@copilotkit/runtime 1.54.1 → 1.55.0-next.7

package/src/graphql/message-conversion/agui-to-gql.test.ts

@@ -1,6 +1,6 @@
 import { vi } from "vitest";
 import * as gql from "../types/converted/index";
-import agui from "@copilotkit/shared";
+import * as agui from "@copilotkit/shared";
 import {
   aguiToGQL,
   aguiTextMessageToGQLMessage,

package/src/graphql/message-conversion/agui-to-gql.ts

@@ -1,6 +1,6 @@
 import * as gql from "../types/converted/index";
 import { MessageRole } from "../types/enums";
-import agui from "@copilotkit/shared"; // named agui for clarity, but this only includes agui message types
+import * as agui from "@copilotkit/shared"; // named agui for clarity, but this only includes agui message types
 
 // Helper function to extract agent name from message
 function extractAgentName(message: agui.Message): string {

package/src/graphql/message-conversion/gql-to-agui.ts

@@ -1,5 +1,5 @@
 import * as gql from "../types/converted/index";
-import agui from "@copilotkit/shared";
+import * as agui from "@copilotkit/shared";
 import { MessageStatusCode } from "../types/message-status.type";
 
 // Define valid image formats based on the supported formats in the codebase

package/src/graphql/message-conversion/roundtrip-conversion.test.ts

@@ -1,6 +1,6 @@
 import { vi } from "vitest";
 import * as gql from "../types/converted/index";
-import agui from "@copilotkit/shared";
+import * as agui from "@copilotkit/shared";
 import { aguiToGQL } from "./agui-to-gql";
 import { gqlToAGUI } from "./gql-to-agui";
 

package/src/lib/integrations/nextjs/app-router.ts

@@ -1,4 +1,4 @@
-import { createCopilotEndpointSingleRoute } from "@copilotkitnext/runtime";
+import { createCopilotEndpointSingleRoute } from "../../../v2/runtime";
 import { CreateCopilotRuntimeServerOptions, getCommonConfig } from "../shared";
 import telemetry, {
   getRuntimeInstanceTelemetryInfo,
@@ -35,7 +35,7 @@ export function copilotRuntimeNextJSAppRouterEndpoint(
     options.runtime.handleServiceAdapter(serviceAdapter);
   }
 
-  // Note: cors option requires @copilotkitnext/runtime with credentials support
+  // Note: cors option requires @copilotkit/runtime with credentials support
   const copilotRoute = createCopilotEndpointSingleRoute({
     runtime: options.runtime.instance,
     basePath: options.baseUrl ?? options.endpoint,

package/src/lib/integrations/node-http/index.ts

@@ -2,7 +2,7 @@ import { CreateCopilotRuntimeServerOptions, getCommonConfig } from "../shared";
 import telemetry, {
   getRuntimeInstanceTelemetryInfo,
 } from "../../telemetry-client";
-import { createCopilotEndpointSingleRoute } from "@copilotkitnext/runtime";
+import { createCopilotEndpointSingleRoute } from "../../../v2/runtime";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import {
   getFullUrl,
@@ -45,7 +45,7 @@ export function copilotRuntimeNodeHttpEndpoint(
     options.runtime.handleServiceAdapter(serviceAdapter);
   }
 
-  // Note: cors option requires @copilotkitnext/runtime with credentials support
+  // Note: cors option requires @copilotkit/runtime with credentials support
   const honoApp = createCopilotEndpointSingleRoute({
     runtime: options.runtime.instance,
     basePath: options.baseUrl ?? options.endpoint,

package/src/lib/runtime/copilot-runtime.ts

@@ -36,7 +36,7 @@ import {
   type CopilotRuntimeOptions as CopilotRuntimeOptionsVNext,
   type AgentRunner,
   InMemoryAgentRunner,
-} from "@copilotkitnext/runtime";
+} from "../../v2/runtime";
 import { TelemetryAgentRunner } from "./telemetry-agent-runner";
 import telemetry from "../telemetry-client";
 
@@ -64,10 +64,7 @@ import {
   type MCPTool,
   extractParametersFromSchema,
 } from "./mcp-tools-utils";
-import {
-  BuiltInAgent,
-  type BuiltInAgentConfiguration,
-} from "@copilotkitnext/agent";
+import { BuiltInAgent, type BuiltInAgentConfiguration } from "../../agent";
 // Define the function type alias here or import if defined elsewhere
 type CreateMCPClientFunction = (
   config: MCPEndpointConfig,
@@ -358,6 +355,7 @@ export class CopilotRuntime<const T extends Parameter[] | [] = []> {
     this.runtimeArgs = {
       agents: { ...endpointAgents, ...agents },
       runner,
+      licenseToken: params?.licenseToken,
       // TODO: add support for transcriptionService from CopilotRuntimeOptionsVNext once it is ready
       // transcriptionService: params?.transcriptionService,
 

package/src/lib/runtime/telemetry-agent-runner.ts

@@ -8,7 +8,7 @@
  * - oss.runtime.agent_execution_stream_errored - when an agent execution fails
  */
 
