mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
py@0.18.2
22 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Alberto Schiabel
|
6e0a9db3c7 |
feat(docs): make coding agents reach for REST API v3.1 (#4079)
This PR: - fixes [UXE-233](https://linear.app/composio/issue/UXE-233/docs-should-explicitly-direct-agents-to-use-v31-apis) - makes the agent-facing Markdown channels publish concrete REST v3.1 base URLs and endpoint tables while preserving the supported v3.0 reference tree - centralizes `REST_VERSION_GUIDANCE`, `TOOL_VERSION_GUIDANCE`, and raw-spec path matching in `lib/api-version-guidance.ts` - renders `ApiBaseUrl` and `ApiEndpointsTable` in authored MDX and adds an explicit version pointer to generated OpenAPI operation Markdown - separates current and legacy REST references in `llms.txt`, excludes v3.0 page bodies from `llms-full.txt`, and adds v3.1 selection guidance to Context7 - validates serialized `ApiEndpointsTable` payloads with Zod before generation while preserving forward-compatible fields - addresses review feedback for the renamed authentication page, SDK-reference pointer scope, generator validation behavior, and stale OpenAPI tool-version descriptions ## Context REST v3.0 is superseded but remains supported for existing integrations. This PR changes what new agent-generated code discovers first; it does not require existing v3.0 callers to migrate. Authenticated read-only probes against the deployed API confirmed that the affected v3 endpoints default to `00000000_00`, while their v3.1 counterparts default to `latest`. `POST /tools/scopes/required` is available only on v3.1 and defaults to `latest`. This PR does not move public URLs. A future `/reference/v3/` to `/reference/v3.0/` migration remains separate because it has independent compatibility and search-indexing risk. ## Verification - `bun test tests/static/` - `bun run build` - `bun run test:integration` - `bun run types:check` - `bun run lint` ## Review follow-up The version-default guidance is intentionally limited to the five verified tool endpoints. v3.1 is a structural superset of v3, so this PR does not claim route parity. Static coverage rejects broad non-tool parity wording in both the shared guidance and Context7 rules. |
||
|
Soumya Medapati
|
52e538286e |
docs: 'latest' requires dangerously_skip_version_check for manual execution
Runtime testing during eval-rerun prep caught that toolkit_versions 'latest' is rejected by tools.execute() (ToolVersionRequiredError: '"latest" is not supported in manual execution') — the guides recommended it anyway; only the TS SDK reference documented the real behavior. Per SDK team (Abir): pass dangerously_skip_version_check=True / dangerouslySkipVersionCheck: true when running 'latest' manually. All direct-execution samples now include the flag with a one-line comment; the version-required callout explains both paths (skip-check for LLM-consumed outputs, pinned via toolkits.get(slug).meta.version for parsed outputs); the toolkit-versioning page's 'latest' claims are corrected; the execute-version static test now fails any page showing 'latest' without the flag. Both patterns runtime-verified against the live API before shipping. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Soumya Medapati
|
70f6772037 |
docs: enforce toolkit-version policy on execution samples via static test
Adds tests/static/execute-version.test.ts: any authored page whose code fences call tools.execute() must show version configuration, and the LLM guardrail blocks are held to the same rule. Fixes the five pages the audit caught (sessions-vs-direct-execution, custom-auth-params, before/after-execution-modifiers) which shipped version-less samples. Changelog, generated reference, and migration guides are exempt as historical/point-in-time records. This is the durable half of eval finding 1: the content fix landed in #3999; this test keeps future samples from regressing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Alberto Schiabel
|
61aafbc9d3 |
refactor(docs): parse untyped data with zod and forbid explicit any (#3967)
This PR: - builds on top of https://github.com/ComposioHQ/composio/pull/3966 - enables `typescript/no-explicit-any` (error, `fixToUnknown`) for docs in `docs/.oxlintrc.json` and removes every remaining explicit `any` in docs code - parses untyped/external data once at the boundary with zod v4 schemas and lets `z.infer` types flow downstream — no hand-rolled `'x' in obj` guard chains, no `as`-casts of untyped page data, no `docs/lib/unknown-value.ts` - adds domain schema modules: `docs/lib/toolkit-schema.ts` (recursive JSON-Schema node, raw tool/trigger payloads, list envelopes) and `docs/lib/reference-page-data.ts` (fumadocs reference page data for both reference routes) - rewrites `validate-links.ts`, `generate-toolkits.ts`, `generate-meta-tools.ts`, the `llms.mdx` route, and `deprecated-api-sidebar.tsx` on