96a66a5aa5
feat(showcase/agno): declare cli-start, gen-ui-tool-based, hitl-in-chat-booking demos
...
Adds three feature-matrix entries to the Agno integration manifest:
- `cli-start` — informational copy-paste starter command card (no route).
- `gen-ui-tool-based` — frontend-only haiku-renderer demo that already ships
in `src/app/demos/gen-ui-tool-based/`; the manifest entry plus the
existing alias in `src/app/api/copilotkit/route.ts` (mainAgentNames)
surface it in the showcase.
- `hitl-in-chat-booking` — second cell for the booking flavor of the
time-picker HITL surface; reuses `src/app/demos/hitl-in-chat/` files and
the main agent's `book_call` external-execution tool.
PARITY_NOTES.md updated with a fourth-pass entry summarising the additions.
Five sibling features (`beautiful-chat`, `gen-ui-interrupt`,
`interrupt-headless`, `declarative-gen-ui`, `a2ui-fixed-schema`) remain
deferred for the reasons already documented in PARITY_NOTES.md — Agno's
AGUI adapter has no interrupt primitive, and the dedicated combined
runtimes (openGenerativeUI + a2ui injection + mcpApps) and the
CopilotKit-middleware-driven catalog injection that the langgraph-python
reference relies on have not been wired into Agno yet.
2026-04-29 10:53:44 +02:00
17e7e0a406
fix(showcase): add missing D5 demo entries and feature IDs to manifests
...
Add demo entries for hitl, hitl-in-app, hitl-in-chat, tool-rendering,
shared-state-read-write, and gen-ui-tool-based across 14 integrations.
Ensure every demo ID also appears in the features list so the showcase
matrix and D5 probes discover them correctly.
2026-04-28 22:20:58 -07:00
2fc196aa8b
fix(showcase): guard preferences-card.tsx against undefined interests
...
STATE_SNAPSHOT can deliver a Preferences object with interests undefined,
crashing .includes(), .filter(), and spread at 4 sites per file. Add
(value.interests ?? []) guards across all 17 integrations.
2026-04-28 22:20:53 -07:00
f1f3f07514
fix: resolve security vulnerabilities via dependency overrides ( #3857 )
...
## Summary
Comprehensive security vulnerability sweep via pnpm overrides and devDep
bumps. Reduces audit from **155+ to 3** unfixable vulnerabilities.
### Changes
**49 pnpm overrides** covering all resolvable transitive dependency
vulnerabilities:
- 12 initial overrides (phase 1)
- 7 upgraded to higher patched versions (phase 2)
- 30 new overrides added (phase 3)
**Direct dependency bumps:**
- storybook devDeps: ^10.1.10 → ^10.2.10 (root + react storybook
example)
- vitest in demo-agents: ^2.1.8 → ^4.1.3 (resolves vite 5.x vuln)
- next in chat-with-your-data: 15.6.0-canary.58 → 15.6.0-canary.61
- vite in react-router: ^6.0.0 → ~7.3.2
### Remaining 3 (truly unfixable)
| Package | Severity | Why |
|---------|----------|-----|
| parse-git-config | HIGH | No patch exists (patched: <0.0.0), dep of
danger |
| elliptic | LOW | No patch exists, deep in storybook crypto chain |
| next | MODERATE | Example on 15.x canary, advisory needs 16.x |
### Companion PR
ag-ui-protocol/ag-ui#1504
Part of CPK-7320
2026-04-28 13:42:41 -07:00
77a07aaa37
docs(showcase/agno): region markers across 12 cells
...
Bring agno to feature parity with the langgraph-python reference for
shell-docs region markers. Round 5 of the per-framework sweep
(mastra #4326 , smalls batch #4361 , ms-agent #4363 , google-adk #4369 ).
Cells advanced (12):
- agentic-chat: sibling chat-component.snippet.tsx (chat-component,
configure-suggestions, provider-setup) — production page.tsx mixes
unrelated frontend tools / agent context for QA.
