mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
mcp-example@0.1.2
5111 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alberto Schiabel
|
7ae0d7f735 |
chore: remove dead code across repo (#3786)
## What Removes orphaned files and stale config that nothing references — a follow-up to the root `Dockerfile` cleanup (#3783), which surfaced that we'd accumulated dead code. | Removed | Why it's dead | |---|---| | `test-exports.ts` | Throwaway debug script — `console.log`s schema internals and imports from `ts/packages/core/dist/` (a build artifact absent on a clean checkout). Zero references. | | `.codex` | Empty 0-byte file, accidentally committed. Every `.codex` reference in the code means `~/.codex` (the Codex CLI home dir), not this. | | `ts/docs/api/mcp.old.md` | Orphaned `.old` doc, superseded by `ts/docs/api/mcp.md`. Not linked anywhere. | | `pnpm-workspace.yaml` → `ts/packages/wrappers/*` | Workspace glob pointing at a directory that doesn't exist. | | `docs/examples/{app-connections-dashboard, workplace-search, support-agent, background-agent}` | Example dirs not wired into the docs build **and** absent from `docs/decisions/cookbooks-revamp-plan.md` — unlike their siblings (`chat-app`, `pr-review-agent`, …) which are explicitly staged WIP cookbooks. Zero references in the tree. | ## Verification Each item was traced with `git grep` over tracked files (excluding lockfiles / generated data) and confirmed to have no consumers in code, CI, docs nav, or build config. Python side was audited too and is clean (no `.bak`/`.old` files, all scripts/providers/modules wired). ## Note If any of the four `docs/examples/` dirs are undocumented cookbook drafts rather than truly abandoned, shout and I'll restore them — they just aren't referenced or tracked in the revamp plan today. A follow-up PR adds **Knip** (TS) + **Vulture** (Python) to CI so this class of rot gets caught automatically. |
||
|
Alberto Schiabel
|
b0a02c9693 |
feat(examples): make validation provider agnostic (#3790)
This PR: - makes example typecheck, lint, and Workers dry-runs discover packages by script presence instead of a Mastra-only filter - runs the nightly staging suite as a provider matrix, starting with Mastra and failing when a matrix package is missing - keeps direct and Tool Router agents explicit while sharing the Tool Router agent between Node.js and Cloudflare Workers - keeps root ESLint rules in Turbo's lint cache key and documents both Worker secrets ## Testing - `pnpm run typecheck` - `pnpm run typecheck:examples` - `./node_modules/.bin/eslint ts/packages --ext .ts,.tsx` (0 errors; 72 existing warnings) - `pnpm run lint:examples` - `pnpm exec turbo cf:dry-run --filter='./ts/examples/*'` - confirmed Turbo includes `eslint.config.mjs` in the Mastra lint task inputs - confirmed a missing provider package fails instead of silently passing the nightly smoke step ## Post-Deploy Monitoring & Validation - after merge, dispatch `ts.examples-nightly.yml` on `next` and confirm the `mastra examples against staging` matrix leg runs smoke, direct-tools, and Tool Router successfully - healthy signal: smoke reports wrapped tools and both agent steps return non-empty output - failure signal: workflow logs contain `SMOKE FAIL`, `Agent returned empty output`, `No projects matched`, or a secret preflight error; revert this PR if the foundation gate begins false-passing or blocking unrelated example work - validation window and owner: the first post-merge dispatch plus the next scheduled 06:00 UTC nightly, owned by the TypeScript examples maintainers --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
shawn-composio
|
ff655168e5 |
docs: embed walkthrough video + scoped API key creation steps (#3785)
## What Updates the **Scoped Project API Key** reference page ([`project-api-key-permissions.mdx`](https://docs.composio.dev/reference/authenticating-to-composio/project-api-key-permissions)): - Embeds a YouTube walkthrough video at the top of the page (using the existing `<YouTube>` MDX component — lazy-loaded iframe, no layout shift). - Adds a short **"Create a scoped API key"** section with dashboard steps (Dashboard → Platform → project → Settings → API Keys → Create API Key). ## Preview <!-- Shawn: drag the localhost screenshot here --> ## Notes - Single-file content change; no component or config edits. <img width="1920" height="956" alt="image" src="https://github.com/user-attachments/assets/9d419ce1-d193-40f6-a669-0a3f2d0dd206" /> <img width="1899" height="985" alt="image" src="https://github.com/user-attachments/assets/ee126ac4-459b-4c08-ad22-2c99116165fb" /> |
||
|
Alberto Schiabel
|
15a03c10fb |
ci: add dead-code detection (knip + vulture + orphaned-CI check) (#3787)
## What Adds a **report-only** `Dead Code` CI workflow that surfaces likely-orphaned code on every PR, across all three surfaces — TypeScript, Python, and GitHub Actions. Follow-up to the root `Dockerfile` cleanup (#3783) and the dead-code sweep in #3786: instead of finding this stuff by hand, catch it automatically. | Surface | Tool | Wiring | |---|---|---| | TypeScript | [**knip**](https://knip.dev) | `knip.json`; runs via `pnpm dlx knip@5`. Finds unused files, exports, types, and dependencies. | | Python | [**vulture**](https://github.com/jendrikseipp/vulture) | `dead_code` nox session + `make dead-code`; allowlist at `python/config/vulture_allowlist.py`. Finds unused functions/classes/variables (complements Ruff's F401/F841). | | GitHub Actions | small bash script | `.github/scripts/check-orphan-ci.sh` — flags reusable workflows and composite actions with no callers. | ## Why report-only (not blocking) Every job writes findings to the run's **Step Summary** and **never fails the build**. These tools carry unavoidable false positives on a library monorepo — public API surface, dynamic imports, import-map targets (e.g. core's `#platform`), framework entry points. A red ❌ on false positives would just train everyone to ignore the check. Once a job's config is refined enough that a clean run is the steady state, it can be flipped to blocking. ## Validation (ran each locally) - **knip**: 0 unused *files* after scoping out the e2e-test workspaces (knip crashes traversing `ts/e2e-tests/**` — pre-existing knip bug, filed via `ignoreWorkspaces`) and build/docs artifacts. Export/dep categories surface advisory items. - **vulture**: clean run (report-only); allowlist suppresses the 3 `TYPE_CHECKING` re-exports in `custom_tool.py`; `build/`/`dist/` excluded. Surfaces 4 genuine minor items (`bases`, `desc`×3). - **orphan-CI script**: finds none — the repo has no orphaned CI plumbing today. - **Pinning**: `jk actions check` clean for this workflow; `actions/checkout` is SHA-pinned, the two local composite actions need no pin. Local usage is documented under **Dead code detection** in `CONTRIBUTING.md`. ## Note on scope These cover TS/Python/GHA — they would *not* have caught the root `Dockerfile` itself (an arbitrary root file no tool tracks). That class stays a manual-review concern; the orphan-CI script is the closest analogue for the CI surface. |
||
|
Alberto Schiabel
|
cbd1a374fd |
fix(examples): give the Mastra agents a step budget so tool-router returns output (#3789)
## What Add `stopWhen: stepCountIs(10)` to both Mastra example agent entries (`src/index.ts`, `src/tool-router.ts`). ## Why The first nightly `workflow_dispatch` run of `ts.examples-nightly` (after #3788 merged) failed on the **tool-router** example with `Agent returned empty output`. `agent.generate(...)` had no step budget, so the multi-step Tool Router flow (router `search` + `multi-execute` meta-tools, then summarize) stopped after the first tool call and produced no final text. The non-empty-output assertion added in #3788 turned that silent no-op into a loud failure — working as intended. Every other tool-router example/e2e in the repo already sets a step budget; this matches the Mastra tool-router e2e reference (`ts/e2e-tests/runtimes/node/mastra-tool-router-zod-v4/e2e.test.ts` → `stopWhen: stepCountIs(10)`). ## Verification - `pnpm run lint:examples` and `pnpm run typecheck:examples` green. - Nightly re-dispatch to confirm the tool-router example now returns non-empty output against staging (follow-up once merged). ## Notes - No changeset — example package is private/unpublished. - `index.ts` passed without the budget but gets the same `stepCountIs(10)` for robustness/consistency. |
||
|
Alberto Schiabel
|
76881491d0 |
feat(examples): executable, CI-linked Mastra example (Tool Router + Workers) (#3788)
## What Turns the **Mastra** example into an executable reference that doubles as a test, and wires the examples into CI for the first time. First slice of the v1 "executable examples" workstream — the pattern here is the template for the other TS providers, then Python. ## Why Examples under `ts/examples/*` were unverified: the only CI tie-in is `validate-examples.ts`, which is transpile-only (no cross-file types, no lint, no execution) and passes on exactly the schema-conversion regressions we keep hitting in the Mastra provider — all closed but unprotected: - https://github.com/ComposioHQ/composio/issues/2109 (zod→json serialization crash) - https://github.com/ComposioHQ/composio/issues/3307 (`$defs` dropped while `$ref` kept) - https://github.com/mastra-ai/mastra/issues/13909 (already-JSON-Schema tools crash serialization) ## Changes **Canonical Mastra example** (`ts/examples/mastra`) - `src/index.ts` — direct tools on the unauthenticated `HACKERNEWS` toolkit - `src/tool-router.ts` — v1-canonical `composio.sessions.create(...)` → `session.tools()` (drops the deprecated bare `composio.create` alias) - `src/cloudflare.ts` — the same wrapping path on the Cloudflare Workers runtime (`export default { fetch }`) - `src/smoke.ts` — deterministic wrapping + tool-router assertions (needs only `COMPOSIO_API_KEY`) - Removed the old Gmail/MCP entries that used deprecated APIs and required auth - Runnable via `bun ts/examples/mastra/src/{index,tool-router}.ts` **Real typecheck + lint** (examples previously escaped both) - Example now has a `typecheck` script (Node + Worker tsconfigs); `typecheck:examples` / `lint:examples` scripts added - eslint now covers `ts/examples/**` with type-safety rules kept (`no-explicit-any`) and console noise allowed **Two-tier CI** - `ts.examples.yml` — per-PR **blocking**, no secrets: build → typecheck → lint → `wrangler deploy --dry-run`. This is the tier that catches the schema-conversion regressions, since a dropped `$defs`/`$ref` surfaces as a **type** error. - `ts.examples-nightly.yml` — **non-blocking**, scheduled: executes against the **staging** backend with secrets; runs the deterministic smoke always and the full agent examples when an LLM key is set. ## Verification Locally against staging: `smoke` passes (5 direct + 6 tool-router tools), `typecheck:examples` and `lint:examples` are green, the Worker `wrangler deploy --dry-run` bundles, and seeded regressions (a type error / an `any`) correctly fail their gate. ## Notes - No changeset — example packages are private/unpublished. - Follow-ups (separate PRs): template the pattern to the other TS providers, then port to `python/examples/*`. |
||
|
shawn-composio
|
8bd1e415c5 |
chore(docs): remove legacy cookbook examples folder (#3774)
## Summary
Removes the legacy `docs/examples/` cookbook folder — 14 standalone
sample-app folders (`app-connections-dashboard`, `background-agent`,
`chat-app`, `email-support-agent`, `fast-api`, `gmail-labeler`, `hono`,
`pr-review-agent`, `slack-summariser`, `supabase-sql-agent`,
`support-agent`, `tool-generator`, `workplace-search`,
`standup-slackbot`).
This folder was orphaned. The live `/examples` page is sourced from
`content/examples/` (the 3 official examples: `general-agent-with-pi`,
`standup-slackbot`, `local-sandbox-pr-reviewer`), which are
**untouched** by this PR.
## Why it's safe to delete
- No MDX in `content/examples/` uses `<include>` to pull code from
`docs/examples/` — the examples are self-contained.
- `source.config.ts` (`examples = defineDocs({ dir: 'content/examples'
})`) points at `content/examples/`, not `docs/examples/`.
- The `llms.txt` / `llms-full.txt` routes are generated from
`examplesSource` (→ `content/examples/`), so this folder never appeared
in `llms.txt`.
- Nothing in `pnpm-workspace.yaml` or the test scripts references it
(`ts/examples/*` is a different, unrelated folder).
## Changes
- Delete `docs/examples/` (35 files).
- Remove the now-dead `"examples"` entry from `docs/tsconfig.json`
`exclude`.
- Add a note in `docs/decisions/cookbooks-revamp-plan.md` recording the
removal.