those schemas with identical validation outcomes - carries the pure typing improvements from the earlier attempt (typed reference source in `source.ts`, `LLMPage`/`PageLike`, typed `ClientLogo[]` in `logo-bar.tsx`, component `any` removals) - adds `tests/static/toolkit-schema.test.ts` and `tests/static/generate-toolkits.test.ts` pinning the transform shapes; no changeset (docs is not published) ## Context Second of the three-PR split of #3958, replacing its rejected structural-guard approach with zod schemas at the data boundaries. Verified with `bun run lint`, `bun run types:check`, `bun test tests/static/` (125 pass), `bun run lint:links`, and a full `next build`. ## Review follow-up Addressed the regressions reported in [the Zod boundary re-review](https://github.com/ComposioHQ/composio/pull/3967#issuecomment-5105279224): scalar JSON Schema enums and auth defaults are preserved as strings, malformed toolkit page envelopes abort generation, and the pre-refactor empty-string fallbacks are restored. Regression coverage lives in `tests/static/toolkit-schema.test.ts` and `tests/static/generate-toolkits.test.ts`. Verified on `2f26c40be` with `bun test tests/static/` (125 pass), `bun run types:check`, and `bun run lint` (0 errors; existing warnings only). |
||
|
Alberto Schiabel
|
3335bb3013 |
fix(docs): restore API reference pages dropped by undeclared tags (#3973)
This PR: - fixes a regression introduced by https://github.com/ComposioHQ/composio/pull/3956: fumadocs-openapi 11's `groupBy: 'tag'` silently skips operations whose tag is not declared in the document's top-level `tags` array, which 404'd all 16 Projects and Organization Management operation pages (e.g. `/reference/api-reference/projects/postProjectUsageSummary`) on both v3.1 and v3, and dropped them from the sitemap and search index - adds `declareOperationTags()` (`docs/lib/openapi-tags.ts`), applied at spec load time in `lib/openapi.ts` (covers build-time-fetched specs) and at sync time in `scripts/fetch-openapi.mjs`, which now also warns when the upstream payload omits tags; the checked-in specs are normalized accordingly (purely additive) - adds CI guards in `tests/static/api-reference-routes.test.ts`: spec invariants (every visible operation has a tag and `operationId`), bidirectional spec-vs-generated-routes set equality through the production loader path, a negative test pinning fumadocs' silent-drop behavior (fails when upstream fixes it, signaling the workaround can be retired), and validation that every `ApiEndpointsTable` quick-link href resolves to a generated page - extends `Docs - Check Links` with a nightly (02:30 UTC) + manual external-URL sweep via a new `lint:links:external` script; the validator only fails on evidence a link is dead (404/410 or repeated network errors, with UA/timeout/GET-fallback/retry and per-URL caching) and scheduled failures file a deduplicated tracking issue; PR runs keep the fast internal-only check - fixes six dead external links the first sweep found (moved Claude Agent SDK docs, stale dashboard settings URL ×2, a `master`-branch path now pinned to tag `0.5.0+post.1`, and two removed `ComposioHQ` example repos whose mentions were dropped — their code is embedded in the pages via `RepoBrowser`) ## Context fumadocs-openapi 10 generated a page for any tag string found on an operation; v11 requires the tag to be declared top-level and skips silently otherwise (`preset-auto.js`: `builder.fromTagName(tag)` → `continue`, no warning). The backend spec generator omits `Projects`, `Organization Management`, and `Invite Codes` from `tags`, so their operation pages vanished while the checked-in MDX tag landing pages kept rendering with dead quick links. With the normalizer, the generated URL set is byte-identical to the pre-#3956 set (234 routes, verified via `getReferenceSource().getPages()` diff); no revert needed. Existing checks missed this because `lint:links` only extracts markdown links and `Card` hrefs (the dead links live in `ApiEndpointsTable`'s array prop) and validates against the same loader that shrank, and the integration suite samples fixed routes under tags that survived. The new completeness guard derives expectations from the specs themselves, so routine data syncs don't churn it. |
||
|
Alberto Schiabel
|
f233e46937 |
chore(repo): migrate eslint to oxlint and typecheck to TypeScript 7 (#3966)
