@copilotkit/runtime 1.55.0-next.8 → 1.55.0

package/src/v2/runtime/__tests__/express-body-order.test.ts

@@ -4,7 +4,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import type { AbstractAgent } from "@ag-ui/client";
 
 import { createCopilotEndpointExpress } from "../express";
-import { CopilotRuntime } from "../runtime";
+import { CopilotRuntime } from "../core/runtime";
 
 const handleRunAgentMock = vi.fn();
 

package/src/v2/runtime/__tests__/express-fetch-bridge.test.ts

@@ -0,0 +1,344 @@
+import express from "express";
+import request from "supertest";
+import { describe, it, expect, vi } from "vitest";
+import { createExpressNodeHandler } from "../endpoints/express-fetch-bridge";
+import type { CopilotRuntimeFetchHandler } from "../core/fetch-handler";
+
+/* ------------------------------------------------------------------------------------------------
+ * Helpers
+ * --------------------------------------------------------------------------------------------- */
+
+/**
+ * Creates an Express app that optionally runs express.json() before our handler,
+ * simulating the "pre-parsed body" scenario.
+ */
+function createApp(
+  fetchHandler: CopilotRuntimeFetchHandler,
+  opts: { bodyParserFirst?: boolean } = {},
+) {
+  const app = express();
+  const nodeHandler = createExpressNodeHandler(fetchHandler);
+
+  if (opts.bodyParserFirst) {
+    app.use(express.json());
+  }
+
+  app.all("*", (req, res) => nodeHandler(req, res));
+  return app;
+}
+
+/* ------------------------------------------------------------------------------------------------
+ * Pre-parsed body (express.json() before handler)
+ * --------------------------------------------------------------------------------------------- */
+
+describe("express-fetch-bridge — pre-parsed body", () => {
+  it("receives JSON body when express.json() runs first", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      const body = await req.json();
+      return new Response(JSON.stringify({ received: body }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app)
+      .post("/test")
+      .set("Content-Type", "application/json")
+      .send({ hello: "world" });
+
+    expect(res.status).toBe(200);
+    expect(res.body.received).toEqual({ hello: "world" });
+  });
+
+  it("receives JSON body when express.json() does NOT run first", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      const body = await req.json();
+      return new Response(JSON.stringify({ received: body }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: false });
+
+    const res = await request(app)
+      .post("/test")
+      .set("Content-Type", "application/json")
+      .send({ hello: "world" });
+
+    expect(res.status).toBe(200);
+    expect(res.body.received).toEqual({ hello: "world" });
+  });
+
+  it("preserves nested objects in pre-parsed body", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      const body = await req.json();
+      return new Response(JSON.stringify(body), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const payload = {
+      messages: [{ role: "user", content: "hi" }],
+      state: { count: 42, nested: { deep: true } },
+      threadId: "t-123",
+    };
+
+    const res = await request(app)
+      .post("/agent/default/run")
+      .set("Content-Type", "application/json")
+      .send(payload);
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual(payload);
+  });
+
+  it("preserves arrays in pre-parsed body", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      const body = await req.json();
+      return new Response(JSON.stringify(body), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app)
+      .post("/test")
+      .set("Content-Type", "application/json")
+      .send([1, 2, 3]);
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual([1, 2, 3]);
+  });
+
+  it("empty object body is preserved", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      const body = await req.json();
+      return new Response(JSON.stringify({ received: body }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app)
+      .post("/test")
+      .set("Content-Type", "application/json")
+      .send({});
+
+    expect(res.status).toBe(200);
+    expect(res.body.received).toEqual({});
+  });
+});
+
+/* ------------------------------------------------------------------------------------------------
+ * URL reconstruction
+ * --------------------------------------------------------------------------------------------- */
+
+describe("express-fetch-bridge — URL reconstruction", () => {
+  it("preserves pathname in reconstructed URL", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      const url = new URL(req.url);
+      return new Response(JSON.stringify({ path: url.pathname }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app)
+      .post("/api/copilotkit/agent/default/run")
+      .set("Content-Type", "application/json")
+      .send({ threadId: "t1" });
+
+    expect(res.status).toBe(200);
+    expect(res.body.path).toBe("/api/copilotkit/agent/default/run");
+  });
+
+  it("preserves query string in reconstructed URL", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      const url = new URL(req.url);
+      return new Response(
+        JSON.stringify({