-import { type AgentRunner, InMemoryAgentRunner } from "@copilotkitnext/runtime";
+import { type AgentRunner, InMemoryAgentRunner } from "../../v2/runtime";
 import { createHash } from "node:crypto";
 import { tap, catchError, finalize } from "rxjs";
 import telemetry from "../telemetry-client";

package/src/service-adapters/conversion.test.ts

@@ -3,7 +3,7 @@ import { describe, it, expect } from "vitest";
 /**
  * safeParseToolArgs is a private (non-exported) function in conversion.ts.
  * We duplicate its logic here to unit-test the algorithm in isolation.
- * This mirrors the shared safeParseToolArgs in @copilotkitnext/shared.
+ * This mirrors the shared safeParseToolArgs in @copilotkit/shared.
  */
 function safeParseToolArgs(raw: string): Record<string, unknown> {
   try {

package/src/service-adapters/conversion.ts

@@ -8,7 +8,7 @@ import {
 } from "../graphql/types/converted";
 import { MessageInput } from "../graphql/inputs/message.input";
 import { plainToInstance } from "class-transformer";
-import { tryMap } from "@copilotkit/shared";
+import { tryMap, safeParseToolArgs } from "@copilotkit/shared";
 
 export function convertGqlInputToMessages(
   inputMessages: MessageInput[],
@@ -67,30 +67,3 @@ export function convertGqlInputToMessages(
 
   return messages.filter((m) => m);
 }
-
-/**
- * Safely parses a JSON string into a plain object for tool arguments.
- * Mirrors the shared safeParseToolArgs in @copilotkitnext/shared (v2).
- * Kept as a local copy because v1 does not import from v2 shared.
- */
-function safeParseToolArgs(raw: string): Record<string, unknown> {
-  try {
-    const parsed = JSON.parse(raw);
-    if (
-      typeof parsed === "object" &&
-      parsed !== null &&
-      !Array.isArray(parsed)
-    ) {
-      return parsed as Record<string, unknown>;
-    }
-    console.warn(
-      `[CopilotKit] Tool arguments parsed to non-object (${typeof parsed}), falling back to empty object`,
-    );
-    return {};
-  } catch {
-    console.warn(
-      "[CopilotKit] Failed to parse tool arguments, falling back to empty object",
-    );
-    return {};
-  }
-}

package/src/v2/index.ts

@@ -1,2 +1,5 @@
-export * from "@copilotkitnext/runtime";
-export * from "@copilotkitnext/agent";
+// V2 runtime (moved from @copilotkit/runtime/v2)
+export * from "./runtime";
+
+// Agent (merged into runtime)
+export * from "../agent";