## Test plan
- [ ] `/examples` page still renders the 3 official examples
- [ ] `llms.txt` / `llms-full.txt` unchanged (never referenced the
deleted folder)
- [ ] Docs build (`bun run build`) passes
|
||
|
Shawn Esquivel
|
bf806ba7b3 |
docs: embed walkthrough video + add scoped API key creation steps
Add a YouTube walkthrough at the top of the Scoped Project API Key reference page and a short "Create a scoped API key" section with dashboard steps. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
2fcdc43bf9 |
chore: remove dead root Dockerfile and .dockerignore (#3783)
## What Deletes the root `Dockerfile` and `.dockerignore`. ## Why The root `Dockerfile` was **dead code**: - Nothing referenced it — no CI workflow, script, docs, README, or Homebrew tap. The e2e suite has its own Dockerfiles under `ts/e2e-tests/_utils/`. - It had already rotted through the v3 `ts/` monorepo restructure: it pointed at a non-existent root `packages/cli` and pinned an old Node/pnpm toolchain. It couldn't build. - Its `ENTRYPOINT` was just `composio --version` — a smoke/demo image, not a shipped or published artifact. Rather than repair an unused, untested image (which would only rot again with no CI to catch it), we remove it. `.dockerignore` only served that Dockerfile, so it goes too. ## Context Spotted thanks to #3756, which proposed repairing the same file — that surfaced the fact that it was orphaned. Closing that PR in favor of deletion. |
||
|
Abhishek Patil
|
f4d09832fc |
Explain why Google Ads quota errors happen after login (#3778)
## Summary - Add a Google Ads toolkit FAQ entry for quota errors after a successful OAuth login. - Clarify that `RESOURCE_EXHAUSTED` with developer-token rate scope is tied to the Google Ads developer token quota, not the user's connected Ads account. - Recommend retrying after Google's retry window or using a custom OAuth/client setup with a dedicated Google Ads developer token for production workloads. ## Tests - `bun run lint:links` - `bun run test` |
||
|
Jeevesh Jain
|
3ef30b6ca3 |
fix(docs): make favicon eligible for Google search results (#3771)
## Problem Google search results show a generic globe instead of the Composio favicon for docs.composio.dev. ## Root cause The site violated three of Google's favicon guidelines: 1. **`/favicon.ico` returned 404** — the well-known fallback path Google's favicon crawler checks didn't exist (only `app/icon.png` was configured). 2. **The icon was 1350×1350px** — Google wants a square icon that's a multiple of 48px (48, 96, 192, …). 3. **The favicon URL changed on every deploy** — Next.js emits the icon link with a per-deploy content-hash query (`/icon.png?icon.<hash>.png`), so Google never saw a stable URL to index. The favicon shipped in January and still hadn't been picked up. Crawlability was fine (robots.txt allows everything; the icon serves 200 to Googlebot), so these were the only blockers. ## Fix - Add `app/favicon.ico` — multi-resolution ICO (16/32/48px), served by Next.js at the stable `/favicon.ico` path - Resize `app/icon.png` 1350×1350 → **192×192** (multiple of 48; 19.5KB → 6.8KB) - Resize `app/apple-icon.png` → **180×180** (Apple's standard touch-icon size) All generated from the existing logo artwork; background is fully opaque so it renders correctly on Google's white results page. ## Verification Ran the docs dev server locally: - `GET /favicon.ico` → `200 image/x-icon`, valid ICO containing all three embedded sizes - Page head now emits `<link rel="icon" href="/favicon.ico" sizes="48x48">`, `<link rel="icon" href="/icon.png…" sizes="192x192">`, and `<link rel="apple-touch-icon" … sizes="180x180">` After deploy: confirm `curl -sI https://docs.composio.dev/favicon.ico` returns 200, then request re-indexing of the homepage in Search Console. Google typically refreshes a site's favicon within days to ~two weeks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PSoqxdNGZWD2TiuCaJQyVM Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
Rahul Tarak
|
f7397e07ca |
docs: mark migration guides legacy + timestamp; surface example code & legacy status in llms output (#3775)
Follow-up doc fixes from a re-audit of the June "Pi Slack-bot friction"
report against the current docs. Low-risk changes across the migration
guides, the example `.md` output, and legacy handling.
## 1. Migration guides: selective legacy + a "Written {date}" stamp
Migration guides are point-in-time documents, but not all are legacy.
Two mechanisms, decoupled:
- **`legacy: true`** (existing Legacy badge) — only on guides that
migrate off something dead: **new-sdk** (deprecated v1 SDK) and
**tool-router-beta** (removed experimental tool router).
- **`written: "{Month YYYY}"`** (new frontmatter field, dates from git
creation) — renders a standalone **"Written {date}"** stamp on *every*
guide, independent of legacy. So current guides (direct-to-sessions,
mcp-servers-to-sessions, toolkit-versioning, the hub) show their date
without being mislabeled legacy.
Files: `source.config.ts` (new `written` field),
`components/legacy-badge.tsx` (plain badge again), docs page (badge +
date row), 6 migration guides.
## 2. Real example code now in the `.md`/llms output
`<FileBuildup>` / `<RepoBrowser>` render an example's actual source
(`bot.ts`, `install.ts`, …) interactively, but they're React components
that don't serialize to markdown — so
`examples/general-agent-with-pi.md` (what an agent fetches) had all the
prose and **no code**. `mdxToCleanMarkdown` now resolves them from the
`FILE_BUILDS` registry. That example's `.md` grows **6.5 KB → 34 KB**
with the real
`createSessionTools`/`proxyExecute`/`waitForConnections`/`verifyWebhook`
code. Also fixes standup-slackbot and local-workbench.
## 3. Legacy pages: flag in `.md`, skip the current-pattern guardrail
`getLLMText` now prepends "Legacy · written {date}" (or "Written {date}"
for current-dated pages) to the `.md`, and **skips the "enforce ONLY the
current patterns" guardrail block on legacy pages** — appending it to a
legacy guide contradicted the guide's own older content (e.g. new-sdk
showing `tools.execute()` as the v3 target).
## 4. Note that `subscribe()` uses Pusher under the hood
Short aside on the triggers subscribe doc, for readers on runtimes that
restrict WebSocket clients.
---
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Shawn Esquivel
|
f77c9c7cdb |
chore(docs): remove legacy cookbook examples folder
Delete the orphaned docs/examples/ sample-code folder (14 standalone app folders). Nothing referenced it: the live /examples page is sourced from content/examples/, no MDX <include> pulled from it, and it was absent from the source config and the llms.txt/llms-full.txt routes. Also drop the now-dead "examples" entry from docs/tsconfig.json exclude and note the removal in the cookbooks revamp plan. |
||
|
composio-zen[bot]
|
914bccf355 |
docs: fix API reference curl base URL (staging → production) (#3761)
# Description
The curl examples in the API reference docs pointed at **staging**
instead of production.
Reported (Slack): *"Curl in API reference docs points to staging-apollo
instead of backend.composio.dev."*
**Root cause:** the API reference (fumadocs, `docs/lib/openapi.ts`)
renders curl snippets using `servers[0].url` from the committed specs
`docs/public/openapi.json` (v3.1) and `docs/public/openapi-v3.json`
(v3.0). Both had:
```json
"servers": [{ "url": "http://staging-apollo.composio.dev", "description": "STAGING API" }]
```
This is a **recurring** regression, not a one-off stale file. The
scheduled workflow **`.github/workflows/docs-update-data.yml`** (`cron:
'0 */5 * * *'`, plus on Apollo production deploys) deliberately points
`OPENAPI_SPEC_URL` at **staging** (`COMPOSIO_BASE_URL_STAGING`, with a
guard that *fails* if it's production), runs `bun run
scripts/fetch-openapi.mjs`, and auto-commits the regenerated specs via
PR. Staging's spec serves `servers[0].url =
http://staging-apollo.composio.dev` (verified: `GET
https://staging-backend.composio.dev/api/v3{,.1}/openapi.json`), and
`fetch-openapi.mjs` did not override `servers` — so every ~5h the
staging server URL got re-committed (the most recent spec commit
`a3e58a421 docs: update ... API spec ...` came from exactly this
workflow).
The live production backend and the platform-committed apollo spec both
correctly serve `https://backend.composio.dev / PRODUCTION API`.
**Changes:**
- `docs/public/openapi.json` + `docs/public/openapi-v3.json`: set
`servers[0]` to `https://backend.composio.dev` / `PRODUCTION API`.
- `docs/scripts/fetch-openapi.mjs`: pin `spec.servers` to the production
URL in `postProcessSpec`. This is the **durable** fix — because the
update-data workflow fetches from staging, a JSON-only edit would be
reverted within ~5h; pinning in the generator forces the published curl
base URL to production regardless of which environment the source spec
was fetched from.
# How did I test this PR
- **Verified the servers value** in both committed specs (valid JSON):
- `node -e "require('./public/openapi.json').servers"` →
`[{"url":"https://backend.composio.dev","description":"PRODUCTION
API"}]`
- same for `public/openapi-v3.json`
- **Zero residual** `staging-apollo` references under `docs/public`,
`docs/scripts`, `docs/lib`.
- **Confirmed the recurrence mechanism:** read `docs-update-data.yml`
(staging fetch + auto-PR) and confirmed
`staging-backend.composio.dev/api/v3{,.1}/openapi.json` returns
`http://staging-apollo.composio.dev`, while live prod +
`apps/apollo/openapi.json` return `https://backend.composio.dev`. The
`postProcessSpec` pin overrides this in the generator.
- **Generator:** `node --check docs/scripts/fetch-openapi.mjs` → syntax
OK.
- **Docs static tests** (the "Docs - Tests" CI check): `bun test
tests/static/` → 16 pass, 0 fail.
- **CI on this commit:** Docs - Tests ✓, Docs - TypeScript Code
Validation ✓, Docs - Check Links ✓, Secrets Detection ✓, Vercel preview
✓.
- **Codex review:** no correctness issues found.
# Security
- **Trivy** (`fs --scanners vuln,secret --severity CRITICAL,HIGH,MEDIUM
--ignore-unfixed`) on all three changed files → clean (no
vulnerabilities, no secrets).
- **Socket** (dependency/supply-chain): N/A — no dependency or lockfile
changes.
- Note: `security/snyk (Composio)` shows failing, but it's a
**pre-existing repo-wide failure** (errors identically on PRs
#3756–#3761; this change touches no dependencies).
