skills/copilotkit__copilotkit
1
0
Fork 0
mirror of https://github.com/CopilotKit/CopilotKit.git synced 2026-09-14 16:26:20 +08:00
Code Issues Packages Projects Releases Wiki Activity
12,110 Commits 502 Branches 1,483 Tags
codex/remove-threads-cli-path
Commit Graph

12110 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jordan Ritter fa6d66d71b Merge remote-tracking branch 'origin/main' into fix/persist-credentials-remaining 
# Conflicts:
#	.github/zizmor.yml
 2026-05-15 11:22:23 -07:00
Jordan Ritter 6f783ae175 fix(ci): limit devops-bot token exposure in capture-previews (#4859) 
## Summary
- Add `persist-credentials: false` to checkout so the devops-bot app
token
(which bypasses branch protection) is not left in `.git/config` for ~30
  minutes while ffmpeg, Playwright, and npm packages install
- Inject credentials via `git config insteadOf` only in the new
  "Configure git for push" step, immediately before the commit/push step
- Remove the now-unnecessary `artipacked` suppression for
  `showcase_capture-previews.yml` from `.github/zizmor.yml`

## Why
A compromised dependency installed during the ~30-minute window could
exfiltrate the persisted devops-bot token from `.git/config` and push
directly to main, bypassing branch protection.

## Test plan
- [ ] Trigger capture-previews workflow manually and verify registry
  commit + push still succeeds
- [ ] Verify zizmor CI passes (no new artipacked findings)
 2026-05-15 11:20:04 -07:00
Jordan Ritter c083e2e0b1 fix(ci): limit credential exposure in format job (#4860) 
## Summary

The format job in `static_quality.yml` installs third-party tools (ruff
from PyPI, oxfmt from npm) with a write-scoped GITHUB_TOKEN persisted in
`.git/config` for the entire job duration. A compromised tool version
could exfiltrate the token.

- Add `persist-credentials: false` to the checkout step so the token is
not baked into `.git/config`
- Inject git credentials via `url.insteadOf` only immediately before the
push step (new "Configure git for push" step)
- Credential exposure window drops from full job duration to seconds
- Remove the `artipacked` suppression for `static_quality.yml` in
`.github/zizmor.yml` since the finding no longer applies

## Test plan

- [ ] CI passes on this PR (format job still auto-fixes and pushes when
formatting changes are needed)
- [ ] zizmor no longer reports an artipacked finding for
static_quality.yml
 2026-05-15 11:20:01 -07:00
Jordan Ritter b439983444 fix(showcase/shell-dashboard): add react-dom type declaration 2026-05-15 11:08:04 -07:00
Jordan Ritter 6e0a15871f feat(showcase/shell-dashboard): integrate LinkPreview into LinksLayer 2026-05-15 11:04:45 -07:00
Jordan Ritter 4622e78068 Add LinkPreview component with hover iframe popup 
Hover-activated iframe preview popups for demo links with:
- 300ms hover delay to prevent accidental triggers
- 200ms dismiss delay with bridge-gap support (link-to-popup mouse movement)
- Singleton behavior ensuring only one popup visible at a time
- Portal rendering into dedicated #link-preview-root div
- Viewport-aware positioning (flips above when near bottom)
- Transparent click overlay that opens URL in new tab
- Touch device exclusion via matchMedia check
- 11 comprehensive tests covering all behaviors
 2026-05-15 11:02:57 -07:00
Jordan Ritter fd8050098f fix(ci): persist-credentials: false on docs-sync and stable-release 2026-05-15 10:44:34 -07:00
Jordan Ritter 08433e9e92 fix(ci): limit credential exposure in format job 
Add persist-credentials: false to the checkout step in the format job
so the write-scoped GITHUB_TOKEN is not persisted in .git/config while
third-party tools (ruff from PyPI, oxfmt from npm) are installed and
executed. Credentials are injected via git insteadOf only immediately
before the push step, reducing the exposure window from the full job
duration to seconds.

Remove the artipacked suppression for static_quality.yml in zizmor.yml
since it no longer triggers the finding.
 2026-05-15 10:34:14 -07:00
Jordan Ritter c9cdbb4f46 fix(ci): limit devops-bot token exposure in capture-previews 
persist-credentials: false on checkout so the devops-bot app token
is not left in .git/config for ~30 minutes while ffmpeg, Playwright,
and npm packages install. Credentials are injected via insteadOf
only in the new "Configure git for push" step immediately before
the commit/push step.

Remove the now-unnecessary artipacked suppression for
showcase_capture-previews.yml from .github/zizmor.yml.
 2026-05-15 10:33:51 -07:00
Tyler Slaton b5d59e72a8 feat(showcase/shell-dojo): category headers in sidebar + rename built-in agent (#4823) 
## Summary

Two small dojo design tweaks, plus an unrelated test fix required to
commit.

**Dojo sidebar — categories as headers**
(`showcase/shell-dojo/src/app/page.tsx`)
- Replace the single static "Demos" label with the feature category
names already present in the registry, so navigation reflects how demos
are grouped instead of presenting one flat list (Dev Ex, Chat & UI,
Platform, Controlled Generative UI, …).
- Bump shared `SectionTitle` to 11px / weight 600 / primary text color
for a touch more prominence. Affects the "Integrations" and "View"
headers above as well — consistent treatment across all sidebar
sections.

**Built-in agent name**
(`showcase/integrations/built-in-agent/manifest.yaml`)
- Renamed "Built-in Agent (TanStack AI)" → "CopilotKit Built-in Agent"
in both display name and description, so users aren't pushed to think
about the LLM backend in the integration name. (Note: the internal
source file `src/lib/factory/tanstack-factory.ts` is unchanged — that's
a real filename surfaced in the code viewer; renaming it is a bigger
refactor.)

**Test fix — vitest localStorage polyfill** (`packages/web-inspector/`)
- Pre-existing failure on `main`: Node 22.4+ ships an experimental
built-in `localStorage` global that is installed before vitest's jsdom
env runs, leaving `window.localStorage` as an uninitialized stub. All 22
telemetry persistence tests crash with `window.localStorage.clear is not
a function` on Node 25.
- Added `vitest.setup.ts` that installs a minimal in-memory `Storage`
shim on `globalThis.{localStorage,sessionStorage}`. Works on Node
18/20/22/25+ without depending on `--no-experimental-webstorage`. All 29
tests now pass on Node 25.
- This is in its own commit (`fix(web-inspector): …`) so it's easy to
cherry-pick out if you'd prefer it as a separate PR.

## Test plan
- [ ] Visual review of dojo sidebar at `localhost:3001` — categories
render as headers above their demos
- [ ] Built-in agent appears as "CopilotKit Built-in Agent" in the
integration dropdown
- [ ] `pnpm nx run @copilotkit/web-inspector:test` passes on Node 25
- [ ] Full lefthook pre-commit passes (already verified locally on both
commits)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
 2026-05-15 10:22:06 -07:00
Tyler Slaton f0f396069a fix(showcase/aimock): scope bare 'hi' / 'help' / 'deal' / 'city' / 'hello' / 'paris' fixtures (#4843) 
## Summary

The subagents demo was randomly returning the showcase-assistant
boilerplate `"Hi there! I'm your showcase assistant. I can help with
weather, charts, meetings…"` for sub-agent (research / writing /
critique) calls instead of the expected sub-task output. Each failure
ended the chain with:

> `[sub-agent error] writing_agent returned an unexpected boilerplate
response twice. I cannot complete the request without a functioning
writing agent.`

and the user got no blog post / explanation / summary.

**Root cause:** `feature-parity.json` had a `match: { userMessage: "hi"
}` catch-all that aimock applies as a **case-sensitive substring match**
against the last user message. The writer / critique sub-agent prompts
contain ordinary English ("**thi**s", "**hi**story", "ac**hi**eving")
which all contain the literal substring `hi` — so the showcase-assistant
boilerplate hijacked the sub-LLM call mid-chain, the supervisor saw an
off-topic response, and the chain bailed.

Same shape as the bare `plan` / `dashboard` / `report` catch-alls
removed earlier — tiny 2–4 character substring matchers that look
harmless individually but capture far more prompts than intended.

**Fix:** scope each one to a full intent phrase that won't accidentally
appear inside unrelated text:

| Old (substring) | New (full phrase) | Was matching |
|---|---|---|
| `hi` | `Hi, who are you` | `this`, `history`, `achieving` |
| `hello` | `hello, what can you do` | `mellow`, `fellow`; also
collapses the dup capital-H entry |
| `help` | `what can you help me with` | `helpful`, `helping` |
| `deal` | `add a new enterprise deal` | `dealing`, `idealized` |
| `city` | `what city do I live in` | `capacity`, `velocity`,
`specificity` |
| `paris` | `flights to Paris` | `comparison`, `preparing` |

## Test plan

- [x] Subagents flow re-runs the writer / critique sub-LLM calls and
they now produce on-topic output (via aimock `--provider-gemini` falling
through to real Gemini) instead of returning the boilerplate.
- [ ] Manual Railway prod check after merge — please retry the 3
subagents pills (cold-exposure, LLM tool-calling, reusable rockets).

## Notes

- Aimock on prod loads `feature-parity.json` from GitHub raw at boot
(per `RAILWAY.md`), so the moment this merges Railway picks up the
tightened matchers without an image rebuild.
- Production-only manifestations of this bug were intermittent because
the supervisor LLM picks slightly different sub-task wording each run;
the failure rate is whatever fraction of sub-task texts happen to
contain a `hi` / `help` substring.
 2026-05-15 10:11:13 -07:00
dependabot[bot] 1b0adb5675 chore(ci)(deps): bump actions/setup-node from 4.4.0 to 6.4.0 
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.4.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:56:26 +00:00
dependabot[bot] b170547aa8 chore(ci)(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:56:24 +00:00
dependabot[bot] 55baa76cda chore(ci)(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.1.0 
Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2.5.0 to 3.1.0.
- [Release notes](https://github.com/dependabot/fetch-metadata/releases)
- [Commits](https://github.com/dependabot/fetch-metadata/compare/21025c705c08248db411dc16f3619e6b5f9ea21a...25dd0e34f4fe68f24cc83900b1fe3fe149efef98)

---
updated-dependencies:
- dependency-name: dependabot/fetch-metadata
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:56:20 +00:00
dependabot[bot] 164648a8c9 chore(ci)(deps): bump actions/create-github-app-token 
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.2.2 to 3.2.0.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/create-github-app-token/compare/fee1f7d63c2ff003460e3d139729b119787bc349...bcd2ba49218906704ab6c1aa796996da409d3eb1)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:56:08 +00:00
dependabot[bot] 0c8ede3f45 chore(ci)(deps): bump actions/setup-python from 5.6.0 to 6.2.0 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.2.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/a26af69be951a213d495a4c3e4e4022e16d87065...a309ff8b426b58ec0e2a45f0f869d46889d02405)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:56:06 +00:00
dependabot[bot] 66467b7668 chore(ci)(deps): bump docker/login-action from 3.7.0 to 4.1.0 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...4907a6ddec9925e35a0a9e82d7399ccc52663121)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:56:02 +00:00
dependabot[bot] 5799857379 chore(ci)(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:55:58 +00:00
dependabot[bot] a4268a37db chore(ci)(deps): bump dorny/paths-filter from 3.0.3 to 4.0.1 
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3.0.3 to 4.0.1.
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](https://github.com/dorny/paths-filter/compare/d1c1ffe0248fe513906c8e24db8ea791d46f8590...fbd0ab8f3e69293af611ebaee6363fc25e6d187d)

---
updated-dependencies:
- dependency-name: dorny/paths-filter
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:55:56 +00:00
github-actions[bot] e4633737b2 chore(ci)(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.4 in the minor-and-patch group (#4847) 
Bumps the minor-and-patch group with 1 update:
[zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).

Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/zizmorcore/zizmor-action/releases">zizmorcore/zizmor-action's
releases</a>.</em></p>
<blockquote>
<h2>v0.5.4</h2>
<ul>
<li>1.25.0 is now available via the action</li>
<li>1.25.0 is now the default version of zizmor used by the action</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/b572f7b1a1c2d41efaab43d504f68d215c3cd727"><code>b572f7b</code></a>
Sync zizmor versions (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/111">#111</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/06928c5dcba418c7d6108a4bd6e2d34cbf3c9377"><code>06928c5</code></a>
chore(deps): bump github/codeql-action in the github-actions group (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/109">#109</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/5ea8b96e1078453e04a1b81443890d9e7da5ddf3"><code>5ea8b96</code></a>
docs: Update link to GitHub docs (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/108">#108</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/849ac260951adeb7c02481da6c7e749b39f4ea6d"><code>849ac26</code></a>
chore(deps): bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/106">#106</a>)</li>
<li><a
href="https://github.com/zizmorcore/zizmor-action/commit/814f9778aceea8641503a8cd8f0cffebc55d790c"><code>814f977</code></a>
Bump pins in README (<a
href="https://redirect.github.com/zizmorcore/zizmor-action/issues/103">#103</a>)</li>
<li>See full diff in <a
href="https://github.com/zizmorcore/zizmor-action/compare/b1d7e1fb5de872772f31590499237e7cce841e8e...b572f7b1a1c2d41efaab43d504f68d215c3cd727">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=zizmorcore/zizmor-action&package-manager=github_actions&previous-version=0.5.3&new-version=0.5.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>
 2026-05-15 16:55:52 +00:00
dependabot[bot] af21d6b88e chore(ci)(deps): bump actions/cache from 4.3.0 to 5.0.5 
Bumps [actions/cache](https://github.com/actions/cache) from 4.3.0 to 5.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...27d5ce7f107fe9357f9df03efb73ab90386fccae)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:55:48 +00:00
dependabot[bot] aadd40eaae chore(ci)(deps): bump zizmorcore/zizmor-action 
Bumps the minor-and-patch group with 1 update: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.4
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/b1d7e1fb5de872772f31590499237e7cce841e8e...b572f7b1a1c2d41efaab43d504f68d215c3cd727)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-15 16:55:36 +00:00
Sam Julien e70bd26b0f docs(showcase): backfill region markers for gen-ui-interrupt across integrations 
Adds @region[frontend-useinterrupt-render] and @region[backend-interrupt-tool]
markers to the gen-ui-interrupt demo across all 17 integrations that ship
this cell. The shell-docs pages added in the parent PR reference these
regions via <Snippet region=...>, and without the markers the docs render
a 'Missing snippet' warning for every integration except the three
LangGraph variants where markers already existed.

