`PackageInstall` disappeared from agent-readable Markdown, removing
required package commands from the quickstart, provider guides, and
search records. Preserve Node and Python install commands,
package-choice comments, coding-agent setup prompts and client links,
and video captions. Share the UI's package-manager definitions and setup
content with the converter.
Addresses [DEVREL-35](https://linear.app/composio/issue/DEVREL-35). The
component audit records existing coverage and remaining visual/catalog
parity work for DEVREL-32 and DEVREL-38.
Validation from `docs/`:
- Static suite: 553 passed.
- Typecheck, lint, and production build passed. Lint retains existing
warnings.
- Built-server HTTP regression: quickstart, Anthropic provider, client
setup, and `/llms-full.txt` retain the expected commands and prompts.
- Corpus regression covers every authored PackageInstall instance in
page text and search records, plus raw and processed attribute forms.
The semantic artifact content hash is stale because indexed text
changes. CI fails at that check. The automatic rebuild skipped its
membership gate on both the initial run and one retry, even though the
current PR API reports MEMBER. A maintainer needs to run the authorized
artifact rebuild before merge. No OPENAI_API_KEY is available locally;
no embeddings were edited by hand and no search index was published
locally.
## Summary
The docs homepage used the article OG template with “Welcome” as its
headline. Its page-level metadata also dropped the site name. Add a
dedicated homepage card with “Build and operate AI agents,” SDK/CLI/MCP
entry points, and a “Start building” prompt.
## Changes
- Route the docs homepage and default social image to the new 1200×630
card. Preserve article cards.
- Use a descriptive homepage title and shorter description, and set
explicit Open Graph and Twitter metadata.
- Cover homepage image routing and rendered metadata after the root
redirect with regression tests.
## Type of change
- [x] Bug fix
- [x] Documentation
## How Has This Been Tested?
Commands run from `docs/`:
- `bun test tests/static/og-image.test.ts`: 2 passed, including article
and homepage PNG rendering.
- `TEST_BASE_URL=http://localhost:3123 bun test
tests/integration/rendering.test.ts --test-name-pattern 'docs homepage
social metadata' --timeout 60000`: passed against the local dev server.
- `bun run types:check`: passed.
- `bun run lint`: passed with warnings in unrelated files.
- Rendered and visually inspected the homepage PNG at 1200×630.
- `git diff --check`: passed.
Image tests were rerun after updating to current `next`. Remote CI and
production deployment are pending.
## Checklist
- [x] Ran local checks as described above
- [x] Updated homepage metadata
- [x] Added regression tests
- [x] No changeset required: docs-only change
Replace the exhaustive `/llms.txt` dump with a short routing map for
product selection, installation, authentication, sessions, execution,
and troubleshooting. Keep the full catalog at `/llms-index.txt`, using
named links and descriptions, and put that catalog and other long-tail
resources under Optional. Current REST v3.1 and legacy v3.0 remain
explicitly separated.
Fixes [DEVREL-34](https://linear.app/composio/issue/DEVREL-34). The
format follows the descriptive-link and Optional conventions in the
[llms.txt proposal](https://llmstxt.org/).
Validation: 551 static tests passed, including bounded routing-map
coverage and route resolution. Typecheck, lint, and link validation
passed. Existing exhaustive-catalog coverage now tests
`/llms-index.txt`; the HTTP version-grouping test follows the new
catalog route. Existing lint warnings remain.
Agents reading individual pages or `/llms-full.txt` could miss the
Markdown changelog. Its dated `.md` links also matched a broad legacy
redirect and landed on HTML instead of release-note Markdown.
Link page Markdown and the full corpus to `/docs/changelog.md`, and
route dated `.md` and `.mdx` requests to the existing Markdown renderer
before the legacy HTML redirects. Add an HTTP regression that follows
quickstart → changelog → dated release and checks both extensions.
Fixes [DEVREL-31](https://linear.app/composio/issue/DEVREL-31).
Validation: typecheck, link validation, and all 551 static tests passed
for discovery. The new HTTP test reproduced the redirect defect locally
and in CI. The corrected combined production build passed. Its full HTTP
suite passed 92 tests with one existing API-key-dependent skip,
including dated .md and .mdx release-note checks. No new feed format or
dependency is added.