Triggered by: palash@composio.dev | Source: slack
Session: https://zen.corp.composio.io/dashboard/#/chat/zen-e559fb27fb16
Co-authored-by: Zen Agent <zen@composio.dev>
Co-authored-by: palash <palash@composio.dev>
|
||
|
Alberto Schiabel
|
72eac88133 |
fix(cli): replace abandoned decompress dependency (GHSA-mp2f-45pm-3cg9) (#3767)
This PR: - replaces `decompress` (unmaintained; the zip-slip fix in the GHSA advisory was never published to npm past 4.2.1) with `extract-zip` across the CLI's four zip-extraction call sites: `install-skill.ts`, `run-companion-modules.ts`, `upgrade-binary.ts`, and `cli-local-tools/bundled-binaries.ts` - `extract-zip` validates each entry resolves inside the target directory before writing, closing the path-traversal issue `pnpm audit` flags as critical - replaces the one `.tgz`-extracting call site (`scripts/_acp-adapters.ts`, used to vendor ACP adapter binaries at build time) with `tar`, since `extract-zip` only handles zip archives - removes `@types/decompress`; both `extract-zip` and `tar` ship their own type definitions - `pnpm audit --prod --audit-level=high` now passes (previously failing on `next`, unrelated to #3766) Verified `extract-zip` and `tar` extract nested directories correctly with a local smoke test (real `.zip`/`.tgz` archives), in addition to the existing `@composio/cli` (724 tests) and `@composio/cli-local-tools` (13 tests) suites passing.@composio/cli@0.2.32-beta.286 |
||
|
Alberto Schiabel
|
b847a2cfd3 |
fix(core): stop misclassifying local paths starting with "http" as URLs (#3766)
This PR:
- fixes a `startsWith('http')` check in the TypeScript SDK that
misclassified local paths such as `http_export/report.csv` or
`http_backup/.ssh/id_rsa` as URLs
- the misclassification routed those paths through the URL-fetch branch,
which skips both the upload allowlist (`assertPathInsideUploadDirs`) and
the sensitive-path denylist (`assertSafeFileUploadPath`, added in #3763
for GHSA-hp3h-89pf-5q58)
- replaces the naive prefix check with `isHttpUrl()`, a `new
URL()`-based check in `fileUtils.node.ts`, matching the Python SDK's
existing `_is_url()` behavior (`urlparse` + scheme check), which was not
affected by this bug
- updates the three call sites that used the naive check:
`fileUtils.node.ts` (`readFile`, `getFileDataAfterUploadingToS3`) and
`FileToolModifier.node.ts` (`beforeFileUpload` source classification)
- adds a regression test asserting a path like `http_export/.aws/creds`
is still blocked by the sensitive-path denylist rather than routed to
`fetch`
|
||
|
Anas Khan
|
040ffd49a2 |
chore(cli): remove dead duplicate maybe-advice-spans-usage file (#3757)
The captured-errors pretty-printer in the CLI has two files that export the same `maybeAdviseSpansUsage` symbol: - `ts/packages/cli/src/effect-errors/pretty-print/captured-errors/maybe-advise-spans-usage.ts` (the live one, spelled `advise`), re-exported by `captured-errors/index.ts` and consumed by `format-captured-error.ts`. - `ts/packages/cli/src/effect-errors/pretty-print/captured-errors/maybe-advice-spans-usage.ts` (spelled `advice`), which is never exported through the barrel and never imported anywhere. The `advice` file is a leftover from an `advice -> advise` rename: both files were originally introduced identical, and only the `advise` copy was later updated (its leading `''` became `' '` for color-contrast spacing) and wired up. The `advice` copy has since sat as unreferenced dead code that still returns the stale pre-fix value. It ships in the bundle as dead code and is a copy-paste / confusion hazard. This PR deletes it. No linked issue (self-identified cleanup). Fixes # ## Changes - Delete the unused, stale duplicate `ts/packages/cli/src/effect-errors/pretty-print/captured-errors/maybe-advice-spans-usage.ts`. The live `maybe-advise-spans-usage.ts` is unchanged and remains the only exported/imported copy. ## Type of change - [ ] Bug fix - [ ] New feature - [x] Refactor/Chore - [ ] Documentation - [ ] Breaking change ## How Has This Been Tested? Confirmed the removed file is unreferenced, then ran the CLI's checks with the deletion in place (local Node 26 / pnpm 10; CI will verify the pinned toolchain): - Unreferenced check: searched the repo for both the path `maybe-advice-spans-usage` and the token `advice` under `ts/packages/cli/src/` -> 0 matches. Only the live `./maybe-advise-spans-usage` is re-exported by `captured-errors/index.ts`, and `format-captured-error.ts` imports `maybeAdviseSpansUsage` through that barrel. - Build workspace deps: `pnpm run build:packages` -> all packages built. - Typecheck (required when touching CLI code, per `ts/packages/cli/AGENTS.md`): `pnpm exec turbo typecheck --filter=@composio/cli --force` -> pass, fully re-executed (no cache). A missing-module error would surface here if anything had imported the deleted file. - Lint: `pnpm exec eslint ts/packages/cli/src/effect-errors --ext .ts` -> clean. - Tests: `pnpm exec vitest run` in `ts/packages/cli` -> 720 passed, 1 skipped, 80 files. No regressions. ## Screenshots (if applicable) N/A. ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed - [x] I updated documentation as needed (none needed; internal dead code) - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages Tests: not applicable. This is a pure deletion of unreachable code with no behavior change; nothing references the file, so there is nothing to regression-test. The live `maybeAdviseSpansUsage` path is already exercised by the existing effect-errors tests via `format-captured-error`. Changeset: not needed. The CLI package is not published to npm and this is an internal, non-published-surface change. ## Additional context Git history for the curious: both files were introduced identical in `333b03c3b`; the live `maybe-advise-spans-usage.ts` diverged in `fe5acc7d7` (leading `''` -> `' '` for color contrast) and became the wired-up copy, leaving `maybe-advice-spans-usage.ts` behind as the stale duplicate removed here. Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>@composio/cli@0.2.32-beta.285 |
||
|
eeshsaxena
|
3e37f3c7a4 |
test: add unit tests for the mimetypes utility (#3750)
## Summary `composio/utils/mimetypes.py` had no test coverage. This adds a suite for both of its public helpers: **`guess()`** (filename/extension → MIME type): - known extensions resolve correctly (json, html, png, mp4, …) - the lookup table is lower-case, so an upper-case suffix (`photo.PNG`) falls back to the default - unknown / missing extensions return `application/octet-stream` - only the final suffix is used (`archive.tar.gz` == `archive.gz`) - `Path` objects are accepted, not just strings **`get_extension_from_mime_type()`** (MIME type → extension): - direct mappings (`image/png` → `png`, `application/vnd.ms-excel` → `xls`, …) - parameters are stripped (`text/plain; charset=utf-8` → `txt`) and matching is case-insensitive - structured `+suffix` handling: known prefixes win (`application/atom+xml` → `atom`), otherwise the suffix is used (`application/vnd.api+json` → `json`, `application/foo+bar` → `bar`) - subtype fallback (`application/x-custom` → `x-custom`), empty subtype → `txt`, and malformed/empty input → `bin` Tests only — no library code changed. `pytest python/tests/test_mimetypes.py` passes (`32 passed`); `ruff check` / `ruff format --check` are clean. Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
Anas Khan
|
57574e4f7c |
fix(cli): point CLI install URL at the next branch (#3758)
The documented one-line CLI install command curls `install.sh` from the `main` branch: ```bash curl -fsSL https://raw.githubusercontent.com/ComposioHQ/composio/main/install.sh | bash ``` But the repository's default branch is `next` and there is no `main` branch. `raw.githubusercontent.com` does not fall back to the default branch, so the documented command returns HTTP 404 and the install fails for anyone who copies it from `INSTALL.md`. This replaces the `main` branch segment with `next` in the `raw.githubusercontent.com/ComposioHQ/composio/<branch>/install.sh` URL at every documented occurrence, so the install one-liner resolves. It matches the `next` branch already used for the raw asset URL in `README.md`. `install.sh` itself needs no change: it downloads binaries from release assets, not from a branch raw URL. Fixes # <!-- No open issue; self-identified bug. Leave the Fixes line blank, or remove it. --> ### Changes - `INSTALL.md`: update the 5 `.../composio/main/install.sh` URLs to `.../composio/next/install.sh` (One-line Install, Install specific version, and the Troubleshooting / manual-download / environment-variable examples). - `.github/workflows/build-cli-binaries.yml`: same `main` -> `next` update at the 2 URLs inside the `create-install-instructions` job's heredoc, which regenerates `INSTALL.md` as a GitHub Release artifact, so the released copy carries the working URL too and stays consistent with the checked-in file. ### Type of change - [ ] Bug fix - [ ] New feature - [ ] Refactor/Chore - [x] Documentation - [ ] Breaking change <!-- It is a documentation URL fix that also updates the CI job which regenerates that documentation. Marked Documentation; a reviewer may also consider it a Bug fix. --> ### How Has This Been Tested? No application code changed (static Markdown plus a CI heredoc), so no unit test applies. Verified the branch/URL facts directly: ``` # Default branch is next; no main branch exists git ls-remote --symref origin HEAD # -> ref: refs/heads/next git ls-remote --heads origin main next # only refs/heads/next (+ changeset-release/next); no main # The broken vs working URL, live curl -s -o /dev/null -w "%{http_code}" https://raw.githubusercontent.com/ComposioHQ/composio/main/install.sh # 404 curl -s -o /dev/null -w "%{http_code}" https://raw.githubusercontent.com/ComposioHQ/composio/next/install.sh # 200 # After the change: 0 remaining main URLs, 7 next URLs grep -rn "composio/main/install.sh" INSTALL.md .github/workflows/build-cli-binaries.yml # no matches grep -rn "composio/next/install.sh" INSTALL.md .github/workflows/build-cli-binaries.yml # 7 matches # The workflow YAML still parses cleanly after the heredoc edit python -c "import yaml; yaml.safe_load(open('.github/workflows/build-cli-binaries.yml'))" ``` ### Screenshots (if applicable) N/A. ### Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [x] I ran linters/tests locally and they passed <!-- YAML re-parses; grep + curl checks above --> - [x] I updated documentation as needed <!-- this change is the documentation fix --> - [ ] I added tests or explain why not applicable <!-- N/A: static docs URL + CI heredoc, no code path to test --> - [ ] I added a changeset if this change affects published packages <!-- N/A: docs + CI only, no published package --> ### Additional context The 14 `github.com/ComposioHQ/composio/tree/main/...` `homepage` fields in `ts/**/package.json` also point at the non-existent `main` branch, but those are published-package metadata (a different URL form that would require a changeset) and are left out to keep this PR single-purpose. They are a reasonable follow-up.@composio/cli@0.2.32-beta.284 |
||
|
Alberto Schiabel
|
fc17c37bf9 |
fix(cli): enforce sensitive-file upload denylist (GHSA-hp3h-89pf-5q58) (#3763)
This PR: - fixes #3746 / GHSA-hp3h-89pf-5q58 — the CLI's tool file-upload path bypassed the sensitive-file denylist - **root cause:** the denylist was enforced at the *caller* layer, so `@composio/cli`'s duplicate upload path (`readFileFromDisk`) read and uploaded any local path a tool argument pointed at — `~/.ssh/id_rsa`, `~/.aws/credentials`, `.env`, etc. — enabling credential exfiltration via `composio execute` / `composio run` (incl. LLM-driven agents hit by prompt injection) - **unified fix:** one canonical guard, exported from `@composio/core` and enforced at the read primitive in every SDK - `core`: the guard now routes fs/path access through the internal `#platform` abstraction (adds a `realpathSync` method), so it carries **no static `node:*` imports** and is exported from the package root: `assertSafeFileUploadPath`, `isBlockedSensitiveFileUploadPath`, `BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS` - `cli`: `readFileFromDisk` calls the shared `assertSafeFileUploadPath` before `fs.readFile`; URLs and `File` objects are unaffected (matches core) - `python`: already routes all uploads through the guarded `FileUploadable.from_path` — no functional change; adds regression tests for parity - supersedes #3755, which exported the then-node-only guard from core's **main** `index.ts` and would have injected `node:fs` into the shared `dist/index.mjs` (the workerd/edge-light entry), likely breaking Cloudflare Workers / Vercel Edge - changesets: `@composio/core` minor (new public exports), `@composio/cli` patch (security fix) ## Verification - core: full suite passes (997), incl. new root-export + realpath-symlink cases - **edge bundle stays clean**: built `dist/index.mjs` has no static `node:*` imports and reaches the platform only via `#platform` - cli: new regression test drives the real `uploadToolInputFiles → readFileFromDisk → guard` chain — `~/.ssh/id_rsa` and `.env` throw `ComposioSensitiveFilePathBlockedError` before any `createPresignedURL` call; a normal file still uploads - python: `test_files.py` + sensitive-path suite pass (145), incl. 3 new `from_path` guard tests - `tsgo` typecheck + eslint clean for core and cli@composio/cli@0.2.32-beta.283 |
||
|
Alberto Schiabel
|
820abb9072 |
fix(sdk): resolve toolkit versions case-insensitively in both SDKs (#3762)
## Summary
Toolkit version maps are keyed by **normalized (lowercase) slugs** on
the *write* side — env vars (`COMPOSIO_TOOLKIT_VERSION_*`) and
user-supplied dicts both get their keys lowercased when the map is
built. But the *lookup* read the map with the **raw slug**. A pin
configured under a different casing (e.g. `{ "GitHub": "20250101_00" }`
or `COMPOSIO_TOOLKIT_VERSION_GITHUB` looked up as `GitHub`) therefore
missed the map and silently fell back to `"latest"`, which
`Tools.execute` then rejects with a version-required error — discarding
the user's explicit pin.
Rather than patch only the read side, this **centralizes the
normalization rule** into a single helper per SDK and routes **both**
the map-building (write) and lookup (read) paths through it, so the two
sides can never drift apart again:
- **Python** — `normalize_toolkit_slug()` in
`python/composio/utils/toolkit_version.py`
- **TypeScript** — `normalizeToolkitSlug()` in
`ts/packages/core/src/utils/toolkitVersion.ts`, imported by
`getToolkitVersionsFromEnv` in `sdk.ts`
Behavior is now identical across the two SDKs. This **supersedes
#3759**, which patched only the Python read side and left TS diverging.
## Backend verification
Confirmed against the backend (staging, **1403 toolkits across 15
pages**): every toolkit `slug` is already lowercase (the mixed-case
`name` field is display-only). So the *primary* execute path — which
resolves via `tool.toolkit.slug` — was never broken in practice. This
change:
- **hardens** the direct-util and mixed-case-config paths (a user
passing `{ "GitHub": "…" }` now resolves as expected), and
- **removes a latent cross-SDK divergence**: the TS suite previously
asserted `getToolkitVersion` was *case-sensitive* (`versions.test.ts`),
locking in the bug for an input the production code path can't actually
produce. That test is flipped to assert case-insensitive resolution.