Each marker nests around the equivalent code in that integration:

- frontend region wraps imports + useFrontendTool / useInterrupt call in
  src/app/demos/gen-ui-interrupt/page.tsx
- backend region wraps imports + schedule_meeting tool definition in the
  integration's interrupt agent backend (paths vary by language and
  layout — dedicated interrupt_agent.py, snippet.ts sibling file,
  InterruptAgentController.java, mastra agents/index.ts, etc.)

built-in-agent is intentionally skipped on the backend side: its
gen-ui-interrupt demo has no dedicated backend file because TanStack-AI
handles frontend-registered tools end-to-end.

Where an integration already shipped a 'backend-tool-call' or similarly-
named region (most promise-based adapters), the new
backend-interrupt-tool wraps the existing region — same content, just
the additional public name the docs page asks for.

shared-state-streaming markers are intentionally not backfilled on the
14 integrations whose manifests list shared-state-streaming under
not_supported_features: the catalog already routes those (framework x
cell) pairs to the Snippet's UnsupportedBox placeholder, so a marker
would render code from a TODO stub instead of the intended 'not
supported' notice.
 2026-05-15 09:50:14 -07:00
Jordan Ritter 00d0e900cf chore(ci): tighten CI/CD security — SHA pins, zizmor, pnpm v11, audit fixes (#4820) 
## Summary

Comprehensive CI/CD security hardening pass over the 33 workflows in
`.github/workflows/`. Inspired by the TanStack security posture: pin
every action to a SHA, bump to pnpm v11 for stronger supply-chain
protections, add zizmor static analysis, and run an agentic security
audit on top.

This PR is **CI-only** — no package code, no docs. The only
non-`.github/` changes are `package.json` (`packageManager` field) and
`pnpm-lock.yaml` (regenerated for the pnpm 10→11 bump).

### What changed

1. **All `uses:` SHA-pinned** (167 occurrences across 33 workflows).
Each pin carries an inline `# vX.Y.Z` comment so reviewers can still
tell what version is wired up. Tag-style refs (`@v4`) are mutable and
have been weaponized in past supply-chain attacks; SHAs are immutable.

2. **`packageManager: pnpm@11.1.2`** + regenerated lockfile. pnpm v11
ships hardened script-execution defaults (the existing
`onlyBuiltDependencies: [better-sqlite3]` in `pnpm-workspace.yaml`
continues to be honored). Workflow-level `version: "10.13.1"` hardcodes
were removed so `pnpm/action-setup` inherits from `packageManager` —
single source of truth, no more silent drift.

3. **Dependabot for `github-actions`** (`.github/dependabot.yml`).
Without this, SHA pins rot fast and new upstream advisories never reach
us. Minor/patch bumps are grouped; majors stay separate for real review.

4. **Zizmor static analysis** (`.github/zizmor.yml` +
`.github/workflows/security_zizmor.yml`). Blocking on PR, runs on push
to main, weekly schedule for advisory drift. Catches the well-known
classes of Actions footguns: template injection, dangerous triggers,
unpinned uses, excessive token scopes, secret exfil patterns.

5. **Workflow hardening from the zizmor baseline + audit-agent
findings**:
- `persist-credentials: false` on every `actions/checkout` except 7
workflows that legitimately push back via the workflow token (each
carries a justifying comment).
- 17 attacker-controllable expansions routed through `env:` with quoted
shell vars instead of direct `${{ }}` interpolation.
- Per-job `permissions:` blocks on 14 workflows; `id-token: write`
demoted from workflow-level to the specific Depot-runner jobs;
`pull-requests: write` / `actions: write` narrowed to the jobs that
actually call those APIs.

### Audit-driven fixes

Two parallel security agents reviewed the post-zizmor state. Real
findings remediated in this PR:

| Finding | Fix |
| --- | --- |
| `publish-release.yml` build job uploaded its workspace as a 1-day
artifact with `.git/config` (containing a persisted GITHUB_TOKEN) —
recoverable by anyone with `actions:read`. | Dropped `token:` and added
`persist-credentials: false`; publish job sets up its own `insteadOf`
auth. |
| `auto_merge_showcases.yml` checked team membership of `context.actor`,
not the PR author. A team member synchronizing or reopening an
outsider's PR would auto-merge unreviewed code. | Now authorizes on
`pull_request.user.login` (immutable for the PR's lifetime). |
| `static_quality.yml` format job ran `pipx install ruff` (unpinned)
with a persisted write-scoped PR token in the workspace. | Pinned
`ruff==0.15.13`. |
| `showcase_capture-previews.yml` concatenated workflow_dispatch inputs
into a space-joined arg string. Whitespace or shell metacharacters in a
slug would re-tokenize. | Switched to a bash array. |

Final zizmor result: **0 high, 0 medium** (down from 28 high + 54 medium
baseline). All suppressions carry per-finding justifications in
`zizmor.yml`.

## Test plan

- [ ] Zizmor workflow runs and passes on this PR
- [ ] All existing CI workflows still complete (static_quality,
test_unit, integrations_parity, etc.) — confirms `permissions:`
tightening hasn't broken any job's actual API needs
- [ ] `pnpm install --frozen-lockfile` succeeds in CI with pnpm 11.1.2
- [ ] Dependabot picks up the config (visible in repo Insights →
Dependency graph → Dependabot)
- [ ] Spot-check that `actions/checkout` jobs that previously needed
credentials (release tagging, auto-format push-back) still function
 2026-05-15 09:49:12 -07:00
Sam Julien 4b432368ea fix(shell-docs): wire generative-ui pages with framework-aware demo content 
The four pages all had the same shape problem: prose followed by
<IntegrationGrid>, which hides on framework-scoped routes via
useFramework() -> null. On /<framework>/<slug> URLs the picker
disappears and the page truncates to a content-less heading.

Add InlineDemo + Snippet + FeatureIntegrations blocks above the picker
so framework-scoped routes still render demo content:

- interactive.mdx: cell gen-ui-interrupt, regions
  frontend-useinterrupt-render and backend-interrupt-tool.
- state-rendering.mdx: cell shared-state-streaming, regions
  frontend-use-coagent-state and state-streaming-middleware.
- display.mdx: cell gen-ui-tool-based, region bar-chart-renderer.
  Drop the hardcoded '## Choose your Integration' heading
  (IntegrationGrid renders its own '<h2>Choose your AI backend</h2>').
- your-components/display-only.mdx: same fix as display.mdx.

Mirrors the wiring pattern in frontend-tools.mdx and the slot-2 fix
for shared-state.mdx.
 2026-05-15 09:24:28 -07:00
Sam Julien 43d62e345c fix(shell-docs): wire shared-state.mdx with framework-aware demo content 
Mirror the frontend-tools.mdx shape so /shared-state and framework-scoped
routes like /google-adk/shared-state render meaningful code examples
instead of ending with a content-less 'Get started by choosing your AI
backend' heading (the IntegrationGrid hides itself once a framework is
selected).

- Preserve the existing 'What is shared state?' and 'When should I use
  this?' prose, ImageZoom, and OpsPlatformCTA verbatim.
- Add Reading / Writing / UI render sections driven by Snippet regions
  from the shared-state-read-write demo (use-agent-read, use-agent-write,
  notes-card-render).
- Add a Streaming overview pointing at the shared-state-streaming demo's
  state-streaming-middleware region, with a link to the existing
  /shared-state/streaming sub-page for the full walkthrough.
- Add a Read-only context section linking to the existing
  /shared-state/agent-readonly orphan sub-page.
- Swap the trailing hardcoded heading for FeatureIntegrations +
  IntegrationGrid so unscoped and scoped routes both terminate cleanly.
 2026-05-15 09:18:15 -07:00
github-actions[bot] 82ff58a078 style: auto-fix formatting 2026-05-15 16:16:56 +00:00
github-actions[bot] 228ea6175c style: auto-fix formatting 2026-05-15 16:14:44 +00:00
Jordan Ritter 25299bc390 fix(ci): separate build from publish to isolate NPM_TOKEN 
Remove pnpm run build (and pnpm run test) calls from publish-release.ts
and prerelease.ts so that repository build code never executes with
NPM_TOKEN in the environment. The CI build job (contents: read, no
secrets) now handles all building and testing, uploading pre-built
artifacts for the publish job to consume.

For prerelease: extract version bumping into a new bump-prerelease.ts
script that runs in the build job before the build step, ensuring the
built artifacts contain the correct canary version numbers.

Also fix prerelease build job to use persist-credentials: false,
matching the publish-release build job pattern.
 2026-05-15 09:13:36 -07:00
Alem Tuzlak 41a2847c7e fix(showcase/aimock): scope bare 'hi' / 'help' / 'deal' / 'city' / 'hello' / 'paris' fixtures 
The subagents demo was randomly returning the showcase-assistant
boilerplate "Hi there! I'm your showcase assistant. I can help with
weather, charts, meetings…" for sub-agent (research / writing /
critique) calls instead of the expected sub-task output. Each failure
ended the chain with a "[sub-agent error] writing_agent returned an
unexpected boilerplate response" message and the user got no blog post.

Root cause: feature-parity.json had a `match: { userMessage: "hi" }`
catch-all that aimock applied as a case-sensitive substring match
against the last user message. The writer / critique sub-agent prompts
contain ordinary English ("this", "history", "achieving") which all
contain the literal substring "hi" — so the showcase-assistant
boilerplate hijacked the sub-LLM call mid-chain, the supervisor saw
an off-topic response, and the chain bailed.

Same shape as the bare 'plan' / 'dashboard' / 'report' catch-alls
removed in earlier PRs — these are tiny, 2-4 character substring
matchers that look harmless individually but capture far more prompts
than intended.

Scope each one to a full intent phrase that won't accidentally appear
inside unrelated text:

- 'hi'    -> 'Hi, who are you' (was substring-matching 'this', 'history')
- 'hello' -> 'hello, what can you do' (also collapses the duplicate
  capital-H entry; 'hello' alone substring-matched 'mellow', 'fellow')
- 'help'  -> 'what can you help me with' (was matching 'helpful',
  'helping')
- 'deal'  -> 'add a new enterprise deal' (was matching 'dealing',
  'idealized')
- 'city'  -> 'what city do I live in' (was matching 'capacity',
  'velocity', 'specificity')
- 'paris' -> 'flights to Paris' (was matching 'comparison',
  'preparing')

Verified by inspecting the subagents flow that previously failed
twice running with the boilerplate response. With these tighter
anchors the sub-LLM calls fall through to real Gemini (via
aimock --provider-gemini, already configured both locally and on
Railway) and produce on-topic writing / critique output.
 2026-05-15 17:57:16 +02:00
Sam Julien e984593d45 fix(shell-docs): register Blocks lucide icon stub for MDX docs 
Two existing MDX pages reference lucide-react's <Blocks /> inside
<Card icon={...}> attributes — built-in-agent/index.mdx and the shared
snippet premium/headless-ui.mdx — but the docs MDX component registry
didn't stub it alongside Sparkles, Wrench, Server, Plug, ArrowLeftRight,
Cpu, BookA, and Cog. Both pages rendered fine pre-cutover (the BIA
intro was hidden behind a hardcoded splash and the shared snippet was
unused), so the gap is only visible now that the framework-root route
exercises both surfaces.
 2026-05-15 08:52:54 -07:00
Sam Julien cf4aa1c64f fix(shell-docs): allow CDN images and canonicalize /built-in-agent to root 
Two related next.config tweaks for the framework intro pages:

1. images.remotePatterns allows cdn.copilotkit.ai so next/image stops
   throwing 'hostname not configured' for banner videos, architecture
   diagrams, and the CopilotKit color logo embedded in every
   FrameworkOverview data record.

2. 308 redirect /built-in-agent → / since built-in-agent is the
   default framework and the docs root is its overview. Without the
   redirect, /built-in-agent rendered a separate intro and the
   sidebar carried a redundant Introduction link.
 2026-05-15 08:52:54 -07:00
Sam Julien 383446546b feat(shell-docs): add Introduction entry at top of integration sidebars 
Adds "index" as the first page in 13 integration meta.json files (all
except built-in-agent) so the framework intro page appears at the top
of the left sidebar. Pairs with buildNavTree's "index"-slug rewrite
which resolves "index" to the bare /<framework> URL, and with
mergeFrameworkNav's hoist which places this entry above the global
root nav.

