skills/copilotkit__copilotkit
1
0
Fork 0
mirror of https://github.com/CopilotKit/CopilotKit.git synced 2026-09-14 16:26:20 +08:00
Code Issues Packages Projects Releases Wiki Activity
16,407 Commits 502 Branches 1,483 Tags
main
Commit Graph

16407 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
renovate[bot] 178b74685e chore(deps): update github actions (#7117) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[actions/setup-dotnet](https://redirect.github.com/actions/setup-dotnet)
| action | major | `v5` → `v6` |
| [actions/setup-go](https://redirect.github.com/actions/setup-go) |
action | major | `v6` → `v7` |
| [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) |
action | minor | `v10.0.1` → `v10.1.0` |
| [pnpm/action-setup](https://redirect.github.com/pnpm/action-setup) |
action | minor | `v6.0.10` → `v6.1.0` |
|
[reviewdog/action-actionlint](https://redirect.github.com/reviewdog/action-actionlint)
| action | minor | `v1.73.4` → `v1.74.0` |

---

### Release Notes

<details>
<summary>actions/setup-dotnet (actions/setup-dotnet)</summary>

###
[`v6.0.0`](https://redirect.github.com/actions/setup-dotnet/releases/tag/v6.0.0)

[Compare
Source](https://redirect.github.com/actions/setup-dotnet/compare/v5.4.0...v6.0.0)

##### What's Changed

- Migrate to ESM and upgrade dependencies by
[@&#8203;priyagupta108](https://redirect.github.com/priyagupta108) in
[#&#8203;752](https://redirect.github.com/actions/setup-dotnet/pull/752)
- Bump actions/checkout from 6.0.3 to 7.0.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;751](https://redirect.github.com/actions/setup-dotnet/pull/751)
- chore(deps): bump
[@&#8203;actions/cache](https://redirect.github.com/actions/cache) to
6.2.0 by [@&#8203;philip-gai](https://redirect.github.com/philip-gai) in
[#&#8203;756](https://redirect.github.com/actions/setup-dotnet/pull/756)

##### New Contributors

- [@&#8203;philip-gai](https://redirect.github.com/philip-gai) made
their first contribution in
[#&#8203;756](https://redirect.github.com/actions/setup-dotnet/pull/756)

**Full Changelog**:
<https://github.com/actions/setup-dotnet/compare/v5...v6.0.0>

</details>

<details>
<summary>actions/setup-go (actions/setup-go)</summary>

###
[`v7.0.0`](https://redirect.github.com/actions/setup-go/releases/tag/v7.0.0)

[Compare
Source](https://redirect.github.com/actions/setup-go/compare/v6.5.0...v7.0.0)

##### What's Changed

- Migrate to ESM and upgrade dependencies by
[@&#8203;priyagupta108](https://redirect.github.com/priyagupta108) in
[#&#8203;763](https://redirect.github.com/actions/setup-go/pull/763)
- chore(deps): bump
[@&#8203;actions/cache](https://redirect.github.com/actions/cache) to
6.2.0 by [@&#8203;philip-gai](https://redirect.github.com/philip-gai) in
[#&#8203;771](https://redirect.github.com/actions/setup-go/pull/771)

##### New Contributors

- [@&#8203;philip-gai](https://redirect.github.com/philip-gai) made
their first contribution in
[#&#8203;771](https://redirect.github.com/actions/setup-go/pull/771)

**Full Changelog**:
<https://github.com/actions/setup-go/compare/v6...v7.0.0>

</details>

<details>
<summary>astral-sh/setup-uv (astral-sh/setup-uv)</summary>

###
[`v10.1.0`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.1.0):
🌈 New output `python-runtime-id`and respect NO_PROXY

[Compare
Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.0.1...v10.1.0)

##### Changes

This release adds more bheind the scene security improvements and also 2
small improvements.

##### NO\_PROXY

This action now respects `no_proxy/NO_PROXY` environment variables which
were previously ignored.

##### New output `python-runtime-id`

The new output `python-runtime-id` can be used to know which python
version exactly was installed if you use `activate-environment`. See
[pyca/cryptography#15572
(comment)](https://redirect.github.com/pyca/cryptography/pull/15572#discussion_r3913508686)
for details on why this can be useful.

##### 🐛 Bug fixes

- fix: respect no proxy directive
[@&#8203;mj0nez](https://redirect.github.com/mj0nez)
([#&#8203;1037](https://redirect.github.com/astral-sh/setup-uv/issues/1037))
- Use JSON + a typed wrapper instead of TS codegen
[@&#8203;woodruffw](https://redirect.github.com/woodruffw)
([#&#8203;1025](https://redirect.github.com/astral-sh/setup-uv/issues/1025))

##### 🚀 Enhancements

- Expose a Python "identity" output
[@&#8203;woodruffw](https://redirect.github.com/woodruffw)
([#&#8203;1036](https://redirect.github.com/astral-sh/setup-uv/issues/1036))
- Verify downloads with astral-sh/versions checksums
[@&#8203;zaniebot](https://redirect.github.com/zaniebot)
([#&#8203;1033](https://redirect.github.com/astral-sh/setup-uv/issues/1033))

##### 🧰 Maintenance

- chore: update known checksums for 0.12.12
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;1041](https://redirect.github.com/astral-sh/setup-uv/issues/1041))
- chore: update known checksums for 0.12.10/0.12.11
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;1038](https://redirect.github.com/astral-sh/setup-uv/issues/1038))
- chore: update known checksums for 0.12.9
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;1035](https://redirect.github.com/astral-sh/setup-uv/issues/1035))
- chore: update known checksums for 0.12.7/0.12.8
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;1031](https://redirect.github.com/astral-sh/setup-uv/issues/1031))
- chore: update known checksums for 0.12.6
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;1030](https://redirect.github.com/astral-sh/setup-uv/issues/1030))
- chore: update known checksums for 0.12.5
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;1020](https://redirect.github.com/astral-sh/setup-uv/issues/1020))
- Use self-repo syntax for all in-repo actions/reusable workflows
[@&#8203;woodruffw](https://redirect.github.com/woodruffw)
([#&#8203;1024](https://redirect.github.com/astral-sh/setup-uv/issues/1024))
- Pin one-shot tools
[@&#8203;woodruffw](https://redirect.github.com/woodruffw)
([#&#8203;1022](https://redirect.github.com/astral-sh/setup-uv/issues/1022))
- ci: remove obsolete direct push attempts
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;1019](https://redirect.github.com/astral-sh/setup-uv/issues/1019))

##### 📚 Documentation

- docs: update version references to v10.0.1
@&#8203;[github-actions\[bot\]](https://redirect.github.com/apps/github-actions)
([#&#8203;1018](https://redirect.github.com/astral-sh/setup-uv/issues/1018))

##### ⬆️ Dependency updates

- chore(deps-dev): roll up Dependabot updates
[@&#8203;eifinger](https://redirect.github.com/eifinger)
([#&#8203;1043](https://redirect.github.com/astral-sh/setup-uv/issues/1043))
- Harden npm install defaults
[@&#8203;zaniebot](https://redirect.github.com/zaniebot)
([#&#8203;1026](https://redirect.github.com/astral-sh/setup-uv/issues/1026))
- Add dependency cooldowns
[@&#8203;woodruffw](https://redirect.github.com/woodruffw)
([#&#8203;1021](https://redirect.github.com/astral-sh/setup-uv/issues/1021))

</details>

<details>
<summary>pnpm/action-setup (pnpm/action-setup)</summary>

###
[`v6.1.0`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.1.0)

[Compare
Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.10...v6.1.0)

##### What's Changed

- feat: support pnpm v12 by
[@&#8203;zkochan](https://redirect.github.com/zkochan) in
[#&#8203;288](https://redirect.github.com/pnpm/action-setup/pull/288)

**Full Changelog**:
<https://github.com/pnpm/action-setup/compare/v6.0.10...v6.1.0>

</details>

<details>
<summary>reviewdog/action-actionlint
(reviewdog/action-actionlint)</summary>

###
[`v1.74.0`](https://redirect.github.com/reviewdog/action-actionlint/releases/tag/v1.74.0)

[Compare
Source](https://redirect.github.com/reviewdog/action-actionlint/compare/v1.73.4...v1.74.0)

#### What's Changed

- docs: update README to include required permissions for action by
[@&#8203;shogo82148](https://redirect.github.com/shogo82148) in
[#&#8203;229](https://redirect.github.com/reviewdog/action-actionlint/pull/229)
- Improve example in readme by
[@&#8203;shogo82148](https://redirect.github.com/shogo82148) in
[#&#8203;230](https://redirect.github.com/reviewdog/action-actionlint/pull/230)
- chore(deps): update reviewdog to 0.21.1 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;231](https://redirect.github.com/reviewdog/action-actionlint/pull/231)

**Full Changelog**:
<https://github.com/reviewdog/action-actionlint/compare/v1.73.4...v1.74.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Los_Angeles)

- Branch creation
  - "before 9am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/CopilotKit/CopilotKit).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
 2026-09-14 08:19:56 +00:00
renovate[bot] 6f0f19731b chore(deps): update github actions 2026-09-14 07:56:41 +00:00
Ran Shemtov 6bc47aea86 feat(showcase): run the AWS Strands demos on the native interrupt and register the reasoning cells (#6907) 
## What this does

Makes the two AWS Strands showcase columns a truthful acceptance test
for the
refreshed AG-UI Strands bridges: the interrupt demos now run on Strands'
native
interrupt instead of a frontend-tool stand-in, the reasoning cells are
registered
and backed by a reasoning-capable agent, and the fixtures that could
never have
matched their shared probes are corrected.

