mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00
Files
T
sdkrelease[bot] 9764ce33ff Release: update version (#3616 )
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to next, this PR will
be updated.


# Releases
## @composio/core@0.12.0

### Minor Changes

- a0bef5d: Bump `@composio/client` to `0.1.0-alpha.74`.
- dfd7a08: Add per-request cancellation to public SDK methods via a new
`ComposioRequestOptions` (`{ signal?: AbortSignal }`) trailing argument,
plus a typed `ComposioRequestCancelledError` for detecting
caller-initiated aborts.

Without this, a slow `tools.get` or `tools.execute` had no way to be
cancelled — a 100s search would block the calling agent indefinitely.
The new shape:

  ```typescript
  try {
    const tools = await composio.tools.get(
      'user_1',
      { search: 'send email', limit: 50 },
      { signal: AbortSignal.timeout(5_000) }
    );
  } catch (err) {
    if (err instanceof ComposioRequestCancelledError) {
      return;
    }
    throw err;
  }
  ```

The signal is forwarded to the underlying `@composio/client` fetch. Any
abort error (`APIUserAbortError`, `AbortError`, or
`DOMException(name='AbortError')`) coming back is normalized to
`ComposioRequestCancelledError` so callers can `instanceof`-detect
cancellation without unwrapping nested causes. Catch-and-wrap paths in
`tools.execute` / `tools.getRawComposioToolBySlug` / `toolkits.get`
re-throw the cancellation error rather than remapping it to
`ComposioToolExecutionError` / `ComposioToolNotFoundError` /
`ComposioToolkitFetchError`.

  Wired through on:
- **Tools**: `get`, `getRawComposioTools`, `getRawComposioToolBySlug`,
`getRawToolRouterSessionTools`, `execute`, `executeSessionTool`,
`getToolsEnum`, `getInput`, `proxyExecute`
  - **Toolkits**: `get`, `listCategories`
- **AuthConfigs**: `list`, `create`, `get`, `update`, `delete`,
`updateStatus`, `enable`, `disable`
- **ConnectedAccounts**: `list`, `get`, `delete`, `refresh`,
`updateStatus`, `enable`, `disable`, `update`
- **Triggers**: `listActive`, `create`, `update`, `delete`, `enable`,
`disable`, `listTypes`, `getType`, `listEnum`
  - **MCP**: `create`, `list`, `get`, `delete`, `update`, `generate`
- **ToolRouter** (`composio.create` / `composio.use`,
`composio.toolRouter.create` / `.use`) — long-running session-creation
paths
- **ToolRouterSession**: `authorize`, `toolkits`, `search`, `execute`,
`proxyExecute`, `update`

  ### Custom-tool cooperative cancellation

Native tool execution is cancelled by the SDK (the underlying `fetch` is
aborted). Custom tools are different — the SDK can't preempt
user-supplied JavaScript. Two affordances are added so callers get
sensible behavior anyway:

1. **Pre-execute signal check**: if `signal.aborted` is true before the
user's `execute` runs, the SDK throws `ComposioRequestCancelledError`
and never invokes user code.
2. **Cooperative signal forwarding**: the same `AbortSignal` is exposed
via `SessionContext.signal` for Tool Router custom tools. Long-running
implementations can wire `ctx.signal` into their own `fetch` (or any
abortable IO) to abort mid-execution; the resulting `AbortError` is
normalized to `ComposioRequestCancelledError` by the SDK.

  ```typescript
  import { experimental_createTool } from '@composio/core';

const longRunningFetch = experimental_createTool('LONG_RUNNING_FETCH', {
    name: 'Long-running fetch',
    description: 'Fetches a URL with cooperative cancellation',
    inputParams: z.object({ url: z.string() }),
    execute: async (input, ctx) => {
// Pass ctx.signal into fetch so a session.execute(...) abort cancels
      // the in-flight HTTP request mid-flight.
      const resp = await fetch(input.url, { signal: ctx.signal });
      return { result: await resp.json() };
    },
  });
  ```

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
- 4b76dbf: Remove the deprecated `uuid` field from the auth config
retrieve/list response type.

The platform has removed the deprecated V1/V2 UUID-mirror field from V3
API responses (it was a mirror of the canonical nanoid `id`). The SDK no
longer reads or re-exposes `uuid` on `AuthConfigRetrieveResponse` (and
therefore on the items of `AuthConfigListResponse`).

This is technically a breaking change to the SDK response type:
consumers should use `id` instead of `uuid`. The `expectedInputFields`
field is unaffected — it remains a top-level field on the API response.

