Upgrade Angular demo and Storybook to version 22

.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "AI agent skills for CopilotKit — setup, develop, integrate, debug, upgrade, and contribute",
-    "version": "1.63.2"
+    "version": "1.65.0"
   },
   "plugins": [
     {
       "name": "copilotkit",
       "source": "./",
       "description": "AI agent skills for CopilotKit — setup, develop, integrate, debug, upgrade, and contribute to CopilotKit projects",
-      "version": "1.63.2",
+      "version": "1.65.0",
       "author": {
         "name": "CopilotKit",
         "url": "https://copilotkit.ai"

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "copilotkit",
   "description": "AI agent skills for CopilotKit — setup, develop, integrate, debug, upgrade, and contribute to CopilotKit projects",
-  "version": "1.63.2",
+  "version": "1.65.0",
   "author": {
     "name": "CopilotKit",
     "url": "https://copilotkit.ai"

.github/config-allowlist.txt

@@ -58,6 +58,7 @@ examples/showcases/pydantic-ai-todos/next.config.ts
 examples/showcases/research-canvas/final/frontend/next.config.ts
 examples/showcases/research-canvas/frontend/next.config.ts
 examples/showcases/research-canvas/start/frontend/next.config.ts
+examples/showcases/reskinnable-demo/next.config.mjs
 examples/showcases/scene-creator/next.config.ts
 examples/showcases/spreadsheet/next.config.mjs
 examples/showcases/strands-crm/frontend/next.config.ts

.github/workflows/canary.yml

@@ -30,13 +30,20 @@ on:
   workflow_dispatch:
     inputs:
       scope:
-        description: "Package scope to publish a canary for. Regenerated from release.config.json — do NOT hand-edit (the release-scope-dropdown-sync CI guard enforces parity)."
+        description: "Package scope to publish a canary for, or 'all' when the change spans scopes (e.g. runtime↔channels). Regenerated from release.config.json — do NOT hand-edit (the release-scope-dropdown-sync CI guard enforces parity)."
         required: true
         type: choice
         options:
           - monorepo
           - angular
           - channels
+          # Sentinel, not a scope (see ALL_SCOPES in scripts/release/lib/config.ts):
+          # publishes every scope from this commit under one shared canary id.
+          # Required whenever the change spans scopes, because cross-scope
+          # `workspace:` deps (e.g. @copilotkit/runtime -> @copilotkit/channels-intelligence)
+          # are packed against whatever is in the tree — a single-scope canary
+          # pins them to the other scope's last STABLE release.
+          - all
       suffix:
         description: "Prerelease suffix (e.g. 'fix-user-issue'); blank = unix timestamp. Allowed: [a-zA-Z0-9._-]+. Reuse a suffix only if the base version moved, else the publish collides."
         required: false
@@ -218,7 +225,9 @@ jobs:
           RUN_ID=""
           ERR=$(mktemp)
           for i in $(seq 1 30); do
-            sleep 6
+            # Poll BEFORE sleeping: Actions has usually indexed the run by the
+            # time the dispatch call returns, so sleeping first paid a guaranteed
+            # 6s on every canary. Same 30-attempt / 3-min tolerance.
             RUN_ID=$(gh run list \
               --repo "$GITHUB_REPOSITORY" \
               --workflow=publish-release.yml \
@@ -234,6 +243,7 @@ jobs:
             if [ -n "$RUN_ID" ]; then
               break
             fi
+            sleep 6
           done
           if [ -z "$RUN_ID" ]; then
             echo "::error::Dispatched publish-release run never appeared on ${BRANCH}. Leaving the ref in place for debugging; delete it manually once resolved."

