[guidovizoso]

What this changes

This upgrades CopilotKit to 1.83 and moves generated interfaces from A2UI 0.9 to A2UI 1.0. A Bot can draw the same components as before: the 18 basic ones (text, images, icons, video, audio, rows, columns, lists, cards, tabs, dividers, dialogs, buttons, checkboxes, text fields, date pickers, choice pickers and sliders).

Two commits:

1. Upgrade CopilotKit to 1.83.0.
   • Updates @copilotkit/react-core, runtime and a2ui-renderer from 1.77.0, and @ag-ui/core and @ag-ui/client to the 1.0.2 they require.
   • Two kinds of test assumed 1.77's behaviour. The provider no longer re-renders its consumers after mount, so the tool-card tests read the SDK's tools lazily. With a non-OpenAI OPENAI_BASE_URL, openai/... models now use Chat Completions, so a gpt-5 model's instructions arrive as a developer message.
2. Draw generated interfaces with A2UI 1.0.
   • Catalog: the browser passes the catalog through the provider's generativeUI prop, only when the deployment has generative UI on. It's CopilotKit's standard catalog cut down to the A2UI 1.0 basic components, which it carries under their A2UI names. A test checks the catalog contains exactly those 18.
   • Theme: the --a2ui-* theme variables point at OpenBot's own tokens, which switch under .dark themselves, so one theme covers light and dark. The CSS overrides for the old catalog go.
   • Server: the runtime sets generativeUI from OPENBOT_GENERATIVE_UI, so an opted-out deployment refuses render_ui even when a client sends a catalog. It also turns the A2UI 0.9 middleware off.

The rest of the standard catalog (tables, charts, composites, and so on) stays out until admins can see and govern it.

Old surfaces no longer draw. A2UI 0.9 surfaces from before the upgrade don't draw when a conversation is reopened; the messages around them stay. This is in the changelog's "Before upgrading" list.

The sandboxed HTML path (openGenerativeUI) is unchanged.

Where it runs

• New state that outlives a request? None.
• What happens on the second replica? Nothing different. The catalog is static code in the browser bundle, and the runtime option is per-process config from the environment.
• Anything serialised? No.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? None.

Boundary and audit

• Every acting call still goes through the gateway. Drawing a surface isn't an acting call.
• No new refusals or failures. The runtime refuses a component outside the catalog and returns that to the model in the tool result, as before.
• Nothing new is trusted from the client. The server decides from its own config whether generative UI runs.

Changelog

• Under Unreleased: "Generated interfaces use A2UI 1.0" and "CopilotKit 1.83". The "Before upgrading" list is updated.

Proof

• Checks: format:check, lint and typecheck pass on all 6 packages.
• App tests (bun test ./app from the root): 1687 pass, 10 fail.
  • All 10 failures are in new-bot-sheet.test.tsx. Unmodified main fails the same 10 when the whole suite runs.
  • The file passes when it runs alone.
• Server and toolkit tests against a fresh pgvector container: 5933 pass, 19 skip, 3 fail.
  • The 3 failures are the Mastra bridge test and the langgraph and bot "real provider sees the learned catalog" tests.
  • They need per-package installs in the agent packages, which aren't workspaces. They're unrelated to this change.
• Live, with General Assistant:
  • Asked for a form through render_ui, it drew an A2UI 1.0 surface with a name field, a date input and a "Submit trip" button.
  • Asked for a table in the same surface, it replied: "the A2UI catalog provided here has no Table component."