For the 12 integrations whose Getting Started section had only the
intro under it, the now-empty section header is dropped. For
deepagents (Getting Started also has quickstart) the section header
stays after Introduction.

built-in-agent and deepagents previously had no meta.json (sidebar
fell through to filesystem order); a new meta.json is added for each.
built-in-agent's omits "index" because /built-in-agent redirects to
the docs root rather than rendering a separate intro.
 2026-05-15 08:52:54 -07:00
Sam Julien 629a0889c3 feat(shell-docs): render FrameworkOverview at framework root URL 
Replaces the hardcoded FrameworkLandingPage splash with a three-tier
resolution at /<framework>:

  1. frameworkOverviews[slug] exists → render <FrameworkOverview> with
     the data record (plus an optional after-features.mdx slot for the
     three frameworks that need one).
  2. integrations/<folder>/index.mdx exists → render through loadDoc /
     DocsPageView.
  3. otherwise notFound().

Recognizes docs-only integrations (a2a, agent-spec, deepagents) that
have docs content but no showcase/integrations/<slug>/ demo package —
previously the registry check sent them to UnscopedDocsPage and they
404'd at /<slug>.

Adds an "index" slug rewrite in buildNavTree and
buildFrameworkOverridesNav so meta.json "index" entries resolve to
the bare /<framework> URL rather than /<framework>/index.

Hoists the framework's Introduction (slug "") to position 0 of the
merged sidebar so users see it above the global root nav rather than
buried inside the per-framework section. RenderNav and sidebar-link
pass an empty slugPath through for active-state matching at the root.
 2026-05-15 08:52:54 -07:00
Sam Julien d264e2e021 feat(shell-docs): add FrameworkOverview data records for 13 frameworks 
One TS record per integration (canonical slug): name, icon key, hero
copy, banner video, three supported-feature cards, architecture asset,
live-demo iframes, optional structured CTA. The aggregator
src/data/frameworks/index.ts exports the slug-keyed map consumed by
the framework-root route.

Three frameworks (ms-agent-dotnet, ag2, agent-spec) have post-features
content that doesn't fit the structured cta field (Resources links, a
Callout, an Agent Spec how-to body). Each ships a sibling
after-features.mdx loaded into the FrameworkOverview's afterFeatures
slot when hasAfterFeaturesMdx is true.

LangGraph variants (langgraph-typescript, langgraph-fastapi) and
ms-agent-python alias the same record as their primary variant —
their content folders are shared and the legacy docs never
differentiated variants at the intro-page level. The component's link
rewriter keeps every CTA on the variant's own URL.

built-in-agent is excluded — it's the default framework and the docs
root '/' IS its overview page.
 2026-05-15 08:52:53 -07:00
Sam Julien 954bf41025 feat(shell-docs): port FrameworkOverview component and framework icons 
Ports the FrameworkOverview marketing layout from legacy docs/ with
data-driven icon resolution via a customIcons registry. The original
shadcn Button (CVA / clsx / tailwind-merge / @radix-ui/react-slot) is
deliberately not ported — its only consumer here is six marketing CTAs
and a demo toggle, all of which use plain <button> + inlined Tailwind
matching the existing copy-button.tsx convention. This keeps shell-docs
out of the workspace lockfile and avoids the latent gray-matter /
js-yaml-v4 override that fires under workspace pnpm but not under
prod's npm install in the Dockerfile.

The component accepts a currentFramework prop and rewrites any
embedded slug in the data record's links (guideLink, featuresLink,
per-feature documentationLink / demoLink, tutorialLink) to that slug
— so when langgraph-typescript or langgraph-fastapi alias the
langgraph-python record, every CTA still routes within the user's
selected variant. Covers internal paths ("/<slug>/...") and
feature-viewer URLs ("feature-viewer.copilotkit.ai/<slug>/...").

Adds A2AIcon and AgentSpecMarkIcon as new icon components; extends the
existing framework-icons module with a DeepAgentsIcon and a customIcons
barrel typed by IconKey.
 2026-05-15 08:52:53 -07:00
Sam Julien 3e7271ac13 feat(shell-docs): add FrameworkOverviewData type definitions 
Type contracts for the data-driven framework intro pages. Optional
fields cover observed variance across the 13 in-scope integrations:
a2a omits bannerVideo, crewai-flows uses architectureVideo instead of
architectureImage, llamaindex's only feature lacks a videoUrl.
 2026-05-15 08:52:53 -07:00
Alem Tuzlak 23311b411a fix(showcase/google-adk/beautiful-chat): wire calculator click handlers via addEventListener (#4841) 
## Summary

The Beautiful Chat **Calculator App (Open Generative UI)** pill rendered
the layout but no button responded to clicks.

**Root cause:** Gemini's default emit for the calculator widget wrapped
buttons in `<form>` with `type="submit"` for click handling. The iframe
runs with `sandbox="allow-scripts"` ONLY, so the browser silently blocks
form submission before any onsubmit / click handler fires. The buttons
drew, nothing happened on click — exactly the "white empty / dead UI"
the user reported in prod.

**Fix:** Expand the `generateSandboxedUi` guidance in
`beautiful_chat_agent.py`'s `_INSTRUCTION` with the same sandbox-iframe
contract `_OPEN_GEN_UI_ADVANCED_INSTRUCTION` already spells out:

- Forms and submit-type buttons are blocked silently — never use them.
- Use `<button type="button" data-key="…">` plus a single delegated
`document.addEventListener('click', e => …)` that reads
`e.target.dataset.key` / `data-value`. Keyboard input via a `keydown`
listener checking `e.key === 'Enter'`.
- All handler code in a `<script>` tag inside `html`.
- For calculators specifically: each digit/operator button carries
`data-key`, each metric-shortcut button carries `data-value`, one
delegated click handler updates the display.

## Test plan

- [x] Local browser: Calculator pill in Beautiful Chat now produces a
widget whose number / operator / metric-shortcut buttons all respond to
clicks; matches the LangGraph-Python output.
- [ ] Manual Railway prod check after merge.

## Notes

- The instruction nudge for `generateSandboxedUi` itself shipped in
#4837. This PR is purely about teaching Gemini the sandbox-iframe
restrictions so the generated HTML stays interactive.
 2026-05-15 17:32:28 +02:00
Alem Tuzlak 36e0e24f94 fix(showcase/google-adk/beautiful-chat): wire calculator click handlers via addEventListener 
Calculator pill rendered the layout but no button responded. Root cause:
Gemini's default emit for the calculator widget used `<form>` /
`<button type="submit">` for clicks — the iframe runs with
`sandbox="allow-scripts"` only, so the browser silently blocks form
submission before any handler fires. The buttons drew, nothing happened.

Expand the `generateSandboxedUi` guidance in `_INSTRUCTION` with the same
sandbox-iframe contract `_OPEN_GEN_UI_ADVANCED_INSTRUCTION` already
spells out:
- Forms and submit-type buttons are blocked silently.
- Use `<button type="button" data-key="…">` plus a single delegated
  `document.addEventListener('click', e => …)` that reads
  `e.target.dataset.key` / `data-value`. Keyboard input via a `keydown`
  listener that checks `e.key === 'Enter'`.
- All handler code in a `<script>` tag inside `html`.

Verified: the calculator widget Gemini now produces wires every key /
metric-shortcut button with delegated click handlers; clicks update the
calculator display end-to-end. Matches the LangGraph-Python output.

(The instruction nudge for generateSandboxedUi itself shipped in #4837.
This change is purely about teaching Gemini the sandbox restrictions so
the generated HTML stays interactive.)
 2026-05-15 17:14:26 +02:00
Alem Tuzlak 12d3547842 fix(deps): update copilotkit examples (major) (#4755) 
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@copilotkit/a2ui-renderer](https://redirect.github.com/CopilotKit/CopilotKit)
([source](https://redirect.github.com/CopilotKit/CopilotKit/tree/HEAD/packages/a2ui-renderer))
| [`0.0.0-mme-ag-ui-0-0-46-20260227141603` →
`1.57.1`](https://renovatebot.com/diffs/npm/@copilotkit%2fa2ui-renderer/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@copilotkit%2fa2ui-renderer/1.57.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@copilotkit%2fa2ui-renderer/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1?slim=true)
|
|
[@copilotkit/react-core](https://redirect.github.com/CopilotKit/CopilotKit)
| [`0.0.0-mme-ag-ui-0-0-46-20260227141603` →
`1.57.1`](https://renovatebot.com/diffs/npm/@copilotkit%2freact-core/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@copilotkit%2freact-core/1.57.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@copilotkit%2freact-core/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1?slim=true)
|
|
[@copilotkit/react-ui](https://redirect.github.com/CopilotKit/CopilotKit)
| [`0.0.0-mme-ag-ui-0-0-46-20260227141603` →
`1.57.1`](https://renovatebot.com/diffs/npm/@copilotkit%2freact-ui/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@copilotkit%2freact-ui/1.57.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@copilotkit%2freact-ui/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1?slim=true)
|
|
[@copilotkit/runtime](https://redirect.github.com/CopilotKit/CopilotKit)
| [`0.0.0-mme-ag-ui-0-0-46-20260227141603` →
`1.57.1`](https://renovatebot.com/diffs/npm/@copilotkit%2fruntime/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@copilotkit%2fruntime/1.57.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@copilotkit%2fruntime/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1?slim=true)
|
|
[@copilotkit/runtime-client-gql](https://redirect.github.com/CopilotKit/CopilotKit)
| [`0.0.0-mme-ag-ui-0-0-46-20260227141603` →
`1.57.1`](https://renovatebot.com/diffs/npm/@copilotkit%2fruntime-client-gql/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@copilotkit%2fruntime-client-gql/1.57.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@copilotkit%2fruntime-client-gql/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1?slim=true)
|
|
[@copilotkit/shared](https://redirect.github.com/CopilotKit/CopilotKit)
| [`0.0.0-mme-ag-ui-0-0-46-20260227141603` →
`1.57.1`](https://renovatebot.com/diffs/npm/@copilotkit%2fshared/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@copilotkit%2fshared/1.57.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@copilotkit%2fshared/0.0.0-mme-ag-ui-0-0-46-20260227141603/1.57.1?slim=true)
|
| copilotkit | [`^0.0.45` →
`^2.0.0`](https://renovatebot.com/diffs/npm/copilotkit/0.0.45/2.0.4) |
![age](https://developer.mend.io/api/mc/badges/age/npm/copilotkit/2.0.4?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/copilotkit/0.0.45/2.0.4?slim=true)
|

---

### Release Notes

<details>
<summary>CopilotKit/CopilotKit
(@&#8203;copilotkit/a2ui-renderer)</summary>

###
[`v1.57.1`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.57.0...v1.57.1)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.57.0...v1.57.1)

###
[`v1.57.0`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.5...v1.57.0)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.5...v1.57.0)

###
[`v1.56.5`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.4...v1.56.5)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.4...v1.56.5)

###
[`v1.56.4`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.3...v1.56.4)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.3...v1.56.4)

###
[`v1.56.3`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.2...v1.56.3)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.2...v1.56.3)

###
[`v1.56.2`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.56.2)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.1...v1.56.2)

### CopilotKit v1.56.2

A hygiene release on the `1.56` line. Removes a leftover peer dependency
that was generating install warnings for users not on LangChain.

#### Install

```bash
npm install @&#8203;copilotkit/react-core@1.56.2 @&#8203;copilotkit/react-ui@1.56.2 @&#8203;copilotkit/runtime@1.56.2
```

#### SDK fixes (`@copilotkit/sdk-js`)

- **Remove unused `@langchain/community` peer dependency** —
`@langchain/community` was a leftover peer dep that nothing inside
`@copilotkit/sdk-js` actually used, but it still generated install
warnings for anyone not on LangChain. Dropped. If you've been installing
`@langchain/community` only to quiet a peer-dep warning, you can drop
it.
([#&#8203;3960](https://redirect.github.com/CopilotKit/CopilotKit/pull/3960))

#### Packages republished at `1.56.2`

`@copilotkit/runtime`, `@copilotkit/react-core`, `@copilotkit/react-ui`,
`@copilotkit/core`, `@copilotkit/shared`,
`@copilotkit/runtime-client-gql`, `@copilotkit/sdk-js`,
`@copilotkit/voice`, `@copilotkit/web-inspector`,
`@copilotkit/a2ui-renderer`, `@copilotkit/react-textarea`,
`@copilotkit/sqlite-runner`, and `@copilotkit/angular`.

###
[`v1.56.1`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.56.1)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.0...v1.56.1)

### CopilotKit v1.56.1

A patch release on the `1.56` line. No breaking API changes —
thirty-plus fixes across adapters, the React UI surface, and the
runtime/agent layer. Most of these address long-standing issues that had
been quietly biting users; batch-resolved here.

#### Install

```bash
npm install @&#8203;copilotkit/react-core@1.56.1 @&#8203;copilotkit/react-ui@1.56.1 @&#8203;copilotkit/runtime@1.56.1
```

#### Adapter fixes (`@copilotkit/runtime`)

- **Anthropic `max_tokens` default bumped 1024 → 4096** — the old
default was short enough that longer completions were getting truncated
without warning.
([#&#8203;3785](https://redirect.github.com/CopilotKit/CopilotKit/pull/3785))
- **Anthropic adapter skips unknown `tool_use` blocks** — no more crash
when Anthropic emits `content_block_delta` for a `tool_use` the adapter
hasn't seen.
([#&#8203;3824](https://redirect.github.com/CopilotKit/CopilotKit/pull/3824),
closes
[#&#8203;2504](https://redirect.github.com/CopilotKit/CopilotKit/issues/2504))
- **Anthropic `tool_result` paired with `tool_use` after token
trimming** — token trimming no longer orphans `tool_result` messages.
([#&#8203;3820](https://redirect.github.com/CopilotKit/CopilotKit/pull/3820),
closes
[#&#8203;2450](https://redirect.github.com/CopilotKit/CopilotKit/issues/2450))
- **Configurable `maxInputTokens` on OpenAI and Anthropic adapters** —
cap input tokens explicitly per request.
([#&#8203;3823](https://redirect.github.com/CopilotKit/CopilotKit/pull/3823),
closes
[#&#8203;2405](https://redirect.github.com/CopilotKit/CopilotKit/issues/2405))
- **LangChain adapter always generates unique message IDs** — prevents
downstream deduplication issues.
([#&#8203;3829](https://redirect.github.com/CopilotKit/CopilotKit/pull/3829))
- **Zod v4 compatibility for schema-to-JSON conversion** — the
schema-to-JSON converter now handles the Zod v4 shape.
([#&#8203;3837](https://redirect.github.com/CopilotKit/CopilotKit/pull/3837))
- **MCP `TOOL_CALL_RESULT` array-content normalization** — array-shaped
tool results are now normalized into strings the runtime can emit.
([#&#8203;3832](https://redirect.github.com/CopilotKit/CopilotKit/pull/3832))
- **Non-unique provider IDs replaced with UUIDs** — placeholders like
`txt-0` were colliding; the adapter now emits proper UUIDs.
([#&#8203;3800](https://redirect.github.com/CopilotKit/CopilotKit/pull/3800),
closes
[#&#8203;3410](https://redirect.github.com/CopilotKit/CopilotKit/issues/3410),
[#&#8203;3623](https://redirect.github.com/CopilotKit/CopilotKit/issues/3623))

#### React fixes (`@copilotkit/react-core`, `@copilotkit/react-ui`)

- **Export `CopilotModal` and `CopilotModalProps`** — public components
without a public export, now corrected.
([#&#8203;3817](https://redirect.github.com/CopilotKit/CopilotKit/pull/3817),
closes
[#&#8203;2194](https://redirect.github.com/CopilotKit/CopilotKit/issues/2194))
- **`Button` uses `forwardRef` for Radix interop** — no more ref
warnings when composing with Radix `DropdownMenuTrigger`.
([#&#8203;3830](https://redirect.github.com/CopilotKit/CopilotKit/pull/3830))
- **IME composition guard in `CopilotChatInput`** — no more accidental
sends mid-composition for CJK/IME input.
([#&#8203;3835](https://redirect.github.com/CopilotKit/CopilotKit/pull/3835))
- **Loading indicator during tool execution** — keeps the UI honest
about what's happening mid-tool-call.
([#&#8203;3833](https://redirect.github.com/CopilotKit/CopilotKit/pull/3833))
- **Controlled-input reset after send** — `onChange("")` fires after
submit in controlled mode.
([#&#8203;3836](https://redirect.github.com/CopilotKit/CopilotKit/pull/3836))
- **`available: "disabled"` tools excluded from `buildFrontendTools`** —
disabled tools are no longer announced to the model.
([#&#8203;3793](https://redirect.github.com/CopilotKit/CopilotKit/pull/3793),
closes
[#&#8203;3020](https://redirect.github.com/CopilotKit/CopilotKit/issues/3020))
- **Thumbs callbacks receive `AssistantMessage`** —
`onThumbsUp`/`onThumbsDown` now pass the message instead of a
`SyntheticEvent`.
([#&#8203;3796](https://redirect.github.com/CopilotKit/CopilotKit/pull/3796),
closes
[#&#8203;3457](https://redirect.github.com/CopilotKit/CopilotKit/issues/3457))
- **`urlTransform` forwards to `ReactMarkdown`** — the prop was being
dropped silently.
([#&#8203;3845](https://redirect.github.com/CopilotKit/CopilotKit/pull/3845))
- **Message footer width** — hardcoded `97%` replaced with `100%`.
([#&#8203;3786](https://redirect.github.com/CopilotKit/CopilotKit/pull/3786))

#### Runtime + agent fixes (`@copilotkit/runtime`,
`@copilotkit/react-core`)

- **Duck-type `Request` for Hono polyfill compat** — `instanceof` was
brittle under Hono's polyfilled `Request`; the runtime now type-sniffs
instead.
([#&#8203;3790](https://redirect.github.com/CopilotKit/CopilotKit/pull/3790))
- **LangGraph agent pagination default 10 → 100** — larger default page
size for LangGraph thread/run listings.
([#&#8203;3812](https://redirect.github.com/CopilotKit/CopilotKit/pull/3812),
closes
[#&#8203;2056](https://redirect.github.com/CopilotKit/CopilotKit/issues/2056))
- **Handle void return from `sendFunction` in `usePushToTalk`** —
push-to-talk no longer assumes a non-void return.
([#&#8203;3783](https://redirect.github.com/CopilotKit/CopilotKit/pull/3783))
- **`useRenderCustomMessages` returns `null` when agent missing** — used
to throw; now safely no-ops.
([#&#8203;3797](https://redirect.github.com/CopilotKit/CopilotKit/pull/3797),
closes
[#&#8203;3497](https://redirect.github.com/CopilotKit/CopilotKit/issues/3497))
- **`CopilotListeners` guards empty agents map** — stops `useAgent`
throwing on initial boot.
([#&#8203;3798](https://redirect.github.com/CopilotKit/CopilotKit/pull/3798),
closes
[#&#8203;3249](https://redirect.github.com/CopilotKit/CopilotKit/issues/3249))
- **Skip version check when `showDevConsole={false}`** — fewer requests
when the dev console is disabled.
([#&#8203;3827](https://redirect.github.com/CopilotKit/CopilotKit/pull/3827))
- **Forward credentials on all agent registration paths** — one
registration path was not forwarding credentials; now consistent.
([#&#8203;3839](https://redirect.github.com/CopilotKit/CopilotKit/pull/3839))
- **`toolCallId` passed to `useRenderTool` render components** — render
functions now receive the tool call ID.
([#&#8203;3843](https://redirect.github.com/CopilotKit/CopilotKit/pull/3843))
- **`hookParams` passed to `onAfterRequest`** — the callback was
receiving an empty object. Now receives the actual hook params.
([#&#8203;3801](https://redirect.github.com/CopilotKit/CopilotKit/pull/3801),
closes
[#&#8203;2124](https://redirect.github.com/CopilotKit/CopilotKit/issues/2124))
- **Configurable audio `mediaType` + mic tracks released on stop** — mic
tracks no longer linger after a recording ends.
([#&#8203;3811](https://redirect.github.com/CopilotKit/CopilotKit/pull/3811),
closes
[#&#8203;2049](https://redirect.github.com/CopilotKit/CopilotKit/issues/2049),
[#&#8203;2050](https://redirect.github.com/CopilotKit/CopilotKit/issues/2050))

#### Build / packaging

- **Release pipeline hardened** — registry error handling, tag-existence
checks before publish, and prerelease smoke tests in the release
workflow.
([#&#8203;3858](https://redirect.github.com/CopilotKit/CopilotKit/pull/3858))

#### Packages republished at `1.56.1`

`@copilotkit/runtime`, `@copilotkit/react-core`, `@copilotkit/react-ui`,
`@copilotkit/core`, `@copilotkit/shared`,
`@copilotkit/runtime-client-gql`, `@copilotkit/sdk-js`,
`@copilotkit/voice`, `@copilotkit/web-inspector`,
`@copilotkit/a2ui-renderer`, `@copilotkit/react-textarea`,
`@copilotkit/sqlite-runner`, and `@copilotkit/angular`.

###
[`v1.56.0`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.56.0)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.55.3...v1.56.0)

### CopilotKit v1.56.0

A minor release on the `1.56` line. The headline is **debug mode** — a
single `debug` flag on the runtime and the `<CopilotKit>` provider that
threads structured logging through the full stack, with PII-safe
defaults. Also fixes the state streaming path on LangGraph prebuilt
agents and realigns A2UI with the v0.9 spec.

#### Install

```bash
npm install @&#8203;copilotkit/react-core@1.56.0 @&#8203;copilotkit/react-ui@1.56.0 @&#8203;copilotkit/runtime@1.56.0
```

#### Features

- **Debug mode for runtime and client** — a single `debug` flag on
`CopilotRuntime` and the `<CopilotKit>` provider, with structured
logging across the SSE event pipeline. Defaults to `verbose: false` to
prevent accidental PII exposure in logs. Shared `DebugConfig` type and
`resolveDebugConfig` helper live in `@copilotkit/shared`. Changes apply
at runtime; toggling the flag does not require a remount.
([#&#8203;3562](https://redirect.github.com/CopilotKit/CopilotKit/pull/3562))

  ```tsx
  // Client
  import { CopilotKit } from "@&#8203;copilotkit/react-core";

  <CopilotKit debug runtimeUrl="/api/copilotkit">
    <App />
  </CopilotKit>
  ```

  ```ts
  // Runtime
  import { CopilotRuntime } from "@&#8203;copilotkit/runtime";

  const runtime = new CopilotRuntime({
    debug: { events: true, lifecycle: true, verbose: false },
  });
  ```

- **State streaming on LangGraph prebuilt agents** — the state streaming
path now works on prebuilt LangGraph agents without unwrapping the graph
manually. A reference example landed alongside the fix.
([#&#8203;3934](https://redirect.github.com/CopilotKit/CopilotKit/pull/3934),
[#&#8203;3649](https://redirect.github.com/CopilotKit/CopilotKit/pull/3649))

#### Runtime fixes (`@copilotkit/runtime`)

- **A2UI schema realigned with v0.9 spec** — the schema format had
drifted from the v0.9 spec as upstream tightened constraints. Realigned,
with improved path-binding prompts so the model produces schema-valid
output more reliably.
([#&#8203;3929](https://redirect.github.com/CopilotKit/CopilotKit/pull/3929))
- **Latest `@ag-ui/langgraph` packages** — runtime and examples now pull
the latest `@ag-ui/langgraph` packages, picking up upstream fixes. No
API change.
([#&#8203;3932](https://redirect.github.com/CopilotKit/CopilotKit/pull/3932))

#### Build / packaging

- **Release pipeline hardening** — registry error handling, a
tag-existence check before publish, and prerelease smoke tests so
release-time failures get caught before the git tag.
([#&#8203;3858](https://redirect.github.com/CopilotKit/CopilotKit/pull/3858))
- **Docs-sync PR flow** — review items now staged before creating the
PR.
([#&#8203;3779](https://redirect.github.com/CopilotKit/CopilotKit/pull/3779))

#### Packages republished at `1.56.0`

`@copilotkit/runtime`, `@copilotkit/react-core`, `@copilotkit/react-ui`,
`@copilotkit/core`, `@copilotkit/shared`,
`@copilotkit/runtime-client-gql`, `@copilotkit/sdk-js`,
`@copilotkit/voice`, `@copilotkit/web-inspector`,
`@copilotkit/a2ui-renderer`, `@copilotkit/react-textarea`,
`@copilotkit/sqlite-runner`, and `@copilotkit/angular`.

###
[`v1.55.3`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.55.3)

### CopilotKit v1.55.3

A consolidation release on the `1.55` line, rolling up everything that
landed in `1.55.0`, `1.55.1`, and `1.55.2`. The headline: every
`@copilotkitnext/*` package has been folded into its flat
`@copilotkit/*` equivalent. v1 imports stay on `@copilotkit/react-core`;
v2 imports continue to use the `@copilotkit/react-core/v2` subpath.

On top of the consolidation: multimodal attachments for the built-in
agent, A2UI v0.9 with Open Generative UI, a fetch-based runtime handler,
Vertex AI provider, `BuiltInAgent` factory mode, and a long list of
fixes to streaming, reasoning, layout, and re-render behavior.

#### Install

```bash
npm install @&#8203;copilotkit/react-core@1.55.3 @&#8203;copilotkit/react-ui@1.55.3 @&#8203;copilotkit/runtime@1.55.3
```

#### Features

- **Package consolidation: `@copilotkitnext/*` → `@copilotkit/*`** —
every `@copilotkitnext/*` package is folded into its flat
`@copilotkit/*` equivalent. The v1 API surface stays at the package root
(e.g. `@copilotkit/react-core`); the v2 API surface continues to be
available via the `@copilotkit/react-core/v2` subpath. The
`@copilotkitnext/*` scope was deprecated in 1.54 and is removed here.
- **Multimodal attachments for the built-in agent** —
`@copilotkit/runtime` now accepts multimodal attachments (images, files,
anything non-text) and passes them through to the model with content
types preserved.
([#&#8203;3604](https://redirect.github.com/CopilotKit/CopilotKit/pull/3604))
- **A2UI v0.9 + Open Generative UI** — A2UI aligns with the v0.9 spec
and Open Generative UI lands with BYOC catalogs (the agent renders from
your component catalog), built-in dark mode, and sandboxed UI generation
(generated components render inside a sandbox instead of being spliced
into the host tree).
([#&#8203;3588](https://redirect.github.com/CopilotKit/CopilotKit/pull/3588))
- **Fetch-based runtime handler** — `@copilotkit/runtime` exposes a
fetch-based handler alongside the Node/Hono integrations, plus a
consistency pass on public function names. Targets Cloudflare Workers,
Vercel Edge, and other Web `fetch` runtimes.
([#&#8203;3550](https://redirect.github.com/CopilotKit/CopilotKit/pull/3550))
- **`BuiltInAgent` factory mode** — the built-in agent now supports a
factory construction path, so you can pass your own LLM-producing
factory and decouple the agent from the providers baked in today. Landed
in 1.55.2.
([#&#8203;3572](https://redirect.github.com/CopilotKit/CopilotKit/pull/3572))
- **Auto-detected runtime transport** — `@copilotkit/core` and
`@copilotkit/react-core` now detect REST vs. single-endpoint transport
from the runtime and adapt automatically.
([#&#8203;3601](https://redirect.github.com/CopilotKit/CopilotKit/pull/3601))
- **Vertex AI provider** — first-class provider on the runtime.
- **State streaming LangGraph middleware re-exported** — re-exported
directly from `@copilotkit/runtime` so callers no longer have to reach
into `@ag-ui/*` to wire it up.
([#&#8203;3473](https://redirect.github.com/CopilotKit/CopilotKit/pull/3473))
- **Custom `mcpClients` configuration** — pass your own MCP client
configuration to the runtime to control how tool providers connect and
reuse.
([#&#8203;3493](https://redirect.github.com/CopilotKit/CopilotKit/pull/3493))

#### Runtime fixes (`@copilotkit/runtime`)

- **Reasoning lifecycle hardening** — keeps the AG-UI reasoning event
stream well-formed regardless of SDK behavior: skip empty reasoning
deltas (which violate the `@ag-ui/core` schema), auto-close reasoning
when the SDK omits `reasoning-end` (covers consecutive-start, phase
changes, aborts, errors, and fallback paths), make `reasoning-end`
idempotent, regenerate `reasoningMessageId` between consecutive
reasoning blocks, and close reasoning in the outer catch block.
([#&#8203;3526](https://redirect.github.com/CopilotKit/CopilotKit/pull/3526))
- **Race condition dropping agent runs** — `RunHandler.runAgent()` had a
race that could drop runs invoked in quick succession. Closed.
([#&#8203;3514](https://redirect.github.com/CopilotKit/CopilotKit/pull/3514))
- **Empty tool arguments no longer crash** — tool calls with empty,
`null`, or `undefined` argument strings were throwing a JSON parse error
instead of being treated as the logically empty object they represent.
The runtime now normalizes them to `{}`.
([#&#8203;3439](https://redirect.github.com/CopilotKit/CopilotKit/pull/3439))
- **Open-generative-ui middleware import fix** — corrects an incorrect
import in the open-generative-ui middleware that surfaced after the
consolidation. Shipped in 1.55.1.
([#&#8203;3680](https://redirect.github.com/CopilotKit/CopilotKit/pull/3680))

#### React fixes (`@copilotkit/react-core`, `@copilotkit/react-ui`)

- **`messageView` and `labels` props stabilized** — `CopilotChat` was
re-rendering the entire message list on every keystroke because prop
identity was shifting. Replaced with `useShallowStableRef` to keep
references stable.
([#&#8203;3646](https://redirect.github.com/CopilotKit/CopilotKit/pull/3646))
- **Multiple `CopilotChat` instances no longer share state across
`threadId`s** — two chats mounted at different threads were sharing
message state. Per-thread agent instances are now isolated.
([#&#8203;3525](https://redirect.github.com/CopilotKit/CopilotKit/pull/3525))
- **Markdown components ref stabilized** — the Markdown component ref
was changing every render, cascading into unnecessary work during
streaming. Stabilized.
([#&#8203;3535](https://redirect.github.com/CopilotKit/CopilotKit/pull/3535))
- **Assistant text preserved across multi-tool turns** — when an
assistant turn emitted text plus multiple tool calls, the text portion
could get dropped. Preserved correctly now (CPK-7154).
([#&#8203;3622](https://redirect.github.com/CopilotKit/CopilotKit/pull/3622))
- **Chat layout regressions from 1.55.0 fixed** — the chat input is
pinned to the bottom of the window again, and mounting `CopilotSidebar`
no longer adds empty space below the page content.
([#&#8203;3759](https://redirect.github.com/CopilotKit/CopilotKit/pull/3759))
- **React keys on `CopilotMessages` children** — suppresses the "unique
key prop" warning React was emitting.
- **`defaultOpen={false}` respected in `CopilotSidebar` and
`CopilotPopup`** — the prop was being ignored on initial mount.

#### Upgrading

- The `@copilotkitnext/*` scope is removed in this release. The
deprecation notice shipped in v1.54.0.

- For v2 imports, switch from `@copilotkitnext/react` to the
`@copilotkit/react-core/v2` subpath:

  ```diff
  - import { CopilotChat } from "@&#8203;copilotkitnext/react";
  + import { CopilotChat } from "@&#8203;copilotkit/react-core/v2";
  ```

- Other `@copilotkitnext/*` packages map one-to-one to their
`@copilotkit/*` equivalents (e.g. `@copilotkitnext/angular` →
`@copilotkit/angular`).

- v1 APIs are unchanged. If you were importing v1 hooks from
`@copilotkit/react-core`, nothing changes.

#### Packages republished at `1.55.3`

`@copilotkit/runtime`, `@copilotkit/react-core`, `@copilotkit/react-ui`,
`@copilotkit/core`, `@copilotkit/shared`,
`@copilotkit/runtime-client-gql`, `@copilotkit/sdk-js`,
`@copilotkit/voice`, `@copilotkit/web-inspector`,
`@copilotkit/a2ui-renderer`, `@copilotkit/react-textarea`,
`@copilotkit/sqlite-runner`, and `@copilotkit/angular`.

###
[`v1.55.2`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1552)

##### Patch Changes

-
[`62c6042`](https://redirect.github.com/CopilotKit/CopilotKit/commit/62c6042):
Bumping the a2ui-middleware underneath the a2ui renderer

###
[`v1.55.1`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1551)

###
[`v1.55.0`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1550)

##### Minor Changes

-
[`1ceb963`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1ceb963):
refactor: consolidate V1/V2 packages into flat @&#8203;copilotkit/\*
structure
-
[`434ccd8`](https://redirect.github.com/CopilotKit/CopilotKit/commit/434ccd8):
A2UI v0.9 + Open Generative UI: BYOC catalogs, dark mode, sandboxed UI
generation

##### Patch Changes

-
[`52a9322`](https://redirect.github.com/CopilotKit/CopilotKit/commit/52a9322):
Fixing license warnings, barrel export and typing

###
[`v1.54.1`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1541-next6)

###
[`v1.54.0`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1540)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.53.0...v1.54.0)

##### Patch Changes

-
[`6e0cddf`](https://redirect.github.com/CopilotKit/CopilotKit/commit/6e0cddf):
feat: move a2ui message renderer to v2s react package
-
[`7916df6`](https://redirect.github.com/CopilotKit/CopilotKit/commit/7916df6):
feat: set default a2ui theme to fit cpk main theme

###
[`v1.53.0`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1530)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.52.1...v1.53.0)

##### Patch Changes

- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`f1eaa4c`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f1eaa4c)]
- Updated dependencies
\[[`ac31331`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ac31331)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.53.0

###
[`v1.52.1`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1521)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.52.0...v1.52.1)

##### Patch Changes

- Updated dependencies
\[[`b555ac4`](https://redirect.github.com/CopilotKit/CopilotKit/commit/b555ac4)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.52.1

###
[`v1.52.0`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1520)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.51.4...v1.52.0)

##### Patch Changes

-
[`80418e3`](https://redirect.github.com/CopilotKit/CopilotKit/commit/80418e3):
Fix a2ui-renderer to use workspace:\* for
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)
peer dependency, preventing lockfile drift on release
- Updated dependencies
\[[`6dd6c84`](https://redirect.github.com/CopilotKit/CopilotKit/commit/6dd6c84)]
- Updated dependencies
\[[`d77f347`](https://redirect.github.com/CopilotKit/CopilotKit/commit/d77f347)]
- Updated dependencies
\[[`2007f8b`](https://redirect.github.com/CopilotKit/CopilotKit/commit/2007f8b)]
- Updated dependencies
\[[`ef0f539`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ef0f539)]
- Updated dependencies
\[[`412965a`](https://redirect.github.com/CopilotKit/CopilotKit/commit/412965a)]
- Updated dependencies
\[[`5f941db`](https://redirect.github.com/CopilotKit/CopilotKit/commit/5f941db)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.52.0

###
[`v1.51.4`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1514)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.51.3...v1.51.4)

##### Patch Changes

-
[`ac64163`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ac64163):
feat(a2ui-renderer): replace Lit wrapper with React renderer
- Updated dependencies
\[[`6b9c60e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/6b9c60e)]
- Updated dependencies
\[[`12ee574`](https://redirect.github.com/CopilotKit/CopilotKit/commit/12ee574)]
- Updated dependencies
\[[`9bc868d`](https://redirect.github.com/CopilotKit/CopilotKit/commit/9bc868d)]
- Updated dependencies
\[[`c998f30`](https://redirect.github.com/CopilotKit/CopilotKit/commit/c998f30)]
- Updated dependencies
\[[`6b7d8ef`](https://redirect.github.com/CopilotKit/CopilotKit/commit/6b7d8ef)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.51.4

###
[`v1.51.3`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1513)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.51.2...v1.51.3)

##### Patch Changes

-
[`d36fc1e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/d36fc1e):
Add UMD export
-
[`ffb46f4`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ffb46f4):
fix(a2ui-renderer): ensure the component updates when A2UI operations
change
- Updated dependencies
\[[`d655e75`](https://redirect.github.com/CopilotKit/CopilotKit/commit/d655e75)]
- Updated dependencies
\[[`d36fc1e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/d36fc1e)]
- Updated dependencies
\[[`e89fe98`](https://redirect.github.com/CopilotKit/CopilotKit/commit/e89fe98)]
- Updated dependencies
\[[`3f00a01`](https://redirect.github.com/CopilotKit/CopilotKit/commit/3f00a01)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.51.3

###
[`v1.51.2`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1512)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.51.1...v1.51.2)

##### Patch Changes

-
[`e59d23f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/e59d23f):
Use deps instead of peerdeps
-
[`e59d23f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/e59d23f):
Move in-repo deps from peerdeps to actual deps
- Updated dependencies
\[[`e59d23f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/e59d23f)]
- Updated dependencies
\[[`e59d23f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/e59d23f)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.51.2

###
[`v1.51.1`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1511)

##### Patch Changes

- Updated dependencies
\[[`329653b`](https://redirect.github.com/CopilotKit/CopilotKit/commit/329653b)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.51.1

###
[`v1.51.0`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1510)

##### Patch Changes

-
[`2839a15`](https://redirect.github.com/CopilotKit/CopilotKit/commit/2839a15):
Update versioning strategy
- Updated dependencies
\[[`2839a15`](https://redirect.github.com/CopilotKit/CopilotKit/commit/2839a15)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.51.0

###
[`v1.50.1`](https://redirect.github.com/CopilotKit/CopilotKit/blob/HEAD/packages/a2ui-renderer/CHANGELOG.md#1501)

##### Patch Changes

-
[`eac8b20`](https://redirect.github.com/CopilotKit/CopilotKit/commit/eac8b20):
- fix: use latest vnext
- Updated dependencies
\[[`bdc7a8f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bdc7a8f)]
- Updated dependencies
\[[`80dffec`](https://redirect.github.com/CopilotKit/CopilotKit/commit/80dffec)]
- Updated dependencies
\[[`cfa4185`](https://redirect.github.com/CopilotKit/CopilotKit/commit/cfa4185)]
- Updated dependencies
\[[`eac8b20`](https://redirect.github.com/CopilotKit/CopilotKit/commit/eac8b20)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.50.1

</details>

<details>
<summary>CopilotKit/CopilotKit (@&#8203;copilotkit/react-core)</summary>

###
[`v1.57.1`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.57.0...v1.57.1)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.57.0...v1.57.1)

###
[`v1.57.0`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.5...v1.57.0)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.5...v1.57.0)

###
[`v1.56.5`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.4...v1.56.5)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.4...v1.56.5)

###
[`v1.56.4`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.3...v1.56.4)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.3...v1.56.4)

###
[`v1.56.3`](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.2...v1.56.3)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.2...v1.56.3)

###
[`v1.56.2`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.56.2)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.1...v1.56.2)

Release v1.56.2

###
[`v1.56.1`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.56.1)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.56.0...v1.56.1)

Release v1.56.1

###
[`v1.56.0`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.56.0)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.55.3...v1.56.0)

Release v1.56.0

###
[`v1.55.3`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.55.3)

Release v1.55.3

###
[`v1.54.0`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.54.0)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.53.0...v1.54.0)

#####
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)

##### 1.54.0

##### Minor Changes

-
[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd):
Add support for Standard Schema (instead of just Zod)

##### Patch Changes

-
[`c80498e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/c80498e):
feat(core): add copilotkit.runTool() for programmatic tool execution
-
[`af11b1e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/af11b1e):
Fixed hook render registrations lost under React Strict Mode.
- Updated dependencies
\[[`eb1e0bf`](https://redirect.github.com/CopilotKit/CopilotKit/commit/eb1e0bf)]
- Updated dependencies
\[[`3780c6a`](https://redirect.github.com/CopilotKit/CopilotKit/commit/3780c6a)]
- Updated dependencies
\[[`6e0cddf`](https://redirect.github.com/CopilotKit/CopilotKit/commit/6e0cddf)]
- Updated dependencies
\[[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd)]
- Updated dependencies
\[[`c80498e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/c80498e)]
- Updated dependencies
\[[`d746e4f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/d746e4f)]
- Updated dependencies
\[[`f1571ef`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f1571ef)]
-
[@&#8203;copilotkitnext/core](https://redirect.github.com/copilotkitnext/core)@&#8203;1.54.0
-
[@&#8203;copilotkitnext/react](https://redirect.github.com/copilotkitnext/react)@&#8203;1.54.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.54.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/react-ui](https://redirect.github.com/copilotkit/react-ui)

##### 1.54.0

##### Patch Changes

- Updated dependencies
\[[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd)]
- Updated dependencies
\[[`c80498e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/c80498e)]
- Updated dependencies
\[[`af11b1e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/af11b1e)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.54.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.54.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/sdk-js](https://redirect.github.com/copilotkit/sdk-js)

##### 1.54.0

##### Patch Changes

-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/react-textarea](https://redirect.github.com/copilotkit/react-textarea)

##### 1.54.0

##### Patch Changes

-
[`40c22a0`](https://redirect.github.com/CopilotKit/CopilotKit/commit/40c22a0):
fix: restore focus to textarea when hitting Escape in CMD+K popup
- Updated dependencies
\[[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd)]
- Updated dependencies
\[[`c80498e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/c80498e)]
- Updated dependencies
\[[`af11b1e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/af11b1e)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.54.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.54.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/runtime](https://redirect.github.com/copilotkit/runtime)

##### 1.54.0

##### Minor Changes

-
[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd):
Add support for Standard Schema (instead of just Zod)

##### Patch Changes

- Updated dependencies
\[[`3780c6a`](https://redirect.github.com/CopilotKit/CopilotKit/commit/3780c6a)]
- Updated dependencies
\[[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd)]
-
[@&#8203;copilotkitnext/agent](https://redirect.github.com/copilotkitnext/agent)@&#8203;1.54.0
-
[@&#8203;copilotkitnext/runtime](https://redirect.github.com/copilotkitnext/runtime)@&#8203;1.54.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)

##### 1.54.0

##### Patch Changes

-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)

##### 1.54.0

#####
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)

##### 1.54.0

##### Minor Changes

-
[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd):
Add support for Standard Schema (instead of just Zod)

##### Patch Changes

-
[`c80498e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/c80498e):
feat(core): add copilotkit.runTool() for programmatic tool execution
-
[`af11b1e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/af11b1e):
Fixed hook render registrations lost under React Strict Mode.
- Updated dependencies
\[[`eb1e0bf`](https://redirect.github.com/CopilotKit/CopilotKit/commit/eb1e0bf)]
- Updated dependencies
\[[`3780c6a`](https://redirect.github.com/CopilotKit/CopilotKit/commit/3780c6a)]
- Updated dependencies
\[[`6e0cddf`](https://redirect.github.com/CopilotKit/CopilotKit/commit/6e0cddf)]
- Updated dependencies
\[[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd)]
- Updated dependencies
\[[`c80498e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/c80498e)]
- Updated dependencies
\[[`d746e4f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/d746e4f)]
- Updated dependencies
\[[`f1571ef`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f1571ef)]
-
[@&#8203;copilotkitnext/core](https://redirect.github.com/copilotkitnext/core)@&#8203;1.54.0
-
[@&#8203;copilotkitnext/react](https://redirect.github.com/copilotkitnext/react)@&#8203;1.54.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.54.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/react-ui](https://redirect.github.com/copilotkit/react-ui)

##### 1.54.0

##### Patch Changes

- Updated dependencies
\[[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd)]
- Updated dependencies
\[[`c80498e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/c80498e)]
- Updated dependencies
\[[`af11b1e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/af11b1e)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.54.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.54.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/sdk-js](https://redirect.github.com/copilotkit/sdk-js)

##### 1.54.0

##### Patch Changes

-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/react-textarea](https://redirect.github.com/copilotkit/react-textarea)

##### 1.54.0

##### Patch Changes

-
[`40c22a0`](https://redirect.github.com/CopilotKit/CopilotKit/commit/40c22a0):
fix: restore focus to textarea when hitting Escape in CMD+K popup
- Updated dependencies
\[[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd)]
- Updated dependencies
\[[`c80498e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/c80498e)]
- Updated dependencies
\[[`af11b1e`](https://redirect.github.com/CopilotKit/CopilotKit/commit/af11b1e)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.54.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.54.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/runtime](https://redirect.github.com/copilotkit/runtime)

##### 1.54.0

##### Minor Changes

-
[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd):
Add support for Standard Schema (instead of just Zod)

##### Patch Changes

- Updated dependencies
\[[`3780c6a`](https://redirect.github.com/CopilotKit/CopilotKit/commit/3780c6a)]
- Updated dependencies
\[[`fa0d1cd`](https://redirect.github.com/CopilotKit/CopilotKit/commit/fa0d1cd)]
-
[@&#8203;copilotkitnext/agent](https://redirect.github.com/copilotkitnext/agent)@&#8203;1.54.0
-
[@&#8203;copilotkitnext/runtime](https://redirect.github.com/copilotkitnext/runtime)@&#8203;1.54.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)

##### 1.54.0

##### Patch Changes

-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.54.0

#####
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)

##### 1.54.0

###
[`v1.53.0`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.53.0)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.52.1...v1.53.0)

#####
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)

##### 1.53.0

##### Patch Changes

-
[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64):
feat: enable mcp and a2ui middleware directly from copilotkit runtime
-
[`f1eaa4c`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f1eaa4c):
Fixing a regression with setModalOpen
-
[`ac31331`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ac31331):
- Prevents error propagating out of CPK when an agent runtime is defined
but not reachable
  - Adds an onError callback to CopilotChat and CopilotKitProvider
- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0
-
[@&#8203;copilotkitnext/core](https://redirect.github.com/copilotkitnext/core)@&#8203;1.53.0
-
[@&#8203;copilotkitnext/react](https://redirect.github.com/copilotkitnext/react)@&#8203;1.53.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.53.0

#####
[@&#8203;copilotkit/react-ui](https://redirect.github.com/copilotkit/react-ui)

##### 1.53.0

##### Patch Changes

- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`f1eaa4c`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f1eaa4c)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
- Updated dependencies
\[[`ac31331`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ac31331)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.53.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.53.0

#####
[@&#8203;copilotkit/sdk-js](https://redirect.github.com/copilotkit/sdk-js)

##### 1.53.0

##### Patch Changes

- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0

#####
[@&#8203;copilotkit/react-textarea](https://redirect.github.com/copilotkit/react-textarea)

##### 1.53.0

##### Patch Changes

- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`f1eaa4c`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f1eaa4c)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
- Updated dependencies
\[[`ac31331`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ac31331)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.53.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.53.0

#####
[@&#8203;copilotkit/runtime](https://redirect.github.com/copilotkit/runtime)

##### 1.53.0

##### Minor Changes

-
[`f822c05`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f822c05):
Updating the path and devex for mcp apps

##### Patch Changes

-
[`d1f7aba`](https://redirect.github.com/CopilotKit/CopilotKit/commit/d1f7aba):
feat(runtime): expose messages in afterRequestMiddleware
-
[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64):
feat: enable mcp and a2ui middleware directly from copilotkit runtime
-
[`8e0f94f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/8e0f94f):
Bump AI SDK from v5 to v6
-
[`501e8d7`](https://redirect.github.com/CopilotKit/CopilotKit/commit/501e8d7):
surpress sse warning in middleware callback
- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0
-
[@&#8203;copilotkitnext/agent](https://redirect.github.com/copilotkitnext/agent)@&#8203;1.53.0
-
[@&#8203;copilotkitnext/runtime](https://redirect.github.com/copilotkitnext/runtime)@&#8203;1.53.0

#####
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)

##### 1.53.0

##### Patch Changes

- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0

#####
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)

##### 1.53.0

##### Patch Changes

-
[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64):
feat: enable mcp and a2ui middleware directly from copilotkit runtime
-
[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f):
fix: `convertJsonSchemaToZodSchema` drops enum constraints

#####
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)

##### 1.53.0

##### Patch Changes

-
[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64):
feat: enable mcp and a2ui middleware directly from copilotkit runtime
-
[`f1eaa4c`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f1eaa4c):
Fixing a regression with setModalOpen
-
[`ac31331`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ac31331):
- Prevents error propagating out of CPK when an agent runtime is defined
but not reachable
  - Adds an onError callback to CopilotChat and CopilotKitProvider
- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0
-
[@&#8203;copilotkitnext/core](https://redirect.github.com/copilotkitnext/core)@&#8203;1.53.0
-
[@&#8203;copilotkitnext/react](https://redirect.github.com/copilotkitnext/react)@&#8203;1.53.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.53.0

#####
[@&#8203;copilotkit/react-ui](https://redirect.github.com/copilotkit/react-ui)

##### 1.53.0

##### Patch Changes

- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`f1eaa4c`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f1eaa4c)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
- Updated dependencies
\[[`ac31331`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ac31331)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.53.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.53.0

#####
[@&#8203;copilotkit/sdk-js](https://redirect.github.com/copilotkit/sdk-js)

##### 1.53.0

##### Patch Changes

- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0

#####
[@&#8203;copilotkit/react-textarea](https://redirect.github.com/copilotkit/react-textarea)

##### 1.53.0

##### Patch Changes

- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`f1eaa4c`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f1eaa4c)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
- Updated dependencies
\[[`ac31331`](https://redirect.github.com/CopilotKit/CopilotKit/commit/ac31331)]
-
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)@&#8203;1.53.0
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.53.0

#####
[@&#8203;copilotkit/runtime](https://redirect.github.com/copilotkit/runtime)

##### 1.53.0

##### Minor Changes

-
[`f822c05`](https://redirect.github.com/CopilotKit/CopilotKit/commit/f822c05):
Updating the path and devex for mcp apps

##### Patch Changes

-
[`d1f7aba`](https://redirect.github.com/CopilotKit/CopilotKit/commit/d1f7aba):
feat(runtime): expose messages in afterRequestMiddleware
-
[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64):
feat: enable mcp and a2ui middleware directly from copilotkit runtime
-
[`8e0f94f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/8e0f94f):
Bump AI SDK from v5 to v6
-
[`501e8d7`](https://redirect.github.com/CopilotKit/CopilotKit/commit/501e8d7):
surpress sse warning in middleware callback
- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0
-
[@&#8203;copilotkitnext/agent](https://redirect.github.com/copilotkitnext/agent)@&#8203;1.53.0
-
[@&#8203;copilotkitnext/runtime](https://redirect.github.com/copilotkitnext/runtime)@&#8203;1.53.0

#####
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)

##### 1.53.0

##### Patch Changes

- Updated dependencies
\[[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64)]
- Updated dependencies
\[[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f)]
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.53.0

#####
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)

##### 1.53.0

##### Patch Changes

-
[`1510f64`](https://redirect.github.com/CopilotKit/CopilotKit/commit/1510f64):
feat: enable mcp and a2ui middleware directly from copilotkit runtime
-
[`bf1fc6f`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bf1fc6f):
fix: `convertJsonSchemaToZodSchema` drops enum constraints

###
[`v1.52.1`](https://redirect.github.com/CopilotKit/CopilotKit/releases/tag/v1.52.1)

[Compare
Source](https://redirect.github.com/CopilotKit/CopilotKit/compare/v1.52.0...v1.52.1)

#####
[@&#8203;copilotkit/react-core](https://redirect.github.com/copilotkit/react-core)

##### 1.52.1

##### Patch Changes

-
[`b555ac4`](https://redirect.github.com/CopilotKit/CopilotKit/commit/b555ac4):
fix(react-core): allow overriding useSingleEndpoint in CopilotKit
provider

The V1 `<CopilotKit>` provider previously hardcoded
`useSingleEndpoint={true}` when wrapping the V2 provider, preventing
users from opting into REST transport mode. The prop is now passed
through from user config, defaulting to `true` to preserve backward
compatibility.

- Updated dependencies
\[[`bbdf67d`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bbdf67d)]
-
[@&#8203;copilotkitnext/react](https://redirect.github.com/copilotkitnext/react)@&#8203;1.52.1
-
[@&#8203;copilotkit/runtime-client-gql](https://redirect.github.com/copilotkit/runtime-client-gql)@&#8203;1.52.1
-
[@&#8203;copilotkit/shared](https://redirect.github.com/copilotkit/shared)@&#8203;1.52.1
-
[@&#8203;copilotkitnext/core](https://redirect.github.com/copilotkitnext/core)@&#8203;1.52.1

#####
[@&#8203;copilotkit/react-ui](https://redirect.github.com/copilotkit/react-ui)

##### 1.52.1

##### Patch Changes

-
[`bbdf67d`](https://redirect.github.com/CopilotKit/CopilotKit/commit/bbdf67d):
fix(css): address imcompat with CJS
- Updated dependencies
\[[`b555ac4`](https://redirect.github.com/CopilotKit/CopilotKit/commit/b555ac4)]
  - [@&#8203;co

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/CopilotKit/CopilotKit).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNTkuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJleGFtcGxlcyJdfQ==-->
 2026-05-15 17:08:38 +02:00
Alem Tuzlak e7f8f82b94 fix(showcase/google-adk/voice): pin transcription baseURL to real OpenAI (#4840) 
## Summary

Voice mic recording on Railway prod was returning `502 Invalid file
format. Supported formats: ['flac', 'm4a', 'mp3', 'mp4', 'mpeg', 'mpga',
'oga', 'ogg', 'wav', 'webm']` even though the browser was sending valid
WebM Opus bytes (~40 KB `audio/webm;codecs=opus` recordings).

**Root cause:** `new OpenAI({ apiKey })` falls through to
`OPENAI_BASE_URL`, which in showcase environments is set to
`http://aimock:4010/v1`. Aimock's `--proxy-only` forwards unmatched
requests to real OpenAI but re-encodes the multipart body in the
process, corrupting the audio bytes by the time Whisper sees them.
Whisper inspects the actual bytes (not just the MIME), so it rejects the
mangled payload with the format error above.

**Fix:** Mirror `langgraph-python`'s voice route — pin the transcription
client's `baseURL` to real OpenAI (or `OPENAI_TRANSCRIPTION_BASE_URL`
when explicitly set) so the audio bypasses aimock entirely.
Non-transcription paths (chat completions etc.) keep going through
aimock for deterministic fixtures.

```diff
 constructor() {
   super();
   const apiKey = process.env.OPENAI_API_KEY;
+  const baseURL =
+    process.env.OPENAI_TRANSCRIPTION_BASE_URL ?? "https://api.openai.com/v1";
   this.delegate = apiKey
-    ? new TranscriptionServiceOpenAI({ openai: new OpenAI({ apiKey }) })
+    ? new TranscriptionServiceOpenAI({
+        openai: new OpenAI({ apiKey, baseURL }),
+      })
     : null;
 }
```

## Test plan

- [x] Local: mic recording at http://localhost:3103/demos/voice now
transcribes the user's actual words via real Whisper instead of failing
502. Confirmed end-to-end by user.
- [ ] Manual Railway prod test after merge.

## Notes

- This was the last fix from PR #4838 that didn't make it into the
squash merge (`dd43576035` only included the prior commit).
- The `packages/runtime` `audio/webm` stamping shipped in PR #4838 is
still useful defensive hardening for empty-type Blobs at the server-side
handler; with this route-level change those bytes never reach aimock
anyway.
 2026-05-15 17:02:47 +02:00
Alem Tuzlak bee96f988d fix(showcase/google-adk/voice): pin transcription baseURL to real OpenAI 
The mic recording path on Railway prod was returning `502 Invalid file
format. Supported formats: ['flac', 'm4a', 'mp3', 'mp4', 'mpeg', 'mpga',
'oga', 'ogg', 'wav', 'webm']` even though the browser was sending valid
WebM Opus bytes (audio/webm;codecs=opus, ~40KB recordings).

Root cause: `new OpenAI({ apiKey })` falls through to `OPENAI_BASE_URL`,
which in showcase environments points at aimock (`http://aimock:4010/v1`).
Aimock's proxy mode forwards unmatched requests to real OpenAI but
re-encodes the multipart body, corrupting the audio bytes en route to
Whisper. Whisper inspects the bytes (not just the MIME), so it rejects
the corrupted payload with the format error.

LangGraph-Python's voice route already documents and works around this:
it pins the transcription client's `baseURL` to real OpenAI (or
`OPENAI_TRANSCRIPTION_BASE_URL` when set) so the audio bypasses aimock
entirely. Mirroring that here verbatim. The non-transcription paths
(chat completions etc.) still go through aimock for deterministic
fixtures; only `/v1/audio/transcriptions` skips it.

Verified locally: mic recording in the browser now transcribes the
user's actual words via real Whisper instead of failing 502.

The audio/webm stamping I added to `packages/runtime` in the previous
commit is still useful defensive hardening for empty-type Blobs that
arrive at the server-side handler — keep it. With this route-level
change those bytes never reach aimock anyway.
 2026-05-15 16:52:41 +02:00
Alem Tuzlak dd43576035 fix(showcase, runtime): subagents fixtures, voice mic format, fine-grained shared-state gating (#4838) 
## Summary

Three follow-ups on top of PR #4837. (My second commit on that branch —
the one that removed the bare
`plan`/`steps`/`mars`/`dashboard`/`report`/`alice`/`Alice` substring
catch-alls — didn't survive the squash merge, so the catch-alls are back
on main and still hijacking demos.)

**Fixes:**

- **packages/runtime: stamp `audio/webm` on empty-type Blobs in the
transcription handler.** Browser MediaRecorder writes audio as webm/opus
but the Blob's `type` is often empty by the time it hits the server.
OpenAI Whisper then rejects with `502 Invalid file format`.
Reconstructing the File with explicit `audio/webm` + `.webm` filename
fallback makes Whisper accept the bytes. Monorepo-wide — applies to
every integration using `/api/copilotkit-voice/transcribe`.

- **showcase/aimock/feature-parity.json: port 12 subagents fixtures from
`d5-all.json`** so the three pills (cold-exposure blog, LLM tool-calling
explanation, reusable-rockets summary) get deterministic content in
production. `d5-all.json` already has the full research → writing →
critique chain with substantive content; feature-parity only had the
single LP remote-work pill. Verbatim port — no fabricated text. Net
result: no more `[sub-agent error] the writing agent…` on the demo.

- **showcase/aimock both files: replace the `tone: casual`
shared-state-rw gate with a true all-defaults `match.systemMessage`
array.** The previous single-substring gate only caught tone changes —
name / language / interests changes still hit the canned fixture.
Replaced with a two-element array gate (aimock supports all-present
substring matching, verified in `/app/dist/router.js`):
- `preferences:\n- Preferred tone: casual\n` — breaks if name is set
(Name line inserts between signature and tone) or tone changes.
- `- Preferred language: English\nTailor every response` — breaks if
language changes or interests are added (Interests line inserts between
language and Tailor).
With `--provider-gemini` already wired in local + Railway prod, any
state change now proxies to real Gemini and returns a personalised
reply.

- **feature-parity.json: re-remove the bare `plan` / `steps` / `mars` /
`dashboard` / `report` / `alice` / `Alice` substring catch-alls** (lost
in the #4837 squash). Replace the alice pair with a single scoped `Hi,
my name is Alice` fixture for the showcase-assistant intro flow.

## Test plan

- [x] `bin/showcase test google-adk --d5` → 38/38 green, 165s.
- [x] Paired curl on shared-state-rw:
- Default state → canned fixture (`"Hi — I'm your shared-state
co-pilot…"`)
  - `name=alem` → real Gemini (`"Hi there! …"`)
- `interests=[Cooking, Travel]` weekend pill → real Gemini (`"Hey there!
Since you're into cooking and travel, how about a weekend plan that
combines both?"`)
- [x] Validate JSON on both fixture files.
- [ ] **Manual Railway prod test** after merge — please drive
shared-state-rw with state changes, subagents pills, voice mic, and
hitl-in-app downgrade-#12346 to confirm the prod-only manifestations are
gone.

## Notes

- Production aimock fetches `feature-parity.json` from GitHub raw at
boot (per `RAILWAY.md`), so once this merges Railway picks up the new
fixtures without rebuilding the image.
- The `packages/runtime` handle-transcribe change needs the runtime
package to be rebuilt + published for production to receive the fix —
that's a separate deploy step depending on how the integrations consume
`@copilotkit/runtime`.
 2026-05-15 16:09:42 +02:00
Alem Tuzlak 6d49ecbb7b fix(showcase, runtime): subagents fixtures, voice mic format, fine-grained shared-state gating 
Three follow-ups on top of PR #4837 that I had on the same branch but
didn't make it into the squash merge.

1. **packages/runtime: stamp `audio/webm` on empty-type Blobs in the
   transcription handler.** Browser MediaRecorder writes the audio as
   webm/opus, but the Blob's `type` field is often empty by the time it
   hits the server. `isValidAudioType` lets empty / octet-stream through
   for compatibility, but OpenAI Whisper then rejects the upload with
   `502 Invalid file format. Supported formats: ['flac', 'm4a', 'mp3',
   'mp4', 'mpeg', 'mpga', 'oga', 'ogg', 'wav', 'webm']` because it
   can't pick a decoder. Reconstructing the File with an explicit
   `audio/webm` type (and a `.webm` filename fallback) makes Whisper
   accept the bytes that were already valid. Monorepo-wide — applies to
   every integration using `/api/copilotkit-voice/transcribe`.

2. **showcase/aimock/feature-parity.json: port 12 subagents fixtures
   from d5-all.json** so the three pills (cold-exposure blog, LLM
   tool-calling explanation, reusable-rockets summary) work in
   production. d5-all.json already has the full research → writing →
   critique chain with substantive content; feature-parity only had the
   single LP remote-work pill. Production aimock loads both files but
   any case where feature-parity wins first-match needs the same
   content. Verbatim port — no fabricated text. Net result: no more
   `[sub-agent error] the writing agent...` on the demo's pills.

3. **showcase/aimock both files: scope shared-state-read-write Greet +
   Plan-a-weekend fixtures with a true all-defaults systemMessage
   gate.** The PR #4837 gate (`systemMessage: "tone: casual"`) only
   caught tone changes — name / language / interests changes still hit
   the canned fixture. Replaced with a two-element array gate (aimock
   supports all-present substring matching, verified in
   `/app/dist/router.js`):
     - `preferences:\n- Preferred tone: casual\n` — breaks if name is
       set (Name line inserts between signature and tone) or tone changes.
     - `- Preferred language: English\nTailor every response` — breaks
       if language changes or interests are added (Interests line
       inserts between language and Tailor).
   With `--provider-gemini` already wired in both local docker-compose
   and Railway prod, any state change now proxies to real Gemini and
   returns a personalised reply.

4. **showcase/aimock/feature-parity.json: re-remove bare 'plan' /
   'steps' / 'mars' / 'dashboard' / 'report' substring catch-alls + the
   bare 'alice' / 'Alice' fixtures.** These were removed in commit
   `ddc2e179` on the PR #4837 branch but didn't survive the squash
   merge, so they're back in main and still hijacking hitl-in-app
   downgrade-#12346 ('plan'), shared-state-rw weekend pill ('plan'),
   subagents 'rockets' pills, hitl-in-chat Schedule-1:1 with Alice
   ('alice'). Replace the alice pair with a single scoped
   `Hi, my name is Alice` fixture for the showcase-assistant
   introduction flow.

Local verification:
- `bin/showcase test google-adk --d5` → 38/38 green, 165s.
- Paired curl on shared-state-read-write:
  - Default state → canned fixture ("Hi — I'm your shared-state co-pilot…")
  - `name=alem` → real Gemini ("Hi there! …")
  - `interests=[Cooking, Travel]` weekend pill → real Gemini ("Hey
    there! Since you're into cooking and travel, how about a weekend
    plan that combines both?")

Production deploys this PR will pick up the aimock fixture changes
(prod loads feature-parity.json from GitHub raw at boot — no image
rebuild needed for that file) plus the runtime change once the
packages/runtime build is republished.
 2026-05-15 15:57:31 +02:00
Alem Tuzlak 7eb0624144 fix(showcase/google-adk): beautiful-chat icon, calculator, hitl, voice mic, state-context gating (#4837) 
## Summary

Production-fix bundle for the beautiful-chat demo plus three other
google-adk demos reported broken on Railway. All confirmed locally; full
`bin/showcase test google-adk --d5` stays **38/38 green** (137s).

**Fixes**
- **Missing CopilotKit logo** on beautiful-chat — `<img
src="/copilotkit-logo-mark.svg">` returned 404. Logo SVGs were never
shipped in the integration's `public/`; copied them over from
langgraph-python.
- **Multimodal sample.{png,pdf}** were Git LFS pointers in prod (Railway
build runs without `git lfs pull`). Added integration-scoped
`.gitattributes` to exempt these two paths from LFS, re-staged the files
as real binaries (10KB / 2.5KB).
- **Sales Dashboard pill** returned generic "Step 1… Step 2…" narration.
Root cause: the `render_a2ui` catch-all fallback I added to
`aimock/d5-all.json` in #4836 fired before `feature-parity.json`'s
specific sales-dashboard fixture (load order is d5-all → smoke →
feature-parity). Removed the catch-all from both `d5-all.json` and the
per-demo source so the specific fixture wins. Verified the agent now
emits the full Column → DashboardCards → PieChart + BarChart payload
end-to-end.
- **Calculator App pill** returned text only with a white iframe —
beautiful-chat's `_INSTRUCTION` never mentioned `generateSandboxedUi`,
so Gemini saw the tool via `AGUIToolset` but had no nudge to use it.
Added a one-line "Interactive / sandboxed widgets" entry. Verified
Gemini now emits `TOOL_CALL_START toolCallName=generateSandboxedUi`.
- **hitl-in-app refund #12345 / escalate #12347** broke on the second
click because the 2nd-turn fixtures keyed on `sequenceIndex` 0/1 (a
global thread-position counter that drifts when other pills land tool
messages in the same thread). Converted both to `toolCallId +
hasToolResult: true` and dropped the reject branch — Gemini reasons
correctly from the tool's `approved: false` return without a fixture
override. Same pattern that fixed tool-rendering-reasoning-chain
previously.
- **hitl-in-app downgrade #12346** produced an unrelated "Research /
Outline / Draft" plan because the prompt contains "plan" and
`feature-parity.json` had a generic catch-all on `userMessage: "plan"`.
Added a specific downgrade fixture in `d5-all.json` (loaded before
feature-parity.json).
- **hitl-in-chat "Schedule a 1:1 with Alice"** returned the wrong "Nice
to meet you, Alice in Tokyo" response when clicked after another pill.
The 2nd-turn fixture only matched on `toolCallId` (no `hasToolResult`),
so the bare "alice" / "Alice" greeting fixtures further down won. Added
`hasToolResult: true` so it scopes correctly regardless of thread state.
- **Voice manual recordings** always returned "What is the weather in
Tokyo?" regardless of audio content because aimock had a catch-all
transcription fixture (`match: { endpoint: "transcription" }`) that
returned the canned Tokyo string for any audio input. D5 voice probe
uses the sample-audio button that bypasses `/transcribe` (injects text
directly), so removing the transcription fixture drops aimock into
`--proxy-only` fall-through to real OpenAI Whisper for mic recordings
while D5 stays green.
- **readonly-state-agent-context** and **shared-state-read-write**
fixtures returned hardcoded "Atai" / generic-preferences responses even
when the user changed the state values in the UI inputs. Gated the
affected fixtures on `match.systemMessage` substring (aimock supports
this matcher) matching the canonical default state values: `"Atai"` for
readonly-state-context (the default name forwarded via
`useAgentContext`), `"tone: casual"` for shared-state-read-write (the
default tone in `INITIAL_PREFERENCES`). When the user changes state, the
agent's before-model callback rebuilds the system prompt with the new
values, the fixture's `systemMessage` substring no longer matches, and
aimock `--proxy-only` falls through to the real model so the response
reflects the actual state. Confirmed with paired curl tests (default
name = fixture match; `alem` name = real-LLM response that uses the live
context).

