop materializing spans for the disabled daemon log layer by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13244">vercel/turborepo#13244</a></li> <li>fix: Keep ancestor-scoped bun dependencies resolvable after prune renames by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13236">vercel/turborepo#13236</a></li> <li>perf: Overlap external dependency hashing with package file hashing by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13234">vercel/turborepo#13234</a></li> <li>perf: Build tracked repo index concurrently with package graph by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13232">vercel/turborepo#13232</a></li> <li>perf: Release tokio runtime at exit so background DNS lookups never stall the user by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13231">vercel/turborepo#13231</a></li> <li>perf: Overhaul pnpm lockfile parsing and dependency closure computation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13228">vercel/turborepo#13228</a></li> <li>feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13227">vercel/turborepo#13227</a></li> <li>feat: Introduce toolchain provider abstraction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13235">vercel/turborepo#13235</a></li> <li>perf: Parse Berry lockfiles in a single pass by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13242">vercel/turborepo#13242</a></li> <li>fix: Apply input exclusion globs to the filesystem walk by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13224">vercel/turborepo#13224</a></li> <li>fix: Stop root-directory packages from claiming every file in change mapping by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13225">vercel/turborepo#13225</a></li> <li>chore: Rename turborepo-repository napi package to <code>@turbo/repository</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13226">vercel/turborepo#13226</a></li> <li>perf: Hash git blobs with hardware-accelerated SHA-1 by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13245">vercel/turborepo#13245</a></li> <li>release(turborepo): 2.10.4-canary.1 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13247">vercel/turborepo#13247</a></li> <li>feat: Discover Cargo crates as packages by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13248">vercel/turborepo#13248</a></li> <li>perf: Reuse per-package external dependency hashes in run summaries by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13249">vercel/turborepo#13249</a></li> <li>perf: Stat workspace turbo.json files concurrently during discovery by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13251">vercel/turborepo#13251</a></li> <li>chore: Add tracing spans to workspace discovery and globwalk phases by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13252">vercel/turborepo#13252</a></li> <li>fix: Avoid non-reentrant libc calls in concurrent shutdown process scans by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13256">vercel/turborepo#13256</a></li> <li>perf: Memoize resolved task definitions during engine construction by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13257">vercel/turborepo#13257</a></li> <li>perf: Compute transitive closures and external dependency hashes concurrently with run setup by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13250">vercel/turborepo#13250</a></li> <li>perf: Probe microfrontends configs in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13262">vercel/turborepo#13262</a></li> <li>feat: Execute Cargo crate tasks via cargo by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13261">vercel/turborepo#13261</a></li> <li>perf: Pre-size engine task collections by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13265">vercel/turborepo#13265</a></li> <li>feat: Expose resolved experimentalCI task configuration in <code>turbo query</code> by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13264">vercel/turborepo#13264</a></li> <li>feat: Derive input and output globs for Cargo tasks by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13263">vercel/turborepo#13263</a></li> <li>perf: Parse large pnpm lockfile sections in parallel by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13266">vercel/turborepo#13266</a></li> <li>feat: Hash Cargo external dependencies per-crate by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13267">vercel/turborepo#13267</a></li> <li>ci: Install pnpm 10 in musl containers for Library Release by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13269">vercel/turborepo#13269</a></li> <li>ci: Force pnpm overwrite in Library Release musl containers by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13270">vercel/turborepo#13270</a></li> <li>perf: Defer the untracked-scan barrier to first file-hash use by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13268">vercel/turborepo#13268</a></li> <li>ci: Fetch API-created commit before updating local ref by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13271">vercel/turborepo#13271</a></li> <li>release(library): 0.0.1-canary.22 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13272">vercel/turborepo#13272</a></li> <li>perf: Remove lock and dispatch overhead from task hash precomputation by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13273">vercel/turborepo#13273</a></li> <li>fix: Fall back to lockfile detection in <code>@turbo/repository</code> when package manager is undeclared by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13275">vercel/turborepo#13275</a></li> <li>test: Add end-to-end coverage for Cargo workspaces by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13274">vercel/turborepo#13274</a></li> <li>release(library): 0.0.1-canary.23 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13276">vercel/turborepo#13276</a></li> <li>release(turborepo): 2.10.4-canary.2 by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/vercel/turborepo/pull/13278">vercel/turborepo#13278</a></li> <li>fix: Collapse nested package-manager fallback conditional by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13279">vercel/turborepo#13279</a></li> <li>feat: Make turbo watch Cargo-aware by <a href="https://github.com/anthonyshew"><code>@anthonyshew</code></a> in <a href="https://redirect.github.com/vercel/turborepo/pull/13280">vercel/turborepo#13280</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/turborepo/commit/1506a114e377dd7e1e8e7a7863c42adf94a9f776"><code>1506a11</code></a> publish 2.10.4 to registry</li> <li><a href="https://github.com/vercel/turborepo/commit/11a68c705274cc7a408776b576ce7a9e14d6e6df"><code>11a68c7</code></a> fix: Stop flagging relative imports that resolve into node_modules in boundar...