Commit Graph

5111 Commits

Author SHA1 Message Date
Kshitij Jhunjhunwala 40a6db796f docs: redesign the Welcome landing around Platform / For You (#4149)
## Summary

- Rebuilds the "Two ways to start" hero cards around Composio's Platform
and For You products — uses the canonical Composio logo + product-badge
lockup (dashboard-parity), and the same product mocks the dashboard
onboarding path step uses: a chat composer + client logos for For You,
an SDK code panel for Platform. Right link pane matches the width of a
feature-grid card exactly.
- Restructures the feature grid: whole-card links, product mocks that
fade into the card edge with a mask-image, cards live on a single flush
`bg-fd-card` surface. Tools mock jumps from an 8×2 grid of 16 tiles to
10×3 = 30 for more impact. Auth becomes a live schematic — one user
identity card wired to three connected-account cards via elbow
connectors computed from real DOM geometry (new
`home-auth-diagram.tsx`). Triggers drops the fake `LIVE` ping in favor
of a plain event list, Sandbox drops the workbench chrome + CPU lights
for a clean filename + code panel.
- Adds a Platform Dashboard link to Reach-for-the-rest so it fills the
3×2 grid. Drops the "Get started / What you get / Reach for the rest"
eyebrows and section heading so titles stand on their own.
- Copy: `audience` → `product` in `HOME_INTENTS`, so `llms.txt` emits
`**Platform**` / `**For You**` alongside the existing headings; matched
in `home-navigation.test.ts`.

## Test plan

- [ ] Visit \`/docs\` at desktop and mobile widths, in both light and
dark themes
- [ ] Verify the auth diagram wires stay aligned across widths (dynamic
getBoundingClientRect + ResizeObserver)
- [ ] \`bun test tests/static/\`
- [ ] \`bun run types:check\`

🤖 Generated with [Claude Code](https://claude.com/claude-code)
2026-08-17 15:53:42 -07:00
Soumya Medapati 8e5b8f7f14 ci: point the eval shim at the clean public-ready repo (docs-agent-eval-ci)
The eval machinery moved to ComposioHQ/docs-agent-eval-ci (clean history,
code only — internal until reviewed, then flipped public so this public
repo may call it; GitHub forbids public->internal reusable workflow calls,
which is this PR's currently failing check).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 15:38:26 -07:00
Kshitij Jhunjhunwala 599cebb108 Merge branch 'next' into claude/platform-for-you-redesign-3c3274 2026-08-17 15:01:01 -07:00
Kshitij Jhunjhunwala 2931dacd5b docs: emit docs_sidebar_click with sidebar group and depth (#4139)
Evaluating #4099 meant inferring every navigation conclusion from
`$pageview` ordering, because the docs app has exactly one
`posthog.capture` call and nothing captures sidebar clicks.
(`$referring_domain` doesn't help: pageviews are captured manually on
client-side route change, so `document.referrer` never updates on
internal navigation.)

**What the event carries:** `docs_sidebar_click` with `href`, `group`
(separator heading), `folder`, `depth`, `position`, and `from_path`.
`position` is the row index among visible siblings — a collapsed folder
counts as one row, and its children get their own `1..n` sequence — so
"clicks land in the top N rows" reads as written.

**Why the index comes from the page tree, not the DOM:** separators
currently render as `<p>` and folder triggers as `<button>` — fumadocs
internals that break on upgrade. `lib/sidebar-nav-index.ts` walks the
tree at build time (mirroring `app/llms.txt/route.ts`) and the client
does a single delegated listener plus an href lookup. An href that isn't
in the index emits nothing rather than a guessed group. `click` and
`auxclick` (middle button) are both captured so links opened in a new
tab aren't silently dropped.

Mounted on the docs, examples, and both reference sidebars. `/toolkits`
has no `DocsLayout` sidebar, so there's nothing to instrument there.

**Folder-toggle tracking: deferred.** Folder triggers are `<button>`s
with no href, so identifying which folder was toggled means matching on
text content, and the open/closed state means reading a Radix
`data-state` — exactly the DOM guessing this PR avoids. Worth doing if
fumadocs gives us a stable hook.

**Verification** (from `docs/`): `lint:links`, `test` (219 pass, 10
new), `types:check`, `build` all green; `lint` output matches the `next`
baseline exactly. Runtime check against a production build with PostHog
pointed at a local sink:

- `/docs/triggers` → `group: "Core concepts"`, `folder: null`, `depth:
1`, `position: 4` (its visible row)
- `/docs/authentication` (folder row) → `folder: "Authentication"`,
`depth: 1`, `position: 3`
- `/docs/authentication/manually-authenticating` → `depth: 2`,
`position: 1`
- middle-click on `/docs/cli` fired; right-click on a sidebar link did
not
- reference sidebar → `group: null` (that tree has no separators)
- clicking an in-body docs link fired a `$pageview` and no
`docs_sidebar_click`
- built keyless, `process.env.NEXT_PUBLIC_POSTHOG_KEY` is inlined into
the effect's guard so no listener is attached; confirmed in the emitted
chunk and by the absence of any "You must initialize PostHog before
calling posthog.capture" warning after clicking sidebar links

🤖 Generated with [Claude Code](https://claude.com/claude-code)
2026-08-17 14:59:41 -07:00
Kshitij Jhunjhunwala a80460b4da fix(docs): keep the Welcome auth diagram drawable at every pane width
The new AuthDiagram sized its hub (`w-36`) and account cards (`w-44`) with
fixed widths totalling 320px, but the feature-grid pane is not monotonic in
the viewport: ~404px at 1280px, and only ~242px at 640px where the grid goes
two-column. Below ~394px viewport the two blocks shrank until they touched,
`ex === sx` collapsed every wire into `elbowPath`'s straight-line fallback,
and the middle connector became a zero-length, invisible path. The card
rendered as three stray tick marks on every iPhone below Pro Max, and the
account cards overflowed the clip at 360px.

Use proportional widths with caps (`w-[36%] max-w-36` / `w-[52%] max-w-56`)
so ~12% of the pane is always reserved as horizontal run for the elbows.
Measured after: 29px gap at the 242px worst case, 34px at 360px, 50px at
1280px, no overflow and no degenerate paths anywhere in the range. The
account label now hides by container query rather than a viewport
breakpoint, which would gate on the wrong axis.

Also from review:

- Sandbox mock showed `composio.sandbox.run()` in a file chromed `sandbox.ts`.
  Per content/docs/sandbox/remote.mdx — where the card links — the sandbox is
  a persistent Python environment driven through COMPOSIO_REMOTE_WORKBENCH
  with `run_composio_tool` / `invoke_llm`. Rewritten on that real surface and
  relabelled `sandbox.py`; `WorkbenchVisual` renamed to `SandboxVisual`.
- `twilio` is not in public/data/toolkits.json, so the tile advertised an app
  with no /toolkits page behind it. Swapped for `zendesk`.
- The dark logo was `aria-hidden`, so the heading's accessible name lost
  "Composio" in dark mode only. Both variants now carry the same alt.
- Restored the badge style assertions the PR dropped, which still held, and
  added regression coverage for the diagram widths, the catalog check, and
  the sandbox surface.
- Restored the window resize listener that connection-refresh-visual.tsx
  keeps alongside its ResizeObserver.
- Nits: stale "8×2" comment, redundant fragment, shared the duplicated fade
  style, renamed the misleading `homeIntentAnchor(title)` parameter.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 14:56:17 -07:00
Soumya Medapati cd1a59edcf ci: don't let unrelated label additions cancel in-flight evals
The labeled event fires for every label; with workflow-level concurrency
any label added mid-run cancelled and restarted the eval. Gate labeled
events on the run-docs-tests* labels and move concurrency to job level
(a skipped job never enters the group). Cursor Bugbot finding.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 14:21:27 -07:00
Soumya Medapati d3b8f8dcc5 ci: add label-triggered docs agent eval check (V1, informational)
Adding the run-docs-tests label to a PR runs an agent-buildability eval
against the PR's Vercel docs preview: deterministic routing (no-eval /
Smoke / Deep), isolated agents reading the proposed docs through a
rewrite proxy, PASS/FAIL/ERROR + agent docs-feedback posted as a PR
comment. Non-blocking; all eval logic lives in ComposioHQ/docs-agent-eval.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 14:13:49 -07:00
Kshitij Jhunjhunwala d9186c1b15 docs: stop restructuring the reference layouts
Extracting buildReferenceTree() existed only so a module-level memo could reuse
the tree. The memo is gone, so the extraction was scaffolding for nothing and
every reference-layout hunk was pure churn in a PR about adding an event.

Both files go back to their shape on next, plus the same four lines the docs and
examples layouts already take. The non-test diff is now insertions only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 13:45:55 -07:00
Kshitij Jhunjhunwala 68c6c0a889 docs: build the reference nav index from the tree the layout already awaited
getNavIndex() awaited buildReferenceTree() on its own while Layout had already
awaited the same tree for DocsLayout, so the first render built and filtered the
reference tree twice. The memo it protected was a module-level singleton with no
key, which is what prompted removing the parameter in the first place.

Dropping the memo resolves both: the index is one traversal over ~64 nodes built
from the tree already in hand, matching how the docs and examples layouts work.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 12:23:37 -07:00
Kshitij Jhunjhunwala 1ccfb8fba7 Merge branch 'next' into kj/docs-sidebar-instrumentation 2026-08-17 12:19:18 -07:00
Kshitij Jhunjhunwala da72336dc2 docs: assert sidebar position relatively, drop the unkeyed nav-index cache
The position assertions pinned absolute indices into the live content tree, so
adding any page to meta.json failed a test named for traversal semantics with
"expected 12, received 13". Assert the invariant instead — a folder occupies one
sibling slot, and its children restart at 1 — which stays green when content
moves and still fails if position starts threading through folders again.

getNavIndex(tree) ignored its argument on every call after the first. The
reference tree is only reachable after an await, so it stays memoized, but the
signature no longer claims to vary with a parameter it never read.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 11:26:43 -07:00
dependabot[bot] c0c511bb4b chore(deps-dev): bump the npm-development group with 7 updates (#4133)
Bumps the npm-development group with 7 updates:

| Package | From | To |
| --- | --- | --- |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `26.1.2` | `26.2.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.77.0` | `1.78.0` |
|
[oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint)
| `1.77.0` | `1.78.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.8` | `2.10.9` |
|
[chrome-devtools-mcp](https://github.com/ChromeDevTools/chrome-devtools-mcp)
| `1.6.0` | `1.7.0` |
|
[@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent)
| `0.83.0` | `0.84.1` |
| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) | `0.29.5`
| `0.31.3` |

