Alberto Schiabel 18944df9eb fix(cli): verify codex-acp tarballs against the lockfile before packaging them (#4217)
# Description

Found by the scheduled security audit while reviewing the CLI release
pipeline.

`ts/packages/cli/scripts/_acp-adapters.ts` downloads four
`@zed-industries/codex-acp-<platform>` tarballs directly from the
registry at release-build time — it has to, because `pnpm` only installs
the optional dependency matching the runner's own platform while the
archive must name all four. Those bytes were then extracted, `chmod
0755`'d, and packaged inside the published `composio` CLI archive
**without being checked against any known hash**.

That made the codex-acp binaries the one dependency in the release that
received none of the integrity verification `pnpm install
--frozen-lockfile` applies to everything else, despite `pnpm-lock.yaml`
already pinning a `sha512` for each of them:

```
'@zed-industries/codex-acp-linux-x64@0.16.0':
  resolution: {integrity: sha512-xs5zZBLpJuciEbZNx6ZSNL0qCa9h3i/zWpj40sp6QtF+L4Ow/7qzHdBzboGhHdcz1jrLedfZeRFDA2Elj8TLMA==}
```

Distribution is `curl -fsSL https://composio.dev/install | sh`, so
anything that reached those bytes between the registry and the archive
would ship executable to every CLI user inside an otherwise-signed
release.

## What changed

New `scripts/_tarball-integrity.ts`:

- `parseLockfileIntegrity` — maps every `name@version` in
`pnpm-lock.yaml` to its recorded hash. Line-based rather than a YAML
parse: the shape being read is two adjacent lines, and this keeps a
build script free of a YAML dependency.
- `expectedIntegrityFor` — returns the pinned hash, and **throws** for a
package the lockfile never resolved.
- `assertBytesMatchIntegrity` — Web Crypto digest compared against the
pinned value; the algorithm is read from the expected string so a
lockfile that moves off sha512 keeps working.
- `findLockfilePath` / `loadLockfileIntegrity` — walk up from the script
rather than resolving a fixed `../../..`.

`_acp-adapters.ts` now looks the hash up *before* the download and
verifies the archive bytes before extracting them.

Two deliberate choices:

- **Checked against the lockfile, not the registry's `dist.integrity`**
— whoever can serve the tarball can serve the metadata that vouches for
it.
- **Fail-closed throughout** — a missing lockfile, or a package absent
from it, aborts the build rather than packaging unverified bytes.

Scope is limited to the integrity gap. The `@zed-industries/codex-acp*`
family is deprecated upstream ("replaced by
`@agentclientprotocol/codex-acp`") and pinned at `0.16.0`; migrating it
is a separate call for whoever owns the ACP integration.

# How did I test this PR

**Unit — 16 new tests, all passing:**

```
$ vitest run test/src/scripts/tarball-integrity.test.ts
 Test Files  1 passed (1)
      Tests  16 passed (16)
```

Covers quoted scoped keys and unquoted bare keys, resolutions carrying
no integrity, `snapshots:` repeats, a package absent from the lockfile,
a version pinned under a different number, tampered bytes, a single
flipped byte, an uncomputable algorithm, sha256 as well as sha512, and
the upward lockfile walk (including the no-lockfile-anywhere case). One
test asserts this repository actually pins a hash for all four packaged
codex-acp binaries.

**Live end-to-end against the real registry** — the real 74,914,872-byte
`@zed-industries/codex-acp-linux-x64@0.16.0` tarball, downloaded and run
through the same code path the build uses:

```
downloaded 74914872 bytes from https://registry.npmjs.org/@zed-industries/codex-acp-linux-x64/-/codex-acp-linux-x64-0.16.0.tgz
PASS: real tarball matches the lockfile pin
PASS: tampered rejected — TarballIntegrityError: Integrity mismatch for @zed-industries/codex-acp-linux-x64@0.16.0.
PASS: unpinned version refused — TarballIntegrityError: @zed-industries/codex-acp-linux-x64@0.99.0 has no integrity hash in pnpm-lock.yaml; refusing to package unverified bytes.
```

So the check passes on genuine bytes, rejects a single flipped byte in a
75 MB archive, and refuses a version the lockfile does not pin.

**Lint / types / boundaries:**

- `oxlint` on all three files — clean. (First draft used `node:crypto`;
`no-restricted-imports` bans it, so the digest went to Web Crypto.)
- `prettier --check` — clean.
- `tsc --noEmit` — no errors in any of the three changed files. This
sandbox has 820 pre-existing errors from an unbuilt workspace (only 7 of
70 projects installed); `test/src/scripts/release-artifacts.test.ts`
fails to import here for the same reason, on `next` as well as on this
branch.
- `pnpm run validate:boundaries` — `lint boundaries OK: 4 registered
disables across 4 files` (unchanged; `scripts/` and `test/` sit outside
the `src/` Effect boundary policy).

# Security

- **Grype** — `grype dir:ts/packages/cli/scripts --only-fixed --fail-on
medium` → `No vulnerabilities found`.
- **Socket** — could not run. `doppler secrets get SOCKET_API_TOKEN
--plain --project hermes --config dev_zen` returns empty in this cron
sandbox, so `socket ci` exits with `Auth Error`. Reporting rather than
skipping silently; this change adds no dependency, so the
dependency-alert surface is unchanged.
- No new dependencies, no new network destinations. The one behavioural
change is a fail-closed integrity check on bytes that were previously
trusted unverified.