The live docs advertise `https://og.composio.dev/api/og?title=Welcome`,
which returns HTTP 404 and breaks link previews. Serve 1200×630 PNG
previews from `/api/og` on the docs host and point the shared page
metadata and root metadata at that route. Titles are bounded to keep the
image readable and rendering work limited.
Fixes [DEVREL-41](https://linear.app/composio/issue/DEVREL-41).
Validation: reproduced the live 404, rendered and visually inspected the
replacement image, tested PNG signatures and dimensions for default,
normal, special-character, and long titles, and passed typecheck, lint,
and all 551 static tests. Existing lint warnings remain. No remote image
service or new dependency is required.
Give contributors one path from a docs problem to a reviewed, published
fix. The guide explains when to use a Docs issue or a PR, where source
files live, how to validate HTML and Markdown, and what to verify after
deployment. Link it from the docs README and replace the stale CLAUDE.md
pointer with the current Twoslash guide.
Addresses [DEVREL-28](https://linear.app/composio/issue/DEVREL-28).
Validation: all relative links resolve, all documented `bun run`
commands exist in `docs/package.json`, and `git diff --check` passes.
Guidance-only change; no runtime tests needed. Reviewer selection
follows existing repository requirements without assigning new owners or
approval rules.
Deprecated API fields clutter the interactive playground at the top of
reference pages. Hide those inputs while retaining their descriptions,
deprecation badges, defaults, and response examples in the reference
below.
Filter a cloned schema only inside the playground renderer. Keep the
shared OpenAPI loader unchanged and preserve synchronization between
playground edits, example selection, server selection, and generated
request code. Published OpenAPI files remain unchanged.
Validation: all 547 docs static tests pass, `bun run types:check`
passes, and `bun run lint` passes with existing warnings. Browser checks
on Create auth config confirm both auth variants omit deprecated inputs,
the JSON editor omits deprecated values, reference descriptions and
badges remain, and edits update the cURL example.
Fixes DEVREL-51.
Review follow-ups on the help consistency work:
- route composio help <unknown> through the framework parser so unknown
targets fail like every other unknown command (stderr, did-you-mean,
exit 1) instead of an exit-0 'Unknown command' line on stdout
- resolve help-spelling targets with the same longest-prefix scan
--help uses, so composio help dev toolkits renders the curated dev
page rather than an unknown-command line
- add curated SUBCOMMAND_HELP entries for agent signup/login/whoami/
inbox/claim, mirroring the orgs list/switch pattern
- make the two rendering tests actually execute (layer(TestLive()) +
it.effect); they previously returned a bare Effect from a plain it
and passed vacuously
- add routing tests for every composio help path: bare, family, child,
level suffixes, trailing --help, deep-path fallback, unknown target
- drop tools from the newly-curated changelog list; its entry already
existed at the PR base
## Summary
The “Copy page” button covers long page titles on mobile, including
“Stream logs to a SIEM”. Keep the button in its own row below the title
on narrow screens.
## Changes
- Apply the negative top margin only at the `md` breakpoint and above,
preserving the existing desktop layout.
- Update the shared component comments to describe its responsive
behavior.
## Type of change
- [x] Bug fix
## How Has This Been Tested?
- Focused Oxlint check passed for `docs/components/page-actions.tsx`,
using dependencies from the main checkout.
- `git diff --check` passed.
- Browser verification and the full docs build were not run. No
automated test added for this CSS breakpoint change.
## Additional context
Docs-only change; no changeset required.
This PR:
- builds on top of https://github.com/ComposioHQ/composio/pull/3901
- adds a second Deno e2e suite, `@e2e-tests/deno-tool-execution`, that
drives the runtime instead of the import surface: session creation over
`fetch`, custom-tool registration, Zod validation/defaults/failures, and
in-process local tool execution
- mirrors the node `custom-tools` suite trimmed to its local-execution
half; remote coverage (tool chaining, weathermap) stays node-only
- imports the workspace's built dist via a relative path: a version-less
`npm:@composio/core` resolves from the registry (published pre-migration
0.18.1), ignoring the pnpm workspace symlink, so the direct path is what
makes the suite test the Effect v4 build CI bakes into the image
- keeps the only backend call to `composio.create()`; requires
`COMPOSIO_API_KEY` (CI provides it, the runner passes it into the
container)
## Context
The existing `deno/esm-basic` suite stops at the import/export surface
and, despite its `deno.jsonc` comment, resolves `npm:@composio/core`
from the registry rather than the workspace — so nothing under Deno
exercised the Effect v4 runtime. This suite closes that gap. A side
observation for a follow-up: `esm-basic` has the same
registry-resolution drift and tests the published package, contrary to
its README.