Updates `@types/node` from 26.1.2 to 26.2.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.77.0 to 1.78.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.78.0] - 2026-08-10</h2>
<h3>🚀 Features</h3>
<ul>
<li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)
(Mikhail Baev)</li>
<li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)
(Cole Ellison)</li>
<li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match
eslint (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)
(Cole Ellison)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>9573937 linter/typescript: Validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)
(Mikhail Baev)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a>
release(apps): oxlint v1.78.0 &amp;&amp; oxfmt v0.63.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25473">#25473</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/ccb8fe89db08123ff2b86d7fb2f39d0dd6c33df7"><code>ccb8fe8</code></a>
feat(linter/jsdoc): implement <code>no-blank-blocks</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9573937df3cc01f29e1c65bc018ce378ec947e0e"><code>9573937</code></a>
fix(linter/typescript): validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/d4a897ce2290bf853720b4fbf371304bfea2c980"><code>d4a897c</code></a>
feat(linter/eslint): implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/5ab9340637eff80539bca89a494e162e94569358"><code>5ab9340</code></a>
feat(linter/jsx-a11y/anchor-has-content): add options to match eslint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.78.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-plugin-eslint` from 1.77.0 to 1.78.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint-plugin-eslint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.78.0 &amp; oxfmt v0.63.0</h2>
<h2>Table of Contents</h2>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxlint-v1.78.0">Oxlint
v1.78.0</a></li>
<li><a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/blob/HEAD/#oxfmt-v0.63.0">Oxfmt
v0.63.0</a></li>
</ul>
<h2>Oxlint v1.78.0</h2>
<h3>🚀 Features</h3>
<ul>
<li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25207">#25207</a>)
(Mikhail Baev)</li>
<li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24470">#24470</a>)
(Cole Ellison)</li>
<li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match
eslint (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/24571">#24571</a>)
(Cole Ellison)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>b746e00 linter/eslint/no-implicit-coercion: Preserve template
coercion whitespace (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25470">#25470</a>)
(camc314)</li>
<li>a92c541 linter: Preserve source text for JS plugin ignore fixes (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25280">#25280</a>)
(Norcleeh)</li>
<li>675c840 linter/eslint/prefer-promise-reject-errors: Handle
parenthesized calls (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25378">#25378</a>)
(camc314)</li>
<li>1703739 linter/unicorn/new-for-builtins: Ignore optional chains (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25411">#25411</a>)
(tanakalucky)</li>
<li>95ece63 linter/unicorn/prefer-code-point: Downgrade the auto-fix to
dangerous (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25412">#25412</a>)
(leemr)</li>
<li>c451a0e linter/vitest: Validate
<code>consistent-test-filename</code> regex patterns (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25408">#25408</a>)
(Mikhail Baev)</li>
<li>937825c react_compiler: Disable exhaustive memo validation by
default (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25417">#25417</a>)
(Boshen)</li>
<li>f0f7dae linter/eslint/no-unused-vars: Report invalid regex options
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25380">#25380</a>)
(Cameron)</li>
<li>44e73fd linter/unicorn/prefer-array-flat: Fix
<code>concat.apply</code> suggestions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25373">#25373</a>)
(Cameron)</li>
<li>6846a9a linter/react/rules-of-hooks: Detect constructor callbacks
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25377">#25377</a>)
(camc314)</li>
<li>b247a9d linter/unicorn/new-for-builtins: Support
<code>Float16Array</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25382">#25382</a>)
(tanakalucky)</li>
<li>19109cd linter/unicorn/error-message: Support
<code>SuppressedError</code> messages (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25375">#25375</a>)
(camc314)</li>
<li>9c13f5e linter: Assert token lookup invariants (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25368">#25368</a>)
(camc314)</li>
<li>bc35f83 linter/eslint/no-unused-vars: Bound catch parameter lookup
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25367">#25367</a>)
(camc314)</li>
<li>c159fb9 linter/unicorn/switch-case-braces: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25363">#25363</a>)
(camc314)</li>
<li>03b2eb2 linter/unicorn/no-static-only-class: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25361">#25361</a>)
(camc314)</li>
<li>0afc59e linter/unicorn/empty-brace-spaces: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25353">#25353</a>)
(camc314)</li>
<li>2963d98 linter/eslint/no-unreachable-loop: Do not report loops whose
body has a finally block (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25335">#25335</a>)
(Todor Andonov)</li>
<li>589e5fb linter/eslint/no-param-reassign: Validate
<code>ignorePropertyModificationsForRegex</code> property (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25346">#25346</a>)
(Mikhail Baev)</li>
<li>aae5d8b linter/eslint/no-throw-literal: False positive on variable
declared without initializer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25275">#25275</a>)
(cjnoname)</li>
<li>6b1c479 oxlint: Normalize customized rule names (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25316">#25316</a>)
(camc314)</li>
<li>d494eb5 linter/unicorn/consistent-existence-index-check: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25325">#25325</a>)
(camc314)</li>
<li>4266037 linter/typescript/prefer-namespace-keyword: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25322">#25322</a>)
(camc314)</li>
<li>4745b4e linter/typescript/no-namespace: Bound token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25321">#25321</a>)
(camc314)</li>
<li>648a481 linter/eslint/one-var: Avoid joining exported declarations
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25314">#25314</a>)
(camc314)</li>
<li>9573937 linter/typescript: Validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25320">#25320</a>)
(Mikhail Baev)</li>
<li>ebf7d18 linter/typescript/consistent-type-definitions: Bound token
lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25281">#25281</a>)
(camc314)</li>
<li>1501ccf linter/typescript/consistent-generic-constructors: Bound
token lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25258">#25258</a>)
(camc314)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>8f784f3 linter: Reduce rule config dispatch size (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25461">#25461</a>)
(Boshen)</li>
<li>2de4ec2 linter: Reduce visitor code size (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25441">#25441</a>)
(Boshen)</li>
<li>6fb7f47 linter/unicorn/prefer-export-from: Narrow
<code>ExportFromDeclaration</code> lookup (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25381">#25381</a>)
(camc314)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a>
release(apps): oxlint v1.78.0 &amp;&amp; oxfmt v0.63.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25473">#25473</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/apps_v1.78.0/npm/oxlint-plugin-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `turbo` from 2.10.8 to 2.10.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/turborepo/releases">turbo's
releases</a>.</em></p>
<blockquote>
<h2>Turborepo v2.10.9</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Changelog</h3>
<ul>
<li>chore: Release Turborepo 2.10.8 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13626">vercel/turborepo#13626</a></li>
<li>perf: Walk literal-prefix tree globs without wax compilation by <a
href="https://github.com/charpeni"><code>@​charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13522">vercel/turborepo#13522</a></li>
<li>fix: Accept semver ranges in devEngines.packageManager.version by <a
href="https://github.com/bangseongbeom"><code>@​bangseongbeom</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13623">vercel/turborepo#13623</a></li>
<li>docs: Explain affected package invalidation reasons by <a
href="https://github.com/ghoullier"><code>@​ghoullier</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13594">vercel/turborepo#13594</a></li>
<li>perf(lockfiles): Borrow field-name scalars in the pnpm fast parser
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13648">vercel/turborepo#13648</a></li>
<li>perf(repository): Avoid discarded alias allocation in Relationship
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13650">vercel/turborepo#13650</a></li>
<li>perf(lockfiles): Drop redundant human_name clone for pnpm v7/v9 by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13649">vercel/turborepo#13649</a></li>
<li>perf: Index workspace nodes by name in project_relationships by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13647">vercel/turborepo#13647</a></li>
<li>perf: Share resolution identity lists across identical workspace
closures by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13641">vercel/turborepo#13641</a></li>
<li>docs: Fix duplicated word in runtime dependencies guide summary by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13630">vercel/turborepo#13630</a></li>
<li>refactor: Remove turborepo-lsp dependency on turborepo-lib by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13631">vercel/turborepo#13631</a></li>
<li>perf: Index Bun nested lockfile entries by name for fallback
resolution by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13633">vercel/turborepo#13633</a></li>
<li>perf: Memoize framework inference per package during task hashing by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13634">vercel/turborepo#13634</a></li>
<li>perf: Avoid materializing transient declarations in
external_dependencies by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13646">vercel/turborepo#13646</a></li>
<li>perf: Enable shared closure DP for npm and yarn1 lockfiles by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13635">vercel/turborepo#13635</a></li>
<li>perf: Parse pnpm explicit-key entries in the lockfile fast path by
<a href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13640">vercel/turborepo#13640</a></li>
<li>perf: Parallelize resolution fingerprint hashing by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13642">vercel/turborepo#13642</a></li>
<li>perf: Build resolution identity lists in parallel by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13643">vercel/turborepo#13643</a></li>
<li>perf: Intern resolution identities as Arc&lt;str&gt; across closures
by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13645">vercel/turborepo#13645</a></li>
<li>fix: Compose affected tasks with package filters by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13656">vercel/turborepo#13656</a></li>
<li>docs: Explain worktree cache path isolation by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13657">vercel/turborepo#13657</a></li>
<li>fix: Upgrade brace-expansion to 5.0.9 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13658">vercel/turborepo#13658</a></li>
<li>docs: Correct verified inaccuracies in the Turborepo Agent Skill by
<a href="https://github.com/charpeni"><code>@​charpeni</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13644">vercel/turborepo#13644</a></li>
<li>chore: Update Next.js to 16.3.0 by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13659">vercel/turborepo#13659</a></li>
<li>fix: Don't use <code>eprintln!</code> in the panic hook by <a
href="https://github.com/molofsky"><code>@​molofsky</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13637">vercel/turborepo#13637</a></li>
<li>fix: Invalidate only when Git ignore sources change by <a
href="https://github.com/smasato"><code>@​smasato</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13632">vercel/turborepo#13632</a></li>
<li>docs: Update Geistdocs to 1.19.4 by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13680">vercel/turborepo#13680</a></li>
<li>docs: Exclude Turborepo from its own OSS products menu by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13681">vercel/turborepo#13681</a></li>
<li>docs: Use the geistdocs Turborepo logo in the navbar by <a
href="https://github.com/christopherkindl"><code>@​christopherkindl</code></a>
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13682">vercel/turborepo#13682</a></li>
<li>docs: Update redirected vercel.com/nextjs.org links to current
targets by <a
href="https://github.com/molebox"><code>@​molebox</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13685">vercel/turborepo#13685</a></li>
<li>refactor: Generalize native command arguments by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13664">vercel/turborepo#13664</a></li>
<li>refactor: Move native contracts to tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13665">vercel/turborepo#13665</a></li>
<li>docs: Fix loadTransformers reference in turbo-codemod README by <a
href="https://github.com/latent-9"><code>@​latent-9</code></a> in <a
href="https://redirect.github.com/vercel/turborepo/pull/13683">vercel/turborepo#13683</a></li>
<li>refactor: Model native task execution explicitly by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13666">vercel/turborepo#13666</a></li>
<li>feat: Compose aggregate native task dependencies by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13667">vercel/turborepo#13667</a></li>
<li>fix: Respect aggregate task overrides by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13668">vercel/turborepo#13668</a></li>
<li>test: Stabilize watch task inputs regression test by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13686">vercel/turborepo#13686</a></li>
<li>feat: Parse Python quality tool declarations by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13669">vercel/turborepo#13669</a></li>
<li>feat: Resolve Python quality plans by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13670">vercel/turborepo#13670</a></li>
<li>refactor: Extract uv native task specs by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13671">vercel/turborepo#13671</a></li>
<li>feat: Synthesize Python quality tasks by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13672">vercel/turborepo#13672</a></li>
<li>test: Cover Python quality task commands by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13673">vercel/turborepo#13673</a></li>
<li>feat: Hash Python quality task inputs by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13674">vercel/turborepo#13674</a></li>
<li>test: Cover Python quality task graph by <a
href="https://github.com/anthonyshew"><code>@​anthonyshew</code></a> in
<a
href="https://redirect.github.com/vercel/turborepo/pull/13675">vercel/turborepo#13675</a></li>
<li>chore: Release Turborepo 2.10.9-canary.1 by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>[bot]
in <a
href="https://redirect.github.com/vercel/turborepo/pull/13687">vercel/turborepo#13687</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/turborepo/commit/33237d4be13d7b74768c2cf3353b19cfa8d1af7c"><code>33237d4</code></a>
publish 2.10.9 to registry</li>
<li><a
href="https://github.com/vercel/turborepo/commit/3b0e57f1289b2a6b3d6dd402bce928469d3b25fa"><code>3b0e57f</code></a>
fix: Prevent Windows process cleanup PID reuse (<a
href="https://redirect.github.com/vercel/turborepo/issues/13695">#13695</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/efe4e1bdf665f2950cf89d7968907de36c2f0737"><code>efe4e1b</code></a>
fix: Prune Bun wildcard workspace dev dependencies (<a
href="https://redirect.github.com/vercel/turborepo/issues/13694">#13694</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/a98e5cde97796088c6107684a64a40a967cd1ef0"><code>a98e5cd</code></a>
docs: Document dependency-driven Python tasks (<a
href="https://redirect.github.com/vercel/turborepo/issues/13676">#13676</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/c09a92f526b6dca9ea0243922f680803779759cd"><code>c09a92f</code></a>
chore: Release Turborepo 2.10.9-canary.1 (<a
href="https://redirect.github.com/vercel/turborepo/issues/13687">#13687</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/09bd548dddbff2a29086bdef7cb07b02d5e5458a"><code>09bd548</code></a>
test: Cover Python quality task graph (<a
href="https://redirect.github.com/vercel/turborepo/issues/13675">#13675</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/3584a5fb8edac9efc826fdea57e92088505fc76a"><code>3584a5f</code></a>
feat: Hash Python quality task inputs (<a
href="https://redirect.github.com/vercel/turborepo/issues/13674">#13674</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/0d43ff3cbf5ac8873c646a84b2fd7ae53097e08d"><code>0d43ff3</code></a>
test: Cover Python quality task commands (<a
href="https://redirect.github.com/vercel/turborepo/issues/13673">#13673</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/94708adc6bc19b41805741cc5a15ac5467a481cf"><code>94708ad</code></a>
feat: Synthesize Python quality tasks (<a
href="https://redirect.github.com/vercel/turborepo/issues/13672">#13672</a>)</li>
<li><a
href="https://github.com/vercel/turborepo/commit/e14f04ec6c2dc2791b0a3beb32df7515b31b3d4b"><code>e14f04e</code></a>
refactor: Extract uv native task specs (<a
href="https://redirect.github.com/vercel/turborepo/issues/13671">#13671</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/turborepo/compare/v2.10.8...v2.10.9">compare
view</a></li>
</ul>
</details>
<br />