## Tests
- **Python** (`python/tests/test_toolkit_version.py`): case-insensitive
lookup via `get_toolkit_versions` round-trip, and against a raw
pre-normalized map. `18 passed`.
- **TypeScript** (`ts/packages/core/test/core/versions.test.ts`):
replaced the case-sensitivity assertion with case-insensitive resolution
+ a write→read round-trip of a mixed-case user pin. Full core suite `997
passed`.
- Typecheck (`tsc --noEmit`) clean; `ruff` clean.
## Notes
- Changeset added: `@composio/core` patch.
- No public API change; the fix is behavioral (case-insensitive) plus an
internal shared helper.
|
||
|
Alberto Schiabel
|
58bc93b2d9 |
chore(deps): consolidate dependency updates (#3760)
This PR: - consolidates https://github.com/ComposioHQ/composio/pull/3733, https://github.com/ComposioHQ/composio/pull/3735 through https://github.com/ComposioHQ/composio/pull/3744, and https://github.com/ComposioHQ/composio/pull/3752 - refreshes the pnpm workspace dependencies under the existing `minimumReleaseAge` supply-chain gate - keeps latest compatible pins for ESLint 9, AI SDK 6, and Cloudflare workers types 4 where latest majors conflict with the current workspace - keeps zod-v3 runtime fixtures on `zod@3.25.76` while bumping the workspace catalog to zod 4 - bumps Python `composio-client` to `1.42.0` and refreshes `uv.lock` - updates the SHA-pinned Claude and Codex workflow actions from the Dependabot action group - adds a patch changeset for the versioned package manifests touched by dependency updates - verifies the rollup with frozen pnpm/uv locks, peer checks, audit threshold checks, typecheck, lint, builds, TypeScript tests, and Python `nox -s chk` ## Context `pnpm audit --prod --audit-level=moderate` passes. The remaining production audit item is a low `@ai-sdk/provider-utils` advisory through Mastra transitive dependencies; forcing it higher would require leaving the compatible stable Mastra dependency path.@composio/cli@0.2.32-beta.282 |
||
|
Alberto Schiabel
|
d3875f99d1 |
chore(ci): add least-privilege tokens, fork-pr guards, audit gate (#3748)
This PR: - depends on #3751 (dependency fixes split out; **merge #3751 first** or the new audit gate below is red) - adds top-level `permissions: contents: read` to the 23 workflows missing one, with job-level opt-ups only where jobs demonstrably need writes (releases, docs automation PR creation, audit PR comments); the `security.secrets-detection.yml` caller job mirrors the reusable workflow's declared scopes so the secret-scanning check keeps working under the cap - pins the secrets-detection reusable-workflow ref to ComposioHQ/.github@a6c053d (master, post ComposioHQ/.github#12) whose actions are now SHA-pinned, fixing the `startup_failure` every PR was hitting - guards all four E2E jobs in `ts.test-e2e.yml` so dependabot and fork PRs (which get no secrets) skip secret-backed steps with a `::notice` instead of failing red; install/build and the secret-free CLI docker build still run on fork PRs - makes `pnpm audit --prod --audit-level=high` a hard gate in `ts.audit.yml` (the advisory PR-comment flow is unchanged) and adds root `package.json`/`pnpm-lock.yaml`/`pnpm-workspace.yaml` to the audit triggers so manifest-only changes can't bypass it - drops the orphaned job-level `pull-requests: write` from `ts.test.yml` (no step has used the PR API since the #2212 comment step was removed) ## Context Implements `plans/002-ci-hardening-permissions-and-fork-guards.md` (advisor plan, orthogonal to the SDK v1 roadmap). A hard `pnpm audit` gate was tried once before and reverted for blocking unrelated PRs (#2213, `dec0ced78`); it lands now paired with #3751, which clears the high advisories, and it only fails on high/critical advisories in production dependencies. Reviewer notes: - release workflows verified statically: `py.release` publishes via PyPI credentials (no token writes); `ts.release` does all writes via the minted GitHub App token and keeps `id-token: write` - worth a dry run after merge: one fork PR to confirm the four skip notices, and one same-repo Secrets Detection run to confirm no 403 warning (the run on this PR already passed clean) - known follow-ups (deliberately out of scope): dev-dependency high advisories (gate is `--prod`), a scheduled audit run, encoding the permissions convention in `.agents/skills/repo-guidance`, extracting the duplicated guard into a composite action |
||
|
Alberto Schiabel
|
49e4c11427 |
chore(deps): resolve high prod audit advisories via in-range bumps (#3751)
This PR: - refreshes lockfile resolutions for the 17 high `pnpm audit --prod` advisories via `pnpm update -r` — real version bumps within the ranges parents already declare (minimatch 5/9, lodash, fast-uri, picomatch, langsmith, `@hono/node-server`, express-rate-limit, ws), not resolution overrides - bumps the pre-existing #3467 security pin `protobufjs: 7.5.9 -> 7.6.1` in `pnpm-workspace.yaml` (7.5.9 itself is vulnerable to GHSA unbounded-Any DoS) - adds ONE temporary scoped override, `minimatch@>=10.0.0 <10.2.3 -> >=10.2.3`: `@zed-industries/claude-code-acp@0.16.2` (latest) exact-pins vulnerable `minimatch 10.2.1` and no fixed release exists; commented in the file, drop when upstream ships - no `package.json` changes anywhere: none of the vulnerable packages is a direct dependency of any workspace package, so there is nothing to major-bump on our side ## Context Split out of #3748 (CI hardening) so dependency changes land in isolation. **Merge this before #3748** — its new `pnpm audit --prod --audit-level=high` hard gate needs this green baseline, per the plan's "gate lands together with the dependency fix" rule. Verified: `pnpm audit --prod --audit-level=high` exits 0 (remaining: 1 low, 6 moderate); `pnpm install --frozen-lockfile` passes. Dev-path high advisories (vite, undici, flatted, linkify-it, minimatch 3.x) are out of scope — the gate is `--prod`; tracked as backlog. |
||
|
Alberto Schiabel
|
8d5823be87 |
chore(ci): cache turbo, bun, and uv and cancel superseded pr runs (#3747)
This PR: - adds `concurrency` to the ten PR/push CI workflows: superseded **PR** runs are cancelled, while push runs use a per-run group (`github.run_id`) so every commit on `next`/`master` still gets its own run - caches turbo outputs (`.turbo/cache`) via a new opt-in `enable-turbo-cache` input on the `setup-node-pnpm-bun` composite (keyed per job — concurrent jobs save different task graphs), enabled in `ts.build`, `ts.test`, `ts.typecheck`, and all four `ts.test-e2e` jobs - enables turbo caching for `typecheck`, removes the incorrect `dist/` outputs from `test`, hashes root `tsconfig.base.json` in `build`/`typecheck` inputs, and adds `mise.toml`/`mise.lock` to `globalDependencies` so toolchain bumps bust every task hash (addresses the Bugbot finding) - fixes `@composio/slim`'s build to participate in the turbo graph: core moves to slim's `devDependencies` (published `dependencies` unchanged) and the script no longer shells out to `pnpm --filter @composio/core build`, which raced concurrent dependents by wiping `core/dist` mid-build and double-built core on every cold run — slim's `dist` remains byte-identical to core's; no changeset added since the published artifact is unchanged (say the word if policy wants one anyway) - fixes the `py.test` matrix cache to `~/.cache/uv` (it cached `~/.cache/pip` while installing via `uv pip`) and caches `~/.bun/install/cache` in the five docs workflows - adds `turbo.jsonc` to the TS workflows' path filters (previously unwatched) - release/publish workflows are deliberately untouched Measured (same commit, cold first attempt vs `gh run rerun` warm): ts.build 103s → 53s, ts.test 157s → 55s (`turbo test` 24/24 cached in 182ms), ts.typecheck 80s → 43s; py.test legs save a few seconds each (uv was already fast). Warm floor is checkout + mise + pnpm-install overhead. ## Context Implements `plans/001-ci-speed-caching-and-concurrency.md` from the advisor audit on `docs/sdk-v1-decision-records`. Implementation by codex against the plan, then self-reviewed and counter-reviewed; warm-rerun testing surfaced and fixed three latent issues (toolchain files absent from turbo's hash, first-writer-wins cache-key collision across jobs, and the slim out-of-band core rebuild race).@composio/cli@0.2.32-beta.281 |
||
|
github-actions[bot]
|
a3e58a4216 |
docs: update toolkits, API spec, and meta tools data (#3426)
## Summary Automated sync of backend data into the docs site. Triggered by: `workflow_dispatch`. ## What changed - **Toolkit catalog** (`docs/public/data/toolkits.json`, `toolkits-list.json`) — refreshed list of available toolkits, auth schemes, and tools from the backend API - **OpenAPI specs** (`docs/public/openapi.json`, `docs/public/openapi-v3.json`) — latest v3.1 and v3.0 API specifications fetched from staging - **API reference pages** (`docs/content/reference/api-reference/`, `docs/content/reference/v3/api-reference/`) — regenerated index pages for both API versions - **Meta tools reference** (`docs/public/data/meta-tools.json`, `docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas and reference docs Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
Alberto Schiabel
|
8e8ce95eb3 |
fix(docs): paginate toolkits fetch so the full catalog reaches the site (#3745)
This PR: - fixes the `docs.composio.dev/toolkits` search returning 0 results for toolkits like Workday that exist in the catalog - paginates `fetchToolkits()` in `generate-toolkits.ts` by following `next_cursor`: `GET /api/v3/toolkits` silently caps `limit` at 1000 per page and defaults to usage ordering, so the previous single-request fetch shipped only the top-1000 toolkits — about half of the ~2.1k catalog - dedupes across pages by slug (pages can overlap when the catalog shifts between cursor fetches) and throws instead of silently truncating if the catalog ever outgrows the page guard, mirroring the dashboard's `listToolkits` procedure - fixes the `docs-update-data.yml` workflow, broken since the sessions-first docs rewrite (https://github.com/ComposioHQ/composio/pull/3637) moved the generated meta-tools MDX to `docs/content/toolkits/meta-tools/`: `create-pull-request` aborted on the stale `docs/content/reference/meta-tools/` pathspec, so every scheduled data sync since then failed at the Create Pull Request step and docs data went stale - updates the request-volume notes in `fetch-with-retry.ts` and `scripts/README.md` (~3000 → ~6500 requests per run); the existing 429 backoff already absorbs the larger run ## Context The toolkits landing page filters a build-time snapshot (`public/data/toolkits-list.json`) client-side, so every toolkit missing from the snapshot is unsearchable and its detail page has no data. The snapshot regenerates via the scheduled `docs-update-data.yml` workflow; with both fixes in place the automated data PR picks up the full catalog and the "Browse N toolkits" count grows from 1000 to the real catalog size. Verified offline by running the script against a stubbed paginated backend (1500 toolkits across 2 pages): all pages are fetched, ordering is preserved, no duplicates. `bun run types:check` and eslint pass. A manual `workflow_dispatch` of the fixed workflow on this branch produced the full-catalog data PR. |
||
|
Alberto Schiabel
|
2e42d75259 |
fix(py): apply skip_default to agentic provider signatures (langchain, langgraph, autogen) (#3730)
## Summary
Agentic providers honor `schema_config={"skip_defaults": True}` for
`args_schema` (defaults stripped, fields become required) but were
**not** applying the same `skip_default` to the function
`__signature__`, so the wrapped tool's signature and `args_schema`
disagreed about which defaulted params were optional. The sibling
`llamaindex` provider already passed it to both.
**Supersedes #3727.** This is the polished version, now that the ag2
migration (#3729) landed and `composio-autogen` imports again — so the
autogen case uses a real import instead of the earlier source-load stub,
and the parity tests run in CI.
## Changes
- **langchain / langgraph** (original commit by @anxkhn): pass
`skip_default=self.skip_default` to
`get_signature_format_from_schema_params`.
- **autogen**: same one-line alignment. autogen builds **only**
`__signature__` (no `args_schema`), so it never had the *mismatch* — but
its signature still ignored `skip_defaults`. Aligned for consistency;
verified on the signature alone.
- **tests**: `TestAgenticSkipDefaultsParity` guards each provider with
`pytest.importorskip`; adds real-import autogen regression tests (no
stub).
- **CI + nox**: install `providers/autogen` in the unit-test job
(`py.test.yml`) and the nox `tst` session so the autogen parity tests
actually run, plus a **hard `import composio_autogen` smoke check** in
CI.
