## Summary
- Headers in the announcement banner now have proper hierarchy (h1/h2/h3
distinct sizes); body bumped to 13px / 1.55 line-height for readability.
- Code blocks get dark theme styling with horizontal scroll, a trailing
80px spacer so the end of long commands is fully readable, and a
brand-lavender copy button (with "Copied" confirmation in `#eee6fe` /
`#6430ab`).
- Announcement banner moved out of the non-scrollable drag-handle header
into the `#cpk-main-scroll` container so expanding it no longer squeezes
the resize handle and main content off-screen (folds in @claude's fix
from `tyler/funny-shtern-1a95ef`).
The prior commit accidentally re-included a local-only flip of
ANNOUNCEMENT_URL to the draft endpoint while staging the unrelated
copy-button timeout fix. Restore the production URL.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The previous copyResetTimeout field was a single instance-level number,
shared across every code block in a multi-block announcement. Clicking
Copy on block A then block B cancelled block A's reset timer, leaving
block A stuck on "Copied" forever.
Switch to a WeakMap<HTMLButtonElement, number> so each button manages
its own pending reset and is naturally cleaned up when the announcement
re-renders. Also keep aria-label in sync with the visible text label so
screen-reader users hear "Code copied" while sighted users see "Copied".
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CR-loop fixes from a 7-agent unbiased review on the announcement banner
work:
- Replace deprecated unescape/escape with TextEncoder/TextDecoder in
encodeBase64/decodeBase64, dropping the half-decoded fallback path.
- Drop unsafe `as HTMLElement` and `as HTMLButtonElement` casts in
handleAnnouncementContentClick; the .announcement-code__copy selector
does not enforce HTMLButtonElement, so use instanceof guards.
- Coalesce overlapping copy-button resets via a class field timeout id
and a constant "Copy" label; previously a rapid double-click captured
"Copied" as the original label and pinned the button text.
- Pass async: false to marked.parse for a type-honest string return.
- Fold escapeHtmlAttr into the module-level escapeHtml helper.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the duplicate escapeHtmlText method with the existing module-level
escapeHtml helper that has identical behavior.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Differentiate h1/h2/h3 sizes and bump body type for readability
- Add code-block styling with horizontal scroll, trailing spacer, and a
copy button (brand lavender on success)
- Move announcement banner from the non-scrollable header into the main
scroll container so an expanded banner no longer pushes the resize
handle and content off-screen
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
⚠️ **Docs sync — MANUAL REVIEW REQUIRED**
This PR was auto-opened because the docs-sync script detected
showcase-local modifications overlapping with upstream changes.
The script attempted a best-effort 3-way merge:
- Where `git merge-file` produced a clean merge, the merged content was
written.
- Where `git merge-file` produced conflict markers, **upstream content
was written as-is** and showcase-local modifications were overridden.
**Manual review required.**
### Review items
```
Files where 3-way merge FAILED — upstream content written as-is, local modifications overridden. Manual review REQUIRED before merging this PR:
- docs/content/docs/(root)/inspector.mdx
- docs/content/docs/integrations/agent-spec/quickstart.mdx
- docs/content/docs/integrations/built-in-agent/server-tools.mdx
- docs/content/docs/integrations/langgraph/deep-agents.mdx
Files auto-merged via 3-way merge (clean, no conflict markers — still worth a glance):
- docs/content/docs/integrations/aws-strands/quickstart.mdx
- docs/content/docs/integrations/langgraph/quickstart.mdx
```
### Source
- Upstream ref:
[`330b4eb06`](https://github.com/CopilotKit/CopilotKit/commit/330b4eb06)
- Workflow run:
https://github.com/CopilotKit/CopilotKit/actions/runs/25185454071
**Review before merging.** Auto-merge is intentionally disabled
for `needs-review` PRs — confirm the upstream-wins sections
preserve any intentional showcase-local divergence you want to
keep, then merge manually.
The auto-sync removed the lastRunAt entry from the useThreads API reference,
but the field is still present on the Thread type and drives sort behavior in
packages/core/src/threads.ts. Restoring the doc keeps the API reference
complete.
<!--
Thank you for sending the PR! We appreciate you spending the time to
work on these changes.
Help us understand your motivation by explaining why you decided to make
this change.
**Please PLEASE reach out to us first before starting any significant
work on new or existing features.**
By the time you've gotten here, you're looking at creating a pull
request so hopefully we're not too late.