Validation:
- full local Deno matrix passes against the staging backend: 22 tests /
2 suites (11 + 11), fixture markers `SESSION_CREATE_OK` through `ALL_OK`
all observed
- `pnpm --filter @e2e-tests/deno-tool-execution typecheck` and prettier
clean
- `pnpm-lock.yaml` updated for the new workspace importer
Merge after #3901.
## Summary
Add an agent-first setup path that helps developers install the Composio
Agent Skill and use their coding agent to integrate Composio.
Fixes
https://linear.app/composio/issue/DEVREL-42/add-agent-first-setup-flow-to-composio-docs
<img width="1120" height="560" alt="CleanShot 2026-09-04 at 15 09 27"
src="https://github.com/user-attachments/assets/bdab541a-335a-4a41-86e6-ee581aac0725"
/>
<img width="926" height="747" alt="CleanShot 2026-09-04 at 15 09 50"
src="https://github.com/user-attachments/assets/c7f24efc-04c4-4585-886f-18ee0920c424"
/>
<img width="968" height="651" alt="CleanShot 2026-09-04 at 15 10 02"
src="https://github.com/user-attachments/assets/b9220ade-1c87-47df-ae68-14ecc08acb59"
/>
## Changes
- Add an Agent setup section with an overview and client-specific
installation instructions.
- Cover Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI,
OpenClaw, OpenCode, Cline, and Grok Build.
- Add reusable actions for opening the setup guide and copying a setup
prompt.
- Add a suggested first prompt for testing the installed skill.
- Surface agent setup from the docs homepage and SDK quickstart.
- Simplify the homepage product cards and tighten spacing across the
landing page.
- Exclude external sidebar links from the generated `llms.txt`
documentation URL list.
- Add static coverage for navigation, client instructions, setup
prompts, and external links.
## Type of change
- [ ] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [x] Documentation
- [ ] Breaking change
## How Has This Been Tested?
- `bun test tests/static/home-navigation.test.ts
tests/static/navigation.test.ts tests/static/product-navigation.test.ts
tests/static/start-routing.test.ts`
- `bun run lint`
- `git diff --check`
All focused tests pass. Lint completes with existing repository warnings
and no errors.
## Screenshots (if applicable)
## Checklist
- [ ] I have read the Code of Conduct and this PR adheres to it
- [ ] I ran linters/tests locally and they passed
- [ ] I updated documentation as needed
- [ ] I added tests or explain why not applicable
- [ ] I added a changeset if this change affects published packages
## Additional context
Audit finding: the curated `--help` pages (USAGE/DESCRIPTION/SEE ALSO
via root-help.ts's SUBCOMMAND_HELP registry) silently missed whole
command families. `composio orgs --help`, `signup --help`, and the
group pages for `connections`, `triggers`, `tools`, `artifacts`,
`install`, and `agent` fell through to the framework's raw parser
rendering — unstyled headers, a different section layout, and the
root-level `--log-level` flag exposed on subcommand pages.
- Add the missing SUBCOMMAND_HELP entries; orgs pages also gain
options/examples matching their actual flags.
- Add `composio help [command] [level]`: the framework has no builtin
help command, so `composio help orgs` now routes to the same curated
page as `composio orgs --help` (bare `composio help` keeps printing
the root help).
- Fix the stale orgs description in the contextual-error help registry
(said 'Manage current organization context'; the command manages the
default global org/project context).
- Lock the class shut: a consistency test walks every visible root
command and fails when any lacks a curated help entry. It caught
signup and agent during development.
Validation: typecheck + full suite (1330 passed, incl. 6 new tests),
oxlint/prettier clean, binary rebuilt and smoke-tested — orgs/signup/
connections/triggers/tools/artifacts/install help pages, help command
paths, and whoami against staging all behave.
Rebuilds the Effect v4 port on top of `next` at `effect@4.0.0-rc.112`
(the newest release that clears the repository's 3-day
`minimumReleaseAge` gate). The three v3-compatible preparation PRs
(#4358, #4359, #4360) already landed on `next`, so this PR is now only
the cutover.