This PR: - replaces ESLint with oxlint across the pnpm workspace and the Bun-based docs site, porting the rules to `.oxlintrc.json` / `docs/.oxlintrc.json` with behavior parity (restricted-syntax selectors kept via `oxlint-plugin-eslint`) - migrates typecheck to TypeScript 7 (`typescript@^7.0.2` catalog) and keeps a TS6 pin for JS compiler API consumers via a named `ts6` pnpm catalog (`ts/scripts/validate-examples.ts`, the `@composio/cli` generate pipeline). The CLI's `typescript` dependency rebinds only the compiler-API import — its typecheck still runs the root TS7 `tsc`, since the alias package only ships a `tsc6` bin (documented in `ts/packages/cli/AGENTS.md`) - removes the `paths` mappings that pointed `@composio/core` (and, in `experimental`, `@composio/json-schema-to-zod` plus core-internal `#`-imports) at sibling `src` directories: under TS7, tsdown's tsgo-based dts step emitted stray `.d.ts` files next to those out-of-root sources on every dependent package build. Workspace deps now resolve through their built dist types, which turbo's `dependsOn: ^build` already guarantees exist — and which the deep-path exports (`@composio/core/*`) always used anyway - renames the cli boundary tooling `eslint-boundaries*` → `lint-boundaries*` and hardens the scanner to reject `oxlint-disable` spellings so the disable manifest cannot be bypassed - rewrites inline `eslint-disable` comments to oxlint rule names (comment-only; no runtime changes), and adds **one new** declared boundary: `tool-file-uploads.ts` needs `no-restricted-imports` disabled for `node:crypto` (MD5 for the presigned-upload checksum is not in Web Crypto), because oxlint also catches dynamic `await import()` where ESLint did not. The manifest grows 46 → 47 deliberately - updates CI path filters, `turbo.jsonc` lint inputs, and the docs typescript-check workflow (renamed to "Docs - Lint and TypeScript Validation" since it now lints too); drops `eslint`, `typescript-eslint`, `eslint-config-next`, and `globals` from the dependency graphs - ships no changeset: I built `@composio/core` and `@composio/anthropic` on this branch and on the pre-migration base and diffed the emitted `dist/**/*.d.mts`. The provider output is byte-identical. Core's output is **semantically identical but not byte-identical**: TS7 changes quote style (`"x"` → `'x'`), object-property and union-member ordering in inferred types, and picks equivalent shorter re-export alias paths for five signatures (e.g. `OpenAI.Beta.Threads.Runs.Run` → `OpenAI.Beta.Threads.Run` — verified both names alias the same type in the shipped typings). Chunk-name hashes shift as a consequence. No type gains, losses, or shape changes; `attw` and `publint` pass on the TS7 build ## Context First of a three-PR split of #3958. The type-safety refactors are stacked on this branch and merge after it: - docs: https://github.com/ComposioHQ/composio/pull/3967 - `@composio/core`: https://github.com/ComposioHQ/composio/pull/3968 |
||
|
Alberto Schiabel
|
16fa3d963a |
chore(docs): migrate the docs site to Fumadocs 11 (#3956)
## Summary - upgrades `fumadocs-openapi` 10 → 11, `fumadocs-mdx` 14 → 15, and `fumadocs-core` / `fumadocs-ui` 16.4 → 16.13 - migrates the Fumadocs OpenAPI API while preserving the custom schema renderer - restores local `$ref` resolution in both the visible API schema UI and generated LLM markdown - reduces API-reference client payloads by slicing the bundled OpenAPI document to each page's reachable operations and components - restores required badges for GET parameters - normalizes the OpenAPI `no_auth` sentinel so explicitly public endpoints render without authentication - moves to `getOpenAPIPageProps()` / `OpenAPIPageProps` and removes obsolete CSS overrides ## Correctness fixes Fumadocs 11 changed the page contract from a server-resolved document id to a client-side bundled document. That exposed several silent regressions: - **Reference resolution:** bundled documents retain local `$ref`s. The LLM renderer now dereferences them, including alias chains and cycles, while the custom schema renderer uses Fumadocs' resolver and retains raw reference identity for stable deduplication. - **Dereference reuse:** repeated LLM-page requests reuse the dereferenced copy for each cached bundled document instead of walking the complete spec per page. - **Client payload size:** each API page now receives only its selected operations and transitively reachable components. The slicer falls back to the complete document for non-component pointers, deep component pointers, missing operations, or dangling references. - **Required badges:** `readOnly` cannot distinguish GET inputs from responses. The renderer now uses the page hook's client name to identify responses. - **Recursive rendering:** schema markdown rendering now caps both structural recursion and nested array type rendering. - **No-auth normalization:** the undeclared `no_auth` sentinel is removed without discarding any real security alternatives that may accompany it. - **Contract drift:** code consuming `getSchema()` now treats `bundled` as required, matching the upstream type. Review follow-up also replaces the new OpenAPI `any` types with typed Fumadocs page props and a narrow recursive schema model. Historical Fumadocs 10/11 migration explanations live here in the PR, not as version-specific source comments; source comments retain only durable invariants. ## Payload impact | | before | after | | --- | --- | --- | | bundled document | 451 KB | 7.7 KB avg / 30 KB worst | | served page HTML | 693 KB | 198 KB | | 10-page sample | 6.55 MB | 2.02 MB (69% smaller) | ## Verification - `bun install --frozen-lockfile` - `bun run test` — 89 pass - `bun run lint:links` — 0 errors - `bun run lint` — 0 errors (77 existing warnings) - `bun run types:check` - `bun run build` - production server + `bun run test:integration` — 74 pass, including v3.1/v3 API pages, redirects, search, and LLM endpoints The production build has one existing Turbopack NFT tracing warning from `next.config.mjs`; it does not fail the build. ## Production vs preview checks A live sample comparison between [production](https://docs.composio.dev) and the [PR preview](https://docs-git-chore-docs-fumadocs-11.preview.composio.dev) found no docs regression: - all 14 representative routes returned 200 with matching titles, headings, canonical production URLs, and key content - redirects for `/`, `/api-reference`, `/tools`, and `/docs/welcome` matched exactly - the sampled pages exposed the same 1,137 internal-link targets; a balanced sample of 29 links resolved successfully on both deployments - sampled v3 and v3.1 OpenAPI pages retained endpoint paths, required fields, response schemas, and legacy indicators - the generated OpenAPI LLM page was byte-for-byte identical - selecting TypeScript in a hydrated browser rendered both inactive-tab examples and synchronized the language tab groups - `llms.txt` retained the same 139 unique lines in a different order - `/docs/quickstart.md` only added an explicit `[#next]` heading anchor The sampled OpenAPI HTML was roughly 35–42% smaller in the preview, consistent with document slicing rather than missing rendered content. |
||
|
Anshu Garg
|
57557fc54b |
docs(webhooks): render the webhook payload reference (PLEN-2793) (#3910)
## Summary Implements the docs half of **PLEN-2793** — renders a typed public reference for the payloads Composio delivers to customer webhook URLs, under **API Reference → Webhook Events**. Pairs with platform PR ComposioHQ/platform#11389, which generates the spec. ## What's here - **`docs/public/openapi-webhooks.json`** — the generated OpenAPI **3.1** spec (top-level `webhooks`: `composio.trigger.message`, `composio.connected_account.expired`, `composio.trigger.disabled`), produced from the webhook payload Zod schemas in Apollo (SSOT). Finishes the earlier untracked WIP: adds the missing `trigger.disabled` event and reuses shared schemas as `$ref` (`WebhookEventEnvelope`, `ConnectedAccountDetailed`). - **`docs/lib/openapi.ts`** — adds the spec as a **second input** to the v3.1 reference source. Fumadocs (`fumadocs-openapi`) renders the `webhooks` block natively; operations group under the "Webhook Events" tag at `api-reference/webhook-events/*`. - **`webhook-events/index.mdx`** — landing page listing the three events, cross-linked to the Webhook Subscriptions API and signature verification. ## Why a separate 3.1 spec `webhooks` is a 3.1-only top-level field; the main `openapi.json` is 3.0. A separate file keeps the main spec (and its sync pipeline) untouched and avoids the docs' union-normalisation pass. See the platform PR for the full rationale. ## Verified locally - [x] `bun scripts/validate-links.ts` — **0 errors** (the generated `handle_composio_*` webhook pages resolve; no collision with the hand-authored `index.mdx`) - [x] `bun test tests/static/` — 33 pass / 0 fail - [x] `bun run types:check` — clean ## Notes - Setup, subscription, and signature-verification docs already exist (`setting-up-triggers/*`) and are cross-linked, not rewritten. - Follow-up (optional): auto-sync the webhooks spec from Apollo on prod deploy (currently committed by hand), mirroring the main-spec `docs-update-data` pipeline. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Alberto Schiabel
|
5078481dcc |
fix(docs): show Legacy badge on deprecated API detail pages (#3911)
This PR: - follows up on https://github.com/ComposioHQ/composio/pull/3838 - renders the existing `Legacy` badge in v3 and v3.1 endpoint headers when the OpenAPI operation has `deprecated: true` - centralizes deprecated-endpoint badge copy across API overview tables and detail pages - adds static coverage plus running-server assertions for the reported routes and active control endpoints - verifies the fix with `bun run test`, `bun run types:check`, `bun run lint:links`, `bun run build`, and the focused integration suite |
||
|
Sarah Simionescu
|
5ef15774e6 |
feat(docs): enforce dashboard go-link paths and ban app/platform hosts
Extend the dashboard link policy: no app.composio.dev or
platform.composio.dev anywhere, and any dashboard.composio.dev link with
a path must be a go-link (/~/project/... or /~/org/...) or /login.
Enforced via new no-restricted-syntax selectors for TS/TSX and the
static test (renamed to dashboard-links.test.ts) for MDX.
