v1.67.0

# CopilotKit v1.67.0

A minor release opening the `1.67` line. The headline is **trusted Inspector metadata** — an optional, display-only channel that carries project identity, plan, license, and Thread-usage context from an Intelligence-backed runtime through to the Web Inspector, which reorganizes its navigation into **Threads / Agents / Learning** and gains a locked-Threads state that never issues Thread requests ([#6275](https://github.com/CopilotKit/CopilotKit/pull/6275)). Also in this release: activity renderers refresh on every frame again ([#6325](https://github.com/CopilotKit/CopilotKit/pull/6325)) and `CopilotSidebar` gets an opt-in `fullHeightChildren` prop that closes a layout bug open since March 2024 ([#6410](https://github.com/CopilotKit/CopilotKit/pull/6410)).

## Install

```bash
npm install @copilotkit/react-core@1.67.0 @copilotkit/react-ui@1.67.0 @copilotkit/runtime@1.67.0
```

## Features

- **Trusted Inspector metadata, end to end (`@copilotkit/shared`, `@copilotkit/runtime`, `@copilotkit/core`, `@copilotkit/web-inspector`)** — a new optional `InspectorMetadataV1` value carries identity, plan, license, action, usage, and expiry context to the Inspector. Each layer has a narrow job:
    - **Runtime** advertises `inspectorMetadata: true` in its runtime-info response and proxies the value on `GET {basePath}/inspector-metadata` (multi-route) or `POST {basePath}` with `{ "method": "inspector/metadata" }` (single-route). Responses are `Cache-Control: no-store, private`. Missing data, an unsupported schema, a non-Intelligence runtime, a provider failure, or a five-second timeout all return `204` on the same private path — the proxy never forwards browser headers or cookies upstream and never surfaces provider error bodies to the browser. A `404` from an older producer is treated as compatible absence.
    - **Core** loads the value in the background *after* the runtime connection and agent notifications settle, so a slow metadata route cannot delay the app. Read it with `copilotkit.inspectorMetadata`, refresh without reconnecting via `refreshInspectorMetadata()`, or subscribe with `onInspectorMetadataChanged`. `setHeaders()` / `setCredentials()` clear the prior value before refreshing so trusted context cannot cross an auth-context change; a runtime-URL, transport, capability, or connection change clears it too. Each refresh cancels the prior request under a five-second deadline, and route, timeout, parse, and subscriber failures stay isolated from the runtime connection.
    - **Shared** owns normalization: it omits a malformed expiry leaf without dropping valid `used`, `limit`, or sibling modules, keeps `schemaVersion: 1`, and treats a missing `usage.expiringSoonCount` as valid V1 while `0` stays a known zero.
    ([#6275](https://github.com/CopilotKit/CopilotKit/pull/6275))
- **Web Inspector: grouped navigation, Thread usage, and a locked Threads view (`@copilotkit/web-inspector`)** — primary navigation is now grouped into **Threads**, **Agents**, and **Learning**. The Threads sidebar gains a usage footer rendering finite, unlimited, unknown, overage, and expiring states: finite usage shows `used / limit Threads` on a progress bar that is green below 90%, orange from 90% up to the limit, and red at or above it; an overage shows `limit+ / limit` capped at 100%; an unknown limit shows the used count with `Limit unavailable` rather than inventing a limit. At 90% a trusted `manage_plan` action changes label from **Manage Your Plan** to a purple **Upgrade Your Plan** without changing its URL or action kind.
    - Metadata is **display-only** — it never authorizes or gates Thread work. Explicit `threadEndpoints` remains the only authority: absent endpoints, literal `false`, or `list: false` produce zero list, subscribe, inspect, messages, events, and state requests.
    - A valid license with no Threads routes on the runtime gets a short **Finish setting up Rich Threads** state with a copyable coding-agent prompt and a link to the public route setup guide.
    - The zero-thread video, three example Threads, detail tabs, and guided tour stay available in empty and locked states. If metadata license state and the runtime's `licenseStatus` are both known and disagree, the Inspector uses the runtime status for copy and hides the action.
    - `Expiring Soon` is display-only: the Inspector does not enforce retention, lock or delete Threads, or run any culler. ([#6275](https://github.com/CopilotKit/CopilotKit/pull/6275))

