mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Markus Ecker
299c6b2a7a
Addresses issues a code review surfaced in the pre-existing connect-only example (none introduced by the preceding trim, which reviewed clean): - hermes-connection.tsx contained a stray NUL byte in the CopilotKit `key` template literal, so git treated the file as binary (`Bin` diffs) and grep skipped it. Rekey on the target URL only — removes the NUL, drops the session token out of the React key (keys land in the fiber tree / DevTools), and avoids the space-delimiter collision. - Guard all localStorage access (try/catch). Previously a throw in Safari private mode / sandboxed iframes / storage-disabled left `mounted` false forever -> permanent blank screen. - Add dark-mode variants to the connect screen and connection badge; the app is theme-aware (the Toggle Theme demo flips `document.documentElement`). - Document (route.ts comment + README "Security - local / trusted use only") that the user-supplied X-Hermes-Url target is intentional for LOCAL DEV, and that a public deployment must add a host allowlist (SSRF / header-forwarding surface otherwise). No behavior change — the connect-anywhere flow is kept. - Drop two more unused deps + their orphaned files (@radix-ui/react-checkbox, @radix-ui/react-separator; ui/checkbox.tsx, ui/separator.tsx). Build + typecheck clean; verified live (connect, chat turn, dark-mode screen). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>