Bump canonicalCopilotKitVersion 1.59.2 -> 1.59.4 and pin every
integration's @copilotkit/* to 1.59.4 (locks regenerated). Keeps the
whole showcase on one version instead of letting the langgraph A2UI
demos deviate. Existing per-slug overrides (built-in-agent pkg.pr.new,
ms-agent-harness-dotnet 1.57.2) unchanged.
Two independent fixes:
1. strands package-lock.json was invalid JSON.
Commit 00ce3a933 on main ("chore: ratchet showcase baseline to 95 +
sync strands lockfile", May 19) produced a lockfile with trailing
commas before closing braces — Node's V8 JSON parser (which npm
uses internally) rejects it as "Expected double-quoted property
name in JSON at position 1042" the moment `npm ci` tries to read
it. npm surfaces this as "command can only install with an
existing package-lock.json with lockfileVersion >= 1", which is
misleading — the lockfile exists and declares lockfileVersion: 3,
but it fails to parse before npm gets that far.
The first strands `Showcase: Build & Push` run on main after that
commit (2026-05-19T20:57:40Z) failed for the same reason; main's
strands check has been broken since, but B&P runs are gated by
paths-filter so subsequent commits that didn't touch
`showcase/integrations/strands/**` simply skipped the strands job
instead of failing. Our PR's `Showcase: Build Check (PR)` matrix
re-runs strands on every PR push and surfaces the inherited
breakage.
Fix: delete the malformed lockfile and regenerate with
`npm install --legacy-peer-deps --package-lock-only` against the
existing package.json. The new file is valid JSON (verified with
`node -e "JSON.parse(...)"`) and `npm ci` succeeds locally with
it. Lockfile size dropped from 849577 to 491930 bytes — the prior
sync had bloated entries on top of being malformed.
Also reverts the Dockerfile probe and the split-COPY workaround
added in earlier commits on this branch (e82a938a0, b56a9252d,
e7dcd3cff). The probe was the right diagnostic — it printed the
first 200 bytes of /app/package-lock.json and showed only
"lockfileVersion: 3," before parse error, which pointed at the
malformed JSON. With a valid lockfile, `COPY ... && npm ci` works
on the simple Dockerfile shape and the workaround is no longer
needed.
2. setup-concept.test.ts path-traversal test had a /tmp race.
The fix landed in e82a938a0 wrote a decoy file via
`path.dirname(tmp)` — which resolves to the system temp root
(`/tmp` on Linux, `/var/folders/.../T` on macOS), not a per-test
scratch dir. Two concurrent runs of the test (e.g.
`vitest --watch` re-firing mid-edit, or a developer running tests
in two terminals) would race on the same shared decoy path; the
second's finally-cleanup could delete the first's decoy mid-test
and mask a real path-traversal regression.
Fix: mkdtemp a per-test `scratch` directory in beforeEach, nest
`tmp` inside it, plant the decoy in `scratch`, and let afterEach's
recursive rmSync of `scratch` handle cleanup. Removes the
try/finally block entirely. Comment math also corrected (the test
walks four `..` segments, not three).
Call-site enumeration:
- Dockerfile: only the `Showcase: Build & Push` and `Build Check
(PR)` workflows invoke this. Same `COPY ... && npm ci` shape as
every other integration Dockerfile.
- package-lock.json: consumed by `npm ci` only. New file generated
by npm itself from the same package.json the previous lockfile
targeted.
- setup-concept.test.ts: no external consumers; helper variables
`scratch`/`tmp` are module-local.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
PR branch had pre-rename strands deps (^0.0.43 / next-tag) which the
Depot CI environment failed to resolve at npm ci. Main has pinned
versions matching the upgraded strands agent (May 2026 canonical demo
renovation). Bringing those four files forward unblocks
build-check (strands).
Files synced from origin/main:
- showcase/integrations/strands/package.json (pinned deps + react-ui/shared)
- showcase/integrations/strands/package-lock.json (regenerated to match)
- showcase/integrations/strands/requirements.txt (pinned agent deps)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Lockfiles committed in 8ba692c42 were generated inside the monorepo
while pnpm's hoisted node_modules tree was present. npm-arborist
resolved transitive deps against pnpm's symlinks and wrote ~40
`../../../node_modules/.pnpm/...` paths into each lockfile's
`packages` map.
npm 10 can parse the JSON, but its arborist bombs out walking the
tree at those pnpm-relative entries with the misleading error:
npm error code EUSAGE
npm error The `npm ci` command can only install with an
npm error existing package-lock.json or npm-shrinkwrap.json
npm error with lockfileVersion >= 1.
`npm install --dry-run` surfaces the real cause:
Cannot read properties of undefined (reading 'extraneous')
A fresh lockfile generated in an isolated container works.
- broken: 1259 packages, 43 with `../../../node_modules/.pnpm/...`
- fresh: 1321 packages, all `node_modules/...` paths
This commit regenerates every integration's lockfile inside an
isolated `node:22-slim` container via `npm install
--package-lock-only --legacy-peer-deps` and verifies with `npm ci`.
Recent feature commits added new dependencies to integration package.json
files (@copilotkit/voice, @hashbrownai/{core,react}, @json-render/{core,react})
and bumped Next.js from 15.4.10 to 15.5.15, but never regenerated the
corresponding package-lock.json. The Showcase Build & Deploy workflow runs
`npm ci --legacy-peer-deps` which strictly enforces lock sync, so every
deploy attempt has been failing at the install step. No new images have been
pushed to GHCR, so Railway services have stayed on stale code and any cell
added since each fw's last successful deploy iframes 404.
Regenerated all 18 lockfiles via `npm install --legacy-peer-deps
--package-lock-only --ignore-scripts` per integration. Verified each with
`npm ci --dry-run --legacy-peer-deps` — all clean.
Refs PDX-90.
The showcase framework directories better reflect their role as
integration examples rather than distributable packages.
Renames showcase/packages/ -> showcase/integrations/ and updates
the test docker-compose file reference accordingly.
Ran Shem Tov