@copilotkit/react-core 1.70.0 → 1.70.1

package/dist/index.umd.js

@@ -688,7 +688,6 @@ react_markdown = __toESM(react_markdown);
 			newMessages: []
 		};
 	}
-	const PROTOCOL_VERSION = "2025-06-18";
 	function buildSandboxHTML(extraCspDomains) {
 		const baseScriptSrc = "'self' 'wasm-unsafe-eval' 'unsafe-inline' 'unsafe-eval' blob: data: http://localhost:* https://localhost:*";
 		const baseFrameSrc = "* blob: data: http://localhost:* https://localhost:*";
@@ -800,6 +799,13 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 		}
 	};
 	const mcpAppsRequestQueue = new MCPAppsRequestQueue();
+	const MCP_OPEN_LINK_BLOCKED_SCHEMES = new Set([
+		"javascript:",
+		"data:",
+		"vbscript:",
+		"blob:",
+		"file:"
+	]);
 	/**
 	* Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType
 	*/
@@ -815,18 +821,32 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 		serverId: zod.z.string().optional(),
 		toolInput: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
 	});
-	function isRequest(msg) {
-		return "id" in msg && "method" in msg;
-	}
-	function isNotification(msg) {
-		return !("id" in msg) && "method" in msg;
-	}
 	/**
 	* MCP Apps Extension Activity Renderer
 	*
 	* Renders MCP Apps UI in a sandboxed iframe with full protocol support.
 	* Fetches resource content on-demand via proxied MCP requests.
 	*/
+	/**
+	* Permissive `ui/message` schema. ext-apps restricts the request to
+	* `role: "user"` with no `followUp`, but CopilotKit intentionally extends
+	* `ui/message` with `role` ("user" | "assistant") and `followUp` (documented
+	* behavior with dedicated tests). We register our own handler (instead of the
+	* bridge's strict `onmessage`) so those extensions survive the migration.
+	*
+	* Going forward, widgets SHOULD pass the extensions under
+	* `params._meta.copilotkit`; the top-level `role`/`followUp` fields are the
+	* legacy channel, kept for backward compatibility and slated for deprecation.
+	*/
+	const CopilotKitUiMessageSchema = zod.z.object({
+		method: zod.z.literal("ui/message"),
+		params: zod.z.object({
+			role: zod.z.string().optional(),
+			content: zod.z.array(zod.z.any()).optional(),
+			followUp: zod.z.boolean().optional(),
+			_meta: zod.z.record(zod.z.string(), zod.z.any()).optional()
+		}).passthrough()
+	});
 	const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agent }) {
 		const { copilotkit } = useCopilotKit();
 		const containerRef = (0, react.useRef)(null);
@@ -840,41 +860,12 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 		contentRef.current = content;
 		const agentRef = (0, react.useRef)(agent);
 		agentRef.current = agent;
+		const bridgeRef = (0, react.useRef)(null);
 		const fetchStateRef = (0, react.useRef)({
 			inProgress: false,
 			promise: null,
 			resourceUri: null
 		});
-		const sendToIframe = (0, react.useCallback)((msg) => {
-			if (iframeRef.current?.contentWindow) {
-				console.log("[MCPAppsRenderer] Sending to iframe:", msg);
-				iframeRef.current.contentWindow.postMessage(msg, "*");
-			}
-		}, []);
-		const sendResponse = (0, react.useCallback)((id, result) => {
-			sendToIframe({
-				jsonrpc: "2.0",
-				id,
-				result
-			});
-		}, [sendToIframe]);
-		const sendErrorResponse = (0, react.useCallback)((id, code, message) => {
-			sendToIframe({
-				jsonrpc: "2.0",
-				id,
-				error: {
-					code,
-					message
-				}
-			});
-		}, [sendToIframe]);
-		const sendNotification = (0, react.useCallback)((method, params) => {
-			sendToIframe({
-				jsonrpc: "2.0",
-				method,
-				params: params || {}
-			});
-		}, [sendToIframe]);
 		(0, react.useEffect)(() => {
 			const { resourceUri, serverHash, serverId } = content;
 			if (fetchStateRef.current.inProgress && fetchStateRef.current.resourceUri === resourceUri) {
@@ -929,11 +920,15 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 			const container = containerRef.current;
 			if (!container) return;
 			let mounted = true;
-			let messageHandler = null;
-			let initialListener = null;
+			let bridge = null;
 			let createdIframe = null;
 			const setup = async () => {
 				try {
+					const bridgeModule = await import("@modelcontextprotocol/ext-apps/app-bridge").catch((importErr) => {
+						throw new Error("MCP Apps require '@modelcontextprotocol/ext-apps' and its peer '@modelcontextprotocol/sdk'. Install them with: npm install @modelcontextprotocol/ext-apps @modelcontextprotocol/sdk", { cause: importErr });
+					});
+					if (!mounted) return;
+					const { AppBridge, PostMessageTransport } = bridgeModule;
 					const iframe = document.createElement("iframe");