.github/workflows/publish-release.yml

@@ -33,13 +33,18 @@ on:
   workflow_dispatch:
     inputs:
       scope:
-        description: "What to release"
+        description: "What to release ('all' is prerelease-only: every scope under one shared canary id)"
         required: true
         type: choice
         options:
           - monorepo
           - angular
           - channels
+          # Sentinel, not a scope (see ALL_SCOPES in scripts/release/lib/config.ts).
+          # PRERELEASE ONLY — rejected for mode=stable by the "Determine scope and
+          # mode" guard below, since a stable release derives its tag, release
+          # branch, and Slack/npm links from a single scope name.
+          - all
       mode:
         description: "Release mode: stable (full release with tag + GH Release) or prerelease (canary, no tag/release)"
         required: false
@@ -113,6 +118,15 @@ jobs:
             SCOPE="${SCOPE%%/v*}"
           fi
           MODE="${INPUT_MODE:-stable}"
+          # `all` is a prerelease-only selector: it publishes every scope under one
+          # shared canary id so cross-scope `workspace:` deps resolve within the run.
+          # A stable release cannot be multi-scope — the tag (`<scope>/v<version>`),
+          # the release branch, and the notify job's npm URL each assume ONE scope,
+          # and the scopes carry independent version lines.
+          if [ "$SCOPE" = "all" ] && [ "$MODE" != "prerelease" ]; then
+            echo "::error::scope=all is only valid with mode=prerelease (canary). Release each scope separately via the 'release / create-pr' workflow."
+            exit 1
+          fi
           echo "scope=$SCOPE" >> "$GITHUB_OUTPUT"
           echo "mode=$MODE"   >> "$GITHUB_OUTPUT"
           echo "Detected scope: $SCOPE, mode: $MODE"
@@ -126,7 +140,18 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          fetch-depth: 0
+          # Canaries need no git history: the prerelease path pushes no tag, cuts
+          # no GitHub Release, reads no commit range for release notes, and the
+          # build is `nx run-many` (NOT `nx affected`), so there is no merge base
+          # to resolve. Full history costs ~25-48s of clone time here AND rides
+          # along in the workspace artifact this job uploads.
+          #
+          # Stable releases MUST keep depth 0: the publish job resolves and
+          # pushes tags out of this checkout's .git (shipped via that artifact),
+          # and the release notes diff against the previous release tag.
+          # `inputs.mode` is empty on the merged-release-PR path, so that path
+          # correctly evaluates to 0.
+          fetch-depth: ${{ inputs.mode == 'prerelease' && 1 || 0 }}
           persist-credentials: false
 
       - name: Setup pnpm
@@ -138,6 +163,54 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22.x
+          # Do NOT use cache: "pnpm" here — its key omits the Node.js version.
+          # Cached manually below with the node version in the key, matching
+          # test_unit.yml's reasoning.
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        run: echo "store-path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      # Without this, every job here installed all 4608 packages cold from the
+      # registry on every release. Usually ~45s, but it is npm-registry-bandwidth
+      # bound and therefore heavy-tailed: an observed canary spent 9m08s in this
+      # step on tarballs trickling in at 2-49 KiB/s.
+      #
+      # Cache-poisoning posture: `--frozen-lockfile` forbids resolution changes
+      # and pnpm verifies every store file against the lockfile's integrity
+      # hashes on link, so a tampered cache entry fails the install rather than
+      # injecting code. The worst case is a denied install, not a compromised
+      # publish.
+      #
+      # WHY PRERELEASES ONLY RESTORE: canary.yml mirrors the source branch to an
+      # EPHEMERAL `canary/<slug>-<run_id>-<attempt>` ref, and Actions scopes cache
+      # entries to the writing branch (plus the default branch). A cache saved
+      # from a canary ref is therefore unreachable by every later run — measured
+      # at 874 MiB of pure orphan per canary, competing for the repo's shared
+      # 10 GB budget and evicting entries other workflows do rely on. Worse, the
+      # save cost more than it bought: 22s save + 18s restore against a 25s
+      # faster install.
+      #
+      # So canaries RESTORE ONLY (free win whenever main has an entry, zero cost
+      # and zero pollution when it doesn't), and stable releases — which run on
+      # main, where a write is durable and reused — do the writing.
+      - name: Restore pnpm store (prerelease — read-only, ephemeral ref)
+        if: ${{ steps.meta.outputs.mode == 'prerelease' }}
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.pnpm-cache.outputs.store-path }}
+          key: ${{ runner.os }}-pnpm-store-22.x-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-22.x-
+
+      - name: Cache pnpm store (stable — read/write on main)
+        if: ${{ steps.meta.outputs.mode != 'prerelease' }}
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.pnpm-cache.outputs.store-path }}
+          key: ${{ runner.os }}-pnpm-store-22.x-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-22.x-
 