package/src/v2/runtime/__tests__/cors-credentials.test.ts

@@ -0,0 +1,320 @@
+import { describe, it, expect, vi } from "vitest";
+import {
+  createCopilotEndpoint,
+  createCopilotEndpointSingleRoute,
+} from "../endpoints";
+import { CopilotRuntime } from "../runtime";
+import type { AbstractAgent } from "@ag-ui/client";
+
+const createMockRuntime = (options: { beforeRequestMiddleware?: any } = {}) => {
+  const createMockAgent = () => {
+    const agent: unknown = {
+      execute: async () => ({ events: [] }),
+    };
+    (agent as { clone: () => unknown }).clone = () => createMockAgent();
+    return agent as AbstractAgent;
+  };
+
+  return new CopilotRuntime({
+    agents: { default: createMockAgent() },
+    ...options,
+  });
+};
+
+describe("CORS credentials configuration", () => {
+  describe("createCopilotEndpoint", () => {
+    it("sets Access-Control-Allow-Credentials header when credentials is true", async () => {
+      const runtime = createMockRuntime();
+      const endpoint = createCopilotEndpoint({
+        runtime,
+        basePath: "/",
+        cors: {
+          origin: "https://myapp.com",
+          credentials: true,
+        },
+      });
+
+      // Make a preflight OPTIONS request
+      const request = new Request("https://example.com/info", {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://myapp.com",
+          "Access-Control-Request-Method": "GET",
+        },
+      });
+
+      const response = await endpoint.fetch(request);
+
+      expect(response.headers.get("Access-Control-Allow-Credentials")).toBe(
+        "true",
+      );
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://myapp.com",
+      );
+    });
+
+    it("does not set Access-Control-Allow-Credentials header when credentials is false", async () => {
+      const runtime = createMockRuntime();
+      const endpoint = createCopilotEndpoint({
+        runtime,
+        basePath: "/",
+        cors: {
+          origin: "https://myapp.com",
+          credentials: false,
+        },
+      });
+
+      const request = new Request("https://example.com/info", {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://myapp.com",
+          "Access-Control-Request-Method": "GET",
+        },
+      });
+
+      const response = await endpoint.fetch(request);
+
+      // When credentials is false, the header should not be present or be "false"
+      const credentialsHeader = response.headers.get(
+        "Access-Control-Allow-Credentials",
+      );
+      expect(credentialsHeader === null || credentialsHeader === "false").toBe(
+        true,
+      );
+    });
+
+    it("defaults to no credentials when cors config is not provided", async () => {
+      const runtime = createMockRuntime();
+      const endpoint = createCopilotEndpoint({
+        runtime,
+        basePath: "/",
+        // No cors config - should default to origin: "*" without credentials
+      });
+
+      const request = new Request("https://example.com/info", {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://somesite.com",
+          "Access-Control-Request-Method": "GET",
+        },
+      });
+
+      const response = await endpoint.fetch(request);
+
+      // Should allow any origin but not credentials
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBe("*");
+      const credentialsHeader = response.headers.get(
+        "Access-Control-Allow-Credentials",
+      );
+      expect(credentialsHeader === null || credentialsHeader === "false").toBe(
+        true,
+      );
+    });
+
+    it("receives cookies in request when client sends them", async () => {
+      const receivedCookies: string[] = [];
+
+      const runtime = createMockRuntime({
+        beforeRequestMiddleware: async ({ request }: { request: Request }) => {
+          const cookie = request.headers.get("Cookie");
+          if (cookie) {
+            receivedCookies.push(cookie);
+          }
+          return undefined; // Don't modify the request
+        },
+      });
+
+      const endpoint = createCopilotEndpoint({
+        runtime,
+        basePath: "/",
+        cors: {
+          origin: "https://myapp.com",
+          credentials: true,
+        },
+      });
+
+      // Simulate a request with cookies (as a browser would send with credentials: "include")
+      const request = new Request("https://example.com/info", {
+        method: "GET",
+        headers: {
+          Origin: "https://myapp.com",
+          Cookie: "session=abc123; user=john",
+        },
+      });
+
+      const response = await endpoint.fetch(request);
+
+      expect(response.status).toBe(200);
+      expect(receivedCookies).toContain("session=abc123; user=john");
+    });
+  });
+
+  describe("createCopilotEndpointSingleRoute", () => {
+    it("sets Access-Control-Allow-Credentials header when credentials is true", async () => {
+      const runtime = createMockRuntime();
+      const endpoint = createCopilotEndpointSingleRoute({
+        runtime,
+        basePath: "/api/copilotkit",
+        cors: {
+          origin: "https://myapp.com",
+          credentials: true,
+        },
+      });
+
+      const request = new Request("https://example.com/api/copilotkit", {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://myapp.com",
+          "Access-Control-Request-Method": "POST",
+        },
+      });
+
+      const response = await endpoint.fetch(request);
+
+      expect(response.headers.get("Access-Control-Allow-Credentials")).toBe(
+        "true",
+      );
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://myapp.com",
+      );
+    });
+
+    it("receives cookies in POST request body", async () => {
+      const receivedCookies: string[] = [];
+
+      const runtime = createMockRuntime({
+        beforeRequestMiddleware: async ({ request }: { request: Request }) => {
+          const cookie = request.headers.get("Cookie");
+          if (cookie) {
+            receivedCookies.push(cookie);
+          }
+          return undefined;
+        },
+      });
+
+      const endpoint = createCopilotEndpointSingleRoute({
+        runtime,
+        basePath: "/api/copilotkit",
+        cors: {
+          origin: "https://myapp.com",
+          credentials: true,
+        },
+      });
+
+      const request = new Request("https://example.com/api/copilotkit", {
+        method: "POST",
+        headers: {
+          Origin: "https://myapp.com",
+          "Content-Type": "application/json",
+          Cookie: "auth_token=xyz789",
+        },
+        body: JSON.stringify({ method: "info" }),
+      });
+
+      const response = await endpoint.fetch(request);
+
+      expect(response.status).toBe(200);
+      expect(receivedCookies).toContain("auth_token=xyz789");
+    });
+  });
+
+  describe("origin configuration", () => {
+    it("supports string origin", async () => {
+      const runtime = createMockRuntime();
+      const endpoint = createCopilotEndpoint({
+        runtime,
+        basePath: "/",
+        cors: {
+          origin: "https://specific-origin.com",
+          credentials: true,
+        },
+      });
+
+      const request = new Request("https://example.com/info", {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://specific-origin.com",
+          "Access-Control-Request-Method": "GET",
+        },
+      });
+
+      const response = await endpoint.fetch(request);
+
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://specific-origin.com",
+      );
+    });
+
+    it("supports array of origins", async () => {
+      const runtime = createMockRuntime();
+      const endpoint = createCopilotEndpoint({
+        runtime,
+        basePath: "/",
+        cors: {
+          origin: ["https://app1.com", "https://app2.com"],
+          credentials: true,
+        },
+      });
+
+      // Request from first allowed origin
+      const request1 = new Request("https://example.com/info", {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://app1.com",
+          "Access-Control-Request-Method": "GET",
+        },
+      });
+
+      const response1 = await endpoint.fetch(request1);
+      expect(response1.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://app1.com",
+      );
+
+      // Request from second allowed origin
+      const request2 = new Request("https://example.com/info", {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://app2.com",
+          "Access-Control-Request-Method": "GET",
+        },
+      });
+
+      const response2 = await endpoint.fetch(request2);
+      expect(response2.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://app2.com",
+      );
+    });
+
+    it("supports function origin for dynamic resolution", async () => {
+      const runtime = createMockRuntime();
+      const endpoint = createCopilotEndpoint({
+        runtime,
+        basePath: "/",
+        cors: {
+          origin: (origin: string) => {
+            // Only allow origins ending with .mycompany.com
+            if (origin.endsWith(".mycompany.com")) {
+              return origin;
+            }
+            return null;
+          },
+          credentials: true,
+        },
+      });
+
+      // Allowed origin
+      const request1 = new Request("https://example.com/info", {
+        method: "OPTIONS",
+        headers: {
+          Origin: "https://app.mycompany.com",
+          "Access-Control-Request-Method": "GET",
+        },
+      });
+
+      const response1 = await endpoint.fetch(request1);
+      expect(response1.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://app.mycompany.com",
+      );
+    });
+  });
+});