 					createdIframe = iframe;
 					iframe.style.width = "100%";
@@ -944,151 +939,108 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 					iframe.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
 					iframe.setAttribute("data-testid", "mcp-app-iframe");
 					iframe.setAttribute("title", "Interactive MCP application");
-					const sandboxReady = new Promise((resolve) => {
-						initialListener = (event) => {
-							if (event.source === iframe.contentWindow) {
-								if (event.data?.method === "ui/notifications/sandbox-proxy-ready") {
-									if (initialListener) {
-										window.removeEventListener("message", initialListener);
-										initialListener = null;
-									}
-									resolve();
-								}
-							}
-						};
-						window.addEventListener("message", initialListener);
-					});
-					if (!mounted) {
-						if (initialListener) {
-							window.removeEventListener("message", initialListener);
-							initialListener = null;
-						}
-						return;
-					}
 					const cspDomains = fetchedResource._meta?.ui?.csp?.resourceDomains;
 					iframe.srcdoc = buildSandboxHTML(cspDomains);
 					iframeRef.current = iframe;
 					container.appendChild(iframe);
-					await sandboxReady;
-					if (!mounted) return;
-					console.log("[MCPAppsRenderer] Sandbox proxy ready");
-					messageHandler = async (event) => {
-						if (event.source !== iframe.contentWindow) return;
-						const msg = event.data;
-						if (!msg || typeof msg !== "object" || msg.jsonrpc !== "2.0") return;
-						console.log("[MCPAppsRenderer] Received from iframe:", msg);
-						if (isRequest(msg)) switch (msg.method) {
-							case "ui/initialize":
-								sendResponse(msg.id, {
-									protocolVersion: PROTOCOL_VERSION,
-									hostInfo: {
-										name: "CopilotKit MCP Apps Host",
-										version: "1.0.0"
-									},
-									hostCapabilities: {
-										openLinks: {},
-										logging: {}
-									},
-									hostContext: {
-										theme: "light",
-										platform: "web"
-									}
-								});
-								break;
-							case "ui/message": {
-								const currentAgent = agentRef.current;
-								if (!currentAgent) {
-									console.warn("[MCPAppsRenderer] ui/message: No agent available");
-									sendResponse(msg.id, { isError: false });
-									break;
-								}
-								try {
-									const params = msg.params;
-									const role = params.role || "user";
-									const textContent = params.content?.filter((c) => c.type === "text" && c.text).map((c) => c.text).join("\n") || "";
-									if (textContent) currentAgent.addMessage({
-										id: crypto.randomUUID(),
-										role,
-										content: textContent
-									});
-									sendResponse(msg.id, { isError: false });
-									if ((params.followUp ?? role === "user") && textContent) {
-										const capturedThreadId = currentAgent.threadId || "default";
-										mcpAppsRequestQueue.enqueue(currentAgent, () => ɵrunMcpFollowUp({
-											host: copilotkit,
-											agent: currentAgent,
-											capturedThreadId
-										})).catch((err) => console.error("[MCPAppsRenderer] ui/message agent run failed:", err));
-									}
-								} catch (err) {
-									console.error("[MCPAppsRenderer] ui/message error:", err);
-									sendResponse(msg.id, { isError: true });
-								}
-								break;
-							}
-							case "ui/open-link": {
-								const url = msg.params?.url;
-								if (url) {
-									window.open(url, "_blank", "noopener,noreferrer");
-									sendResponse(msg.id, { isError: false });
-								} else sendErrorResponse(msg.id, -32602, "Missing url parameter");
-								break;
-							}
-							case "tools/call": {
-								const { serverHash, serverId } = contentRef.current;
-								const currentAgent = agentRef.current;
-								if (!serverHash) {
-									sendErrorResponse(msg.id, -32603, "No server hash available for proxying");
-									break;
-								}
-								if (!currentAgent) {
-									sendErrorResponse(msg.id, -32603, "No agent available for proxying");
-									break;
-								}
-								try {
-									const runResult = await mcpAppsRequestQueue.enqueue(currentAgent, () => currentAgent.runAgent({ forwardedProps: { __proxiedMCPRequest: {
-										serverHash,
-										serverId,
-										method: "tools/call",
-										params: msg.params
-									} } }));
-									sendResponse(msg.id, runResult.result || {});
-								} catch (err) {
-									console.error("[MCPAppsRenderer] tools/call error:", err);