### Interrupts, now native (both languages)

`gen-ui-interrupt` and `interrupt-headless` were quarantined as
unsupported and
were driven by a frontend tool with an async handler. Both bridges
implement the
AG-UI interrupt protocol on top of Strands' own interrupt primitive

([docs](https://strandsagents.com/docs/user-guide/concepts/interrupts/)),
so the
demos now use it:

- New dedicated agents (`src/agents/interrupt_agent.py`,
`src/agent/interrupt-agent.ts`) whose `schedule_meeting` tool pauses
itself
  with `tool_context.interrupt(...)` / `context.interrupt(...)`.
- They are mounted on their own sub-path rather than added to the shared
agent,
because `hitl-in-chat` registers a FRONTEND tool of the same name and
one tool
  name cannot be both client-executed and backend-pausing.
- `interrupt-headless` was rebuilt on `useInterrupt({ renderInChat:
false })`,
matching the reference integrations, replacing a hand-rolled
custom-event
  subscriber that only ever matched LangGraph's legacy interrupt shape.
- Quarantine lifted, `interrupt_pattern` is now `native`, and the stale
prose in
`PARITY_NOTES.md` and `agents/agent.py` that claimed Strands has no
interrupt
  primitive is corrected.

### Reasoning, now registered

`reasoning-default`, `reasoning-custom` and
`tool-rendering-reasoning-chain` were
listed under two DEPRECATED registry ids, so the dashboard showed
nothing at all
while the demo pages pointed at agent names the runtime never
registered. They
now run against dedicated agents on the OpenAI Responses API with
reasoning
summaries enabled; the shared agent stays on chat completions so tool
arguments
keep streaming incrementally.

### Fixtures that could not match

- The interrupt fixtures keyed on phrases that appear in neither pill
prompt, so
no leg could ever match the shared probes. Rewritten on the reference
shape,
  including the cancel leg.
- Several generic legs matched on turn number where the reference
matches on
whether the tool has already answered. That is what made the
reasoning-chain
demo loop (80 tool results, no run finish) and the async frontend-tool
demo
  re-fire its tool 60 times.

### Shared probe

An interrupt turn ends at the pause: the meaningful output is the
mounted picker
and, on a bridge that emits the tool call before pausing, no assistant
prose ever
lands. The gen-ui-interrupt probe settled on assistant-text stability,
so the
turn timed out before its own assertions ran. It now uses the harness's
documented `completeOnMount` opt-in for surface-shaped turns;
run-finished and
new-bubble conjuncts still apply.

## Pins

| Package | Before | After |
|---|---|---|
| `ag_ui_strands` | 0.2.2 | 0.4.0 |
| `ag-ui-protocol` | 0.1.18 | 0.1.22 |
| `strands-agents[OpenAI]` | 1.18.0 | 1.54.0 |
| `strands-agents-tools` | 0.2.16 | 0.8.8 |
| `openai` (Python) | 1.109.1 | 2.54.0 |
| `@strands-agents/sdk` | 1.6.0 | 1.16.0 |
| `@ag-ui/aws-strands` | 0.2.3 | 0.3.0 |
| `@ag-ui/core`, `@ag-ui/client`, `@ag-ui/encoder` | 0.0.57 | 0.0.59 |
| `@copilotkit/*` | 1.68.2 | 1.68.2 (repo-wide canonical pin, untouched)
|

`ag_ui_strands` 0.4.0 is not optional: the Python bridge's interrupt
protocol first appears in the
0.3 line (0.2.5 has no interrupt code at all), and 0.4.0 carries the
bridge fixes this branch was
verified against. The companion bumps are not optional either, because
neither container starts
without them: the Python bridge requires `ag-ui-protocol` 0.1.22, and
the TypeScript one requires
the AG-UI core packages at 0.0.59. `strands-agents` 1.54.0 is not
optional either: the
Responses model that carries reasoning summaries first appears in 1.32,
and on 1.32 the bridge
emitted no reasoning events at all, verified at the wire. `openai` 2.x
is required by the
Responses model and is the ceiling `langchain-openai` allows.

## D6 state, before and after

Before, both columns: `gen-ui-interrupt` and `interrupt-headless`
quarantined as
`not_supported`; `reasoning-default` and `reasoning-custom` absent (the
manifest listed two
DEPRECATED registry ids instead, and the demo pages pointed at agent
names the runtime never
registered); `tool-rendering-reasoning-chain` `not_supported` with no
reason recorded;
`shared-state-streaming` `not_supported` with no reason recorded.

After, per-cell isolated D6 runs on this branch (one stack per cell,
harness image
carrying the probe changes):

| Cell | strands | strands-typescript |
|---|---|---|
| gen-ui-interrupt | green | green |
| interrupt-headless | green | green |
| reasoning-default | green | green |
| reasoning-custom | green | green |
| tool-rendering-reasoning-chain | green | green |
| tool-rendering | not re-run after the fixture edit (see below) | green
|
| frontend-tools-async | green | green |
| shared-state-streaming | unsupported, reason recorded | unsupported,
reason recorded |

`shared-state-streaming` stays unsupported because neither bridge maps a
Strands stream event
onto AG-UI's `STATE_DELTA`; both emit state snapshots only. The manifest
now says so.

## Escalations

Both bridge limitations this branch originally reported have since been
fixed and released, and
both fixes are verified here at the wire against a live model:

1. **Interrupt payload channel drift, fixed.** The two bridges used to
disagree on where a paused
tool's reason travels, so the demo pages had to read both channels. The
released TypeScript
bridge now carries it under the interrupt's `metadata.reason`, matching
Python.
2. **The TypeScript bridge dropped tool calls from the closing snapshot,
fixed.** After a tool run
the final snapshot used to contain only the user message and the
assistant's text, so
tool-rendered cards unmounted when the run finished. Both the tool-call
message and its result
now survive. The same class of loss affected attachments, which is
covered above.

3. **Two cells red locally on both columns and not in this ticket's
scope:**
`gen-ui-open-advanced` and `gen-ui-headless-complete`. The last
production sweep had this
integration fully green, so these are regressions relative to prod.
Re-running
`gen-ui-open` with this branch's fixture edits stashed still failed,
which rules the fixture
edits out; finding 2 above is the most likely cause for the
card-mounting cells. Worth its own
   ticket rather than widening this one.
4. **`@copilotkit/angular` does not build on `main`**
(`ChangeDetectionStrategy.Eager` is not a
member of the enum in the installed Angular). The showcase test
lifecycle builds the shared
Angular artifact, so this blocks every local showcase run until someone
fixes it or has a
   prebuilt artifact lying around.

## Review findings fixed on this branch

Two review rounds ran over the diff. The load-bearing defects they
found, all fixed here:

- The resume envelope was read one way on each side. TypeScript
understood only the shape the
Python bridge produces, so a valid pick came back to the model as "user
did not pick a time";
reproduced at the wire on a real model. Both sides now accept both
shapes.
- Cancel was asymmetric in the same way: a cancel wrapped as
`{"response": {"status": "cancelled"}}`
was reported as "did not pick a time", and a truthy non-boolean cancel
flag cancelled on one
  side and booked on the other.
- An empty label swallowed a valid time on the TypeScript side only.
- The headless resume waited on a single animation frame, which never
fires in a background tab,
  leaving the run paused forever.
- A rejected resume left a green "Booked" badge standing, and the picker
stayed clickable while
  the resume was in flight.
- The headless probe searched the whole page for booking words, which
the demo's own static copy
already satisfies, and the pick-path spec asserted only that a bubble
was visible, which the
pre-pause bubble already satisfies. Both now assert something the
failure mode cannot produce.
- The rationale for the dedicated mount named the wrong tool, the
TypeScript integration cited
Python API names, and the shared docs described a hook the embedded
snippet does not show and
  put a standard interrupt's payload in the wrong place.

## Verification

- **D6 aimock replay**, isolated stacks, harness image rebuilt before
the runs that depend on
probe changes: strands 40 cells / 37 pass, strands-typescript 42 cells /
38 pass. Remaining
  reds are the two out-of-scope cells above.
- **Playwright e2e** against aimock-backed containers: strands 17/17
across both interrupt demos
and both reasoning demos; strands-typescript 8/8 on the interrupt specs
(including the
cancel-path narration regression) and 13/14 on reasoning plus the chain,
the single failure
  being the chain spec's stock-card count, which finding 2 explains.
- **Real model**, no aimock, real OpenAI: on both languages the
interrupt tool pauses with
`RUN_FINISHED outcome=interrupt` carrying the model's own topic and
attendee, and resuming the
same thread with `resume[]` finishes the run with the booking narrated
back. Reasoning summaries
  stream from the Responses-API agents on both languages.
- **Suspicion check.** The interrupt cells did not pass first try: they
failed as
`reason=text-unstable` until the probe change, and the reasoning cells
stayed red until the
image genuinely carried the bumped SDK. Both fixture defects were
reproduced against a
standalone aimock before and after the fix, with the reference
integration as the control.

