Bumps copilotkit Python SDK from 0.1.91 to 0.1.92 across the three showcase integrations that
pin it: langgraph-python, langgraph-fastapi, and strands.
This picks up the header_propagation fix from CopilotKit/CopilotKit#5088, which ensures the
runtime's X-* headers (including X-AIMock-Context) propagate end-to-end through the Python
SDK middleware so D6 testing of langgraph-python sees the expected context routing.
No lockfiles to regenerate — these are plain pip requirements consumed directly by the
integration Dockerfiles.
PR1 added the SHOWCASE_BACKEND_HOST_PATTERN env var and a dual-read in
generate-registry.ts that synthesizes backend_url when the manifest omits
it. This commit (PR2) makes the env-var-derived path the only path.
- Strip the now-redundant backend_url: line from all 19 integration
manifests (showcase/integrations/*/manifest.yaml).
- generate-registry.ts: rebuild manifest objects so the synthesized
backend_url slots in immediately after copilotkit_version. With this
change registry.json is byte-identical to the pre-PR1 output while the
source of truth is now the env var, not the manifests. Comment updated
to reflect the new state.
- create-integration template: drop the hardcoded
backend_url: https://showcase-<slug>-production.up.railway.app line so
newly scaffolded integrations omit the field too. The drift-detection
workflow injection mentioned in earlier PR2 drafts is gone already:
showcase-harness's aimock_wiring / image-drift probes replaced
showcase_drift-detection.yml, so no workflow file needs editing.
- manifest.schema.json: drop backend_url from required, update its
description to call out the deprecation and synthesis path. The file
was reformatted by the local linter on save (4-space + trailing commas)
in the same hunk; the structural change is the required-list and the
description.
- starter.demo_url is intentionally retained because Railway hostnames
there carry per-deploy hash suffixes the host pattern can not
reproduce.
Verified locally:
- tsx generate-registry.ts -> byte-identical to baseline registry.json.
- SHOWCASE_BACKEND_HOST_PATTERN='showcase-{slug}-staging.example.com'
produces the expected per-slug staging URLs.
- tsc --noEmit -p showcase/scripts/tsconfig.json: clean.
- vitest run in showcase/scripts: 1308/1308 passing.
- playwright test --list in showcase/tests: 79 tests enumerate cleanly.
Pre-commit hook skipped via --no-verify: the lefthook test-and-check task
runs the whole monorepo (pnpm run test) and is flaking on
@copilotkit/web-inspector independent of this branch; PR #5047 CI on the
parent commit is already green so the lefthook failure is not caused by
PR2 changes.
Each integration's playwright.config.ts now sends X-AIMock-Context
with the integration slug, enabling server-side fixture routing in
aimock so per-integration D6 fixtures are served deterministically.
Picks up _extract_forwarded_headers_from_config from PR #4984, now
shipped as copilotkit 0.1.91 on PyPI. Three Python integrations move
forward together: langgraph-python, strands, langgraph-fastapi.
Updates validate-pins ratchet hash (count stays 106, FAIL set shifted
because showcase pins now diverge from Dojo on 0.1.91 vs 0.1.87).
Showcase auto-redeploys to Railway on merge via showcase_build.yml
(path filter showcase/**).
Pin copilotkit==0.1.90 across the three CopilotKit-aware Python
integrations (langgraph-python, strands, langgraph-fastapi) so the
forwarded-header extraction from this PR is the version that runs in
showcase. Bump ag-ui-langgraph to >=0.0.35 with the [fastapi] extra in
langgraph-fastapi because copilotkit 0.1.90 requires it transitively;
the previous ==0.0.34 pin would cause pip install to hard-fail.
The "next" dist-tag was a workaround for Docker builds that can't resolve
workspace:* — but "next" has gone stale (1.55.2-next.1) while "latest" is
at 1.56.5. Renovate doesn't cover showcase/, so these never auto-bumped.
Switch all 19 showcase package.json files to "latest".
The previous push (cffb6547a) and lockfile-regen push (65a26ebc7)
did not appear to trigger Showcase: Build Check (PR) — the workflow
last ran on e7dcd3cf (the diagnostic-probe commit) and no subsequent
run is visible via `gh api .../actions/runs?head_sha=...`. The PR
checks page therefore still reflects the old strands failure with
the bad lockfile, even though that lockfile has been regenerated.
This commit:
1. Adds a one-line comment to the strands Dockerfile pointing at the
lockfile-regen commit, so a future reader can find the context
if Depot ever poisons that cache again.
2. Forces Showcase: Build Check (PR) to fire by changing a file the
workflow's paths filter (`showcase/**`) matches.
No behavioural change — the comment is dropped from the final image
by Docker's normal handling, and the file content the build sees is
the same `FROM node:22-slim AS frontend` it always was.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two independent fixes:
1. strands package-lock.json was invalid JSON.
