Conflict resolution: take main's 4-entry migratedIntegrations array and
keep the a2a-middleware-specific contract tests + helper (a2a-middleware
uses app/ root + custom chat, so it doesn't fit the parameterized
src/app contract). 31/31 passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Conflict + post-merge resolutions:
- integration test (add/add): fold into the parameterized batch-2 contract
test; migratedIntegrations now includes langgraph-fastapi (24/24 pass).
- _parity/manifest.json: keep her langgraph-fastapi allowance removals
(threads-drawer/page.tsx/next.config now fully tracked), but drop the
stale strands-python shielding her branch added (example-layout +
docker-route-override divergence, @copilotkit 1.56.5 packageJsonOverrides)
— strands is already parity-synced at 1.59.1 on main; those overrides
would have made the next parity:sync rewrite it back to 1.56.5.
- parity verify on the merged tree: langgraph-js 82 ok / langgraph-fastapi
91 ok / strands-python 83 ok, zero drift.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Conflict resolutions:
- page.tsx: keep the threads layout; swap the dead v1 sidebar labels
(title/initial) for the v2 keys (modalHeaderTitle 'Popup Assistant' +
welcomeMessageText) the starter smoke asserts, and carry over main's
disableSystemMessage + clickOutsideToClose. Keep her useRenderTool
render({ parameters }) — that is the actual v2 RenderToolProps shape;
main's render({ args }) was a latent runtime bug (args is not a prop).
- package.json: keep the drawer UI deps (class-variance-authority, clsx).
- integration test: fold into the parameterized batch-2 contract test;
migratedIntegrations now crewai-flows + llamaindex + pydantic-ai (18/18).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Conflict resolutions:
- page.tsx: keep the threads layout (drawer + gate + provider) and restore
the v2 sidebar labels (modalHeaderTitle 'Popup Assistant' +
welcomeMessageText) the starter smoke asserts, plus clickOutsideToClose.
- layout.tsx: keep the REST-transport explainer comment.
- integration test: keep the parameterized batch-2 contract test from
crewai-flows and add llamaindex to migratedIntegrations (12/12 pass).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Right-pad version tuples so 0.2 and 0.2.0 compare equal (PEP 440), avoiding a
duplicate-version publish that PyPI rejects. Exclude fully-yanked releases when
computing the published max so a yanked high version can't block real bumps.
Fail loud when a 200 response lacks a releases key instead of assuming the
package is new. Surface curl transport errors and add red-green coverage.
Compare against the max numeric version in PyPI `releases` rather than
`info.version` (latest-uploaded, not highest). Apply strict dotted-numeric
validation to the LOCAL version only; non-numeric published versions
(prereleases) are filtered out instead of aborting the script. Add curl
--max-time/--retry hardening and red-green test coverage for both cases.
publish-release.ts now checks npm for each package before publishing
and skips versions that already exist. Makes publish idempotent —
safe to retry after partial failures. Removes the publish-remaining
one-shot workflow that's no longer needed.
Replace pnpm publish with pnpm pack + npx npm@11.15.0 publish to
enable OIDC authentication. Set NODE_AUTH_TOKEN='' to prevent the
expired secret from blocking OIDC. Removes test workflow.
Remove pnpm run build (and pnpm run test) calls from publish-release.ts
and prerelease.ts so that repository build code never executes with
NPM_TOKEN in the environment. The CI build job (contents: read, no
secrets) now handles all building and testing, uploading pre-built
artifacts for the publish job to consume.
For prerelease: extract version bumping into a new bump-prerelease.ts
script that runs in the build job before the build step, ensuring the
built artifacts contain the correct canary version numbers.
Also fix prerelease build job to use persist-credentials: false,
matching the publish-release build job pattern.
Upstream renamed sdk-python/copilotkit/langgraph_agent.py to
langgraph_agui_agent.py and the class to LangGraphAGUIAgent. Update the V1
reference autogen entry in scripts/docs/lib/files.ts to point at the new
source and class name, and regenerate the shell-docs MDX. Pipeline now
reports 26/26 entries succeeding (was 25/26).
Update scripts/docs to write directly into showcase/shell-docs/src/content/reference/
(consumed by /reference/[...slug]) instead of the legacy docs/content/docs tree.
Adds repo-root cwd anchoring, mkdir -p on the destination, allSettled so a single
missing source doesn't abort the run; generates 25 MDX pages (20 V1 + 5 SDK) and
shell-docs build passes.
The model-name allowlist (`docs/model-allowlist.json`) ships
`gpt-5.4` and `gpt-5.4-mini` but never `gpt-5.2*` — the latter slipped
in during a model-bump cycle and was never caught because the CI
validator only scanned the legacy `docs/` tree.