## Two things the review caught that this branch had broken

- **A Python test regression, not a pre-existing failure.**
`test_instrumentor_patch` fails on
`main` only when that one file runs alone; the full suite is green there
because earlier modules
leave the agent modules cached and the real imports never execute. This
branch adds a reasoning
agent built at import time whose model import sits inside the function
body, which module
caching cannot hide, so the full suite went green to red,
deterministically, and CI does run it.
The cause was that the test's stub modules were never importable as
packages: Python reads the
parent's `__path__` before consulting any meta-path finder, so the stub
finder was never
reached. The stubs now carry an empty `__path__` and are removed again
afterwards, and all seven
test files pass individually as well as together, which was true on
neither this branch nor main
  before.
- **Nothing in CI ran the TypeScript unit tests under
`showcase/integrations`.** The Python half of
that tree is gated; its TypeScript half was not, so four test files in
the Strands agent,
including this branch's new one, could fail indefinitely unnoticed. A
workflow now runs them.


## Verified on the released bridges

Both columns re-run end to end against a live OpenAI endpoint with the
released bridges in the
containers: python 138 passed, typescript 141 passed.

The multimodal round trip that the TypeScript bridge used to break is
fixed at both levels. The
bridge returns the user message with its parts intact for inline data,
url and pdf sources, and the
demo renders the image and the document chip; all four of its specs
pass, having failed under both
live and replay before.

The remaining failures are the same 46 on both columns. They are specs
asserting the wording the
aimock fixtures author, which a real model has no reason to reproduce:
one expects a humidity
reading of 55% where the model answered 77%, another expects a greeting
quoted verbatim from the
fixture. An identical failure set across two independently written
bridges is what rules the
bridges out as the cause, and it is the open question this branch leaves
behind: whether those
specs should be loosened or explicitly skipped on live runs.

## What is not verified

The local Docker engine died partway through this work and could not be
brought back from a
non-interactive session: its pull path wedged first (a plain `docker
pull hello-world` hangs while
the host reaches the registry in 0.33s), the VM ran out of disk, and
after a restart the engine
never came up again. Consequences, stated plainly rather than papered
over:

- Every green cell in the table above was run BEFORE the second review
round. The probe and spec
changes from that round (the headless probe's narration check, the
pick-path narration
assertion, the app-surface scoping) make those assertions strictly
stricter, and they have not
been re-run. They typecheck and the unit suites pass, but the D6 cells
need one more sweep.
- `tool-rendering` on the Python column is the one ticket cell with no
post-fix run at all. Its
single red was the showcase CLI failing to start (`Unknown command:
test`), not a probe failure,
and the same cell is green on the TypeScript column with the same
fixture edits.
- Three fixture predictions from the review (two `turnIndex` ordering
claims and one cancel-gate
claim) contradict passing per-cell runs on this branch. They were left
alone rather than changed
on a prediction, and they cannot be re-tested until the engine is back.

Two local workarounds were used and are recorded here because they
affect how the results were
obtained, not what shipped: the harness image was refreshed by compiling
the harness with its own
build script and layering the resulting `dist` onto the existing image
(exactly what the real
Dockerfile's runtime stage copies), and `alpine:3.19` was tagged locally
from `alpine:latest` so
the pocketbase test-infra image could rebuild. Neither touches the
repository.

One further open question from the review, worth a look before merge:
the aimock build the
showcase scripts pin treats a fixture's `turnIndex` as a ranking hint in
relaxed mode, where an
older build still treats it as a hard gate. Driven directly against the
checked-in fixtures, the
newer matcher picks the `turnIndex` leg over the tool-call-chained legs
for three tool-rendering
pills. That contradicts the passing per-cell runs, and the same
behaviour reproduces against the
gold integration's fixtures on main, so it reads as repo-wide and
pre-existing rather than
something this branch introduced. Which build the local D6 stack
actually loaded could not be
settled without a running engine.
 2026-09-14 09:55:53 +02:00
Ran Shemtov 03ea9c86d2 Merge branch 'main' into claude/xenodochial-khayyam-873a16 2026-09-14 09:40:13 +02:00
Ben Taylor abaec72f36 feat(mcp-apps-renderer): extract shared framework-agnostic MCP Apps host package (React pilot) (#6884) 
## Summary

Extracts a single, framework-agnostic MCP Apps host package and migrates
the React host onto it as a thin adapter. This is the pilot step of
#6823: it creates the shared core the issue asks for and proves it
against the React renderer, so Vue and Angular can follow by deleting
their hand-rolled protocol code.

Part of #6823. Builds directly on #6707 (which migrated the React host
onto `@modelcontextprotocol/ext-apps`); this PR lifts that exact,
reviewed implementation into a shared package with no behavior change.

## What lands here

**New package `@copilotkit/mcp-apps-renderer`** owning the whole
app/host protocol layer on top of `@modelcontextprotocol/ext-apps`:

- `bindMcpApp({ iframe, getContent, getAgent, host, hooks })`: connects
the `AppBridge` over a `PostMessageTransport`, fetches the widget
resource through the agent proxy, wires `ui/message` (role/followUp via
`_meta.copilotkit`, with the #5819 thread-capture semantics preserved),
`ui/open-link` (scheme denylist), the `tools/call` + `resources/read`
proxy through the per-thread request queue, size-changed, and tool
input/result forwarding. The adapter owns the iframe; the core only
talks to it through the bridge (never creates, moves, or removes it).
- Bridge-free `./activity` subpath exporting only the activity type,
content schema, and follow-up runner (no ext-apps), so registering the
activity never pulls the bridge bundle. `MCP_APPS_PROTOCOL_VERSION`
lives on the bridge side (`session.ts`), sourced directly from the
ext-apps `/app-bridge` export, so there is a single source of truth with
no hand-maintained literal and the `/activity` entry stays bridge-free.
- `buildSandboxHTML`, the request queue, and the content schema.

**react-core becomes a thin adapter (FR-007 dependency move).**
`MCPAppsActivityRenderer.tsx` drops from a 786-line self-contained
implementation to a ~250-line React shell that creates the iframe and
wires the session hooks to React state. react-core drops its direct
`@modelcontextprotocol/ext-apps` dependency and the
`@modelcontextprotocol/sdk` peer + devDependency, and depends on
`@copilotkit/mcp-apps-renderer` instead. The new package is the sole
owner of the MCP libraries (sdk moves from a peer to a dependency there,
satisfying ext-apps' required sdk peer). react-core keeps its `zod` peer
at `>=3.25`: that floor did not go away with the MCP libraries, it moved
down to the package, and both MCP libraries hard-require it, so lowering
it would be an install failure once an MCP App renders.

## Dependency model (aligned with `@copilotkit/a2ui-renderer`)

react-core depends on `@copilotkit/mcp-apps-renderer` as a regular
workspace `dependency`, matching the established
`@copilotkit/a2ui-renderer` precedent (same architectural role: a
framework-agnostic renderer registered as a built-in activity renderer).
We go one step further than a2ui on runtime cost: `bindMcpApp` is loaded
via a lazy dynamic `import("@copilotkit/mcp-apps-renderer")` inside the
effect, so a non-MCP `<CopilotKit>` app pays zero bundle cost for the
bridge (verified in the built output: the main chunk statically imports
only the bridge-free `/activity` entry;
`AppBridge`/`PostMessageTransport`/sandbox code appear only behind the
dynamic import).

The remaining install-surface question (making ext-apps an optional peer
so non-MCP consumers shed the sdk tree entirely) is the
separately-scoped follow-up called out on #6707; it is a contract change
that deserves its own PR and release note, and it is not coupled to this
extraction. Raising it here so it stays on the record.

## Behavior changes to note

Two small behavior changes vs `main` in the React adapter (both
improvements):

- The bind effect's deps narrow to `[agent, copilotkit, resourceUri,
serverHash, serverId]`. On `main`, any `content` identity change re-ran
the fetch effect (its guard only applied while a fetch was in-progress),
causing a fresh `resources/read` plus a full iframe teardown/recreate as
results streamed in. This PR stops that.
- `crypto.randomUUID()` becomes `randomUUID()` from
`@copilotkit/shared`, which also works outside a secure context.

Inherited unchanged from the #6707 ext-apps migration, re-pinned by
tests here:

- `ui/initialize` is validated against the spec schema by the bridge: a
widget omitting required fields (e.g. `appCapabilities`) fails
initialize with `-32603`, and the host advertises only its own latest
MCP Apps version (`2026-01-26`) rather than echoing the widget's.
Package-level e2e tests pin this contract both ways.
- `ui/open-link` without a `url` returns `-32603` (the bridge validates
params ahead of the handler) rather than `-32602`.

