## What
`triggers.create(userId/user_id, ...)` already accepts a user id and
uses it to resolve the connected account, but **dropped it** when
building the `trigger_instances.upsert` body. With [2FA for
triggers](https://linear.app/composio/issue/PLEN-2580) on the backend,
2FA-enabled projects need `user_id` on the upsert to verify the pinned
connected account belongs to the caller's user.
This forwards `user_id` to upsert in **both SDKs**:
- **TS** (`ts/packages/core/src/models/Triggers.ts`): adds `user_id` to
the upsert params via a `& { user_id?: string }` bridge.
- **Python** (`python/composio/core/models/triggers.py`): forwards
`user_id` via the client's supported `extra_body` escape hatch.
Both bridges exist only until `@composio/client` / `composio-client`
regenerate from the updated OpenAPI spec with a native `user_id` field —
drop them then.
## Safety
Backends without trigger 2FA ignore the extra field, so this is safe to
land ahead of / alongside the backend rollout (hermes PR #10635).
## Tests
- TS: upsert-body assertion added.
- Python: `tests/test_triggers.py::test_create_with_user_id` asserts
`extra_body == {"user_id": ...}`. 49 tests pass.
Closes part of PLEN-2580 (SDK follow-up to the agreed approach).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: jkomyno <alberto@composio.dev>
## Summary
Models — and some MCP transports — occasionally emit tool-call arguments
as a **JSON string instead of an object/dict**. The most visible trigger
is `COMPOSIO_MULTI_EXECUTE_TOOL` on the Vercel AI SDK, where streaming
fails with:
> `messages.3.content.1.tool_use.input: Input should be a valid
dictionary`
Until now only a handful of providers guarded against this, each with
its own slightly different inline check, leaving most providers
vulnerable and behaviour inconsistent across the SDK.
This PR centralizes the coercion into **one helper per language** and
routes **every** provider through it, in both the TypeScript and Python
SDKs.
Closes https://github.com/ComposioHQ/composio/issues/2406
## What changed
**TypeScript** — new `normalizeToolArguments` in `@composio/core`
(exported), used by every provider:
`vercel`, `cloudflare`, `openai-agents`, `openai` (ChatCompletions +
Responses), `anthropic`, `google`, `langchain`, `llamaindex`,
`claude-agent-sdk`, `mastra`.
**Python** — new `normalize_tool_arguments` in `composio.utils.shared`,
used by every provider:
`openai`, `openai-responses`, `anthropic`, `google`, `langchain`,
`langgraph`, `crewai`, `autogen`, `llamaindex`, `gemini`, `google-adk`,
`openai-agents`, `claude-agent-sdk`.
Shared semantics (identical in both languages):
| Input | Result |
| --- | --- |
| object / dict | returned unchanged |
| JSON string | parsed to object |
| empty / whitespace string | `{}` |
| `null` / `undefined` / `None` | `{}` |
| array, primitive, unparseable string, JSON that isn't an object |
**typed error** (`ComposioInvalidToolArgumentsError` / `InvalidParams`)
with the original parse error as cause |
The typed error replaces the previous grab-bag of behaviours: a raw
`SyntaxError`/`JSONDecodeError`, or — worse — silently forwarding a
malformed string downstream.
## Why this supersedes the open PRs
This consolidates and extends three open PRs that each addressed a slice
of the problem inconsistently. Their authors are credited as co-authors
on the relevant commits:
- **#3489** (LlamaIndex + Claude Agent SDK, TS) — @srijanarya
- **#3438** (Anthropic, Google, LangChain, TS) — @aptsalt
- **#3437** (Google ADK empty schemas + name fix, Python) —
@pragnyanramtha — its empty-`input_parameters` / missing-description
handling and the `gemini` → `google_adk` provider-name fix are folded in
here.
Compared to the three combined, this PR additionally: covers **every**
provider in **both** SDKs (not a subset of one), defines a single source
of truth instead of per-provider snippets, normalizes empty/`null`
payloads to `{}`, and raises an actionable typed error instead of
leaking `SyntaxError` or forwarding a bad string.
