Composio

Minor Changes

• 1503786: Replace the loose JSON Schema property type with a recursive, type-safe definition.

  JSONSchemaProperty (re-exported from @composio/core and reachable through Tool.input_parameters / Tool.output_parameters) is now a concrete recursive interface instead of effectively any. Runtime behavior is unchanged, but consumer code that indexed into it without narrowing (for example schema.properties.foo.type or schema.default.someField) may see new type errors: properties entries are now possibly undefined and default / enum values are unknown. Narrow with optional chaining or explicit type guards when upgrading.

Patch Changes

• 2ac6ad3: Bound the background npm version check so registry outages cannot leave the request pending indefinitely.
• 5105612: Match sensitive upload path segments using the target filesystem's actual case sensitivity so case-insensitive mounts cannot bypass the denylist without over-blocking distinct paths on case-sensitive mounts.
• 051c8c5: Redact secrets that appear inside JSON payloads in telemetry error text. The key/value rule required the separator to follow the key name directly, so a serialized body such as {"api_key": "..."} — the shape error messages usually carry — was sent unredacted.
• e5c9ada: Refresh the OpenAI runtime dependency to version 7.
• ecd0861: Release unread response bodies on the paths the SDK knowingly abandons: cancel every intermediate redirect body in ssrfSafeFetch, and the response body before throwing on !response.ok in both URL-upload call sites, instead of leaving them for the garbage collector to reclaim.
• 2a6a051: Remove the unused internal isNewerVersion helper.
• Updated dependencies [1503786]
  • @composio/json-schema-to-zod@0.2.2

Patch Changes

• 577a3d4: Replace the backtracking leading/trailing-slash-trim regexes in the Cloudflare Workers/Edge platform path helpers with index-walk loops, closing a polynomial-time regular expression denial-of-service (CodeQL js/polynomial-redos) on long runs of slash characters. Output is unchanged for every input.
• 503b50a: Refresh runtime dependencies across the TypeScript SDK packages.
• 2f63fe5: Guard Tool Router session URL uploads against SSRF, revalidate redirect targets, and enforce a streamed 100 MiB response limit across TypeScript URL upload paths.

Minor Changes

• fc17c37: Export the sensitive-file-upload denylist guard from the package root so downstream packages share one implementation: assertSafeFileUploadPath, isBlockedSensitiveFileUploadPath, and BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS. The guard now routes its filesystem access through the internal #platform abstraction (adding a realpathSync platform method), so it is edge/workerd-safe and the module carries no static node:* imports. Behavior on Node/Bun is unchanged.

• 20a4711: triggers.create now resolves the connection from user_id on the backend instead of client-side.

  • The SDK no longer makes an extra connectedAccounts.list() call. When connectedAccountId is omitted, the backend resolves the first active connection for the user and the trigger's toolkit (ordered by most recently created), matching tool execution.
  • Behavior change: create no longer throws ComposioConnectedAccountNotFoundError for a missing or invalid connection. That case now surfaces as the backend error from the upsert call. ComposioTriggerTypeNotFoundError (invalid slug) and ValidationError (including empty userId) are still thrown client-side.
  • Requires a backend that resolves the trigger connection from user_id on upsert (ComposioHQ/platform#10932). Self-hosted deployments must be on a version that includes it.

Patch Changes

• 7125576: Normalize duplicate JSON Schema required entries before provider tool schemas are emitted.

• 58bc93b: Refresh dependency ranges and lockfiles across the workspace.

• 4c3a321: Disable client retries on tools.execute and tools.proxyExecute. These are non-idempotent writes, so a silent retry after a read timeout could duplicate the side effect (e.g. send the same email more than once). Both now route through a sibling client built with maxRetries: 0; reads keep the default retry behaviour.

• b07fcad: Add an eve provider: EveProvider makes session.tools() return eve-native defineTools, defineComposioTools is the replay-safe step.started resolver, and (ctx, next) hooks can rewrite, deny, or transform Tool Router meta-tool calls.

  Preserve successful local-tool results when the remote half of a mixed COMPOSIO_MULTI_EXECUTE_TOOL batch fails at the transport layer, so callers can see which side effects already completed before retrying.

• fa933a6: Fix the homepage links in these packages' package.json. They pointed at github.com/ComposioHQ/composio/tree/main/..., but the default branch is next and no main branch exists, so every link 404'd on npm and in editor tooltips. They now point at tree/next/....

• 2ef40ce: Treat local file paths that begin with http as paths instead of URLs, ensuring that upload allowlist and sensitive-file denylist checks still run.

