skills/composiohq__composio
1
0
Fork 0
mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00
Code Issues Packages Projects Releases Wiki Activity
5,111 Commits 338 Branches 1,550 Tags
vercel-example@0.1.11
Commit Graph

5111 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
jkomyno 1f94167595 fix(python): walk only schema positions when checking dynamic refs 
The dynamic-key reference walker descended into every nested dict, so a
$ref-shaped value stored under const, default, enum, or examples was
treated as a schema reference and raised while the tool was wrapped.
Restrict the walk to Draft 7 schema positions.
 2026-08-07 19:39:06 +05:30
LHMQ878 051c8c5357 fix(telemetry): redact secrets inside JSON payloads (#4043) 
## Summary

Telemetry error text is redacted before it leaves the process, but the
key/value rule only matches when the separator follows the key name
directly:

```
\b(authorization|api[-_]?key|...|pwd)\b(\s*[:=]+\s*)(["']?)([^\s"',}&]+)\3
```

In JSON — and in a Python `dict` repr — the key's own closing quote sits
between the name and the colon, so `{"api_key": "..."}` never matches
and the value is sent verbatim. That is the shape error messages usually
carry: an API error envelope, a rejected request body echoed back, or an
f-string interpolating a config dict. Both SDKs share the pattern and
both are affected.

The fix moves the optional quote into the separator group
(`(["']?\s*[:=]+\s*)`). The key name, separator, and quoting are all
preserved in the output; only the value is replaced.

Measured with `redact_sensitive_text` / `redactSensitiveText` directly,
before and after:

| input | before | after |
|---|---|---|
| `api_key=sk-1` | redacted | redacted |
| `api_key: "sk-1"` | redacted | redacted |
| `x-api-key: sk-live-hdr` | redacted | redacted |
| `{"api_key": "sk-live-abc"}` | **leaks** | `{"api_key": "[REDACTED]"}`
|
| `{"api_key":"sk-live-abc"}` | **leaks** | redacted |
| `{"api_key" : "sk-live-abc"}` | **leaks** | redacted |
| `{"refresh_token":"rt-abc.def-123"}` | **leaks** | redacted |
| `{"x-api-key":"sk-hdr","user":"bob"}` | **leaks** | redacted,
`"user":"bob"` kept |
| `{'client_secret': 'cs-live-abc'}` | **leaks** | redacted |
| `the password field is required` | untouched | untouched |
| `no separator here "api_key" and nothing else` | untouched | untouched
|

The end-to-end path in Python is `composio/core/models/base.py:60-61`,
which passes `str(e)` and `traceback.format_exc()` through the redactor
into the telemetry `error` field. A tool failure whose message
interpolates the rejected request body — `Error executing tool: request
body was rejected: {"toolkit": "GMAIL", "arguments": {"api_key": "...",
...}}` — leaked the customer's key today.

## Changes

- `python/composio/utils/redaction.py`,
`ts/packages/core/src/telemetry/redact.ts`: allow a quote between the
key name and the separator.
- Tests on both sides for JSON, minified JSON, spaced-colon JSON, dict
repr, the realistic serialized-payload shape, key/quote preservation,
and no-false-positive cases.
- Changeset for `@composio/core`.

## Type of change

- [x] Bug fix

## How Has This Been Tested?

Node 24.13.0 / pnpm 11.8.0 / Python 3.10.20 (uv), Windows.

- `uv run pytest tests/test_redaction.py` — 13 passed. With
`redaction.py` reverted and the new tests kept, 9 of them fail; the 4
that still pass are the pre-existing test plus the three
no-false-positive controls.
- `npx vitest run test/telemetry/redact.test.ts` in `ts/packages/core` —
10 passed. With `redact.ts` reverted, the 3 new cases fail.
- Full Python suite: 913 passed, same 4 failures as on `next` unchanged
(3 are `ModuleNotFoundError: composio_langchain` from providers not
installed in my env; 1 is `test_empty_name_safe_fails_at_write_time`,
which expects `IsADirectoryError` but Windows raises `PermissionError`
when opening a directory). Collection 944 → 956, exactly the 12 tests
added.
- Full `@composio/core` vitest: 798 passed / 2 failed, byte-identical to
the unchanged baseline (794 passed / same 2 failed — both Windows
path-and-symlink cases). 11 test files fail to load in both runs because
I installed with `--ignore-scripts`; the repo's `preinstall` hook
doesn't run in my shell.
- `ruff format --check` and `ruff check` clean on the two Python files;
`prettier --write` applied to the two TypeScript files.

## Checklist

- [x] I have read the Code of Conduct and this PR adheres to it
- [x] I ran linters/tests locally and they passed
- [ ] I updated documentation as needed — no user-facing behavior change
to document
- [x] I added tests or explain why not applicable
- [x] I added a changeset if this change affects published packages

## Additional context

This is defence-in-depth, so it stays deliberately narrow: same denylist
of key names, same value character class, no new rules. Bare-prefix
secrets (`sk-...`, `ghp_...`) and PEM blocks are still not matched by
either SDK — worth a separate look, but widening the pattern is a
different risk trade-off than closing a shape the rule already intends
to cover.
 2026-08-07 19:14:49 +05:30
jkomyno 4f009baa69 fix(python): resolve nested dynamic refs from document root 2026-08-07 19:11:18 +05:30
jkomyno 5a8e0e358a fix(core): accept widened object schemas in strict helper 2026-08-07 19:06:27 +05:30
Alberto Schiabel 6e0a9db3c7 feat(docs): make coding agents reach for REST API v3.1 (#4079) 
This PR:

- fixes
[UXE-233](https://linear.app/composio/issue/UXE-233/docs-should-explicitly-direct-agents-to-use-v31-apis)
- makes the agent-facing Markdown channels publish concrete REST v3.1
base URLs and endpoint tables while preserving the supported v3.0
reference tree
- centralizes `REST_VERSION_GUIDANCE`, `TOOL_VERSION_GUIDANCE`, and
raw-spec path matching in `lib/api-version-guidance.ts`
- renders `ApiBaseUrl` and `ApiEndpointsTable` in authored MDX and adds
an explicit version pointer to generated OpenAPI operation Markdown
- separates current and legacy REST references in `llms.txt`, excludes
v3.0 page bodies from `llms-full.txt`, and adds v3.1 selection guidance
to Context7
- validates serialized `ApiEndpointsTable` payloads with Zod before
generation while preserving forward-compatible fields
- addresses review feedback for the renamed authentication page,
SDK-reference pointer scope, generator validation behavior, and stale
OpenAPI tool-version descriptions

## Context

REST v3.0 is superseded but remains supported for existing integrations.
This PR changes what new agent-generated code discovers first; it does
not require existing v3.0 callers to migrate.

Authenticated read-only probes against the deployed API confirmed that
the affected v3 endpoints default to `00000000_00`, while their v3.1
counterparts default to `latest`. `POST /tools/scopes/required` is
available only on v3.1 and defaults to `latest`.

This PR does not move public URLs. A future `/reference/v3/` to
`/reference/v3.0/` migration remains separate because it has independent
compatibility and search-indexing risk.

## Verification

- `bun test tests/static/`
- `bun run build`
- `bun run test:integration`
- `bun run types:check`
- `bun run lint`

## Review follow-up

The version-default guidance is intentionally limited to the five
verified tool endpoints. v3.1 is a structural superset of v3, so this PR
does not claim route parity. Static coverage rejects broad non-tool
parity wording in both the shared guidance and Context7 rules.
 2026-08-07 18:48:00 +05:30
jkomyno 8d4bb3bf7e chore: merge next into json schema conversion fix 2026-08-07 18:44:34 +05:30
dependabot[bot] 0c4c5a360a chore(deps): bump the npm-production group across 1 directory with 17 updates (#4090) 
Bumps the npm-production group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
|
[@anthropic-ai/claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-typescript)
| `0.3.220` | `0.3.221` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `6.0.235` |
`6.0.241` |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.13.0` |
`2.15.0` |
| [@langchain/core](https://github.com/langchain-ai/langchainjs) |
`1.2.3` | `1.2.4` |
|
[@langchain/langgraph](https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core)
| `1.4.8` | `1.4.9` |
| [typebox](https://github.com/sinclairzx81/typebox) | `1.3.9` |
`1.3.10` |
| [@ai-sdk/mcp](https://github.com/vercel/ai/tree/HEAD/packages/mcp) |
`2.0.22` | `2.0.24` |
|
[@ai-sdk/openai](https://github.com/vercel/ai/tree/HEAD/packages/openai)
| `4.0.27` | `4.0.29` |
|
[@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers)
| `0.18.8` | `0.20.1` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) |
`5.20260801.1` | `5.20260804.1` |
|
[@mastra/core](https://github.com/mastra-ai/mastra/tree/HEAD/packages/core)
| `1.52.1` | `1.55.0` |
|
[@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk)
| `1.26.0` | `1.30.0` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.0` |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm) | `11.17.0`
| `11.20.0` |
|
[publint](https://github.com/publint/publint/tree/HEAD/packages/publint)
| `0.3.22` | `0.3.23` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.5` |
|
[wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)
| `4.114.0` | `4.118.0` |


Updates `@anthropic-ai/claude-agent-sdk` from 0.3.220 to 0.3.221
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/releases">@​anthropic-ai/claude-agent-sdk's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.221</h2>
<h2>What's changed</h2>
<ul>
<li>Improved <code>skills</code> option validation: malformed names
(delimiters or control characters) and wildcard-form names are rejected
with a clear error; use <code>skills: 'all'</code> to enable every
skill</li>
<li>Fixed external MCP servers passed via the <code>mcpServers</code>
option not being connected before the first turn, which caused the model
to emit tool calls as literal text</li>
</ul>
<h2>Update</h2>
<pre lang="sh"><code>npm install @anthropic-ai/claude-agent-sdk@0.3.221
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.221
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.221
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.221
</code></pre>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md">@​anthropic-ai/claude-agent-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>0.3.221</h2>
<ul>
<li>Improved <code>skills</code> option validation: malformed names
(delimiters or control characters) and wildcard-form names are rejected
with a clear error; use <code>skills: 'all'</code> to enable every
skill</li>
<li>Fixed external MCP servers passed via the <code>mcpServers</code>
option not being connected before the first turn, which caused the model
to emit tool calls as literal text</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-agent-sdk-typescript/commit/31fbbfd403b3289933abc297e66cec775301e15e"><code>31fbbfd</code></a>
chore: Update CHANGELOG.md</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-agent-sdk-typescript/compare/v0.3.220...v0.3.221">compare
view</a></li>
</ul>
</details>
<br />

Updates `ai` from 6.0.235 to 6.0.241
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/ai@6.0.241/packages/ai/CHANGELOG.md">ai's
changelog</a>.</em></p>
<blockquote>
<h2>6.0.241</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [7e50c52]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.163</li>
</ul>
</li>
</ul>
<h2>6.0.240</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [b28367e]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.162</li>
</ul>
</li>
</ul>
<h2>6.0.239</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [d3d9e0b]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.161</li>
</ul>
</li>
</ul>
<h2>6.0.238</h2>
<h3>Patch Changes</h3>
<ul>
<li>9ecdefe: Prevent validated downloads on Node.js from reaching
private or internal services through DNS aliases or DNS rebinding by
validating and pinning every resolved address at connection time.</li>
<li>26d10c0: support overriding model call settings for individual
<code>prepareStep</code> invocations</li>
<li>7767170: Preserve provider metadata from empty text deltas in
<code>streamText</code>.</li>
<li>Updated dependencies [9ecdefe]</li>
<li>Updated dependencies [87fb433]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/4"><code>@​4</code></a>.0.41</li>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.160</li>
</ul>
</li>
</ul>
<h2>6.0.237</h2>
<h3>Patch Changes</h3>
<ul>
<li>f6020d7: Avoid synthesizing client tool errors for invalid
provider-executed tool calls.</li>
<li>Updated dependencies [de438f5]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.159</li>
</ul>
</li>
</ul>
<h2>6.0.236</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [8418710]
<ul>
<li><code>@​ai-sdk/gateway</code><a
href="https://github.com/3"><code>@​3</code></a>.0.158</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/5b4cf0ef925c6dfac12167e9e986e2e2e796e68e"><code>5b4cf0e</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18345">#18345</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/b878ce998fbe53bb27d8124b59c94cb9c109899b"><code>b878ce9</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18314">#18314</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/fbb507af0398516dc4db212a6dcdfff48744a4fd"><code>fbb507a</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18280">#18280</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/6e37b23980716390f878881f0e39a878295d1dd4"><code>6e37b23</code></a>
v6.0: docs: document GenerateTextResult.output getter errors (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18252">#18252</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/006a2f87a3ca3409973d1a11ed21002b37d38c74"><code>006a2f8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18089">#18089</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/2deee5b27ec31ba38a2e2b20966fe1a868b5f117"><code>2deee5b</code></a>
v6.0: docs: clarify generateText text aggregation and empty-string
behavior (...</li>
<li><a
href="https://github.com/vercel/ai/commit/26d10c0b30ca68d5c7b618b8d54b06ae01930a68"><code>26d10c0</code></a>
[v6.0] feat: support per-step model call setting overrides in
prepareStep (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/1">#1</a>...</li>
<li><a
href="https://github.com/vercel/ai/commit/9ecdefe4eb4db14c76bcc7c04813663d2012fb8e"><code>9ecdefe</code></a>
[v6] fix(provider-utils): prevent DNS alias SSRF in validated downloads
(<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18095">#18095</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/776717089720a00a29a7b72b86f7bdc54ea8c0bd"><code>7767170</code></a>
[v6.0] fix: preserve provider metadata from empty streamText text deltas
(<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18">#18</a>...</li>
<li><a
href="https://github.com/vercel/ai/commit/98d8c433aa6a0d3ec05c201e0355f876c6349c47"><code>98d8c43</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/ai/issues/18028">#18028</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/ai/commits/ai@6.0.241/packages/ai">compare
view</a></li>
</ul>
</details>
<br />