- Sweep replace `gpt-5.2-mini` -> `gpt-5.4-mini` and `gpt-5.2` ->
`gpt-5.4` across `showcase/shell-docs/src/content/` (~17 files).
- Extend `scripts/validate-doc-model-names.ts` with an
`EXTRA_DOCS_DIRS` list so the validator now scans the shell-docs
content tree alongside the legacy Nextra tree under `docs/`,
preventing the same drift in future.
Reverts the 14 other framework bumps and 2 lockfile regens. Each
framework needs per-framework QA against 1.56.4 before being shipped
in a sweep — too risky for the demo timeline to bump them all at once.
The validator now uses an explicit ENFORCED allowlist (currently just
adk) with an inline comment documenting the scope decision. Other
integrations get added to ENFORCED as QA clears each framework. The
structural fix (release-please automation that bumps integrations in
lockstep on each release) is tracked in CPK-7534.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The CLI scaffolder (npx copilotkit create -f <fw>) clones from
examples/integrations/<fw>/ on main. The @copilotkit/* deps in those
package.json files are bumped manually on release; 14 of 17 integrations
fell behind. Notable: ADK pinned 1.55.2 (missing useFrontendTool), mcp-apps
at 1.52.1, a2a-middleware floating on "latest". Issue #4253.
Adds scripts/validate-integration-pins.ts + a vitest live-tree check that
fails when any integration pins lag the monorepo release version, so the
gap can't reopen silently on the next release.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Resolves textual conflicts in manifest.yaml and docs-links.json (keeps
both open-gen-ui* from main and agent-config from this branch). Accepts
main's deletion of generated shell*/src/data/*.json (now gitignored).
Bumps langgraph-python feature/demo count test from 32 to 33.
Wave 4a. Port the starter's hashbrown renderer into a dedicated
single-mode langgraph-python demo at /demos/byoc-hashbrown so the
byoc-hashbrown row goes green on the dashboard.
- @hashbrownai/core + @hashbrownai/react + recharts deps added.
- Dedicated /api/copilotkit-byoc-hashbrown route with byoc_hashbrown
graph (ChatOpenAI + CopilotKitMiddleware) and a catalog-aware
system prompt coaching the LLM to emit a <ui>...</ui> envelope.
- Ported MetricCard + bar-chart + pie-chart + chart-config from
showcase/starters/template/frontend with data-testid hooks on
chart roots for E2E coverage.
- Ported hashbrown renderer with local RenderMessageProps /
AssistantMessage types so @copilotkit/react-ui and @ag-ui/core
do not become direct deps of this package.
- Updated hashbrown schema calls to @0.5.0-beta.4 surface:
enumeration for SalesStage; description-first streaming.array +
object; dropped the non-existent .optional() chain.
- v2 CopilotChat uses messageView.assistantMessage slot and
useConfigureSuggestions for 3 canned prompts (sales dashboard /
revenue by category / expense trend).
- QA checklist + Playwright E2E authored (not run pre-deploy).
- Manifest / constraints / docs-links updated and derived registry +
demo-content + docs-status bundles regenerated.
- Extend scripts/hooks/check-binaries.sh whitelist to include the
shell-docs and shell-dojo demo-content bundles so the pre-commit
hook does not reject the regenerated 1.5 MB files it produced.
Integrates @json-render/{core,react} as an alternative BYOC generative-UI
rendering technology in langgraph-python, paired with Wave 4a's hashbrown
demo. Both demos share the same sales-dashboard catalog (MetricCard +
BarChart + PieChart) so the dashboard rows are directly comparable.
- Adds @json-render/{core,react} @ 0.18.0 pinned.
- New /demos/byoc-json-render page using CopilotChat's messageView.assistantMessage
slot to bridge CopilotKit output into @json-render/react Renderer.
- New /api/copilotkit-byoc-json-render route + byoc_json_render graph in
langgraph.json.
- Zod-validated catalog reusing @json-render/react/schema's prebuilt spec shape.
- System prompt with 3 worked examples inlined so the agent emits valid
{ root, elements } JSON deterministically.
- QA checklist + Playwright spec authored (E2E run deferred to post-deploy
stabilization).
- Adds shell-docs/shell-dojo demo-content.json to the check-binaries.sh
allowlist (same 1MB-allowed rationale as shell/demo-content.json).
Declare open-gen-ui and open-gen-ui-advanced in langgraph-python
manifest (code existed, was never registered). Add both to
constrained-explicit allowlist, fill shell_docs_path for 5 demos,
add hitl-in-app override, drop stale chat-customization-css fallback.