+          search: url.search,
+          param: url.searchParams.get("foo"),
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      );
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app)
+      .post("/test?foo=bar")
+      .set("Content-Type", "application/json")
+      .send({ data: true });
+
+    expect(res.status).toBe(200);
+    expect(res.body.param).toBe("bar");
+  });
+});
+
+/* ------------------------------------------------------------------------------------------------
+ * Header preservation
+ * --------------------------------------------------------------------------------------------- */
+
+describe("express-fetch-bridge — header preservation", () => {
+  it("preserves custom headers from original request", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      return new Response(
+        JSON.stringify({
+          auth: req.headers.get("authorization"),
+          custom: req.headers.get("x-custom-header"),
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      );
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app)
+      .post("/test")
+      .set("Content-Type", "application/json")
+      .set("Authorization", "Bearer tok123")
+      .set("X-Custom-Header", "my-value")
+      .send({ data: true });
+
+    expect(res.status).toBe(200);
+    expect(res.body.auth).toBe("Bearer tok123");
+    expect(res.body.custom).toBe("my-value");
+  });
+
+  it("sets content-type to application/json for object bodies", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      return new Response(
+        JSON.stringify({ contentType: req.headers.get("content-type") }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      );
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app)
+      .post("/test")
+      .set("Content-Type", "application/json")
+      .send({ data: true });
+
+    expect(res.status).toBe(200);
+    expect(res.body.contentType).toBe("application/json");
+  });
+});
+
+/* ------------------------------------------------------------------------------------------------
+ * HTTP method handling
+ * --------------------------------------------------------------------------------------------- */
+
+describe("express-fetch-bridge — HTTP methods", () => {
+  it("GET requests bypass pre-parsed body logic", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      return new Response(JSON.stringify({ method: req.method }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app).get("/info");
+
+    expect(res.status).toBe(200);
+    expect(res.body.method).toBe("GET");
+  });
+
+  it("OPTIONS requests bypass pre-parsed body logic", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async (req) => {
+      return new Response(null, { status: 204 });
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app).options("/test");
+
+    expect(res.status).toBe(204);
+  });
+});
+
+/* ------------------------------------------------------------------------------------------------
+ * Error handling
+ * --------------------------------------------------------------------------------------------- */
+
+describe("express-fetch-bridge — error handling", () => {
+  it("returns 500 when fetch handler throws", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async () => {
+      throw new Error("handler exploded");
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app)
+      .post("/test")
+      .set("Content-Type", "application/json")
+      .send({ data: true });
+
+    expect(res.status).toBe(500);
+    expect(res.text).toBe("Internal Server Error");
+  });
+
+  it("returns 500 when fetch handler throws (no body parser)", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async () => {
+      throw new Error("handler exploded");
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: false });
+
+    const res = await request(app)
+      .post("/test")
+      .set("Content-Type", "application/json")
+      .send({ data: true });
+
+    expect(res.status).toBe(500);
+    expect(res.text).toBe("Internal Server Error");
+  });
+});
+
+/* ------------------------------------------------------------------------------------------------
+ * Streaming responses
+ * --------------------------------------------------------------------------------------------- */
+
+describe("express-fetch-bridge — streaming responses", () => {
+  it("streams SSE response through pre-parsed body path", async () => {
+    const fetchHandler: CopilotRuntimeFetchHandler = async () => {
+      const stream = new ReadableStream({
+        start(controller) {
+          controller.enqueue(new TextEncoder().encode("data: event1\n\n"));
+          controller.enqueue(new TextEncoder().encode("data: event2\n\n"));
+          controller.close();
+        },
+      });
+      return new Response(stream, {
+        status: 200,
+        headers: { "Content-Type": "text/event-stream" },
+      });
+    };
+
+    const app = createApp(fetchHandler, { bodyParserFirst: true });
+
+    const res = await request(app)
+      .post("/test")
+      .set("Content-Type", "application/json")
+      .send({ data: true });
+
+    expect(res.status).toBe(200);
+    expect(res.text).toContain("data: event1");
+    expect(res.text).toContain("data: event2");
+  });
+});