Updates `@google/genai` from 2.13.0 to 2.15.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/releases">@​google/genai's
releases</a>.</em></p>
<blockquote>
<h2>v2.15.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a>
(2026-07-30)</h2>
<h3>Features</h3>
<ul>
<li>add environment resource (<a
href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li>
<li>Support GoogleMaps Tool grounding_types places and routing (<a
href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li>
<li>Support per-request retryOptions in the JS GenAI SDK API Client (<a
href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li>
<li>Wire environment service into genai sdk (<a
href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li>
</ul>
<h2>v2.14.0</h2>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a>
(2026-07-28)</h2>
<h3>Features</h3>
<ul>
<li>[GenerateContentConfig] Add
GenerationConfig.audio_transcription_config and
Part.audio_transcription. (<a
href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li>
<li>Add flat <code>language_codes</code> field to
<code>AudioTranscriptionConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li>
<li>Allow api key + proj/location for enterprise mode (<a
href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>add deprecation warnings to Imagen generate_images, edit_images,
generate_videos (if using prompt/text/image args),
LiveConnectConfig.GenerationConfig which will be removed in the next
major version (<a
href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md">@​google/genai's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.14.0...v2.15.0">2.15.0</a>
(2026-07-30)</h2>
<h3>Features</h3>
<ul>
<li>add environment resource (<a
href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7">2c911be</a>)</li>
<li>Support GoogleMaps Tool grounding_types places and routing (<a
href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78">52655c1</a>)</li>
<li>Support per-request retryOptions in the JS GenAI SDK API Client (<a
href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c">124b606</a>)</li>
<li>Wire environment service into genai sdk (<a
href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a">70d7938</a>)</li>
</ul>
<h2><a
href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.14.0">2.14.0</a>
(2026-07-28)</h2>
<h3>Features</h3>
<ul>
<li>[GenerateContentConfig] Add
GenerationConfig.audio_transcription_config and
Part.audio_transcription. (<a
href="https://github.com/googleapis/js-genai/commit/4b2e67aebbb713321c095ccad34618f2a98fdd7d">4b2e67a</a>)</li>
<li>Add flat <code>language_codes</code> field to
<code>AudioTranscriptionConfig</code>. (<a
href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853">cc808eb</a>)</li>
<li>Allow api key + proj/location for enterprise mode (<a
href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5">9c0540a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>add deprecation warnings to Imagen generate_images, edit_images,
generate_videos (if using prompt/text/image args),
LiveConnectConfig.GenerationConfig which will be removed in the next
major version (<a
href="https://github.com/googleapis/js-genai/commit/bb6610199a76f7a99e28ed77974e6a3af21a52b1">bb66101</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/js-genai/commit/a76a3eab126e5b7c6a46f6c43795ec3cc65b5488"><code>a76a3ea</code></a>
chore(main): release 2.15.0 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/1815">#1815</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/124b606bc5be0d5e70673dc28e16e739c9a25d7c"><code>124b606</code></a>
feat: Support per-request retryOptions in the JS GenAI SDK API
Client</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/52655c192848942d2d866c3b256de27c94583f78"><code>52655c1</code></a>
feat: Support GoogleMaps Tool grounding_types places and routing</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/70d79389536821f1323ae5016f63ee95afa6b48a"><code>70d7938</code></a>
feat: Wire environment service into genai sdk</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/2c911befbf839fc250a296783cbedbd3b668a9f7"><code>2c911be</code></a>
feat: add environment resource</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/1895d5793954cb62e3ab4d90aab2f636b4285497"><code>1895d57</code></a>
docs: Communicate on upcoming updates in the next major version</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/ebeba1cda039d43e821d519afb8ce1d0dc9d0f74"><code>ebeba1c</code></a>
chore(main): release 2.14.0 (<a
href="https://redirect.github.com/googleapis/js-genai/issues/1799">#1799</a>)</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/cc808ebcbe76beb8e54fd5ca24ac358643104853"><code>cc808eb</code></a>
feat: Add flat <code>language_codes</code> field to
<code>AudioTranscriptionConfig</code>.</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/9c0540a26694e6a2896a433e43d1bac963af10e5"><code>9c0540a</code></a>
feat: Allow api key + proj/location for enterprise mode</li>
<li><a
href="https://github.com/googleapis/js-genai/commit/d221cf34c94ad558ab22d59e3163b60122d72948"><code>d221cf3</code></a>
chore: internal update</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/js-genai/compare/v2.13.0...v2.15.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/core` from 1.2.3 to 1.2.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langchainjs/releases">@​langchain/core's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/core</code><a
href="https://github.com/1"><code>@​1</code></a>.2.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11190">#11190</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a>
Thanks <a
href="https://github.com/pawel-twardziak"><code>@​pawel-twardziak</code></a>!
- Coalesce nested LangChain tracer callbacks that share run
bookkeeping.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langchainjs/pull/11153">#11153</a>
<a
href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a>
Thanks <a
href="https://github.com/parveshsaini"><code>@​parveshsaini</code></a>!
- fix(core): bind splitText when trimMessages receives a TextSplitter
instance</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/f6dbb882d1d4a591d69020145b6a871fe7801b35"><code>f6dbb88</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11268">#11268</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/9654bde694af4e78080a76a0b39d7edd35683449"><code>9654bde</code></a>
fix(core): coalesce duplicate tracer copies sharing run state (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11190">#11190</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/84ce6d65ef0ab2c556d5a5a3b5651b5cf3d73303"><code>84ce6d6</code></a>
fix(core): bind splitText when trimMessages receives a TextSplitter
instance ...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/710d74f3fc0ff98d5088c8e0c86752829cfaaa2c"><code>710d74f</code></a>
fix: resolve open Dependabot alerts (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11259">#11259</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5226cddb0d0b31d33bb78fc51230e4283cd6cc64"><code>5226cdd</code></a>
chore(deps-dev): bump <code>@​hono/node-server</code> from 2.0.4 to
2.0.10 in /libs/langcha...</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/d829cb490112454b3cf8718a526f28450ff37062"><code>d829cb4</code></a>
chore: version packages (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11204">#11204</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/c8bd4c4a6dbde07fb24deb5870c02dc29c51ab53"><code>c8bd4c4</code></a>
feat(anthropic): add Claude Opus 5 support (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11255">#11255</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/741f380ae54afd2e920495b3042ea6346865836a"><code>741f380</code></a>
chore(deps): bump <code>@​hono/node-server</code> from 2.0.4 to 2.0.10
(<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11244">#11244</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/5103cee12ae0e3e56038f0c20edda5159b252daa"><code>5103cee</code></a>
chore(deps): bump js-yaml from 5.1.0 to 5.2.2 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11256">#11256</a>)</li>
<li><a
href="https://github.com/langchain-ai/langchainjs/commit/db29a6a8060d9d8998f5fb566368e3bad5b32a5b"><code>db29a6a</code></a>
chore(deps): bump axios from 1.16.1 to 1.18.0 (<a
href="https://redirect.github.com/langchain-ai/langchainjs/issues/11228">#11228</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/langchain-ai/langchainjs/compare/@langchain/core@1.2.3...@langchain/core@1.2.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `@langchain/langgraph` from 1.4.8 to 1.4.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/releases">@​langchain/langgraph's
releases</a>.</em></p>
<blockquote>
<h2><code>@​langchain/langgraph</code><a
href="https://github.com/1"><code>@​1</code></a>.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/langchain-ai/langgraphjs/blob/main/libs/langgraph-core/CHANGELOG.md">@​langchain/langgraph's
changelog</a>.</em></p>
<blockquote>
<h2>1.4.9</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/langchain-ai/langgraphjs/pull/2653">#2653</a>
<a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a>
Thanks <a
href="https://github.com/christian-bromann"><code>@​christian-bromann</code></a>!
- fix(langgraph): checkpoint Topic as a flat values list</p>
<p>Match Python Topic checkpoints so Host JS graphs no longer put
<code>__pregel_tasks: [[], []]</code> through the Python checkpointer.
Keep reading legacy <code>[seen, values]</code> checkpoints for restore
compatibility.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/5f9915234a5dca861ef01180fde28e52f42c6e15"><code>5f99152</code></a>
chore: version packages (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2655">#2655</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/7880055ac7303483e424380cdd52f54cd094e311"><code>7880055</code></a>
fix(langgraph): checkpoint Topic as a flat values list (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2653">#2653</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/cac6d3106599b5c9ecff8c00d99a7e78571c5202"><code>cac6d31</code></a>
chore(deps): bump the vite-vitest group across 1 directory with 6
updates (<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2">#2</a>...</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/fa9892117d56398ce0f02f1a73bafb807a61ce2e"><code>fa98921</code></a>
chore(deps-dev): bump <code>@​vitest/browser</code> from 4.1.9 to 4.1.10
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2624">#2624</a>)</li>
<li><a
href="https://github.com/langchain-ai/langgraphjs/commit/cdffd18d192eaa87375bc2d45b343418af8bd024"><code>cdffd18</code></a>
chore(deps): bump the langchain group across 1 directory with 6 updates
(<a
href="https://github.com/langchain-ai/langgraphjs/tree/HEAD/libs/langgraph-core/issues/2616">#2616</a>)</li>
<li>See full diff in <a
href="https://github.com/langchain-ai/langgraphjs/commits/@langchain/langgraph@1.4.9/libs/langgraph-core">compare
view</a></li>
</ul>
</details>
<br />

Updates `typebox` from 1.3.9 to 1.3.10
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sinclairzx81/typebox/commit/221a1de804f08471600ebd4dc8a4460340797d56"><code>221a1de</code></a>
Version 1.3.10 (<a
href="https://redirect.github.com/sinclairzx81/typebox/issues/1662">#1662</a>)</li>
<li><a
href="https://github.com/sinclairzx81/typebox/commit/4992c53f930a675d78acdf5d61a1a12e64e8037a"><code>4992c53</code></a>
Specification</li>
<li>See full diff in <a
href="https://github.com/sinclairzx81/typebox/compare/1.3.9...1.3.10">compare
view</a></li>
</ul>
</details>
<br />

Updates `@ai-sdk/mcp` from 2.0.22 to 2.0.24
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/main/packages/mcp/CHANGELOG.md">@​ai-sdk/mcp's
changelog</a>.</em></p>
<blockquote>
<h2>2.0.24</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [160ccdb]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.20</li>
</ul>
</li>
</ul>
<h2>2.0.23</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [79e133c]
<ul>
<li><code>@​ai-sdk/provider</code><a
href="https://github.com/4"><code>@​4</code></a>.0.5</li>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.19</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18381">#18381</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/mcp/issues/18368">#18368</a>)</li>
<li>See full diff in <a
href="https://github.com/vercel/ai/commits/@ai-sdk/mcp@2.0.24/packages/mcp">compare
view</a></li>
</ul>
</details>
<br />

Updates `@ai-sdk/openai` from 4.0.27 to 4.0.29
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/ai/blob/main/packages/openai/CHANGELOG.md">@​ai-sdk/openai's
changelog</a>.</em></p>
<blockquote>
<h2>4.0.29</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [160ccdb]
<ul>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.20</li>
</ul>
</li>
</ul>
<h2>4.0.28</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [79e133c]
<ul>
<li><code>@​ai-sdk/provider</code><a
href="https://github.com/4"><code>@​4</code></a>.0.5</li>
<li><code>@​ai-sdk/provider-utils</code><a
href="https://github.com/5"><code>@​5</code></a>.0.19</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/ai/commit/22095f409fdf70dc858546fe26b1cf92f12f87f1"><code>22095f4</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18381">#18381</a>)</li>
<li><a
href="https://github.com/vercel/ai/commit/9df82a8bc70f569ae0fbb701a81fd6209ec2a2b7"><code>9df82a8</code></a>
Version Packages (<a
href="https://github.com/vercel/ai/tree/HEAD/packages/openai/issues/18368">#18368</a>)</li>
<li>See full diff in <a
href="https://github.com/vercel/ai/commits/@ai-sdk/openai@4.0.29/packages/openai">compare
view</a></li>
</ul>
</details>
<br />

Updates `@cloudflare/vitest-pool-workers` from 0.18.8 to 0.20.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cloudflare/workers-sdk/releases">@​cloudflare/vitest-pool-workers's
releases</a>.</em></p>
<blockquote>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.20.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]:
<ul>
<li>wrangler@4.118.0</li>
</ul>
</li>
</ul>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.20.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Breaking change: Remove several options from the <code>miniflare</code>
override options</p>
<p>The following options have been removed from the
<code>miniflare</code> override options, as they were not intended to be
exposed, were not functional, or have been superseded by other
options:</p>
<ul>
<li><code>wrappedBindings</code></li>
<li><code>cacheWarnUsage</code></li>
<li><code>fetchMock</code>: you should use <code>outboundService</code>
instead</li>
<li><code>containerEngine</code>: containers were not supported in
vitest-pool-workers. Consider using <a
href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a>
instead if you want to test against actual containers.</li>
</ul>
<p>Additionally, <code>cache</code> has been deprecated and renamed to
<code>cacheAPI</code>, but <code>cache</code> remains functional.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Preserve the deprecated Miniflare <code>cache</code> option</p>
<p>Vitest configurations using <code>cache</code> continue to work after
the internal Miniflare v5 upgrade. The option is translated to
<code>cacheAPI</code>; new configurations should use
<code>cacheAPI</code> directly.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code>
option</p>
<p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare
option, which has been removed. This option was only needed for the
Durable Object isolated storage feature that was dropped in 0.13.0, so
there is no change in behaviour.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p>
<ul>
<li><a
href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li>
<li>wrangler@4.117.0</li>
</ul>
</li>
</ul>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.19.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]:
<ul>
<li>miniflare@4.20260730.0</li>
<li>wrangler@4.116.0</li>
</ul>
</li>
</ul>
<h2><code>@​cloudflare/vitest-pool-workers</code><a
href="https://github.com/0"><code>@​0</code></a>.19.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a>
Thanks <a
href="https://github.com/dmmulroy"><code>@​dmmulroy</code></a>! - Add a
<code>verbose</code> option to <code>cloudflareTest()</code> and
<code>cloudflarePool()</code> configuration</p>
<p>Set <code>verbose: false</code> to suppress verbose workerd runtime
logs, such as caught Durable Object RPC errors. The option defaults to
<code>true</code> to preserve existing output.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md">@​cloudflare/vitest-pool-workers's
changelog</a>.</em></p>
<blockquote>
<h2>0.20.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/cc63aae658c39ae33169c6dc89f2e6ec1071fc53"><code>cc63aae</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/a249591473321cc2fb88a7b62a8c2b8663ebd4ef"><code>a249591</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/f92d1fc1316ba4e5f7e308c79943cb9e34b308c2"><code>f92d1fc</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cec9d8875d3f103acc813724ded980867bd25ed7"><code>cec9d88</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e0bbf55fdce5239a88c78a4350d3287f52d77964"><code>e0bbf55</code></a>]:
<ul>
<li>wrangler@4.118.0</li>
</ul>
</li>
</ul>
<h2>0.20.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Breaking change: Remove several options from the <code>miniflare</code>
override options</p>
<p>The following options have been removed from the
<code>miniflare</code> override options, as they were not intended to be
exposed, were not functional, or have been superseded by other
options:</p>
<ul>
<li><code>wrappedBindings</code></li>
<li><code>cacheWarnUsage</code></li>
<li><code>fetchMock</code>: you should use <code>outboundService</code>
instead</li>
<li><code>containerEngine</code>: containers were not supported in
vitest-pool-workers. Consider using <a
href="https://developers.cloudflare.com/workers/testing/test-harness/"><code>createTestHarness()</code></a>
instead if you want to test against actual containers.</li>
</ul>
<p>Additionally, <code>cache</code> has been deprecated and renamed to
<code>cacheAPI</code>, but <code>cache</code> remains functional.</p>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Preserve the deprecated Miniflare <code>cache</code> option</p>
<p>Vitest configurations using <code>cache</code> continue to work after
the internal Miniflare v5 upgrade. The option is translated to
<code>cacheAPI</code>; new configurations should use
<code>cacheAPI</code> directly.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14586">#14586</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Thanks <a
href="https://github.com/emily-shen"><code>@​emily-shen</code></a>! -
Stop enabling Miniflare's removed <code>unsafeStickyBlobs</code>
option</p>
<p>The pool no longer sets the <code>unsafeStickyBlobs</code> Miniflare
option, which has been removed. This option was only needed for the
Durable Object isolated storage feature that was dropped in 0.13.0, so
there is no change in behaviour.</p>
</li>
<li>
<p>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>]:</p>
<ul>
<li><a
href="mailto:miniflare@5.20260730.0-alpha">miniflare@5.20260730.0-alpha</a></li>
<li>wrangler@4.117.0</li>
</ul>
</li>
</ul>
<h2>0.19.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>Updated dependencies [<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/beec0fbc9d3adec24bc42e31a21fe7f82badb543"><code>beec0fb</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/48f0c6cbbc50dfac02e2d76554c181ced233a792"><code>48f0c6c</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/8049ca451c9561e8b72f3eeeb7916a8712f06133"><code>8049ca4</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/d7f38c311e8cd0f29f56a25250da45f62b20f8ca"><code>d7f38c3</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1394867d1dc357d9bddabf8c16aede47d052fb18"><code>1394867</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/cc5447865022ebc602258cfbeb79953181a62ae0"><code>cc54478</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/5c25cfe4e03e0d3d42ddab57adc3274d6f6a1a30"><code>5c25cfe</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/b21eac24878f060296915f198fae910268c465ef"><code>b21eac2</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/bb09f1bd77a194520db3e61d733996f4bbe4bad8"><code>bb09f1b</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/1f61001e5f7a807db7856f5d89e0b26e12a0d0a0"><code>1f61001</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/01d7020806dd523158cf9f26a4575365117f5381"><code>01d7020</code></a>,
<a
href="https://github.com/cloudflare/workers-sdk/commit/e31ab0f40c5310babd8b493490c0e1ca677e9a8c"><code>e31ab0f</code></a>]:
<ul>
<li>miniflare@4.20260730.0</li>
<li>wrangler@4.116.0</li>
</ul>
</li>
</ul>
<h2>0.19.0</h2>
<h3>Minor Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/cloudflare/workers-sdk/pull/14879">#14879</a>
<a
href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a>
Thanks <a
href="https://github.com/dmmulroy"><code>@​dmmulroy</code></a>! - Add a
<code>verbose</code> option to <code>cloudflareTest()</code> and
<code>cloudflarePool()</code> configuration</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/95d9b12f2c707f254b66b446e0bd9fd6b8b7d96d"><code>95d9b12</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14946">#14946</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/83a37e3ef05d6930f29df904978e7f6eacde2203"><code>83a37e3</code></a>
docs: point vitest-pool-workers BUILD section at the tsdown config (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14940">#14940</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/fcb5402346b2424008c7a0d0612ee8ba2f65bf3e"><code>fcb5402</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14939">#14939</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/5a56ddaf8548fe79787482506b3d5e0233c329c6"><code>5a56dda</code></a>
Miniflare v5 alpha (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14586">#14586</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/96fd16f0e06e82eb99001c70e4935e992e69cb87"><code>96fd16f</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14898">#14898</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/760a85b6fac60b0a73298c99df54ae0058653c76"><code>760a85b</code></a>
Version Packages (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14824">#14824</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/e6480e3c26e849034e9e511a2fd1216257975656"><code>e6480e3</code></a>
[vitest-pool-workers] Make workerd verbose logging configurable (<a
href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/14879">#14879</a>)</li>
<li><a
href="https://github.com/cloudflare/workers-sdk/commit/edc203e42a10a52f8d2af305fecd2fed4807274e"><code>edc203e</code></a>
[vitest-pool-workers] Ignore workerd's ungraceful TLS disconnect
exception lo...</li>
<li>See full diff in <a
href="https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.1/packages/vitest-pool-workers">compare
view</a></li>
</ul>
</details>
<br />

Updates `@cloudflare/workers-types` from 5.20260801.1 to 5.20260804.1
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/cloudflare/workerd/commits">compare
view</a></li>
</ul>
</details>
<br />

