[guidovizoso]

What this changes

Bots can now draw interfaces from CopilotKit's standard catalog: A2UI 1.0, 68 components for layout, text, inputs, tables, charts, media and composites. Admins govern them the way they govern the gallery, so a Bot never draws a component an admin hasn't approved.

Five commits:

1. Upgrade CopilotKit to 1.83.0. Moves @copilotkit/runtime and react-core from 1.77.0, and @ag-ui/* to 1.0.2. Tests now read SDK tools lazily, because the provider no longer re-renders its consumers after mount.
2. Draw from the standard catalog. Uses standardUI without Map, which needs a map library OpenBot doesn't ship. The theme is mapped to OpenBot's tokens, so it follows the colours, radii and font in light and dark. The runtime's generativeUI follows OPENBOT_GENERATIVE_UI.
3. Govern it on the server.
   • Rows: the 68 components are grouped into 57 families. A family keeps together parts that only work as a set, such as Table with its rows and cells. Each family is a row in the existing components table, named like a2ui.Table, so publishing, per-Bot withholding and edited descriptions work as they do for gallery components.
   • Rebuilt per run: a beforeRequestMiddleware throws away the catalog the browser sends. It rebuilds it from the server's own copy (shared/standard-ui-catalog.json), keeping only the families that Bot can use, in the published words.
   • Enforced: CopilotKit's GenerativeUIMiddleware then refuses any other component, whatever the browser sent.
   • Defaults: Layout, text and input families arrive published. Data, media, overlay and composite families arrive unpublished.
4. List the families in Admin → UI components and in the components gallery. One section per group after the gallery tiles. Each row shows "On for every Bot", "Off for N Bots" or "Off" and opens the existing detail page.
5. Preview each family. A family's page shows it drawn by the real SDK from a sample. The samples render in a provider of their own, apart from any conversation.

The browser keeps every standard component for drawing. A conversation from before a family was withdrawn still draws it.

Worth knowing

• Favicon and LinkCard call Google. The SDK loads their icons from https://www.google.com/s2/favicons, so the site's domain goes to Google. Both arrive unpublished.
• The full catalog still crosses the wire. The browser sends the whole catalog with every run because the tool transport has no includeCatalog: false. The server discards it. This needs an upstream change to stop.
• Old surfaces no longer draw. A2UI 0.9 surfaces from before the upgrade don't draw when a conversation is reopened. The messages around them stay. This is in the changelog's "Before upgrading".
• Rebuilding the catalog file. After an SDK upgrade, run bun run --cwd app export:standard-ui. A test fails if the file drifts from what the SDK sends.

Where it runs

• New state that outlives a request? Only rows in the existing components table in Postgres, one per family. The rebuilt catalog is computed per request from those rows. There's no in-memory cache.
• What happens on the second replica? Both replicas run syncCatalogue at boot. The insert is onConflictDoNothing on the unique name, so the second replica inserts nothing and reports nothing added. Every replica reads the same rows on every run.
• Anything serialised? No. The insert above is the only write, and the unique index decides it.
• Anything fanned out to a browser? None.
• New listener, port, or schedule? None. The middleware runs inside the existing CopilotKit runtime route.

Boundary and audit

• Every acting call still goes through the gateway. Drawing a surface isn't an acting call, and no gateway path changed.
• New refusals and failures are recorded. A component outside the Bot's catalog is refused by the runtime and returned to the model in the tool result. Publishing and withholding families use the existing component routes, which already write audit rows. PUT /catalogue refuses the reserved a2ui. prefix with a 400.
• Nothing new is trusted from the client. The server replaces the catalog the browser sends instead of filtering it. When a Bot has no families, the request names no agent, or its permissions can't be read, the run gets no catalog at all.

Changelog

• Under Unreleased: "Bots draw from CopilotKit's standard components" and "CopilotKit 1.83". The "Before upgrading" list is updated.

Proof

• Checks: format:check, lint and typecheck pass on all 6 packages, after a rebase onto 4bb0c0b4.
• App tests (bun test ./app from the root): 1752 pass, 10 fail.
  • All 10 failures are in new-bot-sheet.test.tsx. Unmodified main fails the same 10 when the whole suite runs.
  • They pass when the file runs alone, on this branch and on main.
• Server and toolkit tests against a fresh pgvector container: 5945 pass, 19 skip, 3 fail. The failures are the Mastra bridge test and the langgraph and bot "real provider sees the learned catalog" tests. They need per-package installs in the agent packages, which aren't workspaces.
• Server tests for the catalog rewrite use the real GenerativeUIMiddleware: a granted Text draws and an ungranted Image is refused.
• Previews: a test draws all 57 family samples and fails if the SDK rejects any of them.
• Live, with a real Bot:
  • While Table was unpublished, the Bot said it couldn't use Table.
  • After I published it, the Bot drew one.
  • I unpublished it again.
  • I also checked the Admin and components gallery screens and the previews.

[guidovizoso]

Closing in favour of a smaller PR that only upgrades to A2UI 1.0. The governance work stays on this branch.