Regenerate registry.json, demo-content.json, constraints.json,
and docs-status.json across shell / shell-dojo / shell-docs.
Bump feature/demo count assertion 30→32 in generate-registry test.
Extend check-binaries.sh whitelist for sister-shell demo-content.
- Add top-level 'permissions: contents: read' — the workflow performs
no repo writes, so declaring the minimum explicitly closes a
default-token hardening gap.
- Serialize publishes with concurrency: group: vscode-extension-publish,
cancel-in-progress: false. Two rapid pushes to main used to race
straight into vsce publish; the second failed noisily on duplicate
version or, worse, published out of order.
- Remove the 'Lint' step. The Nx target 'copilotkit-vscode-extension:lint'
doesn't exist and there's no 'lint' npm script either, so the step
always failed — 'continue-on-error: true' just hid it while never
actually linting anything. Re-add once a real lint target lands.
check-binaries.sh:
- Replace '[ ] && exit 1 / exit 0' with an explicit 'if [ ]; then
exit 1; fi; exit 0' block. Under 'set -e' the old form was safe
only because the trailing 'exit 0' existed; the explicit form is
robust regardless of what follows.
Critical
- scripts/hooks/check-binaries.sh: restore showcase data-file exclusions
(demo-content / search-index / starter-content >1 MB) that the inline
refactor dropped; add 'set -eu' so silent shell failures don't hide
policy violations.
- packages/vscode-extension/src/extension/preview-panel.ts: drop 'blob:'
from CSP script-src — it lets arbitrary-string JS execute via Blob URL
and defeats most of CSP's XSS protection.
- packages/vscode-extension/package.json: set private: true. The extension
ships as a .vsix via vsce, not npm, and workspace:* devDependencies
would break an accidental 'npm publish'.
Important
- runtime: forward the real agentId from handleConnectAgent into
handleSseConnect / createSseEventResponse so DebugEventBus envelopes
on /connect carry the actual agent name instead of the literal
'connect'. Updates handle-connect.ts, sse/connect.ts.
- hooks/panel.ts CSP: narrow connect-src from 'https:' to just the
Tailwind CDN. The preview path never drives a real CopilotKit runtime
— all hook calls route through the stub — so there's no legitimate
https: fetch to allow from inside bundled user code.
- extension/utils.ts getNonce(): switch to crypto.randomBytes. Math.random()
is not acceptable for a value that gates inline-script execution.
- .github/workflows/vscode-extension.yml:
* Build step uses 'nx run copilotkit-vscode-extension:build' instead
of 'pnpm run build' (targeted build with Nx caching, not full
monorepo rebuild).
* Added explicit 'Type check' step (tsc --noEmit).
* Added Lint step gated with continue-on-error until the Nx target
exists, so a missing target doesn't break the pipeline.
* Publish job now queries the Marketplace for the current published
version and skips 'vsce publish' when the local package.json
version matches — stops every docs/CI-only push to main from
failing on duplicate-version errors.
- hooks/hook-scanner.ts: bound the synchronous walk at 20 000 files so a
pathologically large workspace can't freeze the extension host; flag
kept in module-level constant with a rationale comment.
- sse-response.ts: document that debugEventBus.broadcast intentionally
runs before the stream-closed gate so debug subscribers see trailing
events even after the SSE client disconnects.
- inspector-panel.ts: subscribe to DebugStream lazily on show() rather
than in the constructor; unsubscribe on panel dispose. Avoids firing
the event callback on every envelope when no panel is open.
Suggestions
- fetch-router.ts: document 'debug-events' as a reserved route so it
can't be shadowed by an agent literally named 'debug-events'.
- activate.ts findValuePosition: add optional startOffset parameter,
document the first-occurrence limitation + the follow-up path for
per-fixture precision.
- activate-hook-explorer.ts isInsideWorkspace: fix JSDoc to reflect the
code (root itself is excluded).
The inline check-binaries hook broke on Windows Git Bash because lefthook invoked
it via sh.exe -c with the multi-line YAML script as a single argument, and the
nested quotes inside (`echo "$STAGED" | grep -iE '...'`) got mangled during
Windows command-line argument escaping. Move it to scripts/hooks/check-binaries.sh
so lefthook just invokes bash against a file, avoiding the escaping issue.
Also scope the root test script (and test:coverage) to --projects=packages/**,
mirroring check:packages. The previous unscoped nx run-many -t test triggered
showcase starter generation tests that fail on leftover state from prior runs;
these aren't relevant to the pre-commit gate, which is about verifying shipped
packages.
Benjamin Taylor