mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
mcp-example@0.1.3
23 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 jkomyno
|
d36048fbe7 | feat(typesafe): add TypeSafe Jev provider for TypeScript | ||
|
Alberto Schiabel
|
2367b80d9d |
chore(ci): enforce agent guidance validators in CI (#4447)
This PR: - Add `.github/workflows/agent-substrate.yml` running `pnpm validate:agent-skills` and `pnpm validate:skill-routing` on every push and pull request; both validators previously ran in no CI workflow - No path filters on the trigger: the stale-guidance walk scans every text file in the repo, so any change can affect the result (PR runs restore caches but only `next` pushes save them, per the `setup-node-pnpm-bun` guidance) - Skip `vendor/` directories in the `validate:agent-skills` stale-guidance walk, which was failing on read-only third-party snapshots mentioning other tools' rule conventions - Extend the validator's command scan to `CONTRIBUTING.md` (with a `pnpm dlx` exemption), so its documented commands are checked against `package.json`, `python/Makefile`, and `python/noxfile.py` like the rest of the guidance - Point the routing-test header, root `AGENTS.md`, and `skill-maintenance` reference docs at the new workflow, and add a "Working with AI Coding Agents" section to `CONTRIBUTING.md` covering the inherited agent setup, the two checks, and the routing-probe requirement for skill edits ## Context These two validators are the only checks keeping repo-level agent guidance honest: command names mentioned in guidance are verified against `package.json`, `python/Makefile`, and `python/noxfile.py`, and routing probes assert each skill stays the unique top match for its representative task. Until now nothing enforced either one, and the stale-guidance walk was already red on vendored trees — a failure no guidance owner could fix, which trains people to ignore the check. This makes both checks blocking everywhere they can bite. ## Verification - `pnpm validate:agent-skills` — 19 skills, green, now including `CONTRIBUTING.md` commands - `pnpm validate:skill-routing` — 19 probes over 19 skills, green - Workflow YAML parsed; oxlint and prettier clean on touched files - `Agent Substrate` workflow ran green on this PR (42s) before the trigger change and re-runs on every push |
||
|
Alberto Schiabel
|
0abc629f5d |
refactor(cli): migrate to Effect 4 (4.0.0-rc.112) (#3901)
Rebuilds the Effect v4 port on top of `next` at `effect@4.0.0-rc.112` (the newest release that clears the repository's 3-day `minimumReleaseAge` gate). The three v3-compatible preparation PRs (#4358, #4359, #4360) already landed on `next`, so this PR is now only the cutover. ## What changes - Pins `effect`, `@effect/platform-bun`, and `@effect/vitest` to exact `4.0.0-rc.112`; drops `@effect/cli`, `@effect/platform`, `@effect/platform-node`, and the `toml` override that existed only for `@effect/cli`. The `ts/vendor/effect` source oracle moves to the `effect@4.0.0-rc.112` release commit. - Services become `Context.Service` classes with explicit `Default` layers; `Either` becomes `Result`; `ParseResult` becomes `Schema.SchemaError`; platform modules come from `effect/FileSystem`, `effect/Path`, `effect/PlatformError`, `effect/unstable/process`, and `effect/unstable/http`. - The runner drives `Command.runWith` with v4's default help and error rendering. `CliError.ShowHelp` carries its own exit code, help for non-explicit invocations renders on stderr, and "Did you mean?" suggestions render. `command-introspection.ts` is gone: v4 renders the resolved command's help and the "missing value" tip itself. - `composio --version`, `composio -v`, and `composio version` print the same bare semver (`GlobalFlag.Version` is not enabled; the flag spellings are rewritten to the `version` command before parsing). - Root `--log-level` is a shared flag applied after the subcommand tree is attached, so `composio --log-level Debug <subcommand>` both parses and takes effect. - Every `Flag.boolean` carries an explicit default, because rc.112 makes boolean flags required when omitted. - A `Result` is not an `Effect` at runtime in rc.112 even though the type checker accepts `yield*` on it (the fiber dies with "Not a valid effect"); every `Result` is lifted with `Effect.fromResult`, and the skill/AGENTS guidance says so. - Every `ChildProcess.make` site passes `extendEnv: true`, because rc.112 no longer inherits the parent environment by default. - `--log-level` and `COMPOSIO_LOG_LEVEL` are exact-match on the `LogLevel` names (`All`, `Fatal`, `Error`, `Warn`, `Info`, `Debug`, `Trace`, `None`) with no case folding, per the earlier review decision; README updated. - Spawned children pass `extendEnv: true`, because