We love community contributions! That said, we want to make sure we're
all on the same page before you start.
Investing a lot of time and effort just to find out it doesn't align
with the upstream project feels awful, and we don't want that to happen.
It also helps to make sure the work you're planning isn't already in
progress.
As described in our contributing guide, please file an issue first:
https://github.com/ag-ui-protocol/ag-ui/issues
Or, reach out to us on Discord: https://discord.com/invite/6dffbvGU3D
You can learn more about contributing to copilotkit here:
https://github.com/copilotkit/copilotkit/blob/master/CONTRIBUTING.md
Happy contributing!
-->
## What does this PR do?
(Describe the changes introduced in this PR)
- Logo component: "Logo" → "CopilotKit" (both light/dark variants)
- Examples carousel: empty alt → example.title
- Scarf tracking pixel: add aria-hidden so SR/audit tools skip it
## Related PRs and Issues
- (Direct link to related PR or issue, if relevant)
## Checklist
- [ ] I have read the [Contribution
Guide](https://github.com/copilotkit/copilotkit/blob/master/CONTRIBUTING.md)
- [ ] If the PR changes or adds functionality, I have updated the
relevant documentation
- [ ] "Allow edits by maintainers" is checked (lets us help iterate on
your PR directly — faster turnaround for everyone)
## Summary
- Adds a reusable `OpsPlatformCTA` component with four visual variants
(card, info, inline, tile), PostHog `cta_clicked` instrumentation, and
UTM-tagged links to the dashboard
- Places sign-up CTAs across topical docs pages, integration overview
pages, manual-setup quickstarts, premium pages, and the shared
prebuilt-components snippet (covers all per-integration prebuilt pages)
- Repoints the navbar "Free Developer Access" link to the dashboard with
matching click tracking
- Adds an `afterFeatures` slot to `FrameworkOverview` so MDX can inject
content below the supported-features section
- Rewrites the CLI step on the eight framework quickstarts that have a
scaffold (ADK, Agno, AWS Strands, LangGraph, LlamaIndex, Mastra,
Microsoft Agent Framework, Pydantic AI) to use the interactive flow and
describe the prompts (project name, platform Yes/No with sign-up link,
framework picker)
Coverage: ~13% of docs pages, focused on the highest-traffic surfaces
and topical landing pages.
## Test plan
- [ ] `/`, `/quickstart`, `/prebuilt-components`, `/shared-state`,
`/inspector` show their CTAs in the expected position
- [ ] Integration overview pages (`/built-in-agent`, `/langgraph`,
`/adk`, `/aws-strands`, `/microsoft-agent-framework`) render the CTA
above the fold
- [ ] Each of the 13 per-integration `/{framework}/prebuilt-components`
pages renders the inline CTA via the shared snippet
- [ ] Each of the 8 framework quickstarts shows the new CLI walkthrough
(Yes-first prompt, dashboard sign-up link, correct framework label)
- [ ] Navbar still shows "Talk to Our Engineers" alongside the repointed
"Free Developer Access" link
- [ ] DevTools Network: clicking any CTA sends one `cta_clicked` PostHog
event with `{surface, variant, target, page_path}`
- [ ] Destination URL on every CTA ends with
`?utm_source=docs&utm_medium=cta&utm_campaign=intelligence&utm_content=<surface>`
Round-1 review on the indicator branch surfaced perf and defensive
hardening items. Tests: react-core 1158 — all green.
- CopilotChatMessageView auto-mount now gates on
`message.role === "assistant"` in addition to
`copilotkit.intelligence !== undefined`. Eliminates wasted
`useAgent` subscriptions, 200 ms polling intervals, and four
`useEffect`s on every user / activity / reasoning slot — the
indicator's own role gate would short-circuit anyway, but only
after a subscribe + interval-set + cleanup cycle on every render.
- IntelligenceIndicator's `toolCalls` access is now defensive:
`Array.isArray(...)` guard and `tc?.function?.name` chain. A
malformed agent payload no longer crashes the chat tree at
`.some(...)`.
Comment fixes:
- CopilotChatMessageView: stale `CopilotKitProvider.intelligenceIndicator.e2e.test.tsx`
reference updated to the actual path
`intelligence-indicator/__tests__/IntelligenceIndicator.e2e.test.tsx`.