## React fixes (`@copilotkit/react-core`)

- **Activity renderers update on every frame** — `CopilotChat` fingerprinted messages for its `useMemo` with `contentKey = 0` for any content that was neither a string nor an array. `ACTIVITY_SNAPSHOT` updates typically reuse the same `messageId` and replace only the object `content` (progress, generative UI), so the memo never invalidated and custom activity renderers sat on the first frame until some unrelated list change forced a refresh. Object content now contributes `JSON.stringify(m.content)` to the fingerprint; multimodal attachments stay on the array-length branch, so user uploads do not reintroduce base64 serialization. ([#6325](https://github.com/CopilotKit/CopilotKit/pull/6325))

## React UI fixes (`@copilotkit/react-ui`)

- **`CopilotSidebar` children can fill the viewport — opt in with `fullHeightChildren`** — `CopilotSidebar` wraps consumer content in two auto-height divs (one of which had no CSS rule at all), so a child's `height: 100%` had no definite containing block and collapsed to content height. The new `fullHeightChildren` prop adds a modifier class that makes the content wrapper a viewport-height flex column, with `min-height: 0` on the children wrapper so tall content scrolls inside the child instead of stretching past the viewport.

    ```tsx
    <CopilotSidebar fullHeightChildren>
      <div style={{ height: "100%" }}>...</div>
    </CopilotSidebar>
    ```

    It is opt-in on purpose — the content wrapper wraps the entire consumer app, so a default fixed-height flex column would reflow apps that never asked for it — and it uses a viewport unit rather than `height: 100%`, which would silently no-op in a stock app where no ancestor declares a height. The sidebar's own `position: fixed` and its expanded `448px` push-aside margin are untouched. Fixes [#261](https://github.com/CopilotKit/CopilotKit/issues/261); supersedes [#4622](https://github.com/CopilotKit/CopilotKit/pull/4622), with @ashish4143 credited as co-author for the original diagnosis. ([#6410](https://github.com/CopilotKit/CopilotKit/pull/6410))

## Documentation

- **The custom Channel runner path is documented** — the Channels READMEs now explain the durable-data dividing line, state Channel lifecycle behavior positively, and carry an updated architecture diagram emphasizing the runner. ([#6437](https://github.com/CopilotKit/CopilotKit/pull/6437))
- **LangGraph self-hosted auth snippets replaced with a working pattern** — the previous snippets did not run. ([#6403](https://github.com/CopilotKit/CopilotKit/pull/6403))

## Dependencies

- **`@ag-ui/*` unchanged from `1.66.4`** — `@ag-ui/langgraph` at `0.0.42`, `@ag-ui/a2ui-middleware` at `0.0.10`, `@ag-ui/mcp-apps-middleware` at `0.0.3`, `@ag-ui/mcp-middleware` at `0.0.1`, `@ag-ui/core` / `@ag-ui/client` / `@ag-ui/encoder` at `0.0.57`.
- **`@copilotkit/license-verifier` stays at `~0.5.0`**.
- **Runtime's Channels dependencies resolve to `0.8.0`** — see `v1.67.1` for the `0.8.1` republish.

## Packages republished at `1.67.0`

`@copilotkit/runtime`, `@copilotkit/react-core`, `@copilotkit/react-ui`, `@copilotkit/react-native`, `@copilotkit/core`, `@copilotkit/shared`, `@copilotkit/runtime-client-gql`, `@copilotkit/sdk-js`, `@copilotkit/vue`, `@copilotkit/voice`, `@copilotkit/web-inspector`, `@copilotkit/web-components`, `@copilotkit/a2ui-renderer`, `@copilotkit/react-textarea`, `@copilotkit/sqlite-runner`, and `@copilotkit/agentcore-runner`.