## What changes
- Pins `effect`, `@effect/platform-bun`, and `@effect/vitest` to exact
`4.0.0-rc.112`; drops `@effect/cli`, `@effect/platform`,
`@effect/platform-node`, and the `toml` override that existed only for
`@effect/cli`. The `ts/vendor/effect` source oracle moves to the
`effect@4.0.0-rc.112` release commit.
- Services become `Context.Service` classes with explicit `Default`
layers; `Either` becomes `Result`; `ParseResult` becomes
`Schema.SchemaError`; platform modules come from `effect/FileSystem`,
`effect/Path`, `effect/PlatformError`, `effect/unstable/process`, and
`effect/unstable/http`.
- The runner drives `Command.runWith` with v4's default help and error
rendering. `CliError.ShowHelp` carries its own exit code, help for
non-explicit invocations renders on stderr, and "Did you mean?"
suggestions render. `command-introspection.ts` is gone: v4 renders the
resolved command's help and the "missing value" tip itself.
- `composio --version`, `composio -v`, and `composio version` print the
same bare semver (`GlobalFlag.Version` is not enabled; the flag
spellings are rewritten to the `version` command before parsing).
- Root `--log-level` is a shared flag applied after the subcommand tree
is attached, so `composio --log-level Debug <subcommand>` both parses
and takes effect.
- Every `Flag.boolean` carries an explicit default, because rc.112 makes
boolean flags required when omitted.
- A `Result` is not an `Effect` at runtime in rc.112 even though the
type checker accepts `yield*` on it (the fiber dies with "Not a valid
effect"); every `Result` is lifted with `Effect.fromResult`, and the
skill/AGENTS guidance says so.
- Every `ChildProcess.make` site passes `extendEnv: true`, because
rc.112 no longer inherits the parent environment by default.
- `--log-level` and `COMPOSIO_LOG_LEVEL` are exact-match on the
`LogLevel` names (`All`, `Fatal`, `Error`, `Warn`, `Info`, `Debug`,
`Trace`, `None`) with no case folding, per the earlier review decision;
README updated.
- Spawned children pass `extendEnv: true`, because rc.112's
`ChildProcess` no longer inherits the parent environment by default.
- ISO timestamps decode through `Schema.DateTimeUtcFromString`;
`Schema.DateTimeUtc` is no longer a string codec in rc.112.
- `ConfigProvider.fromEnv()` snapshots the environment at construction
in v4, so providers that must observe later changes are built per read
(`plugin-hint.ts`, `install.cmd.ts`, `config.ts`) and tests use a
live-env provider helper.
- `cli-keyring` and `json-schema-to-effect-schema` are ported alongside
(the latter on `Schema.makeFilter`).
- The `effect-v4` skill, the `cli-command` and `typescript-testing`
references, `ts/packages/cli/AGENTS.md`, and the oxlint config are
updated to the rc.112 reality. The skill's example checker
(`.agents/skills/effect-v4/scripts/check-examples.mjs`, lifted from
#3851) compiles every TypeScript block in the skill against the pinned
packages.
- The `js-yaml` overrides move to the 4.3.2 / 3.15.2 lines that
GHSA-2883-xcg3-v3hh requires; `pnpm audit --prod` is clean apart from
the already-ignored `extract-zip` advisory.
## Behaviour notes
- `composio <unknown> --help` now prints the root help with exit 0 (v4's
global `--help` handling); `composio <unknown>` without `--help` still
fails with the unknown-subcommand error.
## Validation
- `pnpm --filter @composio/cli typecheck` (src + test): 0 errors
- `pnpm --filter @composio/cli test`: 127 files, 1325 tests pass, 1
skipped; `validate:boundaries` and `validate:skills` pass
- `@composio/cli-keyring` and `@composio/json-schema-to-effect-schema`
typecheck, test, and build pass
- `pnpm validate:agent-skills` and `pnpm validate:skill-routing` pass
(19 skills)
- oxlint clean on `ts/packages/cli`, `cli-keyring`,
`json-schema-to-effect-schema`
- CLI bundle and standalone binary build; smoke-checked `version`,
`--version`, `-v`, `--help`, unknown subcommand, unrecognized flag,
missing flag value
- Docker CLI e2e suites pass against an image built from this branch:
`version`, `toolkits-list`, `toolkits-info`, `toolkits-search`,
`setup-plugins`, `run`. `whoami` (needs an API key), `install` (needs a
release dir), and `upgrade` (needs network) were not run.