- IntelligenceIndicator `ISRUNNING_POLL_MS` JSDoc rewritten — the
prior version claimed `addMessage` iterates subscribers live during
streaming. In fact AG-UI's `runAgent` snapshots subscribers and
threads them through the entire pipeline (including
`processApplyEvents` for streaming events), so a late-mounted
subscriber misses both `onMessagesChanged` AND `onRunFinalized`
from the run's pipeline. The poll fallback is the only thing that
catches the falling edge.
- `globals.css` pill-styles port comment listed `#BEC2FF` as part of
the palette but that hex doesn't appear anywhere in the rules.
Updated to the actual swatches: text #5B21B6, icon #7C3AED, border
#9599E0, gradient #EEE6FE, shadow #5E64AD.
Renames the docs CTA tracking event from `cta_clicked` to
`try_for_free_clicked` to match the per-event custom event names used
on the marketing website, and uses a single `location` string property
in place of the previous `surface` / `variant` / `target` / `page_path`
shape. Surface identifiers are normalized to underscored snake_case to
match the location values already used on the website.
Same change applies to the docs navbar handler that fires when a
visitor clicks the Free Developer Access link.
Adds an official "Using CopilotKit Intelligence" pill, ported from the
visuals of CopilotKit/Intelligence#155. Mounts automatically — the
caller never adds the renderer themselves.
Behavior:
- `CopilotChatMessageView` mounts an `<IntelligenceIndicator>` for
every message slot whenever `copilotkit.intelligence !== undefined`.
When intelligence is not configured, no indicator instance is
mounted at all (no perf cost).
- `IntelligenceIndicator` self-gates so only the canonical message
renders a pill — last message of the latest in-flight run, with at
least one tool call whose name matches a pattern from
`DEFAULT_TOOL_PATTERNS` (currently `[/^bash$/]`, the Intelligence
MCP server's canonical tool).
- The "exactly one pill at any moment" guarantee is structural: only
one message ever satisfies (last in run) + (run is latest) +
(matching tool call), so each renderer invocation decides
independently and the result is one pill in the DOM.
Phase machine (per-instance, all timers local):
- `spinner` while `agent.isRunning`
- → `check` after `agent.isRunning` falls (debounced 500 ms to
absorb step-boundary `RUN_FINISHED → RUN_STARTED` blips inside
one user turn)
- → `fading` after `CHECK_HOLD_MS` (800 ms)
- → `hidden` after `FADE_OUT_ANIMATION_MS` (480 ms)
A 200 ms `agent.isRunning` poll closes the AG-UI snapshot-subscriber
gap (subscribers added INSIDE a run never see that run's
`onRunFinalized`).
Public surface (via `@copilotkit/react-core/v2`):
- `IntelligenceIndicator` — the pill component, exposed for tests
and inspection. Most callers don't import it directly; the
auto-mount in `CopilotChatMessageView` does the work.
There is no factory and no provider — auto-registration eliminates
the prior `createIntelligenceIndicatorRenderer` factory and any
`IntelligenceIndicatorProvider`/coordination store.
Tests (all live next to the component):
- 1 walkthrough (Run A → Run B with multiple messages, asserts the
pill follows the canonical "last message of latest in-flight run"
slot through every phase, with no `renderCustomMessages` prop on
the test setup)
- 4 condition tests (last-in-run / in-flight / latest-run /
tool-match), each pinning one gate
- 1 intelligence-gate test (no pill when `copilotkit.intelligence`
is undefined)
- 1 explicit auto-registration assertion (no `renderCustomMessages`
prop is required for the pill to render)
7 tests, react-core 1157 → 1158.
Adds three new memo gating signals to MemoizedCustomMessage so custom
message renderers stay reactive across the structural events that affect
"is this slot still authoritative?" decisions:
- numberOfMessagesInRun — invalidates when peers stream into the same run,
so renderers gating on "last message of the run" stay correct.
- isInLatestRun — invalidates when a newer run starts, so renderers gating
on "is this the latest activity?" can drop their badges on completed runs.
- isRunning (gated on isInLatestRun) — invalidates exactly twice per run on
the latest run's slots (start, end), preserving the perf-test guarantee
that completed runs' messages skip re-renders during streaming.
CopilotChatMessageView computes these per slot via getRunIdForMessage and
passes them down. Helper getNumberOfMessagesInRun lives next to the call
site for clarity.