## Protocol single-sourcing

The package is the single source of `LATEST_PROTOCOL_VERSION`
(`2026-01-26`). Once Vue and Angular migrate onto it (follow-up PRs),
the version drift described in #6823 disappears by construction: today
Vue and Angular still hardcode `2025-06-18` (a base-MCP version from a
different spec line).

## Testing

- Package: 16 e2e/unit tests (jsdom, mock agent) covering resource fetch
+ sandbox load, `tools/call` proxy round-trip, `ui/open-link`
allow/deny, `ui/message` role via `_meta.copilotkit`, `onInitialized`,
and the `ui/initialize` negotiation contract.
- react-core: MCP e2e suites (proxy, ui/message, activity renderer,
follow-up) green and unchanged (37 tests), plus check-types and oxlint
clean and the public API manifest regenerated.
- Real-browser smoke: exercised the full path in Chrome against the
ext-apps `App` widgets and a live runtime + MCP server. The sandbox
iframe mounts with the shared contract (`data-testid="mcp-app-iframe"`),
the ext-apps handshake completes, `size-changed` resizes the iframe, and
the flight-booking widget renders and advances through its multi-step
wizard, with all proxied MCP requests returning 200 and a clean console.

## Scope / follow-ups

@BenTaylorDev this PR is deliberately React-only. Vue and Angular are
intentionally held back until the architecture here is validated. The
extraction is the risky, opinionated part (the package boundary,
`bindMcpApp`'s shape, the `/activity` split, the dependency model), and
migrating Vue and Angular is behavior-changing for their users (protocol
version bump from `2025-06-18` to `2026-01-26` plus test rewrites).
Rather than build all three adapters against a design that might shift
in review, we would rather lock the shared shape on this React pilot
first, then migrate Vue and Angular onto exactly what you approve here.
Nothing about their migration is blocked once this lands.

- Vue and Angular adapters migrate onto the package once this
architecture is approved (deleting their hand-rolled protocol +
per-framework `PROTOCOL_VERSION`); each is behavior-changing and will be
its own PR.
- The `<copilotkit-mcp-app>` web component (the intended shared
consumption path for all three frameworks) lands with the Vue/Angular
PR, its first real consumer. It was built then pulled from this PR on
review: nothing consumes it here and it carried two defects to fix where
they surface.
- Self-driving message forwarding (F8): `bindMcpApp` stays push-driven
here; the self-subscribing core (`messageId` + activity subscription +
self-push, unsubscribe in teardown) lands alongside the Vue/Angular
adapters that benefit from it.
- Display-mode, update-model-context, and theme host-context then land
once in the package and are inherited by all three frameworks.
- Optional-peer install-surface reduction, as noted above.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a public MCP Apps renderer package for sandboxed app rendering
and host communication.
* Added secure resource loading, tool-call proxying, message forwarding,
link handling, and session lifecycle controls.
* Added serialized request handling, activity registration, content
validation, sandbox security policies, and protocol negotiation.
  * MCP App sessions now rebind when the server identity changes.

* **Bug Fixes**
* Blocked potentially unsafe link schemes, including JavaScript, data,
blob, and file URLs.
* Prevented follow-up messages from being sent to a changed conversation
thread.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-13 10:48:14 -05:00
Yann Jouanin b6efd75ccc Merge branch 'main' into feat/mcp-apps-renderer 2026-09-13 07:15:04 +02:00
Ben Taylor b2d22e4c1d fix(examples): keep Next.js overrides within supported majors (#7102) 
## What does this PR do?

The bare `next: ^16.0.10` override forces Next 14 and 15 examples onto
16.1.3, while examples that declare Next 16 resolve to 16.2.3. This
removes the bare override and replaces the overlapping ranges with two
major-scoped security floors:

- Next 15: `15.5.24`
- Next 16: `16.3.3`

These are the patched versions for
[GHSA-2xp9-vwfh-vxw4](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4)
and
[GHSA-p293-qw3h-jr36](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36).
The rationale is recorded alongside the overrides.

Neither advisory has a Next 14 fix. State Machine, Travel, and the v1
Pages Router example therefore explicitly declare `15.5.24`. The other
nine manifests retain their existing Next ranges. This avoids keeping
those three apps on an unsupported major or silently moving them across
majors through another override.

The updated lockfile covers all 12 Next importers and their compiler,
image-processing, and peer dependencies. Unrelated package versions are
preserved.

The v1 Pages Router example also needs two compatibility adjustments
when it actually runs on Next 15: bundle the SDK's global KaTeX styles
and use the [documented ESM interoperability
setting](https://nextjs.org/docs/messages/import-esm-externals) for
`react-syntax-highlighter`/`refractor`. Its API route now lets
`OpenAIAdapter` create the default client, avoiding a
duplicate-OpenAI-type error that also reproduces with the previous Next
16.1.3 resolution.

## Validation

Node 22.23.2 and pnpm 10.33.4:

- `pnpm install --frozen-lockfile` passes for all 70 workspace projects.
- Resolution audit: nine importers resolve to Next 15.5.24 and three to
Next 16.3.3; every importer matches its declared major.
- Nx production builds pass for State Machine, Travel, the v1 Pages
Router example, `examples/v2/next-pages-router` (which uses the App
Router), and Chat With Your Data (Next 16.3.3).
- Changed source/configuration files pass formatting and lint checks.
- A clean merge with current main (`06b8901d4`) also passes
dependency-reference checks and `pnpm install --frozen-lockfile
--lockfile-only --ignore-scripts` across its 75 workspace projects.

Builds use a placeholder OpenAI key. Next reports the existing
dynamic-import warning from the runtime's channel manager; the v1 Pages
Router build also reports its warning about opting into `esmExternals:
"loose"`.

## Related PRs and Issues

Addresses the Next.js half of #6423. The separate Pino fix is #7089.
This PR does not change Pino or MCP dependencies; the MCP follow-up was
handled separately in #7095.

## Checklist

- [x] I have read the contribution guide.
- [x] The regenerated lockfile is included and the frozen install
passes.
- [x] Allow edits by maintainers.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Updated the Pages Router, state machine, and travel examples for
compatibility with newer Next.js releases.
* Improved the Pages Router example’s handling of module compatibility
and syntax highlighting dependencies.
* Simplified the example API configuration by using the adapter’s
standard setup.
* Updated supported Next.js version ranges and security-floor settings
across the project.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-12 19:42:22 -05:00
Ben Taylor aea557300a docs: raise the stated Node version floor to 20 (#7110) 
## What does this PR do?

Three documentation pages told readers Node 18 was enough. Node 18
reached end of life on 2025-04-30, and #7108 raised every published
package to `engines.node: ">=20"`, so the guidance was wrong on both
counts.

| File | Was | Now |
| --- | --- | --- |
| `docs/cookbook/oracle-agent-spec-memory.mdx:52` | `Node.js 18+` |
`Node.js 20+` |
| `snippets/langgraph-platform-deployment-tabs.mdx:27` | `# For
TypeScript with Node 18 or above` | `# ... Node 20 or above` |
| `docs/deploy/aws-lambda.mdx:29` | "a Node.js managed runtime (Node.js
18 or later)" | states the floor `@copilotkit/runtime` needs, and keeps
the AWS fact |

The AWS Lambda page is the one judgment call. Response streaming
genuinely works on Node 18 as far as AWS is concerned, so the page was
not wrong about AWS — but it was steering CopilotKit users at a floor
the runtime no longer supports, while its own examples already deploy
`nodejs22.x`. The new wording keeps both facts:

> ...and a Node.js managed runtime of version 20 or later. AWS supports
response streaming from Node.js 18, but `@copilotkit/runtime` requires
Node.js 20.

## Testing

This is a prose-only change to existing MDX. No components, props, or
code samples were touched, so there is nothing to execute. The claim
that needs evidence is the **completeness of the sweep**, which I
checked two ways against `origin/main` at `9bf9d4cd3f`.

**1. Version-claim regex across all of `shell-docs/src/content`:**

```
$ grep -rn -iE "node(\.js)?[[:space:]]*(v)?1[0-9]" showcase/shell-docs/src/content/
showcase/shell-docs/src/content/docs/deploy/aws-lambda.mdx:29: ...AWS supports response streaming from Node.js 18, but `@copilotkit/runtime` requires Node.js 20.
```

One hit, and it is the deliberate AWS clause above.

**2. A different technique, in case the regex shape was the blind spot**
— every line containing `node`, filtered to those carrying a major
between 14 and 19, with identifier noise (`node_modules`, `NodeNext`,
`chat_node`, `ReactNode`, …) removed:

```
$ grep -rn -i "node" showcase/shell-docs/src/content/ | grep -E "1[4-9]" | grep -viE "node_modules|\.node|nodeType|NodeJS\.|nodes|NodeNext"
```

Same single hit. Every other Node version claim in the docs already
reads 20+, 20.6+, or 22+.