Updates `chrome-devtools-mcp` from 1.6.0 to 1.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/releases">chrome-devtools-mcp's
releases</a>.</em></p>
<blockquote>
<h2>chrome-devtools-mcp: v1.7.0</h2>
<h2><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a>
(2026-08-10)</h2>
<h3>🎉 Features</h3>
<ul>
<li>add a utility function to check for localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li>
<li>Add get_heapsnapshot_object_details MCP tool (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li>
<li>Emit native contexts in snapshot summary (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li>
<li>Filter heap snapshot objects by native context (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li>
<li><strong>telemetry:</strong> log devtools data. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li>
<li><strong>telemetry:</strong> log is_devtools_open with each tool
call. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li>
<li><strong>telemetry:</strong> report whether tool call is made on
localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li>
<li>update lighthouse to 13.4.1 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li>
</ul>
<h3>🛠️ Fixes</h3>
<ul>
<li>bound per-navigation network request retention (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li>
<li><strong>cli:</strong> validate session ids (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li>
<li><strong>cli:</strong> warn about version mismatch between cli and
daemon (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li>
<li><strong>daemon:</strong> preserve hyphenated browser flags in arg
serialization and lazy daemon startup (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li>
<li>dispose heap snapshot workers on context teardown (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li>
<li>do not throw synchronously when a CDP session is gone (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li>
<li>don't throw if Dialog was handled (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li>
<li>downscale viewport screenshots when no viewport is emulated (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li>
<li>improve daemon lifecycle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li>
<li>improve file writing (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li>
<li>include the tab id in <code>get_tab_id</code>'s text response (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li>
<li><strong>memory:</strong> dispose the heap-snapshot worker when
loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li>
<li><strong>performance:</strong> reset trace-running flag when
start_trace setup fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li>
<li>regression after the <a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>
(<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li>
<li>rename maxRetainedSize column (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li>
<li><strong>screenshot:</strong> dispose element handle after
take_screenshot (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li>
<li>toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li>
<li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens
during an action (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li>
</ul>
<h3>📄 Documentation</h3>
<ul>
<li>Add devin cli install instruction to README (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li>
<li>correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li>
<li><strong>skills:</strong> update memory leak debugging skill to use
native MCP tools (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li>
<li>Update Chrome requirement for categoryExperimentalWebmcp (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li>
<li>update security.md (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li>
</ul>
<h3>🏗️ Refactor</h3>
<ul>
<li>clean up McpResponse.handle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/main/CHANGELOG.md">chrome-devtools-mcp's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">1.7.0</a>
(2026-08-10)</h2>
<h3>🎉 Features</h3>
<ul>
<li>add a utility function to check for localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2454">#2454</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/c5ebf9e2023ec37c77d2ee355a345249ac91d192">c5ebf9e</a>)</li>
<li>Add get_heapsnapshot_object_details MCP tool (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2374">#2374</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8432cb97a2a18f48afcb542f27dd88d7e5a11f36">8432cb9</a>)</li>
<li>Emit native contexts in snapshot summary (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2375">#2375</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f78a911dc0ce843b08549560d0357712d3b18609">f78a911</a>)</li>
<li>Filter heap snapshot objects by native context (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2377">#2377</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/76fd2424984827802867672fcc8d0e0036f4a3af">76fd242</a>)</li>
<li><strong>telemetry:</strong> log devtools data. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2460">#2460</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/df2c753006ce77cdc8df8c7715d0b5c6675560d4">df2c753</a>)</li>
<li><strong>telemetry:</strong> log is_devtools_open with each tool
call. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2445">#2445</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6f60eabf59dd197bcad244846ea5bbdd2e172286">6f60eab</a>)</li>
<li><strong>telemetry:</strong> report whether tool call is made on
localhost. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2455">#2455</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/6398b7e9a4ee91e50a1f1fd31aee45b0a80b14e4">6398b7e</a>)</li>
<li>update lighthouse to 13.4.1 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2398">#2398</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/745ffe7132f8de97cba58b10e6501427fe254cfc">745ffe7</a>)</li>
</ul>
<h3>🛠️ Fixes</h3>
<ul>
<li>bound per-navigation network request retention (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2435">#2435</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b08c73c8d8887813fdf358e81a43925b84ef10e4">b08c73c</a>)</li>
<li><strong>cli:</strong> validate session ids (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2475">#2475</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ca9121d1805ba11215ddc36d6fb18d40403c1fc">5ca9121</a>)</li>
<li><strong>cli:</strong> warn about version mismatch between cli and
daemon (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2461">#2461</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3afc44dac95757fcaa94e0e9296594bdf2ec97d1">3afc44d</a>)</li>
<li><strong>daemon:</strong> preserve hyphenated browser flags in arg
serialization and lazy daemon startup (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2405">#2405</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d79f3ba24f3c38f7391ea7c9d886f9f7f404743c">d79f3ba</a>)</li>
<li>dispose heap snapshot workers on context teardown (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2428">#2428</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/f245c760570680fd808c8c034d138cf4a5c699e0">f245c76</a>)</li>
<li>do not throw synchronously when a CDP session is gone (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2466">#2466</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ba4fe3eaa4c20e4e32ef6af3b78b4d9d9bbdc1d2">ba4fe3e</a>)</li>
<li>don't throw if Dialog was handled (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2437">#2437</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/574c3207ac5376f104960c5ba425dc4a2e0e3232">574c320</a>)</li>
<li>downscale viewport screenshots when no viewport is emulated (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2380">#2380</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/39c4140f119307bf9b4253ab368512a3aab6ebfc">39c4140</a>)</li>
<li>improve daemon lifecycle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2360">#2360</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/3ee6a2710029f3718792da634c048bf4de90eaa6">3ee6a27</a>)</li>
<li>improve file writing (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2447">#2447</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/1da4bb06e2e598ec9cab9158e8d818aa8a344dc4">1da4bb0</a>)</li>
<li>include the tab id in <code>get_tab_id</code>'s text response (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2381">#2381</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/dcbaf495183a34d9bb0e3d9e8f3e566de6b425f8">dcbaf49</a>)</li>
<li><strong>memory:</strong> dispose the heap-snapshot worker when
loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93">744738d</a>)</li>
<li><strong>performance:</strong> reset trace-running flag when
start_trace setup fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2420">#2420</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/40240c033f8ef91596b16e1b5b53974b385f8b5d">40240c0</a>)</li>
<li>regression after the <a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>
(<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2462">#2462</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c80ce46f3a456cbbc379a569506bcf44fc2bc48">4c80ce4</a>)</li>
<li>rename maxRetainedSize column (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2402">#2402</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/75c7048c80033d1826352f5f4464427e4235a526">75c7048</a>)</li>
<li><strong>screenshot:</strong> dispose element handle after
take_screenshot (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2422">#2422</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/fffb40e58bd5f7ff7e7110f07238b93d56f390ec">fffb40e</a>)</li>
<li>toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753">8028bfe</a>)</li>
<li><strong>wait:</strong> avoid 180s mutex stall when a dialog opens
during an action (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2427">#2427</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/b4e8f74ae5da327a5968c4836d9f5450a3bc2532">b4e8f74</a>)</li>
</ul>
<h3>📄 Documentation</h3>
<ul>
<li>Add devin cli install instruction to README (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2361">#2361</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/45262c0a5ca433e4d9d5700e3c1e006ac41f45f5">45262c0</a>)</li>
<li>correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57">5ddbffd</a>)</li>
<li><strong>skills:</strong> update memory leak debugging skill to use
native MCP tools (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2436">#2436</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/99bd90a7881bea5161d4e6b5ab6da26c2a9a3721">99bd90a</a>)</li>
<li>Update Chrome requirement for categoryExperimentalWebmcp (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2163">#2163</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/354458e23ffd2d1aaaaf1486abb6eb793394797d">354458e</a>)</li>
<li>update security.md (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2362">#2362</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5012b077997618edeb2291d39d17553280f5b2a6">5012b07</a>)</li>
</ul>
<h3>🏗️ Refactor</h3>
<ul>
<li>clean up McpResponse.handle (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2392">#2392</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/348975d808aa0bb1f8a7795df36aa3ff738d6d42">348975d</a>)</li>
<li>introduce Explicit resouce managent (using) (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2443">#2443</a>)
(<a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5b25370c9cd779032c3c9dc9880eca7031c73005">5b25370</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/774d78f5eef5e610407a0c92fa6ec5ed74b027e8"><code>774d78f</code></a>
chore(main): release chrome-devtools-mcp 1.7.0 (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2363">#2363</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/5ddbffd0f364ecd073f4d42a56109950b1421a57"><code>5ddbffd</code></a>
docs: correct the user data directory documentation (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2473">#2473</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/8028bfe3abaecb67422530d05327c5ec72c53753"><code>8028bfe</code></a>
fix: toggle lazy loading for source maps. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2486">#2486</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/d1e4d711aa520c67df045a2f805380e9b3307abd"><code>d1e4d71</code></a>
chore(deps): bump sigstore/cosign-installer from 4.1.0 to 4.1.2 in the
all gr...</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/744738deaaa93e931628b8c42a38a317d0ae3c93"><code>744738d</code></a>
fix(memory): dispose the heap-snapshot worker when loading fails (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2449">#2449</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/ca66d0f321a57473ae400fa5e82842d4bbffe210"><code>ca66d0f</code></a>
chore(dev-deps): bump devtools-frontend (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2498">#2498</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/2f375c7e592d15ee9d0e1d665a4600a8b20879d0"><code>2f375c7</code></a>
chore: fix Explicit resource management polyfill (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2496">#2496</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/830f78b8ce19f8ee1e1d8c4d812bd9d6e4f48c2f"><code>830f78b</code></a>
chore: re-use connection adapter and dispose devtools unvierse (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2465">#2465</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/4c96dca1f19711a80308bd0d608fb8d40e29d152"><code>4c96dca</code></a>
ci: add main branch (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2497">#2497</a>)</li>
<li><a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/commit/71d897b27e7936c1a8911d053e19d92ec2c46655"><code>71d897b</code></a>
chore: add a new profiler scenario for get_console_messages. (<a
href="https://redirect.github.com/ChromeDevTools/chrome-devtools-mcp/issues/2491">#2491</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ChromeDevTools/chrome-devtools-mcp/compare/chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@earendil-works/pi-coding-agent` from 0.83.0 to 0.84.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/releases">@​earendil-works/pi-coding-agent's
releases</a>.</em></p>
<blockquote>
<h2>v0.84.1</h2>
<h3>New Features</h3>
<ul>
<li><strong>Qwen Token Plan Individual</strong> — Use the built-in
provider for models documented for Individual subscriptions. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
<li><strong>Authentication readiness checks</strong> — Use <code>pi auth
check</code> to verify provider or model credentials, optionally
emitting the resolved credential.</li>
<li><strong>Improved fullscreen interaction</strong> — Select words and
paragraphs with multiple clicks and configure half-page transcript
scrolling. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a>.</li>
<li><strong>Terminating blocked tool calls</strong> — Extension
<code>tool_call</code> handlers can stop all-terminating batches without
