@copilotkit/react-core 1.70.0 → 1.70.1

package/dist/{copilotkit-BE76j111.cjs → copilotkit-CxLT6zFx.cjs}

@@ -1765,7 +1765,6 @@ async function ɵrunMcpFollowUp({ host, agent, capturedThreadId }) {
 		newMessages: []
 	};
 }
-const PROTOCOL_VERSION = "2025-06-18";
 function buildSandboxHTML(extraCspDomains) {
 	const baseScriptSrc = "'self' 'wasm-unsafe-eval' 'unsafe-inline' 'unsafe-eval' blob: data: http://localhost:* https://localhost:*";
 	const baseFrameSrc = "* blob: data: http://localhost:* https://localhost:*";
@@ -1877,6 +1876,13 @@ var MCPAppsRequestQueue = class {
 	}
 };
 const mcpAppsRequestQueue = new MCPAppsRequestQueue();
+const MCP_OPEN_LINK_BLOCKED_SCHEMES = new Set([
+	"javascript:",
+	"data:",
+	"vbscript:",
+	"blob:",
+	"file:"
+]);
 /**
 * Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType
 */
@@ -1892,18 +1898,32 @@ const MCPAppsActivityContentSchema = zod.z.object({
 	serverId: zod.z.string().optional(),
 	toolInput: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
 });
-function isRequest(msg) {
-	return "id" in msg && "method" in msg;
-}
-function isNotification(msg) {
-	return !("id" in msg) && "method" in msg;
-}
 /**
 * MCP Apps Extension Activity Renderer
 *
 * Renders MCP Apps UI in a sandboxed iframe with full protocol support.
 * Fetches resource content on-demand via proxied MCP requests.
 */
+/**
+* Permissive `ui/message` schema. ext-apps restricts the request to
+* `role: "user"` with no `followUp`, but CopilotKit intentionally extends
+* `ui/message` with `role` ("user" | "assistant") and `followUp` (documented
+* behavior with dedicated tests). We register our own handler (instead of the
+* bridge's strict `onmessage`) so those extensions survive the migration.
+*
+* Going forward, widgets SHOULD pass the extensions under
+* `params._meta.copilotkit`; the top-level `role`/`followUp` fields are the
+* legacy channel, kept for backward compatibility and slated for deprecation.
+*/
+const CopilotKitUiMessageSchema = zod.z.object({
+	method: zod.z.literal("ui/message"),
+	params: zod.z.object({
+		role: zod.z.string().optional(),
+		content: zod.z.array(zod.z.any()).optional(),
+		followUp: zod.z.boolean().optional(),
+		_meta: zod.z.record(zod.z.string(), zod.z.any()).optional()
+	}).passthrough()
+});
 const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agent }) {
 	const { copilotkit } = (0, _copilotkit_react_core_v2_context.useCopilotKit)();
 	const containerRef = (0, react.useRef)(null);
@@ -1917,41 +1937,12 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 	contentRef.current = content;
 	const agentRef = (0, react.useRef)(agent);
 	agentRef.current = agent;
+	const bridgeRef = (0, react.useRef)(null);
 	const fetchStateRef = (0, react.useRef)({
 		inProgress: false,
 		promise: null,
 		resourceUri: null
 	});
-	const sendToIframe = (0, react.useCallback)((msg) => {
-		if (iframeRef.current?.contentWindow) {
-			console.log("[MCPAppsRenderer] Sending to iframe:", msg);
-			iframeRef.current.contentWindow.postMessage(msg, "*");
-		}
-	}, []);
-	const sendResponse = (0, react.useCallback)((id, result) => {
-		sendToIframe({
-			jsonrpc: "2.0",
-			id,
-			result
-		});
-	}, [sendToIframe]);
-	const sendErrorResponse = (0, react.useCallback)((id, code, message) => {
-		sendToIframe({
-			jsonrpc: "2.0",
-			id,
-			error: {
-				code,
-				message
-			}
-		});
-	}, [sendToIframe]);
-	const sendNotification = (0, react.useCallback)((method, params) => {
-		sendToIframe({
-			jsonrpc: "2.0",
-			method,
-			params: params || {}
-		});
-	}, [sendToIframe]);
 	(0, react.useEffect)(() => {
 		const { resourceUri, serverHash, serverId } = content;
 		if (fetchStateRef.current.inProgress && fetchStateRef.current.resourceUri === resourceUri) {
@@ -2006,11 +1997,15 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 		const container = containerRef.current;
 		if (!container) return;
 		let mounted = true;
-		let messageHandler = null;
-		let initialListener = null;
+		let bridge = null;
 		let createdIframe = null;
 		const setup = async () => {
 			try {
+				const bridgeModule = await import("@modelcontextprotocol/ext-apps/app-bridge").catch((importErr) => {
+					throw new Error("MCP Apps require '@modelcontextprotocol/ext-apps' and its peer '@modelcontextprotocol/sdk'. Install them with: npm install @modelcontextprotocol/ext-apps @modelcontextprotocol/sdk", { cause: importErr });
+				});
+				if (!mounted) return;