**3. Format check scope.** The `format` job's file list covers `*.md`
but not `*.mdx`, so a docs-only change hands it an empty list and the
step exits 0 with "No formattable files changed in this PR". Nothing to
pre-format here.

## Related

Follows #7108 (the `engines` floor) and #7089 (pino 10), and closes the
documentation item noted in #7107.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Documentation**
- Updated the Oracle Agent Memory cookbook prerequisites to require
Node.js 20 or later.
- Clarified AWS Lambda streaming requirements: the runtime requires
Node.js 20+, while AWS response streaming is supported from Node.js 18.
- Updated LangGraph deployment guidance to recommend Node.js 20 or later
for local TypeScript deployments.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-12 18:48:53 -05:00
Benjamin Taylor 42ad6c82ca docs: raise the stated Node version floor to 20 
Three pages told readers Node 18 was enough. Node 18 reached end of life
on 2025-04-30, and #7108 raised every published package to
`engines.node: ">=20"`, so the guidance was wrong on both counts.

The AWS Lambda page keeps the AWS fact that response streaming works from
Node 18, but now states the floor `@copilotkit/runtime` actually needs.
Its own examples already deploy `nodejs22.x`.

Every other Node claim across shell-docs already said 20 or later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-09-12 18:38:22 -05:00
Ben Taylor 9bf9d4cd3f fix(packages): raise the published Node engines floor to 20 (#7108) 
## What does this PR do?

Seven published packages declared `engines.node: ">=18"`. CI has never
run Node 18, and Node 18 reached end of life on 2025-04-30, about
sixteen months ago. The claim pointed at a runtime nothing tests and
that receives no security patches.

This raises those seven to `">=20"`, the lowest version the unit matrix
(`[20.x, 22.x, 24.x]`) actually proves, and raises the root manifest to
match.

It also gives `@copilotkit/runtime` its first `engines` field. The
package declared none, while #7089 moved it from `pino: ^9.2.0` to
`^10.1.1`, and pino 10 drops Node 18. Pino ships no `engines` of its
own, so today a consumer on Node 18 installs cleanly and fails later, at
runtime.

`engines` is advisory here. The root `.npmrc` sets no `engine-strict`,
so npm warns and pnpm does not block. A consumer who opts in to
`engine-strict` gets a hard failure, which is the intended signal.

## Scope

Deliberately **not** in this PR:

- The other 18 published packages declare no `engines` at all. Adding a
floor to all of them is a policy decision about whether this repository
wants engine gates as a rule, not a fix to a false claim. Noted in
#7107.
- Two public docs pages that tell readers Node 18 is enough. Listed in
#7107 as a separate, smaller cleanup.

## One thing for the reviewer to decide

The subject is `fix(packages):`, so this lands as a patch. Tightening
`engines` narrows the supported range, which under a strict reading is
breaking — though only for consumers on an end-of-life runtime who have
opted in to `engine-strict`. Say the word and I will re-word the
subject.

## Testing

Run in a worktree at `ed4f44f94f`, on Node 22.23.2 with pnpm 10.33.4.

**1. `publint`, `attw`, and `check-dts` across every package** — the
checks most sensitive to a manifest edit, and what the `package-quality`
job runs:

```
$ NX_NO_CLOUD=true pnpm run check:packages
 NX   Successfully ran targets publint, attw, check-dts for 26 projects and 27 tasks they depend on
```

**2. Tests and type-checks for every changed package:**

```
$ npx nx run-many -t test,check-types --projects=@copilotkit/runtime,@copilotkit/core,@copilotkit/web-inspector,@copilotkit/vue,@copilotkit/voice
 NX   Successfully ran targets test, check-types for 5 projects and 26 tasks they depend on
```

**3. Frozen install, all 75 workspace projects:**

```
$ pnpm install --frozen-lockfile --lockfile-only --ignore-scripts
Scope: all 75 workspace projects
Done in 344ms using pnpm v10.33.4
```

**4. The format check, reproduced exactly as CI runs it.** Worth
showing, because `oxfmt` ignores `package.json` by filename heuristic,
so a package.json-only PR hands it a list it discards entirely. The
workflow's `--no-error-on-unmatched-pattern` covers that case:

```
$ git diff --name-only > f.txt && xargs oxfmt --no-error-on-unmatched-pattern --check < f.txt
No files found matching the given patterns.
exit=0
```

**5. No `">=18"` remains in any manifest:**

```
$ grep -rn '">=18"' --include=package.json . | grep -v node_modules
(no output)
```

Closes #7107

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated the minimum supported Node.js version to 20 across the project
and its packages.
  * Added Node.js 20 compatibility requirements for the runtime package.
* Updated public compatibility information to reflect the new Node.js
requirement.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-12 14:58:14 -05:00
Benjamin Taylor 097d2cd9c9 chore(release): regenerate the public API manifest for the Node 20 floor 
`scripts/release/public-api/manifest.v1.json` records each published
package's `engines`, so raising the floor left it stale and
`public-api-manifest.test.ts` failed on all six unit shards.

Regenerated with `pnpm generate:public-api-manifest`: seven `>=18`
entries become `>=20`, and `@copilotkit/runtime` gains an `engines`
block with its package-json provenance entry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-09-12 14:35:28 -05:00
Benjamin Taylor 8ebdd33998 fix(packages): raise the published Node engines floor to 20 
Seven published packages declared `engines.node: ">=18"`, but CI has never
run Node 18 and Node 18 reached end of life on 2025-04-30. The claim
pointed at a runtime nothing tests and that receives no security patches.

Raise those seven to `">=20"`, the lowest version the unit matrix
(20.x, 22.x, 24.x) actually proves, and raise the root manifest to match.

Also give `@copilotkit/runtime` its first `engines` field. It declared
none, while #7089 moved it to pino 10, which drops Node 18. Pino ships no
`engines` of its own, so a consumer on Node 18 installed cleanly and
failed later, at runtime.

Closes #7107

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-09-12 14:25:05 -05:00
Ben Taylor ed4f44f94f fix(runtime): await durable Intelligence stop completion (#7096) 
## What does this PR do?

Fixes Stop → resend on Intelligence threads.
`IntelligenceAgentRunner.stop()` previously returned `true` after
requesting an abort, while the handler kept renewing the hosted lock.
Agents that ignored abort could keep the thread locked until natural
completion.

Stop now fences late producer events, requests cancellation, and
finalizes the run through the existing event queue. It resolves `true`
only after the gateway acknowledges every queued event and the runner
completes cleanup. The gateway's existing terminal-event handling
releases only that run's lock. Cancellation does not depend on the agent
promise settling; AG-UI subscriptions also detach when the agent
supports it. Delivery rejection, teardown, or the 60-second deadline
cannot report success.

### Compatibility

- No Intelligence or AG-UI server change, new event type, required
capability, dependency bump, or coordinated rollout.
- Existing single-event and batched acknowledgments both work. Older
agents without `detachActiveRun()` retain the cancellation fallback.
- HTTP paths, empty-body requests, single-route envelopes, and response
bodies are unchanged. Missing, mismatched, and duplicate Stop requests
retain `false`.
- The existing optional runner `runId` remains supported. This PR does
not duplicate #6982's HTTP run-selection change.
- Provider cancellation remains best effort; stopping a run cannot undo
external tool effects.

### Validation

- RED: the new legacy/batch transport tests failed because no terminal
event followed a non-cooperative abort. The subscription-cleanup test
separately failed before detachment was added.
- GREEN: 11 new tests exercise real Phoenix WebSocket framing, delayed
terminal acceptance, immediate resend, older agents, throwing aborts,
late events, partial messages/tools, pre-join Stop, rejection, timeout,
and both HTTP route modes. All 2,306 runtime tests and the existing
runner tests pass.
- `pnpm nx run-many -t test,check-types,build,publint,attw
--projects=@copilotkit/runtime --parallel=2` passed again after rebasing
onto current main.
- The 11 new transport and HTTP tests also passed on Node 20.19.4; the
fixture supplies WebSocket only when the Node global is absent.
- The required pre-commit check passed tests and package validation for
nine affected packages. An initial parallel run timed out in the
unrelated SQLite replay test; its isolated rerun passed all 15 tests,
followed by a passing hook with `NX_PARALLEL=2`. No test timeout
changed.
- Focused oxlint and oxfmt checks; `git diff --check`. Oxlint reports
only three existing warnings in the runner and its older test file.
- Local integration: the actual runtime HTTP handler and a gateway built
from Intelligence `a55679d1055ab831930331e64b6129d14e73b613`, with
isolated Redis/PostgreSQL. App API lock acquisition/renewal were
represented by a test adapter over real Redis. Two consecutive streamed
runs stopped in 179 ms and 156 ms; each response followed lock release.
PostgreSQL retained both ordered five-event sequences, one
`RUN_FINISHED` per run, and no `RUN_ERROR`. The fixture included the
current replay-projection migration.