another model call. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a>.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added Qwen Token Plan Individual as a built-in provider with its
documented subscription model catalog and the shared international
<code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a>
by <a
href="https://github.com/arasovic"><code>@​arasovic</code></a>).</li>
<li>Added <code>pi auth check</code> provider/model auth preflight with
optional credential output (<a
href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li>
<li>Added <code>terminate</code> support to blocked extension
<code>tool_call</code> events so all-terminating batches can skip the
automatic follow-up model call. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a>
by <a href="https://github.com/muyiyr"><code>@​muyiyr</code></a>).</li>
<li>Added inherited double-click word and whitespace selection,
granularity-aware drag selection, and triple-click paragraph selection
in fullscreen mode (<a
href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>,
<a
href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a>
by <a href="https://github.com/volsa"><code>@​volsa</code></a>).</li>
<li>Added inherited unbound half-page transcript scrolling actions for
fullscreen mode. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.1/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Softened the bash tool's <code>PI_*</code> environment guideline in
an attempt to reduce unnecessary inspection commands (<a
href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li>
<li>Reduced worst-case automatic terminal theme detection delay from 200
ms to 100 ms by probing color-scheme and background support
concurrently.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed Bun standalone binaries crashing on startup when the cwd
contains a <code>bunfig.toml</code> with <code>preload</code> by
compiling with <code>--no-compile-autoload-bunfig</code> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a>
by <a
href="https://github.com/geril07"><code>@​geril07</code></a>).</li>
<li>Fixed extension TUI method wrappers recursing indefinitely when
delegating to the original method (<a
href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li>
<li>Fixed right-click not pasting clipboard text in fullscreen mode on
Windows.</li>
<li>Fixed inherited <code>Agent.reset()</code> clearing transcript and
runtime state during active runs; it now rejects until the agent is idle
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a>
by <a
href="https://github.com/wesleyzhangwq"><code>@​wesleyzhangwq</code></a>).</li>
<li>Fixed inherited LaTeX relation, multiplication, and named-operator
spacing, and matrix composition with stacked fractions, operator limits,
and adjacent matrices.</li>
<li>Reduced inherited fullscreen mouse event volume under tmux, Zellij,
and GNU Screen by using button-motion tracking instead of all-motion
tracking.</li>
</ul>
<h2>v0.84.0</h2>
<h3>New Features</h3>
<ul>
<li><strong>Fullscreen TUI mode</strong> — Switch between regular and
fullscreen modes at runtime, with a sticky editor and footer,
independently scrollable transcript, and draggable scrollbars. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#ui--display">UI
&amp; Display</a>.</li>
<li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid
diagrams and terminal-friendly Unicode math in interactive transcripts.
See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/settings.md#markdown">Markdown
settings</a> and <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/tui/README.md#markdown">TUI
Markdown</a>.</li>
<li><strong>Per-directory context overrides</strong> — Use
<code>AGENTS.override.md</code> to replace context files for a specific
directory. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/usage.md#context-files">Context
Files</a>.</li>
<li><strong>Advanced custom model sampling</strong> — Configure
arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM
<code>thinking_token_budget</code> values. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/models.md#sampling-parameters">Sampling
Parameters</a>.</li>
<li><strong>Baseten provider</strong> — Use built-in Baseten
authentication and model support. See <a
href="https://github.com/earendil-works/pi/blob/v0.84.0/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>
<p>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code>
interface to <code>ModelsRequestTransforms</code> because its header
transformation now applies to all authenticated provider requests.</p>
</li>
<li>
<p>Changed JSON and RPC <code>message_update</code> events to emit only
<code>assistantMessageEvent</code> deltas, removing the cumulative
<code>message</code> and <code>assistantMessageEvent.partial</code>
fields that caused quadratic output growth. Clients that need partial
messages must assemble deltas between <code>message_start</code> and
<code>message_end</code>; the latter remains authoritative (<a
href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</p>
</li>
<li>
<p><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns
<code>ProviderHeaders</code> with <code>string | null</code> values and
preserves <code>null</code> header-deletion markers. Extensions that
inspect returned headers must handle <code>null</code>; extensions
forwarding them to pi-ai streams should pass them through unchanged.
This prevents placeholder OpenAI credentials from being sent through
Cloudflare AI Gateway (<a
href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</p>
</li>
<li>
<p>Changed <code>ModelRegistry.refresh()</code> to accept
<code>ModelsRefreshOptions</code> and return
<code>ModelsRefreshResult</code> instead of discarding cancellation and
provider errors.</p>
</li>
<li>
<p>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth
cancellation options rather than catalog refresh options. Call
<code>refresh({ providers: [providerId], signal })</code> separately
when remote freshness is required.</p>
</li>
<li>
<p>Required config-form extension OAuth <code>refreshToken(credentials,
signal)</code> callbacks to accept and honor a concrete abort
signal.</p>
</li>
<li>
<p>Replaced dynamic provider refresh context store access with the
read-only <code>context.stored</code> snapshot and generation-checked
<code>context.publish()</code> transaction.</p>
<p><strong>Providers built with <code>createProvider({ fetchModels
})</code>:</strong> no catalog-publication migration is required. Before
and after, return the fetched models and register the resulting
provider; <code>createProvider()</code> owns restoration, persistence,
and in-memory publication.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@​earendil-works/pi-coding-agent's
changelog</a>.</em></p>
<blockquote>
<h2>[0.84.1] - 2026-08-07</h2>
<h3>New Features</h3>
<ul>
<li><strong>Qwen Token Plan Individual</strong> — Use the built-in
provider for models documented for Individual subscriptions. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
<li><strong>Authentication readiness checks</strong> — Use <code>pi auth
check</code> to verify provider or model credentials, optionally
emitting the resolved credential.</li>
<li><strong>Improved fullscreen interaction</strong> — Select words and
paragraphs with multiple clicks and configure half-page transcript
scrolling. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a>.</li>
<li><strong>Terminating blocked tool calls</strong> — Extension
<code>tool_call</code> handlers can stop all-terminating batches without
another model call. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a>.</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added Qwen Token Plan Individual as a built-in provider with its
documented subscription model catalog and the shared international
<code>QWEN_TOKEN_PLAN_API_KEY</code>. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7659">#7659</a>
by <a
href="https://github.com/arasovic"><code>@​arasovic</code></a>).</li>
<li>Added <code>pi auth check</code> provider/model auth preflight with
optional credential output (<a
href="https://redirect.github.com/earendil-works/pi/issues/7152">#7152</a>).</li>
<li>Added <code>terminate</code> support to blocked extension
<code>tool_call</code> events so all-terminating batches can skip the
automatic follow-up model call. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#tool-events">Tool
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7715">#7715</a>
by <a href="https://github.com/muyiyr"><code>@​muyiyr</code></a>).</li>
<li>Added inherited double-click word and whitespace selection,
granularity-aware drag selection, and triple-click paragraph selection
in fullscreen mode (<a
href="https://redirect.github.com/earendil-works/pi/issues/7725">#7725</a>,
<a
href="https://redirect.github.com/earendil-works/pi/pull/7733">#7733</a>
by <a href="https://github.com/volsa"><code>@​volsa</code></a>).</li>
<li>Added inherited unbound half-page transcript scrolling actions for
fullscreen mode. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/keybindings.md#tui-fullscreen-viewport">TUI
Fullscreen Viewport</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7735">#7735</a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Softened the bash tool's <code>PI_*</code> environment guideline in
an attempt to reduce unnecessary inspection commands (<a
href="https://redirect.github.com/earendil-works/pi/issues/7128">#7128</a>).</li>
<li>Reduced worst-case automatic terminal theme detection delay from 200
ms to 100 ms by probing color-scheme and background support
concurrently.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed Bun standalone binaries crashing on startup when the cwd
contains a <code>bunfig.toml</code> with <code>preload</code> by
compiling with <code>--no-compile-autoload-bunfig</code> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7685">#7685</a>
by <a
href="https://github.com/geril07"><code>@​geril07</code></a>).</li>
<li>Fixed extension TUI method wrappers recursing indefinitely when
delegating to the original method (<a
href="https://redirect.github.com/earendil-works/pi/issues/7731">#7731</a>).</li>
<li>Fixed right-click not pasting clipboard text in fullscreen mode on
Windows.</li>
<li>Fixed inherited <code>Agent.reset()</code> clearing transcript and
runtime state during active runs; it now rejects until the agent is idle
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7717">#7717</a>
by <a
href="https://github.com/wesleyzhangwq"><code>@​wesleyzhangwq</code></a>).</li>
<li>Fixed inherited LaTeX relation, multiplication, and named-operator
spacing, and matrix composition with stacked fractions, operator limits,
and adjacent matrices.</li>
<li>Reduced inherited fullscreen mouse event volume under tmux, Zellij,
and GNU Screen by using button-motion tracking instead of all-motion
tracking.</li>
</ul>
<h2>[0.84.0] - 2026-08-06</h2>
<h3>New Features</h3>
<ul>
<li><strong>Fullscreen TUI mode</strong> — Switch between regular and
fullscreen modes at runtime, with a sticky editor and footer,
independently scrollable transcript, and draggable scrollbars. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#ui-display">UI
&amp; Display</a>.</li>
<li><strong>Mermaid and LaTeX rendering</strong> — Render Mermaid
diagrams and terminal-friendly Unicode math in interactive transcripts.
See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#markdown">Markdown
settings</a> and <a
href="https://github.com/earendil-works/pi/blob/main/packages/tui/README.md#markdown">TUI
Markdown</a>.</li>
<li><strong>Per-directory context overrides</strong> — Use
<code>AGENTS.override.md</code> to replace context files for a specific
directory. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context
Files</a>.</li>
<li><strong>Advanced custom model sampling</strong> — Configure
arbitrary OpenAI-compatible <code>samplingParams</code> and opt-in vLLM
<code>thinking_token_budget</code> values. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/models.md#sampling-parameters">Sampling
Parameters</a>.</li>
<li><strong>Baseten provider</strong> — Use built-in Baseten
authentication and model support. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#api-keys">API
Keys</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Renamed the inherited pi-ai <code>ModelsStreamTransforms</code>
interface to <code>ModelsRequestTransforms</code> because its header
transformation now applies to all authenticated provider requests.</li>
<li>Changed JSON and RPC <code>message_update</code> events to emit only
<code>assistantMessageEvent</code> deltas, removing the cumulative
<code>message</code> and <code>assistantMessageEvent.partial</code>
fields that caused quadratic output growth. Clients that need partial
messages must assemble deltas between <code>message_start</code> and
<code>message_end</code>; the latter remains authoritative (<a
href="https://redirect.github.com/earendil-works/pi/issues/7290">#7290</a>).</li>
<li><code>ModelRegistry.getApiKeyAndHeaders()</code> now returns
<code>ProviderHeaders</code> with <code>string | null</code> values and
preserves <code>null</code> header-deletion markers. Extensions that
inspect returned headers must handle <code>null</code>; extensions
forwarding them to pi-ai streams should pass them through unchanged.
This prevents placeholder OpenAI credentials from being sent through
Cloudflare AI Gateway (<a
href="https://redirect.github.com/earendil-works/pi/issues/7030">#7030</a>).</li>
<li>Changed <code>ModelRegistry.refresh()</code> to accept
<code>ModelsRefreshOptions</code> and return
<code>ModelsRefreshResult</code> instead of discarding cancellation and
provider errors.</li>
<li>Changed <code>ModelRuntime.setRuntimeApiKey()</code> to accept auth
cancellation options rather than catalog refresh options. Call
<code>refresh({ providers: [providerId], signal })</code> separately
when remote freshness is required.</li>
<li>Required config-form extension OAuth <code>refreshToken(credentials,
signal)</code> callbacks to accept and honor a concrete abort
signal.</li>
<li>Replaced dynamic provider refresh context store access with the
read-only <code>context.stored</code> snapshot and generation-checked
<code>context.publish()</code> transac...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@composio/cli@0.3.4-beta.353
2026-08-17 18:57:12 +02:00
Malay Vasa d47ed21a43 docs: expand the Platform code mock with the real quickstart lines
Show the actual six-line quickstart snippet (`import Composio` + `import OpenAIAgentsProvider` + `new Composio({ provider })` + `composio.create(userId)` + `session.tools()` + `new Agent({ … })`), tightened to 11.5px / 1.75 leading so it fits inside the same left-pane height as the For You card.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-08-17 21:17:50 +05:30
Malay Vasa 4a1b8c314a docs: redesign the Welcome landing around Platform / For You
Two-ways-to-start hero: cards now lead with the canonical Composio + product-badge lockup (dashboard-parity) and the same product mocks the dashboard onboarding path step uses — a chat composer flanked by client logos for For You, a code panel for Platform. Right link pane width matches a feature-grid card exactly.