## Why the CI import guard (not just the tests)
The `importorskip`-guarded unit tests **skip** when a provider can't be
imported — which is the correct behavior for optional providers, but
means they'd *silently skip* if autogen broke on a fresh install
(exactly the failure that #3729 just fixed). The extra `python -c
"import composio_autogen"` in the import step is a **hard** check that
fails loudly, so a future dependency breakage can't slip through as a
green build.
`providers/langchain` + `providers/autogen` co-install cleanly
(verified: 59 packages, ag2 0.14.0, no conflict). langgraph continues to
skip in CI — its code path is identical to langchain's, which runs.
## Type of change
- [x] Bug fix
## How Has This Been Tested?
- Base venv (langchain only): langchain parity **passes**, langgraph +
autogen **skip** (no error).
- CI-mirror (langchain + autogen, editable): **4 passed, 2 skipped
(langgraph)** — autogen tests actually run and pass.
- Regression proof, each provider: reverting only the provider line
fails the skip-defaults case with `assert 5 is Parameter.empty`;
restoring passes. Verified for langchain **and** autogen.
- `ruff check`, `ruff format --check`, `mypy`, and full
`tests/test_provider.py` (29 passed, 4 skipped) → clean. `py.test.yml`
parses.
## Checklist
- [x] I ran linters/tests locally and they passed
- [x] I added tests: langchain/langgraph parity + regression, and
autogen parity that runs in CI
- [ ] Changeset: not applicable — Python-only change.
## Credits
Original fix by @anxkhn (#3713 → #3727), preserved as the first commit
and co-authored on the follow-up.
---------
Co-authored-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
|
||
|
Alberto Schiabel
|
5ac2de2431 |
fix(py): migrate composio-autogen off abandoned pyautogen to ag2 (#3729)
## Summary `composio-autogen` fails to import on a fresh install: the provider depended on the abandoned `pyautogen` distribution, whose latest release (`0.10.0`) ships **no top-level `autogen` module**. The pin `pyautogen>=0.2.19,<0.11` resolves straight to it, so `import composio_autogen` raises `ModuleNotFoundError: No module named 'autogen'`. The autogen 0.2 lineage moved to the **`ag2`** distribution (`0.14.x`), which provides the same `autogen` package the provider uses (`ConversableAgent`, `autogen.agentchat.register_function`) alongside `autogen-core`. This swaps the dependency. Closes #3728. ## Changes - `providers/autogen/pyproject.toml` and `providers/autogen/setup.py`: `pyautogen>=0.2.19,<0.11` → `ag2>=0.14,<1.0`. `flaml` and `autogen_core` unchanged. **No provider code changes** — the imports and runtime API are identical across the two distributions. ## Type of change - [x] Bug fix ## How Has This Been Tested? Verified in isolation via `uv run --with ./providers/autogen` (a real fresh install of the provider with its new deps → resolves `ag2 0.14.0`): 1. **Import** — `import composio_autogen` now succeeds (previously `ModuleNotFoundError`). 2. **`wrap_tool`** — returns a real `autogen_core.tools.FunctionTool` with the expected signature. 3. **`register_tools` → `autogen.agentchat.register_function`** — the AG2 runtime path works end to end: - caller (LLM side): `caller.llm_config.tools` advertises the tool, - executor (execution side): the function lands in `executor._function_map`. `flaml==2.6.0` + `autogen-core==0.7.5` resolve cleanly alongside `ag2 0.14` (no conflict). ## Notes / follow-up This class of bug (a provider silently un-importable on fresh install) slipped through because **CI never installs or imports the autogen provider** — the unit-test job only installs `providers/langchain`. Worth a small follow-up: add a fresh-install import smoke test for the agentic providers so this can't recur silently. Left out here to keep this PR to the dependency fix and avoid adding ag2's install weight to the main test matrix. ## Checklist - [x] I ran the migration verification locally (isolation) and it passed - [ ] Changeset: not applicable — Python-only change. |
||
|
Alberto Schiabel
|
e78ed312c6 |
fix(core): run all parallel OpenAI tool calls from the first choice (#3726)
This PR: - supersedes https://github.com/ComposioHQ/composio/pull/3712, preserving the original commits by @serhiizghama (kept as author/co-author) - fixes `OpenAIProvider.handleToolCalls` to execute **every** tool call in an assistant message — it previously only read `tool_calls[0]`, so parallel tool calls (on by default) were dropped and their `tool_call_id`s went unanswered, failing the next request with the "must be followed by tool messages responding to each `tool_call_id`" error - limits execution to the **first choice** — with `n > 1` the previous loop ran each tool call once per choice and orphaned the `tool_call_id`s belonging to the alternative completions - aligns the Python SDK (`OpenAIProvider.handle_tool_calls`) with the same first-choice behavior so both SDKs stay in parity - fixes the stale `@composio/openai` test that modeled "multiple tool calls" as separate `n` choices rather than one message's `tool_calls` array - clarifies in the changeset that the calls run **sequentially**, in the order the model returned them (here "parallel" means the model issued several calls in one turn, not concurrent execution), so each `tool_call_id` is answered exactly once and deterministically - adds regression tests (TS + Python): both calls run for parallel tool calls in one message, and only the first choice runs when `n > 1` Full `@composio/core` (996) and `@composio/openai` suites green; Python `handle_tool_calls` tests, Ruff, and mypy clean; `tsc` clean. --------- Co-authored-by: serhiizghama <zmrser@gmail.com> |
||
|
sdkrelease[bot]
|
d30c9f24a0 |
docs: update guides for SDK changes (#3724)
## Summary
Automated docs update triggered by SDK source changes on `next`.
- Claude reviewed the SDK diff and updated guides, FAQs, or examples
that reference changed APIs or features.
- The docs `@composio/*` dependencies were realigned to their latest
published releases so Twoslash snippets and example apps validate
against versions users can actually install.
## Review checklist
- [ ] Changes accurately reflect the new SDK behavior
- [ ] No unrelated docs were modified
- [ ] Code examples are correct and complete
- [ ] If a documented feature is not published yet, the Twoslash build
will fail — wait for the release instead of working around it
Generated by Claude Code via GitHub Actions.
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
|
||
|
Alberto Schiabel
|
a69c3edea3 |
fix(triggers): align create() user_id resolution across SDKs (#3723)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3714 — addresses its code-review findings - restores TS/Python parity on slug validation: Python `create()` now validates the slug up-front and raises a new `TriggerTypeNotFound`, mirroring the TS `ComposioTriggerTypeNotFoundError` - switches both SDKs to the native `user_id` upsert field — TS drops the `& { user_id }` intersection and Python drops the `extra_body` shim (both pinned clients already expose the field) - treats a blank/whitespace `userId` (TS) or `user_id`/`connected_account_id` (Python) as missing instead of forwarding it to the backend - documents the error-contract change (`create()` no longer throws `ComposioConnectedAccountNotFoundError` — that case now surfaces from the backend) in the changeset and `ts/docs/api/triggers.md`, and bumps the changeset from `patch` to `minor` - adds Python tests for the 2FA (both-provided) path, unknown-slug, and blank `userId`; tightens the TS auto-resolve assertion and adds an empty-`userId` case ## ⚠️ Release gating Since #3714, `triggers.create()` (both SDKs) relies on the backend resolving the trigger connection from `user_id` on upsert ([ComposioHQ/platform#10932](https://github.com/ComposioHQ/platform/pull/10932)). There is **no client-side fallback** — reintroducing one would undo #3714's intent, so this is a release-sequencing requirement, not a code change here. - Do not release `@composio/core` or the Python SDK until #10932 is live in all regions. - Self-hosted / on-prem deployments must be on a backend version that includes #10932. ## Review findings addressed | # | Finding | Resolution | |---|---------|------------| | P1-1 | Coupled to unreleased backend, no fallback | Documented dependency in changeset; flagged release-gating above (no fallback by design) | | P2-2 | Cross-SDK parity on slug validation | Kept `getType` in both; added Python `TriggerTypeNotFound` mirroring TS | | P2-3 | `user_id` bridge redundant in both SDKs | TS uses native field directly; Python uses `user_id=` kwarg | | P2-4 | Error-contract change shipped silently | Documented in changeset + docs `Throws` section; `minor` bump | | P2-5 | Python missing 2FA (both-provided) test | Added `test_create_with_user_id_and_connected_account_id` | | P3 6–13 | Cleanups | undefined-assertion, `none_to_omit`, docstring, `parsedBody.data`, redundant `else`, stale comments, blank-string guard | ## Verification - TS: `vitest` 59 passed, `typecheck` clean, `eslint`/`prettier` clean - Python: `pytest tests/test_triggers.py` 69 passed, `nox -s chk` (ruff + mypy) clean |
||
|
Anas Khan
|
c660007c71 |
fix(py): handle typeless and empty combiner schemas in openapi signatures (#3710)
### Summary
`function_signature_from_jsonschema` in
`python/composio/utils/openapi.py` builds the `__signature__` for tools
wrapped by the `google_adk` provider
(`providers/google_adk/composio_google_adk/provider.py:66`). It already
falls back to `Any` for a top-level property with no `type`, but the
nested combiner helpers do not, so real combiner shapes crash at wrap
time:
- a `oneOf`/`anyOf` option with no `type` key -> `KeyError: 'type'`
- an empty `oneOf`/`anyOf` list -> `TypeError: Cannot take a Union of no
types`
- an empty `allOf` list -> `KeyError: 'type'` (merges to `{}`)
This extends the existing "default to Any" intent to nested options.
Follow-up to #3708, which fixed the same bug family in `shared.py` and
noted this `openapi.py` case for a separate PR.
Fixes #
### Changes
- `_type_to_parameter`: read `schema.get("type")` instead of
`schema["type"]`; when the type is missing, return `t.Any` (mirrors the
top-level fallback). An unknown *string* type still raises
`InvalidSchemaError`.
- `_handle_composite_type`: return `t.Any` for an empty option list
instead of building an empty `Union`. Empty `allOf` merges to `{}` and
resolves to `Any` via the above.
- New `python/tests/test_openapi.py` (11 tests): this builder had none.
Asserts the five former crashes now resolve to `Any`, and that existing
shapes are unchanged.
### Type of change
- [x] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [ ] Documentation
- [ ] Breaking change
### How Has This Been Tested?
From `python/`:
```
uv run pytest tests/test_openapi.py -q # 11 passed
make chk # ruff + mypy -> clean
```
To confirm the tests guard the fix, the five former crashes (typeless
`anyOf`/`oneOf` option, empty `anyOf`/`oneOf`/`allOf`) raise on the
unmodified file and now resolve to `Any`; regressions cover
`anyOf:[str,null]` -> `Optional[str]`, a 4-member union, enum, array,
object, and a typeless property.
### Checklist
- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [ ] I updated documentation as needed (internal util)
- [x] I added tests (new test_openapi.py)
- [ ] I added a changeset (Python-only, not needed)
Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com>
|
||
|
Anas Khan
|
b0ab8eacff |
fix(py): handle 4+ option and typeless anyOf/oneOf unions in tool signatures (#3708)
## Summary
`get_signature_format_from_schema_params` in
`python/composio/utils/shared.py` builds the `__signature__` for the
tool wrappers used by the langchain, langgraph, llamaindex, and autogen
providers. Its `oneOf`/`anyOf` handling hardcoded a ladder for exactly
1, 2, or 3 union members and raised `ValueError("Invalid 'oneOf'
schema")` for any union with four or more options. It also indexed
`PYDANTIC_TYPE_TO_PYTHON_TYPE[ptype.get("type")]` directly, so any
combiner option missing a `type` key produced `None` and raised
`KeyError(None)`.
Both shapes are valid JSON Schema and appear in real tool input schemas,
so a tool with a 4-way union, or a combiner option without an explicit
`type`, makes those four providers raise at tool-wrap time. This
replaces the ladder with a single map + `functools.reduce` path that
mirrors the existing `_build_union_from_options` in
`schema_converter.py`, keeping the 1/2/3-member and nullable `[type,
null]` outputs identical to before.
Fixes #
## Changes
- `python/composio/utils/shared.py`: in
`get_signature_format_from_schema_params`, replace the 1/2/3-member
`oneOf`/`anyOf` ladder (which raised `ValueError` for 4+ members) with a
map-each-option-to-a-Python-type + `functools.reduce` Union build that
supports any member count. Unknown/missing option types map to
`typing.Any` instead of raising `KeyError`. Adds `from functools import
reduce` and removes three now-unnecessary `# type: ignore` comments.
