chore(cli): prepare Effect v4 migration

[Alberto Schiabel (jkomyno)]

Summary

Agents can now start the CLI's Effect v4 migration from a verified, repository-local baseline instead of translating APIs from memory. The production CLI remains on Effect v3; this PR establishes the migration guidance, exact beta matrix, source oracle, and behavior checks needed for later implementation slices.

The foundation deliberately keeps two versions separate: ts/vendor/effect tracks upstream source for API investigation, while executable examples compile against the published 4.0.0-beta.98 packages. This prevents an unreleased upstream API from being mistaken for an installable CLI dependency.

What reviewers should assess

• The new effect-v4 skill captures the Composio-specific CLI seams that are not mechanical renames: built-ins, suggestions, argument preprocessing, help/error rendering, and Command.runWith behavior.
• typescript-testing now describes the current Effect v3 suite and the future v4 @effect/vitest boundary without encouraging a premature mixed-version test graph.
• The example compiler enforces exact aligned betas, checks all known v4 examples, fails when an expected code block disappears, and invalidates its cache when compiler/bootstrap configuration changes.
• The Effect source-oracle gitlink advances from 4f2107548fa64c21a8643b7b0efcd556cd16d4b9 to upstream main at 80b539f8aba68f478c75c35c2b4140c4ffc4fada.

No changeset is included because published package dependencies and runtime behavior are unchanged.

Validation

• node .agents/skills/effect-v4/scripts/check-examples.mjs — all three Effect v4 examples compile against the exact beta matrix.
• Negative probe — an explicit Markdown target with no checked TypeScript blocks exits non-zero.
• pnpm validate:agent-skills — 16 canonical skills validated.
• pnpm validate:skill-routing — 16 routing probes pass.
• Skill shape validation passes for effect-v4 and typescript-testing.
• Targeted Prettier and ESLint pass with zero errors.
• pnpm --filter @composio/cli typecheck and pnpm --filter @composio/cli build pass.
• Focused CLI Vitest: 41 tests pass. The broader CLI suite also passed during implementation: 781 passed, 1 skipped.
• Live upstream verification confirms the checked-out submodule SHA equals canonical Effect-TS/effect main.

Post-Deploy Monitoring & Validation

No additional production monitoring is required because this PR changes agent guidance and a read-only source oracle, not the shipped CLI runtime. During the next migration slice, the SDK owner should treat the agent-skill validators, exact-beta example compiler, CLI typecheck/build, and CLI behavior suites as the healthy signals; any red check, beta misalignment, or help/output regression is the rollback trigger. Reverting this commit restores the previous guidance and gitlink.

---

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 15, 2026 8:55pm

[github-actions]

⚠️ Security Audit Warning

The pnpm audit --prod check found security vulnerabilities in production dependencies.

Please review and fix the vulnerabilities. You can try running:

pnpm audit --fix --prod

Audit output

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ low                 │ @ai-sdk/provider-utils has an Uncontrolled Resource    │
│                     │ Consumption issue                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ @ai-sdk/provider-utils                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=3.0.97                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.0.98                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/core>@ai-sdk/provider-utils                 │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v3>@mastra/mcp>@mastra/core>@ai-sdk/provider-utils     │
│                     │                                                        │
│                     │ ts__e2e-tests__runtimes__node__mastra-tool-router-zod- │
│                     │ v4>@mastra/core>@ai-sdk/provider-utils                 │
│                     │                                                        │
│                     │ ... Found 14 paths, run `pnpm why                      │
│                     │ @ai-sdk/provider-utils` for more information           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-866g-f22w-33x8      │
└─────────────────────┴────────────────────────────────────────────────────────┘
1 vulnerabilities found
Severity: 1 low

[Alberto Schiabel (jkomyno)]

Please review and fix the vulnerabilities.

Not addressing in this PR: it does not change package manifests or the lockfile, and the reported advisory is in pre-existing Mastra runtime E2E dependency paths. This PR remains scoped to Effect v4 migration guidance and the read-only source oracle.