Features grid: whole-card links restored, each mock fades into the card edge with a mask-image, cards live on a single flush bg-fd-card surface. Tools mock bumps from an 8×2 grid of 16 tiles to 10×3 = 30 for more impact, Auth becomes a live schematic — one user identity card wired to three connected-account cards via elbow connectors computed from real DOM geometry (`home-auth-diagram.tsx`), Triggers drops the fake LIVE ping in favor of a plain event list, Sandbox drops the workbench chrome + CPU lights for a clean filename + code panel.

Resources: adds a Platform Dashboard link so the 3×2 grid is complete. Drops the "Get started / What you get / Reach for the rest" eyebrows and section heading — headings stand on their own.

Copy: `audience` → `product`, so llms.txt emits `**Platform**` / `**For You**` instead of `**Platform**` / `**For you**`; matched in `home-navigation.test.ts`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-08-17 18:22:57 +05:30
dependabot[bot] 7e560fd072 chore(deps-dev): bump langchain-openai from 1.4.1 to 1.4.3 in /python in the pip-version group across 1 directory (#4132)
Bumps the pip-version group with 1 update in the /python directory:
[langchain-openai](https://github.com/langchain-ai/langchain).

Updates `langchain-openai` from 1.4.1 to 1.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchain/releases">langchain-openai's
releases</a>.</em></p>
<blockquote>
<h2>langchain-openai==1.4.3</h2>
<p>Changes since langchain-openai==1.4.2</p>
<p>release(openai): 1.4.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39485">#39485</a>)
fix(openai): filter invalid tool calls from content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39366">#39366</a>)
chore(openai): update guidance for responses API for OpenAI-compatible
providers (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39327">#39327</a>)
chore(openai): update docstring for
<code>include_response_headers</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39326">#39326</a>)</p>
<h2>langchain-openai==1.4.2</h2>
<p>Changes since langchain-openai==1.4.1</p>
<p>release(openai): 1.4.2 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39322">#39322</a>)
fix(openai): handle <code>ContextWindowExceededError</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39300">#39300</a>)
chore: bump the minor-and-patch group across 3 directories with 7
updates (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39187">#39187</a>)
fix(openai): filter langchain-generated content block IDs (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39209">#39209</a>)
fix(openai): preserve Responses <code>text</code> options (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39204">#39204</a>)
fix(openai): redact MCP <code>authorization</code> (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39155">#39155</a>)
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39050">#39050</a>)</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchain/commit/56daacc8dff4103f430b121711f601ae503bddf9"><code>56daacc</code></a>
release(openai): 1.4.3 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39485">#39485</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/24e8d2b5960ce52985d99332d29ab503fc4be5f9"><code>24e8d2b</code></a>
chore(model-profiles): refresh model profile data (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39344">#39344</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/9b4ef2ab34bdb6f2313bef3f8ee25202eb089ef2"><code>9b4ef2a</code></a>
fix(openai): filter invalid tool calls from content (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39366">#39366</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/9f738f5297d14f46f0341f6c2d773cbf12962e82"><code>9f738f5</code></a>
fix(core): compat with pydantic 2.14 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39328">#39328</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/d048fbe170573b6e7056b5ef5f78d8451e54abaf"><code>d048fbe</code></a>
chore: bump h2 from 4.3.0 to 4.4.1 in /libs/langchain (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39325">#39325</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/a0a434c18550a21ed9137ddc5f0533cb74f8416b"><code>a0a434c</code></a>
chore: bump h2 from 4.3.0 to 4.4.1 in /libs/langchain_v1 (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39324">#39324</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/c318abed446e7d1a0e872a6967b9b17bc6f4761c"><code>c318abe</code></a>
fix(text-splitters): raise TypeError for non-dict, non-convertible input
to R...</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/1499aa9900987c6050670eb1cbd47bc4db0a6d18"><code>1499aa9</code></a>
fix(core): stop StructuredPrompt from mutating caller kwargs (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39174">#39174</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/0424e03dc71cc487dd11e5fa71d083533cb26816"><code>0424e03</code></a>
fix(core): preserve flat tool args schema for <code>RootModel</code>
runnables (<a
href="https://redirect.github.com/langchain-ai/langchain/issues/39307">#39307</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchain/commit/bc16168d710d8b594d0bc622c70361876bd9cbda"><code>bc16168</code></a>
fix(langchain): preserve history on <code>SummarizationMiddleware</code>
summary failure...</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchain/compare/langchain-openai==1.4.1...langchain-openai==1.4.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=langchain-openai&package-manager=pip&previous-version=1.4.1&new-version=1.4.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 14:21:00 +02:00
Kshitij Jhunjhunwala be43f1a43f Merge branch 'kj/docs-sidebar-instrumentation' of https://github.com/ComposioHQ/composio into kj/docs-sidebar-instrumentation 2026-08-16 15:20:50 -07:00
Kshitij Jhunjhunwala c0935ff348 docs: fix sidebar click gating and make position a visible row index
Review follow-ups on the docs_sidebar_click instrumentation.

usePostHog() resolves to the posthog-js module singleton whether or not a
provider is mounted, so the `!posthog` guard never fired: with no
NEXT_PUBLIC_POSTHOG_KEY the listener still attached and every sidebar
click called capture() on an uninitialized instance, logging "You must
initialize PostHog before calling posthog.capture". Gate the effect on
the same env var components/posthog-provider.tsx gates on.

position threaded through folder recursion, so a collapsed folder's
hidden children counted as rows: Triggers is the 4th visible row under
Core concepts but reported 11, which would inflate any "clicks land in
the top N rows" reading — the same inference error this instrumentation
exists to remove. Count per level instead, so a folder occupies one row
for its siblings and its children get their own 1..n sequence. Making
group and position per-level locals also removes the latent collision
where a separator nested in a folder reset the counter for the folder's
siblings; a test pins that case.

Also: capture auxclick (middle button only) so sidebar links opened in a
new tab are not missing while Cmd/Ctrl+click ones are counted; a folder
with a non-string name now reports folder: null rather than inheriting
its parent's label; and both reference layouts memoize the index instead
of rebuilding it on every render.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-16 15:20:32 -07:00
Kshitij Jhunjhunwala 0fd075ecaf Merge branch 'next' into kj/docs-sidebar-instrumentation 2026-08-16 15:11:40 -07:00
Alberto Schiabel a71b812db1 refactor(cli): rename LocalToolkitSlugs.match to longestPrefix (#4145)
## Summary

Renames `LocalToolkitSlugs.match` to `longestPrefix` to clear CodeQL
code-scanning alert
[#113](https://github.com/ComposioHQ/composio/security/code-scanning/113)
(`js/regex-injection`, high).

## Why

The alert flagged `local.match(toolSlug)` in `toolkit-from-tool-slug.ts`
as a regular expression constructed from a command-line argument. It is
a false positive: `local` is a `LocalToolkitSlugs` object, and its
`match` member is a custom longest-prefix matcher
(`makeLongestPrefixMatcher`) that only does
`toolSlug.toLowerCase().split('_')` plus `Set` membership lookups — no
`RegExp` is ever constructed. CodeQL's `js/regex-injection` sink is
keyed on the `match` member name (matching `String.prototype.match`,
which coerces a string argument into a `RegExp`), so it could not tell
the custom method apart from the string sink.

The member name `match` on a non-string object invited exactly that
confusion — for the analyzer and for human readers. Renaming it to
`longestPrefix` (mirroring the underlying `makeLongestPrefixMatcher` /
`longestPrefix` helper) removes the false positive without suppressing
anything, and reads more clearly.

## Changes

- `services/toolkit-slug-catalog.ts`: interface member and object
literal `match` → `longestPrefix`
- `effects/toolkit-from-tool-slug.ts`: call site `local.match(...)` →
`local.longestPrefix(...)`

## Verification

- `pnpm typecheck` — 14/14 packages pass
- lint-staged (oxlint + prettier) clean on commit

The alert should clear on the next CodeQL scan of the merged commit.
@composio/cli@0.3.4-beta.352
2026-08-16 18:33:25 +02:00
Kshitij Jhunjhunwala fe623da434 docs: emit docs_sidebar_click with sidebar group and depth
The docs app had exactly one posthog.capture call ($pageview), so any
question about how people move through the sidebar had to be answered by
reverse-engineering pageview ordering within a session. $referring_domain
is no help either: pageviews are captured manually on client-side route
change, so document.referrer never updates on internal navigation.

Adds a docs_sidebar_click event carrying href, group, folder, depth,
position and from_path. Group/folder/depth are derived from the fumadocs
page tree at build time and the click handler only does an href lookup —
reading them off the rendered sidebar would mean depending on separators
being <p> and folder triggers being <button>, which is fumadocs-internal
and breaks on upgrade.

Mounted on the docs, examples and both reference sidebars. Nothing fires
when PostHog is unconfigured, for non-sidebar links, or for an href that
is not in the index.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-14 15:37:01 -07:00
Kshitij Jhunjhunwala b297a6ed5e docs: restore auth pages to the sidebar as an Authentication folder (#4136)
## What

The auth guides and shared connections dropped out of the sidebar in
#4099. This puts them back.

`authentication.mdx` becomes an `authentication/` folder holding the
seven auth guides. `shared-connections` moves into
`extending-sessions/`, alongside the other experimental session
features.

Top-level sidebar row count is unchanged at 20 — the guides are folder
children, which fumadocs expands automatically when you're inside the
section.