-									sendErrorResponse(msg.id, -32603, String(err));
-								}
-								break;
-							}
-							default: sendErrorResponse(msg.id, -32601, `Method not found: ${msg.method}`);
-						}
-						if (isNotification(msg)) switch (msg.method) {
-							case "ui/notifications/initialized":
-								console.log("[MCPAppsRenderer] Inner iframe initialized");
-								if (mounted) setIframeReady(true);
-								break;
-							case "ui/notifications/size-changed": {
-								const { width, height } = msg.params || {};
-								console.log("[MCPAppsRenderer] Size change:", {
-									width,
-									height
-								});
-								if (mounted) setIframeSize({
-									width: typeof width === "number" ? width : void 0,
-									height: typeof height === "number" ? height : void 0
-								});
-								break;
-							}
-							case "notifications/message":
-								console.log("[MCPAppsRenderer] App log:", msg.params);
-								break;
-						}
-					};
-					window.addEventListener("message", messageHandler);
+					const win = iframe.contentWindow;
+					if (!win) throw new Error("Sandbox iframe has no contentWindow");
 					let html;
 					if (fetchedResource.text) html = fetchedResource.text;
 					else if (fetchedResource.blob) html = atob(fetchedResource.blob);
 					else throw new Error("Resource has no text or blob content");
-					sendNotification("ui/notifications/sandbox-resource-ready", { html });
+					bridge = new AppBridge(null, {
+						name: "CopilotKit MCP Apps Host",
+						version: "1.0.0"
+					}, {
+						openLinks: {},
+						logging: {},
+						message: { text: {} }
+					}, { hostContext: {
+						theme: "light",
+						platform: "web"
+					} });
+					bridge.onsandboxready = () => {
+						bridge?.sendSandboxResourceReady({ html });
+					};
+					bridge.setRequestHandler(CopilotKitUiMessageSchema, async (req) => {
+						const currentAgent = agentRef.current;
+						if (!currentAgent) {
+							console.warn("[MCPAppsRenderer] ui/message: No agent available");
+							return { isError: false };
+						}
+						try {
+							const params = req.params;
+							const ck = params._meta?.copilotkit ?? {};
+							const role = ck.role || params.role || "user";
+							const textContent = params.content?.filter((c) => c.type === "text" && c.text).map((c) => c.text).join("\n") || "";
+							if (textContent) currentAgent.addMessage({
+								id: crypto.randomUUID(),
+								role,
+								content: textContent
+							});
+							if ((ck.followUp ?? params.followUp ?? role === "user") && textContent) {
+								const capturedThreadId = currentAgent.threadId || "default";
+								mcpAppsRequestQueue.enqueue(currentAgent, () => ɵrunMcpFollowUp({
+									host: copilotkit,
+									agent: currentAgent,
+									capturedThreadId
+								})).catch((err) => console.error("[MCPAppsRenderer] ui/message agent run failed:", err));
+							}
+							return { isError: false };
+						} catch (err) {
+							console.error("[MCPAppsRenderer] ui/message error:", err);
+							return { isError: true };
+						}
+					});
+					bridge.onopenlink = async ({ url }) => {
+						let parsed;
+						try {
+							parsed = new URL(url);
+						} catch {
+							console.warn("[MCPAppsRenderer] ui/open-link rejected: unparseable url");
+							return { isError: true };
+						}
+						if (MCP_OPEN_LINK_BLOCKED_SCHEMES.has(parsed.protocol)) {
+							console.warn("[MCPAppsRenderer] ui/open-link rejected: blocked scheme", parsed.protocol);
+							return { isError: true };
+						}
+						window.open(url, "_blank", "noopener,noreferrer");
+						return { isError: false };
+					};
+					bridge.oncalltool = async (params) => {
+						const { serverHash, serverId } = contentRef.current;
+						const currentAgent = agentRef.current;
+						if (!serverHash) throw new Error("No server hash available for proxying");
+						if (!currentAgent) throw new Error("No agent available for proxying");
+						return (await mcpAppsRequestQueue.enqueue(currentAgent, () => currentAgent.runAgent({ forwardedProps: { __proxiedMCPRequest: {
+							serverHash,
+							serverId,
+							method: "tools/call",
+							params
+						} } }))).result || { content: [] };
+					};
+					bridge.onsizechange = (p) => {
+						if (!mounted) return;
+						const { width, height } = p || {};
+						setIframeSize({
+							width: typeof width === "number" ? width : void 0,
+							height: typeof height === "number" ? height : void 0
+						});
+					};
+					bridge.oninitialized = () => {
+						if (mounted) setIframeReady(true);
+					};