+				const { AppBridge, PostMessageTransport } = bridgeModule;
 				const iframe = document.createElement("iframe");
 				createdIframe = iframe;
 				iframe.style.width = "100%";
@@ -2021,151 +2016,108 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 				iframe.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
 				iframe.setAttribute("data-testid", "mcp-app-iframe");
 				iframe.setAttribute("title", "Interactive MCP application");
-				const sandboxReady = new Promise((resolve) => {
-					initialListener = (event) => {
-						if (event.source === iframe.contentWindow) {
-							if (event.data?.method === "ui/notifications/sandbox-proxy-ready") {
-								if (initialListener) {
-									window.removeEventListener("message", initialListener);
-									initialListener = null;
-								}
-								resolve();
-							}
-						}
-					};
-					window.addEventListener("message", initialListener);
-				});
-				if (!mounted) {
-					if (initialListener) {
-						window.removeEventListener("message", initialListener);
-						initialListener = null;
-					}
-					return;
-				}
 				const cspDomains = fetchedResource._meta?.ui?.csp?.resourceDomains;
 				iframe.srcdoc = buildSandboxHTML(cspDomains);
 				iframeRef.current = iframe;
 				container.appendChild(iframe);
-				await sandboxReady;
-				if (!mounted) return;
-				console.log("[MCPAppsRenderer] Sandbox proxy ready");
-				messageHandler = async (event) => {
-					if (event.source !== iframe.contentWindow) return;
-					const msg = event.data;
-					if (!msg || typeof msg !== "object" || msg.jsonrpc !== "2.0") return;
-					console.log("[MCPAppsRenderer] Received from iframe:", msg);
-					if (isRequest(msg)) switch (msg.method) {
-						case "ui/initialize":
-							sendResponse(msg.id, {
-								protocolVersion: PROTOCOL_VERSION,
-								hostInfo: {
-									name: "CopilotKit MCP Apps Host",
-									version: "1.0.0"
-								},
-								hostCapabilities: {
-									openLinks: {},
-									logging: {}
-								},
-								hostContext: {
-									theme: "light",
-									platform: "web"
-								}
-							});
-							break;
-						case "ui/message": {
-							const currentAgent = agentRef.current;
-							if (!currentAgent) {
-								console.warn("[MCPAppsRenderer] ui/message: No agent available");
-								sendResponse(msg.id, { isError: false });
-								break;
-							}
-							try {
-								const params = msg.params;
-								const role = params.role || "user";
-								const textContent = params.content?.filter((c) => c.type === "text" && c.text).map((c) => c.text).join("\n") || "";
-								if (textContent) currentAgent.addMessage({
-									id: crypto.randomUUID(),
-									role,
-									content: textContent
-								});
-								sendResponse(msg.id, { isError: false });
-								if ((params.followUp ?? role === "user") && textContent) {
-									const capturedThreadId = currentAgent.threadId || "default";
-									mcpAppsRequestQueue.enqueue(currentAgent, () => ɵrunMcpFollowUp({
-										host: copilotkit,
-										agent: currentAgent,
-										capturedThreadId
-									})).catch((err) => console.error("[MCPAppsRenderer] ui/message agent run failed:", err));
-								}
-							} catch (err) {
-								console.error("[MCPAppsRenderer] ui/message error:", err);
-								sendResponse(msg.id, { isError: true });
-							}
-							break;
-						}
-						case "ui/open-link": {
-							const url = msg.params?.url;
-							if (url) {
-								window.open(url, "_blank", "noopener,noreferrer");
-								sendResponse(msg.id, { isError: false });
-							} else sendErrorResponse(msg.id, -32602, "Missing url parameter");
-							break;
-						}
-						case "tools/call": {
-							const { serverHash, serverId } = contentRef.current;
-							const currentAgent = agentRef.current;
-							if (!serverHash) {
-								sendErrorResponse(msg.id, -32603, "No server hash available for proxying");
-								break;
-							}
-							if (!currentAgent) {
-								sendErrorResponse(msg.id, -32603, "No agent available for proxying");
-								break;
-							}
-							try {
-								const runResult = await mcpAppsRequestQueue.enqueue(currentAgent, () => currentAgent.runAgent({ forwardedProps: { __proxiedMCPRequest: {
-									serverHash,
-									serverId,
-									method: "tools/call",
-									params: msg.params
-								} } }));
-								sendResponse(msg.id, runResult.result || {});
-							} catch (err) {
-								console.error("[MCPAppsRenderer] tools/call error:", err);