## Changes

- `authentication.mdx` → `authentication/index.mdx`, with the 7 guides
moved in and a new `meta.json`. `/docs/authentication` keeps its URL.
- `shared-connections.mdx` →
`extending-sessions/shared-connections.mdx`.
- Root `meta.json`: `---Migration and security---` split into
`---Migration---` and `---Security and data---`. Different audiences;
adds a heading, not a clickable row.
- Removed `AUTHENTICATION_GUIDE_URLS` from `app/llms.txt/route.ts`. With
the pages back in the page tree, llms.txt emits them automatically and
the hand-maintained list was a duplicate.
- 8 redirects added. 9 pre-existing redirect destinations repointed so
they don't chain through the moved paths.
- ~90 inbound links rewritten.

## Verification

- `bun run lint:links` — 0 errors
- `bun run test` — 207 pass, 0 fail
- `bun run types:check` — pass
- `bun run lint` — no new warnings
- `/llms.txt` contains all 8 URLs exactly once
- All 8 old URLs redirect; `/docs/authentication` returns 200

`permanent: true` emits 308, matching every existing redirect in the
file.

## Open questions, not addressed here

1. `sessions-vs-direct-execution` carries `legacy: true`, and llms.txt
skips legacy sections — so the page that explains *when* to use direct
execution is invisible to agents. Same class of issue as #3999.
2. Worth re-running the docs agent eval against this preview.
3. `single-toolkit-mcp` has been deprecated since January and takes ~700
cold search landings a month with no banner on the page.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
2026-08-14 14:54:21 -07:00
Kshitij Jhunjhunwala 87abcf8112 docs: keep the single "Migration and security" separator
Revert the separator split, and the later ---Security--- rename with it.
Each half held exactly one folder whose title near-repeats the heading,
so the sidebar read "Migration" / "Migration guides" and "Security" /
"Security and data", and llms.txt emitted "## Security" immediately
above "### Security and data". content/docs/meta.json is byte-identical
to next again; both folders keep their titles.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-14 12:57:57 -07:00
Kshitij Jhunjhunwala 4124f713b3 docs: stop folders swallowing their siblings in llms.txt; fix auth folder link
Four review fixes on the sidebar restore.

Folder headings do not close, so every page emitted after a folder read
as one of that folder's children. Making `authentication` a folder
mid-list swallowed `triggers` and `skills` into `### Authentication`.
Reordering meta.json would fix the output but push Authentication below
Skills in the human sidebar, which is what this PR exists to prevent —
so walkPageTree now buffers each separator section and flushes its plain
pages ahead of its folders. Legacy-separator skipping is unchanged. This
also fixes the pre-existing case where `agent-plugins`, `cli` and
`composio-connect` read as children of `#### Custom providers`.

Drop "index" from authentication/meta.json. Listing it clears
`node.index`, so fumadocs renders the folder as a chevron BUTTON plus a
duplicate child row instead of a SidebarFolderLink — the row a reader
clicks to reach /docs/authentication (1,850 views/month) expanded the
folder instead of navigating. Omitting it matches how `providers` and
`migration-guide` already render. Verified in the built DOM: an A with
href=/docs/authentication, no duplicate row, /docs/authentication.md
still emitted exactly once via node.index.

Rename the ---Security and data--- separator to ---Security---; it
duplicated the folder title directly beneath it, in llms.txt and in the
sidebar.

Point the last three agent/instructions/context.md bullets at canonical
paths rather than redirect-only /docs/authenticating-users/* ones, so
that file is internally consistent.

Extend the llms.txt section test to assert the nearest preceding heading
of any level, and to cover the sibling pages that regressed. It fails
against the old walk.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-14 12:28:27 -07:00
Kshitij Jhunjhunwala c3f117e3e8 docs: assert llms.txt output directly, leave the example snapshot alone
Two review follow-ups:

- Revert docs/lib/standup-bot-source.json. It is an upstream source
  snapshot that gets regenerated, so editing the doc URL in that code
  comment only desyncs it and would be clobbered anyway. The permanent
  redirect covers the stale path.

- Strengthen the agent-reachability assertion in start-routing.test.ts.
  Asserting meta.json membership alone is weaker than the assertion it
  replaced, which checked a string that actually shipped into llms.txt:
  a break in the page-tree walk would have gone unnoticed. Import the
  llms.txt route handler and assert its generated output — each of the
  8 guide URLs present exactly once, the 7 auth guides under Core
  concepts -> Authentication, shared-connections under Guides -> Extend
  sessions, and no trailing "## Authentication guides" section. Follows
  the existing tests/static/llms-openapi.test.ts pattern of importing an
  app route directly, so it runs in `bun run test` with no server.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-14 12:21:59 -07:00
Kshitij Jhunjhunwala 5ca29e857e docs: restore auth pages to the sidebar as an Authentication folder
PR #4099 dropped 8 auth pages from meta.json. That was a net win for
machines (Loop 5 eval: 84/100 vs 77/100, tool-routing failure mode gone)
but it made the pages unreachable by clicking. PostHog, weekday-matched
and control-adjusted, shows the affected pages down 14-64pp beyond the
site-wide baseline drift.

Restore human navigation without touching the machine-facing wins:

- authentication.mdx becomes authentication/index.mdx and the 7 sibling
  auth pages move into the folder. /docs/authentication keeps its URL
  (fumadocs serves index.mdx at the folder route), so Core concepts
  still shows one row and the top-level sidebar row count stays 20.
- shared-connections moves into extending-sessions: it is experimental
  and is a session capability, not a core auth concept.
- "Migration and security" splits into "Migration" and "Security and
  data" — separator headings, not clickable rows.
- Drop AUTHENTICATION_GUIDE_URLS from app/llms.txt/route.ts. The pages
  are back in the page tree, so they emit automatically under Core
  concepts -> Authentication; the hardcoded list would now duplicate.
- 8 permanent redirects for the old URLs (36-42% Google entry rate on
  most of them), plus existing redirect destinations repointed so none
  of them chain.
- ~90 inbound links rewritten across content, api-overviews, app, lib
  and agent instructions. lint:links is the gate: 0 errors.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-14 12:02:53 -07:00
Alberto Schiabel 71ec523d25 feat(examples): live-sweep harness, manifest, and scheduled workflow (#4117)
This PR:

- builds on merged PR #4107
- adds `examples-manifest.json`: 93 runnable entrypoints across both
SDKs with tiers (unattended / provisioned / bounded / excluded),
per-entry timeouts, env contracts, and labeled readiness markers for
OAuth flows
- adds `harness/run.mjs`: sweeps entries against staging with per-entry
Composio traces, negative controls (garbage credentials must fail), a
`selftest`, and a baseline/candidate client swap for parity runs
- rejects every non-staging `COMPOSIO_BASE_URL` before the harness or
provisioning script can send credentials
- adds `--llm mock`: LLM examples run against a pinned
`@copilotkit/aimock` server with scripted tool-call fixtures
(`harness/llm-mock/`) — full sweeps spend zero model tokens while
Composio tool execution stays live on staging; 46/48 LLM entries pass
mocked, and the two `@openai/agents` entries are marked `llmMock:false`
- adds `examples-live.yml`: nightly gc-provision → mock sweep →
four-entry live LLM canary; dispatchable per language, client, entry
subset, and LLM mode, and bound to the `staging` GitHub environment
- accepts separate TypeScript tarball and Python wheel inputs for
candidate sweeps, restores exact pre-run workspace files on failure, and
rejects empty or partial parity comparisons

The configured `COMPOSIO_API_KEY` must belong to a dedicated, disposable
staging project. The workflow becomes dispatchable after it exists on
the default branch.

## Context

Examples historically went stale because nothing executed them. PR #4107
makes them runnable and provisionable; this PR adds the machinery that
runs them on a schedule and validates the Stainless→self-managed client
swap via baseline/candidate parity sweeps.

```mermaid
graph TD
    M[examples-manifest.json] --> R[harness/run.mjs sweep]
    P[examples-provision.mjs --gc] -->|COMPOSIO_EXAMPLES_* ids| R
    R -->|tier 1-3 entries| E[TS + Python examples]
    A[aimock fixtures] -->|--llm mock| E
    E -->|live tool execution + traces| C[Composio staging]
    R --> N[nightly live canary: 4 entries]
```

## Verification

- `env -u COMPOSIO_BASE_URL node harness/run.mjs selftest`
- `pnpm test:examples` against a clean tracked snapshot
- manifest integrity: 93 unique entry IDs and 93 existing files
- JavaScript, Python, JSON, YAML, and embedded Bash syntax checks
- `pnpm validate:changesets`
2026-08-14 15:47:47 +02:00
Alberto Schiabel b80808606a fix(cli): use staging dashboard URL (#4129)
This PR:
- updates `constants.STAGING_WEB_URL` so `COMPOSIO_ENVIRONMENT=staging`
uses `https://staging-dashboard.composio.dev/`
- adds literal regression assertions for map-backed and
process-environment config loading
- records the user-facing CLI fix in the unreleased changelog

Verification:
- `pnpm --filter @composio/cli exec vitest run
test/src/services/config.test.ts` (23 passed)
- `pnpm typecheck`
- `pnpm lint:packages` (passes with pre-existing warnings)
@composio/cli@0.3.4-beta.351
2026-08-13 20:20:42 +02:00
Rohit c0f16093ed fix(errors): set this.name on three ComposioError subclasses
ComposioToolVersionRequiredError, JsonSchemaToZodError, and
JsonSchemaRefResolutionError omitted the this.name assignment their sibling
subclasses perform, so instances inherited the base class field value and
reported name 'ComposioError'. error.name is forwarded to error telemetry,
which mis-grouped these three distinct error types under the base name.
2026-08-13 14:19:49 +05:30
Rohit 9545806a62 fix(telemetry): bound telemetry requests with an AbortSignal timeout
sendMetric and sendErrorLog awaited fetch() with no timeout, so a stalled
telemetry endpoint could leave an awaited SDK call pending indefinitely.
Bound both best-effort requests with an AbortController and a cleared timer
via a shared postWithTimeout helper, mirroring the npm version-check bound in
utils/version.ts. The existing catch still swallows the abort, preserving the
never-throws contract.
2026-08-13 13:42:01 +05:30
sdkrelease[bot] fa7ef4add6 docs: update toolkits, API spec, and meta tools data (#4123)
## Summary
Automated sync of backend data into the docs site. Triggered by:
`schedule`.

## What changed
- **Toolkit catalog** (`docs/public/data/toolkits.json`,
`toolkits-list.json`) — refreshed list of available toolkits, auth
schemes, and tools from the backend API
- **OpenAPI specs** (`docs/public/openapi.json`,
`docs/public/openapi-v3.json`, `docs/public/openapi-webhooks.json`) —
latest v3.1 and v3.0 API specifications plus the webhook-events spec,
fetched from production
- **API reference pages** (`docs/content/reference/api-reference/`,
`docs/content/reference/v3/api-reference/`) — regenerated index pages
for both API versions
- **Meta tools reference** (`docs/public/data/meta-tools.json`,
`docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas
and reference docs

Co-authored-by: Sushmithamallesh <19796925+Sushmithamallesh@users.noreply.github.com>
2026-08-13 03:20:02 +02:00
shams haroon 6e261d6abf docs(custom-mcp): auth config requirement, v3 version pinning gotcha, upsert semantics refresh (#4122)
Custom MCP hardening docs pass from Pelago feedback (Linear PLEN-2931,
origin PLEN-2927), verified against platform code on master.