</li> <li><a href="https://github.com/vercel/turborepo/commit/947b4784cd1b254e62b663bbdb22891a849b7442"><code>947b478</code></a> fix: Raise the open-file soft limit at startup (<a href="https://redirect.github.com/vercel/turborepo/issues/13282">#13282</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ddc584d788349fc3668e280286f540feee4eb6b9"><code>ddc584d</code></a> feat: Make turbo prune Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13281">#13281</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ff0d50822314c5b388d9b4daa9c6159387752d95"><code>ff0d508</code></a> perf: Skip dependency-closure assembly for toolchains that derive nothing (<a href="https://redirect.github.com/vercel/turborepo/issues/1">#1</a>...</li> <li><a href="https://github.com/vercel/turborepo/commit/39d623e1323ef50e06be0a103082ae29cc545779"><code>39d623e</code></a> feat: Make turbo watch Cargo-aware (<a href="https://redirect.github.com/vercel/turborepo/issues/13280">#13280</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/af01fdfeb5efe07a7b6843a0b8f5033b59ebbb2c"><code>af01fdf</code></a> fix: Collapse nested package-manager fallback conditional (<a href="https://redirect.github.com/vercel/turborepo/issues/13279">#13279</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/7e02f94f647cb4d527a438313dc4adbe3e8c0df3"><code>7e02f94</code></a> release(turborepo): 2.10.4-canary.2 (<a href="https://redirect.github.com/vercel/turborepo/issues/13278">#13278</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/8e3a59fdb6c71ad24fbbb363db52f88eb9a89116"><code>8e3a59f</code></a> release(library): 0.0.1-canary.23 (<a href="https://redirect.github.com/vercel/turborepo/issues/13276">#13276</a>)</li> <li><a href="https://github.com/vercel/turborepo/commit/ce18f0a79eb49e9a22c7e6cfa491777c24ed746a"><code>ce18f0a</code></a> test: Add end-to-end coverage for Cargo workspaces (<a href="https://redirect.github.com/vercel/turborepo/issues/13274">#13274</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vercel/turborepo/compare/v2.10.2...v2.10.4">compare view</a></li> </ul> </details> <br /> Updates `typescript-eslint` from 8.62.1 to 8.63.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases">typescript-eslint's releases</a>.</em></p> <blockquote> <h2>v8.63.0</h2> <h2>8.63.0 (2026-07-06)</h2> <h3>🚀 Features</h3> <ul> <li><strong>eslint-plugin:</strong> [no-misused-promises] detect async usage of a sync dispose usage (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12426">#12426</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12447">#12447</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12446">#12446</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12491">#12491</a>, <a href="https://redirect.github.com/typescript-eslint/typescript-eslint/issues/12485">#12485</a>)</li> <li><strong>eslint-plugin:</strong> [no-base-to-string] don't flag a shadowed String() call (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12492">#12492</a>)</li> <li><strong>scope-manager:</strong> export ClassStaticBlockScope (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12460">#12460</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Evyatar Daud <a href="https://github.com/StyleShit"><code>@StyleShit</code></a></li> <li>Kristjan <a href="https://github.com/KristjanTammekivi"><code>@KristjanTammekivi</code></a></li> <li>Michael Naumov <a href="https://github.com/mnaoumov"><code>@mnaoumov</code></a></li> <li>Serhii Leniv <a href="https://github.com/Serhii-Leniv"><code>@Serhii-Leniv</code></a></li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md">typescript-eslint's changelog</a>.</em></p> <blockquote> <h2>8.63.0 (2026-07-06)</h2> <p>This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.</p> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.63.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/290cf6cdcc5ffb00c5b8f3e1e0e9f2fd8cc96374"><code>290cf6c</code></a> chore(release): publish 8.63.0</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint">compare view</a></li> </ul> </details> <br /> Updates `typedoc` from 0.28.19 to 0.28.20 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/TypeDoc/releases">typedoc's releases</a>.</em></p> <blockquote> <h2>v0.28.20</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/TypeStrong/typedoc/blob/master/CHANGELOG.md">typedoc's changelog</a>.</em></p> <blockquote> <h2>v0.28.20 (2026-07-05)</h2> <h3>Features</h3> <ul> <li>Group/category section headings (<code><h2></code>) in the default theme now include an <code>id</code> attribute so they can be linked to via fragment identifiers (e.g. <code>modules.html#classes</code>), <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3029">#3029</a>.</li> <li>Added a <code>@reexport</code> modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3096">#3096</a>.</li> <li>API: Introduced <code>generateOutputsBegin</code> and <code>generateOutputsEnd</code> events on <code>Application</code> for plugin use.</li> </ul> <h3>Bug Fixes</h3> <ul> <li>When <code>--emit none</code> is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3078">#3078</a>.</li> <li>Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3103">#3103</a>.</li> <li>A <code>@hidden</code> tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3111">#3111</a>.</li> <li>Custom <code>@group</code> and <code>@category</code> titles with the same sort weight are now ordered consistently with the <code>alphabetical</code> reflection sort, <a href="https://redirect.github.com/TypeStrong/TypeDoc/issues/3120">#3120</a>.</li> </ul> <h3>Thanks!