## Related PRs and Issues

Closes #7078.
Related: #6982 (HTTP selection of an exact run).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Stopping an Intelligence run now waits for terminal confirmation
before completing.
* Stop requests prevent late events and clean up local run
subscriptions.
* Runs can be stopped at different connection stages, including before
channel join.
* Partial text and tool-call streams are properly closed when stopping.
  * Stop failures and durability timeouts are surfaced appropriately.
* HTTP Stop endpoint behavior is preserved while waiting for run
completion.

* **Documentation**
* Added guidance on stopping runs, cancellation ordering, failure
handling, and gateway acknowledgments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-12 14:15:25 -05:00
Ben Taylor 920f67a146 fix(runtime): declare pino 10 directly (#7089) 
## What does this PR do?

The runtime declares `pino: ^9.2.0`, but the root override makes
workspace installs use 10.1.1. Consumers do not inherit that override,
so the published package installs a different major from the one tested
here.

This changes the runtime dependency to `^10.1.1`, removes the Pino
override, and updates the lockfile. The locked version stays at 10.1.1;
all other resolutions are unchanged. The logger regression-test comment
now describes the direct dependency.

Pino 10 requires Node 20 or newer. This makes that dependency
requirement explicit for runtime consumers as well as the workspace.

## Validation

Checked on Node 22.23.2 with pnpm 10.33.4:

- `pnpm install --frozen-lockfile`
- Runtime build, including its 12 prerequisite tasks, through Nx.
- Runtime type check through Nx.
- Full runtime suite through Nx: 2,294 tests passed across 158 files,
including the logger regression tests.
- Packed the runtime and its workspace dependencies, then installed them
in a separate consumer with no Pino override. It resolved Pino 10.3.1
from `^10.1.1`; CJS/ESM imports and actual logger creation passed. The
consumer supplies the optional OpenAI peer (`4.104.0`) for the import
check.
- A clean merge with current main (`06b8901d4`) also passes
dependency-reference checks and `pnpm install --frozen-lockfile
--lockfile-only --ignore-scripts` across its 75 workspace projects.

## Related PRs and Issues

Addresses the Pino half of #6423. The Next.js override cleanup is #7102,
kept separate as requested in the issue. This PR does not change MCP
dependencies; that follow-up was handled separately in #7095.

## Checklist

- [x] I have read the contribution guide.
- [x] The lockfile is included and the frozen install passes.
- [x] Allow edits by maintainers.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Chores**
- Updated the runtime’s logging infrastructure to a newer supported
release.
- Removed an outdated version restriction to keep package resolution
current.
- **Tests**
- Clarified regression-test documentation to reflect the current logging
behavior.

No user-facing functionality changes are included in this update.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-12 14:14:25 -05:00
Mike Ryan 20741d4072 test(runtime): support Node 20 in stop transport tests 2026-09-12 13:56:30 -05:00
Mike Ryan 32c6cc4be9 fix(runtime): await durable Intelligence stop completion 2026-09-12 13:56:30 -05:00
Ben Taylor ea27582da7 Merge branch 'main' into fix/6423-pino-resolution 2026-09-12 13:38:42 -05:00
Ran Shem Tov 115f0c1029 Merge remote-tracking branch 'origin/main' into claude/xenodochial-khayyam-873a16 
# Conflicts:
#	showcase/shell-docs/src/content/docs/integrations/mastra/doctest.json
 2026-09-12 13:23:28 +02:00
Yann Jouanin 60d0828331 Merge branch 'main' into feat/mcp-apps-renderer 2026-09-12 09:31:17 +02:00
Tyler Slaton 06b8901d4f fix(inspector): remove optional feedback prompt copy (#7099) 
## Problem

Inspector feature setup prompts included an unnecessary optional
diagnostic-feedback instruction.

## Why

Threads and Learning use this shared feature CTA prompt, so the extra
instruction was copied into their onboarding flow.

## Fix

Remove the instruction from the shared template and assert it is absent
in the navigation test.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Changes**
- Updated the onboarding prompt to retain the instruction not to reveal
credentials.
- Removed the instruction referring to optional diagnostic feedback
reports.

- **Tests**
- Updated onboarding navigation coverage to verify the credential
protection wording and ensure the removed diagnostic feedback wording is
not present.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-11 17:20:24 -07:00
Tyler Slaton 7d53c9ffbe fix(inspector): preserve credential safeguard 2026-09-11 17:12:29 -07:00
Tyler Slaton cf47debc8b fix(web-inspector): preserve the ephemeral Threads upgrade path (#7098) 
## Problem

The Inspector treated any Threads list endpoint as durable Threads
support. An OSS app using `InMemoryAgentRunner` therefore skipped the
Rich Threads setup CTA even without Intelligence.

## Why

Local thread inspection and Intelligence persistence are separate
capabilities. Developers should be able to inspect ephemeral
conversations without losing the path to durable Threads.

## Fix

- Show the full Rich Threads setup CTA when Threads are unavailable, or
when Intelligence is off and no local threads exist.
- Switch to the thread list when the first ephemeral thread appears,
with a compact “Keep your threads” banner explaining that history can
disappear on restart.
- “Make them permanent” opens the full setup view inside the Inspector.
A sticky “Back to your threads” link returns to local history.
- Remove the banner/setup override when Intelligence becomes available.
Preserve the existing Intelligence-backed empty and populated views.
- Correct the OSS workbench fixture to omit Intelligence, add an
ephemeral-history fixture, and explicitly identify Intelligence-backed
test fixtures.

Validation: production build and type checks pass. Inspector suite:
**700 passed, 3 failed**. All three failures reproduce on untouched main
(`3e86b8d559`) with the same dependencies (baseline: 693 passed, 3
failed): CSS serialization assertions in `inspector-navigation.spec.ts`,
`thread-detail.spec.ts`, and `threads-states.spec.ts`. The pre-commit
package checks ran and failed only on that Inspector test task; the
repeat commit excludes that already-run hook.

Verified in the in-app browser: empty OSS CTA, ephemeral list/banner,
upgrade/back navigation, Intelligence enabled with Threads disabled,
dark theme, and a narrow viewport. Local screenshots are supplied in the
accompanying task.

Workbench: `pnpm exec nx run @copilotkit/web-inspector:dev:standalone`,
then use `oss-no-metadata-enabled-zero`, `oss-ephemeral-existing`, or
`pro-disabled-zero` on port 5177.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **New Features**
- Added support for ephemeral Threads when Intelligence is unavailable.
- Displays an ephemeral Threads banner with an option to make threads
permanent.
  - Added navigation back to existing threads from the setup view.
- Keeps the Threads setup view locked when required capabilities are
unavailable.
  - Expanded support for additional Threads states and scenarios.

- **Style**
- Added light and dark theme styling for the ephemeral Threads banner
and setup navigation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-11 17:11:08 -07:00
Mark 9882f193f3 fix(showcase): clean up Mastra background task cards (#7085) 
The Mastra background-task card continued to say “Running in the
background” after receiving a completed status. Its page also recreated
`renderActivityMessages` on every render, triggering CopilotKit’s
stable-array warning. Show the running footer only while the card is
working and keep the renderer array at module scope.

This is the UI cleanup found during FAC-200 investigation. The Mastra
worker/`untilIdle` configuration is a separate change.

Validation:

- Chrome/Playwright regression checks failed before the patch and passed
afterward: working spinner/footer, completed card without stale copy,
result in chat, and no renderer-array warning. The control with
`untilIdle` disabled retains its working card.
- Browser verification used byte-identical committed frontend files, the
real CopilotKit HTTP runtime, Mastra 1.56.0 and AG-UI adapter, with a
deterministic model. No live model credentials were needed.
- Scoped formatting, lint, strict TypeScript, and the focused Next.js
production build pass locally.
- The full Mastra showcase Docker build and shell-docs build pass in CI.

Related: https://linear.app/copilotkit/issue/FAC-200
 2026-09-11 16:47:54 -07:00
Yann Jouanin 633b0a65be Merge branch 'main' into feat/mcp-apps-renderer 2026-09-12 01:39:03 +02:00
Tyler Slaton d6f23c13eb fix(inspector): remove optional feedback prompt copy 2026-09-11 16:36:25 -07:00
Tyler Slaton 12e2a632b6 fix(web-inspector): preserve ephemeral thread loading and errors 2026-09-11 16:36:11 -07:00
Mark 57d0b9dea3 Merge branch 'main' into fix/FAC-200-background-task-ui-cleanup 2026-09-11 16:31:45 -07:00
Tyler Slaton 7ea9bcabe2 fix(web-inspector): place ephemeral CTA above thread search 2026-09-11 16:27:57 -07:00
Tyler Slaton ce16ddeb4a fix(web-inspector): move persistence action into the banner copy 2026-09-11 16:24:31 -07:00
Tyler Slaton cbae56e2b5 fix(web-inspector): distinguish the persistence CTA from thread controls 2026-09-11 16:19:54 -07:00
Tyler Slaton 36ef524c59 fix(web-inspector): keep the upgrade path visible for ephemeral threads 2026-09-11 16:18:53 -07:00
Mike Ryan e710ee3550 feat(runtime): add native Intelligence runtimes and shared conformance (#6967) 
## Review status

**The January MCP Apps MIME correction is implemented, but TypeScript
integration awaits an upstream release.** Native commit `61d3d0a6cc`
advertises `text/html;profile=mcp-app` and adds three shared regression
cases. [AG-UI #2722](https://github.com/ag-ui-protocol/ag-ui/pull/2722)
fixes the same advertisement in all three TypeScript middleware
connection paths.