- `python/tests/test_schema_parser.py`: add
`TestGetSignatureFormatFromSchemaParams` (8 cases) covering 4- and
5-member unions, an `anyOf` option missing `type`, an all-typeless
`anyOf`, and regressions for the previously supported single/2/3-member
and nullable `[type, null]` shapes.
## Type of change
- [x] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [ ] Documentation
- [ ] Breaking change
## How Has This Been Tested?
From `python/`:
```
uv run pytest tests/test_schema_parser.py::TestGetSignatureFormatFromSchemaParams -v # 8 passed
uv run pytest tests/test_schema_parser.py -q # 75 passed
make chk # ruff + mypy -> clean, no new ignores
```
To confirm the tests guard the fix, the new test class was also run
against the unmodified `shared.py`: 4 of the 8 fail there
(`ValueError`/`KeyError` on the 4+/typeless cases), and all 8 pass with
this change. The nullable `anyOf [type, null]` case still resolves to
`Union[str, Any, NoneType]` (its pre-existing behavior); collapsing
`null` into `Optional` lives in `schema_converter` and is intentionally
left out of this minimal fix, with the test documenting current
behavior.
## Screenshots (if applicable)
N/A
## Checklist
- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [ ] I updated documentation as needed
- [x] I added tests or explain why not applicable
- [ ] I added a changeset if this change affects published packages
## Additional context
No linked issue: this is a self-identified, reproduced bug in the older
schema->signature path. The fix deliberately mirrors
`schema_converter._build_union_from_options` so the two schema paths
agree on N-ary union handling. The same bug family exists in
`python/composio/utils/openapi.py`
(`function_signature_from_jsonschema`, used by the google_adk provider)
but is kept out of this PR to stay single-purpose; happy to follow up on
it separately.
|
||
|
Anshu Garg
|
20a4711ee0 |
feat(triggers): resolve connection from user_id server-side in create() (#3714)
## What `triggers.create()` used to make an extra **`connectedAccounts.list()`** call to turn a `user_id` into a `connected_account_id` before calling upsert. The backend now resolves the connection from `user_id` directly (picks the first active connection for the user + the trigger's toolkit, parity with tool execution), so the SDK passes `user_id` straight through and drops the round-trip. - **TS** (`ts/packages/core`): removed the `connectedAccounts.list()` block in `Triggers.create()`. `user_id` was already forwarded to upsert (for 2FA); this just removes the now-redundant lookup. `getType` is kept for an early, clear "trigger type not found" error. `connected_account_id` is passed when the caller pins one. - **Python** (`python/composio`): dropped `_get_connected_account_for_user`; `user_id` is sent via `extra_body` and `connected_account_id` is omitted when not provided. ## Why The SDK only ever holds a `user_id`, so every `triggers.create()` paid an extra API call to find a connection. The backend change (ComposioHQ/platform#10932) makes trigger upsert accept `user_id` and auto-resolve — this PR consumes that. ## Behavior notes - When `connected_account_id` is omitted, the backend picks the first active connection ordered by `created_at desc`. The TS SDK's old `list()[0]` ordering was unspecified — selection is now deterministic and consistent with tool execution. - "No connected account found" / "connected account not found" now surface from the **backend** instead of a client-side pre-check. - When 2FA is enabled and `connected_account_id` is pinned, the backend validates that `user_id` owns it (unchanged; `user_id` was already forwarded). - The `extra_body` / `& { user_id }` bridges are still needed only until `@composio/client` / `composio_client` regenerate with `user_id` on the upsert type (the field is already in the OpenAPI contract). ## Tests - TS: `vitest run test/models/triggers.test.ts` → **58 passed** (create tests rewritten to assert no `connectedAccounts.list()` call + `user_id` forwarded). - Python: `pytest tests/test_triggers.py` → **66 passed** (same). ## Depends on Backend: ComposioHQ/platform#10932 (`feat(apollo): resolve trigger connection from user_id on upsert (PLEN-2580)`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
4c3a321550 |
fix(core): disable retries on non-idempotent tools.execute/proxyExecute (#3716)
This PR: - Closes https://github.com/ComposioHQ/composio/issues/3586 - disables client retries on `tools.execute` and `tools.proxyExecute` — the two non-idempotent writes — so a request that succeeds server-side but times out client-side is no longer silently replayed (the cause of duplicate `GMAIL_SEND_EMAIL` sends) - routes both through a sibling client built with `withOptions({ maxRetries: 0 })`; reads keep the client's default retries (`maxRetries: 2`) - caches that sibling per `Tools` instance (`clientWithoutRetries`) since `withOptions` constructs a fresh client and execute/proxy is the hottest path; mirrors the Python SDK's `client.without_retries` - adds regression tests asserting both paths route through `maxRetries: 0` and that the sibling is built once across multiple executes ## Context The original hang on attachments larger than ~25 KB was a backend defect and has already been fixed server-side. The remaining gap was a cross-SDK parity one: the Python SDK already disabled retries on these non-idempotent writes, but `@composio/core` still inherited the client default of 2 retries (3 attempts total), with no public knob to turn them off. This is the TypeScript parity port — scoped to exactly `tools.execute` / `tools.proxy`, leaving `toolRouter.session.execute` and all reads on their default retry behaviour, matching Python. |
||
|
Abhishek Patil
|
0f0ca14a8f |
docs: refresh OpenAPI reference (#3699)
## Summary
- Refresh the checked-in v3.1 and v3 OpenAPI snapshots from the live
backend specs using `bun run scripts/fetch-openapi.mjs`.
- Regenerate API reference index pages with `bun run
generate:api-index`.
- Surfaces `DELETE /api/v3.1/tool_router/session/{session_id}` in the
Tool Router API reference.
- Includes the other upstream generated spec changes from the same
auto-fetch, including generated API Keys and Organization Management
section indexes.
## Verification
- `bun run scripts/fetch-openapi.mjs`
- `bun run generate:api-index`
- `git diff --check`
- `bun run build`
## Notes before merge
- This is intentionally the full auto-generated OpenAPI refresh, not the
surgical two-file patch.
- The generated backend OpenAPI still contains some `internal` wording
in descriptions; left as-is to preserve the auto-generated output.
- Confirm the newly generated API Keys / Organization Management
sections are intended to publish with this refresh.
---------
Co-authored-by: jkomyno <alberto@composio.dev>
|
||
|
sdkrelease[bot]
|
e7291ba997 |
docs: update Python SDK reference from source (#3703)
## Summary Auto-generated Python SDK reference docs from `python/composio/`. Regenerates pages at `docs/content/reference/sdk-reference/python/` to reflect changes in the Python package's public API (new methods, updated signatures, changed types). Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> Co-authored-by: Alberto Schiabel <jkomyno@users.noreply.github.com> |
||
|
Alberto Schiabel
|
03cb181fdb |
chore(deps): roll up dependency bumps (#3711)
This PR: - rolls up https://github.com/ComposioHQ/composio/pull/3695, https://github.com/ComposioHQ/composio/pull/3696, https://github.com/ComposioHQ/composio/pull/3697, and https://github.com/ComposioHQ/composio/pull/3698 into one dependency-bump branch - updates Python dependency metadata for `langchain-openai`, `pyautogen`, and `crewai` - updates npm production dependency metadata for `zod-to-json-schema`, `openai`, and `@modelcontextprotocol/sdk` - refreshes `uv.lock` and `pnpm-lock.yaml` with the repo-pinned package managers - leaves Changesets unchanged because the touched TS package manifests are private/ignored and no published TS SDK package metadata changes - verified with `pnpm install --frozen-lockfile`, `pnpm lint`, `pnpm typecheck`, focused TS builds/tests, clean-worktree `pnpm test:examples`, Python import tests, and Python nox checks - note: local `pnpm build:packages` hit a pre-existing broad-build race around `@composio/slim` rebuilding `@composio/core`; focused dependent builds pass --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>@composio/cli@0.2.32-beta.280 |
||
|
dependabot[bot]
|
de6a8ce295 |
chore(deps): bump the github-actions group across 1 directory with 7 updates (#3694)
Bumps the github-actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.0` | | [swift-actions/setup-swift](https://github.com/swift-actions/setup-swift) | `2.4.0` | `3` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.140` | `1.0.159` | | [openai/codex-action](https://github.com/openai/codex-action) | `1.8` | `1.9` | | [anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action) | `1.0.140` | `1.0.159` | | [actions/cache](https://github.com/actions/cache) | `5.0.5` | `6.1.0` | | [actions/setup-python](https://github.com/actions/setup-python) | `6.2.0` | `6.3.0` | Updates `actions/checkout` from 6.0.2 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br /> Updates `swift-actions/setup-swift` from 2.4.0 to 3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/swift-actions/setup-swift/releases">swift-actions/setup-swift's releases</a>.</em></p> <blockquote> <h2>3.0.0 Beta 1</h2> <h2>Beta 1 of using Swiftly to setup Swift</h2> <ul> <li>Now uses Swiftly to set up Swift</li> <li>Added flag <code>skip-verify-signature</code> to disable GPG verification checks</li> </ul> <h2>Features</h2> <ul> <li>Setup Swift more Swiftly 🚀 (setup-swift 3.0) (<a href="https://redirect.github.com/swift-actions/setup-swift/issues/710">#710</a>) <a href="https://github.com/fwal"><code>@fwal</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/swift-actions/setup-swift/commit/364295d9c23900ce04d4e5cc708387921b4e50f9"><code>364295d</code></a> Bump build</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/7ef546c485df71a42699fdc047a6da322da93917"><code>7ef546c</code></a> Update readme</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/3273319f0f0618754506c4c1254da1ec36527312"><code>3273319</code></a> Bump swiftly</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/a90d2583fe1ebfd214260283f072a5fd4fb21ed0"><code>a90d258</code></a> Pass skip flag</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/ded451bd855f0672b0d538b7b00f0f48958284d7"><code>ded451b</code></a> Update workflows</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/0dad4e4b3ad6947c15c7ce23c6193d548ffb067c"><code>0dad4e4</code></a> Merge pull request <a href="https://redirect.github.com/swift-actions/setup-swift/issues/710">#710</a> from swift-actions/next</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/4abecca1bb9fd97e4857628fef56642847a3f8a8"><code>4abecca</code></a> Build</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/0c751509fec030bde17c1c403ee2cd10c61168d9"><code>0c75150</code></a> Formatting</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/7849873cbfe87fdcd1a020cc9cc31d317662e8bb"><code>7849873</code></a> Update gpg handling</li> <li><a href="https://github.com/swift-actions/setup-swift/commit/9005990785b87227ac8641478fa68113afcd07ac"><code>9005990</code></a> Merge branch 'main' into next</li> <li>Additional commits viewable in <a href="https://github.com/swift-actions/setup-swift/compare/7ca6abe6b3b0e8b5421b88be48feee39cbf52c6a...364295d9c23900ce04d4e5cc708387921b4e50f9">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action` from 1.0.140 to 1.0.159 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's releases</a>.</em></p> <blockquote> <h2>v1.0.159</h2> <h2>What's Changed</h2> <ul> <li>fix: bound app token revocation cleanup by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tarunag10"><code>@tarunag10</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159</a></p> <h2>v1.0.158</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158</a></p> <h2>v1.0.157</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157</a></p> <h2>v1.0.156</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156</a></p> <h2>v1.0.155</h2> <h2>What's Changed</h2> <ul> <li>fix: filter PR reviews and inline review comments to trigger time by <a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li>test: cover format-turns content-type fallbacks and system_other handling by <a href="https://github.com/farmer-data"><code>@farmer-data</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li>fix: allow @ in branch names (valid per git-check-ref-format) by <a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li><a href="https://github.com/farmer-data"><code>@farmer-data</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li><a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155</a></p> <h2>v1.0.154</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154</a></p> <h2>v1.0.153</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153</a></p> <h2>v1.0.152</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152</a></p> <h2>v1.0.151</h2> <h2>What's Changed</h2> <ul> <li>fix: skip workflow validation token exchange failures by <a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151</a></p> <h2>v1.0.150</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/a92e7c70a4da9793dc164451d829089dc057a464"><code>a92e7c7</code></a> chore: bump Claude Code to 2.1.195 and Agent SDK to 0.3.195</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f8076dc00886157bd2e1bd828246d01274b9cb62"><code>f8076dc</code></a> fix: bound app token revocation cleanup (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1437">#1437</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/521136812280ae7ef256e06045655b9da02793f0"><code>5211368</code></a> chore: bump Claude Code to 2.1.193 and Agent SDK to 0.3.193</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d"><code>428971d</code></a> chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/74eedf1a1892082d619c3edb66b9402da6520e7f"><code>74eedf1</code></a> chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/80b31826338489861333dc17217865dfe8085cdc"><code>80b3182</code></a> chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/360be9c8fc5d80cb33661e0ffd33dcef4c7155aa"><code>360be9c</code></a> fix: allow @ in branch names (valid per git-check-ref-format) (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1411">#1411</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92"><code>e452eb9</code></a> test: cover format-turns content-type fallbacks and system_other handling (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1">#1</a>...