### Patch Changes

- 552859a: Expose `search` and `showDisabled` filters on
`authConfigs.list()`.
- 23f9053: Replace `chalk` with `picocolors` for colored error and log
output. The two render identically, but `picocolors` is a fraction of
the size (~0.8 kB gzipped vs chalk's much larger footprint), shrinking
the bundled package.
- 507318d: Add a provider-agnostic JSON-schema property-key sanitizer:
`sanitizeSchemaPropertyKeys(schema, policy)`,
`restoreOriginalKeys(value, mapping)`, `mappingHasRenames(mapping)`, and
the `KeyMapping` / `KeySanitizationPolicy` types.

Some providers constrain the characters and length of tool
`input_schema` property keys and reject the whole request on a single
violation. This utility rewrites offending keys to conforming aliases
(recursing through `properties`, array `items`/`prefixItems`, the
composition keywords `allOf`/`anyOf`/`oneOf` and
`not`/`if`/`then`/`else`, plus
`additionalProperties`/`patternProperties`/`$defs`/`contains`) and
records a schema-shaped reverse mapping so the original parameter names
can be restored before execution. The _constraint_ is injected as a
`KeySanitizationPolicy`, so the traversal, collision handling, prototype
safety, and depth cap stay provider-agnostic. The `@composio/anthropic`
provider now consumes it.

- 6a4cb54: Preserve root `$defs` / `definitions` blocks on tool
parameter schemas and dereference them in the Node file modifier, so
auto file upload/download detection works when `file_uploadable` or
`file_downloadable` is hidden behind an internal `$ref`.
- cbbad15: Improve Zod compatibility at the SDK schema boundary. Custom
tools now convert both `zod/v3` and Zod v4 schemas to JSON Schema
correctly instead of degrading Zod v4 object schemas to empty schemas.
`@composio/core` now exposes `jsonSchemaToZodShape` via
`@composio/core/utils/json-schema`, and the Claude Agent SDK provider
uses that core subpath instead of converting to a full Zod object and
casting `.shape` out of it.
- Updated dependencies [025a657]
  - @composio/json-schema-to-zod@0.2.0
## @composio/json-schema-to-zod@0.2.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/anthropic@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- 507318d: Harden the Anthropic tool property-key sanitizer:

- **Broader schema coverage.** Illegal keys are now sanitized wherever
they appear in a tool schema — under the composition keywords
(`allOf`/`anyOf`/`oneOf`, `not`/`if`/`then`/`else`), `prefixItems`
tuples, `additionalProperties`/`patternProperties`, and
`$defs`/`definitions` — not just top-level `properties` and array
`items`. Previously a single illegal key under one of these would still
400 the entire request. Renames inside composition keywords are restored
correctly (they fold into the value level they share).
- **`$ref` keys restored.** `wrapTool` now dereferences internal
`$ref`/`$defs` (leniently — a dangling ref degrades to a permissive
schema instead of throwing) before sanitizing, so keys reachable only
through a reference are both made compliant and restored. Only genuinely
dynamic positions (`additionalProperties`, `patternProperties`,
`contains`) remain rewrite-only.
- **Shared core implementation.** The traversal/restoration mechanism
now lives in `@composio/core` (`sanitizeSchemaPropertyKeys` /
`restoreOriginalKeys`); this provider supplies only the Anthropic key
constraint as a policy, reusing core's prototype-pollution guard and
depth cap.
- **Prototype-safe key restoration.** Reverse-mapping lookups and the
rebuilt argument object are now prototype-free, so a tool call whose
arguments use a key matching an `Object.prototype` member (`__proto__`,
`constructor`, `toString`, `hasOwnProperty`, …) no longer throws or
silently corrupts the payload sent to the backend. `Object.prototype` is
never mutated.
- **Depth cap.** Schema sanitization and key restoration now bound
recursion (matching core's JSON-schema walker) so a pathologically deep
schema or argument object fails with a clear error instead of
overflowing the stack.
- **Empty / all-illegal keys.** A property key that is empty (or made
entirely of stripped characters) now becomes a deterministic non-empty
alias instead of an empty string, which would itself have violated
Anthropic's `{1,64}` length bound.
- **Collision loop.** Replaced a latent non-terminating fixed point in
the alias collision resolver with a counter that always makes progress.
- **Observability.** The provider now emits `debug` logs when it
rewrites a tool's schema keys and when it restores them at execution
time, and the wrap-then-execute (same provider instance) contract for
key restoration is documented.

