npx copilotkit skills install runs the skills CLI against skills/, which
copies each skill directory into user projects wholesale (its only excludes
are metadata.json, .git, __pycache__). That would ship eval.yaml and the
vite-react fixture to every user, and the fixture's package.json would get
indexed by GitHub's dependency graph in their repos. The harness now lives
in skill-evals/copilotkit-setup/, pointed back at the skill under test via
skillgrade's skill: field; skills/copilotkit-setup/ contains only shippable
content.
Also instructs eval agents not to start dev servers: a live trial timed out
at 600s because codex booted vite and the Express backend to verify its
(complete) solution, and codex exec never returned. Verified end-to-end
from the new location: PASS 1.00 (8/8 deterministic + rubric, 324s).
The eval.yaml files predated the v2 API cleanup and were never wired to a
runner. This adopts skillgrade (whose schema the setup eval already used)
and syncs the graders with what SKILL.md actually teaches post-#5345:
@copilotkit/react-core + @copilotkit/runtime, the CopilotKit provider from
/v2, and the createCopilot*Handler factories instead of the deprecated
createCopilotEndpoint aliases. Graders now reject the legacy APIs so the
eval measures whether the skill steers agents to the canonical surface.
Adds the previously-missing workspace/vite-react fixture the second task
references, and a manual pnpm eval:skill:setup command (Docker +
ANTHROPIC_API_KEY required); no CI gate yet since runs cost real agent
tokens. Deletes the copilotkit-develop eval outright: it used a different
ad-hoc grader schema, graded for legacy APIs, and had no fixtures, so it
needs a ground-up rewrite once that skill's own API drift is fixed.
Move enterprise-learning MCP attachment out of the BuiltInAgent-specific
path and the intelligence run handler into a single request-scoped hook:
- `attachIntelligenceEnterpriseLearning` (agent-utils) attaches
`@ag-ui/mcp-middleware` via `configureAgentForRequest`, gated on
`ɵisEnterpriseLearningEnabled()`, resolving the user via `identifyUser`
and the project apiKey.
- Called from `handleRunAgent`; the old `forwardedProps.auth` MCP plumbing
in `intelligence/run.ts` and the BuiltInAgent attach in `agent/index.ts`
are removed.
- Add released `@ag-ui/mcp-middleware@0.0.1` dependency (lockfile +
`@ag-ui/client` override). Drops the obsolete intelligence-mcp-helper test.
Adds two CI signals for keeping the published packages small and broadly compatible:
- Bundle size: size-limit file-mode config across packages plus a
CopilotChat import-size regression signal (gzip) so growth in the
headline consumer entrypoint is visible on every PR. A bundle-size
workflow comments results on the PR (Phase 1: no hard-fail).
- ES compatibility: a compat-check (es-check) script across 9 packages
with a root .browserslistrc, validating built .mjs/.cjs against the
es2022 build target.
The measure script is importable (measureBundle) and unit-tested. Dev
docs live under dev-docs/ (bundle-size.md, browser-compat.md). All
action refs are pinned to full commit SHAs for supply-chain safety.
Move runtime and shared deps (and the root pnpm override) from an exact
0.4.0 pin to ~0.4.2, so future 0.4.x patches are picked up automatically.
Regenerate pnpm-lock.yaml to resolve 0.4.2.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
pnpm v11 ships with stronger supply-chain protections, notably
`minimumReleaseAge` enforcement against tarball-substitution attacks and
hardened script execution defaults. Regenerates `pnpm-lock.yaml` to
match. Workflow-level `version:` hardcodes are removed in the follow-up
commit so `pnpm/action-setup` inherits from `packageManager` (one source
of truth — earlier drift between the field and workflow pins caused
lockfile-vs-engine mismatches that only surfaced on the slow
`--frozen-lockfile` path).
Introduce machinery for keeping examples/integrations/* demos aligned to a
single north-star (langgraph-python). Built first so the upcoming
langgraph-js and langgraph-fastapi alignment PRs have a mechanical baseline
to work against instead of manual copy-paste.