Rewrite the non-conforming links: quickstart /settings -> go-link for
api-keys (also restores UTM params lost to a stray checkout during
verification), changelog {workspace}/{project}/settings -> go-link for
project settings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
||
|
Sarah Simionescu
|
c901397bc5 |
feat(docs): attribute dashboard sign-ups with UTM params on all docs links
Tag every dashboard.composio.dev link in authored docs content and components with utm_source=docs plus utm_medium/utm_campaign, and enforce the convention going forward: an ESLint no-restricted-syntax rule covers TS/TSX and a static bun test covers MDX (runs in docs-tests CI). - content links use utm_medium=content and utm_campaign=<page-slug> - content/reference is excluded (generated upstream) - delete unused landing-hero/_stub-links.ts - fix the no-html-link-for-pages errors; downgrade the pre-existing react-hooks compiler violations to warnings until burned down, so bun run lint exits with zero errors Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|
Lingala
|
b9a790ef4e |
docs: tag deprecated API endpoints with the existing Legacy tag (#3838)
## Summary Deprecated REST endpoints now surface the existing `Legacy` badge in generated API-reference indexes, with endpoint-specific tooltip copy instead of the Sessions-specific default. The generator behavior is covered end to end for both v3 and v3.1, including rendered table output. This branch also restores CI compatibility with the organization Actions policy: workflow tool versions still come from `mise.toml`, but installation uses the approved, SHA-pinned setup actions. Secret scanning pins the repaired organization reusable workflow from ComposioHQ/.github#13. ## Changes - Read the OpenAPI `deprecated` flag and emit `legacy: true` only for deprecated operations. - Render `LegacyBadge` on affected endpoint rows with accurate lifecycle tooltip copy. - Regenerate the affected `files` and `connected-accounts` indexes for v3 and v3.1. - Cover the real generator output, active-operation omission, badge count, and tooltip through a focused regression test. - Replace disallowed transitive Actions dependencies while retaining `mise.toml` as the single tool-version source. Endpoint detail pages continue to use `fumadocs-openapi`'s built-in deprecated marker. The indexed endpoints are `GET /files/list` and `POST /connected_accounts/{nanoid}/refresh`; internal operations remain filtered from the docs. ## Spec data The committed OpenAPI snapshots lagged the live backend for `POST /connected_accounts/{nanoid}/refresh`. Both snapshots now carry its current summary, description, and `deprecated: true`; the next `fetch-openapi.mjs` run will preserve that state from the live spec. ## Validation - `bun run test`: 25 passed, 0 failed. - `bun run types:check`: passed. - Focused ESLint and generated-index drift checks: clean. - Composite-action and workflow YAML parsed successfully; extracted tool pins match `mise.toml`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
composio-zen[bot]
|
4b790dc0ce |
fix(docs): correct toolkit versions and enforce production source (#3837)
## What this fixes This is a follow-up to #3770, not a second root-cause fix. #3770 moved the docs data workflow from staging to production, centralized the production API URL, removed staging hosts from the committed data, and added the hostname guard. The committed toolkit catalog still retained staging-derived `version` values, however, because that PR intentionally did not regenerate the full catalog. After #3770 merged, the scheduled production regeneration began failing with `401 Unauthorized`: the repository's existing `COMPOSIO_API_KEY` secret is staging-scoped. The customer-visible result was that nearly every toolkit page showed the internal staging version `20260703_00`; Gmail's production version was `20260702_01`. ## Changes - Correct every `version` in `docs/public/data/toolkits.json` from the production toolkit changelog. Toolkits absent from that changelog receive `null`, matching the full generator's semantics. No other JSON field changes. - Move production changelog fetching and version application into shared `toolkit-versions.ts` logic used by the full catalog generator. - Add `bun run generate:toolkit-versions` as the narrow, reproducible generator for version-only repairs. - Reject any non-production `COMPOSIO_API_BASE` in the toolkit and meta-tool generators before a request is made. - Keep the version-distribution check as a smoke signal for the known whole-catalog staging-bump pattern, while testing the production source boundary separately. The distribution heuristic is no longer described as proof of provenance. - Fail before writing when the production changelog response is malformed or contains no versions. ## CI policy compatibility - Replace the enterprise-blocked mise action with allowlisted tool setup actions while continuing to resolve exact versions from mise.lock. Install the existing pinned mise CLI release through a checksum-verified repository script for lock freshness and preinstall validation. - Run the existing GitHub Advanced Security alert check locally and notify Slack through the already-allowlisted Slack action, avoiding the central workflow dependency rejected by the enterprise action policy. ## Verification - `bun test tests/static/` — 30 passed. - Targeted ESLint for every changed script/test — passed. - `bun run types:check` — passed. - `bun run build` — passed. - Explicit staging override of `generate-toolkits.ts` — rejected before network access. - Verified the JSON data change remains version-only; toolkit ordering, tools, triggers, descriptions, and counts are unchanged. ## Remaining deployment action An administrator still needs to replace `COMPOSIO_API_KEY` with a production-scoped key. The scheduled `docs-update-data` workflow is correctly pinned to production and therefore fails loudly with the current staging credential instead of republishing staging data. Once the secret is corrected, the normal full-catalog generator remains the authoritative refresh path. Triggered by: abhishek@composio.dev | Source: slack Session: https://zen.corp.composio.io/dashboard/#/chat/zen-3a77f73eb146 --------- Co-authored-by: Zen Agent <zen@composio.dev> Co-authored-by: abhishek <abhishek@composio.dev> Co-authored-by: jkomyno <alberto@composio.dev> |
||
|
Aditya Painuli
|
183a274d99 |
docs: fix Gemini Python example to use composio_gemini with google-genai (#3839)
## Summary
The Gemini Python example paired composio_google (which wraps tools as
VertexAI FunctionDeclaration objects) with google-genai client.