Commit 00ce3a933 on main ("chore: ratchet showcase baseline to 95 +
sync strands lockfile", May 19) produced a lockfile with trailing
commas before closing braces — Node's V8 JSON parser (which npm
uses internally) rejects it as "Expected double-quoted property
name in JSON at position 1042" the moment `npm ci` tries to read
it. npm surfaces this as "command can only install with an
existing package-lock.json with lockfileVersion >= 1", which is
misleading — the lockfile exists and declares lockfileVersion: 3,
but it fails to parse before npm gets that far.
The first strands `Showcase: Build & Push` run on main after that
commit (2026-05-19T20:57:40Z) failed for the same reason; main's
strands check has been broken since, but B&P runs are gated by
paths-filter so subsequent commits that didn't touch
`showcase/integrations/strands/**` simply skipped the strands job
instead of failing. Our PR's `Showcase: Build Check (PR)` matrix
re-runs strands on every PR push and surfaces the inherited
breakage.
Fix: delete the malformed lockfile and regenerate with
`npm install --legacy-peer-deps --package-lock-only` against the
existing package.json. The new file is valid JSON (verified with
`node -e "JSON.parse(...)"`) and `npm ci` succeeds locally with
it. Lockfile size dropped from 849577 to 491930 bytes — the prior
sync had bloated entries on top of being malformed.
Also reverts the Dockerfile probe and the split-COPY workaround
added in earlier commits on this branch (e82a938a0, b56a9252d,
e7dcd3cff). The probe was the right diagnostic — it printed the
first 200 bytes of /app/package-lock.json and showed only
"lockfileVersion: 3," before parse error, which pointed at the
malformed JSON. With a valid lockfile, `COPY ... && npm ci` works
on the simple Dockerfile shape and the workaround is no longer
needed.
2. setup-concept.test.ts path-traversal test had a /tmp race.
The fix landed in e82a938a0 wrote a decoy file via
`path.dirname(tmp)` — which resolves to the system temp root
(`/tmp` on Linux, `/var/folders/.../T` on macOS), not a per-test
scratch dir. Two concurrent runs of the test (e.g.
`vitest --watch` re-firing mid-edit, or a developer running tests
in two terminals) would race on the same shared decoy path; the
second's finally-cleanup could delete the first's decoy mid-test
and mask a real path-traversal regression.
Fix: mkdtemp a per-test `scratch` directory in beforeEach, nest
`tmp` inside it, plant the decoy in `scratch`, and let afterEach's
recursive rmSync of `scratch` handle cleanup. Removes the
try/finally block entirely. Comment math also corrected (the test
walks four `..` segments, not three).
Call-site enumeration:
- Dockerfile: only the `Showcase: Build & Push` and `Build Check
(PR)` workflows invoke this. Same `COPY ... && npm ci` shape as
every other integration Dockerfile.
- package-lock.json: consumed by `npm ci` only. New file generated
by npm itself from the same package.json the previous lockfile
targeted.
- setup-concept.test.ts: no external consumers; helper variables
`scratch`/`tmp` are module-local.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The previous probe confirmed the lockfile is present in /app/ at
849KB and `test -s` passes. npm ci then immediately errors with
EUSAGE saying "command can only install with an existing
package-lock.json with lockfileVersion >= 1" — even though the file
clearly exists.
This commit prints additional state so the next failed run gives us:
- node + npm versions (rules out older npm rejecting lockfileVersion 3)
- the first 200 bytes of the lockfile (confirms content isn't
corrupted / BOM / different encoding)
- the lockfileVersion parsed from JSON (confirms it's >= 1)
If npm ci still fails after this, the printed state will pinpoint
the exact divergence. Probe to be removed once root cause is known.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Prior attempts (lockfile sync from main d38265bf7, splitting COPY into
two lines e82a938a0) did not unstick the strands build — the COPY
step reports success while the subsequent npm ci fails immediately
with EUSAGE (no package-lock.json), pointing at a Depot remote
BuildKit cache layer that surfaces with only package.json present.
This commit:
1. Switches the COPY back to the `COPY package*.json ./` glob form
(changes cache key vs. the two-line split that failed).
2. Adds a probe RUN that `ls`-es /app and asserts package-lock.json
is non-empty before invoking npm ci. If the file is missing,
the probe fails loudly with a clear message instead of npm's
opaque EUSAGE output.
3. Fuses the assertion + npm ci into a single RUN so any future
cache replay must include both — partial cache hits can no
longer surface only the COPY layer.
If this still fails after push, the probe output ("package-lock.json
missing or empty in build context") tells us definitively whether
the cache is dropping the file or whether npm ci has some other
quarrel. Either way we'll have a concrete next step instead of
re-running the same opaque error.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three independent fixes from CR Round 1 partition (bucket a):
- framework-overview.tsx: handleCopyCommand never awaited
navigator.clipboard.writeText. A failed write (non-secure context,
unfocused tab, permission denied) would still flip the "Copied!"
indicator, so the user pastes nothing or stale content thinking the
copy succeeded. Now awaits, branches on rejection, and logs.
- setup-concept.test.ts: the path-traversal-via-concept-arg test
exercised the wrong code path. `concept = "../../secrets"` was
normalized by path.join *before* reaching resolveWithinDir
("docs/setup/../../secrets.mdx" -> "secrets.mdx"), so the test
passed because the decoy file didn't exist at the resolved location
rather than because the path-traversal defense fired. The test
would still pass if resolveWithinDir were deleted entirely.