New e2e test at CopilotKitProvider.intelligenceIndicator.e2e.test.tsx
exercises an "Using CopilotKit Intelligence" renderer that gates on:
position === "after", last-in-run, agent.isRunning, and run-is-latest.
The walkthrough scenario drives Run A then Run B with multiple messages
each, verifying the indicator only appears on the canonical slot at each
phase. Four condition-focused tests pin each gate individually.
Includes IsRunningAccurateMockAgent — a local subclass that makes run()
return a per-run observable terminating on RUN_FINISHED/RUN_ERROR. The
shared MockStepwiseAgent.run() returns the un-terminating subject for
backward compatibility, so emit(RUN_FINISHED) on it doesn't trigger
AbstractAgent's finalize → onRunFinalized → useAgent re-render path. The
subclass scopes the fix to this file without disturbing other tests.
Round-2 review surfaced two cheap improvements; this commit lands them.
All 7 round-1 findings were confirmed fixed by round 2.
- core.ts onAgentsChanged: each iteration of the unregister loops is
now wrapped in try/catch. A throw on iteration [0] no longer stalls
cleanup for [1..n]; both registries' unregister paths are
idempotent so re-attempts on the next onAgentsChanged are safe.
- agent.ts abortRun: removed dead `if (!routedId) return;` after
`routedAgentId()` — that method now throws (or returns a non-empty
string), so the guard is unreachable.
Tests: core 425 — all green.
Round-1 review found seven actionable items; this commit lands fixes for
all of them. Tests: core 425, react-core 1151, web-inspector 7 — all green.
Real bugs fixed:
- run-handler.ts: dropped the stale `agent` argument on the
`reloadSuggestions(agentId, agent)` call. The signature was tightened
to `(agentId)` when the consumerAgent parameter was removed; the call
site wasn't updated, leaving a TS-2554 build break.
- agent.ts: tightened `routedAgentId(): string` to throw when both
`agentId` and `remoteAgentId` are unset, instead of returning
`string | undefined`. Removes two `!` non-null asserts in
`#runViaHttp` / `#connectViaHttp` and the silent
`/agent/undefined/connect` URL path.
- agent.ts: marked `remoteAgentId` `readonly`. The field was publicly
mutable but `super.url` is baked at construction — mutating
`remoteAgentId` post-construction silently desyncs the REST run URL
from the routing decision elsewhere. `readonly` prevents.
- agent-registry.ts: the registerProxiedAgent collision check now uses
`Object.prototype.hasOwnProperty.call(this._agents, agentId)` instead
of `agentId in this._agents`. The `in` operator walks the prototype
chain, so an agentId of `"__proto__"`, `"constructor"`, etc. would
falsely test as already-registered.
- core.ts: the onAgentsChanged handler now mirrors the thread-store
unregister loop with a parallel
`stateManager.unsubscribeFromAgent(agentId)` for any agentId in
previousAgentIds but absent from the current snapshot. Without this,
`unregister()`'s state-manager subscription leaked.
Comment / test cleanup:
- CopilotChatView.tsx:92: stale "empty cloned agent" reference in the
`isConnecting` JSDoc rewritten to "empty agent instance" — clones are
gone.
- core-register-proxied-agent.test.ts: split the misleading "registering
before runtime connects yields a proxy in pending runtimeMode" test
(which exercised the no-runtimeUrl path, never the pending path) into
two: one for the no-runtimeUrl case, one that actually constructs a
core with a runtimeUrl and asserts `runtimeMode === "pending"`.
Adds a sign-up CTA to the shared `prebuilt-components` snippet so it
appears on all twelve per-integration `/{framework}/prebuilt-components`
pages that consume it, and adds a matching CTA to the LangGraph
prebuilt-components page (which uses custom content rather than the
shared snippet).
Moves the Built-in Agent overview CTA from below the features grid to
above the first H2 so it lands above the fold on standard viewports.
Replaces the framework-specific `npx copilotkit@latest create -f <fw>`
command with the interactive `npx copilotkit@latest create` flow on the
eight framework quickstarts that have a CLI scaffold (ADK, Agno, AWS
Strands, LangGraph, LlamaIndex, Mastra, Microsoft Agent Framework,
Pydantic AI).