GenerateContentConfig silently coerces those VertexAI objects into an
empty genai Tool ({}), so the documented flow sends requests with no
tool schemas at all - the model never sees or calls any Composio tool,
with no error surfaced anywhere.
Fixes #3836
## Changes
- docs/content/docs/providers/google.mdx (Gemini tab, Python only):
- install line: composio_google → composio_gemini
- example: GeminiProvider + Automatic Function Calling; the manual while
response.function_calls: loop is gone because the google-genai SDK
executes the wrapped callables itself
- intro paragraph updated to describe the Python (AFC) and TypeScript
(manual loop) flows separately
The TypeScript tab and the Google ADK section are untouched; both
already target the right SDKs. The new Python example matches the
existing quickstart in python/providers/gemini/README.md.
## Type of change
- [ ] Bug fix
- [ ] New feature
- [ ] Refactor/Chore
- [x] Documentation
- [ ] Breaking change
## How Has This Been Tested?
- Offline repro of the bug (issue #3836): with composio_google,
config.tools[0].model_dump(exclude_none=True) is {} and genai's
_transformers.t_tools raises AttributeError on the vertexai type.
- Offline verification of the fix: the exact construction path of the
new example (GeminiProvider().wrap_tools → GenerateContentConfig →
chats.create → t_tools) serializes a complete FunctionDeclaration (name,
description, parameters) with composio==0.17.1, google-genai==2.11.0,
Python 3.12.
- Docs: bun run build and bun run lint:links from docs/: green.
## Screenshots (if applicable)
## Checklist
- [x] I have read the Code of Conduct, and this PR adheres to it
- [x] I ran linters/tests locally, and they passed
- [x] I updated documentation as needed
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages
## Additional context
No changeset: docs-only change, no published package affected.
Regression coverage: `docs/tests/static/content.test.ts` now guards the
documented `composio_gemini` + `google-genai` pairing; the example's
construction path was also exercised offline as described above.
The underlying provider split (composio_google targeting the
upstream-deprecated vertexai generative_models SDK vs composio_gemini
targeting google-genai) is flagged in #3836 as an open question for
maintainers; this PR is the docs-only fix.
---------
Co-authored-by: jkomyno <alberto@composio.dev>
|
||
|
Alberto Schiabel
|
de0bfa356d |
fix(docs): resolve changelog links and Vercel deploys (#3811)
This PR: - fixes copied changelog date URLs so they stay on `/reference/changelog` and target the selected date - resolves fragment links against the current page while preserving full site-relative links - upgrades the docs app to Vercel-supported `eve@0.18.0` - migrates docs-agent evals from the removed `t.completed()` assertion to `t.succeeded()` - verifies the docs static suite, TypeScript type-check, and production build --- [](https://github.com/EveryInc/compound-engineering-plugin)  |
||
|
Alberto Schiabel
|
8a19b75915 |
fix(docs): publish production API URLs and guard against staging leaks (#3770)
## What was wrong The API reference docs were shipping staging URLs to users. There were two separate leaks, both from the same source: the scheduled `docs-update-data` workflow fetches the OpenAPI specs and toolkit data from staging every 5 hours and auto-commits them. The first leak was the curl base URL. `servers[0].url` in `openapi.json` and `openapi-v3.json` rendered as `http://staging-apollo.composio.dev` in every curl example. That is what https://github.com/ComposioHQ/composio/pull/3761 tried to fix. The second leak was in the toolkit data. `toolkits.json` carried 269 `https://staging-backend.composio.dev/api/v1/auth-apps/add` default values, surfaced in the white-labeling and auth-config docs. #3761 never touched this file. ## Which PR caused it Karan asked on Slack whether we could pin down the PR that introduced this. We can. It was https://github.com/ComposioHQ/composio/pull/3426 (commit `a3e58a421`, merged 2026-07-03), which flipped `servers[0].url` from `https://backend.composio.dev` / `PRODUCTION API` to `http://staging-apollo.composio.dev` / `STAGING API` in both specs. It was not a hand-written change. #3426 is itself an auto-generated PR from this same `docs-update-data` workflow, opened by `github-actions[bot]` on the `docs/auto-update-data` branch. The workflow fetched from staging, staging serves the staging server URL in its spec, and the value landed in the committed files where nobody caught it inside a large auto-generated diff. That is the reason the real fix belongs in the generator and the workflow, not in a one-off edit to the JSON. ## Why #3761 was not enough #3761 pinned `spec.servers` to production inside `fetch-openapi.mjs`. That closed the first leak, but three things stayed open. It only covered the OpenAPI specs. The 269 staging hosts in `toolkits.json` come from a different generator, `generate-toolkits.ts`, and stayed live on the docs site. It added no CI guard. The fix was a single line in a generator with nothing asserting it. A later refactor that dropped or reordered that line would republish staging on the next 5-hour regeneration, which is precisely the recurring failure that produced the original report. And it scrubbed the symptom rather than the source. The workflow kept fetching from staging; the pin just rewrote one field afterward. ## The fix I addressed it at four layers, so no single regression brings staging back. **Source.