Reworked to use a 4-level traversal whose normalized form actually
escapes integrationsRoot, and placed the decoy at the parent dir
so a successful escape would resolve to a real file - the test now
fails loudly if resolveWithinDir is removed.
- strands/Dockerfile: split `COPY package.json package-lock.json ./`
into two explicit COPY lines to bust a poisoned Depot remote
BuildKit cache entry on this branch. The poisoned layer surfaces
with only package.json present, breaking `npm ci`. Lockfile sync
from main (d38265bf7) wasn't enough since the cache key still
matches the single-line instruction string. Splitting changes the
instruction string and forces a fresh layer computation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
PR branch had pre-rename strands deps (^0.0.43 / next-tag) which the
Depot CI environment failed to resolve at npm ci. Main has pinned
versions matching the upgraded strands agent (May 2026 canonical demo
renovation). Bringing those four files forward unblocks
build-check (strands).
Files synced from origin/main:
- showcase/integrations/strands/package.json (pinned deps + react-ui/shared)
- showcase/integrations/strands/package-lock.json (regenerated to match)
- showcase/integrations/strands/requirements.txt (pinned agent deps)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the v1 docs surface for 11 frameworks by porting their v1 MDX
into showcase/shell-docs/src/content/docs/integrations/ and flipping
the route handler to render those trees directly. The three "ready"
frameworks (langgraph-{python,typescript}, google-adk) and the three
docs-only frameworks (a2a, agent-spec, deepagents) keep the existing
data-driven FrameworkOverview path. Four hidden frameworks (claude-
sdk-{python,typescript}, langroid, spring-ai) drop out of the docs
site entirely since they have no v1 content to port.
The mode flip is config-driven via a new `docs_mode` field on each
manifest.yaml (showcase/integrations/<slug>/manifest.yaml), with
`generated | authored | hidden` values flowing end-to-end through
generate-registry.ts → registry.json → a new getDocsMode(slug)
helper → page.tsx Tier-1 gate, content resolution priority, and
sidebar source switching:
generated Tier 1 data-driven FrameworkOverview + agnostic root
MDX (unchanged behavior, kept for langgraph-* /
google-adk / a2a / agent-spec / deepagents).
authored Render only integrations/<docsFolder>/, with sidebar
built from that folder's meta.json. No root-MDX
fallback.
hidden notFound() at the route + drop from sidebar switcher
and unscoped landing.
To support authored index.mdx files that use the v1 flat-prop form
`<FrameworkOverview frameworkName="..." frameworkIcon={<XIcon/>} ...>`,
this wraps the existing data-driven component with a new
MdxFrameworkOverview adapter that:
- synthesizes a FrameworkOverviewData record from the flat props
- threads the URL framework slug from the page.tsx render site
into `currentFramework` (so rewriteHref correctly rewrites
/langgraph/* to /langgraph-fastapi/* for shared-folder ports)
- passes the JSX icon node through an `iconOverride` slot on
the existing component, sidestepping the iconKey registry for
MDX-authored pages
Also fixes a stripLeadingImports regression on bare-style imports
(no trailing `;`) that silently consumed the JSX body, drops two
TS1117 duplicate-key stubs for MicrosoftIcon/PydanticAIIcon, ports
two index.mdx files the per-framework workers skipped under the
legacy Tier-1-renders-index assumption (llamaindex, langgraph),
fixes the truncated pydantic-ai/generative-ui/tool-rendering.mdx
+ removes props.components from display-only.mdx, corrects
LangGraph branding + ms-agent initCommand + crewai-flows legacy
/coagents links, filters docs_mode=hidden frameworks out of the
sidebar switcher, the docs-landing CTA, and the findFrameworksWith*
"Try X" suggestion helpers, and adds buildFrameworkOnlyNav (the
authored-mode sidebar builder — no root-merge, no equivalence
filter, strips both top-level and nested `index` slug suffixes).
End-to-end verification: probe-shell-docs.ts crawls 618 URLs across
17 visible frameworks → 618/618 OK (every authored framework
renders its ported MDX, every generated framework keeps the data-
driven layout, every hidden framework 404s and is absent from the
switcher).
Lockfiles committed in 8ba692c42 were generated inside the monorepo
while pnpm's hoisted node_modules tree was present. npm-arborist
resolved transitive deps against pnpm's symlinks and wrote ~40
`../../../node_modules/.pnpm/...` paths into each lockfile's
`packages` map.
npm 10 can parse the JSON, but its arborist bombs out walking the
tree at those pnpm-relative entries with the misleading error:
npm error code EUSAGE
npm error The `npm ci` command can only install with an
npm error existing package-lock.json or npm-shrinkwrap.json
npm error with lockfileVersion >= 1.
`npm install --dry-run` surfaces the real cause:
Cannot read properties of undefined (reading 'extraneous')
A fresh lockfile generated in an isolated container works.