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
@@ -183,6 +256,10 @@ jobs:
           name: workspace
           path: /tmp/workspace.tgz
           retention-days: 1
+          # The payload is already gzipped by "Pack workspace"; re-deflating it
+          # into the artifact zip burns time on both upload and download for
+          # ~no size win.
+          compression-level: 0
 
     outputs:
       scope: ${{ steps.meta.outputs.scope }}
@@ -221,6 +298,13 @@ jobs:
             exit 1
           fi
           MODE="${INPUT_MODE:-stable}"
+          # Same guard as the build job (this job re-derives scope/mode from the
+          # event rather than inheriting them). Defense in depth: nothing may reach
+          # the tag/GH-Release/notify path with the multi-scope sentinel.
+          if [ "$SCOPE" = "all" ] && [ "$MODE" != "prerelease" ]; then
+            echo "::error::scope=all is only valid with mode=prerelease (canary)."
+            exit 1
+          fi
           echo "scope=$SCOPE" >> "$GITHUB_OUTPUT"
           echo "mode=$MODE"   >> "$GITHUB_OUTPUT"
 
@@ -252,11 +336,64 @@ jobs:
           node-version: 22.x
           registry-url: https://registry.npmjs.org
 
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        run: echo "store-path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      # Same split as the build job, for the same reason (see the rationale
+      # there). This job is where the observed 9m08s cold-install stall happened,
+      # so a restore is worth attempting even when it may miss: it is the only
+      # step standing between a built artifact and a publish.
+      - name: Restore pnpm store (prerelease — read-only, ephemeral ref)
+        if: ${{ steps.meta.outputs.mode == 'prerelease' }}
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.pnpm-cache.outputs.store-path }}
+          key: ${{ runner.os }}-pnpm-store-22.x-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-22.x-
+
+      - name: Cache pnpm store (stable — read/write on main)
+        if: ${{ steps.meta.outputs.mode != 'prerelease' }}
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.pnpm-cache.outputs.store-path }}
+          key: ${{ runner.os }}-pnpm-store-22.x-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-22.x-
+
       # Restore node_modules — the build job excludes them from the
       # uploaded workspace artifact (see "Upload workspace" above). Uses
       # pnpm-lock.yaml from the artifact, so this is a deterministic
       # restore of exactly what the build job ran with.
-      - name: Install Dependencies
+      #
+      # The prerelease path needs a NARROW slice of the workspace, and installing
+      # all 4608 projects' dependencies to get it cost ~41s. What it actually
+      # needs is exactly two things:
+      #   1. the ROOT project, for `pnpm tsx` (tsx is a root devDependency), and
+      #   2. every project under packages/, because `pnpm pack` resolves each
+      #      package's `workspace:` dependencies into real version ranges and
+      #      FAILS with ERR_PNPM_CANNOT_RESOLVE_WORKSPACE_PROTOCOL if a workspace
+      #      sibling is not installed. That resolution is what makes cross-scope
+      #      canary deps (runtime -> channels-intelligence) pin the same-run
+      #      version, so it is load-bearing, not incidental.
+      # Everything else in the lockfile is examples/ and showcase/ app
+      # dependencies (Next.js, Playwright, ...) which no publish step touches.
+      #
+      # Nothing else is needed because no publishable package declares `prepack`
+      # or `prepare`, so `pnpm pack` runs no lifecycle scripts; voice's
+      # `prepublishOnly` fires for neither `pnpm pack` nor `npm publish <tarball>`.
+      #
+      # Stable keeps the FULL install: publish-release.ts additionally imports
+      # lib/notion.js and the channels umbrella verifier runs a root workspace
+      # script, so its dependency surface is wider and far less worth trimming on
+      # the highest-stakes path.
+      - name: Install Dependencies (prerelease — root + packages only)
+        if: ${{ steps.meta.outputs.mode == 'prerelease' }}
+        run: pnpm install --frozen-lockfile --filter . --filter "./packages/**"
+
+      - name: Install Dependencies (stable — full workspace)
+        if: ${{ steps.meta.outputs.mode != 'prerelease' }}
         run: pnpm install --frozen-lockfile
 