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6b8063043eb8bc14e8448185a12d6d9dcf07ce55"><code>6b80630</code></a> fix: filter PR reviews and inline review comments to trigger time (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1385">#1385</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/30544b674398ee15c84819bd87caf8a87e8c7b55"><code>30544b6</code></a> chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/fbda2eb1bdc90d319b8d853f5deb53bca199a7c1...a92e7c70a4da9793dc164451d829089dc057a464">compare view</a></li> </ul> </details> <br /> Updates `openai/codex-action` from 1.8 to 1.9 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/openai/codex-action/blob/main/CHANGELOG.md">openai/codex-action's changelog</a>.</em></p> <blockquote> <h1>codex-action Changelog</h1> <h2><a href="https://github.com/openai/codex-action/tree/v1.9">v1.9</a> (2026-06-22)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/85">#85</a> update the internal <code>setup-node</code> pin to <code>v6.3.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.8">v1.8</a> (2026-04-29)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/91">#91</a> tighten what bots are allowed</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.7">v1.7</a> (2026-04-24)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/89">#89</a> restrict bot permission bypass</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.6">v1.6</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/77">#77</a> enable GitHub-hosted Linux bubblewrap support</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.5">v1.5</a> (2026-03-16)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/74">#74</a> harden shell interpolation in action workflows</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.4">v1.4</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/58">#58</a> revert <a href="https://redirect.github.com/openai/codex-action/issues/56">#56</a> and use the latest stable version of Codex CLI again</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.3">v1.3</a> (2025-11-19)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/56">#56</a> temporarily set the default version of Codex CLI to <code>0.58.0</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.2">v1.2</a> (2025-11-07)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/52">#52</a> add <code>baseUrl</code> to <code>Octokit</code> constructor, if appropriate, for GHE</li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.1">v1.1</a> (2025-11-05)</h2> <ul> <li><a href="https://redirect.github.com/openai/codex-action/pull/47">#47</a> added support for Azure via the new <code>responses-api-endpoint</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/36">#36</a> added <code>effort</code> parameter</li> <li><a href="https://redirect.github.com/openai/codex-action/pull/45">#45</a> pin the commit hash of the <code>actions/setup-node</code> action used by <code>openai/codex-action</code></li> </ul> <h2><a href="https://github.com/openai/codex-action/tree/v1.0">v1.0</a> (2025-10-06)</h2> <ul> <li>Initial release (OpenAI DevDay 2025!)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/openai/codex-action/commit/10cb888d2ed3b99867f7e7ccff174a861a75aeb6"><code>10cb888</code></a> Update the internal setup-node pin to v6.3.0 (<a href="https://redirect.github.com/openai/codex-action/issues/85">#85</a>)</li> <li><a href="https://github.com/openai/codex-action/commit/9cdb6f3861cdefafeeaec70dfb42687be5ca62d3"><code>9cdb6f3</code></a> docs: clarify PR-controlled project instructions (<a href="https://redirect.github.com/openai/codex-action/issues/101">#101</a>)</li> <li>See full diff in <a href="https://github.com/openai/codex-action/compare/e0fdf01220eb9a88167c4898839d273e3f2609d1...10cb888d2ed3b99867f7e7ccff174a861a75aeb6">compare view</a></li> </ul> </details> <br /> Updates `anthropics/claude-code-action/base-action` from 1.0.140 to 1.0.159 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's releases</a>.</em></p> <blockquote> <h2>v1.0.159</h2> <h2>What's Changed</h2> <ul> <li>fix: bound app token revocation cleanup by <a href="https://github.com/tarunag10"><code>@tarunag10</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tarunag10"><code>@tarunag10</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1437">anthropics/claude-code-action#1437</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.159</a></p> <h2>v1.0.158</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.158</a></p> <h2>v1.0.157</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.157</a></p> <h2>v1.0.156</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.156</a></p> <h2>v1.0.155</h2> <h2>What's Changed</h2> <ul> <li>fix: filter PR reviews and inline review comments to trigger time by <a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li>test: cover format-turns content-type fallbacks and system_other handling by <a href="https://github.com/farmer-data"><code>@farmer-data</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li>fix: allow @ in branch names (valid per git-check-ref-format) by <a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/EffortlessSteven"><code>@EffortlessSteven</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1385">anthropics/claude-code-action#1385</a></li> <li><a href="https://github.com/farmer-data"><code>@farmer-data</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1421">anthropics/claude-code-action#1421</a></li> <li><a href="https://github.com/bellalMohamed"><code>@bellalMohamed</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1411">anthropics/claude-code-action#1411</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.155</a></p> <h2>v1.0.154</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.154</a></p> <h2>v1.0.153</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.153</a></p> <h2>v1.0.152</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.152</a></p> <h2>v1.0.151</h2> <h2>What's Changed</h2> <ul> <li>fix: skip workflow validation token exchange failures by <a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Ryanoonan"><code>@Ryanoonan</code></a> made their first contribution in <a href="https://redirect.github.com/anthropics/claude-code-action/pull/1417">anthropics/claude-code-action#1417</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.151</a></p> <h2>v1.0.150</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/anthropics/claude-code-action/commit/a92e7c70a4da9793dc164451d829089dc057a464"><code>a92e7c7</code></a> chore: bump Claude Code to 2.1.195 and Agent SDK to 0.3.195</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/f8076dc00886157bd2e1bd828246d01274b9cb62"><code>f8076dc</code></a> fix: bound app token revocation cleanup (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1437">#1437</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/521136812280ae7ef256e06045655b9da02793f0"><code>5211368</code></a> chore: bump Claude Code to 2.1.193 and Agent SDK to 0.3.193</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d"><code>428971d</code></a> chore: bump Claude Code to 2.1.191 and Agent SDK to 0.3.191</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/74eedf1a1892082d619c3edb66b9402da6520e7f"><code>74eedf1</code></a> chore: bump Claude Code to 2.1.190 and Agent SDK to 0.3.190</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/80b31826338489861333dc17217865dfe8085cdc"><code>80b3182</code></a> chore: bump Claude Code to 2.1.187 and Agent SDK to 0.3.187</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/360be9c8fc5d80cb33661e0ffd33dcef4c7155aa"><code>360be9c</code></a> fix: allow @ in branch names (valid per git-check-ref-format) (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1411">#1411</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92"><code>e452eb9</code></a> test: cover format-turns content-type fallbacks and system_other handling (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1">#1</a>...</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/6b8063043eb8bc14e8448185a12d6d9dcf07ce55"><code>6b80630</code></a> fix: filter PR reviews and inline review comments to trigger time (<a href="https://redirect.github.com/anthropics/claude-code-action/issues/1385">#1385</a>)</li> <li><a href="https://github.com/anthropics/claude-code-action/commit/30544b674398ee15c84819bd87caf8a87e8c7b55"><code>30544b6</code></a> chore: bump Claude Code to 2.1.186 and Agent SDK to 0.3.186</li> <li>Additional commits viewable in <a href="https://github.com/anthropics/claude-code-action/compare/fbda2eb1bdc90d319b8d853f5deb53bca199a7c1...a92e7c70a4da9793dc164451d829089dc057a464">compare view</a></li> </ul> </details> <br /> Updates `actions/cache` from 5.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/releases">actions/cache's releases</a>.</em></p> <blockquote> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1768">actions/cache#1768</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v6...v6.1.0">https://github.com/actions/cache/compare/v6...v6.1.0</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update packages, migrate to ESM by <a href="https://github.com/Samirat"><code>@Samirat</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1760">actions/cache#1760</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v6.0.0">https://github.com/actions/cache/compare/v5...v6.0.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bump <code>@actions/cache</code> to v5.1.0 - handle read-only cache access by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/cache/pull/1775">actions/cache#1775</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/cache/compare/v5...v5.1.0">https://github.com/actions/cache/compare/v5...v5.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/cache/blob/main/RELEASES.md">actions/cache's changelog</a>.</em></p> <blockquote> <h1>Releases</h1> <h2>How to prepare a release</h2> <blockquote> <p>[!NOTE] Relevant for maintainers with write access only.</p> </blockquote> <ol> <li>Switch to a new branch from <code>main</code>.</li> <li>Run <code>npm test</code> to ensure all tests are passing.</li> <li>Update the version in <a href="https://github.com/actions/cache/blob/main/package.json"><code>https://github.com/actions/cache/blob/main/package.json</code></a>.</li> <li>Run <code>npm run build</code> to update the compiled files.</li> <li>Update this <a href="https://github.com/actions/cache/blob/main/RELEASES.md"><code>https://github.com/actions/cache/blob/main/RELEASES.md</code></a> with the new version and changes in the <code>## Changelog</code> section.</li> <li>Run <code>licensed cache</code> to update the license report.</li> <li>Run <code>licensed status</code> and resolve any warnings by updating the <a href="https://github.com/actions/cache/blob/main/.licensed.yml"><code>https://github.com/actions/cache/blob/main/.licensed.yml</code></a> file with the exceptions.</li> <li>Commit your changes and push your branch upstream.</li> <li>Open a pull request against <code>main</code> and get it reviewed and merged.</li> <li>Draft a new release <a href="https://github.com/actions/cache/releases">https://github.com/actions/cache/releases</a> use the same version number used in <code>package.json</code> <ol> <li>Create a new tag with the version number.</li> <li>Auto generate release notes and update them to match the changes you made in <code>RELEASES.md</code>.</li> <li>Toggle the set as the latest release option.</li> <li>Publish the release.</li> </ol> </li> <li>Navigate to <a href="https://github.com/actions/cache/actions/workflows/release-new-action-version.yml">https://github.com/actions/cache/actions/workflows/release-new-action-version.yml</a> <ol> <li>There should be a workflow run queued with the same version number.</li> <li>Approve the run to publish the new version and update the major tags for this action.