-								sendErrorResponse(msg.id, -32603, String(err));
-							}
-							break;
-						}
-						default: sendErrorResponse(msg.id, -32601, `Method not found: ${msg.method}`);
-					}
-					if (isNotification(msg)) switch (msg.method) {
-						case "ui/notifications/initialized":
-							console.log("[MCPAppsRenderer] Inner iframe initialized");
-							if (mounted) setIframeReady(true);
-							break;
-						case "ui/notifications/size-changed": {
-							const { width, height } = msg.params || {};
-							console.log("[MCPAppsRenderer] Size change:", {
-								width,
-								height
-							});
-							if (mounted) setIframeSize({
-								width: typeof width === "number" ? width : void 0,
-								height: typeof height === "number" ? height : void 0
-							});
-							break;
-						}
-						case "notifications/message":
-							console.log("[MCPAppsRenderer] App log:", msg.params);
-							break;
-					}
-				};
-				window.addEventListener("message", messageHandler);
+				const win = iframe.contentWindow;
+				if (!win) throw new Error("Sandbox iframe has no contentWindow");
 				let html;
 				if (fetchedResource.text) html = fetchedResource.text;
 				else if (fetchedResource.blob) html = atob(fetchedResource.blob);
 				else throw new Error("Resource has no text or blob content");
-				sendNotification("ui/notifications/sandbox-resource-ready", { html });
+				bridge = new AppBridge(null, {
+					name: "CopilotKit MCP Apps Host",
+					version: "1.0.0"
+				}, {
+					openLinks: {},
+					logging: {},
+					message: { text: {} }
+				}, { hostContext: {
+					theme: "light",
+					platform: "web"
+				} });
+				bridge.onsandboxready = () => {
+					bridge?.sendSandboxResourceReady({ html });
+				};
+				bridge.setRequestHandler(CopilotKitUiMessageSchema, async (req) => {
+					const currentAgent = agentRef.current;
+					if (!currentAgent) {
+						console.warn("[MCPAppsRenderer] ui/message: No agent available");
+						return { isError: false };
+					}
+					try {
+						const params = req.params;
+						const ck = params._meta?.copilotkit ?? {};
+						const role = ck.role || params.role || "user";
+						const textContent = params.content?.filter((c) => c.type === "text" && c.text).map((c) => c.text).join("\n") || "";
+						if (textContent) currentAgent.addMessage({
+							id: crypto.randomUUID(),
+							role,
+							content: textContent
+						});
+						if ((ck.followUp ?? params.followUp ?? role === "user") && textContent) {
+							const capturedThreadId = currentAgent.threadId || "default";
+							mcpAppsRequestQueue.enqueue(currentAgent, () => ɵrunMcpFollowUp({
+								host: copilotkit,
+								agent: currentAgent,
+								capturedThreadId
+							})).catch((err) => console.error("[MCPAppsRenderer] ui/message agent run failed:", err));
+						}
+						return { isError: false };
+					} catch (err) {
+						console.error("[MCPAppsRenderer] ui/message error:", err);
+						return { isError: true };
+					}
+				});
+				bridge.onopenlink = async ({ url }) => {
+					let parsed;
+					try {
+						parsed = new URL(url);
+					} catch {
+						console.warn("[MCPAppsRenderer] ui/open-link rejected: unparseable url");
+						return { isError: true };
+					}
+					if (MCP_OPEN_LINK_BLOCKED_SCHEMES.has(parsed.protocol)) {
+						console.warn("[MCPAppsRenderer] ui/open-link rejected: blocked scheme", parsed.protocol);
+						return { isError: true };
+					}
+					window.open(url, "_blank", "noopener,noreferrer");
+					return { isError: false };
+				};
+				bridge.oncalltool = async (params) => {
+					const { serverHash, serverId } = contentRef.current;
+					const currentAgent = agentRef.current;
+					if (!serverHash) throw new Error("No server hash available for proxying");
+					if (!currentAgent) throw new Error("No agent available for proxying");
+					return (await mcpAppsRequestQueue.enqueue(currentAgent, () => currentAgent.runAgent({ forwardedProps: { __proxiedMCPRequest: {
+						serverHash,
+						serverId,
+						method: "tools/call",
+						params
+					} } }))).result || { content: [] };
+				};
+				bridge.onsizechange = (p) => {
+					if (!mounted) return;
+					const { width, height } = p || {};
+					setIframeSize({
+						width: typeof width === "number" ? width : void 0,
+						height: typeof height === "number" ? height : void 0
+					});
+				};
+				bridge.oninitialized = () => {
+					if (mounted) setIframeReady(true);