• e78ed31: Execute every parallel tool call in OpenAIProvider.handleToolCalls. It previously only ran the first tool call in each assistant message, so parallel tool calls (on by default) dropped the rest and left their tool_call_ids unanswered, failing the next request.

  The calls are run sequentially, in the order the model returned them — here "parallel" means the model issued several calls in one turn, not that they execute concurrently — so each tool_call_id is answered exactly once and the tool messages come back in a deterministic order.

  Only the first choice is handled. Tool results are fed back into a single assistant turn, so with n > 1 iterating over every choice would run each tool call once per choice and orphan the tool_call_ids from the alternative completions.

• a0f37a7: Close two secret/SSRF exposure surfaces in the TypeScript SDK:

  • SSRF guard on URL file inputs. composio.files.upload(url) and automatic file upload during tool execution previously did a raw fetch() on user-supplied URLs with no guard. They now resolve the host and refuse private, loopback, link-local (incl. the 169.254.169.254 cloud-metadata endpoint), CGNAT, and reserved addresses, reject non-http(s) schemes, and follow redirects manually so each hop is re-validated (blocking a public URL that redirects into internal space). Blocked requests throw ComposioBlockedInternalUrlError. Node-only; behaviour for public URLs is unchanged.
  • Telemetry redaction. Error telemetry previously shipped error.message / error.stack verbatim. They are now passed through a redactor that strips URL query strings, Authorization bearer/basic credentials, and secret-like key=value pairs (API keys, tokens, client secrets, passwords) before transport.

• 820abb9: Resolve toolkit version pins case-insensitively. Version maps are keyed by normalized (lowercase) slugs, but getToolkitVersion previously looked them up with the raw slug, so a pin configured under a different casing (e.g. { GitHub: '20250101_00' } or COMPOSIO_TOOLKIT_VERSION_GITHUB) could silently fall back to 'latest'. Normalization is now centralized in a single normalizeToolkitSlug helper used symmetrically on both the write (map-building) and read (lookup) paths, so the two sides can no longer drift. This mirrors the equivalent fix in the Python SDK.

• Updated dependencies [58bc93b]

• Updated dependencies [fa933a6]

  • @composio/json-schema-to-zod@0.2.1

Patch Changes

• 605a726: Add Tool Router session deletion APIs.

Minor Changes

• d17a268: Add the first-class composio.sessions.create() API while keeping composio.create() as an alias, expose the experimental shared-connection ACL patch helper as connectedAccounts.updateAcl() while keeping experimental.updateAcl() as an alias, and include SDK docs/source in the published package.

  MCP is now opt-in. Sessions return native tools by default; the hosted MCP endpoint is only surfaced on the type when you create the session with { mcp: true }. The default create() / use() now return SessionWithoutMcp (the runtime object is unchanged — session.mcp still exists at runtime — but it is no longer in the type).

  Migration: read session.mcp only after creating with { mcp: true }.

• d17a268: Surface the resolved workbench config on Tool Router sessions.

  • Session.workbench is now populated from the API response (on create/retrieve/attach/update). It exposes the resolved workbench config, e.g. session.workbench?.enable (defaults to true server-side).

  This lets callers create a session with the remote workbench disabled (workbench: { enable: false }) and detect that state — the foundation for running code in a sandbox you own via the experimental @composio/experimental/workbench helpers.

Patch Changes

• d17a268: Prefer sandbox for session code-execution configuration while continuing to accept the existing workbench alias.
• d17a268: Add triggers.parse() to parse and optionally verify incoming webhook requests.
• d17a268: Add triggers.setWebhookSubscription() to create or update the project webhook subscription from the TypeScript SDK.

Minor Changes

• a0bef5d: Bump @composio/client to 0.1.0-alpha.74.

• dfd7a08: Add per-request cancellation to public SDK methods via a new ComposioRequestOptions ({ signal?: AbortSignal }) trailing argument, plus a typed ComposioRequestCancelledError for detecting caller-initiated aborts.

  Without this, a slow tools.get or tools.execute had no way to be cancelled — a 100s search would block the calling agent indefinitely. The new shape:

  try {
    const tools = await composio.tools.get(
      'user_1',
      { search: 'send email', limit: 50 },
      { signal: AbortSignal.timeout(5_000) }
    );
  } catch (err) {
    if (err instanceof ComposioRequestCancelledError) {
      return;
    }
    throw err;
  }
  

  The signal is forwarded to the underlying @composio/client fetch. Any abort error (APIUserAbortError, AbortError, or DOMException(name='AbortError')) coming back is normalized to ComposioRequestCancelledError so callers can instanceof-detect cancellation without unwrapping nested causes. Catch-and-wrap paths in tools.execute / tools.getRawComposioToolBySlug / toolkits.get re-throw the cancellation error rather than remapping it to ComposioToolExecutionError / ComposioToolNotFoundError / ComposioToolkitFetchError.

