mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
Alberto Schiabel
64406ff359
Bumps the mise-pinned Bun toolchain from 1.3.10 to 1.4.0 and replaces the one CLI dependency that a Bun 1.4 built-in can verifiably take over. ## Binary size: Linux shrinks a lot, macOS grows a little Measured per target, byte counts from `build:binary:all` on a darwin-arm64 host. | Target | Before (1.3.10) | After runtime (1.4.0) | After full | Δ total | Δ % | |---|---:|---:|---:|---:|---:| | `composio-darwin-aarch64` | 80,850,704 (77.1 MiB) | 83,790,962 (79.9 MiB) | 83,790,962 (79.9 MiB) | +2,940,258 (+2.8 MiB) | +3.6% | | `composio-darwin-x64` | 85,710,240 (81.7 MiB) | 90,430,880 (86.2 MiB) | 90,430,880 (86.2 MiB) | +4,720,640 (+4.5 MiB) | +5.5% | | `composio-linux-x64` | 123,666,298 (117.9 MiB) | 102,270,152 (97.5 MiB) | 102,270,152 (97.5 MiB) | -21,396,146 (-20.4 MiB) | -17.3% | | `composio-linux-aarch64` | 121,153,270 (115.5 MiB) | 102,221,816 (97.5 MiB) | 102,221,816 (97.5 MiB) | -18,931,454 (-18.1 MiB) | -15.6% | **Attribution — read this before quoting the numbers.** Every byte of movement above comes from the **Bun runtime bump**, not from dependency removal. The "after runtime" and "after full" columns are byte-identical: the only dependency dropped here is `tar`, a devDependency used by one build script that never reaches the binary. Its size contribution is exactly **0 bytes**. (The identical columns also confirm the compiled build is reproducible across runs.) Linux users — the large majority of installs — get a ~18-20 MiB smaller binary. macOS grows 2.8-4.5 MiB. This matches the direction upstream reports for the standalone Bun binary. ## What changed - `mise.toml` pins `bun = "1.4.0"`; `mise.lock` regenerated with the exact platform list `ts.audit` uses. - `scripts/_acp-adapters.ts` extracts npm tarballs with `Bun.Archive` instead of the `tar` package. - `tar` dropped from `@composio/cli` devDependencies (plus `@isaacs/fs-minipass`, `chownr`, `minizlib`, `yallist` from the lockfile). ## Verified negative results These are the two adjacent candidates a reviewer would expect to see replaced. Both were probed against a real Bun 1.4.0 binary and both fail — recorded here so nobody re-derives the dead ends: - **`extract-zip` stays.** `Bun.Archive` cannot read zip: `new Bun.Archive(zipBytes)` throws `Unrecognized archive format`, and `ArchiveOptions.compress` accepts only `"gzip"`. Still used at three call sites. - **`semver` stays.** `Object.keys(Bun.semver)` returns exactly `["satisfies", "order"]`. The CLI also needs `valid`, `prerelease`, `compare`, `gt`, and `lt`. `valid` and `prerelease` have no equivalent, so a partial migration would only add a second semver dialect. ## `json5` → `Bun.JSON5` was attempted and backed out `parse-json.ts` is covered by the CLI's Vitest suite, which runs on **Node**, where the `Bun` global does not exist — `Bun.JSON5.parse` throws `ReferenceError` under test. The suite cannot move to the Bun runtime (88 of 122 files fail there on unrelated zod resolution errors), and `bun test` for a single file would conflict with the repo's `@effect/vitest` lint rule. The swap itself is sound — `Bun.JSON5.parse` matched the `json5` package on all nine contract cases against a real 1.4.0 binary, including `SyntaxError` on malformed input. It is the test harness, not the parser, that blocks it. Deferred rather than shipped with weakened coverage. For sizing the follow-up: `--metafile-md` puts `json5` at **28,045 bytes (0.1%)** of the JS bundle, imported only by `src/utils/parse-json.ts` — roughly 0.03% of a compiled binary. Worth doing for dependency-surface reasons, not for size. ## Verification - All four release targets cross-compile on Bun 1.4.0. - `mise lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64` then `git diff --exit-code mise.lock` is clean, replayed in a CI-like environment. - `pnpm typecheck` clean; CLI