No changeset: `@composio/cli` is Changesets-ignored and the ported
sibling packages are private. Human-facing notes are in
`ts/packages/cli/CHANGELOG.md`.
https://claude.ai/code/session_01AW7ZPhfZuni6PrCJ9X86DX
## Summary
`ts/packages/core/scripts/generate-docs.ts` joined `npx typedoc` and
every discovered `src/models/*.ts` file name into one string and ran it
with `execSync`, so a model file whose name contains shell
metacharacters would execute as a command. The script runs in CI on
every push to `next` with a write-scoped app token
(`generate-sdk-docs.yml`). Reported by AppSecure as SEC-899 (command
injection via documentation generation).
Fixes SEC-899 (internal tracker).
## Changes
- Build the typedoc argument vector as an array (`buildTypeDocArgs`) and
run it with `execFileSync`, so no shell is involved.
- Skip model files whose names fall outside `[A-Za-z0-9_.-]` (with a
warning) in `discoverModelFiles`.
- Regression tests in `test/scripts/generate-docs.test.ts`:
metacharacter names are dropped, entry points stay separate arguments.
## Type of change
- [x] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [ ] Documentation
- [ ] Breaking change
## How Has This Been Tested?
```
pnpm --filter @composio/core exec vitest run test/scripts/generate-docs.test.ts
Test Files 1 passed (1)
Tests 12 passed (12)
pnpm exec prettier --check ts/packages/core/scripts/generate-docs.ts ts/packages/core/test/scripts/generate-docs.test.ts
All matched files use Prettier code style!
```
Node 24.17.0 and pnpm 11.8.0 via mise.
## Screenshots (if applicable)
## Checklist
- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [x] I updated documentation as needed
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages (not
needed: `scripts/` is a build-time script, not part of the published
package)
## Additional context
The generated docs output is unchanged; only how typedoc is invoked
changes.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: jkomyno <alberto@composio.dev>
## Summary
Automated sync of backend data into the docs site.
- Trigger: `schedule`
- Dispatch action: `n/a`
- Source commit: `n/a`
## What changed
- **Toolkit catalog** (`docs/public/data/toolkits.json`,
`toolkits-list.json`) — refreshed list of available toolkits, auth
schemes, and tools from the backend API
- **OpenAPI specs** (`docs/public/openapi.json`,
`docs/public/openapi-v3.json`, `docs/public/openapi-webhooks.json`) —
latest v3.1 and v3.0 API specifications plus the webhook-events spec,
fetched from production
- **API reference pages** (`docs/content/reference/api-reference/`,
`docs/content/reference/v3/api-reference/`) — regenerated index pages
for both API versions
- **Meta tools reference** (`docs/public/data/meta-tools.json`,
`docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas
and reference docs
Co-authored-by: Sushmithamallesh <19796925+Sushmithamallesh@users.noreply.github.com>
## Summary
AppSecure SEC-908 reported that remote files fetched from user-supplied
URLs were read into memory with no size cap. The core SDK
(`fileUtils.node.ts`, `RemoteFile.ts`, `ToolRouterSessionFileMount.ts`)
and the Python SDK already stream through a 100 MiB limit. The CLI's
tool-input upload path
(`ts/packages/cli/src/services/tool-file-uploads.ts`) was the last
remaining sink: `readFileFromUrl` still did `response.arrayBuffer()`, so
a large or never-ending response could exhaust memory before the
presigned upload was even requested.
Fixes SEC-908 (internal tracker).
## Changes
- `@composio/core` exports `readResponseBodyWithLimit` and
`MAX_URL_UPLOAD_SIZE_BYTES`, next to the existing
`assertSafeFileUploadPath` export, so downstream packages reuse the one
bounded reader.
- CLI `readFileFromUrl` uses it in place of `response.arrayBuffer()`;
behaviour is unchanged below the cap.
- Regression test: a response declaring a body above the cap is rejected
before `createPresignedURL` is called.
- Changeset for `@composio/core` (patch). `@composio/cli` is in the
changeset ignore list.