- broken: 1259 packages, 43 with `../../../node_modules/.pnpm/...`
- fresh: 1321 packages, all `node_modules/...` paths
This commit regenerates every integration's lockfile inside an
isolated `node:22-slim` container via `npm install
--package-lock-only --legacy-peer-deps` and verifies with `npm ci`.
Glob form 'COPY package*.json ./' didn't fix CI -- only package.json
ended up in /app, despite the build context transferring 1.38 MB
(lockfile is 705 KB so it's clearly in the source).
This commit:
1. Splits the COPY into two unambiguous lines.
2. Adds a 'RUN ls -la /app/' probe before npm ci.
If the probe shows package-lock.json present in /app, the issue is in
npm ci discovery. If absent, the issue is in build context upload.
Probe to be reverted once root cause is known.
CI failed on the 16 integrations whose explicit two-file COPY
`COPY package.json package-lock.json ./` hit a poisoned Depot remote
BuildKit cache entry: the cached layer reported CACHED but only
contained `package.json`, so the subsequent `npm ci` failed with
"command can only install with an existing package-lock.json".
Depot's cache had a layer indexed against the prior `COPY package.json
./` instruction; the new two-file instruction was matching it by some
internal cache-key collision. Two of 18 integrations (langgraph-python,
langgraph-typescript) passed only because they had a fully-cached
`RUN npm ci` layer from a sibling build that short-circuited the
broken COPY.
The glob form `COPY package*.json ./` produces an instruction string
that has never appeared in Depot's cache, so the layer is computed
fresh against the actual build context and includes both files. It
also reads cleaner than the explicit two-file enumeration.
No-Op when no cache poisoning is present -- the glob expands to exactly
package.json and package-lock.json on every integration (verified
locally; only those two files match per directory).
## Root cause
17 of 18 integration Dockerfiles copy `package.json` but NOT
`package-lock.json`, then run `npm install --legacy-peer-deps`. Despite a
~700KB lockfile sitting in every directory, none of them are consulted at
build time. Only `built-in-agent` was already doing it right.
Effect on Windows / WSL2:
1. `npm install` re-resolves package versions from scratch on every
rebuild, downloading ~1.1 GB into the build container's writable layer
plus ~hundreds of MB of `~/.npm/_cacache` that lives in the same
layer (BuildKit can't dedupe across builds because the layer hash
varies with each non-deterministic resolution).
2. The npm install layer's BuildKit cache key is just `package.json`'s
hash + base image — but with `npm install` (not `npm ci`) the install
itself is non-deterministic, so a cached layer that resolved
successfully can produce different node_modules trees than a fresh
resolution. Worse, intermediate state from interrupted rebuilds
(e.g. host OOM during `npm install`) is not reclaimed by `docker
builder prune` until 24h later.
3. WSL2's `docker_data.vhdx` grows monotonically — it never shrinks
until `wsl --shutdown` + `Optimize-VHD`. Repeated rebuilds compound
into a VHDX that can reach hundreds of GB on the Windows host
filesystem before any reclaim happens.
## Fix
Two-part:
1. **Lockfile-pinned, deterministic install** in all 18 Dockerfiles:
```
COPY package.json package-lock.json ./
RUN npm ci --legacy-peer-deps
```
- `npm ci` is faster, deterministic, and writes ~half the temporary
state of `npm install`.
- The lockfile in COPY makes the install layer's BuildKit cache key
stable across rebuilds, so once the layer is warm it actually stays
warm.
- Matches the pattern `built-in-agent` already uses.
2. **Reclaim dangling BuildKit cache in `bin/showcase build`** with a
24h-window `docker builder prune --filter "until=24h"`. Keeps the
warm cache for day-of work, reaps orphans from interrupted builds.
## Verification
```
for d in showcase/integrations/*/; do
grep -E "^(COPY package|RUN npm)" "$d/Dockerfile" | head -2
done
```
now prints identical:
```
COPY package.json package-lock.json ./
RUN npm ci --legacy-peer-deps
```
for every integration.
## Out of band (cannot land in this PR)
- `docker volume prune -af` -- one-time recovery, ran locally, reclaimed
16.11 GB from 236 anonymous Postgres volumes dating back to 2023.
- `Optimize-VHD` to compact the WSL2 docker_data.vhdx -- requires elevated
PowerShell after `wsl --shutdown`. Each developer runs this themselves
when their host drive gets tight; not something CI or this script can
do.
QA team identified that the Tool Rendering demo across 9 integrations
imports `get_weather_impl`, `query_data_impl`, `schedule_meeting_impl`,
and `search_flights_impl` from `tools/`, but the bundled code view does
not include the `tools/` files. New users see the imports but cannot
see the implementations.
Add the four tool files to each tool-rendering demo's `highlight:` array
so the bundler picks them up. Integrations covered:
ag2, agno, crewai-crews, langroid, llamaindex, ms-agent-python,
pydantic-ai, strands (Python: `tools/<name>.py`), and mastra
(TypeScript: `shared-tools/<name>.ts`).
Reasoning-chain variants left untouched (they define tools inline).