Updates `@mastra/core` from 1.52.1 to 1.55.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mastra-ai/mastra/releases">@​mastra/core's
releases</a>.</em></p>
<blockquote>
<h2>July 30, 2026</h2>
<h2>Highlights</h2>
<h3>In-process Code Mode execution (no workspace sandbox required)</h3>
<p>Code Mode transports can now declare <code>requiresSandbox:
false</code>, letting <code>createCodeMode()</code> run without a
workspace sandbox for in-process execution boundaries. This enables
secure in-process runtimes like V8 isolates and exports
<code>sanitizeToolId</code> so transports can share consistent
<code>external_*</code> naming.</p>
<h3>New <code>@mastra/isolated-vm</code> package for V8-isolated Code
Mode</h3>
<p>Introduces <code>@mastra/isolated-vm</code> with
<code>IsolatedVmCodeModeTransport</code>, running model-authored
programs inside an in-process V8 isolate with no
filesystem/network/process access (only bridged <code>external_*</code>
tools). Note: requires <code>isolated-vm</code> native addon and Node
20+ hosts must start with <code>--no-node-snapshot</code>.</p>
<h3>Built-in provider-native Web Search tool</h3>
<p><code>@mastra/core</code> adds <code>webSearchTool</code>, a
first-party web search tool that resolves to provider-native search when
supported by the configured model/provider, simplifying “current info”
agent setups.</p>
<h3>Stored agent drafts via <code>autoPublish</code> (Server + JS
SDK)</h3>
<p>Both <code>@mastra/server</code> and <code>@mastra/client-js</code>
add <code>autoPublish</code> to stored agent creation so you can create
an initial unpublished draft for review before publishing (existing
calls still publish immediately by default).</p>
<h3>New Factory channel identity domain + channels integration slot</h3>
<p><code>@mastra/factory</code> adds a <code>channel-identity</code>
storage domain to link chat-platform senders to Factory users, plus a
<code>channels()</code> integration slot to attach an
<code>AgentControllerChannels</code> during <code>prepare()</code> so
inbound platform messages can drive the same agents as the web UI.</p>
<h3>Breaking Changes</h3>
<ul>
<li><code>ChannelHandler</code> context parameter is now required: the
4th parameter is <code>ctx: ChannelHandlerContext</code> (non-optional).
Code that <em>calls</em> a <code>ChannelHandler</code>-typed function
with only three args must be updated to pass <code>ctx</code>.</li>
</ul>
<h2>Changelog</h2>
<h3><a
href="https://github.com/mastra-ai/mastra/blob/@mastra/core@1.55.0/packages/core/CHANGELOG.md">@​mastra/core@1.55.0</a></h3>
<h4>Minor Changes</h4>
<ul>
<li>
<p>Added support for Code Mode transports that provide their own
execution boundary. A transport can now declare <code>requiresSandbox:
false</code> and <code>createCodeMode()</code> will run it without a
workspace sandbox, which enables in-process transports such as
<code>IsolatedVmCodeModeTransport</code> from
<code>@mastra/isolated-vm</code>: (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/20359">#20359</a>)</p>
<pre lang="typescript"><code>import { createCodeMode } from
'@mastra/core/tools';
import { IsolatedVmCodeModeTransport } from '@mastra/isolated-vm';
<p>// No sandbox needed — the V8 isolate is the execution boundary
const { tool, instructions } = createCodeMode({ tools }, new
IsolatedVmCodeModeTransport());
</code></pre></p>
<p>Also fixed the generated Code Mode instructions to describe isolation
accurately instead of always claiming the program runs fully sandboxed,
since the actual boundary depends on the configured sandbox and
transport. The <code>sanitizeToolId</code> helper used for
<code>external_*</code> naming is now exported from
<code>@mastra/core/tools</code> so transports can reuse it instead of
duplicating it.</p>
</li>
<li>
<p>Added retry callbacks for stream error policies and ensured explicit
matcher policies override provider retry metadata. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/19724">#19724</a>)</p>
</li>
<li>
<p>Channel handlers can now contribute to the request context of the run
they start. (<a
href="https://redirect.github.com/mastra-ai/mastra/pull/20060">#20060</a>)</p>
<p><code>ChannelHandlerContext</code> gains a
<code>requestContext</code> field holding the
<code>RequestContext</code> for the run the inbound message is about to
start. It is constructed fresh for every message, and a handler may
write to it before calling <code>defaultHandler</code>. Core then adds
its own channel and render-context entries and dispatches with the same
instance, so anything the handler wrote reaches the run.</p>
<pre lang="ts"><code>import { AgentControllerChannels } from
'@mastra/core/channels';
<p>const channels = new AgentControllerChannels({
adapters,
handlers: {
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mastra-ai/mastra/commit/bccb45d579ae7a914b9c03733f919127952c2300"><code>bccb45d</code></a>
chore: version - exit prerelease mode</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/469696312ac4c618bc8475b0c5ed7949b8a3455e"><code>4696963</code></a>
fix(core): persist delegation prompt exactly once in sub-agent threads
(<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20174">#20174</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/6b861234d6728e50c7b424d504024b468d6db2b8"><code>6b86123</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20419">#20419</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/723aa5437106bdb708ae03c0ef6b77aa11291e73"><code>723aa54</code></a>
feat(factory): stricter review agent — weigh existing comments,
calibrated ve...</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/ef8a7ceb6d663723e5e09aa6ebabc716665325af"><code>ef8a7ce</code></a>
chore: version packages (alpha) (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20358">#20358</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/07f5b4ba9d608d88865030732e580298296adf99"><code>07f5b4b</code></a>
fix(core): avoid serializing result comparisons (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20340">#20340</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/9c16d7b20f02b5bfd1152861a69fd6694c26f4b3"><code>9c16d7b</code></a>
chore: regenerate providers and docs [skip ci]</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/55c9e248c27c1d72b5bb7e94ea6b8a3999eee49f"><code>55c9e24</code></a>
Run Slack messages as the sender's Mastra tenant (<a
href="https://github.com/mastra-ai/mastra/tree/HEAD/packages/core/issues/20060">#20060</a>)</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/cfb2899d510252f39ddf46fb75c35c11fb4a36f4"><code>cfb2899</code></a>
chore: version packages</li>
<li><a
href="https://github.com/mastra-ai/mastra/commit/ba369f2a0aaf998da0d6aa033d26f64f96bef8ac"><code>ba369f2</code></a>
feat(isolated-vm): add IsolatedVmCodeModeTransport for in-process Code
Mode i...</li>
<li>Additional commits viewable in <a
href="https://github.com/mastra-ai/mastra/commits/@mastra/core@1.55.0/packages/core">compare
view</a></li>
</ul>
</details>
<br />

Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.30.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/typescript-sdk/releases">@​modelcontextprotocol/sdk's
releases</a>.</em></p>
<blockquote>
<h2>1.30.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix(server): prioritize zod issues and format them by <a
href="https://github.com/mozmo15"><code>@​mozmo15</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li>
<li>chore(ci): switch publish to OIDC trusted publishing by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1839">modelcontextprotocol/typescript-sdk#1839</a></li>
<li>Add end-to-end test suite by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2167">modelcontextprotocol/typescript-sdk#2167</a></li>
<li>v1 stdio buffer limit by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2239">modelcontextprotocol/typescript-sdk#2239</a></li>
<li>fix: support Zod 3.25 method literals by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2368">modelcontextprotocol/typescript-sdk#2368</a></li>
<li>Validate Content-Type by parsed media type instead of substring
match (v1.x) by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2444">modelcontextprotocol/typescript-sdk#2444</a></li>
<li>fix: send SSE keep-alive comment frames from Streamable HTTP server
transport (v1.x) by <a
href="https://github.com/mattzcarey"><code>@​mattzcarey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2538">modelcontextprotocol/typescript-sdk#2538</a></li>
<li>fix(deps): widen <code>@​hono/node-server</code> past
GHSA-frvp-7c67-39w9 by <a
href="https://github.com/arimu1"><code>@​arimu1</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li>
<li>Fix SSE keep-alive timer lifecycle in Streamable HTTP server
transport (v1.x) by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2547">modelcontextprotocol/typescript-sdk#2547</a></li>
<li>chore: bump version to 1.30.0 by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2563">modelcontextprotocol/typescript-sdk#2563</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/mozmo15"><code>@​mozmo15</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1503">modelcontextprotocol/typescript-sdk#1503</a></li>
<li><a href="https://github.com/arimu1"><code>@​arimu1</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/2549">modelcontextprotocol/typescript-sdk#2549</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.29.0...1.30.0</a></p>
<h2>v1.29.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: treat v1.x as primary branch for npm latest tag (backport <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1577">#1577</a>)
by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1749">modelcontextprotocol/typescript-sdk#1749</a></li>
<li>[v1.x] fix: disallow null (infinite) requested TTL by <a
href="https://github.com/LucaButBoring"><code>@​LucaButBoring</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1339">modelcontextprotocol/typescript-sdk#1339</a></li>
<li>[v1.x] fix: add missing size field to ResourceSchema by <a
href="https://github.com/olaservo"><code>@​olaservo</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1575">modelcontextprotocol/typescript-sdk#1575</a></li>
<li>Add typings exports by <a
href="https://github.com/tdraier"><code>@​tdraier</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li>
<li>v1.x npm audit fix by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1780">modelcontextprotocol/typescript-sdk#1780</a></li>
<li>v1.x <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/1623">#1623</a>
follow up -add missing types to package.json by <a
href="https://github.com/KKonstantinov"><code>@​KKonstantinov</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1773">modelcontextprotocol/typescript-sdk#1773</a></li>
<li>[v1.x backport] Allow servers / clients to advertise extensions in
the capability object by <a
href="https://github.com/localden"><code>@​localden</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1811">modelcontextprotocol/typescript-sdk#1811</a></li>
<li>fix(stdio): always set windowsHide on Windows, not just in Electron
by <a href="https://github.com/jnMetaCode"><code>@​jnMetaCode</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li>
<li>chore: bump version to 1.29.0 by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1820">modelcontextprotocol/typescript-sdk#1820</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/tdraier"><code>@​tdraier</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1623">modelcontextprotocol/typescript-sdk#1623</a></li>
<li><a
href="https://github.com/jnMetaCode"><code>@​jnMetaCode</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1640">modelcontextprotocol/typescript-sdk#1640</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0">https://github.com/modelcontextprotocol/typescript-sdk/compare/v1.28.0...v1.29.0</a></p>
<h2>v1.28.0</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: use scopes_supported from resource metadata by default (fixes
<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/580">#580</a>)
by <a href="https://github.com/antogyn"><code>@​antogyn</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li>
<li>[v1.x backport] Default to client_secret_basic when server omits
token_endpoint_auth_methods_supported by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1611">modelcontextprotocol/typescript-sdk#1611</a></li>
<li>fix: reject plain JSON Schema objects passed as inputSchema by <a
href="https://github.com/tiluckdave"><code>@​tiluckdave</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li>
<li>fix: clear _timeoutInfo in _onclose() and scope .finally() abort
controller cleanup by <a
href="https://github.com/pcarleton"><code>@​pcarleton</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1462">modelcontextprotocol/typescript-sdk#1462</a></li>
<li>fix(server/auth): RFC 8252 loopback port relaxation by <a
href="https://github.com/poteat"><code>@​poteat</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li>
<li>chore: bump version to 1.28.0 by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1746">modelcontextprotocol/typescript-sdk#1746</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/antogyn"><code>@​antogyn</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/757">modelcontextprotocol/typescript-sdk#757</a></li>
<li><a
href="https://github.com/tiluckdave"><code>@​tiluckdave</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1596">modelcontextprotocol/typescript-sdk#1596</a></li>
<li><a href="https://github.com/poteat"><code>@​poteat</code></a> made
their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/pull/1738">modelcontextprotocol/typescript-sdk#1738</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/2d889f2b329e46680ec9bdd565de4616c497825a"><code>2d889f2</code></a>
chore: bump version to 1.30.0 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2563">#2563</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e3f3daa12cc2603919939b72136ce9d9e800b868"><code>e3f3daa</code></a>
Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport
(v1.x)...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/bb5a718cbf90796bacbf62218b359196d210426b"><code>bb5a718</code></a>
fix(deps): widen <code>@​hono/node-server</code> past
GHSA-frvp-7c67-39w9 (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2549">#2549</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/1dad2634ce5799fb386283d14291d1b4935a9a52"><code>1dad263</code></a>
fix: send SSE keep-alive comment frames from Streamable HTTP server
transport...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/69749aa5081ddfe675d36da8d96c7e27d83742b8"><code>69749aa</code></a>
Validate Content-Type by parsed media type instead of substring match
(v1.x) ...</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/369513df7b0e9d8a979c86f68ba1930e0d5f27f0"><code>369513d</code></a>
fix: support Zod 3.25 method literals (<a
href="https://redirect.github.com/modelcontextprotocol/typescript-sdk/issues/2368">#2368</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/typescript-sdk/commit/e7ee57c2f33b8290a78a3cefa27ab635fe67fbff"><code>e7ee57c</code></a>
v1 stdio buffer limit (<a
href="https://redirect.github.com/modelcontextprotocol...

_Description has been truncated_

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: jkomyno <12381818+jkomyno@users.noreply.github.com>
 2026-08-07 18:41:15 +05:30
dependabot[bot] dda31cf3cb chore(deps): bump the github-actions group with 2 updates (#4089) 
Bumps the github-actions group with 2 updates:
[anthropics/claude-code-action](https://github.com/anthropics/claude-code-action)
and
[anthropics/claude-code-action/base-action](https://github.com/anthropics/claude-code-action).

Updates `anthropics/claude-code-action` from 1.0.183 to 1.0.185
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.185</h2>
<h2>What's Changed</h2>
<ul>
<li>Derive trigger timestamps for issues and pull_request events by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1592">anthropics/claude-code-action#1592</a></li>
<li>Pin bun config for MCP server processes by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1589">anthropics/claude-code-action#1589</a></li>
<li>Match downloaded images to their source URLs by asset identifier by
<a href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1588">anthropics/claude-code-action#1588</a></li>
<li>Check collaborator permissions for workflow_run events by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1590">anthropics/claude-code-action#1590</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185</a></p>
<h2>v1.0.184</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/9db594c7a0e82298c121c18b7f08aa1579ce7341"><code>9db594c</code></a>
chore: bump Claude Code to 2.1.222 and Agent SDK to 0.3.222</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/acb0385805f08d88fa4906025a41975ee6122e32"><code>acb0385</code></a>
Check collaborator permissions for workflow_run events (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1590">#1590</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/b80a0f042f2ff42ebd031d911263a059bdd9bd85"><code>b80a0f0</code></a>
Match downloaded images to their source URLs by asset identifier (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1588">#1588</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/6fb6bb685891c44ad1313dedad3640bcd1f485c9"><code>6fb6bb6</code></a>
Pin bun config for MCP server processes (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1589">#1589</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/b2963b9127309fd8ef897bb24a5d79761d566111"><code>b2963b9</code></a>
Derive trigger timestamps for issues and pull_request events (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1592">#1592</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/86180fa9e4d311eed10c9cc49854c53dab5d517a"><code>86180fa</code></a>
chore: bump Claude Code to 2.1.221 and Agent SDK to 0.3.221</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-code-action/compare/be7b93b1907a4abad570368f3c74b6fe3807510b...9db594c7a0e82298c121c18b7f08aa1579ce7341">compare
view</a></li>
</ul>
</details>
<br />

Updates `anthropics/claude-code-action/base-action` from 1.0.183 to
1.0.185
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/claude-code-action/releases">anthropics/claude-code-action/base-action's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.185</h2>
<h2>What's Changed</h2>
<ul>
<li>Derive trigger timestamps for issues and pull_request events by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1592">anthropics/claude-code-action#1592</a></li>
<li>Pin bun config for MCP server processes by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1589">anthropics/claude-code-action#1589</a></li>
<li>Match downloaded images to their source URLs by asset identifier by
<a href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in
<a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1588">anthropics/claude-code-action#1588</a></li>
<li>Check collaborator permissions for workflow_run events by <a
href="https://github.com/ashwin-ant"><code>@​ashwin-ant</code></a> in <a
href="https://redirect.github.com/anthropics/claude-code-action/pull/1590">anthropics/claude-code-action#1590</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.185</a></p>
<h2>v1.0.184</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184">https://github.com/anthropics/claude-code-action/compare/v1...v1.0.184</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/9db594c7a0e82298c121c18b7f08aa1579ce7341"><code>9db594c</code></a>
chore: bump Claude Code to 2.1.222 and Agent SDK to 0.3.222</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/acb0385805f08d88fa4906025a41975ee6122e32"><code>acb0385</code></a>
Check collaborator permissions for workflow_run events (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1590">#1590</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/b80a0f042f2ff42ebd031d911263a059bdd9bd85"><code>b80a0f0</code></a>
Match downloaded images to their source URLs by asset identifier (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1588">#1588</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/6fb6bb685891c44ad1313dedad3640bcd1f485c9"><code>6fb6bb6</code></a>
Pin bun config for MCP server processes (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1589">#1589</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/b2963b9127309fd8ef897bb24a5d79761d566111"><code>b2963b9</code></a>
Derive trigger timestamps for issues and pull_request events (<a
href="https://redirect.github.com/anthropics/claude-code-action/issues/1592">#1592</a>)</li>
<li><a
href="https://github.com/anthropics/claude-code-action/commit/86180fa9e4d311eed10c9cc49854c53dab5d517a"><code>86180fa</code></a>
chore: bump Claude Code to 2.1.221 and Agent SDK to 0.3.221</li>
<li>See full diff in <a
href="https://github.com/anthropics/claude-code-action/compare/be7b93b1907a4abad570368f3c74b6fe3807510b...9db594c7a0e82298c121c18b7f08aa1579ce7341">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-07 16:54:15 +05:30
dependabot[bot] 2cab683f0e chore(deps-dev): bump the npm-development group with 6 updates (#4091) 
Bumps the npm-development group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.2.0` |
`17.3.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.76.0` | `1.77.0` |
|
[oxlint-plugin-eslint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint)
| `1.76.0` | `1.77.0` |
|
[@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver)
| `7.7.1` | `7.8.0` |
|
[@earendil-works/pi-coding-agent](https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent)
| `0.82.1` | `0.83.0` |
| [eve](https://github.com/vercel/eve/tree/HEAD/packages/eve) |
`0.27.13` | `0.29.5` |

