v1.66.4

# CopilotKit v1.66.4

A patch release on the `1.66` line, covering the combined `v1.66.2 → v1.66.4` range — `1.66.3` shipped to npm without a GitHub release; its changes are included below. The headline is a **bounded in-memory agent runner** that no longer grows until the process OOMs ([#5837](https://github.com/CopilotKit/CopilotKit/pull/5837)), **Channel status split into transport and provider legs** so `status()` stops reporting `online` for a Channel with no provider app bound ([#6360](https://github.com/CopilotKit/CopilotKit/pull/6360)), and a set of HITL run-identity fixes that stop follow-up runs duplicating tool calls or losing their own ([#6296](https://github.com/CopilotKit/CopilotKit/pull/6296), [#6411](https://github.com/CopilotKit/CopilotKit/pull/6411), [#6407](https://github.com/CopilotKit/CopilotKit/pull/6407)).

## Install

```bash
npm install @copilotkit/react-core@1.66.4 @copilotkit/react-ui@1.66.4 @copilotkit/runtime@1.66.4
```

## Features

- **Channel status reports transport and provider legs separately (`@copilotkit/runtime`)** — `status().overall === "online"` proved only that the runtime reached the Gateway with a valid project key, so a Channel with no Slack/Teams app attached still reported `online`. The runtime now captures the Gateway's control join reply, and `status()` gains a per-channel `detail` reporting `transport` and `provider` separately; `overall` and `channels` fold both legs, so a joined Channel with no provider attached reports `setup_required`. The fold is conservative — an older Gateway, a failed lookup, or an unrecognized state yields `unknown` and keeps today's transport-derived status, so no existing deployment turns amber on upgrade — and provider attachment is re-read on every gateway rejoin, so a Channel provisioned while the runtime was disconnected is picked up automatically. The gateway side ships with Channels `v0.8.0`. ([#6360](https://github.com/CopilotKit/CopilotKit/pull/6360))

## Runtime fixes (`@copilotkit/runtime`)

- **The in-memory agent runner is bounded — no more OOM** — `InMemoryAgentRunner` (the default runner when the runtime has no Intelligence backend) kept every thread, every run, and a per-run `ReplaySubject(Infinity)` buffer in an unbounded process-global `Map`; one production deployment hit a fatal V8 OOM after ~173 threads / ~15.5k runs. Storage now goes through a bounded store with three defaults — `maxThreads: 1000` (LRU), `maxRunsPerThread: 100` (FIFO; `0`/`Infinity` disables), `maxBytes: 512 MiB` — tunable on the existing `InMemoryAgentRunner` options bag. The store never evicts a running or still-finalizing thread, releases run buffers once a run completes, logs evictions through a warn-once latch, and clamps invalid limits with a warning instead of crashing. Superseded or stopped runs also get isolated teardown, so a replaced run can no longer leak a duplicate `RUN_STARTED` or a synthetic `RUN_ERROR` into the live run's stream. ([#5837](https://github.com/CopilotKit/CopilotKit/pull/5837))
- **`AGUISendStateDelta` initializes arrays before `/-` append** — a state delta appending to an array that no prior state event had initialized produced a patch that failed event compaction with `OPERATION_PATH_CANNOT_ADD`. The runtime now emits the authoritative input state before the first delta when needed and initializes a missing array immediately before its first `/-` append, across the generic, AI SDK, and TanStack state-delta paths; existing arrays and valid deltas keep their contents and operation order. ([#6293](https://github.com/CopilotKit/CopilotKit/pull/6293), fixes [#5998](https://github.com/CopilotKit/CopilotKit/issues/5998))
- **Unenforceable `mcpApps` tool policy is rejected instead of silently ignored** — `mcpApps.servers` entries carrying `includeTools`/`excludeTools` were accepted even though the pinned `@ag-ui/mcp-apps-middleware@0.0.3` has no such option, so tools an operator meant to restrict stayed available. The runtime now returns a configuration error naming the unsupported key, server, and owning package before constructing the middleware; once the middleware supports the fields, the rejection can be removed. ([#6292](https://github.com/CopilotKit/CopilotKit/pull/6292))
- **No more value-less activity patches from open generative UI** — when the model emitted `jsFunctions` or `css` as `null`, the open-gen-UI middleware produced a JSON Patch `add` op with no `value`, which clients rejected with `OPERATION_VALUE_REQUIRED` (`Failed to apply activity patch …`) and dropped the whole patch. Value-less param deltas are now skipped; empty arrays and completion markers like `jsFunctionsComplete` still emit. ([#6396](https://github.com/CopilotKit/CopilotKit/pull/6396))

## Core fixes (`@copilotkit/core`)

- **HITL follow-ups keep one logical run id — without confusing the transport** — resolving a legacy `useCopilotAction({ renderAndWaitForResponse })` tool used to split one logical run into two run ids, breaking external tracing ([#6296](https://github.com/CopilotKit/CopilotKit/pull/6296), fixes [#3456](https://github.com/CopilotKit/CopilotKit/issues/3456)). Pinning the originating id on the wire then made the transport treat the follow-up as resuming a finished run — re-delivering that run's already-applied tool calls (each duplicate with empty arguments) and keeping the continuation's own tool call from ever reaching client state. The state manager now re-stamps the continuation's events onto the expected logical id while the wire carries a fresh run id, so tracing still sees one run and nothing is re-delivered. ([#6411](https://github.com/CopilotKit/CopilotKit/pull/6411))

## React fixes (`@copilotkit/react-core`)

- **Duplicate tool-call ids collapse in the message view** — when a `TOOL_CALL_START` was applied twice (as the HITL flow could trigger after `respond()`), the assistant message carried the same call id twice; the second copy had empty arguments and rendered as a blank duplicate card, along with React's duplicate-key warning. `deduplicateMessages()` now also collapses duplicate call ids within a message, preferring the copy that carries arguments, and returns the original array untouched when there is nothing to collapse. ([#6407](https://github.com/CopilotKit/CopilotKit/pull/6407))

## Web inspector fixes (`@copilotkit/web-inspector`)

- **Step lifecycle events are recorded** — the inspector did not record `STEP_STARTED` / `STEP_FINISHED` from live agent events; both are now recorded and selectable in the event filter. ([#6323](https://github.com/CopilotKit/CopilotKit/pull/6323), fixes [#6324](https://github.com/CopilotKit/CopilotKit/issues/6324))

## Dependencies

- **`@ag-ui/*` unchanged from `1.66.2`** — `@ag-ui/langgraph` at `0.0.42`, `@ag-ui/a2ui-middleware` at `0.0.10`, `@ag-ui/mcp-apps-middleware` at `0.0.3`, `@ag-ui/mcp-middleware` at `0.0.1`, `@ag-ui/core` / `@ag-ui/client` / `@ag-ui/encoder` at `0.0.57`.
- **`@copilotkit/license-verifier` stays at `~0.5.0`**.

## Packages republished at `1.66.4`

`@copilotkit/runtime`, `@copilotkit/react-core`, `@copilotkit/react-ui`, `@copilotkit/react-native`, `@copilotkit/core`, `@copilotkit/shared`, `@copilotkit/runtime-client-gql`, `@copilotkit/sdk-js`, `@copilotkit/vue`, `@copilotkit/voice`, `@copilotkit/web-inspector`, `@copilotkit/web-components`, `@copilotkit/a2ui-renderer`, `@copilotkit/react-textarea`, `@copilotkit/sqlite-runner`, and `@copilotkit/agentcore-runner`.