</h3> <ul> <li><a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a></li> <li><a href="https://github.com/jonathanhefner"><code>@jonathanhefner</code></a></li> <li><a href="https://github.com/kcastellino"><code>@kcastellino</code></a></li> <li><a href="https://github.com/Metbcy"><code>@Metbcy</code></a></li> <li><a href="https://github.com/StoneCypher"><code>@StoneCypher</code></a></li> <li><a href="https://github.com/wotan-allfather"><code>@wotan-allfather</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/TypeStrong/typedoc/commit/34d843be0953fc81de0fde14bea8db72d0bbccc6"><code>34d843b</code></a> Update changelog for release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/fbd4a254952c171b9ba7ebbe96c5151e844743be"><code>fbd4a25</code></a> Bump version to 0.28.20</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/93ba157000e4a632bfbf32a0b6f00f8ae57c7c99"><code>93ba157</code></a> Update dependencies in example</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/e8c5df8844edca9800dfc62cee9115ef0fba59ea"><code>e8c5df8</code></a> Remove unnecessary files from distribution</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/392b0dd50a428ea0c732c38c6c263e74cb6200b1"><code>392b0dd</code></a> Update dependencies</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/8510dd48c7778f419f4605146f1a733af27993fa"><code>8510dd4</code></a> Add missing entries in changelog before release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/51dc0521890924269f06e08972c6453299f63cb5"><code>51dc052</code></a> Update change log for 0.28.20 release</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/72f20cd87b4ef30aae97b68fcbb42ca19cebdc22"><code>72f20cd</code></a> Merge branch 'fix-locale-sort-group-category-titles' into dev</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/623f2c0bd35b5e89cc79fb5783dac01c6f2530e9"><code>623f2c0</code></a> Fix failing test, accept slightly slower build for now</li> <li><a href="https://github.com/TypeStrong/typedoc/commit/c8bdf14cab0c22dd415b6872cc647c6cf81f917c"><code>c8bdf14</code></a> Minor config tweak to improve dev build time</li> <li>Additional commits viewable in <a href="https://github.com/TypeStrong/TypeDoc/compare/v0.28.19...v0.28.20">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Alberto Schiabel
|
de0bfa356d |
fix(docs): resolve changelog links and Vercel deploys (#3811)
This PR: - fixes copied changelog date URLs so they stay on `/reference/changelog` and target the selected date - resolves fragment links against the current page while preserving full site-relative links - upgrades the docs app to Vercel-supported `eve@0.18.0` - migrates docs-agent evals from the removed `t.completed()` assertion to `t.succeeded()` - verifies the docs static suite, TypeScript type-check, and production build --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
0de52639c4 |
feat(core)!: remove bare session aliases; freeze MCP SPI (#3780)
## What and why This makes the intended v1 API cleanup real rather than postponing it to v2: - Remove the TypeScript root aliases `composio.create(...)` and `composio.use(...)`. Session creation and reuse now live only at `composio.sessions.create(...)` and `composio.sessions.use(...)`. This is a deliberate breaking change, reflected by a major changeset. - Retain `BaseProvider.wrapMcpServerResponse` as the stable v1 provider SPI. Its earlier deprecation pointed to a method that was never introduced. The scope is intentionally narrow: it does **not** remove unrelated deprecated APIs, and Python keeps its supported `Composio.create/use` API. The TypeScript docs, examples, providers, runtime fixtures, generated SDK reference, and API-reference indexes now use the namespaced TypeScript API. Historical changelog examples are left as history. ## Verification - `pnpm typecheck` - `pnpm --filter @composio/core test -- --run test/core/session.test.ts` (42 files, 1,018 tests) - `pnpm exec eslint ts/packages/core/src/composio.ts` - `pnpm --filter @composio/core generate:docs` - `cd docs && bun run generate:api-index` - `cd docs && bun run types:check` - `git diff --check` and targeted scans for removed TypeScript aliases I also attempted the affected Node and Cloudflare runtime E2E suites. They cannot initialize in this checkout without `COMPOSIO_API_KEY` (and, for Cloudflare, `COMPOSIO_BASE_URL` and `OPENAI_API_KEY`); they did not report a product assertion failure. |
||
|
Alberto Schiabel
|
8a19b75915 |
fix(docs): publish production API URLs and guard against staging leaks (#3770)
## What was wrong The API reference docs were shipping staging URLs to users. There were two separate leaks, both from the same source: the scheduled `docs-update-data` workflow fetches the OpenAPI specs and toolkit data from staging every 5 hours and auto-commits them. The first leak was the curl base URL. `servers[0].url` in `openapi.json` and `openapi-v3.json` rendered as `http://staging-apollo.composio.dev` in every curl example. That is what https://github.com/ComposioHQ/composio/pull/3761 tried to fix. The second leak was in the toolkit data. `toolkits.json` carried 269 `https://staging-backend.composio.dev/api/v1/auth-apps/add` default values, surfaced in the white-labeling and auth-config docs. #3761 never touched this file. ## Which PR caused it Karan asked on Slack whether we could pin down the PR that introduced this. We can. It was https://github.com/ComposioHQ/composio/pull/3426 (commit `a3e58a421`, merged 2026-07-03), which flipped `servers[0].url` from `https://backend.composio.dev` / `PRODUCTION API` to `http://staging-apollo.composio.dev` / `STAGING API` in both specs. It was not a hand-written change. #3426 is itself an auto-generated PR from this same `docs-update-data` workflow, opened by `github-actions[bot]` on the `docs/auto-update-data` branch. The workflow fetched from staging, staging serves the staging server URL in its spec, and the value landed in the committed files where nobody caught it inside a large auto-generated diff. That is the reason the real fix belongs in the generator and the workflow, not in a one-off edit to the JSON. ## Why #3761 was not enough #3761 pinned `spec.servers` to production inside `fetch-openapi.mjs`. That closed the first leak, but three things stayed open. It only covered the OpenAPI specs. The 269 staging hosts in `toolkits.json` come from a different generator, `generate-toolkits.ts`, and stayed live on the docs site. It added no CI guard. The fix was a single line in a generator with nothing asserting it. A later refactor that dropped or reordered that line would republish staging on the next 5-hour regeneration, which is precisely the recurring failure that produced the original report. And it scrubbed the symptom rather than the source. The workflow kept fetching from staging; the pin just rewrote one field afterward. ## The fix I addressed it at four layers, so no single regression brings staging back. **Source.