## Type of change
- [x] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [ ] Documentation
- [ ] Breaking change
## How Has This Been Tested?
```
pnpm --filter @composio/core build
pnpm --filter @composio/core exec vitest run test/utils/readResponseBody.test.ts
Tests 4 passed (4)
pnpm --filter @composio/cli exec vitest run test/src/services/tool-file-uploads.test.ts
Tests 8 passed (8)
pnpm exec prettier --check <touched files>
pnpm exec oxlint <touched files>
```
`tsc --noEmit` on the CLI package reports the same pre-existing errors
on `next` and none in the touched files. Node 24.17.0, pnpm 11.8.0 via
mise.
## Screenshots (if applicable)
## Checklist
- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [x] I updated documentation as needed
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages
## Additional context
The other files AppSecure listed for this finding were already capped on
`next` (core: ecd0861, 8a56383; python: 54d07dc); this PR closes the
residual.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
## Summary
Add a Production readiness section with a new SIEM log collection guide.
Move Managed vs custom auth, Rate limits, and Data retention into that
navigation section while preserving their existing URLs.
Closes
https://linear.app/composio/issue/DEVREL-130/add-siem-log-streaming-documentation-to-poc-to-prod
## Changes
- Document scheduled log collection, pagination within fixed time
windows, checkpoints, retries, deduplication, and sensitive-data
handling.
- Include a cURL fetch example, a Datadog forwarding example, and Splunk
HEC guidance.
- Group the production guides in the Platform sidebar and remove their
former sidebar entries. Rate limits links to its existing reference
page; the versioned v3 reference remains unchanged.
- Regenerate the semantic-search index for the new guide and verify it
remains current after the navigation changes.
## Type of change
- [x] Documentation
## How Has This Been Tested?
From `docs/`:
- `bun run test`: 542 passed.
- `bun run build`, `bun run types:check`, `bun run lint:links`, and `bun
run check:kb-semantic`: passed.
- Navigation checks verify the new grouping, absence of duplicate
entries, preserved Rate limits URL, and product switching from Data
retention.
- The initial SIEM guide passed `bun run build` and 90 integration
tests, with one credential-dependent test skipped. Its Bash examples and
JSON transformation were checked with synthetic data; no live SIEM
delivery test was performed.
## Checklist
- [x] Updated documentation and navigation.
- [x] Updated navigation regression checks.
- [x] Verified the semantic-search index.
- [x] No changeset needed for this docs-only change.
## Summary
The session configuration guide doesn't explain how to enable fast mode.
This adds a focused experimental section so developers can opt in with
`experimental.fast_mode: true` and understand the retrieval-quality
tradeoff.
## Changes
- Show cURL requests to create a fast-mode session and enable or disable
it on an existing session.
- Mark fast mode experimental and note that tool search quality may be
affected.
- Document the API workaround because the current high-level TypeScript
and Python session helpers don't forward this field.
- Regenerate the semantic search index for the two new documentation
sections.
## Validation
- Checked both request bodies against the checked-in v3 OpenAPI schema
and the SDK serialization paths.
- Docs static tests: 542 passed; internal link validation and semantic
index freshness checks passed.
- Docs lint and production build (including Twoslash validation) passed.
Optional authenticated toolkit fetches were skipped because no API key
was set.
Documentation only; no SDK changes or changeset required.
`transformToolkitRetrieveResponse` handed the two auth field groups straight
through from the raw client response. Every other key on those fields already
happens to be camelCase on the wire, but `is_secret` and `legacy_template_name`
do not, so they never matched `ToolkitAuthFieldSchema` and zod dropped them
while validating the transformed object. `auth_hint_url` was never mapped at
all.
`is_secret` is the one signal a client has for deciding whether to mask an input
when it renders its own credential form, which is what
`toolkits.getConnectedAccountInitiationFields()` exists to drive. Losing it
means the caller cannot tell an API key apart from a shop subdomain. The Python
helpers return the generated client models untouched, so they never lost these
keys.
Map the auth fields explicitly instead of passing them through, and add
`isSecret`, `legacyTemplateName` and `authHintUrl` to the schemas. Optional keys
are spread conditionally so that an absent key stays absent: assigning it
unconditionally would create an own property holding `undefined` and silently
beat a caller's fallback in `{ default: 'fallback', ...field }`.