## Tests
- Exhaustive unit tests for both helpers (object passthrough,
JSON-string parse, empty/null → `{}`, malformed/non-object → typed
error).
- Per-provider regression tests across the touched TypeScript providers
(string path, malformed-string path, empty-payload path).
- Full `@composio/core` + touched-provider TS suites pass; `typecheck`
and `lint` clean. Python `ruff` clean and new test green.
## Changeset
Patch bump for all affected TypeScript packages (`@composio/core` + the
providers). Python follows its own versioning, so no changeset there.
---------
Co-authored-by: srijanarya <74669415+srijanarya@users.noreply.github.com>
Co-authored-by: Deepak Singh Kandari <deepaksinghkandari07@gmail.com>
Co-authored-by: Pragnyan Ramtha <pragnyanramtha@gmail.com>
This PR is **part 1 of 3** splitting
https://github.com/ComposioHQ/composio/pull/3505 to make the removal of
the old 2025 custom tools easier to review. It carries the **Python**
slice.
- removes the legacy `composio.tools.custom_tool` registry path:
`core.models.custom_tools`, `ExecuteRequestFn`, the old fallback
execution wiring, the security tests, and the example
- preserves the 2026 tool-router APIs: `composio.experimental.tool()`,
`composio.experimental.Toolkit`, inline custom-tool execution,
preload/attach/use flows, and `session.custom_tools()`
- bumps the Python workspace and all provider packages `0.13.1` →
`0.14.0`
## Notes
- This slice is a byte-identical subset of #3505 — the three split
branches recombine to that PR's exact tree. See #3505 for the original
local verification logs (`uv run --frozen nox -s chk`, targeted pytest);
CI re-runs per PR.
Patch release matching TS 0.9.1 — includes account_type + per-user ACL
on SHARED connections, SEC-339 deprecation header fix, nullability fix
in schema converter, and docstring cleanup.
Core was erroneously bumped to 0.14.0 in #3401 without a release; since
0.14.0 was never published to PyPI, all packages align at 0.13.1.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
`pnpm changeset version` consumed `.changeset/fluffy-kids-lose.md` (the
auto file upload/download opt-in changeset for `@composio/core`). The
mechanical run bumped every dependent provider package to **`1.0.0`**,
which would surface as a spurious major bump on packages whose public
API didn't change. This PR corrects the provider bumps to **`0.8.0`** so
the version line stays aligned with `@composio/core` across the release
train.
> **Note:** Earlier revisions of this PR targeted `0.7.0`. After release
planning, the train was bumped to `0.8.0` (see commit `efc63ca6f`) —
`0.7.0` was published briefly and has since been **deprecated on npm**
in favor of `0.8.0`.
## Changes
| Package | Before | After |
| ------- | ------ | ----- |
| `@composio/core` | 0.6.11 | **0.8.0** (minor — see PR #3260) |
| `@composio/anthropic` | 0.6.11 | **0.8.0** |
| `@composio/claude-agent-sdk` | 0.6.11 | **0.8.0** |
| `@composio/cloudflare` | 0.6.11 | **0.8.0** |
| `@composio/google` | 0.6.11 | **0.8.0** |
| `@composio/langchain` | 0.6.11 | **0.8.0** |
| `@composio/llamaindex` | 0.6.11 | **0.8.0** |
| `@composio/mastra` | 0.6.11 | **0.8.0** |
| `@composio/openai` | 0.6.11 | **0.8.0** |
| `@composio/openai-agents` | 0.6.11 | **0.8.0** |
| `@composio/vercel` | 0.6.11 | **0.8.0** |
| `@composio/cli` | 0.2.25 | 0.2.26 (unchanged from `changeset version`;
CLI keeps its own version line) |
`.changeset/fluffy-kids-lose.md` is consumed.