Updates `lint-staged` from 17.2.0 to 17.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/releases">lint-staged's
releases</a>.</em></p>
<blockquote>
<h2>v17.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a>
- It is now possible to run multiple tasks in parallel for a single glob
by configuring it with an array of tasks (which run sequentially), and
then placing another array inside it (where the tasks will run in
parallel). The following demonstrates the order tasks will start in:</p>
<pre lang="json"><code>{
&quot;*.ts&quot;: [&quot;first&quot;, &quot;second&quot;,
[&quot;third&quot;, &quot;third&quot;], &quot;fourth&quot;]
}
</code></pre>
<p>As a concrete example, <em>lint-staged</em>'s own configuration
is:</p>
<pre lang="js"><code>/** @type {import('./lib/index.js').Configuration}
*/
export default {
  &quot;*&quot;: [
    [
      &quot;oxfmt --check --no-error-on-unmatched-pattern&quot;,
      &quot;oxlint --no-error-on-unmatched-pattern&quot;,
    ],
  ],
  &quot;*.ts&quot;: () =&gt; &quot;tsc&quot;,
};
</code></pre>
<p>which means:</p>
<ol>
<li>for all staged files, run the two commands in parallel with staged
filenames appended, for example:
<ul>
<li><code>oxfmt --check --no-error-on-unmatched-pattern
lib/index.js</code></li>
<li><code>oxlint --no-error-on-unmatched-pattern
lib/index.js</code></li>
</ul>
</li>
<li>additionally, if any <code>*.ts</code> files are staged, run
<code>tsc</code> without appending any arguments</li>
<li>The two sets of commands also run in parallel</li>
</ol>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
- During an in-progress merge, files that are unchanged from the branch
being merged are now skipped. Technically, files are only included if
there are staged changes against both <code>HEAD</code> and
<code>MERGE_HEAD</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md">lint-staged's
changelog</a>.</em></p>
<blockquote>
<h2>17.3.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1825">#1825</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/16b3f74850e5d2811b5fbaea6c136733a71ad3e4"><code>16b3f74</code></a>
- It is now possible to run multiple tasks in parallel for a single glob
by configuring it with an array of tasks (which run sequentially), and
then placing another array inside it (where the tasks will run in
parallel). The following demonstrates the order tasks will start in:</p>
<pre lang="json"><code>{
&quot;*.ts&quot;: [&quot;first&quot;, &quot;second&quot;,
[&quot;third&quot;, &quot;third&quot;], &quot;fourth&quot;]
}
</code></pre>
<p>As a concrete example, <em>lint-staged</em>'s own configuration
is:</p>
<pre lang="js"><code>/** @type {import('./lib/index.js').Configuration}
*/
export default {
  &quot;*&quot;: [
    [
      &quot;oxfmt --check --no-error-on-unmatched-pattern&quot;,
      &quot;oxlint --no-error-on-unmatched-pattern&quot;,
    ],
  ],
  &quot;*.ts&quot;: () =&gt; &quot;tsc&quot;,
};
</code></pre>
<p>which means:</p>
<ol>
<li>for all staged files, run the two commands in parallel with staged
filenames appended, for example:
<ul>
<li><code>oxfmt --check --no-error-on-unmatched-pattern
lib/index.js</code></li>
<li><code>oxlint --no-error-on-unmatched-pattern
lib/index.js</code></li>
</ul>
</li>
<li>additionally, if any <code>*.ts</code> files are staged, run
<code>tsc</code> without appending any arguments</li>
<li>The two sets of commands also run in parallel</li>
</ol>
</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li><a
href="https://redirect.github.com/lint-staged/lint-staged/pull/1829">#1829</a>
<a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
- During an in-progress merge, files that are unchanged from the branch
being merged are now skipped. Technically, files are only included if
there are staged changes against both <code>HEAD</code> and
<code>MERGE_HEAD</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/d15344350d914f5ce24df2c85f3ffebb9b387f3b"><code>d153443</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1828">#1828</a>
from lint-staged/changeset-release/main</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/5162c149bbfa09b8a5ad4d37c647d63946568ca8"><code>5162c14</code></a>
chore(changeset): release</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/a4db9a4c32f108d1397436752be7e9dda956baa2"><code>a4db9a4</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1831">#1831</a>
from lint-staged/linter-updates</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/ea96cab0109ab44a5b2562927b890648ee32b4cc"><code>ea96cab</code></a>
style: enable oxlint &quot;suspicious&quot; category</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/2fae00778cea0c99da9bcb8bad4718dce08ea04e"><code>2fae007</code></a>
style: add <code>@e18e/eslint-plugin</code></li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/2280c38a09ff4ca4db60320b5879e0029527afaa"><code>2280c38</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1829">#1829</a>
from lint-staged/fix-merge-conflict-files</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/1453ae6ae0e05275d714ad0cad7cd090885f504d"><code>1453ae6</code></a>
test: relax assertion so that it passes in worktree</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/15f7e5314b4afe4702808d978758b22d42437f43"><code>15f7e53</code></a>
fix: lint only files changed against HEAD and MERGE_HEAD, during a
merge</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/dedfc31007aed50e1c9c5591a11085cb485ba41c"><code>dedfc31</code></a>
Merge pull request <a
href="https://redirect.github.com/lint-staged/lint-staged/issues/1825">#1825</a>
from lint-staged/parallel-tasks-inside-sequence</li>
<li><a
href="https://github.com/lint-staged/lint-staged/commit/286e25cef9fde2fb6e77d2312fd91ac99020d69d"><code>286e25c</code></a>
feat: allow running parallel tasks by nesting arrays</li>
<li>Additional commits viewable in <a
href="https://github.com/lint-staged/lint-staged/compare/v17.2.0...v17.3.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.76.0 to 1.77.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.27.0 &amp;&amp; oxfmt v0.12.0</h2>
<h1>Oxlint v1.27.0</h1>
<h3>🚀 Features</h3>
<ul>
<li>222a8f0 linter/plugins: Implement
<code>SourceCode#isSpaceBetween</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15498">#15498</a>)
(overlookmotel)</li>
<li>2f9735d linter/plugins: Implement
<code>context.languageOptions</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15486">#15486</a>)
(overlookmotel)</li>
<li>bc731ff linter/plugins: Stub out all <code>Context</code> APIs (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15479">#15479</a>)
(overlookmotel)</li>
<li>5822cb4 linter/plugins: Add <code>extend</code> method to
<code>FILE_CONTEXT</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15477">#15477</a>)
(overlookmotel)</li>
<li>7b1e6f3 apps: Add pure rust binaries and release to github (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15469">#15469</a>)
(Boshen)</li>
<li>2a89b43 linter: Introduce debug assertions after fixes to assert
validity (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15389">#15389</a>)
(camc314)</li>
<li>ad3c45a editor: Add <code>oxc.path.node</code> option (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15040">#15040</a>)
(Sysix)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>6f3cd77 linter/no-var: Incorrect warning for blocks (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15504">#15504</a>)
(Hamir Mahal)</li>
<li>6957fb9 linter/plugins: Do not allow access to
<code>Context#id</code> in <code>createOnce</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15489">#15489</a>)
(overlookmotel)</li>
<li>7409630 linter/plugins: Allow access to <code>cwd</code> in
<code>createOnce</code> in ESLint interop mode (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15488">#15488</a>)
(overlookmotel)</li>
<li>732205e parser: Reject <code>using</code> / <code>await using</code>
in a switch <code>case</code> / <code>default</code> clause (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15225">#15225</a>)
(sapphi-red)</li>
<li>a17ca32 linter/plugins: Replace <code>Context</code> class (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15448">#15448</a>)
(overlookmotel)</li>
<li>ecf2f7b language_server: Fail gracefully when tsgolint executable
not found (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15436">#15436</a>)
(camc314)</li>
<li>3c8d3a7 lang-server: Improve logging in failure case for tsgolint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15299">#15299</a>)
(camc314)</li>
<li>ef71410 linter: Use jsx if source type is JS in fix debug assertion
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15434">#15434</a>)
(camc314)</li>
<li>e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15426">#15426</a>)
(camc314)</li>
<li>6565dbe linter/switch-case-braces: Skip comments when searching for
<code>:</code> token (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15425">#15425</a>)
(camc314)</li>
<li>85bd19a linter/prefer-class-fields: Insert value after type
annotation in fixer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15423">#15423</a>)
(camc314)</li>
<li>fde753e linter/plugins: Block access to
<code>context.settings</code> in <code>createOnce</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15394">#15394</a>)
(overlookmotel)</li>
<li>ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper
in invalid positions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15388">#15388</a>)
(camc314)</li>
<li>dac2a9c linter/no-template-curly-in-string: Remove fixer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15387">#15387</a>)
(camc314)</li>
<li>989b8e3 linter/no-var: Only fix to <code>const</code> if the var has
an initializer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15385">#15385</a>)
(camc314)</li>
<li>cc403f5 linter/plugins: Return empty object for unimplemented
parserServices (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15364">#15364</a>)
(magic-akari)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>25d577e language_server: Start tools in parallel (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15500">#15500</a>)
(Sysix)</li>
<li>3c57291 linter/plugins: Optimize loops (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15449">#15449</a>)
(overlookmotel)</li>
<li>3166233 linter/plugins: Remove <code>Arc</code>s (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15431">#15431</a>)
(overlookmotel)</li>
<li>9de1322 linter/plugins: Lazily deserialize settings JSON (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15395">#15395</a>)
(overlookmotel)</li>
<li>3049ec2 linter/plugins: Optimize <code>deepFreezeSettings</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15392">#15392</a>)
(overlookmotel)</li>
<li>444ebfd linter/plugins: Use single object for
<code>parserServices</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15378">#15378</a>)
(overlookmotel)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>97d2104 linter: Update comment in lint.rs about default value for
tsconfig path (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15530">#15530</a>)
(Connor Shea)</li>
<li>2c6bd9e linter: Always refer as &quot;ES2015&quot; instead of
&quot;ES6&quot; (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15411">#15411</a>)
(sapphi-red)</li>
<li>a0c5203 linter/import/named: Update &quot;ES7&quot; comment in
examples (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15410">#15410</a>)
(sapphi-red)</li>
<li>3dc24b5 linter,minifier: Always refer as &quot;ES Modules&quot;
instead of &quot;ES6 Modules&quot; (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15409">#15409</a>)
(sapphi-red)</li>
<li>2ad77fb linter/no-this-before-super: Correct &quot;Why is this
bad?&quot; section (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15408">#15408</a>)
(sapphi-red)</li>
<li>57f0ce1 linter: Add backquotes where appropriate (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15407">#15407</a>)
(sapphi-red)</li>
</ul>
<h1>Oxfmt v0.12.0</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.77.0] - 2026-08-03</h2>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>5c0fa61 linter/eslint/no-warning-comments: Unify config structs and
remove manual options docs (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25151">#25151</a>)
(Mikhail Baev)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>9dc7756 linter/typescript/no-unnecessary-condition: Clarify options
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)
(camc314)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a>
release(apps): oxlint v1.77.0 &amp;&amp; oxfmt v0.62.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25251">#25251</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/5c0fa61ddbd098fea5101dff356dc9b67adbee95"><code>5c0fa61</code></a>
fix(linter/eslint/no-warning-comments): unify config structs and remove
manua...</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9dc77567291db6ebd0641284f80bf50163c6a257"><code>9dc7756</code></a>
docs(linter/typescript/no-unnecessary-condition): clarify options (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.77.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-plugin-eslint` from 1.76.0 to 1.77.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a>
release(apps): oxlint v1.77.0 &amp;&amp; oxfmt v0.62.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint-plugin-eslint/issues/25251">#25251</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/apps_v1.77.0/npm/oxlint-plugin-eslint">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/semver` from 7.7.1 to 7.8.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver">compare
view</a></li>
</ul>
</details>
<br />

Updates `@earendil-works/pi-coding-agent` from 0.82.1 to 0.83.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/releases">@​earendil-works/pi-coding-agent's
releases</a>.</em></p>
<blockquote>
<h2>v0.83.0</h2>
<h3>New Features</h3>
<ul>
<li><strong>Credential export for external clients</strong> — <code>pi
auth print-api-key</code> and <code>pi auth print-bearer-token</code>
export configured credentials with automatic OAuth refresh and
minimum-validity enforcement.</li>
<li><strong>Headless OpenRouter sign-in</strong> — Complete
<code>/login</code> over SSH by pasting the redirect URL or
authorization code when the loopback callback is unavailable. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li>
<li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5
through GitHub Copilot with adaptive thinking and a 1M context window.
See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs
including <code>Type.Base</code>, <code>Type.Awaited</code>,
<code>Type.Promise</code>, <code>Type.AsyncIterator</code>,
<code>Type.Iterator</code>, <code>Type.Options</code>, and
<code>Value.Mutate</code>, while fixing compiled validation of nullable
array tool arguments. Extensions using removed APIs must migrate to
supported TypeBox APIs. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#dependencies">Package
Dependencies</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a>
by <a
href="https://github.com/petrroll"><code>@​petrroll</code></a>).</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added <code>pi auth print-api-key</code> and <code>pi auth
print-bearer-token</code> commands for exporting configured credentials
to external clients, including automatic OAuth refresh and configurable
minimum token validity (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
<li>Exposed the session's resolved model scope as
<code>ctx.scopedModels</code> to extensions. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension
Context</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a>
by <a href="https://github.com/pungggi"><code>@​pungggi</code></a>, <a
href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li>
<li>Added inherited per-request <code>fetch</code> injection for
supported text and image provider transports.</li>
<li>Added the inherited <code>&quot;pending&quot;</code> stop reason for
partial streaming messages. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom
Provider Stream Pattern</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a>
by <a
href="https://github.com/lucasmeijer"><code>@​lucasmeijer</code></a>).</li>
<li>Added inherited raw provider stop reasons across Google, Anthropic,
Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons
now surface as provider errors instead of successful stops (<a
href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li>
<li>Added manual redirect URL and authorization-code entry to OpenRouter
login for remote and headless environments. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a>
by <a
href="https://github.com/rgarcia"><code>@​rgarcia</code></a>).</li>
<li>Added inherited Claude Opus 5 support for GitHub Copilot with
adaptive thinking and a 1M context window. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a>
by <a
href="https://github.com/jay-aye-see-kay"><code>@​jay-aye-see-kay</code></a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Changed inherited OAuth credential resolution to refresh tokens with
less than five minutes of validity remaining instead of waiting until
expiration (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Added a status line when the tool output expansion is toggled (<a
href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li>
<li>Fixed file-backed <code>SYSTEM.md</code> and
<code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive
startup context listing. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#system-prompt-files">System
Prompt Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li>
<li>Fixed context files loading twice when a linked Git worktree is
nested under its main repository. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#context-files">Context
Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a>
by <a
href="https://github.com/arajkumar"><code>@​arajkumar</code></a>).</li>
<li>Fixed llama.cpp streamed responses reporting zero token usage and
leaving session context accounting empty. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a>
by <a
href="https://github.com/SteveImmanuel"><code>@​SteveImmanuel</code></a>).</li>
<li>Fixed session replacement and committed tree navigation during an
active response to abort and persist the outgoing turn instead of
leaving dangling tool calls. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/usage.md#sessions">Sessions</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a>
by <a
href="https://github.com/tmustier"><code>@​tmustier</code></a>).</li>
<li>Fixed failed Git package installs leaving partial directories that
blocked clean retries. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/packages.md#install-and-manage">Install
and Manage</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a>
by <a
href="https://github.com/haoqixu"><code>@​haoqixu</code></a>).</li>
<li>Fixed the <code>/model</code> selector retaining a stale selection
while filtering instead of highlighting the top match (<a
href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed direct RPC bash commands bypassing extension
<code>user_bash</code> handlers. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#user-bash-events">User
Bash Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li>
<li>Fixed skills, prompts, and themes losing package source metadata
after extensions reload resources. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/extensions.md#resource-events">Resource
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li>
<li>Fixed cancellation of concurrently running user bash commands so
every active command is aborted (<a
href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed duplicate messages appearing when extensions switch sessions
during interactive startup (<a
href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed inherited Qwen Token Plan reasoning models to send their
service-specific thinking controls and supported reasoning-effort levels
(<a
href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>,
<a
href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li>
<li>Fixed inherited Z.AI output limits being sent through an unsupported
parameter. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md">Providers</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a>
by <a
href="https://github.com/HyeokjaeLee"><code>@​HyeokjaeLee</code></a>).</li>
<li>Fixed explicitly configured Amazon Bedrock profiles being overridden
by ambient AWS access keys. See <a
href="https://github.com/earendil-works/pi/blob/v0.83.0/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon
Bedrock</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed inherited image fallback paths overflowing narrow terminals,
shortened home-directory paths, and made absolute paths clickable when
terminal hyperlinks are available (<a
href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li>
<li>Fixed inherited OpenAI-compatible tool calls losing their function
arguments when malformed deltas also contain an empty
<code>custom</code> object (<a
href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a>
by <a
href="https://github.com/sunnyyoung"><code>@​sunnyyoung</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/CHANGELOG.md">@​earendil-works/pi-coding-agent's
changelog</a>.</em></p>
<blockquote>
<h2>[0.83.0] - 2026-07-29</h2>
<h3>New Features</h3>
<ul>
<li><strong>Credential export for external clients</strong> — <code>pi
auth print-api-key</code> and <code>pi auth print-bearer-token</code>
export configured credentials with automatic OAuth refresh and
minimum-validity enforcement.</li>
<li><strong>Headless OpenRouter sign-in</strong> — Complete
<code>/login</code> over SSH by pasting the redirect URL or
authorization code when the loopback callback is unavailable. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>.</li>
<li><strong>Claude Opus 5 on GitHub Copilot</strong> — Use Claude Opus 5
through GitHub Copilot with adaptive thinking and a 1M context window.
See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a>.</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Upgraded bundled TypeBox aliases to 1.3.7, removing deprecated APIs
including <code>Type.Base</code>, <code>Type.Awaited</code>,
<code>Type.Promise</code>, <code>Type.AsyncIterator</code>,
<code>Type.Iterator</code>, <code>Type.Options</code>, and
<code>Value.Mutate</code>, while fixing compiled validation of nullable
array tool arguments. Extensions using removed APIs must migrate to
supported TypeBox APIs. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#dependencies">Package
Dependencies</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7243">#7243</a>
by <a
href="https://github.com/petrroll"><code>@​petrroll</code></a>).</li>
</ul>
<h3>Added</h3>
<ul>
<li>Added <code>pi auth print-api-key</code> and <code>pi auth
print-bearer-token</code> commands for exporting configured credentials
to external clients, including automatic OAuth refresh and configurable
minimum token validity (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
<li>Exposed the session's resolved model scope as
<code>ctx.scopedModels</code> to extensions. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#ctxmodelregistry--ctxmodel--ctxthinkinglevel--ctxscopedmodels">Extension
Context</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7191">#7191</a>
by <a href="https://github.com/pungggi"><code>@​pungggi</code></a>, <a
href="https://redirect.github.com/earendil-works/pi/pull/7215">#7215</a>).</li>
<li>Added inherited per-request <code>fetch</code> injection for
supported text and image provider transports.</li>
<li>Added the inherited <code>&quot;pending&quot;</code> stop reason for
partial streaming messages. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/custom-provider.md#stream-pattern">Custom
Provider Stream Pattern</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7151">#7151</a>
by <a
href="https://github.com/lucasmeijer"><code>@​lucasmeijer</code></a>).</li>
<li>Added inherited raw provider stop reasons across Google, Anthropic,
Amazon Bedrock, Mistral, and OpenAI streams; unmapped terminal reasons
now surface as provider errors instead of successful stops (<a
href="https://redirect.github.com/earendil-works/pi/pull/7272">#7272</a>).</li>
<li>Added manual redirect URL and authorization-code entry to OpenRouter
login for remote and headless environments. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#openrouter">OpenRouter</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7114">#7114</a>
by <a
href="https://github.com/rgarcia"><code>@​rgarcia</code></a>).</li>
<li>Added inherited Claude Opus 5 support for GitHub Copilot with
adaptive thinking and a 1M context window. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#github-copilot">GitHub
Copilot</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7158">#7158</a>
by <a
href="https://github.com/jay-aye-see-kay"><code>@​jay-aye-see-kay</code></a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Changed inherited OAuth credential resolution to refresh tokens with
less than five minutes of validity remaining instead of waiting until
expiration (<a
href="https://redirect.github.com/earendil-works/pi/pull/7168">#7168</a>).</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Added a status line when the tool output expansion is toggled (<a
href="https://redirect.github.com/earendil-works/pi/issues/7180">#7180</a>).</li>
<li>Fixed file-backed <code>SYSTEM.md</code> and
<code>APPEND_SYSTEM.md</code> prompts being omitted from the interactive
startup context listing. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#system-prompt-files">System
Prompt Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/7096">#7096</a>).</li>
<li>Fixed context files loading twice when a linked Git worktree is
nested under its main repository. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#context-files">Context
Files</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7221">#7221</a>
by <a
href="https://github.com/arajkumar"><code>@​arajkumar</code></a>).</li>
<li>Fixed llama.cpp streamed responses reporting zero token usage and
leaving session context accounting empty. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/llama-cpp.md">llama.cpp</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7258">#7258</a>
by <a
href="https://github.com/SteveImmanuel"><code>@​SteveImmanuel</code></a>).</li>
<li>Fixed session replacement and committed tree navigation during an
active response to abort and persist the outgoing turn instead of
leaving dangling tool calls. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/usage.md#sessions">Sessions</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7022">#7022</a>
by <a
href="https://github.com/tmustier"><code>@​tmustier</code></a>).</li>
<li>Fixed failed Git package installs leaving partial directories that
blocked clean retries. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/packages.md#install-and-manage">Install
and Manage</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7210">#7210</a>
by <a
href="https://github.com/haoqixu"><code>@​haoqixu</code></a>).</li>
<li>Fixed the <code>/model</code> selector retaining a stale selection
while filtering instead of highlighting the top match (<a
href="https://redirect.github.com/earendil-works/pi/pull/7211">#7211</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed direct RPC bash commands bypassing extension
<code>user_bash</code> handlers. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#user-bash-events">User
Bash Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7214">#7214</a>).</li>
<li>Fixed skills, prompts, and themes losing package source metadata
after extensions reload resources. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/extensions.md#resource-events">Resource
Events</a> (<a
href="https://redirect.github.com/earendil-works/pi/issues/6968">#6968</a>).</li>
<li>Fixed cancellation of concurrently running user bash commands so
every active command is aborted (<a
href="https://redirect.github.com/earendil-works/pi/pull/7103">#7103</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed duplicate messages appearing when extensions switch sessions
during interactive startup (<a
href="https://redirect.github.com/earendil-works/pi/pull/7110">#7110</a>
by <a
href="https://github.com/yzhg1983"><code>@​yzhg1983</code></a>).</li>
<li>Fixed inherited Qwen Token Plan reasoning models to send their
service-specific thinking controls and supported reasoning-effort levels
(<a
href="https://redirect.github.com/earendil-works/pi/issues/6951">#6951</a>,
<a
href="https://redirect.github.com/earendil-works/pi/issues/6998">#6998</a>).</li>
<li>Fixed inherited Z.AI output limits being sent through an unsupported
parameter. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md">Providers</a>
(<a
href="https://redirect.github.com/earendil-works/pi/pull/7174">#7174</a>
by <a
href="https://github.com/HyeokjaeLee"><code>@​HyeokjaeLee</code></a>).</li>
<li>Fixed explicitly configured Amazon Bedrock profiles being overridden
by ambient AWS access keys. See <a
href="https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/providers.md#amazon-bedrock">Amazon
Bedrock</a> (<a
href="https://redirect.github.com/earendil-works/pi/pull/7176">#7176</a>
by <a
href="https://github.com/christianbasch"><code>@​christianbasch</code></a>).</li>
<li>Fixed inherited image fallback paths overflowing narrow terminals,
shortened home-directory paths, and made absolute paths clickable when
terminal hyperlinks are available (<a
href="https://redirect.github.com/earendil-works/pi/pull/7262">#7262</a>).</li>
<li>Fixed inherited OpenAI-compatible tool calls losing their function
arguments when malformed deltas also contain an empty
<code>custom</code> object (<a
href="https://redirect.github.com/earendil-works/pi/pull/7288">#7288</a>
by <a
href="https://github.com/sunnyyoung"><code>@​sunnyyoung</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/earendil-works/pi/commit/845d6ff1f6643aba440341cce877ce1c43ebbc39"><code>845d6ff</code></a>
Release v0.83.0</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f0499a63ff5563ff041c689f680ecbf01436a5e2"><code>f0499a6</code></a>
docs: audit changelogs since v0.82.1</li>
<li><a
href="https://github.com/earendil-works/pi/commit/bff5ab71743b442efa234dbed369e0a96da791f3"><code>bff5ab7</code></a>
fix(coding-agent): show system prompt files in startup context (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7266">#7266</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/cced6a21da273b26ee4a23a803680614bbe8dd1e"><code>cced6a2</code></a>
fix(coding-agent): stop loading AGENTS.md twice in nested git worktrees
(<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7221">#7221</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f9476a61e557bfdce2fbf3ffeaad0988fe47c184"><code>f9476a6</code></a>
fix(ai): update TypeBox nullable array validation (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7243">#7243</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/0c32e83a352a4284133b2544f730a23814948ac3"><code>0c32e83</code></a>
fix(coding-agent): enable streaming usage for llama.cpp provider (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7258">#7258</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/47ca25fcd8535b80710fad5be758f1f2cf81443c"><code>47ca25f</code></a>
Revert &quot;fix(coding-agent): build-check-test (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)&quot;</li>
<li><a
href="https://github.com/earendil-works/pi/commit/0d008b746892ad33d3fe15c0c4bc86a14369e0e8"><code>0d008b7</code></a>
fix(coding-agent): show tool expansion status</li>
<li><a
href="https://github.com/earendil-works/pi/commit/f14519551682cd0fddac2e4b4e8b1f333667e94c"><code>f145195</code></a>
fix(coding-agent): build-check-test (<a
href="https://github.com/earendil-works/pi/tree/HEAD/packages/coding-agent/issues/7206">#7206</a>)</li>
<li><a
href="https://github.com/earendil-works/pi/commit/cefa40ed8f8dbcd6ffd67b5e7a0eaa75a5050d1a"><code>cefa40e</code></a>
***WIP it's a PoC *** fix(coding-agent): guard tree navigation during
respons...</li>
<li>Additional commits viewable in <a
href="https://github.com/earendil-works/pi/commits/v0.83.0/packages/coding-agent">compare
view</a></li>
</ul>
</details>
<br />