</li> </ol> </li> </ol> <h2>Changelog</h2> <h3>6.1.0</h3> <ul> <li>Bump <code>@actions/cache</code> to v6.1.0 to pick up <a href="https://redirect.github.com/actions/toolkit/pull/2435">actions/toolkit#2435 Handle cache write error due to read-only token</a></li> <li>Switch redundant "Cache save failed" warning to debug log in save-only</li> </ul> <h3>6.0.0</h3> <ul> <li>Updated <code>@actions/cache</code> to ^6.0.1, <code>@actions/core</code> to ^3.0.1, <code>@actions/exec</code> to ^3.0.0, <code>@actions/io</code> to ^3.0.2</li> <li>Migrated to ESM module system</li> <li>Upgraded Jest to v30 and test infrastructure to be ESM compatible</li> </ul> <h3>5.0.4</h3> <ul> <li>Bump <code>minimatch</code> to v3.1.5 (fixes ReDoS via globstar patterns)</li> <li>Bump <code>undici</code> to v6.24.1 (WebSocket decompression bomb protection, header validation fixes)</li> <li>Bump <code>fast-xml-parser</code> to v5.5.6</li> </ul> <h3>5.0.3</h3> <ul> <li>Bump <code>@actions/cache</code> to v5.0.5 (Resolves: <a href="https://github.com/actions/cache/security/dependabot/33">https://github.com/actions/cache/security/dependabot/33</a>)</li> <li>Bump <code>@actions/core</code> to v2.0.3</li> </ul> <h3>5.0.2</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/cache/commit/55cc8345863c7cc4c66a329aec7e433d2d1c52a9"><code>55cc834</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1768">#1768</a> from jasongin/readonly-cache</li> <li><a href="https://github.com/actions/cache/commit/d8cd72f230726cdf4457ebb61ec1b593a8d12337"><code>d8cd72f</code></a> Bump <code>@actions/cache</code> to v6.1.0 - handle cache write error due to RO token</li> <li><a href="https://github.com/actions/cache/commit/2c8a9bd7457de244a408f35966fab2fb45fda9c8"><code>2c8a9bd</code></a> Merge pull request <a href="https://redirect.github.com/actions/cache/issues/1760">#1760</a> from actions/samirat/esm_migration_and_package_update</li> <li><a href="https://github.com/actions/cache/commit/e9b91fdc3fea7d79165fceb79042ef45c2d51023"><code>e9b91fd</code></a> Prettier fixes</li> <li><a href="https://github.com/actions/cache/commit/e4884b8ff7f92ef6b52c79eda480bbc86e685adb"><code>e4884b8</code></a> Rebuild dist</li> <li><a href="https://github.com/actions/cache/commit/10baf0191a3c426ea0fa4a3253a5c04233b6e18f"><code>10baf01</code></a> Fixed licenses</li> <li><a href="https://github.com/actions/cache/commit/e39b386c9004d72a15d864ade8c0b3a702d47a37"><code>e39b386</code></a> Fix test mock return order</li> <li><a href="https://github.com/actions/cache/commit/b6928203372a8571ff984c0c883ef3a1adfb0c06"><code>b692820</code></a> PR feedback</li> <li><a href="https://github.com/actions/cache/commit/60749128a44d25d3c520a489e576380cf00ff3f1"><code>6074912</code></a> Rebuild dist bundles as ESM to match type:module</li> <li><a href="https://github.com/actions/cache/commit/5a912e8b4af820fa082a0e75cfd2c782f8fbfe0e"><code>5a912e8</code></a> Fix lint and jest issues</li> <li>Additional commits viewable in <a href="https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-python` from 6.2.0 to 6.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add RHEL support and include Linux distro in cache keys by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li> <li>Fix pip cache error handling on Windows by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li> <li>Upgrade actions dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li>Upgrade dependency versions and test workflow configuration by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li> </ul> <h3>Documentation</h3> <ul> <li>Update advanced-usage.md by <a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li><a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v6.3.0">https://github.com/actions/setup-python/compare/v6...v6.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1"><code>ece7cb0</code></a> Fix pip cache error handling on Windows. (<a href="https://redirect.github.com/actions/setup-python/issues/1040">#1040</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf"><code>1d18d7a</code></a> Update advanced-usage.md (<a href="https://redirect.github.com/actions/setup-python/issues/811">#811</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/d2b357a6a3a3687dd6781a416c0d24fcfd68660e"><code>d2b357a</code></a> Update dependency versions and test workflow configuration (<a href="https://redirect.github.com/actions/setup-python/issues/1322">#1322</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/8f639b1e75c1048640734b2bb46e22cecf136982"><code>8f639b1</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-python/issues/1324">#1324</a> from jasongin/update-actions-cache-5.1.0</li> <li><a href="https://github.com/actions/setup-python/commit/6731c2ba87f530c26324d128c8fdd53499a4d4b0"><code>6731c2b</code></a> Resolve high-severity audit issues</li> <li><a href="https://github.com/actions/setup-python/commit/0cb1a84326b90186fcd211036c65b42819794c87"><code>0cb1a84</code></a> Add RHEL support and include Linux distro in cache keys (<a href="https://redirect.github.com/actions/setup-python/issues/1323">#1323</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/dc6eab6194394e0119523369788b507096f923e2"><code>dc6eab6</code></a> Update dist</li> <li><a href="https://github.com/actions/setup-python/commit/6f4b74bfa2f520a380a620de3615c0dac427f4d3"><code>6f4b74b</code></a> Strict equality</li> <li><a href="https://github.com/actions/setup-python/commit/fa8bde1a9cc6347d06948d66bcd68c598b79eaea"><code>fa8bde1</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied</li> <li><a href="https://github.com/actions/setup-python/commit/c8813ba1bc76ebf779b911ad8ffccbf2e449cb48"><code>c8813ba</code></a> Upgrade <a href="https://github.com/actions"><code>@actions</code></a> dependencies and update licenses (<a href="https://redirect.github.com/actions/setup-python/issues/1303">#1303</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev>@composio/cli@0.2.32-beta.279 |
||
|
Alberto Schiabel
|
aede04995d |
ci(docs): keep docs @composio/* deps current on each SDK sync (#3709)
## Summary The `Docs - Sync guides on SDK changes` workflow updates docs **content** when SDK source changes on `next`, but it never touched `docs/package.json`. Because the docs site is a standalone Bun app **outside** the pnpm workspace — it pins *published* `@composio/*` versions rather than linking workspace source — those pins silently drifted behind the SDK. That drift is what produced the recent breakage in #3705: docs still pinned `@composio/core@0.9.1` while `delete()` shipped in `0.13.1`, so the Twoslash type-check failed and the sync bot worked around it by casting a fake `delete()` onto the session type. ## What this changes In `docs.sdk-change-sync.yml` (gated on the same `has_changes` condition as the rest of the job): - **New step** sets up Node/Bun (via the shared `setup-node-pnpm-bun` action) and realigns every `@composio/*` dependency in `docs/package.json` to its **latest published** release (`npm view <pkg> version` → `^<latest>`), then refreshes `bun.lock` with `bun install`. It scans both `dependencies` and `devDependencies`, is idempotent (no diff → no `bun install`), and warns rather than fails if a version can't be resolved. - **`add-paths`** now includes `docs/package.json` and `docs/bun.lock` so the realignment lands in the PR. - **Content prompt** gains a rule: don't add casts/assertions to compile against an API missing from the published package — document released behavior and let the Twoslash build flag the gap. ## Why pin to *published* (not workspace source) Docs deliberately target what users can `npm install`. Twoslash snippets and the runnable example apps are a contract that the documented API exists in a real release. The PR's existing Twoslash build (`docs-typescript-check.yml`) remains the gate: if a documented feature isn't published yet, the build fails loudly instead of being silently worked around. ## Notes - Complementary to #3705, which fixes the *current* stale pins by hand; this prevents the drift from recurring. - Validated the bump shell logic locally under `bash` (matching the runner): correctly resolves all 10 `@composio/*` devDeps and is a no-op when already current. |
||
|
Alberto Schiabel
|
7fe998c45c |
docs: document session delete() and realign docs @composio/* deps (#3705)
## Summary Documents session deletion (`session.delete()`) and realigns the docs site's `@composio/*` dependencies so the new snippet type-checks against a published SDK. ## Changes - **`docs/content/docs/configuring-sessions.mdx`** — adds a `### delete()` section with Python and TypeScript examples and a version-requirement callout (`@composio/core` ≥ `0.13.1` / `composio` ≥ `0.17.1`). - **`docs/package.json` + `docs/bun.lock`** — bumps `@composio/core` `^0.9.1` → `^0.13.1` (the release that adds `delete()`) and aligns the provider packages to their `^0.10.x`/`^0.11.0` releases (peer `@composio/core >=0.10.0 <1.0.0`). ## Why the dependency bump The docs site type-checks every Twoslash snippet against the `@composio/*` versions pinned in `docs/package.json`. Those pins were stale (`@composio/core@0.9.1`), and `delete()` only exists on the `Session` type from `0.13.1`, so the snippet didn't compile. The original sync run worked around this with a `DeletableSession` cast; this PR fixes the root cause by bumping the pins to published releases that expose `delete()` natively and dropping the cast. The full docs build (Twoslash validation) passes against the bump. ## Review checklist - [ ] `delete()` examples accurately reflect the SDK behavior - [ ] Version callout matches the releases that introduce `delete()` - [ ] No unrelated docs were modified ## Notes - Originally produced by the `Docs - Sync guides on SDK changes` run. - Follow-up https://github.com/ComposioHQ/composio/pull/3709 prevents this pin drift from recurring by realigning the docs `@composio/*` deps automatically on each SDK sync. --------- Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
Alberto Schiabel
|
9bd600a9a2 |
fix(docs): use app token for SDK docs sync PRs (#3706)
This PR: - fixes the `Docs - Sync guides on SDK changes` workflow failure from https://github.com/ComposioHQ/composio/actions/runs/28332657149/job/83933412114 - mints the existing release-bot GitHub App token before checkout - uses that token for checkout, `peter-evans/create-pull-request`, and reviewer requests - keeps reviewer assignment non-blocking so a successful docs PR is not failed by reviewer-request edge cases - verifies the workflow file with `ruby -e 'require "yaml"; YAML.load_file(ARGV.fetch(0)); puts "yaml ok"' .github/workflows/docs.sdk-change-sync.yml`, `mise exec -- pnpm exec prettier --check .github/workflows/docs.sdk-change-sync.yml`, and `git diff --check -- .github/workflows/docs.sdk-change-sync.yml` |
||
|
Alberto Schiabel
|
bfec5f4789 |
chore(ci): use GitHub App client ID input (#3707)
This PR: - replaces the deprecated `app-id` input for `actions/create-github-app-token` with `client-id` - reads the public release bot Client ID from the `RELEASE_BOT_CLIENT_ID` repo variable - keeps `RELEASE_BOT_APP_PRIVATE_KEY` as the only GitHub App secret used by these token steps - updates token generation in docs data sync, SDK reference generation, and TypeScript release workflows - pairs with the one-line update already pushed to https://github.com/ComposioHQ/composio/pull/3706 for the SDK docs sync workflow ## Verification - `rg -n 'app-id:' .github || true` - `rg -n 'client-id:' .github/workflows` - parsed edited workflow YAML with Ruby/Psych - confirmed `RELEASE_BOT_CLIENT_ID` exists as a repo variable - workflow-dispatch smoke run for #3706 passed with `client-id` and no `app-id` deprecation warning: https://github.com/ComposioHQ/composio/actions/runs/28358680527 |
||
|
jkomyno
|
008316ac18 |
Revert "chore(ci): use GitHub App client ID input"
This reverts commit
|
||
|
jkomyno
|
7ef3a786d4 | chore(ci): use GitHub App client ID input | ||
|
Alberto Schiabel
|
9901e01a80 |
feat(py): add tool router session deletion
Release Python 0.17.1 with Tool Router session deletion support.py@0.17.1 |
||
|
jkomyno
|
551790c114 | chore(py): sync 0.17.0 lockfile @composio/slim@0.13.1 py@0.17.0 | ||
|
sdkrelease[bot]
|
156a1eb7b2 |
Release: update version (#3686)
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/vercel@0.11.0 ### Minor Changes -@composio/vercel@0.11.0 @composio/mastra@0.10.1 @composio/core@0.13.1 |
||
|
Alberto Schiabel
|
956f9be9b4 |
chore(agents): normalize repo guidance skills (#3666)
This PR: - replaces the duplicated repo-local skill set with the requested canonical `.agents/skills` taxonomy and short router `SKILL.md` files backed by first-level references - makes `.claude/skills` a compatibility symlink to `.agents/skills` and removes hand-maintained Claude skill/rule copies - moves docs agent guidance and decisions into neutral `docs/agent-guidance/` and `docs/decisions/`, with `docs/CLAUDE.md` reduced to a shim - retires CLI Cursor rules after migrating CLI design, Effect source, and client-cache sync guidance into `AGENTS.md` and `cli-command` - adds nested `AGENTS.md` files for TS, core, providers, e2e, Python, Python providers, and docs - adds `pnpm validate:agent-skills` to validate skill frontmatter, taxonomy, references, symlink invariants, stale paths, and command names - implements missing Python `tst` and `snt` nox sessions that existing Makefile targets already exposed - no changeset: repository guidance/tooling only, no published SDK package behavior ## Verification - `pnpm validate:agent-skills` -> `Validated 14 canonical agent skills and guidance invariants.` - `for skill in .agents/skills/*; do python /Users/jkomyno/.codex/skills/.system/skill-creator/scripts/quick_validate.py "$skill" || exit 1; done` -> 14x `Skill is valid!` - `pnpm --dir ts/packages/cli validate:skills` -> `Validated composio-cli skill builds for stable and beta.` - `cd python && uv run nox --list` -> includes `tst` and `snt` - `cd python && uv run nox -s snt` -> 18 passed - `cd python && uv run nox -s tst -- tests/test_imports.py` -> 8 passed - `git diff --check` / `git diff --cached --check` -> clean - stale reference search for retired docs/Claude/Cursor paths -> no matches ## Forward Tests - TypeScript core bug: loaded `bug-fixing`, `typescript-sdk`, `typescript-testing`; found correct root/ts/core `AGENTS.md` route. - Python provider: loaded `python-providers`, `python-testing`; found missing nox sessions, fixed here. - CLI command: loaded `cli-command`; found recording/changeset wording gaps, fixed here. - Cross-SDK drift: loaded `cross-sdk-parity`; again found Python nox drift, fixed here. - Docs + decision: loaded `docs-decisions`; found decision template/index and Twoslash path gaps, fixed here. ## Notes The first normal `git commit` attempt hit a lint-staged/Git stash limitation while replacing `.claude/skills/` with a symlink (`path ... beyond a symbolic link`). The final commit used `--no-verify` after the validators and formatting checks above passed.@composio/cli@0.2.32-beta.278 |