Alberto Schiabel
62e51e838f
## Summary Refreshes the safe TypeScript, Python, and GitHub Actions dependency surface in one maintainer-owned change. Effect 4 rc.115, Vitest 5, the vendored Effect source, CLI migrations, and agent guidance move together, while known incompatible boundaries stay pinned. The Effect v4 config schemas preserve unknown fields across `config.json` and `user_data.json` read-update-write cycles. Fixes #4535 ## Changes - Keeps Cloudflare Workers fixtures on Vitest 4 until `@cloudflare/vitest-pool-workers` supports Vitest 5. - Keeps Mastra on the Workers-compatible versions and AG2 below 1.0 because AG2 1.x no longer ships the imported `autogen` module. - Removes the unused package-level `pnpm` dependency instead of changing the repository's pinned pnpm 11 toolchain. - Migrates the Effect CLI APIs, Eve callback contract, provider peer ranges, and repository skills required by the selected upgrades. - Preserves unknown CLI settings when `config.json` and `user_data.json` are read, updated, and written back. - Uses immutable SHA pins for the refreshed Claude Code actions and adds release metadata for the affected published TypeScript packages. ## Type of change - [x] Bug fix - [ ] New feature - [x] Refactor/Chore - [x] Documentation - [ ] Breaking change ## How Has This Been Tested? - `pnpm install --frozen-lockfile` with pnpm 11.8.0 - `pnpm typecheck` - `pnpm build:packages` - `pnpm --filter @composio/cli test` — 1,400 passed, 1 skipped, including targeted persistence regressions for `config.json` and `user_data.json` - Package tests — 28 workspace tasks passed - Example typechecks/tests and all Cloudflare dry-runs - Provider compatibility, experimental/Eve, Mastra, CLI keyring, and JSON-schema Effect checks - Agent-skill validation, routing validation, Effect skill example compilation, and peer-dependency checks - All three Python `uv lock --check` runs - `nox -s tst_autogen`, `nox -s snt`, and `nox -s chk type_inference` - Production dependency audit completed with the repository's three existing ignored advisories Docker CLI E2E was not run locally because the Docker daemon is unavailable. The exact root lint command also enters the vendored Effect submodule, whose checkout does not install its `@effect/oxc/oxlint` plugin; scoped lint over the changed non-vendor files passed. ## Screenshots (if applicable) Not applicable. ## Checklist - [x] I have read the Code of Conduct and this PR adheres to it - [ ] I ran linters/tests locally and they passed - [x] I updated documentation as needed - [x] I added tests or explain why not applicable - [x] I added a changeset if this change affects published packages The dependency migrations are covered by the focused and workspace suites. Two targeted regression tests verify that CLI updates preserve unknown fields in `config.json` and `user_data.json`. ## Additional context The Connect client sync retains its existing `Bash(curl *)` permission while moving the removed `allowed_tools` input to `claude_args`. A separate hardening change should move logo downloads outside the model-controlled shell boundary. --- [](https://github.com/EveryInc/compound-engineering-plugin)
Composio TypeScript examples
Each directory here is its own private workspace package (<name>-example) showing one integration or feature: openai/, anthropic/, langchain/, typesafe/, connected-accounts/, tools/, triggers/, mcp/, tool-router/, and more.
Run one example
cd ts
pnpm install
out=$(node ../scripts/examples-provision.mjs) && eval "$out"
pnpm --filter openai-example start
pnpm --filter <package-name> start runs the example with bun (see the scripts.start entry in that package's package.json). Some packages expose extra entrypoints alongside start, for example openai-example also has start:chat-completion, start:assistant, and start:mcp — check the package's package.json for the full list.
Configuration
Examples read configuration from environment variables and fail loudly, naming the missing variable, if one isn't set:
COMPOSIO_API_KEY— always required.COMPOSIO_EXAMPLES_USER_ID— the user id examples act as.COMPOSIO_EXAMPLES_{GMAIL,GITHUB,SLACK}_AUTH_CONFIG_IDandCOMPOSIO_EXAMPLES_{GMAIL,GITHUB,SLACK}_CONNECTED_ACCOUNT_ID— per-toolkit auth config and standing connected account.COMPOSIO_EXAMPLES_APIKEY_AUTH_CONFIG_IDandCOMPOSIO_EXAMPLES_APIKEY_PLACEHOLDER— the serpapi API-key auth config and its placeholder key value.OPENAI_API_KEY/ANTHROPIC_API_KEY/TYPESAFE_API_KEY— only needed by examples that call that model provider.
node ../scripts/examples-provision.mjs (run from ts/, or node scripts/examples-provision.mjs from the repo root) checks a Composio project for this state, prints a report to stderr, and prints export COMPOSIO_EXAMPLES_*=... lines to stdout. Load them with out=$(node ../scripts/examples-provision.mjs) && eval "$out". Capture first, then eval. eval "$(...)" reports the status of the text it evaluates, so it would hide a failed provisioning run. It's idempotent — it verifies what already exists and only creates what's missing — and it never prints credential values.
Add --initiate-missing to also start an OAuth connection request for any toolkit (gmail, googledrive, github, slack) that has no active connected account yet; it prints an authorization URL to visit once in a browser. The serpapi API-key auth config is created automatically, no browser step needed.
Run node ../scripts/examples-provision.mjs --gc to delete what example runs leave behind: connected accounts that never reached ACTIVE, surplus serpapi demo accounts, and MCP configs from earlier runs. It skips anything created in the last 24h and only touches resources the examples created. It deletes for real, so preview it with --gc --dry-run first and point it only at the disposable examples project.
A note on connection examples
Examples that demonstrate creating a connection (for example connected-accounts/) only initiate the OAuth flow and print a line like Please visit the following URL to authorize the user: ... — running them does not require you to complete that authorization. Examples that use a connection (calling a tool through Gmail, GitHub, or Slack) rely on the standing connected accounts that the provisioning script already verified are active.