Updates `eve` from 0.27.13 to 0.29.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/eve/releases">eve's
releases</a>.</em></p>
<blockquote>
<h2>eve@0.29.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>c0dc572: Rename the TUI <code>/new</code> command to
<code>/reset</code> so session reset uses the same name across the
client, HTTP, channel, and TUI APIs.</li>
<li>3dce30a: Add manual session compaction through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/compact</code> command. Compaction preserves the session, queues
behind an active turn, and does not send synthetic model input.</li>
<li>910805e: Make a single <code>Esc</code> cancel the running turn in
the eve dev TUI when no message is queued. Queued messages still use
<code>Esc</code> to steer the oldest message into the next turn.</li>
<li>9c51755: Connection search and discovered connection tools now use
the same <code>defineDynamic</code> and <code>defineTool</code> pipeline
as authored tools. Dynamic tool maps now reject entries that omit
<code>defineTool</code> instead of accepting unsupported raw
objects.</li>
<li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with
consistent integration categories and category-specific browsing labels.
MCP connections are now named explicitly, and the flow more clearly
explains channels, extensions, and observability integrations.</li>
<li>0c28eb7: Allow declared subagents to export
<code>defineDynamic</code> from <code>agent.ts</code>. Session and turn
resolvers can now return an agent configuration to expose it or nil to
omit it from direct and Workflow delegation.</li>
<li>f3bb60d: Add manual session-context clearing through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/clear</code> command. Clearing removes model-message history
while preserving the session, agent configuration, durable state,
limits, and sandbox.</li>
<li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command
cooperatively cancels a running turn from either the live streaming
input or the idle prompt while preserving the session and settled
context.</li>
</ul>
<h2>eve@0.29.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>e90a8c2: Launch local or deployed eve applications as stable ACP v1
agents with <code>eve acp [url]</code>, including streamed messages,
tool activity, human input, cancellation, concurrent sessions, and
verified Vercel authentication.</li>
<li>cec672d: Add guided Discord setup through <code>eve add
channel/discord</code>, including Vercel Connect provisioning, trigger
attachment, interactions endpoint configuration, slash-command
registration, and channel scaffolding.</li>
<li>ed328e7: Render registry item titles with their exact
registry-provided casing by loading manifests for each page of catalog
results.</li>
<li>c875a67: Update the generated <code>AGENTS.md</code> to direct
coding agents to the eve registry for discovering and installing
integrations.</li>
<li>5153b13: Add JSON output to <code>eve registry list</code> and
<code>eve registry search</code> for scripts that inspect registry
catalogs.</li>
<li>155d46a: Connection registry items now configure their Vercel
Connect connector during <code>eve add</code>, and registry setup
commands close their IPC channel after reporting an outcome so
<code>/add</code> returns instead of remaining stuck.</li>
<li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a
finite, cursor-consistent session event prefix that can hydrate
server-rendered applications.</li>
<li>67bfc76: Resolve sandbox skill roots and seed-file paths through the
same <code>$HOME</code> resolver the file tools use, so the skills
location is spelled once instead of twice.</li>
<li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and
any surviving workflow processes before the CLI exits. Persisted
workflow messages now reach the ready worker during restart instead of
being rejected while the file watcher starts.</li>
<li>731464f: Give the local trace spool's on-disk layout a single owner:
the shared trace reader now exposes the listing and segment-read
primitives that <code>eve traces</code> and the <code>/traces</code>
viewer both use, and payload formatting is shared between the detail
panel and the conversation view.</li>
<li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line
geometry from one prefix-sum helper so scroll, click, and wheel math
cannot disagree, and reset the view through a single factory when the
viewed trace changes.</li>
<li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's
colors instead of forcing a hardcoded black/grey truecolor palette. It
probes the terminal's default background (OSC 11) and derives its card
surfaces from your own theme — subtly elevated bands on dark and light
backgrounds alike, with red bands for failures, and card titles that
invert to black on light backgrounds so they stay legible. Terminals
that don't answer the probe get a clean gutter-rail rendering drawn
entirely with the shared TUI theme.</li>
<li>f5d0533: Derive the dev TUI's slash-command suggestion window from
the command registry instead of a hand-maintained constant, and collapse
the duplicated cursor step in the terminal line-wrap loop.</li>
</ul>
<h2>eve@0.29.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>22bfa02: Add guided Photon setup through <code>eve add
channel/photon-imessage</code>, including project creation, phone
registration, Vercel Connect or portable credentials, and channel
scaffolding.</li>
<li>0c0de19: Add an opt-in experimental steering policy to Chat SDK
sends that cancels an active turn before delivering its replacement
message.</li>
<li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class
Photon iMessage channel with lazy credentials, Vercel OIDC webhook
verification, and automatic eve session routing.</li>
<li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in
<code>read_file</code>, <code>write_file</code>, <code>glob</code>, and
<code>grep</code> tools so agents can directly access packaged skill
references advertised in their prompt.</li>
<li>bf01952: Local trace spans now capture model and tool payloads: the
system prompt, prompt messages, and response text/reasoning/tool calls
on model spans, and call arguments/results on tool spans, each capped at
32 KB with provider transport metadata stripped. Set
<code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the
spool.</li>
<li>680db59: Provider-executed tool calls (like a gateway's
<code>web_search</code>) now show up in local traces: their calls and
results are captured on the model span and the <code>/traces</code>
viewer renders them as tool cards, with oversized outputs truncated to
stay valid JSON.</li>
<li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time,
so views rendering large single-line payloads (long tool results, big
JSON) no longer stall on every repaint.</li>
<li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto
one shared lifecycle. A <code>vercel</code> lookup killed by a signal
(for example Ctrl-C during setup) now reports a cancellation failure
instead of resolving as a success with truncated output.</li>
<li>7703448: The local trace spool reader behind <code>eve traces</code>
moved into a shared internal module; command behavior is unchanged.</li>
<li>2d87acb: Subagent turn spans now record the dispatch that created
them —
<code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>,
<code>agent.parent.call_id</code>, and
<code>agent.subagent.name</code> — so a parent turn that fans out to
several children can
be attributed to the exact tool call behind each one.</li>
<li>3c846bc: The <code>/traces</code> viewer supports drag-to-select:
dragging with the mouse highlights text and releasing copies it to the
clipboard (OSC 52 with tmux passthrough, plus the platform clipboard
command) with a confirmation toast. Clicks now act on release so drags
never toggle cards, and Esc cancels an in-flight selection.</li>
<li>3645c6e: The <code>/traces</code> viewer frame breathes: padding
rows around the title and above the footer hints, the copy toast floats
top-right as a small surface with a left edge bar, and the scroll wheel
scrolls the attributes drawer when the pointer is over it.</li>
<li>8858403: The local tracing subsystem (spool writer/reader,
retention, the zero-config local OTel runtime, and agent span capture)
moved from <code>src/harness</code> into its own
<code>src/tracing</code> module; no behavior change.</li>
<li>9adb455: Adds a <code>/traces</code> command to the dev TUI: a
full-screen live viewer over the local trace spool that re-tells each
trace as a chat-style conversation — system prompt, user and assistant
messages, and tool calls render as expandable cards (arrow keys or mouse
click to expand/collapse), with a right-side metadata drawer. Subagent
turns are badged with their dispatch lineage
(<code>subagent:&lt;name&gt;</code>), and the viewer opens on the trace
containing the current session — including windowed sessions and
subagent children recorded into a parent's trace. Expanded cards scroll
line-by-line so content taller than the viewport is fully readable.
Model spans with errors, token usage, or tool calls (but no text) now
appear as cards instead of disappearing. Terminal escape sequences in
trace payloads are stripped at render time. Tool-call arguments and
results are captured without stripping domain-level
<code>providerOptions</code>/<code>providerMetadata</code> keys. A
single prompt message over 32 KiB is truncated at the text level so the
serialized JSON stays parseable. Local spans capture system prompt,
prompt messages, responses, reasoning, and tool arguments/results
(<code>EVE_TRACES_CONTENT=off</code> to disable); long conversations
truncate oldest messages first with an omission marker.</li>
<li>275271d: Subagent runs now record into the trace of the session that
dispatched them instead of a disconnected trace of their own, and
<code>eve traces</code> resolves either session id to it. Local traces
also open a real <code>agent.session</code> root span rather than a
synthesized parent, so an authored OTel sampler's root rule decides
whether a session is sampled, and a session long enough to outgrow one
trace rolls into numbered windows that <code>eve traces
&lt;session-id&gt;</code> lists oldest first. Rows whose lifetime
outlives the worker that opened them — <code>agent.session</code> and
<code>agent.turn</code> — now show the extent of their descendants
instead of <code>0ms</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/eve/blob/main/packages/eve/CHANGELOG.md">eve's
changelog</a>.</em></p>
<blockquote>
<h2>0.29.5</h2>
<h3>Patch Changes</h3>
<ul>
<li>c0dc572: Rename the TUI <code>/new</code> command to
<code>/reset</code> so session reset uses the same name across the
client, HTTP, channel, and TUI APIs.</li>
<li>3dce30a: Add manual session compaction through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/compact</code> command. Compaction preserves the session, queues
behind an active turn, and does not send synthetic model input.</li>
<li>910805e: Make a single <code>Esc</code> cancel the running turn in
the eve dev TUI when no message is queued. Queued messages still use
<code>Esc</code> to steer the oldest message into the next turn.</li>
<li>9c51755: Connection search and discovered connection tools now use
the same <code>defineDynamic</code> and <code>defineTool</code> pipeline
as authored tools. Dynamic tool maps now reject entries that omit
<code>defineTool</code> instead of accepting unsupported raw
objects.</li>
<li>84aa671: Clarify the dev TUI’s <code>/add</code> flow with
consistent integration categories and category-specific browsing labels.
MCP connections are now named explicitly, and the flow more clearly
explains channels, extensions, and observability integrations.</li>
<li>0c28eb7: Allow declared subagents to export
<code>defineDynamic</code> from <code>agent.ts</code>. Session and turn
resolvers can now return an agent configuration to expose it or nil to
omit it from direct and Workflow delegation.</li>
<li>f3bb60d: Add manual session-context clearing through custom-channel
helpers, the eve HTTP client, and the <code>eve dev</code> TUI's
<code>/clear</code> command. Clearing removes model-message history
while preserving the session, agent configuration, durable state,
limits, and sandbox.</li>
<li>ac7d3c6: Add <code>/cancel</code> to the eve dev TUI. The command
cooperatively cancels a running turn from either the live streaming
input or the idle prompt while preserving the session and settled
context.</li>
</ul>
<h2>0.29.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>e90a8c2: Launch local or deployed eve applications as stable ACP v1
agents with <code>eve acp [url]</code>, including streamed messages,
tool activity, human input, cancellation, concurrent sessions, and
verified Vercel authentication.</li>
<li>cec672d: Add guided Discord setup through <code>eve add
channel/discord</code>, including Vercel Connect provisioning, trigger
attachment, interactions endpoint configuration, slash-command
registration, and channel scaffolding.</li>
<li>ed328e7: Render registry item titles with their exact
registry-provided casing by loading manifests for each page of catalog
results.</li>
<li>c875a67: Update the generated <code>AGENTS.md</code> to direct
coding agents to the eve registry for discovering and installing
integrations.</li>
<li>5153b13: Add JSON output to <code>eve registry list</code> and
<code>eve registry search</code> for scripts that inspect registry
catalogs.</li>
<li>155d46a: Connection registry items now configure their Vercel
Connect connector during <code>eve add</code>, and registry setup
commands close their IPC channel after reporting an outcome so
<code>/add</code> returns instead of remaining stuck.</li>
<li>6f3daca: Add <code>ClientSession.snapshot()</code> for reading a
finite, cursor-consistent session event prefix that can hydrate
server-rendered applications.</li>
<li>67bfc76: Resolve sandbox skill roots and seed-file paths through the
same <code>$HOME</code> resolver the file tools use, so the skills
location is spelled once instead of twice.</li>
<li>a5acde8: Ensure exiting the dev TUI shuts down its owned server and
any surviving workflow processes before the CLI exits. Persisted
workflow messages now reach the ready worker during restart instead of
being rejected while the file watcher starts.</li>
<li>731464f: Give the local trace spool's on-disk layout a single owner:
the shared trace reader now exposes the listing and segment-read
primitives that <code>eve traces</code> and the <code>/traces</code>
viewer both use, and payload formatting is shared between the detail
panel and the conversation view.</li>
<li>f7ba3b3: Derive the <code>/traces</code> conversation viewer's line
geometry from one prefix-sum helper so scroll, click, and wheel math
cannot disagree, and reset the view through a single factory when the
viewed trace changes.</li>
<li>3f4bb9c: The <code>/traces</code> viewer now follows your terminal's
colors instead of forcing a hardcoded black/grey truecolor palette. It
probes the terminal's default background (OSC 11) and derives its card
surfaces from your own theme — subtly elevated bands on dark and light
backgrounds alike, with red bands for failures, and card titles that
invert to black on light backgrounds so they stay legible. Terminals
that don't answer the probe get a clean gutter-rail rendering drawn
entirely with the shared TUI theme.</li>
<li>f5d0533: Derive the dev TUI's slash-command suggestion window from
the command registry instead of a hand-maintained constant, and collapse
the duplicated cursor step in the terminal line-wrap loop.</li>
</ul>
<h2>0.29.3</h2>
<h3>Patch Changes</h3>
<ul>
<li>22bfa02: Add guided Photon setup through <code>eve add
channel/photon-imessage</code>, including project creation, phone
registration, Vercel Connect or portable credentials, and channel
scaffolding.</li>
<li>0c0de19: Add an opt-in experimental steering policy to Chat SDK
sends that cancels an active turn before delivering its replacement
message.</li>
<li>b00a79d: Add <code>photonIMessageChannel</code>, a first-class
Photon iMessage channel with lazy credentials, Vercel OIDC webhook
verification, and automatic eve session routing.</li>
<li>495e93b: Resolve leading <code>$HOME</code> paths in the built-in
<code>read_file</code>, <code>write_file</code>, <code>glob</code>, and
<code>grep</code> tools so agents can directly access packaged skill
references advertised in their prompt.</li>
<li>bf01952: Local trace spans now capture model and tool payloads: the
system prompt, prompt messages, and response text/reasoning/tool calls
on model spans, and call arguments/results on tool spans, each capped at
32 KB with provider transport metadata stripped. Set
<code>EVE_TRACES_CONTENT=off</code> to keep payloads out of the
spool.</li>
<li>680db59: Provider-executed tool calls (like a gateway's
<code>web_search</code>) now show up in local traces: their calls and
results are captured on the model span and the <code>/traces</code>
viewer renders them as tool cards, with oversized outputs truncated to
stay valid JSON.</li>
<li>7ab6d8a: Terminal text wrapping in the dev TUI is now linear-time,
so views rendering large single-line payloads (long tool results, big
JSON) no longer stall on every repaint.</li>
<li>52cee9c: Consolidate the three Vercel CLI subprocess runners onto
one shared lifecycle. A <code>vercel</code> lookup killed by a signal
(for example Ctrl-C during setup) now reports a cancellation failure
instead of resolving as a success with truncated output.</li>
<li>7703448: The local trace spool reader behind <code>eve traces</code>
moved into a shared internal module; command behavior is unchanged.</li>
<li>2d87acb: Subagent turn spans now record the dispatch that created
them —
<code>agent.parent.session.id</code>, <code>agent.parent.turn.id</code>,
<code>agent.parent.call_id</code>, and
<code>agent.subagent.name</code> — so a parent turn that fans out to
several children can
be attributed to the exact tool call behind each one.</li>
<li>3c846bc: The <code>/traces</code> viewer supports drag-to-select:
dragging with the mouse highlights text and releasing copies it to the
clipboard (OSC 52 with tmux passthrough, plus the platform clipboard
command) with a confirmation toast. Clicks now act on release so drags
never toggle cards, and Esc cancels an in-flight selection.</li>
<li>3645c6e: The <code>/traces</code> viewer frame breathes: padding
rows around the title and above the footer hints, the copy toast floats
top-right as a small surface with a left edge bar, and the scroll wheel
scrolls the attributes drawer when the pointer is over it.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vercel/eve/commit/8988139097d1e1a1f1aca9b2828e63408848fccf"><code>8988139</code></a>
Version Packages (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1497">#1497</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/c0dc57240ec850b0f73075f0e3cc900c6e07640a"><code>c0dc572</code></a>
feat(tui): rename /new command to /reset (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1513">#1513</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/910805e8a825a34ba90c0a22a59dc1d787967976"><code>910805e</code></a>
feat(tui): cancel with one Esc press (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1514">#1514</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/ac7d3c66f8c43ce1008d88cedd5254bfec1301e1"><code>ac7d3c6</code></a>
feat(tui): add /cancel command (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1512">#1512</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/f3bb60dd53fa56e955c6ea71cbf72533cfe618e1"><code>f3bb60d</code></a>
feat: add manual session context clearing (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1511">#1511</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/3dce30a18d24644d85b6120d79eaf4d304beaf4b"><code>3dce30a</code></a>
feat: add manual session compaction (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1508">#1508</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/9c517555e870231af00df799523bffd9fc00df71"><code>9c51755</code></a>
refactor(eve): use public dynamic definitions for connection tools (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1505">#1505</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/0c28eb7e886c1a69ee20a5229682509d5413e140"><code>0c28eb7</code></a>
feat(eve): support dynamic subagents (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1485">#1485</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/84aa6715dbf6b6d696b7f567744711f4526b183f"><code>84aa671</code></a>
fix(eve): clarify add flow categories (<a
href="https://github.com/vercel/eve/tree/HEAD/packages/eve/issues/1494">#1494</a>)</li>
<li><a
href="https://github.com/vercel/eve/commit/ab86523b3e07f05f415c9c784232b3875b17b16f"><code>ab86523</code></a>
feat(eve): agent-handle lifecycle contracts (three-phase handles, turn
outcom...</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/eve/commits/eve@0.29.5/packages/eve">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@composio/cli@0.3.3-beta.341 		2026-08-07 16:53:51 +05:30
Kshitij Jhunjhunwala 0c139caac7 feat(skills): add public composio agent skill 2026-08-06 15:56:58 -07:00
Soumya Medapati b581670d40 docs: rewrite the "CRITICAL INSTRUCTIONS FOR AI MODELS" block as descriptive notes (#4083) 
## What