- chat-customization-css: in-place css-variables in theme.css,
theme-css-import in page.tsx.
- chat-slots: in-place register-welcome-slot, register-disclaimer-slot,
register-assistant-message-slot in page.tsx.
- headless-simple: in-place use-agent-simple, message-list-simple in
page.tsx.
- prebuilt-popup: in-place popup-basic-setup in page.tsx.
- prebuilt-sidebar: in-place sidebar-basic-setup, sidebar-configuration
in page.tsx.
- readonly-state-agent-context: in-place context-provider-sketch,
use-agent-context-call in page.tsx.
- shared-state-read-write: in-place use-agent-read, use-agent-write
in page.tsx; preferences-card-render in preferences-card.tsx;
notes-card-render in notes-card.tsx.
- subagents: in-place delegation-log-frontend in delegation-log.tsx;
subagent-setup, supervisor-delegation-tools in agents/subagents.py.
- tool-rendering: sibling render-flight-tool.snippet.tsx with
render-weather-tool, render-flight-tool, catchall-renderer; in-place
weather-tool-backend on get_weather in agents/main.py — the docs page
teaches per-tool + catchall patterns the production page.tsx doesn't
exercise (weather-only render, shared god-file backend).
- tool-rendering-custom-catchall: in-place
use-default-render-tool-wildcard in page.tsx.
- tool-rendering-default-catchall: in-place default-catchall-zero-config
in page.tsx.
Manifest: no changes — sibling .snippet.tsx files are picked up by the
demo-content bundler walking the demo folder, no explicit highlight
needed.
Verification: re-ran the audit script; missing-region count for agno
dropped from 12 cells → 0.
2026-04-28 13:21:02 -07:00
c272a795dc
fix: remove stale starter: blocks from all 17 integration manifests
...
The packages/starters merge (PR #4351 ) eliminated starters as separate
deployable units. Remove the starter: block (path, name, description,
github_url, demo_url, clone_command) from all 17 integration manifests
to stop propagating stale showcase-starter-* Railway URLs through the
data pipeline.
2026-04-28 12:06:08 -07:00
6bc0db6a25
fix: harden showcase packages — dep pins + Docker image pins
...
Dependency version floors:
- next: ^15.0.0 → ^15.5.15 across all 19 showcase packages (CVE-2025-29927)
- express: ^4.21.0 → ^4.21.2 in claude-sdk-typescript (open redirect fix)
- hono: ^4.0.0 → ^4.6.0 in shell (path traversal fix)
Docker base image pins:
- node:20-slim → node:20.19-slim (18 Dockerfiles)
- python:3.12-slim → python:3.12.11-slim (12 Dockerfiles)
- aimock:latest → aimock:1.13.0 (1 Dockerfile)
Part of CPK-7320
2026-04-28 10:33:06 -07:00
23a3b24a01
feat(showcase/integrations): shared-state-read-write + subagents demos across 15 packages
...
Adds real working Shared State (Read+Write) and Sub-Agents demos to 15
showcase integrations, mirroring the canonical langgraph-python and
google-adk reference implementations. Fills rows previously empty on
the showcase coverage dashboard.
Packages: ag2, agno, claude-sdk-python, claude-sdk-typescript,
crewai-crews, langgraph-fastapi, langgraph-typescript, langroid,
llamaindex, mastra, ms-agent-dotnet, ms-agent-python, pydantic-ai,
spring-ai, strands. (built-in-agent landed independently on main as
PR #4321 — its variant is canonical; this PR no longer touches it.)
Per-package deliverables: framework-native backend agents
(preferences-injection middleware/callback + set_notes tool;
supervisor + 3 sub-agents wired as tools with running -> completed
/failed delegation log); frontend page.tsx + preferences-card.tsx /
notes-card.tsx for SSRW and delegation-log.tsx for subagents — wired
to useAgent({ updates: [OnStateChanged] }); manifest entries; runtime
route registration + per-package agent server config; real QA
scripts.