** `docs-update-data.yml` no longer overrides the base URL to staging. The generators default to production, so the docs reflect production. **Generators.** The production URL now lives in one place, `docs/scripts/production-api.mjs`. The toolkit and meta-tools generators sanitize any staging host to production before writing, so a staging fetch can no longer republish staging. **Committed data.** I rewrote the 269 staging hosts already in `toolkits.json` to production. **Guard.** `docs/tests/static/production-urls.test.ts` asserts the OpenAPI `servers` is production and scans both specs and every `public/data/*.json` for any `staging-*.composio.dev` host. It is an independent oracle: it hardcodes the expected value and deliberately does not import the generator constants, so a wrong edit there fails CI instead of moving both sides together. I verified it catches both the original `staging-apollo` and the `staging-backend` leaks. ## One thing to confirm before merge `COMPOSIO_API_KEY` is paired with `COMPOSIO_BASE_URL_STAGING` in every other workflow, so it is most likely a staging key. If that is the case, provision a production-capable key before the next scheduled run. Otherwise that run fails on auth, which is loud and safe, rather than silently republishing staging. The generator sanitizer and the guard keep the output correct regardless of which environment the fetch hits, so there is no risk in the interim. ## Testing - `bun test tests/static/` passes 21 of 21 (16 existing, 5 new). - The shared module loads and all three generators build under bun. - No `staging-*.composio.dev` host remains under `docs/public/`. - `docs-update-data.yml` re-validated as valid YAML. |
||
|
Alberto Schiabel
|
a0f37a7f77 |
fix(core): SSRF guard on URL file inputs + telemetry secret redaction (#3779)
## What & why Two v1 non-negotiable gates from the [SDK road to v1](https://github.com/ComposioHQ/composio) plan are currently red. Both are self-contained and closed here. ### ① SSRF guard on URL file inputs — `@composio/core` `composio.files.upload(url)` and automatic file upload during tool execution did a **raw `fetch()`** on user-supplied URLs (`readFileContentFromURL`, `fileUtils.node.ts`) with no guard. Because URL inputs deliberately bypass the local-path allowlist, a caller — or an LLM-produced tool argument — could point the SDK at internal infrastructure (`http://169.254.169.254/…` cloud metadata, RFC1918 hosts) or a public URL that 3xx-redirects into internal space. New `ssrfGuard.node.ts`: - resolves the host and refuses **private, loopback, link-local (incl. `169.254.169.254`), CGNAT, TEST-NET, benchmarking, multicast, and reserved** ranges (IPv4 + IPv6, incl. IPv4-mapped / NAT64); - validates the **resolved address**, not the hostname string, so decimal/octal/hex IP obfuscation doesn't slip through; - rejects non-`http(s)` schemes; - follows redirects **manually** so every hop is re-validated; - blocked requests throw the new `ComposioBlockedInternalUrlError`. Behaviour for legitimate public URLs is unchanged. Node-only path. Known residual (documented in-file): a DNS-rebinding TOCTOU window between our lookup and `fetch`'s connect — closing it fully needs connect-time IP pinning (a custom dispatcher), out of scope here. ### ② Telemetry secret redaction — `@composio/core` Error telemetry shipped `error.message` / `error.stack` **verbatim** to `telemetry.composio.dev` with zero redaction. New `redact.ts` runs at the single chokepoint (`prepareAndSendErrorTelemetry`) and strips URL query strings, `Authorization` bearer/basic credentials, and secret-like `key=value` pairs (API keys, tokens, client secrets, passwords) before transport. ## Tests - `ssrfGuard.test.ts` — IP classification (v4/v6, mapped, CGNAT, metadata), scheme rejection, resolve-to-internal, "any resolved address internal" pinning bypass, redirect-into-internal, redirect budget. - `redact.test.ts` — URL query, bearer/basic, key/value secrets, quote preservation, benign text untouched. - Updated `fileUtils.test.ts` to mock DNS (hermetic) and expect `redirect: 'manual'`. - `tsc --noEmit` clean; lint clean. ## Notes - `patch` changeset included. - Adds `ComposioBlockedInternalUrlError` to the public error exports. |
||
|
dependabot[bot]
|
4baacbeb77 |
chore(deps): bump the npm-production group across 1 directory with 7 updates (#3799)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
dependabot[bot]
|
78591f7623 |
chore(deps): bump the github-actions group with 5 updates (#3792)
Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.163` | `1.0.170` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.10` | `1.11` | | [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) | `1.0.163` | `1.0.170` | | [actions/stale](https://github.com/actions/stale) | `10.3.0` | `10.4.0` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | Updates `anthropics/claude-code-action` from 1.0.163 to 1.0.170 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.170</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170</a></p> <h2>v1.0.169</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169</a></p> <h2>v1.0.168</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168</a></p> <h2>v1.0.167</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167</a></p> <h2>v1.0.166</h2> <h2>What's Changed</h2> <ul> <li>Drop buffered inline comment when it is posted live (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1405">#1405</a>) by <a href="https://github.com/archievi"><code>@archievi</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li>Use modern noreply email for co-author trailers by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1369">anthropics/claude-code-action#1369</a></li> <li>fix(restore): handle symlinked CLAUDE.md paths during config snapshot by <a href="https://github.com/syf2211"><code>@syf2211</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li>fix: preserve repeated add-dir flags in claude args by <a href="https://github.com/Jerry2003826"><code>@Jerry2003826</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1256">anthropics/claude-code-action#1256</a></li> <li>fix: propagate curl failures in install pipeline by <a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> <li>chore: fix prettier formatting