- c90ae95: Sanitize tool `input_schema` property keys that violate
Anthropic's `^[a-zA-Z0-9_.-]{1,64}$` constraint before sending tools to
the Messages API, then restore the original names when the tool is
executed.

A single non-conforming key previously made Anthropic reject the entire
`tools` array with HTTP 400, taking down every other tool in the same
request. This commonly happened with OneDrive's Microsoft Graph OData
parameters (`$top`, `$filter`, `@microsoft.graph.conflictBehavior`) and
with over-long flattened keys from tools such as Zoom. Offending keys
are now rewritten to conforming aliases (`$` → `dollar_`, `@` → `at_`,
any other illegal character → `_`, keys longer than 64 characters
truncated with a deterministic suffix), recursing through nested object
`properties` and array `items` schemas. The original parameter names are
restored before the call reaches the Composio backend, so the model sees
`dollar_top` while the backend still receives `$top`. Schemas whose keys
already conform are left unchanged.
## @composio/claude-agent-sdk@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- cbbad15: Improve Zod compatibility at the SDK schema boundary. Custom
tools now convert both `zod/v3` and Zod v4 schemas to JSON Schema
correctly instead of degrading Zod v4 object schemas to empty schemas.
`@composio/core` now exposes `jsonSchemaToZodShape` via
`@composio/core/utils/json-schema`, and the Claude Agent SDK provider
uses that core subpath instead of converting to a full Zod object and
casting `.shape` out of it.
## @composio/cloudflare@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/google@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/langchain@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/llamaindex@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/mastra@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- aaabf5e: Relax the Mastra provider output schema so real third-party
API responses are no longer rejected by Mastra's output validation
(which dropped the data and substituted an error). Before compilation
the output schema is made lenient: every typed node becomes nullable,
objects allow extra keys (`additionalProperties: true`), `enum`/`const`
are widened to also admit `null`, and `required` is dropped (APIs omit
unset fields rather than returning `null` for them). All of these only
widen what validates, so previously-valid output is unaffected.
## @composio/openai@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/openai-agents@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/vercel@0.10.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/ts-builders@0.2.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/cli@0.3.0

### Minor Changes

- a0bef5d: Bump `@composio/client` to `0.1.0-alpha.74`.
- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- 5f004ff: Drop `COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from
the CLI meta-tool list. These slugs were removed from `@composio/client`
(alpha.74), so listing them broke the type-checked CLI build.
- 23f9053: Remove the unused `ansis` dependency from the CLI. Colored
output is already handled by `picocolors`, so `ansis` was a dead
production dependency that shipped with the package.
- 446c6f6: Fix virtual TypeScript file resolution used by CLI type
generation so in-memory imports resolve consistently during
transpilation and validation.
- Updated dependencies [552859a]
- Updated dependencies [a0bef5d]
- Updated dependencies [23f9053]
- Updated dependencies [dfd7a08]
- Updated dependencies [507318d]
- Updated dependencies [025a657]
- Updated dependencies [6a4cb54]
- Updated dependencies [4b76dbf]
- Updated dependencies [cbbad15]
  - @composio/core@0.12.0
  - @composio/json-schema-to-zod@0.2.0
  - @composio/ts-builders@0.2.0
  - @composio/cli-keyring@0.2.0
  - @composio/cli-local-tools@0.1.0
## @composio/cli-keyring@0.2.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.
## @composio/cli-local-tools@0.1.0

### Minor Changes

- 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK
packages as ESM-only packages. This is a breaking change within the
existing 0.x release line: consumers must use Node.js 22.22.3 or newer.
CommonJS callers can only rely on Node's native `require(esm)` interop,
and the SDK no longer ships custom CommonJS compatibility machinery or
`.cjs` artifacts.

### Patch Changes

- Updated dependencies [552859a]
- Updated dependencies [a0bef5d]
- Updated dependencies [23f9053]
- Updated dependencies [dfd7a08]
- Updated dependencies [507318d]
- Updated dependencies [025a657]
- Updated dependencies [6a4cb54]
- Updated dependencies [4b76dbf]
- Updated dependencies [cbbad15]
  - @composio/core@0.12.0

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-06-25 04:38:11 +04:00
config.json
fix(release): keep provider peer bumps range-aware (#3582 )
2026-06-16 16:04:25 +04:00
README.md
Add changesets
2025-05-19 19:30:29 +05:30
README.md

Changesets

Hello and welcome! This folder has been automatically generated by @changesets/cli, a build tool that works with multi-package repos, or single-package repos to help you version and publish your code. You can find the full documentation for it in our repository
We have a quick list of common questions to get you started engaging with this project in our documentation