Published middleware 0.1.0 still advertises the old value. CopilotKit
continues to depend on that release, so its normal TypeScript CI is
expected to fail the three new MIME cases until the upstream fix is
released and consumed. The gate must remain enabled; these failures must
not be skipped.

Full local validation passes all 126 shared cases across TypeScript,
Python, Go, .NET, Rack, and Rails (756 executions). The TypeScript run
used the built upstream correction through a temporary dependency
symlink, restored afterward. This is integration evidence for the
proposed fix, not evidence that it has been published. Native lint,
tests, typechecks, and builds pass; upstream middleware tests (103),
typecheck, and build pass.

Visibility filtering is already implemented in all four native runtimes,
with five shared cases covering omitted, model, app, both, and empty
visibility. Those cases remain green. Nested metadata support remains in
place.

MCP `2026-07-28` migration is deferred to a follow-up PR, as agreed in
person with the reviewing engineer. The January MIME and visibility
corrections use the existing core protocol and do not require that
migration. Maintainer approval remains pending.

## Commit structure

The history is grouped into 13 commits by purpose:

- Four TypeScript fixes: tool schemas, MCP Apps, identity/request
boundaries, and failure reporting.
- One commit for each native runtime and SDK, including its tests and
package guide.
- One shared conformance and CI commit.
- Two focused CI fixture fixes.
- One native MCP access-boundary fix with shared visibility and
account-selection regressions.
- One January MCP Apps MIME fix with shared connection-path regressions.

The latest follow-up changes native MCP discovery and proxy selection;
the other runtime code is preserved. The public documentation commit was
removed; public SDK/runtime guides and navigation updates are deferred
until publication. Package-local README files remain with their
implementations. Other history-cleanup changes are Python manifest
formatting and moving internal plans/checkpoints out of the public tree,
with their documentation links updated. Public contract instructions and
regression evidence remain in the PR.

Pre-push validation reran scoped formatting, lint, typechecks, tests,
builds, and frozen-lockfile checks. Before dropping the public docs
commit, its targeted tests and the full docs build passed. The
associated new docs test was removed with that commit. The broader docs
suite reports eight failures in unrelated tests on unchanged files;
existing workflow-lint findings also match the base. These are recorded
limits, not new regressions introduced by the rewrite.

## Scope

Keep the TypeScript fixes, native runtimes, SDKs, and shared conformance
suite together in this PR. The MCP Apps middleware changes were
extracted upstream and are consumed as a released dependency.

Add native Intelligence runtimes and SDKs for Python, Go, Ruby, and
C#/.NET. Run TypeScript through the same shared contract tests. Only
IntelligenceRunner is in scope; the native runtimes do not use Node
sidecars.

The Ruby runtime is a Rack application that can mount in Rails or
Sinatra; neither framework is required. Rack and Rails have dedicated
conformance runs. Sinatra uses the same Rack interface and does not yet
have a separate conformance run.

The runtimes expose run, connect, stop, thread, memory, annotation,
discovery, and entitlement APIs with application-owned authentication.
They support durable event delivery, A2UI, MCP Apps, and the existing
completion analytics contract.

[Public
walkthrough](https://intelligence-runtime-guide.mikeryandev.chatgpt.site/)

The TypeScript runtime now consumes `@ag-ui/mcp-apps-middleware@^0.1.0`
from npm. The published tarball contains the reviewed origin,
visibility, diagnostics, and cleanup fixes. Local packed-runtime
installation and ESM/CJS imports pass with the released dependency.

## Human-review corrections

The latest follow-up filters model tools by `_meta.ui.visibility` while
keeping iframe calls available. Hash-only proxy requests must resolve
exactly one server, and explicit IDs never fall back to a hash. Shared
cases cover five visibility settings, ambiguous hashes, both account
IDs, and unknown IDs.

- Preserve shipped TypeScript routing and trusted SDK update precedence.
Restrict browser update fields instead: identity aliases cannot override
the authenticated user in TypeScript, Go, or Ruby. The fixture now uses
the actual platform alias precedence.
- Supply required deletion audit reasons in Python, Go, and Ruby.
Recover Ruby idle gateway failures without cancelling an agent whose
platform lease remains valid. Prefer current nested MCP metadata while
retaining the legacy format.
- Remove the TypeScript MCP Apps fork. [AG-UI
#2718](https://github.com/ag-ui-protocol/ag-ui/pull/2718) owns transport
validation, bounded session cleanup, credential-free hashes, redirect
protection, safe errors, and current metadata. The upstream PR is merged
and released as v0.1.0; this PR now uses that npm release.
- Restore completion analytics for completed streams containing
RUN_ERROR, retain private error handling, preserve stop bodies consumed
by identity callbacks, and limit relaxed tool strictness to the A2UI
tool.
- Scope conformance CI to runtime dependencies, restore normal package
previews, label native libraries as source-only previews, reject remote
HTTP MCP credentials in .NET, and target .NET 8 with a real Agent
Framework AG-UI integration test.

The stop endpoint still checks current ownership before cancellation.
This intentionally fails closed when ownership cannot be verified;
platform unavailability can prevent cancellation. Reviewer acceptance of
that security/availability tradeoff remains open. The GTM month-close
query was not available to inspect; shipped completion-event behavior
was restored.

## Validation

Earlier validation at `6351fd34f9`, before the MIME follow-up (current
MIME evidence is above):

- 123 shared cases pass on TypeScript, Python, Go, Ruby/Rack,
Ruby/Rails, and .NET 8: **738 local case executions** through loopback
HTTP and Phoenix sockets.
- 2,342 TypeScript runtime tests, typecheck, and build pass. Python, Go,
and Ruby tests, lint, typecheck where defined, and package builds pass.
The harness tests include negative stub checks.
- .NET 8 tests, lint, typecheck, build, and pack pass. Both NuGet
artifacts contain net8.0 assemblies. The test target hosts the actual
Microsoft Agent Framework AG-UI endpoint with a deterministic model and
reads it through the runtime HTTP agent.
- The final upstream review fixes passed 102 tests, typecheck, and build
with SDK 1.15.0 and 1.20.0. The published v0.1.0 tarball was inspected
for those fixes.
- Changed-file lint, workflow syntax, frozen-lockfile installation, and
`git diff --check` pass. Earlier shell-docs build/typecheck/lint passed
with existing lint warnings. This repository has no `docs:check` target.

Commands and observed failing assertions are recorded in
[REGRESSIONS.md](https://github.com/CopilotKit/CopilotKit/blob/codex/intelligence-polyglot-runtimes/tools/runtime-conformance/REGRESSIONS.md).
The [contract
guide](https://github.com/CopilotKit/CopilotKit/blob/codex/intelligence-polyglot-runtimes/tools/runtime-conformance/AGENTS.md)
requires a behavior failure before a production fix and independent
review of fixture changes. The [branch
rules](https://github.com/CopilotKit/CopilotKit/rules/14521235) retain
the conformance gate and independent engineering review.

The current rebase contains main at `dfb68fdbd0`. The 12 patches present
at `6351fd34f9` were unchanged by the rebase (`git range-diff`); runtime
and fixture Git trees match the tested pre-rebase commit. Fresh native
lint, typechecks, tests, builds, and shared conformance validate the MCP
follow-up locally. GitHub Actions on `6351fd34f9` is complete: 66 checks
pass, three are skipped, and no checks fail. CodeRabbit has started a
new review and is pending. The required [Intelligence runtime
conformance
gate](https://github.com/CopilotKit/CopilotKit/actions/runs/34538610986)
passes. Its logs record all 738 shared case executions passing. GitHub
still records changes requested; this does not imply review approval.

Release dependency follow-up:

- Replaced the upstream preview URL with `^0.1.0`; the lockfile selects
0.1.0 with registry integrity.
- Added MCP Apps to the named AG-UI release-age exception lists in
`.npmrc` and the clean-consumer config, consistent with the existing
upstream entries. Exotic transitive dependency blocking remains enabled.
- `NX_DAEMON=false pnpm nx run-many -t test,check-types,build -p
@copilotkit/runtime`: 2,342 runtime tests, typecheck, and build pass
locally.
- `NX_DAEMON=false pnpm run verify:runtime-package`: packed runtime
installation and ESM/CJS imports pass locally on Node 22. The previous
`ERR_PNPM_EXOTIC_SUBDEP` failure no longer occurs.
- Eight release-config tests, changed-file lint, frozen-lockfile
installation, and `git diff --check` pass. On `ea30890c47`, all six Node
20/22/24 and React 18/19 jobs pass in [the unit and package
workflow](https://github.com/CopilotKit/CopilotKit/actions/runs/34530428044).
The released dependency has cleared the previous package-install blocker
in CI.