rc.112's `ChildProcess` no longer inherits the parent environment by default. - ISO timestamps decode through `Schema.DateTimeUtcFromString`; `Schema.DateTimeUtc` is no longer a string codec in rc.112. - `ConfigProvider.fromEnv()` snapshots the environment at construction in v4, so providers that must observe later changes are built per read (`plugin-hint.ts`, `install.cmd.ts`, `config.ts`) and tests use a live-env provider helper. - `cli-keyring` and `json-schema-to-effect-schema` are ported alongside (the latter on `Schema.makeFilter`). - The `effect-v4` skill, the `cli-command` and `typescript-testing` references, `ts/packages/cli/AGENTS.md`, and the oxlint config are updated to the rc.112 reality. The skill's example checker (`.agents/skills/effect-v4/scripts/check-examples.mjs`, lifted from #3851) compiles every TypeScript block in the skill against the pinned packages. - The `js-yaml` overrides move to the 4.3.2 / 3.15.2 lines that GHSA-2883-xcg3-v3hh requires; `pnpm audit --prod` is clean apart from the already-ignored `extract-zip` advisory. ## Behaviour notes - `composio <unknown> --help` now prints the root help with exit 0 (v4's global `--help` handling); `composio <unknown>` without `--help` still fails with the unknown-subcommand error. ## Validation - `pnpm --filter @composio/cli typecheck` (src + test): 0 errors - `pnpm --filter @composio/cli test`: 127 files, 1325 tests pass, 1 skipped; `validate:boundaries` and `validate:skills` pass - `@composio/cli-keyring` and `@composio/json-schema-to-effect-schema` typecheck, test, and build pass - `pnpm validate:agent-skills` and `pnpm validate:skill-routing` pass (19 skills) - oxlint clean on `ts/packages/cli`, `cli-keyring`, `json-schema-to-effect-schema` - CLI bundle and standalone binary build; smoke-checked `version`, `--version`, `-v`, `--help`, unknown subcommand, unrecognized flag, missing flag value - Docker CLI e2e suites pass against an image built from this branch: `version`, `toolkits-list`, `toolkits-info`, `toolkits-search`, `setup-plugins`, `run`. `whoami` (needs an API key), `install` (needs a release dir), and `upgrade` (needs network) were not run. No changeset: `@composio/cli` is Changesets-ignored and the ported sibling packages are private. Human-facing notes are in `ts/packages/cli/CHANGELOG.md`. https://claude.ai/code/session_01AW7ZPhfZuni6PrCJ9X86DX |
||
|
Alberto Schiabel
|
20aaa95c96 |
ci(ts): verify packed provider compatibility (#4355)
This PR: - adds a clean consumer harness that packs core, its internal JSON Schema dependency, and all ten TypeScript providers - verifies tarball contents, npm installation, named public exports, consumer typechecking, provider construction, and a credential-free `wrapTool` conversion - covers the current workspace core, one verified minimum-core lane per provider, and the packed workspace core presented as `1.0.0-beta.0` - preserves existing 0.x minimum peer ranges while recording the verified floors separately for the future breaking release - additively accepts core 1.0 prereleases without claiming stable 1.x support yet - widens the Anthropic and OpenAI Agents peer ranges to include the upstream versions already used by this repository - runs the gate in TypeScript CI and immediately before Changesets publishing The release guard fails before publication and its regression test verifies build -> compatibility -> publish ordering plus failure propagation. ## Non-breaking scope No public API is removed or renamed, and the existing 0.x core peer floors remain unchanged. All peer-range changes are additive. The gate reports the nine floor corrections that should be made with the planned breaking release. ## Validation - `pnpm run check:provider-compatibility` (12 packed consumer lanes) - `pnpm run test:provider-compatibility` - `pnpm run test:release-workflow` - `pnpm run build:packages` (19 packages) - focused TypeScript compile and Oxlint checks - Prettier, Changesets validation, and `git diff --check` |
||
|
Alberto Schiabel
|
be8e978c3a |
fix(toolchain): pin Bun canary for valid macOS signatures (#4315)
This PR: - closes #4284 - makes `mise.toml` the editable source of truth for Bun and pins `1.4.1-canary.1+d9b769812`, the first Bun build whose compiled macOS binaries carry strictly valid signatures - maps that revision to the immutable per-platform `@oven/bun-*` npm tarballs via mise's `http` backend, so mise extracts the exact checksum-verified binary with no npm lifecycle, Node dependency, or postinstall script - installs Bun through mise in CI and Docker E2E images, removing the independent `bun-version` input and the `oven-sh/setup-bun` channel - updates the checksum-verified mise installer to `2026.8.15`, reuses it in the Docker E2E images, and regenerates `mise.lock` with that release - teaches the preinstall toolchain check to compare the full Bun revision (via `Bun.version_with_sha`, in-process) when the pinned version carries build metadata - verifies the exact `bun --revision`, a strictly valid Bun-compiled macOS signature, a Linux container install, the release-workflow contract, and formatting/linting EOF -R ComposioHQ/composio |
||
|
jkomyno
|
3e8ce1eae2 | fix(release): use Changesets v3 action protocol | ||
|
Rahul Tarak
|
d7b6e7eb30 |
chore(agents): restore good-docs-writing and good-docs-audit skills (#3991)
## What Restores the two docs-prose skills that were dropped from the skill tree: - `good-docs-writing` — the house documentation style guide (Voice, Structure, Terminology, Punctuation, Code examples, Formatting), for drafting or revising docs prose. - `good-docs-audit` — the review process that audits a doc/README/prose block against that guide and reports `file:line` findings with concrete rewrites. Report-only by default. ## Why Both existed at `d17a268d` under `.claude/skills/` and were deleted in #3666 (`chore(agents): normalize repo guidance skills`), which renamed the rest of the tree into the current taxonomy but did not carry these two over. Nothing replaced them: there is no docs-voice guidance in the repo today, and `docs-decisions` covers docs-site mechanics (Fumadocs, changelogs, ADRs), not prose style. ## Shape of the restore Rule content is restored unchanged from `d17a268d`. Only the file layout differs, because the old flat single-file form no longer passes `validate:agent-skills` (SKILL.md is now capped at 80 lines and a linked `references/` directory is required): ``` .agents/skills/good-docs-writing/SKILL.md # routing + the rules that matter most .agents/skills/good-docs-writing/references/style-guide.md .agents/skills/good-docs-audit/SKILL.md # routing + non-negotiables .agents/skills/good-docs-audit/references/audit-process.md ``` They live under `.agents/skills` (canonical); `.claude/skills` is a symlink, so there is no second copy. Wiring, all three places the taxonomy is asserted: - `ts/scripts/validate-agent-skills.mjs` — added to the `expectedSkills` gate - `ts/scripts/test-skill-routing.mjs` — one routing probe each (the validator fails on any skill without a probe) - `AGENTS.md` — added to the Skill Routing list ## Test results - `node ts/scripts/test-skill-routing.mjs` — passes, 18 probes over 18 skills. Both new probes resolve to a unique top match. - `node ts/scripts/validate-agent-skills.mjs` — zero findings against tracked files. - `pnpm lint-staged` — no staged file matches a configured task (patterns cover `ts/packages/**` and `python/**`). - Markdown formatted with the repo Prettier config. Two notes on how those were run. `pnpm validate:*` could not be used locally: pnpm's pre-run dependency check tries to purge and reinstall the workspace and aborts without a TTY, so the scripts were invoked directly with `node` (same entrypoints the pnpm scripts use). Separately, `validate-agent-skills` reports stale-guidance hits under `docs/.eve/dev-runtime/snapshots/**` on my machine; those are untracked, gitignored local eve snapshots, unrelated to this change, and won't exist in CI. The commit used `--no-verify` because the pre-commit hook is just the `pnpm lint-staged` wrapper that hits the same pnpm abort; lint-staged was run manually instead. No changeset: guidance and tooling only, no published package touched. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
f233e46937 |
chore(repo): migrate eslint to oxlint and typecheck to TypeScript 7 (#3966)
This PR: - replaces ESLint with oxlint across the pnpm workspace and the Bun-based docs site, porting the rules to `.oxlintrc.json` / `docs/.oxlintrc.json` with behavior parity (restricted-syntax selectors kept via `oxlint-plugin-eslint`) - migrates typecheck to TypeScript 7 (`typescript@^7.0.2` catalog) and keeps a TS6 pin for JS compiler API consumers via a named `ts6` pnpm catalog (`ts/scripts/validate-examples.ts`, the `@composio/cli` generate pipeline). The CLI's `typescript` dependency rebinds only the compiler-API import — its typecheck still runs the root TS7 `tsc`, since the alias package only ships a `tsc6` bin (documented in `ts/packages/cli/AGENTS.md`) - removes the `paths` mappings that pointed `@composio/core` (and, in `experimental`, `@composio/json-schema-to-zod` plus core-internal `#`-imports) at sibling `src` directories: under TS7, tsdown's tsgo-based dts step emitted stray `.d.ts` files next to those out-of-root sources on every dependent package build. Workspace deps now resolve through their built dist types, which turbo's `dependsOn: ^build` already guarantees exist — and which the deep-path exports (`@composio/core/*`) always used anyway - renames the cli boundary tooling `eslint-boundaries*` → `lint-boundaries*` and hardens the scanner to reject `oxlint-disable` spellings so the disable manifest cannot be bypassed - rewrites inline `eslint-disable` comments to oxlint rule names (comment-only; no runtime changes), and adds **one new** declared boundary: `tool-file-uploads.ts` needs `no-restricted-imports` disabled for `node:crypto` (MD5 for the presigned-upload checksum is not in Web Crypto), because oxlint also catches dynamic `await import()` where ESLint did not. The manifest grows 46 → 47 deliberately - updates CI path filters, `turbo.jsonc` lint inputs, and the docs typescript-check workflow (renamed to "Docs - Lint and TypeScript Validation" since it now lints too); drops `eslint`, `typescript-eslint`, `eslint-config-next`, and `globals` from the dependency graphs - ships no changeset: I built `@composio/core` and `@composio/anthropic` on this branch and on the pre-migration base and diffed the emitted `dist/**/*.d.mts`. The provider output is byte-identical. Core's output is **semantically identical but not byte-identical**: TS7 changes quote style (`"x"` → `'x'`), object-property and union-member ordering in inferred types, and picks equivalent shorter re-export alias paths for five signatures (e.g. `OpenAI.Beta.Threads.Runs.Run` → `OpenAI.Beta.Threads.Run` — verified both names alias the same type in the shipped typings). Chunk-name hashes shift as a consequence. No type gains, losses, or shape changes; `attw` and `publint` pass on the TS7 build ## Context First of a three-PR split of #3958. The type-safety refactors are stacked on this branch and merge after it: - docs: https://github.com/ComposioHQ/composio/pull/3967 - `@composio/core`: https://github.com/ComposioHQ/composio/pull/3968 |
||
|
Alberto Schiabel
|
9498679c26 |
fix(release): guard and document CLI releases (#3895)
This PR: - removes the stale `@composio/cli` changeset that wedges `changesets/action` and preserves its release note in the CLI changelog - adds `validate:changesets` before the TypeScript release action and covers ignored-package changesets in the release regression suite - makes the guard read changeset files directly so it also works in shallow and detached CI checkouts - refreshes `mise.lock` after the pinned Python standalone artifacts moved to the 20260718 build - adds the repo-local `cli-release` skill with beta, stable-promotion, verification, and failure-recovery procedures - replaces the contradictory "stable via changeset" contributor guidance with the tested-beta promotion path - extends skill taxonomy, routing probes, and PR path filters so the guard cannot silently drift ## Regression coverage The validator test creates a changeset fixture outside a Git repository, verifies that an ignored CLI package is rejected, then verifies that a normal package changeset passes. This reproduces the shallow-checkout failure without relying on a local `next` ref. ## Verification - `pnpm validate:agent-skills` - `pnpm validate:skill-routing` - `pnpm validate:changesets` - `pnpm test:release-workflow` - `pnpm lint` - `pnpm install --frozen-lockfile` - all 24 TypeScript package test tasks - skill-creator `quick_validate.py` - Prettier check - `git diff --check` - manual beta release [`@composio/cli@0.2.33-beta.294`](https://github.com/ComposioHQ/composio/releases/tag/%40composio/cli%400.2.33-beta.294): 33/33 release and installation jobs passed |
||
|
Alberto Schiabel
|
956f9be9b4 |
chore(agents): normalize repo guidance skills (#3666)
This PR: - replaces the duplicated repo-local skill set with the requested canonical `.agents/skills` taxonomy and short router `SKILL.md` files backed by first-level references - makes `.claude/skills` a compatibility symlink to `.agents/skills` and removes hand-maintained Claude skill/rule copies - moves docs agent guidance and decisions into neutral `docs/agent-guidance/` and `docs/decisions/`, with `docs/CLAUDE.md` reduced to a shim - retires CLI Cursor rules after migrating CLI design, Effect source, and client-cache sync guidance into `AGENTS.md` and `cli-command` - adds nested `AGENTS.md` files for TS, core, providers, e2e, Python, Python providers, and docs - adds `pnpm validate:agent-skills` to validate skill frontmatter, taxonomy, references, symlink invariants, stale paths, and command names - implements missing Python `tst` and `snt` nox sessions that existing Makefile targets already exposed - no changeset: repository guidance/tooling only, no published SDK package behavior ## Verification - `pnpm validate:agent-skills` -> `Validated 14 canonical agent skills and guidance invariants.` - `for skill in .agents/skills/*; do python /Users/jkomyno/.codex/skills/.system/skill-creator/scripts/quick_validate.py "$skill" || exit 1; done` -> 14x `Skill is valid!` - `pnpm --dir ts/packages/cli validate:skills` -> `Validated composio-cli skill builds for stable and beta.` - `cd python && uv run nox --list` -> includes `tst` and `snt` - `cd python && uv run nox -s snt` -> 18 passed - `cd python && uv run nox -s tst -- tests/test_imports.py` -> 8 passed - `git diff --check` / `git diff --cached --check` -> clean - stale reference search for retired docs/Claude/Cursor paths -> no matches ## Forward Tests - TypeScript core bug: loaded `bug-fixing`, `typescript-sdk`, `typescript-testing`; found correct root/ts/core `AGENTS.md` route. - Python provider: loaded `python-providers`, `python-testing`; found missing nox sessions, fixed here. - CLI command: loaded `cli-command`; found recording/changeset wording gaps, fixed here. - Cross-SDK drift: loaded `cross-sdk-parity`; again found Python nox drift, fixed here. - Docs + decision: loaded `docs-decisions`; found decision template/index and Twoslash path gaps, fixed here. ## Notes The first normal `git commit` attempt hit a lint-staged/Git stash limitation while replacing `.claude/skills/` with a symlink (`path ... beyond a symbolic link`). The final commit used `--no-verify` after the validators and formatting checks above passed. |
||
|
Alberto Schiabel
|
cddd66c3ce |
chore(ts): bump Hono, Mastra, and Chrome deps (#3691)
This PR: - bumps `hono`, `@mastra/core`, and `chrome-devtools-mcp` to their current latest published versions - routes the remaining Cloudflare Tool Router Hono consumer through the workspace catalog - updates the `@composio/mastra` `@mastra/core` peer range and adds a patch changeset - fixes `check-peer-deps` to resolve `semver` through the normal package dependency |
||
|
Alberto Schiabel
|
f8cd90ce5a |
chore(ts): adopt Node 24 and pnpm 11 toolchain (#3646)
This PR: - uses plain `tsdown` package scripts and a shared typed `tsdown.config.base.ts` so Node 24 builds work without loader flags - switches the repo dev/build toolchain to Node `24.17.0` and pnpm `11.8.0` through `mise.toml`, `mise.lock`, and `pnpm-lock.yaml` - marks the root package as ESM with `type: module`, matching the TypeScript packages - keeps Node `22.22.3` in the runtime/E2E matrices as the minimum supported user runtime - changes the TypeScript build workflow back to a single build on the mise-managed toolchain and broadens path filters for package-manager/build config files - adds pnpm 11 build-script policy with `allowBuilds` and intentionally ignored `sharp` builds - enables tsdown ESM shims for the packaged CLI wrapper so `composio --help` runs under Node 22 and Node 24 Verified locally: - `CI=true pnpm install --frozen-lockfile` - `pnpm lint` - `pnpm run build:packages` - `COMPOSIO_E2E_NODE_VERSION=22.22.3 pnpm --filter @e2e-tests/node-esm-basic --filter @e2e-tests/node-cjs-basic run test:e2e:node` - `node ts/packages/cli/bin/composio.mjs --help` under Node `22.22.3` and `24.17.0` |
||
|
Alberto Schiabel
|
025a657597 |
feat(ts): drop CommonJS support (#3494)
This PR moves the TypeScript SDK support floor to the latest Node.js 22 release and uses that as the point where we stop carrying custom CommonJS compatibility machinery. The e2e runtime coverage now exercises the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested against the minimum supported version and the newer runtimes users are likely to adopt next. Because the SDK packages are still on `0.x`, the accompanying changeset uses `minor` bumps while calling out that this is a breaking change inside the existing 0.x line. It also moves pnpm under mise on this Node 22 layer. That belongs here, not in #3493, because the pinned `pnpm@10.28.2` requires Node.js `>=22.13`. Removing Corepack is intentional: Node.js documents that Corepack is no longer distributed starting with Node.js v25, so relying on `corepack enable` would keep a toolchain dependency that is already on the way out of the Node distribution. ## What changed - Pins the local/toolchain Node.js floor to `22.22.3` in `mise.toml`, `mise.lock`, `toolchain-versions.json`, and root `devEngines`. - Pins pnpm in `mise.toml` as `"npm:pnpm" = "10.28.2"` and makes mise the single source of truth for the pnpm version. Removes the root `packageManager` / `devEngines.packageManager` Corepack pin entirely (rather than keeping a second copy of the version that could drift) and removes stale `packageManager` metadata from real TS packages/examples and generators. - Sets `dangerouslyDisablePackageManagerCheck: true` in `turbo.jsonc` so Turbo discovers pnpm from `pnpm-lock.yaml` instead of requiring a `packageManager` field. Without this, Turbo fails workspace resolution (`Could not resolve workspaces -> Missing 'packageManager' field`), which is the only reason the field would otherwise need to stay. - Replaces `corepack enable` in the shared setup action with mise-managed pnpm. The E2E Docker images install bun + pnpm directly from `mise.toml`/`mise.lock` (with `dangerouslyDisablePackageManagerCheck`-style separation: Node/Deno stay on the base image as the test matrix axis and are disabled via `MISE_DISABLE_TOOLS` so mise does not shadow them; the tool binaries are symlinked into `/usr/local/bin`). No `BUN_VERSION`/`PNPM_VERSION` build args are threaded from the host anymore, and bun+pnpm now carry `mise.lock` checksum verification. - Extends the install-time toolchain check to validate pnpm against mise alongside Bun. - Sets the Node E2E matrix and install fallback checks to `22.22.3`, `24.16.0`, and `25.9.0`. - Makes TS package builds ESM-only: `tsdown` now emits `.mjs` / `.d.mts` only and uses the ATTW `esm-only` profile. - Removes explicit `require` / `.cjs` / `.d.cts` package export paths and internal import mappings from the public TS SDK packages. - Marks public TS SDK packages as `type: module` where they were missing it. - Replaces the remaining runtime `require('pusher-js')` with dynamic ESM import. - Deletes the legacy CJS example. - Reintroduces `node/cjs-basic` as a modern Node `require(esm)` interop E2E: it verifies `require('@composio/core')` works through Node's native ESM loader on Node 22, 24, and 25 while resolving to `dist/index.mjs`, not a `.cjs` artifact. - Removes `.cjs` / `.cts` handling from example validation and CLI project-language detection. - Updates provider scaffolding so newly generated providers are ESM-only. - Adds a minor changeset warning that CommonJS callers can only rely on Node's native `require(esm)` interop and that custom CommonJS compatibility machinery is gone. ## Bundled behavior changes Two changes here are technically independent of the CommonJS removal but ride along because they touch the same files and ship in the same release cut. Calling them out explicitly so they are not missed in review: - **`PusherUtils` realtime channel auth (`@composio/core`).** Replacing the runtime `require('pusher-js')` with a dynamic ESM `import()` was done alongside conforming `channelAuthorization` to pusher-js's typed `customHandler(params, callback)` contract. The previous `(authOptions) => Promise` shape did not match pusher-js's actual calling convention — it read `endpoint`/`headers`/`params` off an argument that pusher-js never passes — so this also fixes that latent mismatch. New unit tests (`ts/packages/core/test/utils/pusher.test.ts`) cover the auth request shape (endpoint, `x-api-key` header, JSON `socket_id`/`channel_name` body) and the success / invalid-JSON / network-failure callback paths. - **CLI meta-tool slug list (`@composio/cli`).** Drops `COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from `META_TOOL_SLUG_LIST` in `tools-executor.ts`; `@composio/client` alpha.74 removed those slugs from the `SessionExecuteMetaParams['slug']` union. The list is declared `satisfies ReadonlyArray<SessionExecuteMetaParams['slug']>`, so this is enforced at compile time (`pnpm typecheck`) — keeping the stale slugs would be a type error — and needs no separate runtime test. ## Verification - Verified latest Node 22/24/25 releases from the official Node dist index: `22.22.3`, `24.16.0`, `25.9.0` (https://nodejs.org/dist/index.json). - Verified Node docs state Corepack is no longer distributed starting with Node.js v25: https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html - `mise exec -- pnpm --version` -> `10.28.2` - `mise exec -- pnpm install --frozen-lockfile` - `mise exec -- bun run ts/scripts/pre-install/check-toolchain.ts` - `mise exec -- pnpm --filter @e2e-tests/utils typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheck` - `mise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:node` - `mise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheck` - `mise exec -- pnpm --filter @composio/cli typecheck` - `mise exec -- pnpm --filter @composio/cli test -- --runInBand` - `mise exec -- pnpm --filter @composio/core typecheck` - `mise exec -- pnpm --filter @composio/core exec vitest run test/utils/pusher.test.ts` - `mise exec -- pnpm run build:packages` - `mise exec -- turbo run build --dry-run` resolves all workspace packages with no root `packageManager` field (pnpm discovered from `pnpm-lock.yaml`). - `mise exec -- pnpm --filter @composio/cli exec vitest run test/src/services/project-environment-detector.test.ts` - `mise exec -- pnpm exec prettier --check ...` - `docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .` (also `Dockerfile.deno` with `DENO_VERSION=2.6.7 NODE_MAJOR=22`) — both build green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 / bun 1.3.10 from mise. - `docker manifest inspect node:24.16.0-slim` - `docker manifest inspect node:25.9.0-slim` - `bash -n ts/scripts/create-provider.sh && git diff --check` - `ruby -e "require 'yaml'; YAML.load_file('.github/workflows/ts.test-e2e.yml')"` - Tracked example validation in a clean temporary tree: `Validated 21 example packages.` |
||
|
Alberto Schiabel
|
08f7072110 |
fix(ci): make CLI releases reliably ship binary assets (#3515)
## Summary Permanently stops the recurring *"release published with zero assets → install/upgrade 404s"* outage (https://github.com/ComposioHQ/composio/issues/3408, https://github.com/ComposioHQ/composio/issues/3269; regressions of https://github.com/ComposioHQ/composio/issues/2625 and https://github.com/ComposioHQ/composio/issues/1820 — 3 of the last 5 stable releases shipped empty). **Root cause:** a concurrent-writer race. On a CLI version bump, `changesets/action` creates an empty `@composio/cli@x.y.z` GitHub Release in seconds, then the slower `build-cli-binaries.yml` fails its `gh release create` because the release already exists — so binaries never attach. > 🥞 **Stacked on #3415** (`pi/exclude-cli-ts-release-42161920`), which removes the *second writer* (changesets no longer creates CLI releases). Review/merge #3415 first; this PR targets that branch. This PR hardens the now-sole writer so a *partial* build can't publish either, and fixes the monitoring that hid the failure. ## What changed (`build-cli-binaries.yml` + canary) - **Draft → verify → publish.** The release is built as a **draft**, then a gate asserts all 6 canonical assets are present **and** `state == "uploaded"` (loud `::error::` + fail otherwise), and only the final step flips it to published. Drafts fire no `release: published` event and are excluded from `/releases/latest`, so no install.sh / Homebrew / redirect consumer can observe an incomplete release. - **`fail-fast: false`** on the build matrix → a single platform failure can never publish a partial set (`needs.build.result` is `success` only if all legs pass). - **Per-tag job-level `concurrency`** so re-runs / quick pushes can't interleave uploads on the same tag, without serializing unrelated betas. - **Beta-safe:** `--prerelease` is set on the draft so betas stay prereleases through the publish flip. - **`promote-stable` guard** uses `gh release view --json isDraft` (the REST tags endpoint 404s on drafts) to resume an existing draft but refuse an already-published tag. - **Least privilege:** workflow defaults to `contents: read`; only the release job opts up to `contents: write`. - **Canary fix** (`cli.install-health-check.yml`): install the newest stable **pinned** tag (`npm view @composio/cli version`) instead of the asset-aware no-arg flow, which self-heals to the last good release and kept the canary green through every outage. ## Idempotency note Re-running a run that failed **before publish** is safe (reuse draft + `--clobber`). An already-**published** tag is refused, not mutated — by design. ## Testing - Extended `test/release-workflow.test.ts` (run via `pnpm test:release-workflow`) to lock in: draft→verify→publish ordering, `fail-fast: false`, per-tag concurrency, preserved `--prerelease`, and the pinned-tag canary. ✅ passes. - `shellcheck` clean on the new `run:` scripts; YAML validated. `actionlint` runs in CI. - Runtime verification of the full green path happens on the next release CI run. ## Out of scope (deferred to their own PRs) Per reviewer consensus, these are real but *not this bug*: a per-release npm↔GitHub asset auditor (needs a grace window), the Homebrew trigger constraint (folds into #3355), `composio upgrade` missing-asset back-off (https://github.com/ComposioHQ/composio/issues/3269), and a rollback runbook. --------- Co-authored-by: Rahul Tarak <cryogenicplanet@gmail.com> |
||
|
Alberto Schiabel
|
4fe776898a |
chore(toolchain): finish mise migration (#3493)