In three independent eval runs across two rounds
(ctx.composio.io/soumya/docs-agent-eval/), capable agents classified
this block as prompt injection and deliberately ignored it (round 1,
agent-007: "a prompt injection I had to identify and ignore"; round 3,
two more agents unprompted). The ALWAYS/NEVER imperative framing also
contradicted the sessions-vs-direct-execution page — the block forbade
the API that page documents.

## Change

Rewritten in `docs/lib/llm-guardrails/session.ts` — same facts, no
commands:

- Sessions documented as the recommended default (samples unchanged)
- The provider-import gotcha kept — it's the most common real mistake in
generated code
- The managed-auth default kept
- Direct execution acknowledged as a supported lower-level interface,
with a link to the sessions-vs-direct tradeoffs page (this replaces the
"DISCOURAGED — do not generate tools.execute()" section, which
contradicted the docs one click away)

An AI-steering block only works if AI readers trust it.

## Verification

- `bun test tests/static/` passes (the execute-version policy test also
validates the guardrail blocks)
- Every factual claim from the old block is preserved; only the framing
and the tools.execute() discouragement changed

Split out of #4059 (which now carries only the legacy-flag and
REST/SDK-naming changes) so this piece can be decided on its own.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
 2026-08-06 13:11:39 -07:00
Soumya Medapati 8b9a5a7381 docs: rewrite the AI guardrails block as descriptive notes 
Three independent eval runs across two rounds show capable agents
classify the CRITICAL INSTRUCTIONS block as prompt injection and ignore
it; its ALWAYS/NEVER framing also contradicted the
sessions-vs-direct-execution page. Same facts, no commands: sessions
stay the recommended default, the provider-import gotcha and
managed-auth default are kept, and direct execution is acknowledged as a
supported lower-level interface with a link to the tradeoffs page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-08-06 13:04:52 -07:00
jkomyno 3639ad29a6 docs(changelog): align free-form object release notes 2026-08-07 00:07:04 +05:30
jkomyno 4a89ff112c fix(json-schema): enforce dynamic object contracts 2026-08-07 00:06:55 +05:30
jkomyno 063f03a72f docs(changesets): explain each behavior change with a before and after 2026-08-06 22:50:46 +05:30
jkomyno ac6bbabd31 fix(claude-agent-sdk): register complete tool schemas 
The provider registered tools through jsonSchemaToZodShape, which returns only
the per-property map. Root-level constraints -- `additionalProperties`, boolean
or schema-valued, and `patternProperties` -- are structurally unrepresentable in
a raw shape, so they were dropped before the Claude Agent SDK ever saw them:
free-form object arguments lost their content, and an unknown key was silently
stripped from tool input rather than rejected.

Registering the complete object schema fixes both. A tool with no input
parameters keeps its closed root explicitly, since a bare `properties: {}` is
now an open object.

Proven at the real SDK boundary rather than against a mocked `tool()`: the new
suite drives createSdkMcpServer over an in-memory MCP transport and asserts on
the advertised inputSchema and on real tools/call results.
 2026-08-06 21:59:12 +05:30
jkomyno 46ee10eb78 chore(deps): catalog @types/node on the Node 24 line 
Every workspace package now takes @types/node from the catalog instead of
pinning its own major, and an override pulls the transitive copies onto the
same line -- @types/ws and @types/yauzl depend on `@types/node: *`, so
vite/vitest peer-resolved 26 for packages that declare nothing themselves.

Node 26 is not a safe target yet. This also removes the one-off ^24.13.3
devDependency the schema-conversion corpus loaders had added to
@composio/json-schema-to-effect-schema, which was the only package in the
repository typing against a different major.
 2026-08-06 21:44:41 +05:30
jkomyno b7592585dd refactor(json-schema-to-effect-schema): validate through a filter instead of a declaration 
`Schema.declare`, `ParseResult`, and `Either` are all removed or reshaped in
Effect 4, so the converter compiled against three APIs that do not survive the
next major.

Express validation as a filter over `Schema.Unknown` instead: the filter returns
the formatted messages and Effect builds the issue tree, which drops the
hand-constructed `ParseResult.Composite`/`Type` values and the identity encode
half that declarations no longer carry. `Either.try` has no `Result` counterpart
in Effect 4 and both uses were local try/catch in disguise, so they become that.

Reported messages are unchanged: the location stays inside the message, because
`formatIssues` may fan one issue out into several. Tests move to
`decodeUnknownOption`, which keeps its name across both majors.

The CLI keeps `ParseResult.ArrayFormatter` while the repo is on Effect 3.x.
 2026-08-06 21:25:48 +05:30
jkomyno cb6fe9bf64 chore(changesets): release the schema conversion fixes as minor bumps 
Python's unknown-key rejection changes behavior for the langchain, langgraph,
and crewai providers rather than only fixing a defect, so the release carries a
minor bump across both SDKs instead of a patch.
 2026-08-06 21:00:15 +05:30
jkomyno e8ffecece3 docs(changelog): document free-form object argument preservation 
Records the cross-SDK fix and, in particular, the Python behavior change the
release would otherwise ship undocumented: object schemas that name properties
and omit `additionalProperties` now reject unknown keys instead of dropping
them, affecting the langchain, langgraph, and crewai providers.
 2026-08-06 20:50:43 +05:30
jkomyno 2e2e71f2b1 chore(json-schema-to-effect-schema): type the corpus loaders against Node 24 
The corpus loaders read their fixture copy with `node:fs`, so both test
tsconfigs now declare `types: ["node"]` — the dependency alone was not enough,
as `@composio/json-schema-to-zod` already had it and still failed to resolve the
builtins. `@types/node` is pinned to the 24.x line that `mise.toml` pins the
runtime to.
 2026-08-06 20:47:23 +05:30
jkomyno bbeacac653 fix(python): preserve and police dynamic object content in schema conversion 
`json_schema_to_model` and `json_schema_to_pydantic_type` now share one
compiled object policy, so provider-facing Pydantic models stop silently
discarding valid free-form arguments and stop ignoring `patternProperties` and
explicit `additionalProperties` controls. Accepted dynamic keys are written back
into `__pydantic_extra__`, which is what `LangchainProvider.wrap_tool` re-reads
with `getattr`.

Acceptance and rejection are asserted from the shared cross-SDK corpus, so the
Python entry points cannot diverge from the TypeScript converters.
 2026-08-06 20:40:59 +05:30
jkomyno 5e57815af1 fix(json-schema): accept and preserve dynamic object content across converters 
Property-less objects (`{ type: "object" }`, `properties: {}`) were being
collapsed to a strict empty object by the Zod converter and given an implicit
`additionalProperties: false` by the Effect converter, so valid free-form
payloads such as METABASE_POST_API_CARD.dataset_query were rejected at the CLI
boundary. `ToolSchema.parse` separately dropped root `patternProperties` and
rejected a schema-valued root `additionalProperties`.

Dynamic keys are now routed to exactly the schemas that apply to them, and the
shared acceptance contract lives in one checked-in corpus with byte-identical
TypeScript and Python copies.
 2026-08-06 20:33:53 +05:30
Alberto Schiabel ecd0861741 fix(core): release unread response bodies (#4078) 
This PR:
- follows [Undici's
recommendation](https://github.com/nodejs/undici#garbage-collection) to
consume or cancel unread response bodies instead of leaving
connection-resource cleanup to the garbage collector, which can increase
connection pressure and reduce reuse
- cancels every intermediate redirect body in `ssrfSafeFetch` before
validating and following the next hop
- cancels non-success response bodies in both URL-upload callers before
preserving their existing errors
- adds regression coverage for redirect ordering, redirect-budget
exhaustion, and both caller error paths
- adds a patch changeset for `@composio/core`
- supersedes https://github.com/ComposioHQ/composio/pull/4018 and
credits @pacocartones as co-author

## Verification

- `pnpm --filter @composio/core test ssrfGuard fileUtils
ToolRouterSessionFilesMount` (4 files, 58 tests passed)
- `pnpm --filter @composio/core test` (47 files, 1,049 tests passed)
- `pnpm --filter @composio/core typecheck`
- `pnpm lint:packages` (0 errors; existing warnings only)
- Prettier check on all touched files
- `pnpm validate:changesets`

Co-authored-by: pacocartones <pacocartones@users.noreply.github.com>
 2026-08-06 17:52:02 +05:30
Palash Kala 5607a662f4 docs(skills): explain how skills reach an agent at runtime 
The page described Skills only as a dashboard catalog and never said how
one gets to an agent. Adds "How a skill reaches your agent": the session
search loop, the COMPOSIO_SEARCH_TOOLS response fields the skill rides in
(recommended_plan_steps, known_pitfalls, difficulty, alongside
primary_tool_slugs / related_tool_slugs), and why that matters — the plan
lands in context before the first execution, so the sequence is right the
first time instead of being recovered from an error.

Also states plainly that skills are part of search results by default with
no opt-out today, and narrows the API note to browsing, which is what is
actually dashboard-only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-05 22:18:07 -07:00
Rajarshi Datta 2a6a051bc3 refactor(core): remove unused isNewerVersion helper (#4029) 
This PR:

- closes #4028
- removes the unused `isNewerVersion` helper from the internal version
utility
- avoids defining malformed-version behavior for a helper with no
callers or package export
- retains `next`'s tested npm version-check timeout implementation
- adds a patch changeset for `@composio/core`
- refreshes Python 3.12.13 artifact metadata in `mise.lock` after the
upstream build was republished

## Verification

- version utility tests: 2 passed
- core typecheck: passed
- changeset validation: passed
- `mise 2026.5.18 lock --platform
linux-x64,linux-arm64,macos-arm64,macos-x64`: clean

---------

Co-authored-by: jkomyno <alberto@composio.dev>
@composio/cli@0.3.3-beta.340 		2026-08-06 09:32:53 +05:30
Palash Kala ab636416da docs: use a dashboard go-link for the Skills page 
The repo's dashboard link policy bans platform.composio.dev and requires
dashboard.composio.dev go-links carrying utm attribution, so sign-ups
originating in docs can be attributed. Points at the project-scoped
Skills go-link instead.
 2026-08-05 20:36:55 -07:00
Alberto Schiabel bcb839b745 ci(docs): open docs PRs with the release-bot app token (#4074) 
## Problem

`docs.changelog-to-docs.yml` fails at `gh pr create` on every run that
has documentation changes:

```
pull request create failed: GraphQL: GitHub Actions is not permitted to
create or approve pull requests (createPullRequest)
```

The repository has *Allow GitHub Actions to create and approve pull
requests* disabled:

```console
$ gh api repos/ComposioHQ/composio/actions/permissions/workflow
{"default_workflow_permissions":"read","can_approve_pull_request_reviews":false}
```

That setting gates PR **creation** as well as approval, and it overrides
whatever the job's `pull-requests` permission grants. `GITHUB_TOKEN`
simply cannot open a PR in this repo.

This is not a new regression. The last PR this workflow successfully
opened was #3466 on 2026-05-20; the setting was flipped off some time
after. Since then every run with docs changes has failed at this step —
**13 failures**, leaving **36 orphaned `docs/changelog-update-*`
branches** on the remote, because the step pushes the branch and then
dies. #3816 was opened by hand to rescue one of them.

Every other PR-opening workflow in this repo already mints a release-bot
App token for exactly this reason. These two were missed. On the same
commit `661d7b5`, `docs.sdk-change-sync.yml` (app token) ran its
create-PR and request-review steps green while
`docs.changelog-to-docs.yml` failed.

## Changes

**`docs.changelog-to-docs.yml`** — the root-cause fix:
- Mint a release-bot App token, same pinned action SHA and
`vars`/`secrets` names as the sibling workflows.
- Check out with that token, so the push is authored by the app and PR
CI triggers.
- `gh pr create` runs with the app token instead of `GITHUB_TOKEN`.
- `id-token: write` added to match the siblings.

**`docs.sync-connect-clients.yml`** — the same defect, latent: its
`peter-evans/create-pull-request` step passed no `token:`, so it fell
back to `github.token` and would hit the identical block on its next
docs change.

**Reviewer request split out of `gh pr create`** (both files, matching
`docs.sdk-change-sync.yml`): an unassignable actor previously failed the
whole command *after* the branch was already pushed — which is precisely
what turned each failure into an orphaned branch. It is now a separate
`continue-on-error` step.

## Verification

Repo lint/prettier cover only `**/*.{ts,tsx,js,jsx,json,md}`, so nothing
gates workflow YAML; these were checked manually:

| Check | Result |
|---|---|
| `yaml.safe_load` both files | OK |
| `bash -n` on the extracted PR script | OK |
| PR step with a stubbed `gh` | branch name byte-identical to the real
run; multi-line body survives the nested heredoc; `pull-request-number`
emitted |
| No-changes path | `No documentation changes needed`, exit 0, no `gh`
call |
| `pnpm lint` / `pnpm typecheck` | pass |

The nested `$(gh pr create … "$(cat <<'EOF' …)")` was the one genuinely
risky part of the edit, so it was exercised rather than eyeballed.