by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1463">anthropics/claude-code-action#1463</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/archievi"><code>@archievi</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li><a href="https://github.com/syf2211"><code>@syf2211</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li><a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166</a></p> <h2>v1.0.165</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165</a></p> <h2>v1.0.164</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/536f2c32a39763739000b0e1ac69ca2647d97ce9"><code>536f2c3</code></a> chore: bump Claude Code to 2.1.206 and Agent SDK to 0.3.206</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/37b464ce72700f7b2c5ff8d2db7fa7b15df792f5"><code>37b464c</code></a> chore: bump Claude Code to 2.1.205 and Agent SDK to 0.3.205</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/ba0aafd4308cbba7165f9f2cdb0cfbed5a3c99ce"><code>ba0aafd</code></a> chore: bump Claude Code to 2.1.204 and Agent SDK to 0.3.204</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0fe28cdb64e23015219b0e478100b7105fd7dfa1"><code>0fe28cd</code></a> chore: bump Claude Code to 2.1.203 and Agent SDK to 0.3.203</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f87768c6d25f92ae6efa7175e223ef77d4cbf97f"><code>f87768c</code></a> chore: bump Claude Code to 2.1.202 and Agent SDK to 0.3.202</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/58a2944bbcf1a73b1ae7960995fffca4fa29b113"><code>58a2944</code></a> chore: fix prettier formatting (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1463">#1463</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/beb753ed7288e960e1519e0bf631be7b502af876"><code>beb753e</code></a> fix: propagate curl failures in install pipeline (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1241">#1241</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/235b39bf21ce5bca22c31b37d171bd6e27cdd743"><code>235b39b</code></a> fix: preserve repeated add-dir flags in claude args (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1256">#1256</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/d060ddc96310109df573e19c7c458b84816c6af6"><code>d060ddc</code></a> fix(restore): handle symlinked CLAUDE.md paths during config snapshot (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1441">#1441</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0f07aee43515c58828104d3f2391785c2c565dd5"><code>0f07aee</code></a> Use modern noreply email for co-author trailers (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1369">#1369</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/769e3bdff9bb7ecfb51bad4c9cba23d6f5fc5ea5...536f2c32a39763739000b0e1ac69ca2647d97ce9">compare view</a></li> </ul> </details> <br /> Updates `openai/codex-action` from 1.10 to 1.11 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's changelog</a>.</em></p> <blockquote> <h1>codex-action Changelog</h1> <h2><a href="https://github.com/openai/codex-action/tree/v1.11">v1.11</a> (2026-07-04)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/116">#116</a> keep the permission profile helper backward compatible</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.10">v1.10</a> (2026-07-02)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/113">#113</a> add Codex permission profile support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a> (2026-06-22)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/85">#85</a> update the internal <code>setup-node</code> pin to <code>v6.3.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a> (2026-04-29)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/91">#91</a> tighten what bots are allowed</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a> (2026-04-24)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/89">#89</a> restrict bot permission bypass</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/77">#77</a> enable GitHub-hosted Linux bubblewrap support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/74">#74</a> harden shell interpolation in action workflows</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/58">#58</a> revert <a href="https://redirect.github.com/openai/codex-action/issues/56">#56</a> and use the latest stable version of Codex CLI again</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/56">#56</a> temporarily set the default version of Codex CLI to <code>0.58.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a> (2025-11-07)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/52">#52</a> add <code>baseUrl</code> to <code>Octokit</code> constructor, if appropriate, for GHE</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a> (2025-11-05)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/47">#47</a> added support for Azure via the new <code>responses-api-endpoint</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/36">#36</a> added <code>effort</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/45">#45</a> pin the commit hash of the <code>actions/setup-node</code> action used by <code>openai/codex-action</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.0">v1.0</a> (2025-10-06)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/openai/codex-action/commit/52fe01ec70a42f454c9d2ebd47598f9fd6893d56"><code>52fe01e</code></a> fix: keep permission profile helper backward compatible (<a href="https://redirect.github.com/openai/codex-action/issues/116">#116</a>)</li> <li><a href="https://github.com/openai/codex-action/commit/0d2a018b4dacc6b0eaa3918e0d2780df6d6fd23e"><code>0d2a018</code></a> docs: update CHANGELOG for v1.10 (<a href="https://redirect.github.com/openai/codex-action/issues/114">#114</a>)</li> <li>See full diff in <a href="https://github.com/openai/codex-action/compare/6b771854be52d8637d060e4b15120b9d746282ab...52fe01ec70a42f454c9d2ebd47598f9fd6893d56">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.163 to 1.0.170 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.170</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.170</a></p> <h2>v1.0.169</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.169</a></p> <h2>v1.0.168</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.168</a></p> <h2>v1.0.167</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.167</a></p> <h2>v1.0.166</h2> <h2>What's Changed</h2> <ul> <li>Drop buffered inline comment when it is posted live (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1405">#1405</a>) by <a href="https://github.com/archievi"><code>@archievi</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li>Use modern noreply email for co-author trailers by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1369">anthropics/claude-code-action#1369</a></li> <li>fix(restore): handle symlinked CLAUDE.md paths during config snapshot by <a href="https://github.com/syf2211"><code>@syf2211</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li>fix: preserve repeated add-dir flags in claude args by <a href="https://github.com/Jerry2003826"><code>@Jerry2003826</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1256">anthropics/claude-code-action#1256</a></li> <li>fix: propagate curl failures in install pipeline by <a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> <li>chore: fix prettier formatting by <a href="https://github.com/ashwin-ant"><code>@ashwin-ant</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1463">anthropics/claude-code-action#1463</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/archievi"><code>@archievi</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1412">anthropics/claude-code-action#1412</a></li> <li><a href="https://github.com/syf2211"><code>@syf2211</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1441">anthropics/claude-code-action#1441</a></li> <li><a href="https://github.com/akhilesharora"><code>@akhilesharora</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1241">anthropics/claude-code-action#1241</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.166</a></p> <h2>v1.0.165</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.165</a></p> <h2>v1.0.164</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.164</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/536f2c32a39763739000b0e1ac69ca2647d97ce9"><code>536f2c3</code></a> chore: bump Claude Code to 2.1.206 and Agent SDK to 0.3.206</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/37b464ce72700f7b2c5ff8d2db7fa7b15df792f5"><code>37b464c</code></a> chore: bump Claude Code to 2.1.205 and Agent SDK to 0.3.205</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/ba0aafd4308cbba7165f9f2cdb0cfbed5a3c99ce"><code>ba0aafd</code></a> chore: bump Claude Code to 2.1.204 and Agent SDK to 0.3.204</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0fe28cdb64e23015219b0e478100b7105fd7dfa1"><code>0fe28cd</code></a> chore: bump Claude Code to 2.1.203 and Agent SDK to 0.3.203</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f87768c6d25f92ae6efa7175e223ef77d4cbf97f"><code>f87768c</code></a> chore: bump Claude Code to 2.1.202 and Agent SDK to 0.3.202</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/58a2944bbcf1a73b1ae7960995fffca4fa29b113"><code>58a2944</code></a> chore: fix prettier formatting (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1463">#1463</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/beb753ed7288e960e1519e0bf631be7b502af876"><code>beb753e</code></a> fix: propagate curl failures in install pipeline (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1241">#1241</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/235b39bf21ce5bca22c31b37d171bd6e27cdd743"><code>235b39b</code></a> fix: preserve repeated add-dir flags in claude args (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1256">#1256</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/d060ddc96310109df573e19c7c458b84816c6af6"><code>d060ddc</code></a> fix(restore): handle symlinked CLAUDE.md paths during config snapshot (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1441">#1441</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/0f07aee43515c58828104d3f2391785c2c565dd5"><code>0f07aee</code></a> Use modern noreply email for co-author trailers (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1369">#1369</a>)</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/769e3bdff9bb7ecfb51bad4c9cba23d6f5fc5ea5...536f2c32a39763739000b0e1ac69ca2647d97ce9">compare view</a></li> </ul> </details> <br /> Updates `actions/stale` from 10.3.0 to 10.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/stale/releases">actions/stale's releases</a>.</em></p> <blockquote> <h2>v10.4.0</h2> <h2>What's Changed</h2> <h3>Bug Fix</h3> <ul> <li>Fixed <code>only-issue-types</code> validation by <a href="https://github.com/trueberryless"><code>@trueberryless</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Bump undici to 6.27.0 via override, clean up stale license files, and version to 10.4.0. by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/stale/pull/1342">actions/stale#1342</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/trueberryless"><code>@trueberryless</code></a> made their first contribution in <a href="https://redirect.github.com/actions/stale/pull/1338">actions/stale#1338</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/stale/compare/v10.3.0...v10.4.0">https://github.com/actions/stale/compare/v10.3.0...v10.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629"><code>1e223db</code></a> Bump undici to 6.27.0 via override, clean up stale license files, and version...</li> <li><a href="https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd"><code>9461cb1</code></a> fix: <code>only-issue-types</code> does not affect PRs (<a href="https://redirect.github.com/actions/stale/issues/1338">#1338</a>)</li> <li>See full diff in <a href="https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629">compare view</a></li> </ul> </details> <br /> Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/denoland/setup-deno/releases">denoland/setup-deno's releases</a>.</em></p> <blockquote> <h2>v2.0.5</h2> <h2>What's Changed</h2> <ul> <li>fix: update README and tests by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/85">denoland/setup-deno#85</a></li> <li>2.0.1 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/86">denoland/setup-deno#86</a></li> <li>Add problem matchers for <code>deno lint</code> by <a href="https://github.com/r7kamura"><code>@r7kamura</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/62">denoland/setup-deno#62</a></li> <li>refactor: use GitHub downloads for stable version download by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/91">denoland/setup-deno#91</a></li> <li>2.0.2 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/92">denoland/setup-deno#92</a></li> <li>refactor: convert action to TS and bundle code by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/95">denoland/setup-deno#95</a></li> <li>feat: add "lts" version option by <a href="https://github.com/sebdanielsson"><code>@sebdanielsson</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/97">denoland/setup-deno#97</a></li> <li>feat: add built-in caching via inputs by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/89">denoland/setup-deno#89</a></li> <li>feat: include a hash of deno.lock files in the cache key automatically by <a href="https://github.com/dsherret"><code>@dsherret</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/98">denoland/setup-deno#98</a></li> <li>fix: switch back to package.json as it's necessary for GH actions by <a href="https://github.com/dsherret"><code>@dsherret</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/101">denoland/setup-deno#101</a></li> <li>2.0.3 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/102">denoland/setup-deno#102</a></li> <li>Update actions/checkout by <a href="https://github.com/katayama8000"><code>@katayama8000</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/106">denoland/setup-deno#106</a></li> <li>docs: add lts as possible release-channel output by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/99">denoland/setup-deno#99</a></li> <li>docs: condense Deno version information in one section by <a href="https://github.com/csvn"><code>@csvn</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/100">denoland/setup-deno#100</a></li> <li>docs: fix identifier for latest stable release by <a href="https://github.com/Ms2ger"><code>@Ms2ger</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/115">denoland/setup-deno#115</a></li> <li>feat: upgrade Node.js runtime from node20 to node24 by <a href="https://github.com/nikicat"><code>@nikicat</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/123">denoland/setup-deno#123</a></li> <li>2.0.4 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/125">denoland/setup-deno#125</a></li> <li>chore: use versions.json from dl.deno.land by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/130">denoland/setup-deno#130</a></li> <li>2.0.5 by <a href="https://github.com/crowlKats"><code>@crowlKats</code></a> in <a href="https://redirect.github.com/denoland/setup-deno/pull/131">denoland/setup-deno#131</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/r7kamura"><code>@r7kamura</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/62">denoland/setup-deno#62</a></li> <li><a href="https://github.com/csvn"><code>@csvn</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/95">denoland/setup-deno#95</a></li> <li><a href="https://github.com/sebdanielsson"><code>@sebdanielsson</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/97">denoland/setup-deno#97</a></li> <li><a href="https://github.com/katayama8000"><code>@katayama8000</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/106">denoland/setup-deno#106</a></li> <li><a href="https://github.com/Ms2ger"><code>@Ms2ger</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/115">denoland/setup-deno#115</a></li> <li><a href="https://github.com/nikicat"><code>@nikicat</code></a> made their first contribution in <a href="https://redirect.github.com/denoland/setup-deno/pull/123">denoland/setup-deno#123</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/denoland/setup-deno/compare/v2.0.0...v2.0.5">https://github.com/denoland/setup-deno/compare/v2.0.0...v2.0.5</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/denoland/setup-deno/commit/22d081ff2d3a40755e97629de92e3bcbfa7cf2ed"><code>22d081f</code></a> 2.0.5 (<a href="https://redirect.github.com/denoland/setup-deno/issues/131">#131</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/28c677f5df3d8f072e45566ed931347ae6325d53"><code>28c677f</code></a> chore: use versions.json from dl.deno.land (<a href="https://redirect.github.com/denoland/setup-deno/issues/130">#130</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/ff4860f9d7236f320afa0f82b7e6457384805d05"><code>ff4860f</code></a> 2.0.4 (<a href="https://redirect.github.com/denoland/setup-deno/issues/125">#125</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/6a293fc1a20bd1d541577761b3169054c853c099"><code>6a293fc</code></a> feat: upgrade Node.js runtime from node20 to node24 (<a href="https://redirect.github.com/denoland/setup-deno/issues/123">#123</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/390061ada6be77a29ed6544d545349413e1f645c"><code>390061a</code></a> docs: fix identifier for latest stable release (<a href="https://redirect.github.com/denoland/setup-deno/issues/115">#115</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/bdaa2e4f849cbc8d7b46337cf37db0dc9b321074"><code>bdaa2e4</code></a> docs: condense Deno version information in one section (<a href="https://redirect.github.com/denoland/setup-deno/issues/100">#100</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/e4ff81cdb2791c6378ce29a7fbf02fc798992f78"><code>e4ff81c</code></a> docs: add lts as possible release-channel output (<a href="https://redirect.github.com/denoland/setup-deno/issues/99">#99</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/bac1f7276ce08dba2dadbc204ad8385615bf7bdb"><code>bac1f72</code></a> Update actions/checkout (<a href="https://redirect.github.com/denoland/setup-deno/issues/106">#106</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/2f7698fd116bfedbd1c3cd4119337b5a787ef53a"><code>2f7698f</code></a> 2.0.3 (<a href="https://redirect.github.com/denoland/setup-deno/issues/102">#102</a>)</li> <li><a href="https://github.com/denoland/setup-deno/commit/ee64dd32002995d8c023a32a49c0085d179610b1"><code>ee64dd3</code></a> fix: switch back to package.json as it's necessary for GH actions (<a href="https://redirect.github.com/denoland/setup-deno/issues/101">#101</a>)</li> <li>Additional commits viewable in <a href="https://github.com/denoland/setup-deno/compare/667a34cdef165d8d2b2e98dde39547c9daac7282...22d081ff2d3a40755e97629de92e3bcbfa7cf2ed">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Rahul Tarak
|
a13c883845 |
docs: package-manager picker for install commands (#3802)
## What Two changes to the docs install experience: **1. Package-manager picker on install code blocks.** New `PackageInstall` client component (`docs/components/package-install.tsx`): the code block's copy button opens a dropdown of package managers. Selecting one rewrites the displayed command and copies it to the clipboard. - TypeScript blocks: npm (default, `npm install`) / pnpm / bun / yarn (`<pm> add`) - Python blocks: uv (default, `uv add`) / pip (`pip install`) - The menu is portaled to `document.body` so it isn't clipped by the `Tabs`/`CodeBlock` overflow containers, and closes on outside click, Escape, or real scroll movement. **2. `@composio/slim` callout in the quickstart.** The quickstart TypeScript install blocks carry display-only `#` comment lines noting that `@composio/core` ships its docs and TypeScript source in the package (inspectable to coding agents) and that `@composio/slim` is the smaller install with the same API. Comment lines are rendered muted and are **never copied** — the picker copies only the command. ## Where Converted every plain `npm install` / `pip install` code block under `docs/content` (quickstart, all provider pages, single-toolkit MCP, custom tools, migration guides, standup example, SDK reference indexes). The TS reference index's manual npm/pnpm/yarn/bun tabs collapse into one picker. The two SDK-reference generators (`ts/packages/core/scripts/generate-docs.ts`, `python/scripts/generate-docs.py`) emit the new component so regeneration keeps it. Flagged upgrade commands (`pip install -U/--upgrade`) and the bun-first examples were left as-is. ## Verification - `bun run types:check` — pass - `bun run build` — pass - `eslint` on touched TS files — clean (remaining repo lint errors are pre-existing on `next`) - Visual check via dev server + browser: comment lines render muted below the command, picker opens npm/pnpm/bun/yarn (uv/pip on Python tabs), selecting a manager rewrites the command, and the clipboard receives exactly the command with no comment lines. Docs-only behavior change; no changeset (generator-script edits don't touch published code). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Rahul Tarak
|
caef908075 |
docs: refresh README(s) (#3801)
## Summary Rewrites the stale root `README.md` against the current docs (structure modeled on [earendil-works/pi](https://github.com/earendil-works/pi)'s README). - **Quickstarts** now use the session-based API (`composio.create()` → `session.tools()`) that the docs treat as canonical, replacing the legacy `composio.tools.get()` flow - **Positioning** matches the docs welcome page: 1000+ pre-authenticated toolkits, per-user sessions, auth, triggers, and a sandbox - **New sections**: CLI install (curl / Homebrew / npm), sessions-via-MCP note, repository layout, minimum runtime versions - **Provider table** merged with package links; adds the Claude Agent SDK providers (both SDKs) and the experimental Pi provider (`@composio/experimental`); documents the Python `composio-gemini`/`composio-google`/`composio-google-adk` split - **Removed**: Rube section (no longer in docs), cover banner (replaced with theme-adaptive brand logomark from brand.composio.dev), master-branch pointer, internal OpenAPI-pull section, private `@composio/ts-builders` listing Docs-only change — no changeset needed. ## Preview Rendered view: [README.md on this branch](https://github.com/ComposioHQ/composio/blob/docs/refresh-root-readme/README.md) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
b07fcada3f |
feat(experimental): add Eve provider and iMessage example (#3800)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3642 and credits @shamsharoon for the original Eve provider and iMessage work - rebases the integration onto the current `next` branch and resolves its lockfile conflicts - publishes an isolated `@composio/experimental/eve` entry with the correct Eve 0.12+ peer contract - adds recoverable per-session discovery, native Eve context propagation, and durable approval policies for direct and batched side effects - centralizes circular-safe auth-link extraction across Eve and Pi and replaces dense conditional expressions with named control flow - hardens the iMessage example against `osascript` option injection, unsafe trigger scoping, and third-party prompt injection - preserves completed local-tool results when a mixed local/remote batch loses its remote transport - consolidates the example documentation onto shared components, documents direct model-provider credentials, and clarifies that the browsable source is not yet a standalone fixture - verifies the change with 999 core tests, 32 experimental tests, package builds/typechecks, packed peer-isolation smokes, and a production docs build --------- Co-authored-by: shams haroon <144290365+shamsharoon@users.noreply.github.com> Co-authored-by: shams haroon <shamsharoon7@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: shams haroon <shams@composio.dev> |
||
|
Alberto Schiabel
|
30ba4d2930 |
feat(openai): add executable provider example (#3798)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3790 - makes the OpenAI example executable in direct-tools, Tool Router, smoke, and Cloudflare Workers modes - keeps direct and Tool Router agents in separate files so each execution model is explicit and readable - requires a successful Composio tool execution before either agent can accept a final model response - adds OpenAI to the nightly staging matrix without weakening the existing Mastra coverage - updates two stale experimental OpenAI usages so the complete example package typechecks against current SDK APIs ## Testing - `pnpm --filter openai-example run typecheck` - `pnpm --filter openai-example run lint` (0 errors; 4 pre-existing warnings) - `pnpm --filter openai-example run smoke` (staging: 5 direct tools and 6 Tool Router tools) - `pnpm --filter openai-example run cf:dry-run` - `pnpm run typecheck` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` - `pnpm run typecheck:examples` - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - [branch nightly](https://github.com/ComposioHQ/composio/actions/runs/29079263571): OpenAI and Mastra both passed smoke, direct-tools, and Tool Router against staging ## Post-deploy validation - dispatch `ts.examples-nightly.yml` on `next` after merge and confirm both matrix legs stay green - healthy runs finish within the 20-minute job budget and log successful tool-backed responses for both agent modes - revert this PR if the OpenAI leg blocks the nightly; examples maintainers own the first post-merge run and the next 06:00 UTC schedule --- [](https://github.com/EveryInc/compound-engineering-plugin)  |