Alberto Schiabel 8b3ccffb03 feat(cli): rewrite installer for POSIX shell (#4015)
This PR:

- builds on top of
[#4011](https://github.com/ComposioHQ/composio/pull/4011) ([Glen
review](https://app.tryglen.com/review/ComposioHQ/composio/4011)) and
implements Stage 2 of the mise-style installer rollout
- rewrites the base installer for POSIX `sh`, install-only defaults,
verified complete bundles, and a `~/.local/bin/composio` entry point
- adds explicit bash, zsh, and fish setup routes with compatibility
fallback for older CLI releases, enforced byte-identical except for the
shell each hardcodes in `requested_shell()` (drift guard in the
installer test harness)
- posts a sticky PR comment with copy-paste preview install commands
once the hermetic install E2E suite passes (`preview-comment` job). The
run-time release resolution means any branch's checked-in scripts are
complete working installers
- updates install workflows, release guidance, public docs, generated
LLM guidance, CODEOWNERS, and the installer changelog
- adds hermetic bash/zsh Docker coverage, corrupt-archive rejection,
upgrade symlink regression coverage, and PR/nightly install E2E CI
- simplifies internals after a review pass: dedupes the curl `--proto`
selection in `install.sh`, merges the duplicated install verification CI
steps, removes the `execPath` test bypass around the `NodeProcess`
service, and threads the Docker image platform through the E2E harness
instead of re-inspecting per test

## Verification

- `shellcheck -s sh install.sh install/*.sh`
- `bash test/install-sh-release-resolution.test.sh` (runs under `sh` and
`dash`, includes the shell-variant drift guard)
- `pnpm turbo typecheck --filter=@composio/cli --filter=@e2e-tests/utils
--filter=@e2e-tests/cli-install`
- `pnpm vitest run` from `ts/packages/cli` (full suite, 1094 tests)
- `pnpm run test:release-workflow` and `pnpm run validate:boundaries`
- Docker install E2E (bash + zsh hermetic legs) runs on this PR via
`cli.install-e2e.yml`
- Docs: typecheck, lint, link lint, static tests, and production build

## Stacked follow-up

- #4042 (`feat/installer-auto-shell-default`) targets this branch and
flips the default to automatic shell setup
(`COMPOSIO_INSTALL_SHELL=auto`, with `none` as the install-only
opt-out). It merges into this PR after its own review; checks and review
then rerun on the combined head before this PR moves to `next`.
- #4042's head now also carries the full stack-review remediation
(2026-08-04): the #4016 atomic-replacement port (support files first,
release metadata next, binary last; atomic `composio upgrade`), legacy
three-line managed-block migration in both reconcilers, a safe tested
uninstall snippet, mandatory checksum verification for official release
downloads, and the scheduled prod E2E moved to the base `/install` route
with `COMPOSIO_INSTALL_SHELL` (the variant routes are still
unprovisioned). See #4042's "Review remediation" section for details;
#4016 is superseded by that merge.
- Rollback order for the combined rollout is copy-first: restore the
previous dashboard/docs copy, then revert installer behavior if needed.
The old copy remains compatible with the new installer; the new promise
is not compatible with the old install-only default.

## Merge gates

- [ ] #4011 is merged and its stable CLI release handoff is verified.
- [ ] The live `next` ruleset requires code-owner review. It currently
requires one approval but reports `require_code_owner_review: false`.

Note: the Cloudflare routes `/install/bash`, `/install/zsh`, and
`/install/fish` remain unprovisioned (404) and are deliberately
undocumented until live checks return the expected scripts. They are no
longer a merge prerequisite; the release-asset/repo `install/*.sh`
variants cover explicit-shell installs.

## Next steps

- Render `install.sh` at release time with the version and per-target
checksums baked in (mise's `install.envsubst` + `render-install.sh`
model), sign the rendered script, and serve it from our own routes. This
removes run-time GitHub API release resolution (rate limits and
missing-asset races) from the user install path.
- If the shell variants ever grow real per-shell logic, generate them
from a single template at build time (mise's `shell.envsubst` model).
Until then, the drift guard enforces lockstep.

No changeset: the standalone CLI is excluded from Changesets, and the
remaining changes are installer, docs, tests, and CI.

## Review follow-up

- `cbb5f5a70` fixes unset `SHELL`, rejects `:` in compatibility fallback
paths, and makes signal traps terminate after cleanup.
`test/install-sh-release-resolution.test.sh` covers all three
regressions under `sh` and `dash`.
- `3d4c3b6cd` bounds the uninstall filter to the legacy install-dir
export and exactly one installer-owned `PATH` line. Legacy POSIX,
current POSIX, fish, unrelated `PATH`, and completions fixtures pass.
- Focused verification: `pnpm test:install-sh`, `shellcheck -s sh
install.sh install/*.sh`, `bash -n
test/install-sh-release-resolution.test.sh`, and `bun test
docs/tests/static/content.test.ts`.
2026-08-05 18:03:34 +05:30
2025-09-28 04:02:01 +05:30
2025-06-16 19:52:20 +05:30
2025-11-13 21:18:45 +05:30

Composio logo

composio.dev • Documentation • Quickstart • Changelog

GitHub stars npm PyPI Discord HVTrust

Composio

Composio gives your AI agents 1000+ pre-authenticated toolkits, per-user sessions, authentication, triggers, and a sandbox, so you can ship agents that turn intent into action.