## Follow-ups (not in this PR)

- 36 orphaned `docs/changelog-update-*` branches need pruning;
`docs/changelog-update-661d7b5` carries a real Codex docs commit worth
salvaging first.
- `git add -A` in the PR step is unscoped — the siblings constrain this
with `add-paths`. Not the cause of this failure.
- `Docs Health Check` is separately failing on `661d7b5`.
 2026-08-06 08:52:06 +05:30
Palash Kala b0dd6fd442 docs: add Skills page 
Skills are execution playbooks Composio derives from real usage: for one
concrete task, the tools it needs, the order to call them in, and the
pitfalls that make it fail.

The page leads with why that saves work — an agent that has to discover a
tool sequence and its failure modes pays for it in tokens and retries —
then covers what a skill contains and how to browse the catalog.

Skills are dashboard-only today, so this page has no cURL examples. That
runs against the usual preference for machine-readable API docs, so the
absence is called out explicitly rather than left implicit.

A screenshot will be added in a follow-up.
 2026-08-05 19:24:16 -07:00
Alberto Schiabel ba4408268d chore(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the github-actions group (#4070) 
Bumps the github-actions group with 1 update:
[pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish).

Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/gh-action-pypi-publish/releases">pypa/gh-action-pypi-publish's
releases</a>.</em></p>
<blockquote>
<h2>v1.14.2</h2>
<!-- raw HTML omitted -->
<h2>🛠️ Urgh… Another release!? Again? Explain yourself!</h2>
<p>Looking at the diff, you'll only witness updates across the
dependency tree. That's it! It's not a security fix or anything like
that even, no. But you'll want this update.</p>
<blockquote>
<p>[!tip]
So what <em>most</em> people will find useful is <a
href="https://github.com/takluyver"><code>@​takluyver</code></a><a
href="https://github.com/sponsors/takluyver">💰</a>'s update of Twine to
v7 that we use internally (<a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416">#416</a>).
This version will let them upload their sdists and wheels containing
core packaging metadata v2.5 to (Test)PyPI.</p>
</blockquote>
<h2>🧐 Tell me why..</h2>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<p>TL;DR non-pure-python projects with C-extensions tend to have dozens
(sometimes hundreds) wheels to upload to PyPI per release. They are
often quite big and take time to transfer over the network. People
started noticing problems and coming up with DIY sharding workarounds
like <a
href="https://redirect.github.com/aio-libs/aiohttp/pull/13226">aio-libs/aiohttp#13226</a>
around July 23.
On this date, projects with a good amount of bytes to publish would
start getting timeouts 5 minutes after the PyPI publishing job begun.
The same job that worked just fine before.</p>
<p>I had to start pinging upstream library and ecosystem people, on
GitHub and privately, to start making sense of what was happening.
Eventually, we collectively concluded that GitHub must've shortened the
lifetime of their OIDC identity — it seems to have used to be 10 minutes
long (at some point in the past) and is now 5 minutes, apparently. It's
not documented clearly, and we have not been able to get any clarity by
attempting to contact GitHub through private channels, using personal
connections.</p>
<p>Over the course of investigation, <a
href="https://github.com/facutuesca"><code>@​facutuesca</code></a><a
href="https://github.com/sponsors/facutuesca">💰</a> found and fixed a
related underlying cache invalidation bug in <a
href="https://redirect.github.com/sigstore/sigstore-python/pull/1838">sigstore/sigstore-python#1838</a>,
which he then coordinated propagation through the dependency chain
updates in sigstore-python, pypi-attestations, gh-action-pypi-publish
and gh-action-sigstore-python.</p>
<p>Mike's also discovered that Sigstore's Rekor slowdown seems to have
become the main contributing cause of the last week's incident. He's
collected some data to support this claim: <a
href="https://publishing-five-minute-timeout.tiiny.site">https://publishing-five-minute-timeout.tiiny.site</a>.</p>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<h2>🫶 New Contributors</h2>
<ul>
<li><a
href="https://github.com/davidbrochart"><code>@​davidbrochart</code></a>
made their first contribution in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415">#415</a></li>
<li><a href="https://github.com/takluyver"><code>@​takluyver</code></a>
made their first contribution in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416">#416</a></li>
</ul>
<p><strong>🪞 Full Diff</strong>: <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2">https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2</a></p>
<p><strong>🧔‍♂️ Release Manager:</strong> <a
href="https://github.com/sponsors/webknjaz"><code>@​webknjaz</code></a>
<a href="https://stand-with-ukraine.pp.ua">🇺🇦</a></p>
<p><strong>🙏 Special Thanks</strong> to <a
href="https://github.com/davidbrochart"><code>@​davidbrochart</code></a><a
href="https://github.com/sponsors/davidbrochart">💰</a> and <a
href="https://github.com/Dreamsorcerer"><code>@​Dreamsorcerer</code></a><a
href="https://github.com/sponsors/Dreamsorcerer">💰</a> for turning my
attention (in <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415">#415</a>
and in private) to the newly surfaced corner case in GitHub's behavior
that only affected a narrow category of projects while many others
remained blissfully unaware. <a
href="https://github.com/bdraco"><code>@​bdraco</code></a><a
href="https://github.com/sponsors/bdraco">💰</a> came up with a DIY
sharding workaround for aiohttp that served as a demo for other
projects. <a
href="https://github.com/miketheman"><code>@​miketheman</code></a><a
href="https://github.com/sponsors/miketheman">💰</a> confirmed the
Warehouse-side details. Also, <a
href="https://github.com/jku"><code>@​jku</code></a><a
href="https://github.com/sponsors/jku">💰</a> and <a
href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a
href="https://github.com/sponsors/woodruffw">💰</a> helped work through,
review and release the Sigstore ecosystem upstream libs.</p>
<p><strong>💬 Discuss</strong> <a
href="https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j">on
Bluesky 🦋</a>, <a
href="https://mastodon.social/@webknjaz/117005132816750073">on Mastodon
🐘</a> and [on GitHub][release discussion].</p>
<p>[![GH Sponsors badge]][GH Sponsors URL]</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/dc37677b2e1c63e2034f94d8a5b11f265b73ba33"><code>dc37677</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/417">#417</a>
from trail-of-forks/ft/bump-deps</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/8b2f23418f024937cf97f77534a597947105e772"><code>8b2f234</code></a>
Bump <code>pypi-attestations</code> and <code>sigstore</code></li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/78b72dbfed6e025eb89577c059edc936f8a2df14"><code>78b72db</code></a>
Merge pull request <a
href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416">#416</a>
from takluyver/twine-v7</li>
<li><a
href="https://github.com/pypa/gh-action-pypi-publish/commit/92f4d2a159875dd135a7e56b7b3262f502b23a13"><code>92f4d2a</code></a>
Update twine to v7</li>
<li>See full diff in <a
href="https://github.com/pypa/gh-action-pypi-publish/compare/ba38be9e461d3875417946c167d0b5f3d385a247...dc37677b2e1c63e2034f94d8a5b11f265b73ba33">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pypa/gh-action-pypi-publish&package-manager=github_actions&previous-version=1.14.1&new-version=1.14.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>
 2026-08-05 23:02:47 +05:30
jkomyno 1e55f0a52e ci(docs): open docs PRs with the release-bot app token 
`GITHUB_TOKEN` cannot create pull requests in this repository: the
"Allow GitHub Actions to create and approve pull requests" setting is
disabled, so `createPullRequest` is rejected regardless of what the job's
`pull-requests` permission grants.

`docs.changelog-to-docs.yml` has failed at `gh pr create` on every run
with docs changes since that setting was flipped, leaving pushed branches
behind with no PR. `docs.sync-connect-clients.yml` had the same defect
latently: its `create-pull-request` action passed no `token`, so it fell
back to `github.token`.

Both now mint a release-bot App token, matching every other PR-opening
workflow in the repo, and check out with it so pushes are authored by the
app and PR CI triggers.

Also split the reviewer request out of `gh pr create` into a separate
best-effort step. An unassignable actor previously failed the whole
command after the branch was already pushed, which is what turned each
failure into an orphaned branch.
 2026-08-05 22:38:14 +05:30
dependabot[bot] 9a04be76a4 chore(deps): bump pypa/gh-action-pypi-publish 
Bumps the github-actions group with 1 update: [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish).


Updates `pypa/gh-action-pypi-publish` from 1.14.1 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/ba38be9e461d3875417946c167d0b5f3d385a247...dc37677b2e1c63e2034f94d8a5b11f265b73ba33)

---
updated-dependencies:
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-05 16:23:21 +00:00
Alberto Schiabel d417b5d097 chore(deps): remediate Dependabot updates (#4041) 
This PR:

- consolidates the approved updates from the audited Dependabot queue
onto the current `next` branch
- refreshes `actions/stale`, development tooling, the Effect family, AI
SDK packages, agent frameworks, and runtime support dependencies
- migrates the OpenAI runtime to v7 while keeping the published
`@composio/openai` peer compatible with v6 and v7
- adds a packed OpenAI 7 and Zod 4 consumer fixture with strict
typechecks and offline runtime coverage across Node 22, 24, and 25
- preserves intentional AI SDK 6 and Zod 3 compatibility pins and keeps
AG2 as the maintained package
- configures Dependabot to skip deliberate compatibility majors, the
invalid `@effect/printer-ansi` 1.0.0 target, and Tomli updates blocked
by CrewAI
- adds release changesets for the published package updates
- leaves the AG2 v1 API migration and Tomli/CrewAI update as follow-up
work
- verifies frozen install, peer policy, changesets, package
builds/types/tests, all 20 example typechecks, and production audit;
credentialed CLI/Cloudflare E2E remains for CI

## Context

The `openai-zod4-compat` fixture deliberately packs `@composio/core` and
`@composio/openai` before installing them with npm. Its setup command
runs from the fixture directory, so `pnpm --dir /app/ts/packages/core
pack` and the equivalent provider command select the source packages
while `--pack-destination "$PWD"` writes their tarballs into the
fixture. Installing those tarballs instead of using `"@composio/core":
"file:/app/ts/packages/core"` exercises the consumer-visible package
contents, exports, type declarations, normalized workspace and catalog
dependencies, and peer ranges without reusing monorepo links. npm also
runs without `--legacy-peer-deps`, ensuring incompatible OpenAI, Zod,
core, or provider peer declarations fail the test.

The runtime assertions are intentionally offline: they parse a Zod
schema, construct OpenAI and Composio clients with a fake `test-key`,
verify the OpenAI Responses surface, and wrap tools through both
providers without making network requests. A real `COMPOSIO_API_KEY`
would add a secret dependency without testing authentication or API
behavior, so the fixture no longer passes that environment variable.
@composio/cli@0.3.3-beta.339 		2026-08-05 21:48:57 +05:30
jkomyno 3c4c025aff fix(deps): patch undici audit vulnerability 2026-08-05 21:40:13 +05:30
jkomyno 86cc3cc399 chore: merge next into dependabot remediation 2026-08-05 21:29:53 +05:30
Alberto Schiabel 1221c15783 fix(core): bound the npm version-check fetch with an AbortSignal timeout (#4027) 
Fixes #4026

## Problem

The `Composio` constructor fires a background npm version check unless
`disableVersionCheck` is set — and `disableVersionCheck` has no default,
so this is on for every user:

```ts
// ts/packages/core/src/composio.ts:399-402
if (!this.config.disableVersionCheck) {
  checkForLatestVersionFromNPM(version);
}
```

That check performed a bare fetch with no timeout and no AbortSignal:

```ts
// ts/packages/core/src/utils/version.ts:46
const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`);
```

An in-flight fetch keeps its socket referenced on the Node event loop.
When registry.npmjs.org is slow, black-holed, or
unreachable-but-accepting (corporate proxy, egress firewall that drops
rather than rejects, captive network, npm incident), the process cannot
exit — all the user's work is done and it just sits there. It's also
called without await, so a caller has nowhere to attach a bound of their
own.

Reproducing with a local server that accepts the socket and never
responds: the process was still alive at 90s and had to be killed.

## Fix

```diff
-    // @TODO: Check if fetch is available, if not use node-fetch
-    const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`);
+    const response = await fetch(`https://registry.npmjs.org/${packageName}/latest`, {
+      signal: AbortSignal.timeout(VERSION_CHECK_TIMEOUT_MS),
+    });
```

`VERSION_CHECK_TIMEOUT_MS = 2000`. The existing `catch (_error) { /*
Ignore and do nothing */ }` already swallows the resulting
`TimeoutError`, so failure stays silent — which is right for a
best-effort nicety nobody awaits. A comment records why the signal is
there so a later cleanup doesn't drop it.

Also removed the stale `@TODO: Check if fetch is available, if not use
node-fetch` on the line above: the code already calls global `fetch`
unconditionally, and `toolchain-versions.json` pins the tested Node
versions to 22/24/25, where both `fetch` and `AbortSignal.timeout` (Node
17.3+) are available.

## Results, and one honest caveat

End-to-end with the issue's reproduction: 91s, exit 124 (killed) →
exited on its own after 6.0s, exit 0.

That 6.0s deserves explanation, because the timeout is 2s and I did not
want to overclaim. Measured in isolation:

```text
fetch rejected at 2.01s with TimeoutError     <- the signal works as intended
handler done at 2.01s
process exited at 6.03s                       <- undici's default 4s keepAliveTimeout
```

So the SDK's wait is bounded at 2s, which is what this change controls.
The trailing ~4s is Node's global undici agent releasing the pooled
socket, outside this code's reach — I tested `connection: 'close'` to
see if it could be shortened and got an identical 6.03s. Eliminating it
would require a custom dispatcher, which isn't worth the complexity for
a background version check. Net: unbounded becomes bounded, worst-case
exit ~6s instead of never.

## Tests

Added `ts/packages/core/test/utils/version.test.ts` with two focused
regressions:

- asserts `AbortSignal.timeout` receives `2_000` and its exact signal is
passed to the registry request
- proves that aborting a registry request that never responds is
swallowed by the best-effort check

The timeout path uses a controlled `AbortController`, so the test is
deterministic and does not wait two seconds of wall-clock time.

## Verification

| Check | Result |
|---|---|
| Focused version-check tests | 2 passed |
| Full core suite | 1046 passed |
| Core typecheck | exit 0 |
| Core build | passed, including ATTW and publint |
| Package lint | exit 0 with existing repository warnings |
| Changeset validation | passed |

## Out of scope — follow-up worth filing

`TelemetryService.sendMetric` / `sendErrorLog`
(`services/telemetry/TelemetryService.ts:14,35`) have the identical
unbounded-fetch shape. Black-holing `telemetry.composio.dev` still hangs
the process indefinitely with this fix applied:

```text
blackhole=[registry]   -> exited after 6.0s
blackhole=[telemetry]  -> HUNG (killed at 45s)
```

I deliberately left it alone: telemetry has its own
`registerExitHandlers`/`flush` machinery that intends to block on exit,
so bounding it is a real design decision rather than a one-liner, and
it's outside what this issue covers. Happy to open a separate issue for
it.

## Notes

- Changeset included (`@composio/core: patch`).
- The Python SDK has no equivalent version check, so no parity change is
needed.
 2026-08-05 21:07:04 +05:30
Alberto Schiabel 661d7b5f83 feat(cli): make automatic shell setup the installer default (#4042) 
This PR:

- builds on top of https://github.com/ComposioHQ/composio/pull/4015
- makes `COMPOSIO_INSTALL_SHELL=auto` the default: the installer infers
the login shell from `$SHELL` (zsh, bash, fish) and always runs
idempotent PATH setup for it; `COMPOSIO_INSTALL_SHELL=none` is the
documented install-only opt-out for CI, Docker, and dotfile managers
- makes the ending truthful for every outcome: Case A/Case B are decided
against a pre-install `PATH` snapshot with physical-path identity,
startup-file failures never fail the install (warning + runnable
absolute-path command, exit 0), and the final action block is always the
last output
- seeds `~/.bash_profile` (sourcing `~/.profile`) on bash systems with
no login file, so login shells actually read the managed block; the
documented uninstall deletes that file again when only the block was in
it
- teaches `composio install` to reconcile a stale managed PATH block
(exactly one block per physical file, symlink-aware) and to suppress its
boxed restart hint when `COMPOSIO_CLI_INVOCATION_ORIGIN=installer`
- verifies delegated shell setup actually reconciled before trusting its
exit code, and writes rc files through symlinks with preserved mode and
per-process tmp names
- covers every output-matrix row with exact final-tail harness
assertions under `sh` and `dash`, adds default-flow/`SHELL`-unset/`none`
Docker e2e legs, and aligns CI workflows, docs, and the changelog
- includes one deliberate cross-cutting refactor (`8b7ebadef`): the
per-process atomic tmp-write helper used for rc files is shared with the
analytics and tool-permission state writers instead of duplicating it

## Review remediation (2026-08-04)

All P1/P2 findings from the stack review are addressed on this head:

- **Atomic replacement (P1):** #4016 (`fix/cli-upgrade-atomic-replace`)
is merged into this branch. `install.sh` publishes support files first,
`release-tag.txt` next, and the `composio` binary last, with
aside/rollback recovery and preserved staging on failed restores;
`composio upgrade` replaces the running binary via rename-based
`atomic-replace` helpers (no `fs.copy`), with running-version precedence
and Linux open-handle/changed-inode coverage.
- **Safe documented uninstall (P1):** the docs snippet stages each
startup-file rewrite in a 0600 `mktemp` file, promotes only on filter
success (preserving symlinks, inode, owner, mode), always cleans up, and
is extracted verbatim and exercised by
`test/install-sh-uninstall-snippet.test.sh` under `sh` and `dash`
(symlinks, modes, filter failure/partial output, `.bash_profile`
deletion).
- **Legacy block migration (P2):** both reconcilers migrate the old
three-line block (marker + `export COMPOSIO_INSTALL_DIR` + PATH export,
POSIX and fish) as a unit, with shared
`legacy-migrate-*`/`legacy-near-miss-*` fixtures run by the TS
conformance suite and the shell suite; the uninstall filter removes the
legacy lines too.
- **Checksum policy (P2):** for the default ComposioHQ GitHub source, a
missing `checksums.txt` or missing manifest entry is now a hard error
(mismatch/malformed stay fatal everywhere); overridden mirrors keep the
lenient path; a missing SHA-256 utility warns that verification was
skipped. The changelog claims match this exactly.
- **CI (P2):** the scheduled prod E2E stays on the Docker harness but
installs through `/install` with `COMPOSIO_INSTALL_SHELL` (the
`/install/<shell>` routes are still unprovisioned 404s; a workflow
comment records how to restore variant-route coverage), with a new fish
leg; the hourly canary installs with
`COMPOSIO_BIN_DIR=$HOME/.composio-canary/bin` so its `env -i` login
probe passes only when the managed block itself makes `composio`
resolvable.