       - name: Dry-run notice
@@ -416,7 +553,9 @@ jobs:
             echo "## Prerelease Published"
             echo ""
             echo "**Scope:** ${{ steps.meta.outputs.scope }}"
-            echo "**Version:** ${{ steps.publish.outputs.version }}"
+            # `versions` lists every published scope (`<scope>@<version>`), which is
+            # the whole story for scope=all; `version` alone names only the first.
+            echo "**Versions:** ${{ steps.publish.outputs.versions || steps.publish.outputs.version }}"
             echo "**Tag:** (prerelease — no tag created)"
           } >> "$GITHUB_STEP_SUMMARY"
 
@@ -697,10 +836,21 @@ jobs:
     # always() so we still report on a failed lane, but guard on a real release
     # context: a workflow_dispatch (manual release) OR a *merged* PR. A
     # closed-unmerged PR is not a release attempt and must not notify.
+    #
+    # Canaries are excluded up front. For mode=prerelease the builder already
+    # returns should_post=false and the self-watchdog's Slack post is already
+    # gated off (npm_intended is false for a prerelease dispatch), so this job
+    # could only ever checkout + install + compute "post nothing" — ~85s of dead
+    # work sitting on the canary critical path, since canary.yml waits for the
+    # whole run. `inputs.python_publish == true` keeps the PyPI lane's
+    # notification and self-alert reachable under a prerelease-mode dispatch, and
+    # `inputs.mode` is empty on the merged-PR path so stable releases are
+    # unaffected.
     if: >
       always() &&
       (github.event_name == 'workflow_dispatch' ||
-        github.event.pull_request.merged == true)
+        github.event.pull_request.merged == true) &&
+      (inputs.mode != 'prerelease' || inputs.python_publish == true)
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
@@ -779,6 +929,32 @@ jobs:
         with:
           node-version: 22.x
 
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        run: echo "store-path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      # Same split as the build job (see the rationale there). This job is
+      # normally stable-only, but a prerelease dispatch with python_publish=true
+      # still reaches it on an ephemeral canary ref — hence the same read-only
+      # arm, keyed off `inputs.mode` (the signal this job's own `if:` gate uses).
+      - name: Restore pnpm store (prerelease — read-only, ephemeral ref)
+        if: ${{ inputs.mode == 'prerelease' }}
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.pnpm-cache.outputs.store-path }}
+          key: ${{ runner.os }}-pnpm-store-22.x-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-22.x-
+
+      - name: Cache pnpm store (stable — read/write on main)
+        if: ${{ inputs.mode != 'prerelease' }}
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.pnpm-cache.outputs.store-path }}
+          key: ${{ runner.os }}-pnpm-store-22.x-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-22.x-
+
       # Restore node_modules so `pnpm tsx` (and the release-config import the
       # notifier does) resolves. The build/publish jobs install before running
       # tsx for the same reason; without this the notify step fails and NO

.github/workflows/security_zizmor.yml

@@ -53,7 +53,7 @@ jobs:
         # `min-severity: low` blocks PRs on the broadest set of findings
         # without flagging hypothetical-only `informational` notes. Drop
         # to `medium` if low-severity churn becomes a problem.
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
         with:
           min-severity: low
           advanced-security: false