Commit Graph

260 Commits

Author SHA1 Message Date
Ran Shem Tov 09501b43ed chore(integrations/_parity): inline-prompt contract + track Dockerfile
Two small changes to the parity tooling, surfaced while validating it on
the langgraph-fastapi port.

1. Drop the per-instance PROMPT.md file. The reference demo
   (langgraph-python) does not load agent/PROMPT.md at runtime — it inlines
   the prompt as a triple-string literal in agent/main.py. Syncing a
   cosmetic PROMPT.md file to every instance created a contract the code
   did not follow. Now:
   - sync.ts no longer writes agent/PROMPT.md per instance.
   - verify.ts greps the first non-blank line of _parity/canonical/PROMPT.md
     against each instance's agent source. Inline the prompt string in
     source; verifier passes.
   - Deleted the now-orphaned PROMPT.md copy under langgraph-js/agent/.

2. Track Dockerfile, docker/Dockerfile.agent, and serve.py in the shared
   verbatim-files list. These were previously silent "allowed divergence"
   across all instances — any Docker or runtime-adapter drift shipped
   unflagged. Now:
   - Added to tracked.verbatimFiles in manifest.json.
   - langgraph-js keeps them in allowedDivergence (Node-only stack, legit
     difference from the Python-based reference).
   - langgraph-fastapi drops them from allowedDivergence (same language
     stack as the reference; Docker/serve.py should match).

README and the copilotkit-demo-parity skill updated to match the new
prompt contract. Verifier still supports `--target` and exits non-zero on
unexpected drift.
2026-05-01 12:31:04 +02:00
Ran Shem Tov c9793b5e6e chore(integrations/langgraph-js): sync to langgraph-python reference demo
Align langgraph-js with examples/integrations/langgraph-python via the
parity tooling. Remove legacy app/ layout, adopt src/ layout, rewrite
the TS agent to expose the tracked tool surface (manage_todos,
get_todos, query_data, generate_a2ui, search_flights) and todos state,
and write the canonical PROMPT.md. Keeps LangGraphAgent + stategraph
runtime (allowed divergence per the manifest); brings deps,
Dockerfile.app, entrypoint, showcase metadata, and shared UI into
lockstep. Parity verifier: 88 ok / 0 error.
2026-05-01 12:31:04 +02:00
Ran Shem Tov 2bb9f3fdf4 chore(integrations): add _parity tooling + copilotkit-demo-parity skill
Introduce machinery for keeping examples/integrations/* demos aligned to a
single north-star (langgraph-python). Built first so the upcoming
langgraph-js and langgraph-fastapi alignment PRs have a mechanical baseline
to work against instead of manual copy-paste.

- examples/integrations/_parity/manifest.json declares verbatim files,
  tracked package.json keys, and expected agent surface (tool names,
  state keys) per instance plus allowed-divergence lists.
- _parity/sync.ts copies verbatim files + rewrites tracked package.json
  keys from north-star to a target instance. Dry-run supported.
- _parity/verify.ts diffs each instance vs north-star and exits non-zero
  on unexpected drift. Checks verbatim content, tracked keys, canonical
  prompt equality, and agent-surface grep-level presence.
- Canonical prompt at _parity/canonical/PROMPT.md — synced into each
  instance's agent/PROMPT.md on parity:sync.
- Root package.json: pnpm parity:sync, parity:verify, parity:check.
- CI: .github/workflows/integrations_parity.yml runs parity:check on PRs
  touching examples/integrations/**.
- Skill: .claude/skills/copilotkit-demo-parity/SKILL.md teaches agents
  how to drive sync/verify and handle manual-merge zones (agent code,
  api route, Dockerfile).

Does NOT touch the existing instance demos yet. Those alignment commits
follow in the same PR.
2026-05-01 12:31:04 +02:00
Tyler Slaton 26e245c009 chore: run pnpm format
Signed-off-by: Tyler Slaton <tyler@copilotkit.ai>
2026-04-30 12:32:31 -07:00
Mike Ryan ff929fbb40 chore: Update Intelligence version in the demo app 2026-04-30 10:57:19 -07:00
Tyler Slaton e80602c7c3 fix(langgraph-python): fix issue with themeing in lightmode
Signed-off-by: Tyler Slaton <tyler@copilotkit.ai>
2026-04-30 09:39:22 -07:00
Tyler Slaton 01fd0ac6d7 feat(langgraph-py): add file-uploads and bug-fixes
Signed-off-by: Tyler Slaton <tyler@copilotkit.ai>
2026-04-29 23:54:10 -07:00
Jordan Ritter f1f3f07514 fix: resolve security vulnerabilities via dependency overrides (#3857)
## Summary

Comprehensive security vulnerability sweep via pnpm overrides and devDep
bumps. Reduces audit from **155+ to 3** unfixable vulnerabilities.

### Changes

**49 pnpm overrides** covering all resolvable transitive dependency
vulnerabilities:
- 12 initial overrides (phase 1)
- 7 upgraded to higher patched versions (phase 2)
- 30 new overrides added (phase 3)

**Direct dependency bumps:**
- storybook devDeps: ^10.1.10 → ^10.2.10 (root + react storybook
example)
- vitest in demo-agents: ^2.1.8 → ^4.1.3 (resolves vite 5.x vuln)
- next in chat-with-your-data: 15.6.0-canary.58 → 15.6.0-canary.61
- vite in react-router: ^6.0.0 → ~7.3.2

### Remaining 3 (truly unfixable)

| Package | Severity | Why |
|---------|----------|-----|
| parse-git-config | HIGH | No patch exists (patched: <0.0.0), dep of
danger |
| elliptic | LOW | No patch exists, deep in storybook crypto chain |
| next | MODERATE | Example on 15.x canary, advisory needs 16.x |

### Companion PR
ag-ui-protocol/ag-ui#1504

Part of CPK-7320
2026-04-28 13:42:41 -07:00
Martha Schumann a274ce2023 chore(examples/integrations): scope to ADK only per review
Reverts the 14 other framework bumps and 2 lockfile regens. Each
framework needs per-framework QA against 1.56.4 before being shipped
in a sweep — too risky for the demo timeline to bump them all at once.

The validator now uses an explicit ENFORCED allowlist (currently just
adk) with an inline comment documenting the scope decision. Other
integrations get added to ENFORCED as QA clears each framework. The
structural fix (release-please automation that bumps integrations in
lockstep on each release) is tracked in CPK-7534.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 12:00:27 -07:00
Martha Schumann 7673a0bb1a fix(examples/integrations): bump stale @copilotkit/* pins to 1.56.4
The CLI scaffolder (npx copilotkit create -f <fw>) clones from
examples/integrations/<fw>/ on main. The @copilotkit/* deps in those
package.json files are bumped manually on release; 14 of 17 integrations
fell behind. Notable: ADK pinned 1.55.2 (missing useFrontendTool), mcp-apps
at 1.52.1, a2a-middleware floating on "latest". Issue #4253.

Adds scripts/validate-integration-pins.ts + a vitest live-tree check that
fails when any integration pins lag the monorepo release version, so the
gap can't reopen silently on the next release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 11:11:57 -07:00
Jordan Ritter ac66995bf8 fix: bump all 15.x examples to Next 15.5.15 (security patches)
24 examples bumped from various 15.0-15.4 versions to 15.5.15.
chat-with-your-data bumped from 15.6.0-canary to 16.1.7.
next-openai: moved OpenAI client init into handlers (15.5 evaluates
edge routes at build time).

Remaining on 14.x: next-pages-router(v1), state-machine, travel,
banking, enterprise-brex, presentation, todo — require major rewrite.
2026-04-28 10:33:06 -07:00
Max Korp 7232c15bc2 Revert "chore(threads-example): bump @copilotkit/* deps to 1.56.4" 2026-04-27 14:45:02 -07:00
Benjamin Taylor 05c9056d88 chore(threads-example): bump @copilotkit/* deps to 1.56.4
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-27 16:03:57 -05:00
Max Korp be835b013b fix(langgraph-threads): restore A2UI tool docstrings dropped in compaction rewrite
The Apr 21 "refactor(runtime): Support durable compaction of threads" commit
re-added a2ui_dynamic_schema.py and a2ui_fixed_schema.py to the
langgraph-python-threads example in a stripped form. Most of the simplification
was cleanup, but two docstrings carried load-bearing instructions for the
sub-LLM and those got lost:

- render_a2ui's Args block said the root component must have id "root".
  Without it, the LLM emits a valid flat component list with no entry point;
  the A2UI renderer (A2uiSurface.tsx:152) hard-codes id="root" and falls
  through to a shimmer placeholder — the "Sales Dashboard (A2UI Dynamic)"
  demo renders as an empty white square.
- search_flights' docstring spelled out airline logo URLs, date format,
  and status-icon colors, producing consistently-styled flight cards.

This restores both files verbatim from the non-threads example, which is
the known-good template. All differences in the agent/src dir are now
removed. Debug prints and headers come back with the restore; happy to
trim them in a follow-up if the intent was to keep the -threads version
terser.
2026-04-23 13:21:07 -07:00
Jordan Ritter 0d9ead7556 fix(starters): replace curl|sh uv install with COPY from uv image
Replace `RUN curl -LsSf https://astral.sh/uv/install.sh | sh` across all
starter Dockerfiles with `COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx
/usr/local/bin/`. The curl|sh form has a pipe-swallow latent bug: when
astral.sh returns a 5xx, curl fails but `sh` gets no stdin and exits 0,
so the layer "succeeds" with no uv binary. A later `RUN uv sync` then
crashes with `uv: not found` (exit 127). This already bit the agno
starter today (run 24809910399) when astral.sh had a transient outage;
upstream recovered on its own so this is latent-bug cleanup, not a
hotfix.

Using the official uv image is uv's own recommended pattern: it's
cache-friendly, network-free at build time, and sidesteps the pipe
failure mode entirely.

Scope: all 20 Dockerfiles under examples/integrations/*/Dockerfile,
examples/integrations/*/docker/Dockerfile.agent, and
examples/showcases/scene-creator/agent/Dockerfile.

Verified locally: `docker build -f docker/Dockerfile.agent ./agent`
for agno succeeds against the new pattern.
2026-04-22 17:44:02 -07:00
Max Korp df64a01583 fix(example-langgraph-python-threads): share threadId between chat and canvas
Wrap <ExampleLayout> in <CopilotChatConfigurationProvider agentId="default"
threadId={threadId}> so the canvas's useAgent() inherits the active threadId
via the existing fallback in use-agent.tsx. Without this wrapper, the canvas
calls useAgent() with no args and resolves to the registry agent instead of
the per-thread clone that the chat's /connect replay populates, so
STATE_SNAPSHOT events never reach it — todos rendered blank on thread resume
even though the final persisted snapshot contained them.

CopilotChat no longer needs explicit agentId/threadId props; it inherits
from the same provider, keeping one source of truth.
2026-04-22 16:31:16 -07:00
Benjamin Taylor b453e40256 chore: bump copilotkit deps to 1.56.3 in langgraph-python-threads
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 16:27:40 -05:00
Benjamin Taylor 771879c35a chore: drop stray a2ui-theme background + bump generated cli version
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 15:28:05 -05:00
github-actions[bot] e38c00ca54 style: auto-fix formatting 2026-04-22 19:54:39 +00:00
Max Korp 8e6a3205f9 feat(examples/langgraph-python-threads): use intelligence composite image 2026-04-22 12:10:42 -07:00
Jordan Ritter 96e29c886b feat(examples/v2): rename interrupts-langraph→interrupts-langgraph + integration cleanup
Fix the long-standing typo across the example directory name + module
identifiers, align imports + package names. Also touches examples/integrations/adk
docker-compose fixtures and examples/e2e agents reference doc.
2026-04-22 10:50:10 -07:00
Mike Ryan 79e1bebece fix(runtime): require identifyUser name in intelligence mode 2026-04-22 09:55:59 -05:00
Benjamin Taylor bbe23e604e fix(threads): skip /connect for absent threads, stabilize switch UX (ENT-314)
- Skip copilotkit.connectAgent when CopilotChat lacks a caller-supplied
  threadId — a locally-minted UUID has no backend record, so /connect
  would always 404 on the intelligence platform.
- Suppress the welcome screen while a connect is in flight and
  unconditionally when the caller has supplied a threadId
  (hasExplicitThreadId). Prevents the "How can I help you today?"
  flash on thread switch.
- Gate suggestions on !isConnecting && !isRunning to avoid painting
  them against a mid-replay message tree.
- Defer the isConnecting release by one animation frame so trailing
  bootstrap renders commit before the flag flips.
- Reserve room for the "Powered by CopilotKit" license badge via a
  new --copilotkit-license-banner-offset CSS var published by the
  banner on mount; chat input consumes it only when bottom-anchored.
- Sort and display threads by lastRunAt (fallback to updatedAt →
  createdAt) so metadata-only actions like archive/rename don't
  reshuffle the list.
- useThreads waits for runtimeConnectionStatus === Connected before
  dispatching the store context, eliminating the speculative /threads
  fetch that fired before /info returned wsUrl.

Threads example polish: restore button + tooltips on
archive/restore/delete, segmented Active/All filter, graceful error
state, skeleton rows on initial load, stable scrollbar gutter,
pre-paint dark-mode class, logo position stable across app/chat
modes, drop dynamic-import drawer wrapper that caused null first
paint, archived-row dimming via child colors instead of opacity.

Tests:
- CopilotChat.absentThreadConnect: connect is skipped without a
  threadId, fires when supplied via prop or config.
- CopilotChatView.connectingGate: isConnecting suppresses welcome;
  hasExplicitThreadId suppresses welcome on empty chat.
- threads (core): lastRunAt sort fallback ordering.
- use-threads: Connecting-state gate defers /threads until Connected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 09:42:34 -05:00
github-actions[bot] 6a04464bb0 style: auto-fix formatting 2026-04-21 16:25:11 -07:00
Mike Ryan 25f6f15418 refactor(runtime): Support durable compaction of threads 2026-04-21 16:25:11 -07:00
Jordan Ritter b60ce9d31b fix(examples/crewai-crews): bump ag-ui-crewai pin to 0.2.x
ag-ui-crewai 0.1.5 contains three defects that took down crewai-crews
in prod for 9h on 2026-04-21: unguarded .messages access, orphan
asyncio.create_task, and sync completion() calls. All three are fixed
in 0.2.0 (ag-ui PR #1550).

Showcase already moved to 0.2.x in PR #4115. Dojo is the user-facing
reference — leaving it on 0.1.5 means every reader clones the broken
version. This closes the validate-pins drift.

Pip dry-run resolves ag-ui-crewai-0.2.0 cleanly with no conflicts.
Grep of examples/integrations/crewai-crews/ confirms no consumer code
touches the 0.1.5 defect paths (.state.messages, create_task,
completion sync).
2026-04-21 10:41:52 -07:00
Mike Ryan 48afe59260 fix(examples): Pin version number and simplify example 2026-04-18 21:25:41 -05:00
Mike Ryan 1fcd3f205a refactor(examples): Switch Threads to use GHCR 2026-04-18 13:44:02 -07:00
Max Korp 0b19b31ae5 fix(examples/langgraph-python-threads): load .env + use runtime with thread-name fix
The scaffolded BFF was hitting two issues out of the box:

1. tsx doesn't auto-load .env, and the template's .env lives at the
   monorepo root. process.env.COPILOTKIT_LICENSE_TOKEN was undefined
   at runtime so the runtime logged 'No license token configured'
   even when the user had populated .env via `copilotkit license`.
2. @copilotkit/runtime: next resolved to 1.55.0-next.9, which
   predates the thread-naming UUID fix (v1.55.3). The BFF blew up
   creating LangGraph threads with 'Invalid thread ID: must be a
   UUID' because the runtime passed a compound thread-name:<uuid>:
   <uuid> string.

Fix both:
- Switch dev script to `tsx watch --env-file=../../.env src/server.ts`
  so tsx loads the monorepo root .env.
- Pin @copilotkit/runtime to `latest` so scaffolds get the
  thread-naming fix. (The next dist-tag is still stale on npm.)
2026-04-17 17:25:04 -07:00
Max Korp 6127ac01d6 chore(langgraph-python-threads): use published intelligence images
Switch docker-compose to pull app-api, db-migrations, and realtime-gateway
from public.ecr.aws/cpk/intelligence/* at tag 0.1.0-rc.5 instead of locally
built cpki/*:local images, and drop the build-local-images prerequisite
from the README and compose header.
2026-04-17 15:24:41 -07:00
Alem Tuzlak 321454b823 fix: pin langgraph-python to stable deps, fix mastra dev, restore Windows .bat fallback
- langgraph-python: replace ephemeral pkg.pr.new URLs with stable @copilotkit/*@1.56.2
- mastra: wire dev to run ui + agent via concurrently (was only starting UI)
- Restore `|| scripts\setup-agent.bat` / `|| scripts\run-agent.bat` fallback across
  12 starter templates so npm install + npm run dev work on Windows without Git Bash
2026-04-17 18:04:18 +02:00
Alem Tuzlak 332f518a63 Merge branch 'main' into worktree-lucky-popping-wren 2026-04-17 10:21:32 +02:00
Jordan Ritter d1928cdb67 fix: address CR findings on aimock validate-on-load hardening
- Add --validate-on-load to all aimock invocations (4 workflows/scripts
  + 13 integration docker-compose files)
- Replace hardcoded 2-file fixture list with dynamic discovery across
  showcase/, examples/integrations/*/, scripts/doc-tests/ (16 fixtures)
- Add sanity check to prevent silent zero-test pass when discovery fails
- Extend showcase_validate.yml path filter to trigger on
  examples/integrations/**/fixtures/** and scripts/doc-tests/fixtures/**
- Import and use ValidationResult type for callback parameters
- Fix scripts/doc-tests/fixtures/default.json to use { fixtures: [...] }
  envelope shape
2026-04-16 13:00:01 -07:00
Jordan Ritter f00c040f15 fix: keep playwright install stderr for debugging
Playwright install stderr is diagnostic signal — version/network errors,
missing system libs, or browser download failures all surface here. Only
suppress stderr on the noisy npm install step. Also pin the image-tag /
client-version relationship with a code comment on one compose file so
future bumps know to keep them aligned.
2026-04-16 12:07:43 -07:00
Jordan Ritter e05181265a fix: drop --with-deps from starter-smoke Playwright install
The Playwright Docker image (mcr.microsoft.com/playwright:v1.52.0-noble)
ships with all Chromium system libraries and browsers pre-installed, so
`--with-deps` adds no runtime value — it only forces a redundant
`apt-get update && apt-get install` inside the tests container.

That apt-get call is the sole source of the intermittent
"Installation process exited with code: 100" / "Failed to install
browsers" failures that rotate across the 12 smoke matrix entries. The
underlying cause is transient Ubuntu archive mirror hash/size mismatches
("File has unexpected size ... Mirror sync in progress?", "Hash Sum
mismatch"), which cause apt to abort with exit 100. Because each matrix
job races apt against archive.ubuntu.com independently, the failing
subset rotates per run (run 24526747926 hit 5 starters; run 24509673514
hit a different 5; run 24495760568 hit 3) — classic flake, not a per-
starter regression.

Dropping --with-deps eliminates the apt-get call entirely. The browsers
themselves are already present at /ms-playwright/chromium-* in the base
image, and `npx playwright install chromium` remains as a cheap no-op
that self-heals if the pinned Playwright version ever drifts from the
image's bundled browser build.
2026-04-16 11:39:02 -07:00
Alem Tuzlak d5cab97c84 chore: update langgraph-js starter to @copilotkit/*@1.56.0
This version removes the unused @langchain/community peer dep from
sdk-js, fixing dependency resolution conflicts with @langchain/core@1.x.
2026-04-16 18:14:50 +02:00
Alem Tuzlak 07e864b99a Merge remote-tracking branch 'origin/main' into worktree-lucky-popping-wren
# Conflicts:
#	examples/integrations/langgraph-python/apps/app/package.json
#	examples/integrations/langgraph-python/pnpm-lock.yaml
2026-04-16 16:13:44 +02:00
Alem Tuzlak f47b9e9775 fix: remove unused @langchain/community peer dep, add langchain to langgraph-js agent, add postcss config to mcp-apps threejs-server
- Remove @langchain/community from sdk-js peerDependencies (unused,
  was blocking @langchain/core@1.x resolution)
- Add langchain@^1.0.0 to langgraph-js agent deps to prevent
  transitive resolution to 0.3.x
- Add postcss.config.mjs to mcp-apps threejs-server
2026-04-16 16:02:24 +02:00
Alem Tuzlak 41e57ed74b fix: remove .bat fallback pattern, fix README typos and phantom scripts
- Remove '|| .bat' fallback from all starter package.json scripts so
  real errors on Linux/macOS are not masked by a failing .bat attempt
- Fix typos: 'isseus' -> 'issues', 'interactin' -> 'interacting'
- Fix crewai-crews README title/body saying 'Flow' instead of 'Crew'
- Fix a2a-a2ui README wrong agent name and file path
- Remove phantom lint/dev:debug scripts from README Available Scripts
  sections where those scripts don't exist in package.json
- Add missing dev:ui and dev:agent to mastra README
2026-04-16 14:00:52 +02:00
Alem Tuzlak 0d4b887d8b fix: set execute bit on .sh scripts, fix langgraph-js Docker builds
- chmod +x all new .sh scripts so they work on Linux/macOS
- Use --ignore-scripts in langgraph-js Dockerfiles to avoid postinstall
  failure (agent/ dir not yet copied during npm install stage)
- Install agent deps in production Dockerfile after COPY agent/
- Fix hardcoded pnpm commands in agent-spec README
2026-04-16 13:51:53 +02:00
Alem Tuzlak 96ed9151d7 fix: default to npm in all starter READMEs, support any package manager
Reorder package manager instructions to show npm first as the default.
Remove stale 'ignores lock files' notes since lock file entries were
removed from .gitignore. All starters now work with npm, pnpm, yarn,
or bun — user's choice.
2026-04-16 13:37:10 +02:00
Alem Tuzlak 4f49da19e0 fix: remove lock file entries from all starter .gitignore files
Starters should not constrain users to a specific package manager.
The .gitignore gets cloned into the user's project, so ignoring
certain lock files would prevent them from committing their chosen
package manager's lock file.
2026-04-16 13:28:28 +02:00
Alem Tuzlak 453097ff18 fix: convert starter templates from pnpm/Turborepo to flat npm projects
Flatten langgraph-python, langgraph-js, and mcp-apps starters so
npm install && npm run dev works out of the box. Replace Turborepo
with concurrently, move apps/* to root, update Dockerfiles, READMEs,
and entrypoints. Also remove stray pnpm-lock.yaml from a2a-a2ui and
ms-agent-framework-dotnet starters.
2026-04-16 13:23:30 +02:00
Markus Ecker 9945d892e5 chore: update langgraph starter lockfile for 1.56.0 2026-04-15 20:41:05 +02:00
Markus Ecker 097bc7ac6c fix: update langgraph starter to use released @copilotkit packages 1.56.0
Replace pkg-pr-new preview URLs with published 1.56.0 versions.
2026-04-15 20:19:30 +02:00
Ran Shemtov d74e32c824 Merge branch 'main' into chore/example-state-streamin 2026-04-15 19:24:23 +02:00
Max Korp 246448120a feat: add langgraph-python-threads example 2026-04-15 09:50:03 -07:00
Ran Shem Tov 65500c5fb8 chore: fix state streaming on langgraph prebuilt agents in demos 2026-04-15 18:35:55 +02:00
Ran Shem Tov c8d4b273aa chore: add state streaming to langgraph example 2026-04-15 17:54:05 +02:00
Markus Ecker c61ebc5d15 chore: use pkg-pr-new preview packages in langgraph starter 2026-04-15 16:13:47 +02:00