The inspector subscribed to AG-UI events only through onAgentsChanged, which
skips per-thread clones, leaving the event timeline empty during runs
(regression of #3872). Subscribe to the run instance reported by
onAgentRunStarted so its events are recorded.
Memory, NewMemory, MemoryChanges, MemoryKind, and MemoryScope are the
memory types surfaced by the useMemories / injectMemories hook result
shapes, so export them unprefixed as supported public API instead of
behind the ɵ "internal" marker. Internal memory plumbing (MemoryStore,
the selectMemories* selectors, state/context/event types,
createMemoryStore) keeps the ɵ prefix.
Updates the react-core and angular hook signatures, the web-inspector
Memories tab, and the affected tests to the unprefixed names.
Repairs TypeScript check-types across the monorepo and adds a CI gate so
regressions are caught going forward:
- core: bundler module resolution and strict-mode fixes
- sdk-js: bundler module resolution; keep codegen, formatter, packaging working
- react-core: fixes across components, hooks, and tests
- react-native: restore catch binding referenced by TypeError cause
- runtime: repair check-types and bound AI SDK schema inference
- web-inspector: nodenext import extensions, export Anchor
- remaining packages and node example: assorted check-types repairs
- deps: add missing type-only devDependencies
- license context driven from /info licenseStatus
- ci: run check-types in the static quality workflow
Squashed from 12 commits for a single, easily-revertable change.
The inspector's owned thread store (created when useThreads() isn't mounted)
initialized its context with empty headers, so its /threads requests omitted
the headers configured on <CopilotKit> (e.g. X-CSRF, auth). This produced
HTTP 403 in environments that enforce CSRF/auth checks.
Source the headers from core.headers at store creation, and re-apply them via
onHeadersChanged so the owned store stays authorized when headers are updated
at runtime, mirroring how useThreads() keeps its context in sync.
Address review: the popout dismiss control was a focusable interactive
element (role="button" + tabindex) rendered INSIDE the floating inspector
<button>. That violates the HTML button content model — a <button> may not
contain interactive descendants or descendants with tabindex, even when the
descendant isn't itself a <button>.
Render the announcement preview as a SIBLING of the floating button inside a
position: relative wrapper, so the dismiss affordance becomes a real
<button type="button">. The wrapper preserves the absolute positioning, so
the bubble still anchors to the button's edge (verified live: identical
placement). Native button keyboard handling replaces the manual Enter/Space
keydown shim. stopPropagation still keeps the X from bubbling to the preview
body (which opens the inspector).
Behavior unchanged and re-verified in a real browser: X persists the
timestamp + hides the bubble without opening the inspector; body-click opens
without persisting. web-inspector suite 32/32 green.
(--no-verify: the full-package pre-commit suite has pre-existing, unrelated
failures in core/runtime/sdk-js transport tests; this change only touches
packages/web-inspector.)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The announcement preview bubble that pops out of the floating inspector
button had no dismiss control of its own. Its only hide paths
(handleAnnouncementPreviewClick / openInspector) cleared an in-memory flag
without persisting, so on the next mount fetchAnnouncement() recomputed
showAnnouncementPreview from the stored timestamp — which only the in-window
banner X ever wrote. Result: the popout reappeared on every reload unless the
user opened the inspector and dismissed the inner banner.
Add an X control to the popout that calls markAnnouncementSeen() (persists the
timestamp) and stopPropagation() (so the X does not bubble up and open the
inspector). The control is a role="button" span — the popout renders inside the
floating <button>, so a nested <button> would be invalid HTML. Includes
Enter/Space keyboard support and focus-visible styling.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Defer trackBannerViewed until runtime connection is established via
pendingBannerViewed + flushPendingBannerViewed(), preventing the race
where the CDN response beats the /info handshake and fires the event
before core.telemetryDisabled is known
- Remove dead isTelemetryOptedOut() short-circuit from track(); opt-out
is enforced at call sites via core.telemetryDisabled, not localStorage
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Don't fire banner_clicked on copy-button clicks (move track call to
the non-copy-button branch of handleAnnouncementContentClick)
- Defer ensureTelemetryDistinctId() to runtime connection so no UUID
is written to localStorage when COPILOTKIT_TELEMETRY_DISABLED is set
- Remove setTelemetryOptOut re-export from telemetry.ts (no production
caller; tests already import directly from persistence.ts)
- Fix docs: replace Privacy tab toggle description with env var opt-out
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Per Ben Taylor: the ingest lambda parses the X-CopilotKit-Telemetry-Id header
as telemetry_id for the distinct ID. Send it as a header in addition to keeping
it in the POST body properties.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add telemetryDisabled to RuntimeInfo from COPILOTKIT_TELEMETRY_DISABLED/DO_NOT_TRACK env vars
- Mirror through AgentRegistry and expose via CopilotKitCore getter
- Guard track calls, URL param appending, and console disclosure on core.telemetryDisabled
- Move maybeShowDisclosure() to onRuntimeConnectionStatusChanged (fires after core attaches)
- Update docs to replace localStorage toggle description with env var approach
- Add telemetryDisabled test suite to get-runtime-info tests
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove "Privacy" from the nav tab row; move settings access to a cog
button (Settings icon) in the top-right header, between dock controls
and the close button. Clicking the cog toggles the settings panel;
clicking again returns to the previous view.