suite green (122 files, 1248 passed, 1 skipped). - `Bun.Archive` adapter build against the live npm registry produces codex-acp binaries **byte-identical** (SHA-256) to the `tar`-produced ones, at the same `package/bin/<name>` paths, executable after `chmod`, extracted concurrently. A truncated tarball throws `ReadError` rather than silently yielding an empty directory. - Runtime smoke on the 1.4.0 binary: `composio version`, `composio --help`, and the `composio run` companion-module spawn path (reports `process.version` v26.3.0 — no Node 26 stream regression). `extract-zip` verified working under the new runtime. ### Not run locally `pnpm test:e2e:cli` needs Docker, which was unavailable on this machine. CI covers it. Worth a look at that job: the e2e image is version-keyed and has served a stale Bun binary from a cached layer before, so confirm the container reports 1.4.0. ## Notes - `@types/bun` is deliberately not bumped: `Bun.JSON5` and `Bun.Archive` are already declared in the installed `bun-types@1.3.14`, no `@types/bun` 1.4.x exists yet, and `minimumReleaseAge` would block a fresh pin anyway. - No changeset: `@composio/cli` is in `.changeset/config.json`'s `ignore` list and no published package is touched. - `mise lock` locally adds a stray `[[tools.node]] 24.19.0` block sourced from the developer's global mise config. It was stripped; the committed lock is stable under the audit gate's exact command.
Composio TypeScript workspace
This directory contains the TypeScript half of the Composio SDK monorepo: the core SDK, provider adapters, the CLI, examples, and end-to-end tests. For an overview of Composio itself, start at the root README and docs.composio.dev.
If you just want to use the SDK:
npm install @composio/core
import { Composio } from '@composio/core';
const composio = new Composio({ apiKey: process.env.COMPOSIO_API_KEY });
const session = await composio.create('user_123');
const tools = await session.tools();
See the @composio/core README and the quickstart for the full flow, including provider setup for your agent framework.
Packages
Published packages:
| Package | Description |
|---|---|
@composio/core |
The Composio SDK. Ships its TypeScript source and SDK docs so installed copies are inspectable by coding agents. |
@composio/slim |
Same API as @composio/core without the packaged source and docs; smaller install. |
composio CLI |
Standalone CLI binary: search, execute, and script tools from your shell. |
@composio/* providers |
Adapters that format Composio tools for agent frameworks (OpenAI, Anthropic, Vercel AI SDK, LangChain, and more). See the provider table. |
@composio/experimental |
Experimental integrations, currently the Pi provider. |
@composio/json-schema-to-zod |
JSON Schema to Zod conversion. |
Internal (unpublished) packages: cli-keyring and cli-local-tools support the CLI; ts-builders generates TypeScript source.
Layout
ts/
packages/ Published and internal packages (see above)
examples/ Runnable examples per feature and framework
e2e-tests/ Runtime E2E tests (Node, Deno, Cloudflare Workers, CLI)
docs/ Workspace SDK docs: API notes and internal guides
scripts/ Build, validation, and scaffolding scripts
vendor/ Read-only reference submodules; do not edit
Development
Commands run from the repository root. Install the pinned toolchain first:
mise install
pnpm install
Build and verify:
pnpm build:packages # build all TS packages
pnpm typecheck # typecheck all TS packages
pnpm lint:packages # oxlint over ts/packages
pnpm test # package unit tests plus example validation
Runtime E2E suites (require credentials):
pnpm test:e2e:node
pnpm test:e2e:deno
pnpm test:e2e:cloudflare
pnpm test:e2e:cli
Scaffolding:
pnpm create:provider <name> [--agentic] # new provider package
pnpm create:example <name> # new example under ts/examples
Changesets are required for changes to published packages; see the contribution guidelines.