- examples/integrations/_parity/manifest.json declares verbatim files,
tracked package.json keys, and expected agent surface (tool names,
state keys) per instance plus allowed-divergence lists.
- _parity/sync.ts copies verbatim files + rewrites tracked package.json
keys from north-star to a target instance. Dry-run supported.
- _parity/verify.ts diffs each instance vs north-star and exits non-zero
on unexpected drift. Checks verbatim content, tracked keys, canonical
prompt equality, and agent-surface grep-level presence.
- Canonical prompt at _parity/canonical/PROMPT.md — synced into each
instance's agent/PROMPT.md on parity:sync.
- Root package.json: pnpm parity:sync, parity:verify, parity:check.
- CI: .github/workflows/integrations_parity.yml runs parity:check on PRs
touching examples/integrations/**.
- Skill: .claude/skills/copilotkit-demo-parity/SKILL.md teaches agents
how to drive sync/verify and handle manual-merge zones (agent code,
api route, Dockerfile).
Does NOT touch the existing instance demos yet. Those alignment commits
follow in the same PR.
@types/react 19.2.x breaks recharts class component types with
"JSX element class does not support attributes because it does not
have a 'props' property." Pin the workspace-wide pnpm override and
the chat-with-your-data devDependency to 19.1.8.
immutable, ajv, picomatch, diff, brace-expansion, yaml, rollup —
all scoped to only bump consumers already on the target major version.
Prevents forcing e.g. ajv 8.x onto ajv ^6.x consumers.
The unscoped >=13.2.1 override forced remark-rehype@10's
mdast-util-to-hast from 12.x to 13.x, removing the 'all' and
'one' exports that remark-rehype depends on. Broke form-filling,
research-canvas, and travel Vercel deploys.
The @angular/compiler >=19.2.20 override removed the
DEFAULT_INTERPOLATION_CONFIG export that ng-packagr depends on.
Angular packages must be upgraded together with their tooling —
can't safely override independently.
Phase 2: upgrade existing overrides to higher patched versions
Phase 3: add 36 new safe overrides for all resolvable transitive deps
Phase 4: bump storybook devDeps, vite in react-router, vitest in demo-agents, next canary
Remaining 3 are truly unfixable:
- parse-git-config: no patch exists (danger devDep)
- elliptic: no patch exists (storybook crypto chain)
- next: example on 15.x canary, advisory needs 16.x
Part of CPK-7320
Add pnpm overrides for 12 vulnerable transitive dependencies.
Reduces audit from 212 to 155 alerts (27% reduction), criticals
from 10 to 1. Published package runtime vulns mostly resolved.
Remaining 155 are in examples, showcase, docs, test-apps, and
deep transitive chains (langchain, mermaid, graphql-codegen)
that require upstream updates.
Part of CPK-7320
Missed on the first pass — root package.json had a pnpm.overrides pin on
@copilotkit/license-verifier@0.0.1-a1 that forced the lockfile to keep the
old version even after packages/runtime + packages/shared dep bumps.
The inline check-binaries hook broke on Windows Git Bash because lefthook invoked
it via sh.exe -c with the multi-line YAML script as a single argument, and the
nested quotes inside (`echo "$STAGED" | grep -iE '...'`) got mangled during
Windows command-line argument escaping. Move it to scripts/hooks/check-binaries.sh
so lefthook just invokes bash against a file, avoiding the escaping issue.
Also scope the root test script (and test:coverage) to --projects=packages/**,
mirroring check:packages. The previous unscoped nx run-many -t test triggered
showcase starter generation tests that fail on leftover state from prior runs;
these aren't relevant to the pre-commit gate, which is about verifying shipped
packages.
Each release scope has its own packages, version source, and
independent version track:
- monorepo: 12 core @copilotkit/* packages (shared version)
- cli: copilotkit CLI (independent version)
- angular: @copilotkitnext/angular (independent version)
Branch pattern is now release/publish/<scope>/v<version> and git
tags use <scope>/v<version> for non-monorepo scopes.