  Wired through on:

  • Tools: get, getRawComposioTools, getRawComposioToolBySlug, getRawToolRouterSessionTools, execute, executeSessionTool, getToolsEnum, getInput, proxyExecute
  • Toolkits: get, listCategories
  • AuthConfigs: list, create, get, update, delete, updateStatus, enable, disable
  • ConnectedAccounts: list, get, delete, refresh, updateStatus, enable, disable, update
  • Triggers: listActive, create, update, delete, enable, disable, listTypes, getType, listEnum
  • MCP: create, list, get, delete, update, generate
  • ToolRouter (composio.create / composio.use, composio.toolRouter.create / .use) — long-running session-creation paths
  • ToolRouterSession: authorize, toolkits, search, execute, proxyExecute, update

  Custom-tool cooperative cancellation

  Native tool execution is cancelled by the SDK (the underlying fetch is aborted). Custom tools are different — the SDK can't preempt user-supplied JavaScript. Two affordances are added so callers get sensible behavior anyway:

  1. Pre-execute signal check: if signal.aborted is true before the user's execute runs, the SDK throws ComposioRequestCancelledError and never invokes user code.
  2. Cooperative signal forwarding: the same AbortSignal is exposed via SessionContext.signal for Tool Router custom tools. Long-running implementations can wire ctx.signal into their own fetch (or any abortable IO) to abort mid-execution; the resulting AbortError is normalized to ComposioRequestCancelledError by the SDK.

  import { experimental_createTool } from '@composio/core';
  
  const longRunningFetch = experimental_createTool('LONG_RUNNING_FETCH', {
    name: 'Long-running fetch',
    description: 'Fetches a URL with cooperative cancellation',
    inputParams: z.object({ url: z.string() }),
    execute: async (input, ctx) => {
      // Pass ctx.signal into fetch so a session.execute(...) abort cancels
      // the in-flight HTTP request mid-flight.
      const resp = await fetch(input.url, { signal: ctx.signal });
      return { result: await resp.json() };
    },
  });
  

• 025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native require(esm) interop, and the SDK no longer ships custom CommonJS compatibility machinery or .cjs artifacts.

• 4b76dbf: Remove the deprecated uuid field from the auth config retrieve/list response type.

  The platform has removed the deprecated V1/V2 UUID-mirror field from V3 API responses (it was a mirror of the canonical nanoid id). The SDK no longer reads or re-exposes uuid on AuthConfigRetrieveResponse (and therefore on the items of AuthConfigListResponse).

  This is technically a breaking change to the SDK response type: consumers should use id instead of uuid. The expectedInputFields field is unaffected — it remains a top-level field on the API response.

Patch Changes

• 552859a: Expose search and showDisabled filters on authConfigs.list().

• 23f9053: Replace chalk with picocolors for colored error and log output. The two render identically, but picocolors is a fraction of the size (~0.8 kB gzipped vs chalk's much larger footprint), shrinking the bundled package.

• 507318d: Add a provider-agnostic JSON-schema property-key sanitizer: sanitizeSchemaPropertyKeys(schema, policy), restoreOriginalKeys(value, mapping), mappingHasRenames(mapping), and the KeyMapping / KeySanitizationPolicy types.

  Some providers constrain the characters and length of tool input_schema property keys and reject the whole request on a single violation. This utility rewrites offending keys to conforming aliases (recursing through properties, array items/prefixItems, the composition keywords allOf/anyOf/oneOf and not/if/then/else, plus additionalProperties/patternProperties/$defs/contains) and records a schema-shaped reverse mapping so the original parameter names can be restored before execution. The constraint is injected as a KeySanitizationPolicy, so the traversal, collision handling, prototype safety, and depth cap stay provider-agnostic. The @composio/anthropic provider now consumes it.

• 6a4cb54: Preserve root $defs / definitions blocks on tool parameter schemas and dereference them in the Node file modifier, so auto file upload/download detection works when file_uploadable or file_downloadable is hidden behind an internal $ref.

• cbbad15: Improve Zod compatibility at the SDK schema boundary. Custom tools now convert both zod/v3 and Zod v4 schemas to JSON Schema correctly instead of degrading Zod v4 object schemas to empty schemas. @composio/core now exposes jsonSchemaToZodShape via @composio/core/utils/json-schema, and the Claude Agent SDK provider uses that core subpath instead of converting to a full Zod object and casting .shape out of it.

• Updated dependencies [025a657]

  • @composio/json-schema-to-zod@0.2.0