- Settings panel replaces the privacy panel: shows the same transparency
copy but replaces the checkbox toggle with an "I want to opt out —
show me how →" link to the docs. Opt-out is via COPILOTKIT_TELEMETRY_DISABLED
(env variable, documented at docs.copilotkit.ai/telemetry) rather than
a per-browser localStorage toggle.
- Remove isTelemetryOptedOut / setTelemetryOptOut from index.ts (no longer
used; the toggle UI is gone). Underlying persistence exports remain in
telemetry.ts for future use.
- Fix cpk-tab-icon: add display:inline-flex + flex-shrink:0 + align-items:center
to prevent icon containers from collapsing on the x-axis.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move `package` from properties string to top-level `{ name }` object per
Ben's confirmed IngestPayload schema (telemetry-sink-ingest/index.ts:127-134)
- Add typed per-event helpers trackBannerViewed/trackBannerClicked/trackThreadsTabClicked
to enforce property shapes at call sites and prevent PII leakage under wrong keys
- Add trackBannerClickedOnce guard in index.ts (per-mount Set keyed by
banner_id + cta) to prevent banner_clicked inflation on repeated clicks
- Fix handleTelemetryOptOutToggle: replace ?? true fallback with
instanceof HTMLInputElement guard (wrong fallback was a privacy bug)
- Add threadsTabClicked re-selection guard (skip if already on threads tab)
- Replace getTelemetryDistinctIdForUrl() call on mount with ensureTelemetryDistinctId()
- Add inMemoryFallbackId in persistence.ts for funnel coherence when
localStorage is unavailable (same UUID returned per page load)
- Add _resetTelemetryPersistenceForTesting() for test isolation
- Remove @copilotkit/shared dep from telemetry-disclosure.ts (inline
env-var check; keeps module self-contained and testable in isolation)
- Add clearMocks: true to web-inspector vitest config (fixes spy call
history accumulating across tests)
- Expand telemetry.test.ts to 22 tests covering wire body shape, opt-out,
5 error-resilience paths, typed helpers, distinct ID lifecycle (SSR +
localStorage-throws + funnel coherence), maybeShowDisclosure, and
getTelemetryDistinctIdForUrl
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Three V1 funnel events from the inspector — oss.inspector.banner_viewed,
oss.inspector.banner_clicked, oss.inspector.threads_tab_clicked — plus a
privacy panel for opt-out, a first-run console disclosure on inspector
mount and runtime startup, and inspector content added to the canonical
/telemetry docs page on main.
Inspector POSTs directly from the browser to telemetry.copilotkit.ai/ingest
(per ticket: URL is intentionally clearly named for transparency in DevTools).
Inline fetch POST in lib/telemetry.ts — no @copilotkit/shared dep on the
inspector, no dependency on any non-main branch.
Wire body shape (conservative; needs Ben confirmation):
POST https://telemetry.copilotkit.ai/ingest
{ event, properties: { ...caller, distinct_id, package }, ts }
If the lambda expects a richer envelope, update the single JSON.stringify
in lib/telemetry.ts.
Privacy invariants:
- Opt-out toggle short-circuits before any network call (verified by test).
- Properties are scoped to event metadata only — no message content, agent
state, prompts, completions, banner markdown. Negative test pins the wire.
- Anonymous distinct ID (UUID v4 in localStorage) set on inspector load and
propagated onto banner CTA links as ?posthog_distinct_id=<uuid> so the
destination site can posthog.alias() and close the
banner_viewed → banner_clicked → signup_attributed funnel. URL param
suppressed when opted out.
- Console disclosure on first inspector mount and runtime startup. Both
link to https://docs.copilotkit.ai/telemetry.
Plan gaps addressed:
- CTA name on banner_clicked: cta:'body'|'dismiss' (click location) plus
optional cta_label read defensively. Sam: confirm dismiss treatment.
- De-anon opt-out folded into the single toggle. Docs say so explicitly.
- banner_viewed dedup: per-instance Set<string> keyed by timestamp.
- EPIC consent / pixel review: out of scope for this PR; flagged at merge.
Deferred for V1.1:
- Wire body shape (Ben).
- Event-type allowlist for oss.inspector.* (Ben — oss-path-to-production).
- posthog_distinct_id URL-param key name (Ben/Tyler/website team).
Refs https://linear.app/copilotkit/issue/OSS-96
Ran Shemtov