chore: update CopilotKit packages

[arcadegeek23]

Summary

• Update @copilotkit/react-core and @copilotkit/runtime from 1.68.3 to 1.69.0.
• Refresh the resolved CopilotKit dependency graph in bun.lock.

Validation

• bun run typecheck
• bun run test:smoke (5 passed)
• Local OpenBot stack restart and CopilotKit runtime discovery succeeded.

Conversation: https://app.warp.dev/conversation/6d1440e3-155d-4658-9b82-ad4cd8775a97

Co-Authored-By: Warp agent@warp.dev

[Copilot]

Pull request overview

Updates CopilotKit dependencies used by the OpenBot app and server, and refreshes the Bun lockfile to reflect the new resolved dependency graph.

Changes:

• Bump @copilotkit/react-core to 1.69.0 in the app workspace.
• Bump @copilotkit/runtime to 1.69.0 in the server workspace.
• Update bun.lock to the newly resolved CopilotKit dependency set.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
app/package.json	Updates the app’s CopilotKit React dependency to 1.69.0.
server/package.json	Updates the server’s CopilotKit runtime dependency to 1.69.0.
bun.lock	Refreshes lockfile entries and resolved CopilotKit package versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[davidmckayv]

A green suite is not enough for a runtime bump, so I checked the two contracts this repo actually leans on rather than trusting the version number.

BuiltInAgent.clone() — 1.69.0 still does new BuiltInAgent(this.config) and copies middlewares. The tool-selection wrapper added in #178 depends on that, because the runtime clones an agent before every run and a clone that lost its state would fail on the first message anybody sent.

config.tools is still read inside run() (line 467), not captured at construction. Same dependency: narrowing per run only works because the tools are resolved at subscription time.

Then the test that asserts on the wire. The tool-selection integration suite reads the tool list out of the request the mock actually received, through a real clone() — 41 pass. That is the check that would catch a behaviour change a typecheck cannot see.

@ag-ui/client stays 0.0.57 and rxjs stays 7.8.1, so the explicit rxjs pin remains correct and needs no repin.

Fixed one thing before merging. The lockfile recorded ^1.69.0 for the runtime and ^1.39.0 for aimock while both are pinned exact in server/package.json — and aimock's range was loosened with no manifest change at all. --frozen-lockfile still passed, but the lock had stopped describing the manifest, which is how a patch nobody chose arrives later. Regenerated, and rebased onto current main.

What green still does not prove, stated rather than implied: no test runs a real turn against Intelligence, so thread create/restore, deleteThread and the gateway socket are exercised by nothing here. A stale model id would typecheck and fail only at the platform. Confidence is high anyway, but from reading the delta rather than from the suite.

Checks after rebase: typecheck, lint, format clean; 1416 pass, 0 fail — identical to main.