This is the Composio SDK monorepo. It contains:

  • @composio/core: TypeScript SDK
  • composio: Python SDK
  • composio CLI: search, execute, and script tools from your shell
  • Provider adapters for OpenAI Agents, Claude Agent SDK, Vercel AI SDK, LangChain, and more

Quickstart

Create a session for a user, hand its tools to your agent, and let the agent take action across 1000+ apps. Grab a COMPOSIO_API_KEY from the dashboard first.

TypeScript

npm install @composio/core @composio/openai-agents @openai/agents

@composio/core intentionally packages its TypeScript source and SDK docs so the installed package is inspectable to coding agents. If you want a smaller install with the same API, use @composio/slim.

import { Composio } from "@composio/core";
import { OpenAIAgentsProvider } from "@composio/openai-agents";
import { Agent, run } from "@openai/agents";

const composio = new Composio({ provider: new OpenAIAgentsProvider() });

// Each session is scoped to one of your users
const session = await composio.create("user_123");
const tools = await session.tools();

const agent = new Agent({
  name: "Personal Assistant",
  instructions: "You are a helpful assistant. Use Composio tools to take action.",
  tools,
});

const result = await run(agent, "Summarize my emails from today");
console.log(result.finalOutput);

Python

pip install composio composio-openai-agents openai-agents
from composio import Composio
from composio_openai_agents import OpenAIAgentsProvider
from agents import Agent, Runner

composio = Composio(provider=OpenAIAgentsProvider())

# Each session is scoped to one of your users
session = composio.create(user_id="user_123")
tools = session.tools()

agent = Agent(
    name="Personal Assistant",
    instructions="You are a helpful assistant. Use Composio tools to take action.",
    tools=tools,
)

result = Runner.run_sync(starting_agent=agent, input="Summarize my emails from today")
print(result.final_output)

By default a session gets meta tools that discover, authenticate, and execute app tools at runtime, so you don't load hundreds of tool definitions into context. Store session.session_id and reuse it with composio.use() across turns. See what a session is and configuring sessions for restricting toolkits, auth configs, and connected accounts.

Prefer MCP? Every session also exposes a hosted MCP endpoint. Pass mcp: true to composio.create() and point Claude, Cursor, or any MCP client at session.mcp.url. See sessions via MCP.

CLI

The composio CLI runs Composio from your shell and gives coding agents like Claude Code a local tool surface.

curl -fsSL https://composio.dev/install | sh
composio login

Use composio search to find tools, composio execute to run them, composio link to connect accounts, and composio run to script workflows in TypeScript. See the CLI docs.

Providers

A provider adapts Composio tools to your agent framework's native tool format:

Provider TypeScript Python
OpenAI @composio/openai composio-openai
OpenAI Agents @composio/openai-agents composio-openai-agents
Anthropic @composio/anthropic composio-anthropic
Claude Agent SDK @composio/claude-agent-sdk composio-claude-agent-sdk
Vercel AI SDK @composio/vercel —
Google GenAI @composio/google composio-gemini, composio-google
Google ADK — composio-google-adk
LangChain @composio/langchain composio-langchain
LangGraph via @composio/langchain composio-langgraph
LlamaIndex @composio/llamaindex composio-llamaindex
Mastra @composio/mastra —
Pi @composio/experimental* —
Cloudflare Workers AI @composio/cloudflare —
CrewAI — composio-crewai
AutoGen — composio-autogen

* The Pi provider is experimental and ships from @composio/experimental.

Don't see your framework? Build a custom provider, or skip providers entirely and connect over MCP.

All packages

Everything published from this repo:

Package Description
@composio/core TypeScript SDK
@composio/slim @composio/core without packaged source or docs; same API, smaller install
composio CLI Standalone CLI binary: curl -fsSL https://composio.dev/install | sh
@composio/experimental Experimental integrations, including the Pi provider
@composio/json-schema-to-zod JSON Schema to Zod conversion
@composio/* provider adapters OpenAI, OpenAI Agents, Anthropic, Claude Agent SDK, Vercel, Google, LangChain, LlamaIndex, Mastra, Cloudflare
composio Python SDK
composio-* provider adapters OpenAI, OpenAI Agents, Anthropic, Claude Agent SDK, Gemini, Google, Google ADK, LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen

Repository layout

ts/                TypeScript SDK workspace
  packages/core/       @composio/core
  packages/providers/  Provider adapters
  packages/cli/        Composio CLI
python/            Python SDK and provider packages
docs/              Documentation site (docs.composio.dev)

The TypeScript SDK is tested against Node 22+; the Python SDK supports Python 3.10+.

Development

mise install    # pinned toolchain (Node, Python, pnpm)
pnpm install
pnpm build
pnpm test

Python commands run from python/; see python/README.md. We welcome contributions to both SDKs; read the contribution guidelines before submitting pull requests.

Support

License

MIT. See LICENSE.

S
Description
Route and complete Composio work across Composio For You and Composio Platform. Use when the user mentions Composio; wants an agent to use apps such as Gmail,…
Readme 1.3 GiB
Languages
TypeScript 72.2%
Python 23.3%
Shell 2.1%
JavaScript 2%
Swift 0.4%