Attachment queue & previews:
- Image lightbox with View Transition API morph animation
- Video lightbox with native controls and play button overlay
- Document lightbox (PDF via blob URL, text inline, info card fallback)
- Drop zone overlay with upload icon
- Filename preservation via InputContent metadata
- Proper video thumbnail sizing and play/pause indicator
- Fix attachment queue positioning (max-w-3xl constraint)
- Padding between X button and content for audio/document cards
- Document filenames wrap instead of truncating
Attachments config:
- onUploadFailed callback for validation/upload errors (file-too-large, invalid-type, upload-failed)
- onUpload accepts sync or async returns
- AttachmentUploadResult discriminated union with explicit interfaces
- Metadata field on Attachment and onUpload return type
AG-UI version bump:
- Bump @ag-ui/client, @ag-ui/core, @ag-ui/encoder, @ag-ui/proto to 0.0.51
- Remove process.env Vite workaround (fixed upstream in 0.0.51)
Deprecation lifecycle:
- @deprecated JSDoc on all legacy image upload APIs
- ImageRenderer, ImageRendererProps, ImageUpload type, imageUploadsEnabled prop,
inputFileAccept prop, ImageRenderer prop, AIMessage.image, ImageData
- Codemod at codemods/migrate-attachments.ts (15 tests)
- Migration guide updated with codemod instructions and new type shapes
Docs:
- New guide: docs/(root)/multimodal-attachments.mdx
- Updated migration guide with onUpload return type, metadata, codemod section
- Cross-links from prebuilt-components and migration guide
- Label change: "Add photos or files" → "Add attachments"
Tests:
- CopilotChat.attachments.test.tsx — 5 tests for onUploadFailed
- migrate-attachments codemod — 15 tests
Replace eslint and prettier with oxlint and oxfmt for faster linting
and formatting across the monorepo. Remove all eslint and prettier
configs, dependencies, and related packages. Add .oxlintrc.json and
.oxfmtrc.json for the new tooling. Update CI workflows and lefthook
hooks accordingly. Reformat codebase with oxfmt.
https://claude.ai/code/session_01GMkSf29p78HuMR1mbXn8He
Flatten all packages from packages/v1/* and packages/v2/* into packages/* —
every package now lives directly under the @copilotkit/ scope with no v1/v2
subdirectories.
- Move all v1 packages (react-core, react-ui, runtime, shared, etc.) from
packages/v1/* to packages/*
- Absorb v2 react code into packages/react-core/src/v2/ (exported via /v2 subpath)
- Absorb v2 agent code into packages/runtime/src/agent/ (exported via /v2 subpath)
- Move v2 packages (core, angular, demo-agents, etc.) to packages/*
- Replace all @copilotkitnext/* imports with @copilotkit/* equivalents
- Keep @copilotkitnext/angular as the sole exception (angular remains on next)
- Update CI workflows, renovate config, release scripts for flat structure
- No public API surface changes — all exports fields are preserved
Co-authored-by: Alem Tuzlak <t.zlak@hotmail.com>
Signed-off-by: Tyler Slaton <tyler@copilotkit.ai>
- Replace husky with lefthook for git hooks management
- Pre-commit runs lint --fix, format, test, and check:packages in parallel
with auto-staging of fixes via stage_fixed
- Commit-msg runs commitlint
- Add dependsOn ^build to test target in nx.json so dependencies are
built before tests run
- Upgrade @analogjs/vite-plugin-angular and @analogjs/vitest-angular
from ^1.20.2 to ^2.2.3 for vite 7 compatibility
- Add pnpm packageExtensions to declare missing vite peer dependency
on @analogjs/vite-plugin-angular
- Fix lint issues: let -> const in agent and react packages
- Disable nx TUI in pre-commit hooks via NX_TUI env var
Austin Merrick