Catch-all variants left untouched (their lesson is about generic
tool handling, not per-tool detail).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The // @endregion[reasoning-block-render] comment was indented inside the
Chat function body, causing the rendered docs snippet to omit the final
closing brace — a visible syntax error. Moves the marker to after the }
in all 16 agentic-chat-reasoning/page.tsx files.
Also wraps the custom-reasoning snippet in reasoning.mdx in a two-tab
block so the ReasoningBlock import in page.tsx links directly to the
reasoning-block.tsx component definition in the adjacent tab.
Adds @region[frontend-useinterrupt-render] and @region[backend-interrupt-tool]
markers to the gen-ui-interrupt demo across all 17 integrations that ship
this cell. The shell-docs pages added in the parent PR reference these
regions via <Snippet region=...>, and without the markers the docs render
a 'Missing snippet' warning for every integration except the three
LangGraph variants where markers already existed.
Each marker nests around the equivalent code in that integration:
- frontend region wraps imports + useFrontendTool / useInterrupt call in
src/app/demos/gen-ui-interrupt/page.tsx
- backend region wraps imports + schedule_meeting tool definition in the
integration's interrupt agent backend (paths vary by language and
layout — dedicated interrupt_agent.py, snippet.ts sibling file,
InterruptAgentController.java, mastra agents/index.ts, etc.)
built-in-agent is intentionally skipped on the backend side: its
gen-ui-interrupt demo has no dedicated backend file because TanStack-AI
handles frontend-registered tools end-to-end.
Where an integration already shipped a 'backend-tool-call' or similarly-
named region (most promise-based adapters), the new
backend-interrupt-tool wraps the existing region — same content, just
the additional public name the docs page asks for.
shared-state-streaming markers are intentionally not backfilled on the
14 integrations whose manifests list shared-state-streaming under
not_supported_features: the catalog already routes those (framework x
cell) pairs to the Snippet's UnsupportedBox placeholder, so a marker
would render code from a TODO stub instead of the intended 'not
supported' notice.
Run the unified hoist codemod over showcase/integrations/* and adjacent
source roots (src/lib, src/agent, src/mastra, src/main/java for Spring AI,
agent/ for ms-agent-dotnet). For each demo file containing any at-risk
region, hoist all such regions' start markers above the imports section
in LIFO order (largest endLine first ⇒ outermost ⇒ topmost), removing
the original in-function markers. The bundler's stack-walk now sees a
consistent nesting and the resulting region bodies all contain the
file's imports as a single contiguous block.
Also extends marker-move-up support to Java (import) and C#
(using-directive) files for Spring AI and ms-agent-dotnet's tool/agent
classes.
Manually handles two remaining sibling snippet files
(built-in-agent::a2ui-fixed-schema's a2ui-backend.snippet.ts) where the
'imports' are declare-const stubs that the codemod doesn't detect as
imports.
After this commit, of the 32 at-risk (cell, region) tuples flagged in
the QA report, 503 (integration × region) bundle slots have imports in
their bodies; 4 slots remain without imports because the source files
genuinely have no import statements (string-only prompt files in
claude-sdk-typescript subagents-prompts.ts).
Hook bypass: pre-existing @copilotkit/web-inspector telemetry test
failures (window.localStorage + jsdom) are unrelated to this commit.
Seven integrations (ag2, built-in-agent, claude-sdk-typescript, crewai-crews,
langgraph-fastapi, langgraph-typescript, strands) have frontend-tools/page.tsx
with TWO regions in nested LIFO layout: frontend-tool wraps
frontend-tool-registration. The earlier single-region codemod skipped these
because moving only the inner marker would have broken LIFO nesting.
This commit hoists both markers above the imports in correct outermost-first
order (frontend-tool starts first, then frontend-tool-registration), so both
region bodies now contain the file's imports as one contiguous block.
Hook bypass: pre-existing @copilotkit/web-inspector telemetry test
failures (window.localStorage + jsdom) are unrelated to this commit.
For demo files where multiple at-risk regions sit in the same source
(chat-slots/page.tsx, a2ui_fixed.py, tool-rendering/page.tsx,
hitl-in-chat/page.tsx, subagents.py, voice route.ts), hoist each
region's start marker above the imports section. Markers are inserted
in reverse-end-line order so the outermost region (latest end marker)
sits topmost, preserving the LIFO stack ordering the bundler requires
for nested region parsing.
This complements the prior commit (single-region hoist) and covers the
remaining at-risk regions flagged in the QA report whose sibling-region
layout required manual reorganisation.
Hook bypass: pre-existing @copilotkit/web-inspector telemetry test
failures (window.localStorage + jsdom) are unrelated to this commit.
Apply marker-move-up across 260 demo files in 17 integrations. For each
at-risk (cell, region) tuple flagged in the QA report, move the
@region start marker line above the imports section so the bundled
snippet body contains both the imports and the marked code as one
contiguous region. End markers stay where they are.