Pre-rewrite CI on `ea30890c47` is complete: 67 checks pass and three are
skipped, with no failures. The [conformance
workflow](https://github.com/CopilotKit/CopilotKit/actions/runs/34530428052)
passes for TypeScript, Python, Go, Ruby (Rack and Rails), and .NET 8.
All six Node/React package jobs also pass. GitHub still records the
maintainer review as changes requested; this CI result does not imply
review approval.

## Evidence limits and release boundary

The shared fixture is authored in this PR. Source calibration now covers
identity precedence, foreign-thread privacy, deletion reasons, and the
shipped TypeScript behavior corrected above. Agreement across drivers
alone does not prove deployed-platform compatibility.

The public frontend core runs against real Phoenix sockets in Node; that
is not browser coverage. Earlier hosted/browser recordings predate these
changes, and their previously recorded checkout path is absent from this
workspace. Fresh browser, hosted-platform, and projection-replay
validation remain unverified.

Native MCP Apps supports Streamable HTTP. Legacy SSE, OAuth setup,
server-initiated requests, and stream resumption remain outside the
native implementation; TypeScript retains legacy SSE support.
Provider-specific agents, managed Channels, GraphQL, voice, single-route
dispatch, automatic thread naming, stateless suggestions, Open
Generative UI, and automatic memory-tool injection remain outside this
scope. The Agent Framework test uses its public AG-UI endpoint, not a
new provider adapter.

The four native libraries are source-only previews. Go source is
publicly fetchable by commit and may be cached by module proxies without
a release tag. No merge, stable package release, or runtime deployment
is authorized by this work.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added native CopilotKit Intelligence runtimes and SDKs for Python, Go,
Ruby, and .NET.
* Added support for A2UI, MCP Apps, telemetry, memory policies, thread
operations, and Inspector metadata across runtimes.
* Added typed resource models, runtime entitlements, lifecycle events,
and HTTP agent integrations.

* **Bug Fixes**
* Improved identity and ownership validation, event durability, stream
finalization, error handling, and sensitive-data redaction.
* Improved MCP authentication, proxy safety, request validation, and
redirect handling.

* **Tests**
* Added cross-runtime conformance coverage and automated validation for
supported runtime integrations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-11 16:15:13 -07:00
Maximiliano Korp e687cc006e fix(ci): remove duplicate AG-UI checkout option 2026-09-11 15:57:24 -07:00
Maximiliano Korp cd44dc0acb fix(runtime): consume MCP Apps MIME correction 2026-09-11 15:57:23 -07:00
Mike Ryan 2cbacc90f1 fix(runtime): advertise the January MCP Apps MIME type 2026-09-11 15:55:32 -07:00
Mike Ryan fa8480a8b4 fix(runtime): enforce MCP tool visibility and account selection 2026-09-11 15:55:31 -07:00
Mike Ryan c6b9a6c5ed test(docs): pin the Mastra client used by the doctest 
Keep the documented integration test on the client version it was validated
against.
 2026-09-11 15:55:31 -07:00
Mike Ryan 8586d6ea4d fix(ci): fetch AG-UI LFS fixtures for dojo tests 
Fetch real fixture contents instead of LFS pointers when checking out
upstream AG-UI for dojo tests.
 2026-09-11 15:55:31 -07:00
Mike Ryan e251bcac83 test(runtime): enforce shared cross-language conformance 
Run the same public HTTP and socket cases against TypeScript and all native
runtimes. Keep native toolchains out of JavaScript-only jobs, require the
dedicated conformance gate, and retain regression evidence and fixture
review rules.
 2026-09-11 15:55:31 -07:00
Mike Ryan d2b207d514 feat(runtime-dotnet): add native Intelligence SDK and ASP.NET Core runtime 
Provide native Intelligence SDK operations and runtime routes with
application-owned identity, durable runs, A2UI, MCP Apps, entitlements,
Inspector metadata, and telemetry. Include package docs, hosting examples,
and regression tests.
 2026-09-11 15:55:30 -07:00
Mike Ryan b7f495decb feat(runtime-ruby): add native Intelligence SDK and Rack runtime 
Provide native Intelligence SDK operations and runtime routes with
application-owned identity, durable runs, A2UI, MCP Apps, entitlements,
Inspector metadata, and telemetry. Include package docs, hosting examples,
and regression tests.
 2026-09-11 15:55:30 -07:00
Mike Ryan d611ef108c feat(runtime-go): add native Intelligence SDK and net/http runtime 
Provide native Intelligence SDK operations and runtime routes with
application-owned identity, durable runs, A2UI, MCP Apps, entitlements,
Inspector metadata, and telemetry. Include package docs, hosting examples,
and regression tests.
 2026-09-11 15:55:30 -07:00
Mike Ryan 92afdb1f2c feat(runtime-python): add native Intelligence SDK and ASGI runtime 
Provide native Intelligence SDK operations and runtime routes with
application-owned identity, durable runs, A2UI, MCP Apps, entitlements,
Inspector metadata, and telemetry. Include package docs, hosting examples,
and regression tests.
 2026-09-11 15:55:30 -07:00
Mike Ryan f7424b047b fix(runtime): preserve safe failure reporting and completion analytics 
Report failures without private diagnostic payloads in analytics. Preserve
completion counts for streams containing RUN_ERROR and notify clients when
execution fails.
 2026-09-11 15:55:29 -07:00
Mike Ryan 05d6cacd93 fix(runtime): preserve identity and request boundary contracts 
Preserve SDK update precedence and mounted routing, strip browser identity
aliases, and clone stop requests before application authentication consumes
the body. Keep entitlement response-body timeouts retryable.
 2026-09-11 15:55:29 -07:00
Mike Ryan 84549992ab fix(runtime): scope MCP Apps requests through the released middleware 
Consume upstream MCP Apps 0.1.0, retain trusted server credentials, and
reject proxy requests outside the selected agent scope. Ordinary runs
without selected servers do not attach middleware.
 2026-09-11 15:55:29 -07:00
Mike Ryan 288070063a fix(runtime): validate tool arguments while preserving A2UI schemas 
Validate AG-UI tool arguments against their JSON schemas. Keep relaxed
structured output limited to the open A2UI tool and preserve existing tool
tests.
 2026-09-11 15:55:14 -07:00
Tyler Slaton 3e86b8d559 fix(docs): remove retired AG-UI mirror (#7092) 
## Problem

The discontinued AG-UI protocol mirror remained published on
docs.copilotkit.ai. Its sitemap advertised pages owned by the separate
AG-UI repository, including eight routes that returned 500.

## Why

The protocol documentation is maintained at docs.ag-ui.com. Keeping an
unsynchronized duplicate on the CopilotKit host created broken
user-facing URLs and misleading search results.

## Fix

Remove the vendored `/ag-ui/*` content, renderer, sitemap/search/LLM
enumeration, and mirror-specific tests. Retain CopilotKit's own AG-UI
integration documentation under `/backend/ag-ui` and
`/agentic-protocols/ag-ui`.

Validation: `npm run typecheck`; focused Vitest suite (39 tests).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* AG-UI protocol documentation has been removed from the documentation
site.
* AG-UI documentation updates are now directed to the upstream protocol
project.
* Related guides, SDK references, drafts, roadmap, integrations, and
contribution pages are no longer available here.

* **Search & Navigation**
* AG-UI pages no longer appear in search indexes, sitemap listings, or
LLM-generated documentation content.
* Documentation routing now resolves supported content areas without the
former AG-UI route.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-09-11 15:44:24 -07:00
Tyler Slaton 4b7c0d35fd chore: release monorepo v1.71.1 (#7097) 
## Release monorepo v1.71.1

**Scope:** `monorepo` | **Bump:** `patch`

---

### How this release process works

1. **This PR was created automatically** by the "release / create-pr"
workflow.
   It bumped the `monorepo` packages to `1.71.1`
   and generated AI-enhanced release notes.

2. **CI runs on this PR** — the full test suite (unit tests, lint, type
checks, build)
   must pass before merging. This is the review gate.

3. **Review the release notes** in `CHANGELOG.md`
   in this PR. Edit the top section on this branch to change what ships:
   the publish job reads that section back as the GitHub Release body.

4. **When this PR is merged**, the `release / publish` workflow
automatically:
   - Builds all packages
   - Publishes the `monorepo` packages to npm at version `1.71.1`
   - Creates git tag `monorepo/v1.71.1`
   - Creates a GitHub Release with the final release notes

### Before merging

- [ ] CI is green (tests, lint, types, build)
- [ ] Version bumps look correct
- [ ] Release notes are accurate (edit `CHANGELOG.md` on this branch)

---

> **Do not merge until CI is fully green.** The full test suite runs
automatically on this PR.
v1.71.1 		2026-09-11 15:15:37 -07:00
github-actions[bot] 4432bec602 style: auto-fix formatting 2026-09-11 22:03:06 +00:00