A type-level test fails the build when the generated client grows a key in any
of the four field groups that the mapping does not list. The client declares
each group as its own interface, so both the raw field type and the test
distribute over all four; deriving from one interface alone would miss a key
added to any of the other three.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Summary
Automated sync of backend data into the docs site.
- Trigger: `schedule`
- Dispatch action: `n/a`
- Source commit: `n/a`
## What changed
- **Toolkit catalog** (`docs/public/data/toolkits.json`,
`toolkits-list.json`) — refreshed list of available toolkits, auth
schemes, and tools from the backend API
- **OpenAPI specs** (`docs/public/openapi.json`,
`docs/public/openapi-v3.json`, `docs/public/openapi-webhooks.json`) —
latest v3.1 and v3.0 API specifications plus the webhook-events spec,
fetched from production
- **API reference pages** (`docs/content/reference/api-reference/`,
`docs/content/reference/v3/api-reference/`) — regenerated index pages
for both API versions
- **Meta tools reference** (`docs/public/data/meta-tools.json`,
`docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas
and reference docs
Co-authored-by: Sushmithamallesh <19796925+Sushmithamallesh@users.noreply.github.com>
Co-authored-by: Sushmitha Mallesh <sushdec6@gmail.com>
This PR:
- wraps `pysher.Pusher` in `_ComposioPusher`, whose channel-auth POST
carries a `(5, 15)` connect/read timeout and raises
`TriggerSubscriptionAuthError` (a `TriggerSubscriptionError`) on a
transport failure, a non-200, or a response without an `auth` token —
pysher 1.0.8 sent it with no timeout and turned a non-200 into a bare
`AssertionError` on the websocket thread, on every (re)subscribe
- keeps that POST a plain `requests.post(..., timeout=...)` rather than
routing it through `safe_request`: the endpoint is built from the
configured Composio API base URL, a fixed trusted host, not a value from
a response, and the SSRF guard would refuse a local dev base URL
- validates `pusher_cluster` against `^[a-z0-9-]+$` (non-empty, at most
64 chars) before pysher formats it into `ws-{cluster}.pusher.com`,
raising `InvalidPusherClusterError` that names the shape violation
without echoing the value
- replaces the `unittest.mock.MagicMock` stand-in for pysher's
connection logger with a dedicated `logging.Logger` (`NullHandler`,
`propagate=False`, disabled), so `unittest` leaves the runtime import
graph while raw frames stay out of user logs; a test asserts the module
source no longer mentions `unittest`
- strips `Authorization`, `Proxy-Authorization`, and `Cookie` from the
next hop when `ssrfSafeFetch` or `safe_request` follows a redirect to a
different origin; same-origin hops keep them. Manual redirect following
bypasses both `fetch`'s cross-origin rule and `requests`'
`rebuild_auth`, so neither guard applied it before — the gap #4387 left
out
- `@composio/slim` has no mirrored source (its build copies
`core/dist`), so the changeset covers `@composio/core` and
`@composio/slim` as patches
Verified with `pytest tests/test_triggers.py tests/test_url_safety.py
tests/test_path_join_guardrail.py` (192 passed), `ruff check` / `ruff
format --check` on the changed files, `mypy --config-file
config/mypy.ini` on the three changed modules with the noxfile's stub
pins (no issues), `vitest run test/utils/ssrfGuard.test.ts` in
`@composio/core` (42 passed), `pnpm typecheck` at the root (14 tasks
successful), and `oxlint` + `prettier --check` on the changed TypeScript
files.
https://claude.ai/code/session_016ZuBv7JhVdSYTLYcTy2VJr
This PR:
- Adds `src/utils/compile-pattern.ts` in `@composio/json-schema-to-zod`,
a shared helper that compiles `pattern` and `patternProperties` keys
through `new RegExp` inside a try/catch and rethrows a typed
`InvalidPatternError` (exported) that names the keyword, the pattern,
and the property path (e.g. `at properties.name`), mirroring the eager
`assertRegexCompiles` guard in `@composio/json-schema-to-effect-schema`.
- Adds a 1024-character cap on pattern length, reported through the same
error with `reason: 'too-long'`.
- Chooses fail-at-conversion over degrade-with-warning: the package has
no warning hook or lenient `refs` mode, its sibling packages and `oneOf`
handling already throw on schema defects, and a silently dropped
`pattern` would widen what a tool accepts without anyone noticing.