Each quickstart's "Run our CLI" step now describes the three prompts
the CLI walks the user through — project name, the platform Yes/No
question (with a sign-up link to the dashboard), and the framework
choice. Framework labels match the strings rendered by the CLI's
interactive select-input so the docs stay aligned with the runtime
prompt.
Drops the per-language Tabs blocks on LangGraph and Microsoft Agent
Framework since the language variant is now picked through the CLI
prompt rather than encoded as a flag.
Places dashboard sign-up CTAs on topical pages, threads guides,
reference pages, and integration overview pages. Each CTA is tagged
with a stable surface identifier for PostHog attribution and routes to
the dashboard with matching UTM parameters.
Placements include:
- Home and quickstart landing pages
- Prebuilt-components, shared-state, and chat-related reference pages
- Threads how-to, tutorial, reference, and per-integration threads pages
(via the shared snippet)
- Inspector, event-inspector, and learning explainer pages
- Premium overview, observability, headless-ui, and self-hosting pages
(via the shared snippets)
- Integration overview pages — placed via the new afterFeatures slot on
the four FrameworkOverview-based pages (LangGraph, ADK, AWS Strands,
Microsoft Agent Framework) and below the features grid on Built-in
Agent
- Manual-setup quickstart pages (a2a, ag2, agent-spec, built-in-agent,
crewai-flows, deepagents)
Also normalizes platform copy across the affected pages.
Adds an optional `afterFeatures` ReactNode prop to the FrameworkOverview
landing-page component, rendered as a section between the supported
features grid and the architecture section. Lets the hosting MDX page
inject contextual content (links, callouts, sign-up cards) below the
final feature without needing to modify the component for each
integration.
Introduces a reusable OpsPlatformCTA component with four visual variants
(card, info, inline, tile) for placing dashboard sign-up calls-to-action
across the docs. Each click captures a `cta_clicked` PostHog event tagged
with surface, variant, and page path, and navigates to the dashboard with
UTM parameters identifying the source surface.
Registers the component in both MDX provider maps (home and integrations
slug routes) so it can be used in any MDX file.
Repoints the navbar "Free Developer Access" link to the dashboard and
wires the same PostHog tracking to its left and right placements.
Replace the abrupt "cut in" with a 300ms fade + slide-from-bottom
entrance on each chat card so they feel connected to the streaming
response instead of popping in.
Applied to all five tool render surfaces:
- ToolCard (Specialized + Default variants — do_research, do_projections,
navigate_and_filter, dashboard ops, render_chat_visual, etc.)
- InlineChart
- CashPositionCard
- InventoryReorderCard
- InvoiceApprovalCard
Uses tw-animate-css utilities (`animate-in fade-in slide-in-from-bottom-2
duration-300 ease-out`), already imported in globals.css — no new deps.
Adds a "Registering a Proxied Agent" section to the useCopilotKit reference
page. Covers the React pattern (useEffect + unregister cleanup), the
local-id vs remote-id contract, parameter and return-value reference, and
a per-chat-window example showing two ChatWindow instances backed by the
same runtime agent.
Re-adds the isolation coverage that the per-thread cloning revert deleted,
rewritten against the explicit-registration model:
- 9 new core-level tests in core-register-proxied-agent.test.ts cover the
cases from the deleted use-agent-thread-isolation.test.tsx — distinct
instances when two proxies target the same remoteAgentId, message and
state isolation between proxies, independent threadId per proxy, shared
outbound URL (both route to remoteAgentId), getAgent identity, pending
registration before runtime connect, registration with a remote id the
runtime doesn't yet know, and re-register-after-unregister yielding a
fresh proxy.
- 1 new react-core test in CopilotChatActivityRendering.e2e.test.tsx
replaces the deleted "passes the per-thread clone to activity message
renderers" regression test. The clone-vs-registry trap is gone in the
new model, so the test is reframed: the renderer must receive the agent
registered under the local agentId, not any other agent in the registry
(e.g. the runtime-side id a proxy might route to).
Total: +10 tests. Core 415 → 424, react-core 1150 → 1151.
The agent's request_approval tool calls copilotkit_interrupt() which
raises GraphInterrupt and the runtime emits a CUSTOM { name:
"on_interrupt" } event. The previous useHumanInTheLoop hook only handles
frontend-executed tools and was ignoring those events, so the approval
card flashed in then vanished without ever exposing Approve/Reject.
