mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00

Files

T

Alberto Schiabel 2dc9ef34d0 fix(cli): remove new Function() eval from JSON-ish input parsing (#3878 )

This PR:
- removes an in-process arbitrary-code-execution surface:
`parse-json-ish.ts` fell back to `Function("return (…)")()` for any
`tools execute --data`, `listen --params`, or `proxy` body value that
failed JSON and comment-JSON parsing — the CLI is agent-facing and
`--data` also accepts `@file` and stdin, so crafted or prompt-injected
input reached the eval
- lands the parser in its final consolidated shape:
`src/utils/parse-json.ts` parses JSON5 (unquoted keys, single quotes,
trailing commas, comments) without evaluating anything and returns
`Either` with a typed `JsonParsingError`
- consolidates the `effect-errors` read-json duplicates onto the same
parser and swaps `comment-json` for `json5` (the stack's only lockfile
change)
- pins code-execution probes in unit tests (`new Date()`, computed
expressions, `globalThis` writes are rejected, never evaluated)
- intentional narrowing: JS expressions such as `1+1` that only worked
because of the eval now fail with a parse error; proxy bodies that are
not JSON5 records fall back to the raw string
---

**Stack** (re-slice of https://github.com/ComposioHQ/composio/pull/3859;
each PR targets its parent and auto-retargets to `next` as parents
merge):

1. https://github.com/ComposioHQ/composio/pull/3877 — guidelines + inert
rule groups
2. https://github.com/ComposioHQ/composio/pull/3878 — `new Function()`
eval security fix ← **this PR**
3. https://github.com/ComposioHQ/composio/pull/3879 — behavioral fix
pack
4. https://github.com/ComposioHQ/composio/pull/3880 — platform-imports
rule + migration
5. https://github.com/ComposioHQ/composio/pull/3881 — terminal-streams
rule + TerminalUI boundary
6. https://github.com/ComposioHQ/composio/pull/3882 — descriptor seam +
zod→Schema
7. https://github.com/ComposioHQ/composio/pull/3883 — test-tree lint +
deterministic suites
8. https://github.com/ComposioHQ/composio/pull/3884 — typed error
boundaries + v4 seams
9. https://github.com/ComposioHQ/composio/pull/3885 — try/catch+env ban
+ boundary ratchet

On stacked bases CI runs lint/build and the CLI Docker e2e job; unit
tests and typecheck are verified locally per PR and re-verified by full
CI when each PR is retargeted to `next`.

2026-07-21 11:14:55 +04:00

docs

revert(core): defer v1 session alias removal (#3826 )

2026-07-14 01:01:18 +04:00

e2e-tests

fix(cli): honor if-present for unsupported hosts

2026-07-14 19:35:10 -07:00

examples

revert(core): defer v1 session alias removal (#3826 )

2026-07-14 01:01:18 +04:00

packages

fix(cli): remove new Function() eval from JSON-ish input parsing (#3878 )

2026-07-21 11:14:55 +04:00

scripts

fix(release): guard and document CLI releases (#3895 )

2026-07-20 23:17:03 +04:00

vendor

chore(cli): land Effect-first guidelines and inert guardrail rule groups (#3877 )

2026-07-21 11:13:04 +04:00

AGENTS.md

fix(release): guard and document CLI releases (#3895 )

2026-07-20 23:17:03 +04:00

README.md

revert(core): defer v1 session alias removal (#3826 )

2026-07-14 01:01:18 +04:00

README.md

Composio TypeScript workspace

This directory contains the TypeScript half of the Composio SDK monorepo: the core SDK, provider adapters, the CLI, examples, and end-to-end tests. For an overview of Composio itself, start at the root README and docs.composio.dev.

If you just want to use the SDK:

npm install @composio/core

import { Composio } from '@composio/core';

const composio = new Composio({ apiKey: process.env.COMPOSIO_API_KEY });

const session = await composio.create('user_123');
const tools = await session.tools();

See the @composio/core README and the quickstart for the full flow, including provider setup for your agent framework.

Packages

Published packages:

Package	Description
`@composio/core`	The Composio SDK. Ships its TypeScript source and SDK docs so installed copies are inspectable by coding agents.
`@composio/slim`	Same API as `@composio/core` without the packaged source and docs; smaller install.
`composio` CLI	Standalone CLI binary: search, execute, and script tools from your shell.
`@composio/*` providers	Adapters that format Composio tools for agent frameworks (OpenAI, Anthropic, Vercel AI SDK, LangChain, and more). See the provider table.
`@composio/experimental`	Experimental integrations, currently the Pi provider.
`@composio/json-schema-to-zod`	JSON Schema to Zod conversion.

Internal (unpublished) packages: cli-keyring and cli-local-tools support the CLI; ts-builders generates TypeScript source.

Layout

ts/
  packages/        Published and internal packages (see above)
  examples/        Runnable examples per feature and framework
  e2e-tests/       Runtime E2E tests (Node, Deno, Cloudflare Workers, CLI)
  docs/            Workspace SDK docs: API notes and internal guides
  scripts/         Build, validation, and scaffolding scripts
  vendor/          Read-only reference submodules; do not edit

Development

Commands run from the repository root. Install the pinned toolchain first:

mise install
pnpm install

Build and verify:

pnpm build:packages   # build all TS packages
pnpm typecheck        # typecheck all TS packages
pnpm lint:packages    # eslint over ts/packages
pnpm test             # package unit tests plus example validation

Runtime E2E suites (require credentials):

pnpm test:e2e:node
pnpm test:e2e:deno
pnpm test:e2e:cloudflare
pnpm test:e2e:cli

Scaffolding:

pnpm create:provider <name> [--agentic]   # new provider package
pnpm create:example <name>                # new example under ts/examples

Changesets are required for changes to published packages; see the contribution guidelines.

README.md

Composio TypeScript workspace

Packages

Layout

Development

Support