- Auth config: state explicitly that registration does not create an
auth config; for API-key and DCR OAuth servers creating one (with
`is_enabled_for_tool_router: true`) is a required separate step. Also
fixed the PATCH example: the update body requires `"type": "custom"`
(discriminated union), the previous example would 400.
- v3 gotcha: explain the empty-tools-list symptom, `GET
/api/v3/tools?toolkit_slug=CUSTOM_...` pins a default version without
custom tools; pass `toolkit_versions=latest` or use v3.1.
- Upsert semantics refresh (tracks platform #11598): re-registering an
owned slug now updates mutable fields (name, logo) in place, identical
config is a no-op; `app_url` and `auth_schemes` stay immutable (409,
delete + re-register). Updated the registration callout, logo section,
delete section, and known gaps.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
2026-08-12 14:27:27 -07:00
shams haroon 1c183990cf docs(custom-mcp): auth config is a required step, v3 version pinning, true-upsert semantics
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-12 14:23:52 -07:00
Azhar c3623cb898 fix(cli): nest custom credentials under auth_config.credentials in auth-configs create (#4063)
## Summary

The `composio dev auth-configs create` command fails when custom OAuth
credentials are spread at the top level of `auth_config`. The API
expects those values under `auth_config.credentials`.

Fixes #4058

## Changes

- Nests custom credentials under `auth_config.credentials`.
- Merges parsed `--scopes` into the same credentials object.
- Preserves `credentials: undefined` when neither credentials nor scopes
are supplied.
- Captures the typed repository request in the CLI test layer and
asserts the exact custom OAuth payload.
- Records the user-visible fix in the CLI changelog.
- Merges the current `next` branch without conflicts.

## Verification

- Reproduced on the old implementation: 1 of 8 focused tests failed
because `client_id` remained at `auth_config.client_id`.
- Verified the fix: 8 of 8 focused auth-config create tests passed.
- Full CLI package suite: 120 test files passed; 1,188 tests passed; 1
skipped.
- `pnpm typecheck`: 14 tasks passed across the 19 TypeScript packages in
scope.
- `pnpm run lint:packages`: passed with existing warnings only.
- Prettier check on all four changed files: passed.

The fresh-worktree CLI suite currently needs a temporary local Vitest
alias for the pre-existing `#ssrf_guard` resolver drift. That alias was
used only to run the suite and is not part of this PR.

## Release notes

`@composio/cli` is excluded from Changesets, so this PR updates
`ts/packages/cli/CHANGELOG.md` directly.

---------

Co-authored-by: jkomyno <alberto@composio.dev>
@composio/cli@0.3.4-beta.350
2026-08-12 23:18:17 +02:00
sdkrelease[bot] 7f1ead518c docs: update toolkits, API spec, and meta tools data (#4044)
## Summary
Automated sync of backend data into the docs site. Triggered by:
`schedule`.

## What changed
- **Toolkit catalog** (`docs/public/data/toolkits.json`,
`toolkits-list.json`) — refreshed list of available toolkits, auth
schemes, and tools from the backend API
- **OpenAPI specs** (`docs/public/openapi.json`,
`docs/public/openapi-v3.json`, `docs/public/openapi-webhooks.json`) —
latest v3.1 and v3.0 API specifications plus the webhook-events spec,
fetched from production
- **API reference pages** (`docs/content/reference/api-reference/`,
`docs/content/reference/v3/api-reference/`) — regenerated index pages
for both API versions
- **Meta tools reference** (`docs/public/data/meta-tools.json`,
`docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas
and reference docs

---------

Co-authored-by: Sushmithamallesh <19796925+Sushmithamallesh@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
2026-08-12 22:11:47 +02:00
Kshitij Jhunjhunwala d928d94831 docs: restore quickstart framework picker with TypeScript, keep intent-rewrite improvements (#4121)
## Summary

- Reverts the quickstart portion of #4099, which replaced the framework
picker with a Python-only `uv` flow and left TypeScript readers without
a quickstart path (a gap the review on that PR also flagged).
- Restores the `QuickstartFlow` picker: OpenAI Agents, Claude Agent SDK,
and Vercel AI SDK, each with Python and TypeScript tabs and
`PackageInstall` steps.
- Keeps the parts of #4099 that made the page better:
- Sharper intro and the meta-tools explanation (sessions load app
schemas only when the agent needs them).
- Agent instructions that handle Connect Links and confirm destructive
actions, applied to all six code samples. The Claude Agent SDK
TypeScript sample previously shipped with no system prompt.
- "What just happened?" section with dual-language session persistence
notes (`session.session_id` / `session.sessionId`, `composio.use()`).
  - Production callout for replacing `user_123` with a stable user ID.
  - Logs API pointer and the "Adapt the example" cards.
- Deletes `docs/tests/static/quickstart.test.ts`, which #4099 added to
pin the Python-only structure.

## Validation

- All three TypeScript code blocks pass strict type-checking with the
docs compiler settings (same check Twoslash runs at build).
- Page renders correctly on the local dev server with all three
frameworks and both language tabs.
- Prose follows the good-docs-writing style guide (no em-dashes, "you"
voice, concept-first openings).

🤖 Generated with [Claude Code](https://claude.com/claude-code)
2026-08-11 23:58:05 -07:00
Rahul Tarak 205329c3d2 docs: restore quickstart framework picker with TypeScript, keep intent-rewrite improvements
Reverts the quickstart portion of #4099, which replaced the framework
picker (OpenAI Agents, Claude Agent SDK, Vercel AI SDK with Python and
TypeScript tabs) with a Python-only uv flow, leaving TypeScript readers
without a quickstart path.

Keeps the parts of #4099 that improved the page:

- Sharper intro and meta-tools explanation
- Agent instructions that handle Connect Links and confirm destructive
  actions, applied to all six code samples (the Claude Agent SDK
  TypeScript sample previously had no system prompt)
- "What just happened?" section, dual-language session persistence notes
- Production callout for replacing user_123 with a stable user ID
- Logs API pointer and "Adapt the example" cards

Deletes tests/static/quickstart.test.ts, which was added by #4099 to pin
the Python-only structure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-11 23:08:22 -07:00
palash-c 791853c0f0 docs: add Skills page (#4076)
Adds a Skills page under a new **Skills** section in the docs nav.

## What it covers

A skill is an execution playbook for one concrete task — the tools it
needs, the order to call them in, and the pitfalls that make it fail.
The page leads with why that saves work (an agent rediscovering a tool
sequence and its failure modes pays for it in tokens and retries), then
covers what a skill contains and how to browse the catalog.

## Notes for review

- **No cURL examples.** Skills are dashboard-only today — there is no
public API. That cuts against the repo's usual preference for
machine-readable API docs, so the page calls the absence out explicitly
rather than leaving a reader hunting for an endpoint. Happy to revisit
when an API lands.
- **A screenshot is coming in a follow-up.** The page reads fine without
one, but the browsing section would benefit.
- Branched off `next` and targets `next`, per `docs/CLAUDE.md`.
- Nav placement is a new `---Skills---` section. Open to it living under
an existing section instead.

## Verification

- `bun run scripts/validate-links.ts` → 0 errors
- `bun run build` → exit 0

🤖 Generated with [Claude Code](https://claude.com/claude-code)
2026-08-11 18:45:46 -07:00
Palash Kala 2bf35e43d5 docs(skills): rewrite in the house voice, and show the response
Applied the repo's good-docs-writing skill. The page broke its two hardest
rules: em-dashes are banned in this style and the page was built on them
(the sibling triggers page has zero), and a page with no example asked the
reader to take the whole mechanism on trust.

It now shows the search response carrying a plan, so the shape is concrete
before the prose explains it. The field names are checked against the
schema in composio_actions/utils/schemas.ts: recommended_plan_steps and
known_pitfalls are string arrays, difficulty is a string, and all three are
optional, present only when a skill covers the use case. The page says so,
since anything else would have readers destructure fields that may be absent.

Also cut the filler the audit checklist flags and made every definition a
sentence rather than a dash fragment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 17:10:31 -07:00
Palash Kala c04f2b9332 Merge remote-tracking branch 'origin/next' into docs/developer-skills
# Conflicts:
#	docs/content/docs/meta.json
2026-08-11 16:20:00 -07:00
Kshitij Jhunjhunwala c1fca392de docs: restructure onboarding around user intent (#4099)
## Summary

- Reframes the docs Welcome page around two intents: build with Composio
or use Composio from an existing agent.
- Replaces the framework picker with a general Python quickstart and
routes other frameworks to focused provider guides.
- Adds a shared Agent plugins page for Codex and Claude Code, with
CLI-first setup and explicit MCP alternatives.
- Simplifies the sidebar into Get Started, Core concepts, Guides, Direct
execution (legacy), and Migration and security.
- Keeps the Welcome page readable through its `.md` endpoint and
clarifies intent routing in `llms.txt`.

## Review order

1. Welcome hero and the two intent cards.
2. Quickstart copy and runnable example.
3. Agent plugins, CLI, and MCP routing.
4. Sidebar grouping and progressive disclosure.
5. Agent-readable Welcome Markdown and regression tests.

## Validation

- `bun run test` — 208 passing
- `bun run types:check`
- `bun run lint:links` — 0 errors
- `bun run lint` — passes with pre-existing warnings only
- Dashboard badge styles compared against the live product UI

## Deliberately out of scope

- Docs eval harnesses or eval result files
- Search ranking, agent-index generation, or agent prompt changes
- Deleting pre-existing unused hero or quickstart components
- Unrelated lint warnings and docs content cleanup

This replaces #4085 with a one-commit, docs-only review surface. The
earlier PR accumulated implementation experiments and bot commentary
that made the intended change difficult to evaluate.
2026-08-11 12:18:21 -07:00
Kshitij Jhunjhunwala 70b63f943d docs: clarify toolkit version defaults (#4108)
## Summary

- clarify that the SDK fetching examples default to `latest`
- distinguish REST v3 pinned defaults from REST v3.1 latest defaults
- replace the blanket production warning with output-consumer guidance

## Root cause

The legacy fetching guide used an unqualified `API` statement next to
SDK examples. That conflated SDK behavior with two REST API versions and
contradicted the current API reference.

No SDK package changes or changeset are required.
2026-08-11 11:51:20 -07:00
Kshitij Jhunjhunwala aaa31ab8ad feat(skills): publish the Composio agent skill (#4084)
## Summary

- publish the first-party `composio` skill from the SDK repository
- route first by product (Composio For You or Composio Platform), then
by the requested job
- preserve progressive disclosure, credential safety, and a strict
evidence boundary
- explain exactly what the CLI, raw MCP, OpenAI/Codex plugin, and Claude
Code plugin make discoverable

## Starting point

This keeps Palash's generic router design and Soumya's canonical-link
and cross-language corrections from temporary-repository PRs
[#1](https://github.com/composio-temp/composio-skill/pull/1)
([Glen](https://app.tryglen.com/composio-temp/composio-skill/pull/1))
and [#2](https://github.com/composio-temp/composio-skill/pull/2)
([Glen](https://app.tryglen.com/composio-temp/composio-skill/pull/2)).
The maintained copy now lives with Composio's SDK, CLI, and docs source
instead of the temporary evaluation repository.

## Installation and discovery

Project-scoped, with agent selection when needed:

```bash
npx skills add ComposioHQ/composio --skill composio
```

Global, non-interactive install for the detected agent:

```bash
npx skills add ComposioHQ/composio --skill composio --global --yes
```

This public skill is installed explicitly. A raw MCP connection exposes
tools but does not install a skill. The CLI-owned `composio-cli` skill
and the OpenAI plugin-owned `composio-runtime` skill remain separate
because they own current CLI operation and hosted-versus-local runtime
routing, respectively. The Claude Code plugin does not bundle another
skill.

## Dashboard handoff

Dashboard Getting Started is one context handled by the generic Platform
route, not the skill's identity. When the developer already has the Step
1 `COMPOSIO_API_KEY`, the skill uses that existing project key, never
creates or replaces it, avoids `composio dev init`, and inspects the
real agent path and user identity before proposing code.