- Switch to useInterrupt for the interrupt-driven flow
- Add a no-op useRenderTool for request_approval to suppress the
wildcard tool renderer (which would otherwise show a half-finished
generic card during streaming)
- JSON-parse event.value (the runtime delivers the interrupt payload as
a string, not an object — accessing properties directly silently
returns undefined and filters the interrupt out)
Adds a public CopilotKitCore.registerProxiedAgent({ agentId, remoteAgentId }) API
that mints a ProxiedCopilotRuntimeAgent under a local registry id and routes its
outbound HTTP requests to the named runtime agent. Returns { agent, unregister }
so React callers can clean up via useEffect.
Throws when agentId is already taken — collisions with agents__unsafe_dev_only or
a previous registerProxiedAgent are loud, not silent.
ProxiedCopilotRuntimeAgent gains a remoteAgentId field used only for outbound
routing — URL paths (/agent/<id>/run, /connect, /stop), single-route envelopes,
and the IntelligenceAgent delegate's agentId. The local agentId remains the
registry key and the source of truth for state-manager subscriptions, useAgent
caching, and onAgentsChanged. So multiple proxies (e.g. chat-1, chat-2) can
target the same runtime agent ("default") without cross-talk in any subscriber
bookkeeping.
Use case: replaces the implicit per-thread cloning previously offered by
useAgent({ threadId }). Callers now opt into multiple frontend agents
explicitly.
Includes 6 unit tests covering routing, duplicate-throw, idempotent unregister,
onAgentsChanged notification, and header inheritance.
Reverts the cloning design from #3525 (useAgent per-thread clones, getThreadClone,
globalThreadCloneMap, cloneForThread) and #3630 (clone routing in activity renderers),
plus the inspector machinery that existed only to handle clones (onAgentRunStarted
subscriber + run-handler emissions from #3869, the connect-time emission from #3872,
and the agentRunThreadId map that read from it).
State-manager isClone composite-key path and SuggestionEngine consumerAgent param —
both added in #3525 to keep clones visible to bookkeeping — are gone too.
Restores agent.threadId = resolvedThreadId in CopilotChat (pre-#3525 behavior) and
swaps the inspector's agentRunThreadId map for a direct agent.threadId read.
Removes the DemoButtonAgent and /a2ui-demo page from the demo (added by #3630 as a
clone-fix repro).
Re-opens the original issue #2957 (CPK-7155): two CopilotChat instances with the same
agentId and different threadIds will share message state again. The follow-up is a
public registerProxiedAgent API so callers can opt into multiple frontend agents
proxying to the same runtime agent, without implicit per-thread cloning.
## Summary
Fixes GitHub Actions template injection (CWE-78) across three workflow
files. Untrusted PR event data (`title`, `head.ref`, `base.ref`, SHAs,
`user.login`) was interpolated directly into shell `run:` blocks via
`${{ }}`, allowing arbitrary code execution on the runner via a crafted
PR title or branch name.
**Fix:** Move all untrusted expressions to `env:` blocks and reference
them as shell variables (`${VAR}`) instead. This is the standard
mitigation recommended by GitHub's security hardening guide.
### Affected files
- **test_smoke-starter.yml** — PR title, user login, head SHA in the
"Capture failure cause" step
- **publish-release.yml** — PR head ref (branch name) in the "Extract
scope from branch" step
- **static_quality.yml** — PR base ref in the "Collect PR-changed files"
step; base/head SHAs in the "Validate PR commits with commitlint" step
All other workflow files were audited and already use safe patterns
(`env:`, `with:`, or `concurrency:` blocks).
## Test plan
- [ ] CI passes on this PR (the workflows themselves are exercised by PR
events)
- [ ] Grep confirms no remaining `${{ github.event.pull_request.*`
inside `run:` blocks
Move untrusted PR event data (title, head ref, base ref, SHAs) from
inline ${{ }} interpolation in shell run: blocks to env: blocks,
referencing them as shell variables instead. This prevents arbitrary
code execution via crafted PR titles or branch names.