+				};
+				bridge.onloggingmessage = (p) => {
+					console.log("[MCPAppsRenderer] App log:", p);
+				};
+				const transport = new PostMessageTransport(win, win);
+				await bridge.connect(transport);
+				if (!mounted) {
+					await bridge.close();
+					return;
+				}
+				bridgeRef.current = bridge;
 			} catch (err) {
 				console.error("[MCPAppsRenderer] Setup error:", err);
 				if (mounted) setError(err instanceof Error ? err : new Error(String(err)));
@@ -2174,11 +2126,8 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 		setup();
 		return () => {
 			mounted = false;
-			if (initialListener) {
-				window.removeEventListener("message", initialListener);
-				initialListener = null;
-			}
-			if (messageHandler) window.removeEventListener("message", messageHandler);
+			bridgeRef.current = null;
+			bridge?.close();
 			if (createdIframe) {
 				createdIframe.remove();
 				createdIframe = null;
@@ -2188,9 +2137,7 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 	}, [
 		isLoading,
 		fetchedResource,
-		sendNotification,
-		sendResponse,
-		sendErrorResponse
+		copilotkit
 	]);
 	(0, react.useEffect)(() => {
 		if (iframeRef.current) {
@@ -2202,25 +2149,11 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 		}
 	}, [iframeSize]);
 	(0, react.useEffect)(() => {
-		if (iframeReady && content.toolInput) {
-			console.log("[MCPAppsRenderer] Sending tool input:", content.toolInput);
-			sendNotification("ui/notifications/tool-input", { arguments: content.toolInput });
-		}
-	}, [
-		iframeReady,
-		content.toolInput,
-		sendNotification
-	]);
+		if (iframeReady && content.toolInput) bridgeRef.current?.sendToolInput({ arguments: content.toolInput });
+	}, [iframeReady, content.toolInput]);
 	(0, react.useEffect)(() => {
-		if (iframeReady && content.result) {
-			console.log("[MCPAppsRenderer] Sending tool result:", content.result);
-			sendNotification("ui/notifications/tool-result", content.result);
-		}
-	}, [
-		iframeReady,
-		content.result,
-		sendNotification
-	]);
+		if (iframeReady && content.result) bridgeRef.current?.sendToolResult(content.result);
+	}, [iframeReady, content.result]);
 	const borderStyle = fetchedResource?._meta?.ui?.prefersBorder === true ? {
 		borderRadius: "8px",
 		backgroundColor: "#f9f9f9",
@@ -4035,7 +3968,8 @@ function useFrontendTool(tool, deps) {
 		tool.name,
 		tool.available,
 		copilotkit,
-		JSON.stringify(extraDeps)
+		JSON.stringify(extraDeps),
+		JSON.stringify(tool.webmcp ?? null)
 	]);
 }
 
@@ -5829,9 +5763,9 @@ const DEFAULT_CONTAINERS = ["project"];
 * }
 * ```
 *
-* @deprecated Legacy plural-container annotation compatibility only. New
-* Intelligence runtimes assign one container with `ɵlearning.containerId` on
-* `CopilotRuntime`.
+* @deprecated This hook supports only the legacy plural-container annotation.
+* Configure `getLearningContainerId` on `CopilotKitIntelligence` for new
+* Intelligence runtimes.
 */
 function useLearningContainers({ threadId, learningContainers }) {
 	const { copilotkit } = (0, _copilotkit_react_core_v2_context.useCopilotKit)();
@@ -5935,9 +5869,9 @@ function useLearningContainers({ threadId, learningContainers }) {
 * }
 * ```
 *
-* @deprecated Legacy plural-container annotation compatibility only. New
-* Intelligence runtimes assign one container with `ɵlearning.containerId` on
-* `CopilotRuntime`.
+* @deprecated This hook supports only the legacy plural-container annotation.
+* Configure `getLearningContainerId` on `CopilotKitIntelligence` for new
+* Intelligence runtimes.
 */
 function useLearningContainersInCurrentThread({ learningContainers }) {
 	const threadId = useCopilotChatConfiguration()?.threadId;
@@ -10942,7 +10876,7 @@ const getErrorActions = (error) => {
 	switch (error.code) {
 		case _copilotkit_shared.CopilotKitErrorCode.MISSING_PUBLIC_API_KEY_ERROR: return { primary: {
 			label: "Show me how",
-			onClick: () => window.open("https://docs.copilotkit.ai/premium/overview#getting-access", "_blank", "noopener,noreferrer")
+			onClick: () => window.open("https://docs.copilotkit.ai/intelligence/overview#plans-and-access", "_blank", "noopener,noreferrer")
 		} };
 		case _copilotkit_shared.CopilotKitErrorCode.UPGRADE_REQUIRED_ERROR: return { primary: {
 			label: "Upgrade",
@@ -12689,4 +12623,4 @@ Object.defineProperty(exports, 'ɵrunMcpFollowUp', {
     return ɵrunMcpFollowUp;
   }
 });
-//# sourceMappingURL=copilotkit-BE76j111.cjs.map
+//# sourceMappingURL=copilotkit-CxLT6zFx.cjs.map