Origin: cron-48e51eab745f /
[zen-cron-44e260352d1a](https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a)

Triggered by: saransh@composio.dev | Source: unknown
Session:
https://zen.corp.composio.io/dashboard/#/chat/zen-cron-44e260352d1a
2026-08-25 23:57:49 +02:00
…

Composio logo

composio.dev • Documentation • Quickstart • Changelog

GitHub stars npm PyPI Discord HVTrust

Composio

Composio gives your AI agents 1000+ pre-authenticated toolkits, per-user sessions, authentication, triggers, and a sandbox, so you can ship agents that turn intent into action.

This is the Composio SDK monorepo. It contains:

  • @composio/core: TypeScript SDK
  • composio: Python SDK
  • composio CLI: search, execute, and script tools from your shell
  • Provider adapters for OpenAI Agents, Claude Agent SDK, Vercel AI SDK, LangChain, and more

Quickstart

Create a session for a user, hand its tools to your agent, and let the agent take action across 1000+ apps. Grab a COMPOSIO_API_KEY from the dashboard first.

TypeScript

npm install @composio/core @composio/openai-agents @openai/agents

@composio/core intentionally packages its TypeScript source and SDK docs so the installed package is inspectable to coding agents. If you want a smaller install with the same API, use @composio/slim.

import { Composio } from "@composio/core";
import { OpenAIAgentsProvider } from "@composio/openai-agents";
import { Agent, run } from "@openai/agents";

const composio = new Composio({ provider: new OpenAIAgentsProvider() });

// Each session is scoped to one of your users
const session = await composio.create("user_123");
const tools = await session.tools();

const agent = new Agent({
  name: "Personal Assistant",
  instructions: "You are a helpful assistant. Use Composio tools to take action.",
  tools,
});

const result = await run(agent, "Summarize my emails from today");
console.log(result.finalOutput);

Python

pip install composio composio-openai-agents openai-agents
from composio import Composio
from composio_openai_agents import OpenAIAgentsProvider
from agents import Agent, Runner

composio = Composio(provider=OpenAIAgentsProvider())

# Each session is scoped to one of your users
session = composio.create(user_id="user_123")
tools = session.tools()

agent = Agent(
    name="Personal Assistant",
    instructions="You are a helpful assistant. Use Composio tools to take action.",
    tools=tools,
)

result = Runner.run_sync(starting_agent=agent, input="Summarize my emails from today")
print(result.final_output)

By default a session gets meta tools that discover, authenticate, and execute app tools at runtime, so you don't load hundreds of tool definitions into context. Store session.session_id and reuse it with composio.use() across turns. See what a session is and configuring sessions for restricting toolkits, auth configs, and connected accounts.

Prefer MCP? Every session also exposes a hosted MCP endpoint. Pass mcp: true to composio.create() and point Claude, Cursor, or any MCP client at session.mcp.url. See sessions via MCP.

CLI

The composio CLI runs Composio from your shell and gives coding agents like Claude Code a local tool surface.

curl -fsSL https://composio.dev/install | sh

The installer puts composio on your PATH for future terminals. Open a new terminal, then run composio login. See INSTALL.md for shell setup overrides, including COMPOSIO_INSTALL_SHELL=none for install-only runs.

Use composio search to find tools, composio execute to run them, composio link to connect accounts, and composio run to script workflows in TypeScript. See the CLI docs.

Providers

A provider adapts Composio tools to your agent framework's native tool format:

Provider TypeScript Python
OpenAI @composio/openai composio-openai
OpenAI Agents @composio/openai-agents composio-openai-agents
Anthropic @composio/anthropic composio-anthropic
Claude Agent SDK @composio/claude-agent-sdk composio-claude-agent-sdk
Vercel AI SDK @composio/vercel —
Google GenAI @composio/google composio-gemini, composio-google
Google ADK — composio-google-adk
LangChain @composio/langchain composio-langchain
LangGraph via @composio/langchain composio-langgraph
LlamaIndex @composio/llamaindex composio-llamaindex
Mastra @composio/mastra —
Pi @composio/experimental* —
Cloudflare Workers AI @composio/cloudflare —
CrewAI — composio-crewai
AutoGen — composio-autogen

* The Pi provider is experimental and ships from @composio/experimental.

Don't see your framework? Build a custom provider, or skip providers entirely and connect over MCP.

All packages

Everything published from this repo:

Package Description
@composio/core TypeScript SDK
@composio/slim @composio/core without packaged source or docs; same API, smaller install
composio CLI Standalone CLI binary: curl -fsSL https://composio.dev/install | sh
@composio/experimental Experimental integrations, including the Pi provider
@composio/json-schema-to-zod JSON Schema to Zod conversion
@composio/* provider adapters OpenAI, OpenAI Agents, Anthropic, Claude Agent SDK, Vercel, Google, LangChain, LlamaIndex, Mastra, Cloudflare
composio Python SDK
composio-* provider adapters OpenAI, OpenAI Agents, Anthropic, Claude Agent SDK, Gemini, Google, Google ADK, LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen

Repository layout

ts/                TypeScript SDK workspace
  packages/core/       @composio/core
  packages/providers/  Provider adapters
  packages/cli/        Composio CLI
python/            Python SDK and provider packages
docs/              Documentation site (docs.composio.dev)

The TypeScript SDK is tested against Node 22+; the Python SDK supports Python 3.10+.

Development

mise install    # pinned toolchain (Node, Python, pnpm)
pnpm install
pnpm build
pnpm test

Python commands run from python/; see python/README.md. We welcome contributions to both SDKs; read the contribution guidelines before submitting pull requests.

Support

License

MIT. See LICENSE.

S
Description
Route and complete Composio work across Composio For You and Composio Platform. Use when the user mentions Composio; wants an agent to use apps such as Gmail,…
Readme 1.3 GiB
Languages
TypeScript 72.2%
Python 23.3%
Shell 2.1%
JavaScript 2%
Swift 0.4%