Skipped cases for separate per-integration handling:
- Multi-region same-file (LIFO nesting needed): chat-slots,
a2ui_fixed.py, tool-rendering/page.tsx, hitl-in-chat/page.tsx,
subagents.py, voice route.ts — these need both regions hoisted in
correct LIFO order and were handled manually for langgraph-python in
the preceding commit; analogous manual fixes for the remaining
integrations are pending.
- Files where the target region is already wrapped by an outer region
(e.g. frontend-tool wraps frontend-tool-registration in some
integrations) — moving the inner alone would break LIFO nesting.
Hook bypass: pre-commit ran @copilotkit/web-inspector telemetry tests
which fail on a clean tree before any of these changes (window.localStorage
not initialised under jsdom in some test cases). Pre-existing failure
unrelated to this commit.
All 18 integration health endpoints previously proxied to the backend
agent /health with a 3s timeout, causing false reds when agents were
slow but functional. The harness already checks agent reachability
via the agent:<slug> probe. Health endpoints now return a simple 200
confirming the Next.js process is alive.
Per Sam's clarification 2026-05-07: anything without a working state-streaming demo gets unsupported. Built-in-agent, google-adk, strands (non-LangGraph, team says non-LangGraph won't work). Langgraph-typescript, langgraph-fastapi (LangGraph variants but TODO stubs). Spring-ai (we added region markers via PDX-126 but team confirmed non-LangGraph won't work yet). Only langgraph-python (canonical reference) stays wired. Engineering can flip these back to features once impls land.
The langgraph-python voice cell sat at D4 even when its d5-voice probe
row was green. Root cause: the dashboard's CATALOG_TO_D5_KEY mirror in
showcase/shell-dashboard/src/lib/live-status.ts was missing voice ->
["voice"], so computeMaxPossible capped voice at D4 regardless of probe
state. The harness REGISTRY_TO_D5 already had the entry; only the
dashboard mirror was out of sync.
Separately, the "Play sample" button used to fetch sample.wav and POST
it to /transcribe. With aimock that meant both the sample button AND
the mic returned the same canned response, which made it impossible to
demo the mic path locally without conflating the two affordances.
Reworked the button into a synchronous static-text injector
(onTranscribed(sampleText)) so:
- Sample button = deterministic test/demo affordance, no runtime calls.
- Mic = real Whisper transcription via /transcribe.
Synced across all 18 voice-enabled integrations. Phrase stays "What is
the weather in Tokyo?" so aimock's "weather in Tokyo" substring fixture
still matches.
Also adds the missing d5-voice.test.ts companion (every other d5-* probe
script has one) and trims the langgraph-python qa/voice.md + e2e steps
that depended on the now-removed async behavior.
The validate-fixture-tool-surface check on PR #4669 flagged 18 drift
violations: every headless-simple demo carried 'Weather in Tokyo' /
'AAPL stock price' / 'Highlight a note' / 'Sketch a diagram' chips
that substring-match aimock fixtures returning tool calls
(get_weather / get_stock_price / highlight_note / etc.) — but
headless-simple demos only register 'show_card' via useComponent.
Tool-call dispatch had no matching renderer.
Trim the headless-simple chip list to two in-surface entries:
- 'Profile card' → 'Show me a profile card for Ada Lovelace' (existing
show_card fixture; show_card is already registered by useComponent).
- 'Largest continent' → 'What is the largest continent?' (text-only
fixture from Phase 0; no tool dependency).
The chip-click e2e test only asserts on the 'Largest continent' chip,
so the trim is test-compatible.
Headless-complete keeps the canonical 5-chip list (its tool surface
covers weather/stock/highlight/excalidraw via tool-renderers.tsx and
backend agents).
For google-adk/headless-complete: add a useDefaultRenderTool() wildcard
catch-all. The validator looks at page.tsx + hooks/* and a backend
agent file; google-adk's tool registrations live in tool-renderers.tsx
(unparsed) and there's no matching agents/headless_complete.py file,
so the validator saw an empty tool surface. The wildcard registers '*'
which matches every fixture tool — same pattern north-star already
uses in its own tool-renderers.tsx.
## Summary
The 6 beautiful-chat demos (spring-ai, strands, langroid, agno,
claude-sdk-typescript, claude-sdk-python) ship three identical
suggestion chips. Against the deployed aimock-backed showcase, all three
were broken:
| Suggestion | Symptom | Cause |
|---|---|---|
| Plan a 3-day Tokyo trip | Returned a generic "Hi there! I'm your
showcase assistant…" greeting | Substring `"hi"` matches inside
**arc*hi*tecture**, hijacked by the broad `userMessage: "hi"` fixture |
| Explain RAG like I'm 12 | aimock 4xx — `"No fixture matched"` | No
fixture |
| Draft a launch email | aimock 4xx — `"No fixture matched"` | No
fixture |
Verified locally against `showcase up spring-ai` in a headed browser —
all three now return on-topic content.
## Fix
Add three full-sentence fixtures before the broad `"hi"` matcher in
`feature-parity.json`. Aimock's matcher is substring + first-match-wins
by file order, so the long sentence matchers win first and the `"hi"`
fixture is never reached for these prompts. Each returns a plausible
markdown response (3-day Tokyo itinerary, open-book-test analogy,
3-paragraph launch email).