## Summary Depends on #3492. This completes the Phase 2 migration by removing the transitional version-file layer and making `mise.toml` plus `mise.lock` the repository toolchain source of truth. It also moves runtime test matrices into `toolchain-versions.json`, so CI matrix changes are explicit and reviewable without reintroducing `.nvmrc`, `.dvmrc`, `.bun-version`, or `.python-version`. The Node.js e2e matrix now starts at the latest Node 22 LTS line and also covers the latest Node 24 and Node 25 lines. That removes Node 20 from the well-known e2e versions while keeping us covered on the runtimes SDK users are moving toward. ## Rationale Phase 1 introduced mise side by side with the existing version files to keep the first PR low-risk. Phase 2 removes that compatibility layer so there is one place to update tool versions. That avoids silent drift between local setup, GitHub Actions, Docker E2E images, release docs, and install-time checks. The composite setup actions now install Node, Bun, Python, and uv through mise by default, with explicit version overrides only where a matrix needs them. New GitHub actions added in this PR are pinned by release commit SHA and include the release version comment. ## What changed - Deleted the transitional root/version files: `.nvmrc`, `.bun-version`, `.dvmrc`, root `.python-version`, and `python/.python-version`. - Removed `idiomatic_version_file_enable_tools` from `mise.toml` and added a committed `mise.lock` for linux/macOS x64/arm64 tool resolution. - Replaced `BYPASS_BUN_VERSION_CHECK` with `BYPASS_TOOLCHAIN_CHECK`, and made Docker E2E image installs use that bypass because they receive explicit build args instead of installing mise. - Updated Node/Bun and Python/uv composite actions to default to mise, remove `*-version-file` inputs, report resolved versions, and cache pnpm after `corepack enable`. - Centralized CI runtime matrices in `toolchain-versions.json` for TS E2E, Python tests, and CLI npm fallback coverage. - Updated the Node E2E matrix to `22.22.3`, `24.16.0`, and `25.9.0`, removing Node 20 from the well-known runtime versions. - Updated workflows, docs, E2E helpers, Dockerfiles, and release guidance to reference `mise.toml` / `mise.lock`. ## Verification - Verified latest Node 22/24/25 releases from the official Node dist index: `22.22.3`, `24.16.0`, `25.9.0` (https://nodejs.org/dist/index.json). - `pnpm install --frozen-lockfile` - `pnpm --filter @e2e-tests/utils typecheck` - `pnpm --filter @e2e-tests/utils exec tsc --noEmit --target es2022 --module esnext --moduleResolution bundler --types bun --resolveJsonModule --skipLibCheck --strict scripts/docker-build.ts` - `bash -n ts/scripts/pre-install.sh && bun run ts/scripts/pre-install/check-toolchain.ts && BYPASS_TOOLCHAIN_CHECK=1 bash ts/scripts/pre-install.sh` - `pnpm exec prettier --check ...` on touched YAML/Markdown/TS/JSON files - `ruby -e "require \"yaml\"; ARGV.each { |f| YAML.load_file(f) }" ...` on touched actions/workflows - `mise lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64 && git diff --exit-code mise.lock` - `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/utils typecheck` - `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/node-esm-basic typecheck` - `mise exec node@22.22.3 -- pnpm --filter @e2e-tests/node-cjs-basic typecheck` - `docker manifest inspect node:24.16.0-slim` - `docker manifest inspect node:25.9.0-slim` - `git diff --check` |
||
|
Rahul Tarak
|
a8071e0d35 |
Add channel-aware Composio CLI skill builds (#3127)
## Summary - Add a generated `composio-cli` skill source that can render stable and beta variants from a single channel-aware definition. - Introduce build and validation scripts to generate the skill output and verify channel-specific content, references, and reproducibility. - Update the CLI packaging workflow to validate skills and package the correct release-channel build for beta vs stable releases. - Expand the skill content with clearer top-level CLI guidance, troubleshooting, developer-project workflows, and beta-only power-user examples. - Tighten CLI install/upgrade behavior and add tests covering skill installation behavior. - Add example validation to the repo test flow and align example package metadata with workspace expectations. ## Testing - Not run locally. - Added `ts/packages/cli/scripts/validate-skills.ts` checks for stable/beta markers, channel-specific content, and required reference files. - Added `ts/packages/cli/test/src/effects/install-skill.test.ts` coverage for skill installation behavior. - Added `ts/scripts/validate-examples.ts` to validate example package manifests during `pnpm test`. - CI workflow now runs `pnpm run validate:skills` before packaging CLI skill files. |
||
|
Alberto Schiabel
|
d80cd28f46 |
feat(ci): QoL improvements (#2404)
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
Alberto Schiabel
|
ded64beb75 |
feat(ts): support Cloudflare Workers + refactor build pipeline with tsdown + introduce e2e tests (#2360)
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com> |
||
|
jkomyno
|
4554eba908 | chore: update to pnpm@10.17.0 | ||
|
jkomyno
|
18e7feea41 | chore: update to pnpm@10.16.0 | ||
|
jkomyno
|
bab3adf1c0 | chore(ts): update tsconfig.json in ts/scripts | ||
|
Musthaq Ahamad
|
84d43812e2 | feat: Add file upload / download modifiers (#1670) | ||
|
haxzie
|
8f527fce00 | Move packages to ts |