## Forward evaluation

Four blind requests were run through fresh agents:

1. Personal Cursor access to Gmail and Google Calendar passed the For
You/MCP route and avoided Platform credentials.
2. First-time Python setup initially overexposed advanced options; after
progressive-disclosure rules, the replay stayed on the minimum
SDK/session/auth path.
3. A GitHub 401 with a working project key remained a narrow
provider-auth debugging task and did not restart onboarding.
4. A TypeScript dashboard handoff initially invented repository facts;
after the evidence boundary, the replay preserved the key and requested
the actual framework and entrypoint.

These are manual routing and response-quality evaluations, not reusable
eval infrastructure. A live provider/OAuth run remains part of the
separate dashboard E2E gate.

## Validation

- skill-creator validator: passed
- canonical repository validator: 18 skills passed before this
documentation-only follow-up
- routing smoke test: 18/18 probes passed
- isolated local `skills add --copy`: passed
- current head CI: pending after the discovery clarification
- no SDK package, backend, CLI, database, or release-metadata changes
2026-08-11 11:42:28 -07:00
Alberto Schiabel 8086ef02cb fix(examples): align Python and TypeScript examples with current backend (#4107)
## Summary

- Repairs runnable TypeScript and Python examples for current backend
requirements, including authenticated MCP endpoints, current transports,
valid tool identifiers, provider limits, and resource uniqueness.
- Replaces placeholder resource IDs with explicit `COMPOSIO_EXAMPLES_*`
configuration and makes failed examples exit loudly.
- Adds `scripts/examples-provision.mjs` as an idempotent provisioning
check for a disposable examples project.

## Scope

- This PR no longer changes the Python SDK runtime or generated-client
dependency.
- Python remains pinned to the published `composio-client==1.43.0` in
`pyproject.toml`, `setup.py`, and `uv.lock`.
- The owned 2.x client integration is deferred until that client
completes its release guarantees and is explicitly published.
- The scheduled live workflow and manifest remain deferred until their
runner is tracked.

## Verification

- `make chk`
- `make tst` (`927 passed, 33 skipped`)
- Hosted checks rerun against commit `12691aca7`.
2026-08-11 19:45:58 +02:00
Alberto Schiabel 0e3b489f9f docs(cli): record 0.3.2 and 0.3.3 releases (#4118)
This PR:

- records the pending CLI entries under `0.3.3`
- restores the missing `0.3.2` boundary from its published source tag
- keeps `Unreleased` available for changes after the stable promotion
- verifies the release metadata with `pnpm validate:changesets` and
`pnpm test:release-workflow`
@composio/cli@0.3.4-beta.349
2026-08-11 16:09:54 +02:00
sdkrelease[bot] 7e78b720df docs: update documentation for new changelog entries (#4116)
## Summary

- Consolidates the provider documentation generated for the Python
0.19.0 and TypeScript provider releases.
- Documents object-schema handling, dynamic-key validation,
omitted/default argument behavior, and provider-specific validation
failures.
- Supersedes #4115, whose generated patch overlaps this one.

## Verification

- `bun run types:check`
- `bun run test`
- `bun run lint:links`
- Adversarial source-backed review with Claude Opus 5 (medium effort)

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: jkomyno <alberto@composio.dev>
2026-08-11 12:29:36 +02:00
sdkrelease[bot] 02196de0b5 Release: update version (#4104)
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to next, this PR will
be updated.


# Releases
## @composio/core@0.16.0

### Minor Changes

- 5e57815: Keep free-form object roots, `patternProperties`, and
`additionalProperties` when parsing a tool schema.

`ToolSchema.parse` used to reject a bare `{ "type": "object" }` root,
drop root `patternProperties` as an unknown key, and reject a root
`additionalProperties` written as a schema instead of a boolean.
Free-form roots now parse successfully, and both constraints survive
parsing exactly as written. The public `ToolSchema` type now makes
`properties` optional to reflect those valid property-less object
schemas.

This matters downstream. Every provider reads `inputParameters` after
parsing, so a tool that declares dynamic keys had those rules stripped
before the model ever saw them.

An omitted `additionalProperties` still stays omitted. The parser does
not invent a value, because each converter decides its own default.

  **What no longer works**

Parsing no longer fails on a schema-valued root `additionalProperties`.

  ```ts
  const tool = ToolSchema.parse({
    slug: 'MY_TOOL',
    inputParameters: {
      type: 'object',
      properties: { name: { type: 'string' } },
      additionalProperties: { type: 'number' },
    },
    // ...
  });

  // before: parsing failed, because only a boolean was accepted
// now: tool.inputParameters.additionalProperties is { type: 'number' }
  ```

  **What to do instead**

Nothing, if you only ever passed boolean values. That case is unchanged.

If your code assumed `inputParameters` never carries
`patternProperties`, or that `additionalProperties` is always a boolean,
widen that assumption. Both keywords can now appear, and
`additionalProperties` can be a boolean or a schema object.

### Patch Changes

- a2f6b96: Add `type: "object"` to nested JSON Schema nodes that carry
`properties` without an explicit type, so tool schemas work with strict
OpenAPI 3.0 consumers like Google Gemini.
- c625edc: Reuse fetched tool schemas when provider-wrapped tools
execute to avoid a redundant retrieval request.
- Updated dependencies [5e57815]
  - @composio/json-schema-to-zod@0.3.0
## @composio/json-schema-to-zod@0.3.0

### Minor Changes

- 5e57815: Keep the content of free-form object arguments, and apply
dynamic key rules only where they belong.

An object schema with no named properties, written as `{ "type":
"object" }` or `{ "properties": {} }`, used to become a strict empty
object. The only value that passed was `{}`. Any real payload was
rejected. Such an object is now open, so arbitrary content is accepted
and preserved. This works at the root, nested inside another object, and
inside array items.

Dynamic keys are now routed to the schemas that actually claim them.
Every matching `patternProperties` entry validates its key. A
schema-valued `additionalProperties` applies only to keys that no
declared property and no pattern matches. Before this change a key could
pass by satisfying an unrelated pattern instead of its own.

  **What no longer works**

Converting a property-less object no longer gives you a schema that
rejects everything.

  ```ts
  const schema = jsonSchemaToZod({ type: 'object' });

  schema.parse({ anything: 1 });
  // before: threw, because the result was z.object({}).strict()
  // now:    returns { anything: 1 }
  ```

  **What to do instead**

If you want a property-less object to stay closed, say so in the JSON
Schema:

  ```ts
const schema = jsonSchemaToZod({ type: 'object', additionalProperties:
false });

  schema.parse({ anything: 1 }); // throws, as before
  ```

Objects that name at least one property are unchanged. They still reject
unknown keys when `additionalProperties` is omitted.
## @composio/claude-agent-sdk@0.11.0

### Minor Changes

- ac6bbab: Register each tool with its complete schema, so root rules
reach the Claude Agent SDK.

The provider used to register a raw property shape. A raw shape is only
the map of named properties, so it cannot carry any root rule.
`additionalProperties` and `patternProperties` were dropped before the
SDK saw them.

Two things went wrong because of that. Free-form object arguments lost
their content. An argument the tool never declared was quietly removed,
and the tool ran anyway.

  Both are fixed. The provider now registers the whole object schema.

  **What no longer works**

  An undeclared argument no longer passes silently.

  ```ts
// The tool declares `to` and nothing else. The model also sends
`hallucinated`.
  { to: 'someone@example.com', hallucinated: 'value' }

// before: `hallucinated` was stripped, and the tool ran with { to:
'...' }
// now: the caller receives an error result, and the tool does not run
  ```

Tools with no input parameters behave the same way. They stay closed and
reject every argument.

  **What to do instead**

If the model should be allowed to send extra keys, say so in the tool
schema:

  ```json
  {
    "type": "object",
    "properties": { "to": { "type": "string" } },
    "additionalProperties": true
  }
  ```

If an argument is one the tool really accepts, declare it in
`properties`. Rejection is usually the better outcome, because the agent
sees the error and can correct itself instead of running with a silently
dropped argument.

This brings the provider in line with `@composio/vercel`,
`@composio/langchain`, and `@composio/llamaindex`, which already
registered complete schemas.
## @composio/google@0.10.2

### Patch Changes

- a2f6b96: Add missing object types to nested Google GenAI tool schemas
so Gemini accepts function declarations with property maps. This release
requires `@composio/core >=0.16.0 <1.0.0` for the shared schema
normalizer.
## @composio/slim@0.16.0

### Patch Changes

- Updated dependencies [5e57815]
  - @composio/json-schema-to-zod@0.3.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@composio/google@0.10.2 @composio/claude-agent-sdk@0.11.0 @composio/core@0.16.0 @composio/slim@0.16.0 @composio/json-schema-to-zod@0.3.0
2026-08-11 10:54:21 +02:00
Alberto Schiabel 26ec42a38c chore(py): prepare 0.19.0 release (#4114)
This PR:

- builds on top of https://github.com/ComposioHQ/composio/pull/4094
- bumps `composio` and all 12 provider distributions from `0.18.2` to
`0.19.0`
- keeps `python/composio/__version__.py` and `uv.lock` aligned with
package metadata
- documents recursive provider argument-presence preservation in the
existing cross-SDK changelog
- passes the release-workflow guard, Ruff, mypy, provider type
inference, and 1,167 Python tests
- builds and validates 26 wheel/sdist artifacts with Twine
- must be retargeted to `next` after #4094 merges
py@0.19.0
2026-08-11 10:44:44 +02:00
Alberto Schiabel 26f380612c fix(docs): probe canonical Markdown route (#4113)
This PR:

- replaces the removed `/docs/tools-and-toolkits.md` health probe with
`/docs/how-composio-works.md`
- restores the scheduled docs health check after the tools page moved in
the sessions-first rewrite
- verifies the canonical endpoint returns `200 text/markdown`
- keeps the release stack unchanged
2026-08-11 10:39:31 +02:00
Alberto Schiabel fc036563b0 fix(py): preserve provider tool arguments (#4094)
This PR:

- builds on #4081's cross-SDK JSON Schema conversion contract
- closes #4092 and supersedes the narrower CrewAI-only proposal in #4093
- validates and serializes CrewAI, LangChain, and LangGraph arguments
without renaming aliases, padding omitted optionals with `None`,
dropping explicit nulls, declared defaults, or dynamic extras
- forces framework validation for pattern-only and other zero-field
Pydantic schemas before tool execution
- returns structured CrewAI validation failures

The final correctness pass extends presence tracking recursively. It
combines each selected Pydantic model's `model_fields_set` with metadata
for JSON Schema-declared defaults, including nested objects, arrays,
maps, `anyOf`/`oneOf`, overlapping `patternProperties`, and
schema-valued `additionalProperties`.

It preserves literal `$ref`-shaped instance defaults and keeps dynamic
attributes and `model_extra` in their previous plain dict/list form.
Repeated dynamic-key materialization is presence-safe and does not turn
omitted nullable fields into explicit nulls.

## Verification

- Provider serialization and schema converter: 158 passed
- Provider, neighboring provider, and parser suites: 219 passed
- Full `nox -s chk`: Ruff and mypy passed
- Claude Fable 5 high adversarial gate: 359 tests plus union, reference,
overlapping-pattern, alias, reserved-key, recursion, and wide/deep
payload probes; `VERDICT: SHIP`
- `git diff --check` passed

Python package versioning remains part of the later Python release
workflow; this PR does not require a TypeScript Changeset.

Closes #4092.
2026-08-11 10:38:38 +02:00
Alberto Schiabel c044aa9577 Merge branch 'next' into fix/python-provider-argument-serialization 2026-08-11 10:31:12 +02:00