** `docs-update-data.yml` no longer overrides the base URL to staging. The generators default to production, so the docs reflect production. **Generators.** The production URL now lives in one place, `docs/scripts/production-api.mjs`. The toolkit and meta-tools generators sanitize any staging host to production before writing, so a staging fetch can no longer republish staging. **Committed data.** I rewrote the 269 staging hosts already in `toolkits.json` to production. **Guard.** `docs/tests/static/production-urls.test.ts` asserts the OpenAPI `servers` is production and scans both specs and every `public/data/*.json` for any `staging-*.composio.dev` host. It is an independent oracle: it hardcodes the expected value and deliberately does not import the generator constants, so a wrong edit there fails CI instead of moving both sides together. I verified it catches both the original `staging-apollo` and the `staging-backend` leaks. ## One thing to confirm before merge `COMPOSIO_API_KEY` is paired with `COMPOSIO_BASE_URL_STAGING` in every other workflow, so it is most likely a staging key. If that is the case, provision a production-capable key before the next scheduled run. Otherwise that run fails on auth, which is loud and safe, rather than silently republishing staging. The generator sanitizer and the guard keep the output correct regardless of which environment the fetch hits, so there is no risk in the interim. ## Testing - `bun test tests/static/` passes 21 of 21 (16 existing, 5 new). - The shared module loads and all three generators build under bun. - No `staging-*.composio.dev` host remains under `docs/public/`. - `docs-update-data.yml` re-validated as valid YAML. |
||
|
Rahul Tarak
|
d17a268d3f |
docs: sessions-first rewrite — new guides, examples & components (+ core 0.13.0 SDK changes) (#3637)
Integration branch for the next docs release: a **sessions-first
documentation rewrite** — new and rewritten guides, example pages,
interactive components, and docs tooling — plus the supporting SDK
changes that the new docs describe.
The bulk of this PR is docs (~24k lines across ~150 commits); the SDK
changes (~5k lines) back the new guides.
## Documentation (the bulk)
- **Sessions-first restructure** — reorganized navigation and section
structure (incl. the "Sandbox (prev workbench)" section), with
v3-reorganization redirects so old URLs keep resolving.
- **Rewritten core guides** — quickstart, configuring sessions, triggers
(creating + subscribing to events), proxy-execute, toolkits
enable/disable, and common FAQ, rewritten in the house voice.
- **New example pages** — local-sandbox PR reviewer, daily standup bot,
and slack bot, with runnable build-ups.
- **New interactive components & diagrams** — triggers flow animation,
manage-connections visual, connection-refresh visual, and the
terminal-kit components.
- **Docs tooling** — a docs-graph link-graph connectivity checker,
search reprioritization (deprioritize legacy pages), and SDK-reference
regeneration.
## Supporting SDK changes
**`@composio/core` → 0.13.0 (minor)**
- `composio.sessions.create()` as the first-class sessions API
(`composio.create()` kept as an alias).
- **MCP is opt-in:** default `create()` / `use()` return native-tool
sessions (`SessionWithoutMcp`); pass `{ mcp: true }` to surface
`session.mcp`. _Migration: read `session.mcp` only after creating with
`{ mcp: true }`._
- `session.sandbox` is the canonical resolved config;
`session.workbench` kept as a deprecated alias. `sandbox` is the
preferred session-config key (`workbench` still accepted).
- `connectedAccounts.updateAcl()` graduated from experimental (alias
kept).
- `triggers.parse()` (parse + optionally verify an incoming webhook) and
`triggers.setWebhookSubscription()`.
**`@composio/experimental` → minor** — local-workbench helpers moved
onto the `@composio/experimental/workbench` subpath (out of
`@composio/core/experimental`), keeping the ~14 KB embedded Python
helper out of core. Plus the experimental Pi provider.
**`@composio/slim` → minor.**
**Python → 0.17.0** — mirrors the TS surface: `composio.sessions` mount
(`tool_router` deprecated), `triggers.parse()` /
`set_webhook_subscription()`, the `sandbox` config key, and
`connected_accounts.update_acl()`.
## Review response (#3664)
Addressed the `@composio/core` review:
- **Security:** `triggers.parse()` no longer fails open — a
present-but-empty `verifySecret` (e.g. unset `COMPOSIO_WEBHOOK_SECRET`)
now throws instead of silently skipping verification; omitting it stays
an explicit opt-out (both SDKs).
