v1.66.4

CopilotKit v1.66.4

A patch release on the 1.66 line, covering the combined v1.66.2 → v1.66.4 range — 1.66.3 shipped to npm without a GitHub release; its changes are included below. The headline is a bounded in-memory agent runner that no longer grows until the process OOMs (#5837), Channel status split into transport and provider legs so status() stops reporting online for a Channel with no provider app bound (#6360), and a set of HITL run-identity fixes that stop follow-up runs duplicating tool calls or losing their own (#6296, #6411, #6407).

Install

npm install @copilotkit/react-core@1.66.4 @copilotkit/react-ui@1.66.4 @copilotkit/runtime@1.66.4

Features

• Channel status reports transport and provider legs separately (@copilotkit/runtime) — status().overall === "online" proved only that the runtime reached the Gateway with a valid project key, so a Channel with no Slack/Teams app attached still reported online. The runtime now captures the Gateway's control join reply, and status() gains a per-channel detail reporting transport and provider separately; overall and channels fold both legs, so a joined Channel with no provider attached reports setup_required. The fold is conservative — an older Gateway, a failed lookup, or an unrecognized state yields unknown and keeps today's transport-derived status, so no existing deployment turns amber on upgrade — and provider attachment is re-read on every gateway rejoin, so a Channel provisioned while the runtime was disconnected is picked up automatically. The gateway side ships with Channels v0.8.0. (#6360)

Runtime fixes (@copilotkit/runtime)

• The in-memory agent runner is bounded — no more OOM — InMemoryAgentRunner (the default runner when the runtime has no Intelligence backend) kept every thread, every run, and a per-run ReplaySubject(Infinity) buffer in an unbounded process-global Map; one production deployment hit a fatal V8 OOM after ~173 threads / ~15.5k runs. Storage now goes through a bounded store with three defaults — maxThreads: 1000 (LRU), maxRunsPerThread: 100 (FIFO; 0/Infinity disables), maxBytes: 512 MiB — tunable on the existing InMemoryAgentRunner options bag. The store never evicts a running or still-finalizing thread, releases run buffers once a run completes, logs evictions through a warn-once latch, and clamps invalid limits with a warning instead of crashing. Superseded or stopped runs also get isolated teardown, so a replaced run can no longer leak a duplicate RUN_STARTED or a synthetic RUN_ERROR into the live run's stream. (#5837)
• AGUISendStateDelta initializes arrays before /- append — a state delta appending to an array that no prior state event had initialized produced a patch that failed event compaction with OPERATION_PATH_CANNOT_ADD. The runtime now emits the authoritative input state before the first delta when needed and initializes a missing array immediately before its first /- append, across the generic, AI SDK, and TanStack state-delta paths; existing arrays and valid deltas keep their contents and operation order. (#6293, fixes #5998)
• Unenforceable mcpApps tool policy is rejected instead of silently ignored — mcpApps.servers entries carrying includeTools/excludeTools were accepted even though the pinned @ag-ui/mcp-apps-middleware@0.0.3 has no such option, so tools an operator meant to restrict stayed available. The runtime now returns a configuration error naming the unsupported key, server, and owning package before constructing the middleware; once the middleware supports the fields, the rejection can be removed. (#6292)
• No more value-less activity patches from open generative UI — when the model emitted jsFunctions or css as null, the open-gen-UI middleware produced a JSON Patch add op with no value, which clients rejected with OPERATION_VALUE_REQUIRED (Failed to apply activity patch …) and dropped the whole patch. Value-less param deltas are now skipped; empty arrays and completion markers like jsFunctionsComplete still emit. (#6396)

Core fixes (@copilotkit/core)

• HITL follow-ups keep one logical run id — without confusing the transport — resolving a legacy useCopilotAction({ renderAndWaitForResponse }) tool used to split one logical run into two run ids, breaking external tracing (#6296, fixes #3456). Pinning the originating id on the wire then made the transport treat the follow-up as resuming a finished run — re-delivering that run's already-applied tool calls (each duplicate with empty arguments) and keeping the continuation's own tool call from ever reaching client state. The state manager now re-stamps the continuation's events onto the expected logical id while the wire carries a fresh run id, so tracing still sees one run and nothing is re-delivered. (#6411)

React fixes (@copilotkit/react-core)

• Duplicate tool-call ids collapse in the message view — when a TOOL_CALL_START was applied twice (as the HITL flow could trigger after respond()), the assistant message carried the same call id twice; the second copy had empty arguments and rendered as a blank duplicate card, along with React's duplicate-key warning. deduplicateMessages() now also collapses duplicate call ids within a message, preferring the copy that carries arguments, and returns the original array untouched when there is nothing to collapse. (#6407)

Web inspector fixes (@copilotkit/web-inspector)

• Step lifecycle events are recorded — the inspector did not record STEP_STARTED / STEP_FINISHED from live agent events; both are now recorded and selectable in the event filter. (#6323, fixes #6324)

Dependencies

• @ag-ui/* unchanged from 1.66.2 — @ag-ui/langgraph at 0.0.42, @ag-ui/a2ui-middleware at 0.0.10, @ag-ui/mcp-apps-middleware at 0.0.3, @ag-ui/mcp-middleware at 0.0.1, @ag-ui/core / @ag-ui/client / @ag-ui/encoder at 0.0.57.
• @copilotkit/license-verifier stays at ~0.5.0.

Packages republished at 1.66.4

@copilotkit/runtime, @copilotkit/react-core, @copilotkit/react-ui, @copilotkit/react-native, @copilotkit/core, @copilotkit/shared, @copilotkit/runtime-client-gql, @copilotkit/sdk-js, @copilotkit/vue, @copilotkit/voice, @copilotkit/web-inspector, @copilotkit/web-components, @copilotkit/a2ui-renderer, @copilotkit/react-textarea, @copilotkit/sqlite-runner, and @copilotkit/agentcore-runner.