Affected workflows:
- test_smoke-starter.yml: PR title, user login, head SHA
- publish-release.yml: PR head ref (branch name)
- static_quality.yml: PR base ref, base SHA, head SHA
## Summary
- Removed the dark `#0a0a0f` background `<rect>` from `icon.svg` — the
favicon now shows only the shield+kite shape on a transparent background
- Converted `og-image.png` from RGB to RGBA and made all background
pixels (`#0a0a0f`) fully transparent, leaving the 17k content pixels
(shield+kite graphic) intact
## Test plan
- [ ] Open showcase-dashboard locally, verify the browser tab favicon
shows the shield without a dark square
- [ ] Check the og:image preview (e.g. via https://www.opengraph.xyz/)
to confirm the shield renders on transparent background
## Summary
- Add "Isolated Test Runs" section to `showcase/DEBUGGING.md` covering
how `--isolate` works (temp overlays, slot-based ports, project name
scoping), parallel safety, and troubleshooting stale state from the old
behavior.
- Add "Isolated Test Runs" section to `showcase/RUNBOOK.md` with
operational notes: when to use `--isolate`, parallel run limits, orphan
container cleanup, and stale slot cleanup.
Documents the rewrite from PR #4570, which replaced the old in-place
mutation approach with temp overlay files that never touch originals.
## Test plan
- [ ] Verify DEBUGGING.md renders correctly on GitHub
- [ ] Verify RUNBOOK.md renders correctly on GitHub
- [ ] Confirm section placement matches existing document structure and
style
The --isolate flag was rewritten in PR #4570 to use temp overlay
files instead of mutating originals in place. Add sections to
DEBUGGING.md (how it works, troubleshooting) and RUNBOOK.md
(operational notes for parallel runs and cleanup).
## Summary
- Adds `if: false` to the `create-check` job in
`showcase_eval_check.yml`
- The check is failing on every PR (see screenshot in conversation)
- Easy to re-enable: just remove the `if: false` line
## Test plan
- [ ] Verify new PRs no longer show the failing "Showcase: Eval Check"
check
## What does this PR do?
Corrects scaffolded template instructions so generated projects match
their actual package scripts and runtime requirements. The updates
remove stale duplicate setup steps, fix provider environment examples,
align Python version and uv guidance, and document that the threads
template npm run dev starts its Docker Compose infrastructure.
## Related PRs and Issues
- Companion Intelligence CLI PR:
https://github.com/CopilotKit/Intelligence/pull/160
## Checklist
- [x] I have read the Contribution Guide
- [x] If the PR changes or adds functionality, I have updated the
relevant documentation
- [ ] Allow edits by maintainers is checked
## Summary
Polish pass on the deep-agents-finance-erp showcase to reduce visual
noise and make the chat surface feel more like a real assistant.
- **Persistent follow-up suggestion chips** above the input. The third
chip rotates based on the currently loaded dashboard so we never suggest
switching to the view the user is already on (e.g. on Cost Control the
chip becomes "Cash Flow Risk", on Cash Flow Risk it becomes "Cost
Control").
- **Hover-only assistant toolbar on the last turn.** The copy icon no
longer floats between tool-call cards mid-conversation; it only appears
on the latest assistant message and only when the user hovers it.
- **Cleaner research / projections tool render.** Replaced the raw
markdown-table preview under `do_research` / `do_projections` cards (`|
Metric | Amount | |---|---:|...`) with a "Completed data gathering" /
"Completed projections" status caption. Full results still available
behind the chevron expand.
- **Natural-language intent routing in the orchestrator prompt.**
Spending / cost / cash-flow / revenue / executive-overview questions now
resolve to `do_research` → `load_dashboard` against the matching
pre-built template (no `save_dashboard` + `manage_dashboard(reset)` +
`update_dashboard` churn). Approval-context invoice questions ("do we
have any invoices for approval", "what needs to be paid") route to
`request_approval(invoice_payment)` instead of just charting.
## Files
-
examples/showcases/deep-agents-finance-erp/src/components/layout/shell.tsx
— suggestion chips, hover-only toolbar wrapper, dashboard-aware rotation
-
examples/showcases/deep-agents-finance-erp/src/components/chat/tool-card.tsx
— clean status caption for do_research / do_projections
- examples/showcases/deep-agents-finance-erp/agent/prompts.py —
intent-mapping rules for dashboards and approvals
## Test plan
- [ ] Open the chat and send any message — verify three chips appear
above the input on the second turn (Cash Position Chart / Approve
Payments / dashboard suggestion).