+					bridge.onloggingmessage = (p) => {
+						console.log("[MCPAppsRenderer] App log:", p);
+					};
+					const transport = new PostMessageTransport(win, win);
+					await bridge.connect(transport);
+					if (!mounted) {
+						await bridge.close();
+						return;
+					}
+					bridgeRef.current = bridge;
 				} catch (err) {
 					console.error("[MCPAppsRenderer] Setup error:", err);
 					if (mounted) setError(err instanceof Error ? err : new Error(String(err)));
@@ -1097,11 +1049,8 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 			setup();
 			return () => {
 				mounted = false;
-				if (initialListener) {
-					window.removeEventListener("message", initialListener);
-					initialListener = null;
-				}
-				if (messageHandler) window.removeEventListener("message", messageHandler);
+				bridgeRef.current = null;
+				bridge?.close();
 				if (createdIframe) {
 					createdIframe.remove();
 					createdIframe = null;
@@ -1111,9 +1060,7 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 		}, [
 			isLoading,
 			fetchedResource,
-			sendNotification,
-			sendResponse,
-			sendErrorResponse
+			copilotkit
 		]);
 		(0, react.useEffect)(() => {
 			if (iframeRef.current) {
@@ -1125,25 +1072,11 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 			}
 		}, [iframeSize]);
 		(0, react.useEffect)(() => {
-			if (iframeReady && content.toolInput) {
-				console.log("[MCPAppsRenderer] Sending tool input:", content.toolInput);
-				sendNotification("ui/notifications/tool-input", { arguments: content.toolInput });
-			}
-		}, [
-			iframeReady,
-			content.toolInput,
-			sendNotification
-		]);
+			if (iframeReady && content.toolInput) bridgeRef.current?.sendToolInput({ arguments: content.toolInput });
+		}, [iframeReady, content.toolInput]);
 		(0, react.useEffect)(() => {
-			if (iframeReady && content.result) {
-				console.log("[MCPAppsRenderer] Sending tool result:", content.result);
-				sendNotification("ui/notifications/tool-result", content.result);
-			}
-		}, [
-			iframeReady,
-			content.result,
-			sendNotification
-		]);
+			if (iframeReady && content.result) bridgeRef.current?.sendToolResult(content.result);
+		}, [iframeReady, content.result]);
 		const borderStyle = fetchedResource?._meta?.ui?.prefersBorder === true ? {
 			borderRadius: "8px",
 			backgroundColor: "#f9f9f9",
@@ -2820,7 +2753,8 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 			tool.name,
 			tool.available,
 			copilotkit,
-			JSON.stringify(extraDeps)
+			JSON.stringify(extraDeps),
+			JSON.stringify(tool.webmcp ?? null)
 		]);
 	}
 
@@ -4537,7 +4471,7 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 		switch (error.code) {
 			case _copilotkit_shared.CopilotKitErrorCode.MISSING_PUBLIC_API_KEY_ERROR: return { primary: {
 				label: "Show me how",
-				onClick: () => window.open("https://docs.copilotkit.ai/premium/overview#getting-access", "_blank", "noopener,noreferrer")
+				onClick: () => window.open("https://docs.copilotkit.ai/intelligence/overview#plans-and-access", "_blank", "noopener,noreferrer")
 			} };
 			case _copilotkit_shared.CopilotKitErrorCode.UPGRADE_REQUIRED_ERROR: return { primary: {
 				label: "Upgrade",
@@ -6129,7 +6063,7 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 	* `useCopilotChatHeadless_c` is for building fully custom UI (headless UI) implementations.
 	*
 	* <Callout title="This is a CopilotKit Intelligence feature">
-	* Read more about <a href="/premium/overview">CopilotKit Intelligence</a>.
+	* Read more about <a href="/intelligence/overview">CopilotKit Intelligence</a>.
 	*
 	* Usage is generous and **free** to get started.
 	* </Callout>
@@ -6360,7 +6294,7 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 	* See https://docs.copilotkit.ai/reference/v2/hooks/useFrontendTool
 	*/
 	function useFrontendTool(tool, dependencies) {
-		const { name, description, parameters, render, followUp, available } = tool;
+		const { name, description, parameters, render, followUp, available, webmcp } = tool;
 		const zodParameters = (0, _copilotkit_shared.getZodParameters)(parameters);
 		const renderRef = (0, react.useRef)(render);
 		(0, react.useEffect)(() => {
@@ -6391,7 +6325,8 @@ window.parent.postMessage({jsonrpc:"2.0",method:"ui/notifications/sandbox-proxy-
 			handler: tool.handler ? (args) => handlerRef.current?.(args) : void 0,
 			followUp,
 			render: normalizedRender,
-			available: available === void 0 ? void 0 : available !== "disabled"
+			available: available === void 0 ? void 0 : available !== "disabled",
+			webmcp
 		});
 	}