- Removed snake_case leakage from `transformWebhookSubscription` (+ the
index signature that allowed it).
- **Removed** the TS-only `connectedAccounts.link()` toolkit
auto-resolve (shipped with cancellability / orphaned-auth-config bugs
and was effectively undocumented; to be reintroduced properly later).
- Unified Python error types on `ValidationError`; added `mcp=True`
Python tests; fixed runtime-portability + error-type test assertions.
- Polished deprecation messages; fixed the backwards `/experimental`
`@deprecated` note and the `SessionWithMcp` JSDoc.
## Testing
- **TS:** `@composio/core` + `@composio/experimental` typecheck pass;
vitest green for the touched suites.
- **Python:** `test_tool_router.py` + `test_triggers.py` pass (161
tests).
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Kshitij Jhunjhunwala <kj@composio.dev>
Co-authored-by: Malay Vasa <malayvasa@gmail.com>
Co-authored-by: Sarah Simionescu <sarah@composio.dev>
Co-authored-by: Kshitij Jhunjhunwala <113939507+KJ-11@users.noreply.github.com>
|
||
|
Alberto Schiabel
|
80448048a8 |
docs: remove legacy custom tools references and retarget redirects (#3510)
This PR is **part 3 of 3** splitting https://github.com/ComposioHQ/composio/pull/3505 to make the removal of the old 2025 custom tools easier to review. It carries the **docs** slice. - builds on top of https://github.com/ComposioHQ/composio/pull/3509 (stacked — this PR's base is `remove-ts-custom-tools`) - deletes the legacy `/docs/tools-direct/custom-tools` page and prunes its `meta.json` entry - retargets redirects for `/docs/tools-direct/custom-tools` and the `:path*` wildcard to `/docs/toolkits/custom-tools-and-toolkits`, with matching `redirects.test.ts` expectations - updates migration-guide, glossary, proxy-execute, and executing-tools prose; fixes the `ctx.proxyExecute` example to include the required GitHub toolkit - updates agent guidance (`AGENTS.md`, `building-agents` skills) to the experimental custom tools API ## Notes - This slice is a byte-identical subset of #3505 — the three split branches recombine to that PR's exact tree. Docs link/redirect checks could not run in the source checkout (missing docs deps); CI runs them per PR. |
||
|
Rahul Tarak
|
9acfa852b2 |
docs: tidy welcome page, fix playground link, hide ugly Ask AI tab (#3455)
## Summary Three small docs polishes: - **Hide the disgusting "Ask AI" side tab.** The Decimal widget renders its own `.decimal-widget-sidebar-tab` launcher (vertical pill with sideways text) on every page. We already trigger the widget from our own "Ask AI" button in the nav, so the third-party launcher is redundant *and* ugly. Hidden via CSS in `app/global.css`. - **Fix the Playground nav link.** It pointed at `platform.composio.dev/auth?next_page=/tool-router` — which (a) hits a dead host now that platform has moved to `dashboard.composio.dev`, and (b) lost the playground's connect check on the redirect. Repointed to `https://dashboard.composio.dev/~/project/playground`, which is the dashboard's smart-resolver route: it handles login (`?next=`), looks up `last_visited` / default org+project, and lands the user on `/{org}/{project}/playground` with the connect step intact. Same fix applied to the toolkits landing CTA and the welcome-page Playground card. - **Trim the welcome page.** Dropped the duplicated intro Cards row, the "Get Started" / "Explore" / "Features" / "Community" headers, and the secondary Features grid. Now it's: intro → AIToolsBanner → Quickstart → Toolkits + Playground → Providers. Much cleaner. ## Test plan - [ ] `bun run scripts/validate-links.ts` passes (already verified locally — 0 errors) - [ ] On preview deploy, the side "Ask AI" tab is gone - [ ] Clicking "Playground" in the nav (logged out) lands on login → playground; (logged in) lands on `/{org}/{project}/playground` - [ ] Welcome page renders without missing-icon errors 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Sushmitha Mallesh
|
0dbecb5f74 |
test(docs): add static tests for quickstart PromptBanner
- Validate all 6 prompts exist with required sections - Verify deprecated section includes code examples - Guard against markdown headings in prompts (TOC pollution) - Ensure mdxToCleanMarkdown strips PromptBanner from .md output Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
Sushmithamallesh
|
6fc201d5a2 |
fix: handle '...' rest entries in root meta.json navigation test
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
Sushmithamallesh
|
93020e1c6e |
ci: add docs test suite (static + integration)
Static tests (no server): navigation completeness, content/frontmatter validation, changelog format, toolkit data integrity. Integration tests (needs server): search API, page rendering, LLM markdown endpoints, redirect validation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |