@copilotkit/react-core 1.70.0 → 1.70.1

package/dist/{copilotkit-B7aFKfQR.mjs → copilotkit-DiUK2Bhq.mjs}

@@ -1735,7 +1735,6 @@ async function ɵrunMcpFollowUp({ host, agent, capturedThreadId }) {
 		newMessages: []
 	};
 }
-const PROTOCOL_VERSION = "2025-06-18";
 function buildSandboxHTML(extraCspDomains) {
 	const baseScriptSrc = "'self' 'wasm-unsafe-eval' 'unsafe-inline' 'unsafe-eval' blob: data: http://localhost:* https://localhost:*";
 	const baseFrameSrc = "* blob: data: http://localhost:* https://localhost:*";
@@ -1847,6 +1846,13 @@ var MCPAppsRequestQueue = class {
 	}
 };
 const mcpAppsRequestQueue = new MCPAppsRequestQueue();
+const MCP_OPEN_LINK_BLOCKED_SCHEMES = new Set([
+	"javascript:",
+	"data:",
+	"vbscript:",
+	"blob:",
+	"file:"
+]);
 /**
 * Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType
 */
@@ -1862,18 +1868,32 @@ const MCPAppsActivityContentSchema = z.object({
 	serverId: z.string().optional(),
 	toolInput: z.record(z.string(), z.unknown()).optional()
 });
-function isRequest(msg) {
-	return "id" in msg && "method" in msg;
-}
-function isNotification(msg) {
-	return !("id" in msg) && "method" in msg;
-}
 /**
 * MCP Apps Extension Activity Renderer
 *
 * Renders MCP Apps UI in a sandboxed iframe with full protocol support.
 * Fetches resource content on-demand via proxied MCP requests.
 */
+/**
+* Permissive `ui/message` schema. ext-apps restricts the request to
+* `role: "user"` with no `followUp`, but CopilotKit intentionally extends
+* `ui/message` with `role` ("user" | "assistant") and `followUp` (documented
+* behavior with dedicated tests). We register our own handler (instead of the
+* bridge's strict `onmessage`) so those extensions survive the migration.
+*
+* Going forward, widgets SHOULD pass the extensions under
+* `params._meta.copilotkit`; the top-level `role`/`followUp` fields are the
+* legacy channel, kept for backward compatibility and slated for deprecation.
+*/
+const CopilotKitUiMessageSchema = z.object({
+	method: z.literal("ui/message"),
+	params: z.object({
+		role: z.string().optional(),
+		content: z.array(z.any()).optional(),
+		followUp: z.boolean().optional(),
+		_meta: z.record(z.string(), z.any()).optional()
+	}).passthrough()
+});
 const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agent }) {
 	const { copilotkit } = useCopilotKit$1();
 	const containerRef = useRef(null);
@@ -1887,41 +1907,12 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 	contentRef.current = content;
 	const agentRef = useRef(agent);
 	agentRef.current = agent;
+	const bridgeRef = useRef(null);
 	const fetchStateRef = useRef({
 		inProgress: false,
 		promise: null,
 		resourceUri: null
 	});
-	const sendToIframe = useCallback((msg) => {
-		if (iframeRef.current?.contentWindow) {
-			console.log("[MCPAppsRenderer] Sending to iframe:", msg);
-			iframeRef.current.contentWindow.postMessage(msg, "*");
-		}
-	}, []);
-	const sendResponse = useCallback((id, result) => {
-		sendToIframe({
-			jsonrpc: "2.0",
-			id,
-			result
-		});
-	}, [sendToIframe]);
-	const sendErrorResponse = useCallback((id, code, message) => {
-		sendToIframe({
-			jsonrpc: "2.0",
-			id,
-			error: {
-				code,
-				message
-			}
-		});
-	}, [sendToIframe]);
-	const sendNotification = useCallback((method, params) => {
-		sendToIframe({
-			jsonrpc: "2.0",
-			method,
-			params: params || {}
-		});
-	}, [sendToIframe]);
 	useEffect(() => {
 		const { resourceUri, serverHash, serverId } = content;
 		if (fetchStateRef.current.inProgress && fetchStateRef.current.resourceUri === resourceUri) {
@@ -1976,11 +1967,15 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 		const container = containerRef.current;
 		if (!container) return;
 		let mounted = true;
-		let messageHandler = null;
-		let initialListener = null;
+		let bridge = null;
 		let createdIframe = null;
 		const setup = async () => {
 			try {
+				const bridgeModule = await import("@modelcontextprotocol/ext-apps/app-bridge").catch((importErr) => {
+					throw new Error("MCP Apps require '@modelcontextprotocol/ext-apps' and its peer '@modelcontextprotocol/sdk'. Install them with: npm install @modelcontextprotocol/ext-apps @modelcontextprotocol/sdk", { cause: importErr });
+				});
+				if (!mounted) return;
+				const { AppBridge, PostMessageTransport } = bridgeModule;
 				const iframe = document.createElement("iframe");
 				createdIframe = iframe;
 				iframe.style.width = "100%";
@@ -1991,151 +1986,108 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 				iframe.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
 				iframe.setAttribute("data-testid", "mcp-app-iframe");
 				iframe.setAttribute("title", "Interactive MCP application");
-				const sandboxReady = new Promise((resolve) => {
-					initialListener = (event) => {
-						if (event.source === iframe.contentWindow) {
-							if (event.data?.method === "ui/notifications/sandbox-proxy-ready") {
-								if (initialListener) {
-									window.removeEventListener("message", initialListener);
-									initialListener = null;
-								}
-								resolve();
-							}
-						}
-					};
-					window.addEventListener("message", initialListener);
-				});
-				if (!mounted) {
-					if (initialListener) {
-						window.removeEventListener("message", initialListener);
-						initialListener = null;
-					}
-					return;
-				}
 				const cspDomains = fetchedResource._meta?.ui?.csp?.resourceDomains;
 				iframe.srcdoc = buildSandboxHTML(cspDomains);
 				iframeRef.current = iframe;
 				container.appendChild(iframe);
-				await sandboxReady;
-				if (!mounted) return;
-				console.log("[MCPAppsRenderer] Sandbox proxy ready");
-				messageHandler = async (event) => {
-					if (event.source !== iframe.contentWindow) return;
-					const msg = event.data;
-					if (!msg || typeof msg !== "object" || msg.jsonrpc !== "2.0") return;
-					console.log("[MCPAppsRenderer] Received from iframe:", msg);
-					if (isRequest(msg)) switch (msg.method) {
-						case "ui/initialize":
-							sendResponse(msg.id, {
-								protocolVersion: PROTOCOL_VERSION,
-								hostInfo: {
-									name: "CopilotKit MCP Apps Host",
-									version: "1.0.0"
-								},
-								hostCapabilities: {
-									openLinks: {},
-									logging: {}
-								},
-								hostContext: {
-									theme: "light",
-									platform: "web"
-								}
-							});
-							break;
-						case "ui/message": {
-							const currentAgent = agentRef.current;
-							if (!currentAgent) {
-								console.warn("[MCPAppsRenderer] ui/message: No agent available");
-								sendResponse(msg.id, { isError: false });
-								break;
-							}
-							try {
-								const params = msg.params;
-								const role = params.role || "user";
-								const textContent = params.content?.filter((c) => c.type === "text" && c.text).map((c) => c.text).join("\n") || "";
-								if (textContent) currentAgent.addMessage({
-									id: crypto.randomUUID(),
-									role,
-									content: textContent
-								});
-								sendResponse(msg.id, { isError: false });
-								if ((params.followUp ?? role === "user") && textContent) {
-									const capturedThreadId = currentAgent.threadId || "default";
-									mcpAppsRequestQueue.enqueue(currentAgent, () => ɵrunMcpFollowUp({
-										host: copilotkit,
-										agent: currentAgent,
-										capturedThreadId
-									})).catch((err) => console.error("[MCPAppsRenderer] ui/message agent run failed:", err));
-								}
-							} catch (err) {
-								console.error("[MCPAppsRenderer] ui/message error:", err);
-								sendResponse(msg.id, { isError: true });
-							}
-							break;
-						}
-						case "ui/open-link": {
-							const url = msg.params?.url;
-							if (url) {
-								window.open(url, "_blank", "noopener,noreferrer");
-								sendResponse(msg.id, { isError: false });
-							} else sendErrorResponse(msg.id, -32602, "Missing url parameter");
-							break;
-						}
-						case "tools/call": {
-							const { serverHash, serverId } = contentRef.current;
-							const currentAgent = agentRef.current;
-							if (!serverHash) {
-								sendErrorResponse(msg.id, -32603, "No server hash available for proxying");
-								break;
-							}
-							if (!currentAgent) {
-								sendErrorResponse(msg.id, -32603, "No agent available for proxying");
-								break;
-							}
-							try {
-								const runResult = await mcpAppsRequestQueue.enqueue(currentAgent, () => currentAgent.runAgent({ forwardedProps: { __proxiedMCPRequest: {
-									serverHash,
-									serverId,
-									method: "tools/call",
-									params: msg.params
-								} } }));
-								sendResponse(msg.id, runResult.result || {});
-							} catch (err) {
-								console.error("[MCPAppsRenderer] tools/call error:", err);
-								sendErrorResponse(msg.id, -32603, String(err));
-							}
-							break;
-						}
-						default: sendErrorResponse(msg.id, -32601, `Method not found: ${msg.method}`);
-					}
-					if (isNotification(msg)) switch (msg.method) {
-						case "ui/notifications/initialized":
-							console.log("[MCPAppsRenderer] Inner iframe initialized");
-							if (mounted) setIframeReady(true);
-							break;
-						case "ui/notifications/size-changed": {
-							const { width, height } = msg.params || {};
-							console.log("[MCPAppsRenderer] Size change:", {
-								width,
-								height
-							});
-							if (mounted) setIframeSize({
-								width: typeof width === "number" ? width : void 0,
-								height: typeof height === "number" ? height : void 0
-							});
-							break;
-						}
-						case "notifications/message":
-							console.log("[MCPAppsRenderer] App log:", msg.params);
-							break;
-					}
-				};
-				window.addEventListener("message", messageHandler);
+				const win = iframe.contentWindow;
+				if (!win) throw new Error("Sandbox iframe has no contentWindow");
 				let html;
 				if (fetchedResource.text) html = fetchedResource.text;
 				else if (fetchedResource.blob) html = atob(fetchedResource.blob);
 				else throw new Error("Resource has no text or blob content");
-				sendNotification("ui/notifications/sandbox-resource-ready", { html });
+				bridge = new AppBridge(null, {
+					name: "CopilotKit MCP Apps Host",
+					version: "1.0.0"
+				}, {
+					openLinks: {},
+					logging: {},
+					message: { text: {} }
+				}, { hostContext: {
+					theme: "light",
+					platform: "web"
+				} });
+				bridge.onsandboxready = () => {
+					bridge?.sendSandboxResourceReady({ html });
+				};
+				bridge.setRequestHandler(CopilotKitUiMessageSchema, async (req) => {
+					const currentAgent = agentRef.current;
+					if (!currentAgent) {
+						console.warn("[MCPAppsRenderer] ui/message: No agent available");
+						return { isError: false };
+					}
+					try {
+						const params = req.params;
+						const ck = params._meta?.copilotkit ?? {};
+						const role = ck.role || params.role || "user";
+						const textContent = params.content?.filter((c) => c.type === "text" && c.text).map((c) => c.text).join("\n") || "";
+						if (textContent) currentAgent.addMessage({
+							id: crypto.randomUUID(),
+							role,
+							content: textContent
+						});
+						if ((ck.followUp ?? params.followUp ?? role === "user") && textContent) {
+							const capturedThreadId = currentAgent.threadId || "default";
+							mcpAppsRequestQueue.enqueue(currentAgent, () => ɵrunMcpFollowUp({
+								host: copilotkit,
+								agent: currentAgent,
+								capturedThreadId
+							})).catch((err) => console.error("[MCPAppsRenderer] ui/message agent run failed:", err));
+						}
+						return { isError: false };
+					} catch (err) {
+						console.error("[MCPAppsRenderer] ui/message error:", err);
+						return { isError: true };
+					}
+				});
+				bridge.onopenlink = async ({ url }) => {
+					let parsed;
+					try {
+						parsed = new URL(url);
+					} catch {
+						console.warn("[MCPAppsRenderer] ui/open-link rejected: unparseable url");
+						return { isError: true };
+					}
+					if (MCP_OPEN_LINK_BLOCKED_SCHEMES.has(parsed.protocol)) {
+						console.warn("[MCPAppsRenderer] ui/open-link rejected: blocked scheme", parsed.protocol);
+						return { isError: true };
+					}
+					window.open(url, "_blank", "noopener,noreferrer");
+					return { isError: false };
+				};
+				bridge.oncalltool = async (params) => {
+					const { serverHash, serverId } = contentRef.current;
+					const currentAgent = agentRef.current;
+					if (!serverHash) throw new Error("No server hash available for proxying");
+					if (!currentAgent) throw new Error("No agent available for proxying");
+					return (await mcpAppsRequestQueue.enqueue(currentAgent, () => currentAgent.runAgent({ forwardedProps: { __proxiedMCPRequest: {
+						serverHash,
+						serverId,
+						method: "tools/call",
+						params
+					} } }))).result || { content: [] };
+				};
+				bridge.onsizechange = (p) => {
+					if (!mounted) return;
+					const { width, height } = p || {};
+					setIframeSize({
+						width: typeof width === "number" ? width : void 0,
+						height: typeof height === "number" ? height : void 0
+					});
+				};
+				bridge.oninitialized = () => {
+					if (mounted) setIframeReady(true);
+				};
+				bridge.onloggingmessage = (p) => {
+					console.log("[MCPAppsRenderer] App log:", p);
+				};
+				const transport = new PostMessageTransport(win, win);
+				await bridge.connect(transport);
+				if (!mounted) {
+					await bridge.close();
+					return;
+				}
+				bridgeRef.current = bridge;
 			} catch (err) {
 				console.error("[MCPAppsRenderer] Setup error:", err);
 				if (mounted) setError(err instanceof Error ? err : new Error(String(err)));
@@ -2144,11 +2096,8 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 		setup();
 		return () => {
 			mounted = false;
-			if (initialListener) {
-				window.removeEventListener("message", initialListener);
-				initialListener = null;
-			}
-			if (messageHandler) window.removeEventListener("message", messageHandler);
+			bridgeRef.current = null;
+			bridge?.close();
 			if (createdIframe) {
 				createdIframe.remove();
 				createdIframe = null;
@@ -2158,9 +2107,7 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 	}, [
 		isLoading,
 		fetchedResource,
-		sendNotification,
-		sendResponse,
-		sendErrorResponse
+		copilotkit
 	]);
 	useEffect(() => {
 		if (iframeRef.current) {
@@ -2172,25 +2119,11 @@ const MCPAppsActivityRenderer = function MCPAppsActivityRenderer({ content, agen
 		}
 	}, [iframeSize]);
 	useEffect(() => {
-		if (iframeReady && content.toolInput) {
-			console.log("[MCPAppsRenderer] Sending tool input:", content.toolInput);
-			sendNotification("ui/notifications/tool-input", { arguments: content.toolInput });
-		}
-	}, [
-		iframeReady,
-		content.toolInput,
-		sendNotification
-	]);
+		if (iframeReady && content.toolInput) bridgeRef.current?.sendToolInput({ arguments: content.toolInput });
+	}, [iframeReady, content.toolInput]);
 	useEffect(() => {
-		if (iframeReady && content.result) {
-			console.log("[MCPAppsRenderer] Sending tool result:", content.result);
-			sendNotification("ui/notifications/tool-result", content.result);
-		}
-	}, [
-		iframeReady,
-		content.result,
-		sendNotification
-	]);
+		if (iframeReady && content.result) bridgeRef.current?.sendToolResult(content.result);
+	}, [iframeReady, content.result]);
 	const borderStyle = fetchedResource?._meta?.ui?.prefersBorder === true ? {
 		borderRadius: "8px",
 		backgroundColor: "#f9f9f9",
@@ -4005,7 +3938,8 @@ function useFrontendTool(tool, deps) {
 		tool.name,
 		tool.available,
 		copilotkit,
-		JSON.stringify(extraDeps)
+		JSON.stringify(extraDeps),
+		JSON.stringify(tool.webmcp ?? null)
 	]);
 }
 
@@ -5799,9 +5733,9 @@ const DEFAULT_CONTAINERS = ["project"];
 * }
 * ```
 *
-* @deprecated Legacy plural-container annotation compatibility only. New
-* Intelligence runtimes assign one container with `ɵlearning.containerId` on
-* `CopilotRuntime`.
+* @deprecated This hook supports only the legacy plural-container annotation.
+* Configure `getLearningContainerId` on `CopilotKitIntelligence` for new
+* Intelligence runtimes.
 */
 function useLearningContainers({ threadId, learningContainers }) {
 	const { copilotkit } = useCopilotKit();
@@ -5905,9 +5839,9 @@ function useLearningContainers({ threadId, learningContainers }) {
 * }
 * ```
 *
-* @deprecated Legacy plural-container annotation compatibility only. New
-* Intelligence runtimes assign one container with `ɵlearning.containerId` on
-* `CopilotRuntime`.
+* @deprecated This hook supports only the legacy plural-container annotation.
+* Configure `getLearningContainerId` on `CopilotKitIntelligence` for new
+* Intelligence runtimes.
 */
 function useLearningContainersInCurrentThread({ learningContainers }) {
 	const threadId = useCopilotChatConfiguration()?.threadId;
@@ -10912,7 +10846,7 @@ const getErrorActions = (error) => {
 	switch (error.code) {
 		case CopilotKitErrorCode.MISSING_PUBLIC_API_KEY_ERROR: return { primary: {
 			label: "Show me how",
-			onClick: () => window.open("https://docs.copilotkit.ai/premium/overview#getting-access", "_blank", "noopener,noreferrer")
+			onClick: () => window.open("https://docs.copilotkit.ai/intelligence/overview#plans-and-access", "_blank", "noopener,noreferrer")
 		} };
 		case CopilotKitErrorCode.UPGRADE_REQUIRED_ERROR: return { primary: {
 			label: "Upgrade",
@@ -12144,4 +12078,4 @@ function validateProps(props) {
 
 //#endregion
 export { useAgentContext as $, CopilotChatMessageView as A, AudioRecorderError as At, CopilotChatAssistantMessage_default as B, CopilotModalHeader as C, MCPAppsActivityContentSchema as Ct, CopilotChat as D, CopilotKitInspector as Dt, DefaultOpenIcon as E, ɵrunMcpFollowUp as Et, CopilotChatSuggestionView as F, useLearnFromUserActionInCurrentThread as G, useLearningContainersInCurrentThread as H, CopilotChatSuggestionPill as I, useThreads$1 as J, useLearnFromUserAction as K, CopilotChatReasoningMessage_default as L, IntelligenceIndicator as M, CopilotChatConfigurationProvider as Mt, getIntelligenceTurnAnchors as N, useCopilotChatConfiguration as Nt, CopilotChatView_default as O, useRenderToolCall as Ot, IntelligenceIndicatorView as P, useSuggestions as Q, CopilotChatUserMessage_default as R, CopilotSidebarView as S, useSandboxFunctions as St, DefaultCloseIcon as T, MCPAppsActivityType as Tt, useLearningContainers as U, CopilotChatToolCallsView as V, useAttachments as W, INTERRUPT_EVENT_NAME as X, useInterrupt as Y, useConfigureSuggestions as Z, WildcardToolCallRender as _, OpenGenerativeUIActivityRenderer as _t, ThreadsProvider as a, useRenderTool as at, CopilotSidebar as b, OpenGenerativeUIToolRenderer as bt, CoAgentStateRendersProvider as c, useRenderActivityMessage as ct, shouldShowDevConsole as d, useCopilotKit$1 as dt, useCapabilities as et, useToast as f, useLicenseContext$1 as ft, useCopilotContext as g, GenerateSandboxedUiArgsSchema as gt, CopilotContext as h, createA2UIMessageRenderer as ht, ThreadsContext as i, useDefaultRenderTool as it, INTELLIGENCE_TURN_HEAD as j, CopilotChatAudioRecorder as jt, CopilotChatAttachmentQueue as k, CopilotChatInput_default as kt, useCoAgentStateRenders as l, useRenderCustomMessages as lt, useCopilotMessagesContext as m, defineToolCallRenderer as mt, defaultCopilotContextCategories as n, useAgent as nt, useThreads as o, useComponent as ot, CopilotMessagesContext as p, CopilotKitCoreReact as pt, useMemories as q, CoAgentStateRenderBridge as r, useHumanInTheLoop as rt, CoAgentStateRendersContext as s, useFrontendTool as st, CopilotKit as t, UseAgentUpdate as tt, useAsyncCallback as u, CopilotKitProvider as ut, CopilotThreadsDrawer as v, OpenGenerativeUIActivityType as vt, CopilotChatToggleButton as w, MCPAppsActivityRenderer as wt, CopilotPopupView as x, SandboxFunctionsContext as xt, CopilotPopup as y, OpenGenerativeUIContentSchema as yt, CopilotChatAttachmentRenderer as z };
-//# sourceMappingURL=copilotkit-B7aFKfQR.mjs.map
+//# sourceMappingURL=copilotkit-DiUK2Bhq.mjs.map