## Context

The production installer already auto-configured the shell once, and a
first-time user still hit `composio: command not found` four times in a
row: the refresh hint printed mid-stream, plugin output buried it, and
the final block suggested an unrunnable command. Users execute the last
instruction on screen, so auto-setup is only safe together with a
truthful, copy-paste-safe ending — that pairing is the core of this PR.
The audience now includes non-technical users: one command, no shell
vocabulary, and the only follow-up ever needed is "open a new terminal,
then run `composio login`".

## Release sequencing and rollback

1. This PR merges into `feat/mise-style-installer-rollout` (#4015) after
review; checks and review rerun on the combined head.
2. #4011 merges to `next`; a stable `@composio/cli` containing `install
--shell` must be promoted and verified before #4015 moves.
3. #4015 retargets to `next` and merges; `https://composio.dev/install`
then serves the new default. Smoke-test the live `auto` and `none` flows
before deploying the linked dashboard PR ComposioHQ/dashboard#1204 and
announcing.

Rollback order is copy-first: restore the previous dashboard/docs copy,
then revert installer behavior if needed. The old copy stays compatible
with the new installer; the new promise is not compatible with the old
install-only default.

## Known Residuals

Accepted during review (recorded, not dropped):

- **Design observation (matches the plan's output matrix by design):**
agent-mode success with an unresolved inherited PATH prints only the
new-terminal notice, with no runnable command for automation; consider a
follow-up amendment.
- **Cross-repo risk:** `$SHELL`-inferred setup may target a different
shell than the interpreter driving an agent (e.g. the Claude Code plugin
runs bash while `$SHELL` is zsh); verify the plugin's install-then-login
sequence end to end before rollout.
- Minor: a stale block plus a completions append targeting the same file
performs two rewrites and prints `Updated` twice (requires
`--completions` and a changed bin dir).
- Minor: `test/install-sh-uninstall-snippet.test.sh` runs in the
release-validation workflow (like the other install-sh unit suites), not
on plain PRs, so docs-snippet drift is caught at release time.
- Minor: a legacy file already mangled by an unreleased build of this
branch (marker consumed, orphaned exports left) is not migrated —
without the marker anchor those lines are indistinguishable from user
content.

## Post-Deploy Monitoring & Validation

- **Live verification (owner: release driver, before dashboard
deploy):** in a fresh container/VM, run the plain `curl -fsSL
https://composio.dev/install | sh` with zsh/bash `$SHELL`; a new login
shell must resolve `composio`; repeat with `COMPOSIO_INSTALL_SHELL=none`
and assert no rc changes.
- **Canary:** `cli.install-health-check.yml` (hourly) now asserts the
auto contract in isolation — managed block present with the canary bin
dir, exact PATH line, `env -i bash -ilc 'command -v composio'` resolving
through the managed block only. Healthy = green hourly runs; failure
signal = red canary or a `warning: Automatic PATH setup` line in its
logs.
- **Telemetry:** PostHog `install` events with `invocation_origin:
installer` — watch install→login completion rate for regression in the
first 48h.
- **Rollback trigger:** sustained canary failures or a spike in `command
not found` support reports → roll back copy first, installer second
(order above).
- **Validation window:** 24h of hourly canary runs post-deploy.
@composio/cli@0.3.2 @composio/cli@0.3.2-beta.337 		2026-08-05 19:40:36 +05:30
jkomyno 5941fbace1 docs(cli): announce the shell-setup default in its own dated entry 
The 07-31 changelog entry is already published on next and describes the
install-only default that composio.dev/install serves today. Rewriting it
in place would replace a live, accurate description with its opposite
under a date on which that behavior never shipped, and readers who
already saw it would get no notice of the flip.

Restore that entry verbatim and add a dated 08-05 entry carrying the
behavior-change callout, the auto/none bullets, and the created
~/.bash_profile disclosure.

The download-verification section moves to the new entry rather than
staying on 07-31: the strict abort is new here. The live installer warns
and continues when checksums.txt is missing -- the official_release_source
gate that turns that into an abort does not exist there.

Also scope the HTTPS claim, which is_allowed_http_authority contradicts
for loopback and COMPOSIO_INSTALL_ALLOW_HTTP_HOST; document the second
shape of the installer-created ~/.bash_profile, which survives the
documented uninstall when ~/.profile existed; and record the checksum
abort in INSTALL.md, where someone hitting 'Refusing to install' will
look for it.
 2026-08-05 19:33:16 +05:30
rajashidattapy 52848129d7 Merge branch 'fix/version-check-fetch-timeout' of https://github.com/rajarshidattapy/composio into fix/version-check-fetch-timeout 
# Conflicts:
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
 2026-08-05 19:30:30 +05:30
Rajarshi Datta e0f4a3463c Merge branch 'next' into fix/version-check-fetch-timeout 2026-08-05 19:27:36 +05:30
rajashidattapy bcf7300dcc fix(ci): clear high advisories failing the ts.audit gate 
`pnpm audit --prod --audit-level=high` fails on three HIGH advisories that
have nothing to do with this branch's source change:

- brace-expansion: GHSA-rgw5-rvv9-x895 reopens the unbounded-expansion DoS
  on <5.0.9, so the existing override's 5.0.8 floor is now vulnerable. Bump
  the selector and target; the cross-major span and the minimatch@5.1.9
  callable-CJS trade-off documented there are unchanged.
- fast-uri: GHSA-7p8r-x3mc-p8w7 (ReDoS), reached via ajv.
- ip-address: GHSA-mwp4-54f8-5fhr (leading-zero octet SSRF), reached via
  express-rate-limit inside @modelcontextprotocol/sdk.

The latter two are already inside their parents' declared ranges, so an
override is only needed to pull the lockfile forward without the whole-graph
re-resolution `pnpm update -r` would drag in (rollup, postcss, jose, hono,
nitro). Both are marked temporary and drop on the next dependency refresh.

Lockfile churn is limited to those three packages. Gate now exits 0; the
remaining 1 low + 1 moderate sit below the threshold.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-05 19:26:49 +05:30
jkomyno a7c73b679a fix(ci): keep the canary teardown out of the pinned uninstall block 
test/release-workflow.test.ts pins the `rm -rf` block in
cli.install-health-check.yml against INSTALL.md's documented uninstall,
and the health check listed $HOME/.composio-canary inside that block.
The canary bin dir is the workflow's own isolation directory, not
something a user uninstalls, so INSTALL.md must not grow an entry for it.

Tear it down in a separate statement instead. The parser only reads the
backslash-continued block, so a single-line `rm -rf` is invisible to it
while the cleanup still runs before the install.
 2026-08-05 19:25:27 +05:30
jkomyno 5475c6a858 ci(cli): run install-script unit tests on installer-only pull requests 
An installer-only change ran no lint or tests anywhere before landing:
Test Installation triggered on tag push, dispatch, and call only, and Build
CLI Binaries' push path filter did not cover install.sh or install/.

Add install.sh and install/** to that path filter, and trigger Test
Installation on pull requests touching the installer, its suites, or the
workflow itself. Only the ubuntu-only unit-test job (shellcheck plus the
install-sh-*.test.sh suites) runs there; the multi-OS matrix installs an
already-published release a pull request cannot produce, so it stays gated
off pull requests along with the summary that reports it.
 2026-08-05 19:16:38 +05:30
jkomyno 0994c73b55 ci(cli): drop the orphaned built_from_this_checkout installation input 
The input let legs that install an older published release accept
install.sh's legacy PATH block. That case no longer exists: install.sh
always comes from this checkout, and delegated_setup_verified only trusts a
delegated `composio install --shell` when every target startup file matches
its own rendering byte for byte, rewriting the block inline otherwise. The
unconditional managed-block assertion is therefore valid on every leg, and
no run body ever read the env var it was wired into.
 2026-08-05 19:16:22 +05:30
jkomyno 9a6d59326f Merge branch 'next' into feat/installer-auto-shell-default 
Keeps this branch's fixture-driven managed-block reconciler
(reconcileManagedPathBlock, pinned byte-for-byte against install.sh's awk
rewrite by test/managed-block-fixtures) and drops next's narrower
replaceManagedPathBlock/applyFileChanges pair, which it supersedes.

Adopts from next: the narrowed unsafe-path character set on both the TS and
sh sides, the removal of the $PATH-reachability write skip, the hedged
no-shell PATH message, and the COMPOSIO_BIN_DIR command documentation.
 2026-08-05 19:12:05 +05:30
Alberto Schiabel 7106c665c3 fix(installer): satisfy shellcheck in install.sh and the shell variants (#4067) 
## Why

`next` is red. The **Install Script Unit Tests** job runs:

```
shellcheck -s sh install.sh install/*.sh
```

shellcheck exits non-zero on *any* finding, including info-level ones,
and #4015 introduced four **SC2015** diagnostics ("Note that A && B || C
is not if-then-else"):

| file | line |
|---|---|
| `install.sh` | 535 |
| `install/bash.sh` | 11 |
| `install/zsh.sh` | 11 |
| `install/fish.sh` | 11 |

The knock-on matters more than the lint: `Test Install Script` **depends
on** that job, so it was **skipped** on the beta.336 build — meaning
that release's real installation legs never ran. See [run
31006150923](https://github.com/ComposioHQ/composio/actions/runs/31006150923).

This was not caught on #4015 because **Test Installation does not
trigger on pull requests** — it runs on tag push and from Build CLI
Binaries, so the job first executed after merge.

## What changed

Both patterns become explicit conditionals, with no behavior change:

```sh
# install/{bash,zsh,fish}.sh
-debug() { is_true "\${COMPOSIO_DEBUG:-}" && printf '+ %s\n' "\$*" >&2 || :; }
+debug() { if is_true "\${COMPOSIO_DEBUG:-}"; then printf '+ %s\n' "\$*" >&2; fi; }
```

`debug()` still prints only when `COMPOSIO_DEBUG` is truthy, and still
returns 0 otherwise (the `|| :` existed to keep it from tripping `set
-e`; `if` returns 0 on a false condition, so that property is
preserved).

```sh
# install.sh
-[ -n "\$version" ] && [ -n "\$archive_url" ] || error '...'
+if [ -z "\$version" ] || [ -z "\$archive_url" ]; then
+    error '...'
+fi
```

## Verification

- `shellcheck -s sh install.sh install/*.sh` — the exact CI command —
exits **0** locally
- All four files still pass `sh -n`

## Follow-up worth considering (not in this PR)

The gap that let this through is that the installer's own lint and unit
tests never run on the PR that changes the installer. Running the
`Install Script Unit Tests` job on PRs touching `install.sh` /
`install/**` would have caught this before merge.
 2026-08-05 18:47:10 +05:30
jkomyno b11f31cec8 fix(installer): satisfy shellcheck in install.sh and the shell variants 
The Install Script Unit Tests job runs `shellcheck -s sh install.sh
install/*.sh`, which exits non-zero on any finding including info-level
ones. Four SC2015 diagnostics ("A && B || C is not if-then-else") failed
the job on next, which also skipped the Test Install Script legs that
depend on it.

Rewrite both patterns as explicit conditionals. Behavior is unchanged:
debug() still prints only when COMPOSIO_DEBUG is truthy and still
returns 0 otherwise, and the release-metadata guard still aborts when
either field is empty.
 2026-08-05 18:41:20 +05:30
Alberto Schiabel 8b3ccffb03 feat(cli): rewrite installer for POSIX shell (#4015) 
This PR:

- builds on top of
[#4011](https://github.com/ComposioHQ/composio/pull/4011) ([Glen
review](https://app.tryglen.com/review/ComposioHQ/composio/4011)) and
implements Stage 2 of the mise-style installer rollout
- rewrites the base installer for POSIX `sh`, install-only defaults,
verified complete bundles, and a `~/.local/bin/composio` entry point
- adds explicit bash, zsh, and fish setup routes with compatibility
fallback for older CLI releases, enforced byte-identical except for the
shell each hardcodes in `requested_shell()` (drift guard in the
installer test harness)
- posts a sticky PR comment with copy-paste preview install commands
once the hermetic install E2E suite passes (`preview-comment` job). The
run-time release resolution means any branch's checked-in scripts are
complete working installers
- updates install workflows, release guidance, public docs, generated
LLM guidance, CODEOWNERS, and the installer changelog
- adds hermetic bash/zsh Docker coverage, corrupt-archive rejection,
upgrade symlink regression coverage, and PR/nightly install E2E CI
- simplifies internals after a review pass: dedupes the curl `--proto`
selection in `install.sh`, merges the duplicated install verification CI
steps, removes the `execPath` test bypass around the `NodeProcess`
service, and threads the Docker image platform through the E2E harness
instead of re-inspecting per test

## Verification

- `shellcheck -s sh install.sh install/*.sh`
- `bash test/install-sh-release-resolution.test.sh` (runs under `sh` and
`dash`, includes the shell-variant drift guard)
- `pnpm turbo typecheck --filter=@composio/cli --filter=@e2e-tests/utils
--filter=@e2e-tests/cli-install`
- `pnpm vitest run` from `ts/packages/cli` (full suite, 1094 tests)
- `pnpm run test:release-workflow` and `pnpm run validate:boundaries`
- Docker install E2E (bash + zsh hermetic legs) runs on this PR via
`cli.install-e2e.yml`
- Docs: typecheck, lint, link lint, static tests, and production build

## Stacked follow-up

- #4042 (`feat/installer-auto-shell-default`) targets this branch and
flips the default to automatic shell setup
(`COMPOSIO_INSTALL_SHELL=auto`, with `none` as the install-only
opt-out). It merges into this PR after its own review; checks and review
then rerun on the combined head before this PR moves to `next`.
- #4042's head now also carries the full stack-review remediation
(2026-08-04): the #4016 atomic-replacement port (support files first,
release metadata next, binary last; atomic `composio upgrade`), legacy
three-line managed-block migration in both reconcilers, a safe tested
uninstall snippet, mandatory checksum verification for official release
downloads, and the scheduled prod E2E moved to the base `/install` route
with `COMPOSIO_INSTALL_SHELL` (the variant routes are still
unprovisioned). See #4042's "Review remediation" section for details;
#4016 is superseded by that merge.
- Rollback order for the combined rollout is copy-first: restore the
previous dashboard/docs copy, then revert installer behavior if needed.
The old copy remains compatible with the new installer; the new promise
is not compatible with the old install-only default.

## Merge gates

- [ ] #4011 is merged and its stable CLI release handoff is verified.
- [ ] The live `next` ruleset requires code-owner review. It currently
requires one approval but reports `require_code_owner_review: false`.

Note: the Cloudflare routes `/install/bash`, `/install/zsh`, and
`/install/fish` remain unprovisioned (404) and are deliberately
undocumented until live checks return the expected scripts. They are no
longer a merge prerequisite; the release-asset/repo `install/*.sh`
variants cover explicit-shell installs.

## Next steps

- Render `install.sh` at release time with the version and per-target
checksums baked in (mise's `install.envsubst` + `render-install.sh`
model), sign the rendered script, and serve it from our own routes. This
removes run-time GitHub API release resolution (rate limits and
missing-asset races) from the user install path.
- If the shell variants ever grow real per-shell logic, generate them
from a single template at build time (mise's `shell.envsubst` model).
Until then, the drift guard enforces lockstep.

No changeset: the standalone CLI is excluded from Changesets, and the
remaining changes are installer, docs, tests, and CI.

## Review follow-up

- `cbb5f5a70` fixes unset `SHELL`, rejects `:` in compatibility fallback
paths, and makes signal traps terminate after cleanup.
`test/install-sh-release-resolution.test.sh` covers all three
regressions under `sh` and `dash`.
- `3d4c3b6cd` bounds the uninstall filter to the legacy install-dir
export and exactly one installer-owned `PATH` line. Legacy POSIX,
current POSIX, fish, unrelated `PATH`, and completions fixtures pass.
- Focused verification: `pnpm test:install-sh`, `shellcheck -s sh
install.sh install/*.sh`, `bash -n
test/install-sh-release-resolution.test.sh`, and `bun test
docs/tests/static/content.test.ts`.
@composio/cli@0.3.2-beta.336 		2026-08-05 18:03:34 +05:30
jkomyno f1b25f551b Merge remote-tracking branch 'origin/next' into feat/mise-style-installer-rollout 2026-08-05 17:52:38 +05:30
Alberto Schiabel 5630041145 fix(ci): refresh mise.lock for the republished python 3.12.13 build (#4066) 
## Why

`next` is currently red on **Audit Typescript SDK**, and so is every PR
based on it.

`python-build-standalone` republished cpython **3.12.13** under a new
date tag (`20260728` → `20260804`). The pinned version in `mise.toml`
did not change, but `mise lock` now resolves different URLs and
checksums for it. The Audit job runs:

```
mise lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64
git diff --exit-code mise.lock
```

so the committed lockfile no longer matches what `mise lock` produces,
and that step fails on every branch.

Evidence: [Audit on `next` @
`973de6541`](https://github.com/ComposioHQ/composio/actions/runs/31001686227)
— the failing step's diff is exactly the four python entries updated
here.

## What changed

Only the four `[tools.python."platforms.*"]` URL/checksum pairs. No
version pins in `mise.toml` are touched, and no other tool entry moves.

The regenerated checksums match the ones CI computed in the run linked
above, byte for byte.

## Note

Running `mise lock` locally also wanted to append a `[[tools.node]]
version = "24.18.1"` block, picked up from a globally-installed node
rather than from this repo — `mise.toml` pins `node = "24.17.0"`, which
is already locked. That block is deliberately **not** included here.
@composio/cli@0.3.2-beta.335 		2026-08-05 17:52:15 +05:30