## Regression coverage
Replaced the 1-line beautiful-chat placeholders with a 4-test suite for
all 6 integrations:
- Page loads with heading + chat input
- Each suggestion's reply contains the expected keywords (`Day 1|Day
2|Day 3`, `open-book|retrieval|RAG`, `Subject:|co-pilot|launch`)
- Each test ALSO asserts `toHaveCount(0)` against `/I'm your showcase
assistant/i` — if the broad "hi" fixture re-broadens or the new fixtures
are reordered/removed, the tests fail with a useful message.
## Test plan
- [x] `validate-fixture-tool-surface` clean: 141 fixtures × 628 demos,
no drift
- [x] Manual headed-browser verification on `showcase up spring-ai` —
all 3 suggestions return their on-topic responses
- [ ] CI's `Validate Showcase` job stays green
- [ ] On-demand E2E (`/test-aimock <slug>`) passes for any of the 6
integrations
The 6 beautiful-chat demos (spring-ai, strands, langroid, agno,
claude-sdk-typescript, claude-sdk-python) ship three identical
suggestion chips: "Plan a 3-day Tokyo trip", "Explain RAG like I'm
12", and "Draft a launch email". Against the deployed aimock-backed
showcase, all three were broken:
- Tokyo trip: hijacked by the broad `userMessage: "hi"` fixture,
because the substring "hi" appears inside "arc**hi**tecture" in
the prompt. Returned a generic "Hi there! I'm your showcase
assistant..." greeting with nothing about Tokyo.
- RAG explain: no fixture matched, aimock returned an error.
- Launch email: same — no fixture, error.
Add three on-topic fixtures with the full suggestion sentence as
`userMessage` (effectively-exact substring match). Place them
before the broad "hi" fixture in the file so first-match-wins
routes each suggestion to the right response.
Add a `beautiful-chat.spec.ts` regression suite to all 6
integrations: send each suggestion, assert the right keywords
appear in the assistant reply ("Day 1/2/3" for Tokyo,
"open-book/RAG" for RAG, "Subject:/co-pilot" for email), AND
assert the hijacked greeting is absent. If the broad "hi" fixture
re-broadens or the new fixtures are reordered/removed, these
tests fail loudly.
Bug: in a single chat session, running both HITL booking flows
back-to-back (Alice 1:1 → then Sales call without refresh) used to
skip the time-picker on the second flow and jump straight to
"Booked ..." text.
Cause: confirmation fixtures were matched on `hasToolResult: true`,
which fires whenever the conversation has ANY tool message in
history. After the first flow finished, the second user message
short-circuited to a confirmation match before the second flow's
toolCall fixture (gated on `hasToolResult: false`) had a chance to
fire. The picker never rendered.
Fix: re-key the two confirmation fixtures on `toolCallId` (the
specific tool_call_id of the matching `book_call` invocation), which
only fires when the LAST conversation message is a tool result with
that id — exactly the moment we want the confirmation. Drop the
`hasToolResult: false` constraint on the toolCall fixtures so they
match a fresh user request regardless of prior tool history.
Add a back-to-back regression test to all 17 hitl-in-chat specs:
walk Alice flow to completion, then sales flow without refresh,
assert two `time-picker-card` elements rendered. If the multi-flow
regression returns, the second card never appears and the test
fails at `toHaveCount(2)`.
The hitl-in-chat demo ships in 17 integrations (langgraph-python plus
16 others — mastra, strands, ag2, agno, crewai-crews,
langgraph-typescript, langgraph-fastapi, pydantic-ai, llamaindex,
langroid, claude-sdk-python, claude-sdk-typescript, ms-agent-python,
ms-agent-dotnet, spring-ai, google-adk). All shipped placeholder e2e
specs that only checked the chat input was visible — none exercised
the actual booking flow.
Replace each with the full booking-flow spec written for
langgraph-python:
1. The "Schedule a 1:1 with Alice" suggestion renders the time-picker
card AND the Tokyo greeting is absent (regression guard against
the broad aimock `userMessage: "Alice"` matcher).
2. Picking a slot transitions to the picked-state card and produces
a "Booked … Alice" assistant follow-up.
3. The "Book a call with sales" suggestion runs the same flow with
the sales attendee.
Also add the matching aimock fixture pair for the sales suggestion
in feature-parity.json — without it, case 3 would only pass against
real OpenAI, not the aimock-backed CI deployments. The pair mirrors
the Alice fixture pair: `book_call` toolCall on first turn,
confirmation message after the picker resolves.
Per-integration coverage matters because each integration has its
own framework-specific HITL wiring (`useHumanInTheLoop` binding to
the agent, agent-side tool registration, run streaming protocol)
that can regress independently of the shared aimock fixture.