## What changed in each provider's CHANGELOG.md
- `## 1.0.0` → `## 0.8.0`
- `### Patch Changes` → `### Minor Changes` with a one-line entry:
`Bumped to align with @composio/core@0.8.0 for the file-upload allowlist
release train. No public-API change in this package.`
- The duplicate `- Updated dependencies` line was deduped to a single `-
Updated dependencies [ebc9778]\n - @composio/core@0.8.0`.
## What changed in `@composio/core`'s CHANGELOG.md
- Removed the stray `- [BREAKING] Disable auto file upload / download`
bullet (an artifact of an earlier changeset that doesn't apply on
`next`); the long-form entry from `fluffy-kids-lose.md` already covers
the breaking nature in detail.
- The closing paragraph now says providers are bumped to `0.8.0`
alongside core (matching reality) instead of "automatic patch bumps via
`updateInternalDependencies: \"patch\"`".
## Notes
- `pnpm-lock.yaml` doesn't need updating — internal deps use
`workspace:*`.
- `pnpm typecheck` on `@composio/core` is clean (now reports
`@composio/core@0.8.0`).
- `pnpm build:packages` failed locally on a tsdown config-loader bug
under Node 24; the repo is pinned to Node 20.19.0 in `.nvmrc`, and the
build works fine there. Verified by stashing this PR's diff and
reproducing the same failure on clean `next` — pre-existing
local-environment issue, unrelated to the version bumps.
## Published & deprecated
Published to npm:
-
`@composio/{core,anthropic,claude-agent-sdk,cloudflare,google,langchain,llamaindex,mastra,openai,openai-agents,vercel}@0.8.0`
Deprecated on npm (all `@0.7.0`) with the message: *"0.7.0 has been
superseded by 0.8.0. Please upgrade: npm install <package>@0.8.0"*.
## Test plan
- [x] CI passes (build, typecheck, tests on Node 20.19.0).
- [x] After merge, `changesets-release/next` PR is generated cleanly
with no leftover changesets.
- [x] Verify the release publishes `@composio/*@0.8.0` (not `1.0.0`).
- [x] `@composio/*@0.7.0` deprecated on npm, redirecting users to
`0.8.0`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
## Summary
Security-hardening for automatic file upload in `@composio/core` (patch
release per changeset).
### Changes
- **Default denylist** for local paths before auto-upload /
`files.upload`: blocks common credential directories (e.g. `.ssh`,
`.aws`) and credential-like filenames (e.g. `.env`, default SSH private
keys). Resolves symlinks when the path exists.
- **Config:** `sensitiveFileUploadProtection`,
`fileUploadPathDenySegments` on `Composio`.
- **`beforeFileUpload`** hook (e.g. with `composio.tools.get` /
`tools.execute`): rewrite path, return `false` to abort, or throw.
- **Errors:** `ComposioSensitiveFilePathBlockedError`,
`ComposioFileUploadAbortedError`; file modifier errors exported from
`@composio/core` errors entry.
- **Changeset:** patch bump for `@composio/core`.
### Notes
- URLs and `File` blobs are not subject to the path denylist
(unchanged).
- Opt out of path checks only if required:
`sensitiveFileUploadProtection: false`.
### Tests
- `pnpm test` in `ts/packages/core` (799 tests) passed locally before
commit.
Made with [Cursor](https://cursor.com)
The `_python_reserved` set was hardcoded to only `{"for", "async"}`,
missing `"from"` and all other Python keywords. Tools from toolkits like
Intercom that have a `from` parameter caused `ValueError: 'from' is not
a valid parameter name` when building function signatures.
Extracted keyword substitution logic into shared utilities
(`substitute_reserved_python_keywords` / `reinstate_reserved_python_keywords`)
using `keyword.iskeyword()` from stdlib for complete coverage, and applied
it to all affected providers: langchain, gemini, langgraph, autogen, llamaindex.
Closes PLEN-1671
The actual parameter was already renamed to user_id but docstrings
still referenced entity_id, causing confusion.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Anshu Garg