## Test plan

- [x] `bin/showcase test google-adk --d5` → 38/38 green, 137s
- [x] Calculator pill against real Gemini → `TOOL_CALL_START
toolCallName=generateSandboxedUi` emitted
- [x] Sales Dashboard pill via aimock → full DashboardCards + PieChart +
BarChart payload in TOOL_CALL_RESULT
- [x] readonly-state-context with default name (Atai) → fixture match;
with name="alem" → real LLM responds using actual context
- [x] Logo SVG → `HTTP 200 OK` from
`http://localhost:3103/copilotkit-logo-mark.svg`
- [ ] **Manual verification on Railway prod** after merge — please click
through Beautiful Chat (icon, sales dashboard, calculator) and HITL
demos to confirm the production-only manifestations are gone.

## Known deferred

- **Subagents "Summarize a topic"** pill — all 3 pills exist in
`aimock/d5-all.json` locally and work; the prod-only failure
(`[sub-agent error] the writing agent…`) is likely caused by Railway's
aimock loading a different fixture set. Easy to address once we confirm
prod fixture-loading config; left out of this PR to keep scope tight.
- **shared-state-read-write per-default-value gating** — current
`systemMessage: "tone: casual"` gate catches tone changes but not name
changes (the agent's prefs block omits empty default names, so there's
no substring to gate on for "name changed from default"). aimock doesn't
support negative substring matching today; defer to a follow-up that
either adds that or rebinds the default state to a non-empty sentinel.
 2026-05-15 14:38:34 +02:00
Alem Tuzlak 4a27087094 test(showcase/google-adk): default fake LlmResponse to finish_reason=STOP 
The Python unit tests for stop_on_terminal_text /
simple_after_model_modifier built fake LlmResponse objects without a
finish_reason field. That worked before the thinking-mode fix in #4826,
which added a finish_reason="STOP" gate so the callback no longer
terminates on text-only chunks that arrive non-partial with
finish_reason=None (Gemini thinking-mode emits a text-only chunk first,
then a separate function-call chunk — terminating on the first would
skip the second).

Fix: default the fake response's finish_reason to "STOP" (the real
terminal-response shape) and also stub turn_complete=None so the
matcher path the callback walks lines up with what production sees.
Local pytest on Python 3.10 → 23/23 green.
 2026-05-15 14:31:10 +02:00
Alem Tuzlak 9e54ba6706 fix(showcase/google-adk): beautiful-chat icon, calculator, hitl, voice mic, state-context gating 
Production-fix bundle for beautiful-chat + 3 other google-adk demos. All
issues either reported on Railway prod or unmasked by the catch-all
render_a2ui fallback I added in #4836. Local D5 stays 38/38 green.

- Missing copilotkit logo: `<img src="/copilotkit-logo-mark.svg">` returned
  404 because the SVG never shipped in the integration's public/. Copy
  copilotkit-logo-mark.svg + copilotkit-logo.svg over from langgraph-python.

- Multimodal sample.png / sample.pdf were LFS pointers in prod (Railway
  build runs without `git lfs pull`), so the magic-byte check rejected them
  on first click. Add an integration-scoped .gitattributes that exempts
  these two paths from LFS (mirrors what every working sibling integration
  already does) and re-stage the files as real binaries (10KB / 2.5KB).

- Sales Dashboard pill returned a generic "Step 1... Step 2..." narration
  instead of rendering the A2UI surface. Root cause: the render_a2ui
  catch-all fallback I added to aimock/d5-all.json in #4836 fired before
  feature-parity.json's specific sales-dashboard fixture (load order
  d5-all → smoke → feature-parity). Removing the catch-all from both
  d5-all.json and the per-demo source so the specific fixture wins.

- Calculator App pill returned text only with a white iframe because
  beautiful-chat's agent instruction never mentioned generateSandboxedUi —
  Gemini saw the tool listed via AGUIToolset but had no nudge to use it.
  Added a one-line "Interactive / sandboxed widgets" entry to the
  instruction; verified Gemini now emits the tool call.

- hitl-in-app refund (#12345) and escalate (#12347) pills broke on the
  second click because the 2nd-turn fixtures keyed on `sequenceIndex` 0/1
  (a global thread-position counter that drifts when other pills land
  tool messages in the same thread). Convert both to `toolCallId +
  hasToolResult: true` and drop the reject branch — Gemini reasons
  correctly from the tool's `approved: false` return without a fixture
  override. Same pattern that fixed tool-rendering-reasoning-chain
  previously.

- hitl-in-app downgrade (#12346) pill produced an unrelated
  "Research / Outline / Draft / Review / Finalize" plan because the
  prompt contains the substring "plan" and feature-parity.json has a
  generic catch-all match on `userMessage: "plan"`. Add a specific
  downgrade fixture in d5-all.json (loaded before feature-parity.json)
  with hasToolResult: false / true branches.

- hitl-in-chat "Schedule a 1:1 with Alice" returned the wrong
  "Nice to meet you, Alice in Tokyo" response when clicked AFTER another
  pill in the same thread. The 2nd-turn fixture only matched on
  `toolCallId` (no hasToolResult), so the bare "alice" / "Alice" greeting
  fixtures further down won. Add `hasToolResult: true` to the 2nd-turn
  fixture so it scopes correctly regardless of thread state.

- Voice manual recordings always returned "What is the weather in Tokyo?"
  regardless of audio content. aimock had a catch-all transcription fixture
  (`match: { endpoint: "transcription" }`) that returned the canned
  Tokyo string for any audio input. The D5 voice probe uses the sample
  audio button which bypasses /transcribe entirely (it injects text
  directly into the composer), so removing the transcription fixture
  drops aimock into --proxy-only fall-through to real OpenAI Whisper for
  mic recordings while D5 stays green. Verified.

- readonly-state-agent-context and shared-state-read-write fixtures
  returned hardcoded "Atai" / generic preferences responses even when
  the user changed the state values in the UI inputs. Gate the
  Who-am-I / Suggest-next-steps / Greet / Plan-a-weekend fixtures on
  systemMessage substring matching the canonical default state values
  ("Atai" name for readonly-state-context; "tone: casual" for
  shared-state-read-write). When the user changes state, the agent's
  before-model callback rebuilds the system prompt with the new values,
  the fixture's systemMessage substring no longer matches, and aimock
  --proxy-only falls through to the real model so the response reflects
  the actual state. Confirmed with paired curl tests (default state =
  fixture match; alem name = real-LLM response).

Local verification: bin/showcase test google-adk --d5 finishes 38/38
green (137s). Calculator pill confirmed via direct ADK invocation
against real Gemini (GOOGLE_GEMINI_BASE_URL=) emits TOOL_CALL_START
toolCallName=generateSandboxedUi. Sales-dashboard pill confirmed end-to-end
returning the full Column / DashboardCards / PieChart / BarChart payload.
readonly-state-context confirmed with name=Atai matching fixture vs
name=alem falling through to real-LLM response that uses the actual
context.
 2026-05-15 14:24:16 +02:00
Alem Tuzlak b53764a865 fix(showcase/google-adk): bring final 5 demos to D5 green (#4836) 
## Summary

- Final five google-adk demos that were red after PR #4826 are now D5
green: **readonly-state-context, multimodal, gen-ui-declarative,
shared-state-streaming, tool-rendering-reasoning-chain** — google-adk is
now 38/38 under aimock locally.
- Each demo had a distinct root cause; details in the commit body
(covers agent-ID kebab/underscore mismatch, `google-genai 1.75`
`HttpOptions` field rename, A2UI fixture shape regression,
`write_document` param parity with LGP, and the thinking-mode
`stop_on_terminal_text` premature-termination bug).
- The `stop_on_terminal_text` finish-reason guard in `shared_chat.py`
applies to every ADK agent using the shared callback, so chain-aware
behavior is uniform across the package.
- D5 fixtures for `gen-ui-declarative` now include both `render_a2ui`
(Google-ADK) and `_design_a2ui_surface` (LangGraph-Python) variants so
the same fixture serves both integrations.

## Test plan

- [x] `bin/showcase test google-adk --d5 --live` finishes green for all
38 cells (~140s) on a clean recreate; dashboard reflects results from
PocketBase.
- [x] Single-cell verification for each of the 5 fixed demos via
`bin/showcase test google-adk:<slug> --d5`.
- [x] Manual real-Gemini click-through (`GOOGLE_GEMINI_BASE_URL=` empty
+ recreate) of the five fixed demos — all behave correctly end-to-end
against real Gemini.
- [ ] CI runs the full monorepo test suite (gates publish + the rest of
the demos in the matrix).

## Notes

- The bundled `public/demo-files/sample.png` / `sample.pdf` for the
multimodal demo are still Git-LFS-tracked. Fresh checkouts must `git lfs
pull` before `bin/showcase build google-adk` so the image bakes in the
real binaries instead of the LFS pointer stubs (the magic-byte check in
`sample-attachment-buttons.tsx` already fails loudly on pointer content
— added that as a clear error path some time back).
 2026-05-15 13:06:48 +02:00
github-actions[bot] df4b122351 style: auto-fix formatting 2026-05-15 10:56:14 +00:00
Alem Tuzlak 110ca6f4b2 fix(showcase/google-adk): bring final 5 demos to D5 green 
Five distinct root causes were keeping google-adk from full D5 parity
with langgraph-python. Fixing them takes the integration to 38/38 D5
green under aimock locally (verified end-to-end with --live writing
to PocketBase).

- readonly-state-context: page.tsx asked for agent slug
  readonly_state_agent_context (underscore) but the registry mounts
  it kebab-case as readonly-state-agent-context. useAgent threw,
  the demo layout never mounted, and the ctx-name input never rendered.
  Align with the registry (and with langgraph-python).

- multimodal: the secondary failure was a backend Pydantic
  ValidationError on HttpOptions.api_endpoint. google-genai 1.75
  renamed the field to base_url; all three direct genai client
  constructors (main.py, beautiful_chat_agent.py, subagents_agent.py)
  needed the rename so the secondary A2UI / sub-agent LLM calls stop
  crashing. (The pre-existing LFS-pointer issue on the bundled
  sample.png/pdf was a worktree hydration problem, not a tracked
  code change — git lfs pull handles it.)

- gen-ui-declarative (two bugs stacked):
  1. The same api_endpoint -> base_url rename above. The secondary
     generate_a2ui planner LLM was failing every request.
  2. The D5 fixture emitted components in {id, type, props: {...}}
     shape, but sanitize_a2ui_components requires component, so
     every entry was dropped and the renderer received an empty
     surface. Rewrite both the per-demo fixture and the d5-all.json
     aggregate to the flat {id, component, ...props} shape that
     langgraph-python's _design_a2ui_surface fixture already uses,
     wrapping multi-child layouts in a basic-catalog Column (the
     custom Card schema has a single child slot). Add
     _design_a2ui_surface variants so LGP gets per-pill payloads too.

- shared-state-streaming: ADK's write_document took content and
  the PredictStateMapping read tool_argument="content", but the
  shared D5 fixture (and the LGP function signature) names the
  argument document. Rename both sides so the fixture's tool_call
  args plumb into the function and into PredictStateMapping's
  state-key emission. STATE_DELTA now propagates and DocumentView
  streams live.

- tool-rendering-reasoning-chain: in thinking mode
  (include_thoughts=True), Gemini emits a turn as two separate
  non-partial chunks — a text-only chunk with finish_reason=None
  and a function-call-only chunk with finish_reason=FUNCTION_CALL.
  stop_on_terminal_text fired on the first (text-only) chunk and
  set end_invocation=True before the function-call chunk arrived,
  which broke AAPL->MSFT chaining. Gate termination on
  finish_reason=STOP; FUNCTION_CALL and None both mean "more
  chunks inbound — defer". Applies to every agent that uses the
  shared callback, so chain-aware behavior is uniform.

Local verification: bin/showcase test google-adk --d5 --live
finishes green for all 38 cells (~140s), dashboard reflects the
results from PocketBase. Manual real-Gemini click-through of the
five fixed demos also passes end-to-end via GOOGLE_GEMINI_BASE_URL=
(empty) recreate.
 2026-05-15 12:53:26 +02:00