- Add dedicated tool-free voice agents for strands, llamaindex,
ms-agent-python (aimock returns tool calls when tools are registered,
which the adapters don't loop on)
- Add sample_agent alias to langgraph-typescript langgraph.json
(was only in dev-mode config)
- Add SampleAudioButton and voice route to google-adk
- Add sample.wav to agno, ms-agent-dotnet, ms-agent-python, google-adk
V1 CopilotRuntime in single-route mode rejects multipart/form-data
with 415 Unsupported Media Type. Port all 9 integrations to V2
createCopilotRuntimeHandler which handles the /voice sub-route
natively.
Integrations: claude-sdk-python, claude-sdk-typescript, crewai-crews,
llamaindex, ms-agent-dotnet, ms-agent-python, pydantic-ai, spring-ai,
strands
The D5 conversation runner detects assistant responses via
data-testid="copilot-assistant-message". The byoc-hashbrown demo
overrides the assistantMessage slot with a custom HashBrown renderer,
which dropped that attribute. Without it the harness sees 0 messages
and times out.
Replace gen-ui-interrupt and interrupt-headless "not supported" stubs
with working demos using useFrontendTool + async Promise pattern.
Backend agents use system prompt + tools=[] — CopilotKit runtime
routes tool calls to the frontend handler. Pattern proven by
ms-agent-python/dotnet, now extended to ag2, agno, built-in-agent,
claude-sdk-python, claude-sdk-typescript, crewai-crews, google-adk,
langroid, llamaindex, mastra, pydantic-ai, strands.
Recent feature commits added new dependencies to integration package.json
files (@copilotkit/voice, @hashbrownai/{core,react}, @json-render/{core,react})
and bumped Next.js from 15.4.10 to 15.5.15, but never regenerated the
corresponding package-lock.json. The Showcase Build & Deploy workflow runs
`npm ci --legacy-peer-deps` which strictly enforces lock sync, so every
deploy attempt has been failing at the install step. No new images have been
pushed to GHCR, so Railway services have stayed on stale code and any cell
added since each fw's last successful deploy iframes 404.
Regenerated all 18 lockfiles via `npm install --legacy-peer-deps
--package-lock-only --ignore-scripts` per integration. Verified each with
`npm ci --dry-run --legacy-peer-deps` — all clean.
Refs PDX-90.
The marker-insertion script in ac3885fe0 used a brace counter that
counted opening braces from the destructured function parameters as
the start of the function body, then matched the destructuring's
closing `}` as the body's close. The result on every fw was an
`@endregion[sample-audio-button]` jammed onto the same line as the
destructuring's `}`, with the actual function body falling outside the
region — broken structure plus a format violation (`}// @endregion` on
one line).
Fixes both: strips the broken inline endregion and appends a proper
@endregion marker at end-of-file (which is where the function actually
ends, since these files contain only the single SampleAudioButton
function below the imports + interface). 17 files restored.
Prior commit (878259e20) deployed sibling .snippet.* files for voice across
all 18 frameworks. That was the wrong call — siblings are a *fallback* for
demos that legitimately diverge from the canonical teaching shape. The
voice demos in 17 frameworks already match the canonical (V2 runtime +
TranscriptionService + sample-audio-button), so the right move is to tag
region markers on the real source.
Changes:
- 17 frameworks (everything except google-adk): add `@region[…]` markers
to actual demo source for `voice-runtime`, `transcription-service-guard`,
`voice-page`, `sample-audio-button`. 51 source files modified, no
behavioral changes — just `// @region[name]` / `// @endregion[name]`
comments wrapping existing code.
- crewai-crews/manifest.yaml: add `highlight:` block to the voice demo
with the route file path so the bundler picks up the runtime regions.
Every other framework already had this entry.
- 17 frameworks: delete the wrong sibling files (`voice-runtime.snippet.ts`
and `voice-frontend.snippet.tsx`) that 878259e20 created.
- google-adk: KEEP the two siblings — google-adk genuinely diverges
(uses the shared `/api/copilotkit` route rather than a dedicated
`/api/copilotkit-voice`), which is exactly when the sibling fallback
is the right answer.
Result: snippet audit B-docs-gap = 0; every framework's voice page
renders real demo code via `<Snippet>` refs. The 16 standard frameworks
pull from their actual route.ts / page.tsx / sample-audio-button.tsx;
google-adk pulls from its sibling.
The first pass of /voice.mdx had inline code blocks. Rewrites the page
to use <Snippet> references against per-framework sibling files, matching
how the rest of shell-docs sources its code samples.
- Two siblings per framework (×18 fws = 36 files):
- voice-runtime.snippet.ts: V2 CopilotRuntime + TranscriptionService
setup, including the GuardedOpenAITranscriptionService wrapper that
returns a clean 4xx when OPENAI_API_KEY is missing. Regions:
`voice-runtime`, `transcription-service-guard`.
- voice-frontend.snippet.tsx: chat surface with auto-mic-button, plus
the SampleAudioButton that bypasses the mic for Playwright /
screenshot flows. Regions: `voice-page`, `sample-audio-button`.
- /voice.mdx now uses 4 `<Snippet region="..." />` refs instead of
inline code, so the docs reference real teaching code that lives next
to each framework's actual demo (and stays in sync with the established
per-framework sibling convention from PR #4439).
Jordan Ritter