package/src/v2/runtime/__tests__/express-abort-signal.test.ts

@@ -0,0 +1,25 @@
+import express from "express";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+
+import { createFetchRequestFromExpress } from "../endpoints/express-utils";
+
+describe("createFetchRequestFromExpress abort behavior", () => {
+  it("does not abort when the request ends normally", async () => {
+    const app = express();
+
+    app.post("/check", async (req, res) => {
+      const request = createFetchRequestFromExpress(req);
+      await new Promise((resolve) => setTimeout(resolve, 20));
+      res.json({ aborted: request.signal.aborted });
+    });
+
+    const response = await request(app)
+      .post("/check")
+      .set("Content-Type", "application/json")
+      .send({ hello: "world" });
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual({ aborted: false });
+  });
+});

package/src/v2/runtime/__tests__/express-body-order.test.ts

@@ -0,0 +1,76 @@
+import express from "express";
+import request from "supertest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { AbstractAgent } from "@ag-ui/client";
+
+import { createCopilotEndpointExpress } from "../express";
+import { CopilotRuntime } from "../runtime";
+
+const handleRunAgentMock = vi.fn();
+
+vi.mock("../handlers/handle-run", () => ({
+  handleRunAgent: (...args: unknown[]) => handleRunAgentMock(...args),
+}));
+
+const createRuntime = () =>
+  new CopilotRuntime({
+    agents: {
+      agent: {
+        clone: () => ({
+          execute: async () => ({ events: [] }),
+        }),
+      } as unknown as AbstractAgent,
+    },
+  });
+
+describe("createCopilotEndpointExpress with body parsers", () => {
+  beforeEach(() => {
+    handleRunAgentMock.mockReset();
+    handleRunAgentMock.mockImplementation(
+      async ({ request }: { request: Request }) => {
+        const body = await request.json();
+        return new Response(JSON.stringify({ body }), {
+          headers: { "content-type": "application/json" },
+        });
+      },
+    );
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  const sendRunRequest = (app: express.Express) =>
+    request(app)
+      .post("/agent/agent/run")
+      .set("Content-Type", "application/json")
+      .send({ hello: "world" });
+
+  it("handles requests when CopilotKit router is registered before express.json()", async () => {
+    const app = express();
+    app.use(
+      createCopilotEndpointExpress({ runtime: createRuntime(), basePath: "/" }),
+    );
+    app.use(express.json());
+
+    const response = await sendRunRequest(app);
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual({ body: { hello: "world" } });
+    expect(handleRunAgentMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("handles requests when express.json() runs before the CopilotKit router", async () => {
+    const app = express();
+    app.use(express.json());
+    app.use(
+      createCopilotEndpointExpress({ runtime: createRuntime(), basePath: "/" }),
+    );
+
+    const response = await sendRunRequest(app);
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual({ body: { hello: "world" } });
+    expect(handleRunAgentMock).toHaveBeenCalledTimes(1);
+  });
+});