- Threads `refs.path` into `parseString` and `parseTypelessConstraints`
so the error carries the property path, and appends
`patternProperties.<key>` for dynamic-key objects.
- Makes `@composio/core`'s `jsonSchemaToZodSchema` include the cause
message in `JsonSchemaToZodError`, so the wrapped error names the
malformed property without unwrapping `cause`.
- Leaves out a nested-quantifier (star-height) ReDoS heuristic on
purpose: it flags linear patterns such as `^(\d+\.)*\d+$`, a wrong
rejection makes `tools.get` fail for the whole tool, and it cannot be
validated against the live toolkit catalog without false-positive risk.
Catastrophic backtracking from a hostile `pattern` remains a known
limitation; only zero-false-positive guards ship here.
- Adds `test/compile-pattern.test.ts` (`(` -> `InvalidPatternError` with
`SyntaxError` cause, length cap, typeless and `patternProperties` paths,
`^(\d+\.)*\d+$` still compiles and enforces, valid patterns still
enforced) and a core test for the wrapped message; adds a patch
changeset for both packages.
- Verification: `pnpm test` + `pnpm typecheck` in
`ts/packages/json-schema-to-zod` (4 files, 255 tests), `pnpm test` in
`ts/packages/core` (54 files, 1281 passed, 2 expected fail), root `pnpm
typecheck` (14/14), `lint:packages` and Prettier clean.
https://claude.ai/code/session_016ZuBv7JhVdSYTLYcTy2VJr
This PR:
- raises the `composio` package floors to `requests>=2.32.4` and
`urllib3>=2.7.0` in `python/pyproject.toml`, `python/setup.py`, and
`uv.lock`
- closes GHSA-9hjg-9r4m-mvj7 (`requests` `.netrc` credential leak via
malicious URLs) for downstream installs; `url_safety` fetches user- and
server-supplied URLs through a `trust_env` session
- closes GHSA-mf9v-mfxr-j63j (decompression-bomb guard bypass in the
`urllib3` streaming API that `_fetch_file_from_url` relies on for its
size limit) and GHSA-qccp-gfcp-xxvc (sensitive headers forwarded across
origins)
- the workspace lock already resolves 2.34.2 / 2.7.0, so only the
`requires-dist` specifiers change; `uv lock --check` passes and `import
composio` still works
- documents the advisory IDs next to each floor so the next bump has
context
## Summary
Auto-generated Python SDK reference docs from `python/composio/`.
Regenerates pages at `docs/content/reference/sdk-reference/python/` to
reflect changes in the Python package's public API (new methods, updated
signatures, changed types).
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
This PR:
- adds `py.audit.yml`, the Python counterpart of `ts.audit.yml`; there
was no dependency audit for the Python SDK until now
- exports each tracked `uv.lock` (the root workspace plus the standalone
`openai` and `claude_agent_sdk` provider projects) to pinned runtime
requirements with `uv export --frozen --no-dev`, then scans them with a
pinned `pip-audit --strict`
- runs on lockfile and manifest changes and on a weekly schedule, so
advisories that land without a commit still surface
- ignores the four chromadb advisories with a comment: chromadb has no
patched release, crewai pins `chromadb~=1.1.0`, and all four affect the
Chroma server that `composio-crewai` never starts
- with those ignores the gate is green on `next` today, which I verified
locally by running the exact workflow commands
## Summary
Automated sync of backend data into the docs site.
- Trigger: `schedule`
- Dispatch action: `n/a`
- Source commit: `n/a`
## What changed
- **Toolkit catalog** (`docs/public/data/toolkits.json`,
`toolkits-list.json`) — refreshed list of available toolkits, auth
schemes, and tools from the backend API
- **OpenAPI specs** (`docs/public/openapi.json`,
`docs/public/openapi-v3.json`, `docs/public/openapi-webhooks.json`) —
latest v3.1 and v3.0 API specifications plus the webhook-events spec,
fetched from production
- **API reference pages** (`docs/content/reference/api-reference/`,
`docs/content/reference/v3/api-reference/`) — regenerated index pages
for both API versions
- **Meta tools reference** (`docs/public/data/meta-tools.json`,
`docs/content/toolkits/meta-tools/*.mdx`) — updated meta tool schemas
and reference docs
Co-authored-by: Sushmithamallesh <19796925+Sushmithamallesh@users.noreply.github.com>
Brendan O'Leary