package/src/v2/runtime/__tests__/express-single-sse.test.ts

@@ -3,7 +3,7 @@ import type { AddressInfo } from "node:net";
 import { afterEach, describe, expect, it } from "vitest";
 
 import { createCopilotEndpointSingleRouteExpress } from "../express";
-import { CopilotRuntime } from "../runtime";
+import { CopilotRuntime } from "../core/runtime";
 import { InMemoryAgentRunner } from "../runner/in-memory";
 
 const buildRuntime = () => {

package/src/v2/runtime/__tests__/fetch-cors.test.ts

@@ -0,0 +1,205 @@
+import { describe, it, expect } from "vitest";
+import { handleCors, addCorsHeaders } from "../core/fetch-cors";
+import type { CopilotCorsConfig } from "../core/fetch-cors";
+
+describe("fetch-cors", () => {
+  describe("handleCors (preflight)", () => {
+    it("returns null for non-OPTIONS requests", () => {
+      const request = new Request("http://localhost/api", { method: "GET" });
+      expect(handleCors(request, {})).toBeNull();
+    });
+
+    it("returns null for POST requests", () => {
+      const request = new Request("http://localhost/api", { method: "POST" });
+      expect(handleCors(request, {})).toBeNull();
+    });
+
+    it("returns 204 for OPTIONS requests", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+      });
+      const response = handleCors(request, {});
+      expect(response).not.toBeNull();
+      expect(response!.status).toBe(204);
+    });
+
+    it("adds permissive CORS headers with empty config (cors: true equivalent)", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+      });
+      const response = handleCors(request, {})!;
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBe("*");
+      expect(response.headers.get("Access-Control-Allow-Methods")).toContain(
+        "GET",
+      );
+      expect(response.headers.get("Access-Control-Allow-Methods")).toContain(
+        "POST",
+      );
+      expect(response.headers.get("Access-Control-Allow-Headers")).toBe("*");
+    });
+
+    it("reflects custom origin string", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+        headers: { Origin: "https://myapp.com" },
+      });
+      const config: CopilotCorsConfig = { origin: "https://myapp.com" };
+      const response = handleCors(request, config)!;
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://myapp.com",
+      );
+    });
+
+    it("reflects request origin when in allowed array", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+        headers: { Origin: "https://b.com" },
+      });
+      const config: CopilotCorsConfig = {
+        origin: ["https://a.com", "https://b.com"],
+      };
+      const response = handleCors(request, config)!;
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://b.com",
+      );
+    });
+
+    it("does not set origin when request origin is not in allowed array", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+        headers: { Origin: "https://c.com" },
+      });
+      const config: CopilotCorsConfig = {
+        origin: ["https://a.com", "https://b.com"],
+      };
+      const response = handleCors(request, config)!;
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBeNull();
+    });
+
+    it("uses origin function to resolve", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+        headers: { Origin: "https://dynamic.com" },
+      });
+      const config: CopilotCorsConfig = {
+        origin: (origin: string) => (origin.endsWith(".com") ? origin : null),
+      };
+      const response = handleCors(request, config)!;
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://dynamic.com",
+      );
+    });
+
+    it("sets credentials header when configured", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+        headers: { Origin: "https://myapp.com" },
+      });
+      const config: CopilotCorsConfig = {
+        origin: "https://myapp.com",
+        credentials: true,
+      };
+      const response = handleCors(request, config)!;
+      expect(response.headers.get("Access-Control-Allow-Credentials")).toBe(
+        "true",
+      );
+    });
+
+    it("sets custom allowMethods", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+      });
+      const config: CopilotCorsConfig = { allowMethods: ["GET", "POST"] };
+      const response = handleCors(request, config)!;
+      expect(response.headers.get("Access-Control-Allow-Methods")).toBe(
+        "GET, POST",
+      );
+    });
+
+    it("sets custom allowHeaders", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+      });
+      const config: CopilotCorsConfig = {
+        allowHeaders: ["Content-Type", "Authorization"],
+      };
+      const response = handleCors(request, config)!;
+      expect(response.headers.get("Access-Control-Allow-Headers")).toBe(
+        "Content-Type, Authorization",
+      );
+    });
+
+    it("sets maxAge header", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+      });
+      const config: CopilotCorsConfig = { maxAge: 86400 };
+      const response = handleCors(request, config)!;
+      expect(response.headers.get("Access-Control-Max-Age")).toBe("86400");
+    });
+
+    it("auto-resolves wildcard to request origin when credentials enabled", () => {
+      const request = new Request("http://localhost/api", {
+        method: "OPTIONS",
+        headers: { Origin: "https://example.com" },
+      });
+      const config: CopilotCorsConfig = { origin: "*", credentials: true };
+      const response = handleCors(request, config)!;
+      // Per Fetch spec, wildcard + credentials is invalid. We auto-resolve
+      // the wildcard to the actual request origin when credentials are enabled.
+      expect(response.headers.get("Access-Control-Allow-Origin")).toBe(
+        "https://example.com",
+      );
+      expect(response.headers.get("Access-Control-Allow-Credentials")).toBe(
+        "true",
+      );
+    });
+  });
+
+  describe("addCorsHeaders (response decoration)", () => {
+    it("adds CORS headers to an existing response", () => {
+      const response = new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+      const config: CopilotCorsConfig = {};
+      const result = addCorsHeaders(response, config, null);
+      expect(result.headers.get("Access-Control-Allow-Origin")).toBe("*");
+      expect(result.headers.get("Content-Type")).toBe("application/json");
+      expect(result.status).toBe(200);
+    });
+
+    it("adds CORS headers to error responses", () => {
+      const response = new Response("Not found", { status: 404 });
+      const config: CopilotCorsConfig = {};
+      const result = addCorsHeaders(response, config, null);
+      expect(result.headers.get("Access-Control-Allow-Origin")).toBe("*");
+      expect(result.status).toBe(404);
+    });
+
+    it("sets exposeHeaders", () => {
+      const response = new Response(null, { status: 200 });
+      const config: CopilotCorsConfig = {
+        exposeHeaders: ["X-Request-Id", "X-Custom"],
+      };
+      const result = addCorsHeaders(response, config, null);
+      expect(result.headers.get("Access-Control-Expose-Headers")).toBe(
+        "X-Request-Id, X-Custom",
+      );
+    });
+
+    it("adds Vary: Origin when origin is not wildcard", () => {
+      const response = new Response(null, { status: 200 });
+      const config: CopilotCorsConfig = { origin: "https://myapp.com" };
+      const result = addCorsHeaders(response, config, "https://myapp.com");
+      expect(result.headers.get("Vary")).toContain("Origin");
+    });
+
+    it("does not add Vary when origin is wildcard", () => {
+      const response = new Response(null, { status: 200 });
+      const config: CopilotCorsConfig = {};
+      const result = addCorsHeaders(response, config, null);
+      expect(result.headers.get("Vary")).toBeNull();
+    });
+  });
+});