Includes targeted hardening fixes from a 7-agent code-review loop:
- Sub-agent failure paths now correctly emit status: "failed"
(previously hardcoded "completed" or unreachable in
mastra/strands/langgraph-fastapi/langgraph-typescript/ag2)
- Parallel-tool-call delegation race fixed in langgraph-fastapi
(Annotated[list, add]) and langgraph-typescript (concat reducer)
- Silent data loss eliminated in
claude-sdk-python/claude-sdk-typescript/crewai-crews — empty
JSON.parse catches now log + emit error events
- ms-agent-dotnet set_notes writes to per-thread slot via AsyncLocal
- mastra working-memory writes are deterministic via
src/mastra/tools/working-memory.ts helper
- spring-ai tool-call envelope ids match supervisor's tc.id() and
AG-UI event ordering reordered; CopyOnWriteArrayList for
parallel-call safety
- Stack trace + raw error message leaks scrubbed across 8+ Next.js
routes — log server-side with errorId + return generic envelope
- Sub-agent calls no longer block event loops in ag2
(asyncio.to_thread), langroid (llm_response_async), pydantic-ai
(async run + async tools)
- langroid lru_cache cross-request contamination dropped
- Numerous smaller items: claude-sdk-python invalid model id, Callable
annotation, /health endpoint exposed; crewai-crews supervisor
no longer resets delegations every turn; pydantic-ai snapshot uses
model_dump()
CI fixes folded in:
- crewai-crews test_forwarded_props: extend the stubbed
ag_ui_crewai.endpoint module to expose
add_crewai_flow_fastapi_endpoint and add stub
agents.shared_state_read_write / agents.subagents modules
- generate-catalog test: bump crewai-crews wired-cell expectation
28 -> 30; replace hardcoded total-wired count with an invariant
(wired + stub + unshipped = 737) plus a lower-bound floor
- oxfmt run on the qa/shared-state-read-write.md files in mastra +
spring-ai
Rebased onto latest main (post showcase/packages -> showcase/integrations
rename + post built-in-agent landing). Original blitz history
preserved at the blitz-pre-rebase-snapshot tag.
Known follow-ups (deferred to follow-up PR):
- agno sync sub_agent.run() blocks event loop (perf only)
- ms-agent-python asyncio thread-fallback fragility
- llamaindex initial-state coercion when UI clears state
- Manifest highlight audit (langgraph-typescript headless-complete,
langgraph-fastapi byoc-* missing route.ts highlights)
- agno hitl-in-chat declared in demos but not features; duplicate
/demos/hitl-in-chat route
- langgraph-typescript server.mjs graphSpec only registers 3 graphs
vs 23 in langgraph.json (pre-existing)
- mastra hitl legacy demo missing from features list
- claude-sdk-python agents/agent.py line 474 also has the legacy
claude-opus-4-5 default
- PARITY_NOTES vs manifest mismatches for hitl-in-app across
spring-ai/agno/ag2 (pre-existing)
- spring-ai a2ui-fixed-schema missing from generative_ui list
2026-04-28 18:36:13 +02:00
e9a2e143de
fix(showcase): add shared-tools symlinks and refactor imports
...
Replace sys.path.insert hacks in Python agent files with direct
imports via symlinks to shared/{python,typescript}/tools.
Update Dockerfiles, entrypoints, and configs to support the new
symlink-based tool resolution. Add PARITY_NOTES for frameworks
that have known gaps.
2026-04-28 07:50:03 -07:00
dd06dd89d1
refactor(showcase): rename packages/ to integrations/
...
The showcase framework directories better reflect their role as
integration examples rather than distributable packages.
Renames showcase/packages/ -> showcase/integrations/ and updates
the test docker-compose file reference accordingly.
2026-04-28 07:47:35 -07:00
Alem Tuzlak