Benjamin Taylor
2c05ed6885
The notes now land in a source-controlled changelog instead of a scratch file that rides the release branch. One file per lane, because the lanes version independently: a shared file would interleave `1.70.0`, `angular/0.5.0` and `channels/0.9.0` into one unreadable sequence. monorepo -> CHANGELOG.md angular -> packages/angular/CHANGELOG.md channels -> packages/channels/CHANGELOG.md `write-changelog.ts` prepends this release's section on the release branch, create-pull-request commits it (a tracked file, always staged), and `extract-release-notes.ts` reads the section back in the publish job as the GitHub Release body. The changelog is therefore both the durable record and the review surface: editing a section on the release PR changes what ships. release-notes.md goes back to being ignored, so the same notes never exist as two editable copies. Also deletes 29 changesets-era changelogs that no tooling had written since April. They stopped at 1.55.2 while the lane shipped 1.69.3, and packages/angular/CHANGELOG.md still claimed 1.54.3 from before that lane split onto its own 0.x line. Their content stays recoverable from git history. A test pins the tracked changelog set to the lanes so they cannot creep back and contradict the real versions. Extraction never fails the publish job: it runs after npm publish, so a miss annotates loudly and falls through to the existing bodyless-release fallback rather than stranding the tag. Committed with --no-verify: the pre-commit nx lane cannot run in this worktree (packages/core and packages/channels-ui have no node_modules, and `nx run @copilotkit/core:build` fails identically with the tree clean). The only change under packages/** is deleting orphan markdown that no build or test reads.
CopilotKit - Runtime
✨ Why CopilotKit?
- Minutes to integrate - Get started quickly with our CLI
- Framework agnostic - Works with React, Next.js, AGUI and more
- Production-ready UI - Use customizable components or build with headless UI
- Built-in security - Prompt injection protection
- Open source - Full transparency and community-driven
🧑💻 Real life use cases
Deploy deeply-integrated AI assistants & agents that work alongside your users inside your applications.
🏆 Featured Examples
Trusted Inspector metadata
An Intelligence-backed v2 runtime can proxy trusted project and license context
to the Inspector. The runtime advertises this support with
inspectorMetadata: true in its runtime-info response.
| Runtime mode | Request |
|---|---|
| Multi-route | GET {basePath}/inspector-metadata |
| Single-route | POST {basePath} with { "method": "inspector/metadata" } |
A valid response is a sanitized InspectorMetadataV1 JSON object with
Cache-Control: no-store, private. Missing data, an unsupported schema, a
non-Intelligence runtime, or a provider failure returns 204 with the same
cache policy. This optional request never changes the main runtime connection
state. The upstream Intelligence request has a five-second deadline; a timeout
uses the same private 204 path.
Runtime keeps schemaVersion: 1 and returns the object normalized by Shared.
Older producers may omit usage.expiringSoonCount, and 0 stays a known zero.
If this optional leaf is malformed, Shared removes only the leaf and keeps valid
base usage and sibling modules. Runtime does not calculate or cache expiry, and
older consumers ignore the additive leaf.
The Intelligence request uses the API key configured on the server-side
CopilotKitIntelligence client. The proxy does not forward browser headers or
cookies to Intelligence, and it does not expose provider error bodies to the
browser. Browser headers and configured fetch credentials still apply between
@copilotkit/core and your Copilot Runtime, so you can protect the runtime route
with your normal app auth.
Deploy the Intelligence producer before releasing a runtime that advertises the
capability. New runtimes treat a 404 from an older Intelligence App API as
compatible absence and return 204 to the client.
Documentation
To get started with CopilotKit, please check out the documentation.
Intelligence identity and Memory
An Intelligence Runtime supports web only, Channels only, or both. Web routes
need identifyUser(request). Each Channel has its own identifyUser policy in
createChannel. A Channels-only Runtime omits the web callback and exposes no
functional web routes.
const runtime = new CopilotRuntime({
agents,
intelligence,
identifyUser: authenticateApplicationUser,
channels: [supportChannel],
memory: {
access: async ({ request, user, consumer }) => {
const role = await roleFor(request, user);
if (role === "blocked") return null;
return consumer === "client"
? { user: "read", project: "none" }
: { user: "read-write", project: "read" };
},
},
});
The callback runs once per web request. Its user owns ordinary web Threads and
is reused for agent and browser Memory policy. Adding memory exposes the
browser Memory routes and agent tools under the same policy. A denial returns
403; a policy error fails the request. Omitting memory hides the browser
routes and does not attach Memory tools.
exposeMemoryRoutes and
CopilotKitIntelligence({ enableEnterpriseLearning: true }) remain for one
compatibility window. New code should use memory.access.
Analytics & Privacy
CopilotKit uses Scarf for anonymous usage analytics to help improve the product. Scarf handles all privacy compliance and does not store raw IP addresses. This helps us understand how CopilotKit is being used and prioritize improvements.
Opting Out
To disable analytics, set the environment variable:
export COPILOTKIT_TELEMETRY_DISABLED=true
Or use the DO_NOT_TRACK standard:
export DO_NOT_TRACK=1