- [ ] Click "Show me where the company is spending its money" — verify
agent only calls `do_research` then `load_dashboard("Cost Control")`, no
`update_dashboard` / `save_dashboard` / `manage_dashboard`.
- [ ] After Cost Control loads, verify the third chip rotates to "Cash
Flow Risk".
- [ ] Hover over an assistant message — copy/toolbar icons fade in only
on the latest turn.
- [ ] Trigger `do_research` and verify the tool card shows "Completed
data gathering" instead of raw markdown.
- [ ] Ask "Do we have any pending invoices for approval?" — verify the
approval HITL dialog renders.
DocsLayer rendered unconditionally for docs-only features whenever
any overlay was active. Now respects the Docs toggle — docs-only
cells show Links (command) when Links is on, Docs when Docs is on,
empty otherwise.
## Summary
- Adds a **Talk to Our Engineers** CTA button to the right side of the
docs navbar, mirroring the new website's nav button.
- Wires the same PostHog `talk_to_us_clicked` event the website fires,
with `{ location: "docs_nav" }` so docs-originated clicks can be
segmented from website clicks (`"nav"`) in PostHog.
- Fixes a pre-existing layout bug where the navbar's slanted SVG borders
were sized in fixed pixels (`w-[24px] h-[60px]` / `xl:w-[29px]
xl:h-[72px]`) and didn't follow the nav's actual height once Chrome's
default font size was scaled above 16px — the wedge of page background
that leaked through the join is now sealed.
## Behavior
| Viewport | Button |
|---|---|
| `>= 1400px` | Visible |
| `1024–1399px` | Hidden (button text would otherwise force the left
links to wrap) |
| `< 1024px` | Hidden — mobile burger menu surfaces the link |
The button uses `text-muted-foreground` for the resting state to match
the existing nav links and an indigo `#7076D5` hover accent that matches
the active-link underline color. Target is
`https://copilotkit.ai/contact-us` (absolute since docs runs on the
`docs.` subdomain).
## Test plan
- [ ] Click the button on a wide viewport — navigates to
`https://copilotkit.ai/contact-us` and fires `talk_to_us_clicked` with
`{ location: "docs_nav" }` in PostHog.
- [ ] Resize from > 1400px down through 1024px and below — button shows
/ hides at the right thresholds with no left-link wrapping.
- [ ] Toggle dark mode — button border and text stay legible, hover
accent still indigo.
- [ ] Set Chrome's default font size to 20px and reload — no wedge gap
at the slanted-border join between the left and right pill containers.
Removes the unreleased Threads management surface (useThreads hook,
multi-conversation tutorial, the per-integration Threads how-to, the
shared snippet) and the Intelligence Platform / self-hosting pages
introduced alongside them, plus the ThreadsEarlyAccess gate that wrapped
them. The Learn landing page stays; just drops the Threads card and the
Intelligence Platform card. Sidebars (root, learn, reference/v2/hooks,
12 integrations + their premium subsections) are pruned to match.
<!--
Thank you for sending the PR! We appreciate you spending the time to
work on these changes.
Help us understand your motivation by explaining why you decided to make
this change.
**Please PLEASE reach out to us first before starting any significant
work on new or existing features.**
By the time you've gotten here, you're looking at creating a pull
request so hopefully we're not too late.
We love community contributions! That said, we want to make sure we're
all on the same page before you start.
Investing a lot of time and effort just to find out it doesn't align
with the upstream project feels awful, and we don't want that to happen.
It also helps to make sure the work you're planning isn't already in
progress.
As described in our contributing guide, please file an issue first:
https://github.com/ag-ui-protocol/ag-ui/issues
Or, reach out to us on Discord: https://discord.com/invite/6dffbvGU3D
You can learn more about contributing to copilotkit here:
https://github.com/copilotkit/copilotkit/blob/master/CONTRIBUTING.md
Happy contributing!
-->
## What does this PR do?
(Describe the changes introduced in this PR)
## Related PRs and Issues
- (Direct link to related PR or issue, if relevant)
## Checklist
- [ ] I have read the [Contribution
Guide](https://github.com/copilotkit/copilotkit/blob/master/CONTRIBUTING.md)
- [ ] If the PR changes or adds functionality, I have updated the
relevant documentation
- [ ] "Allow edits by maintainers" is checked (lets us help iterate on
your PR directly — faster turnaround for everyone)
Tyler Slaton