feat: add thread list and deletion API with new component by tylerslaton · Pull Request #21 · CopilotKit/vnext_experimental

tylerslaton · 2025-10-12T04:20:56Z

switch docs, stories, and UI to the slot-based CopilotThreadList API
surface delete controls with optimistic updates and error feedback
extend useThreads with deleteThread/currentThreadId helpers plus tests
prevent suggestion-generated runs from polluting thread history
wire DELETE handler through runtime endpoints and runner backends
harden CopilotChat reconnect flow and tool-call rendering keys

claude · 2025-10-12T04:21:10Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

claude · 2025-10-17T12:56:55Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

claude · 2025-10-17T19:47:07Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

claude · 2025-10-17T19:59:08Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

claude · 2025-10-17T20:21:36Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

- switch docs, stories, and UI to the slot-based CopilotThreadList API - surface delete controls with optimistic updates and error feedback - extend useThreads with deleteThread/currentThreadId helpers plus tests - prevent suggestion-generated runs from polluting thread history - wire DELETE handler through runtime endpoints and runner backends - harden CopilotChat reconnect flow and tool-call rendering keys Signed-off-by: Tyler Slaton <tyler@copilotkit.ai>

claude · 2025-10-17T21:20:31Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

- Add undefined scope guards to thread handlers (list/get/delete) to return 401 when authentication fails. - Add scope validation and thread ownership check to handleStopAgent to prevent cross-user run termination.

claude · 2025-10-17T21:36:42Z

Claude encountered an error —— View job

I'll analyze this and get back to you.

mme

I stopped after 25 comments - needs more work to be merged safely

mme · 2025-11-11T10:37:38Z

+
+### 2. Server-Side: Validate and Enforce
+
+Configure the `` in your runtime:


A word seems to be missing here

mme · 2025-11-11T10:44:35Z

+}
+```
+
+## Validation Helpers


Do we need to introduce four different helpers here?

If so, I think the whole concept of validation needs to be explained a little better, i.e. how to signal access is granted/denied (throwing exceptions?), what to return from resolveThreadsScope

mme · 2025-11-11T10:47:15Z

+
+## Security Best Practices
+
+### 1. Always Validate on the Server


As discussed, there are ways to skip server side validation and still be secure by generating unguessable tokens as resourceId.

mme · 2025-11-11T10:49:25Z

+```tsx
+// Development - Warning in console
+<CopilotKitProvider runtimeUrl="/api/copilotkit">
+  {/* Console: "No resourceId set. All threads are globally accessible." */}


Without a resourceId, no list of threads should be accessible at all. Being able to list all the threads of all users must not be the default behavior.

mme · 2025-11-11T10:51:53Z

+  const user = await authenticate(request);
+
+  if (user.isAdmin) {
+    return null; // Admin bypass - sees all threads


It seems dangerous to have null mean "access to all threads" - is there an explicit way to signal that?

In general, I don't see having access to all the threads as a practical feature in almost any application.

mme · 2025-11-11T11:12:44Z

+
+        // Manually trigger subscribers since direct assignment doesn't notify them
+        // This ensures React components re-render with the empty messages
+        const subscribers = (agent as any).subscribers || [];


don't manually trigger agent subscribers

mme · 2025-11-11T11:14:05Z

    try {
      if (agent instanceof HttpAgent) {
-        agent.headers = { ...(this.core as unknown as CopilotKitCoreFriendsAccess).headers };
+        agent.headers = this.core.getHeadersWithResourceId();


This does not look right

mme · 2025-11-11T11:14:54Z

    }
  }

+  async disconnectAgent({ agent }: CopilotKitCoreDisconnectAgentParams): Promise<void> {


This looks like the coding agent added some weird hacks

mme · 2025-11-11T11:16:30Z

  }
 }

+async function waitForAgentToStop(agent: AbstractAgent, timeoutMs = 2000): Promise<void> {


why do we need to do this?

mme · 2025-11-11T11:18:21Z

    ...restProps
  } = props;

-  useEffect(() => {


I have huge doubts about removing this piece (core logic)

tylerslaton force-pushed the tyler/thread-management branch from a0c2cf1 to 46c5821 Compare October 17, 2025 12:56

tylerslaton force-pushed the tyler/thread-management branch 4 times, most recently from ca7279b to 3c22a31 Compare October 17, 2025 19:46

tylerslaton force-pushed the tyler/thread-management branch from 3c22a31 to 5733495 Compare October 17, 2025 19:58

tylerslaton force-pushed the tyler/thread-management branch from 5733495 to d797194 Compare October 17, 2025 20:21

tylerslaton force-pushed the tyler/thread-management branch from d797194 to 775b6a9 Compare October 17, 2025 21:20

fix: prevent unauthorized thread access via undefined scope

184afbd

- Add undefined scope guards to thread handlers (list/get/delete) to return 401 when authentication fails. - Add scope validation and thread ownership check to handleStopAgent to prevent cross-user run termination.

mme requested changes Nov 11, 2025

View reviewed changes


		### 2. Server-Side: Validate and Enforce

		Configure the `` in your runtime:


		## Security Best Practices

		### 1. Always Validate on the Server

Conversation

tylerslaton commented Oct 12, 2025

Uh oh!

claude Bot commented Oct 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mme left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

claude Bot commented Oct 12, 2025 •

edited

Loading

claude Bot commented Oct 17, 2025 •

edited

Loading

claude Bot commented Oct 17, 2025 •

edited

Loading

claude Bot commented Oct 17, 2025 •

edited

Loading

claude Bot commented Oct 17, 2025 •

edited

Loading

claude Bot commented Oct 17, 2025 •

edited

Loading

claude Bot commented Oct 17, 2025 •

edited

Loading