Repository navigation
fix(runtime): enforce basePath segment boundary in single-route mode - #7341
Merged
lukasmoschitz merged 2 commits intoSep 28, 2026
Conversation
remote-controlled-man
requested review from
jpr5,
marthakelly,
mme,
ranst91 and
tylerslaton
as code owners
September 22, 2026 02:39
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Important Review skippedReview was skipped as selected files did not have any reviewable changes. ⚙️ Run configurationConfiguration used: Repository: CopilotKit/CopilotKit/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: CopilotKit/CopilotKit/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughSingle-route resolution now requires an exact base-path match or a following ChangesSingle-route boundary validation
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Suggested reviewers: Merge Risk: ⚪ Minimal · up to Single-route requests with lookalike base paths now return 404 without affecting valid routes. The focused regression coverage supports merging with normal checks. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@copilotkit/a2ui-renderer
@copilotkit/agentcore-runner
@copilotkit/angular
@copilotkit/channels
@copilotkit/channels-core
@copilotkit/channels-discord
@copilotkit/channels-intelligence
@copilotkit/channels-slack
@copilotkit/channels-teams
@copilotkit/channels-telegram
@copilotkit/channels-ui
@copilotkit/channels-whatsapp
@copilotkit/core
@copilotkit/intelligence-langgraph
@copilotkit/intelligence-mastra
@copilotkit/mcp-apps-renderer
@copilotkit/react-core
@copilotkit/react-native
@copilotkit/react-textarea
@copilotkit/react-ui
@copilotkit/runtime
@copilotkit/runtime-client-gql
@copilotkit/sdk-js
@copilotkit/shared
@copilotkit/sqlite-runner
@copilotkit/voice
@copilotkit/vue
@copilotkit/web-components
@copilotkit/web-inspector
commit: |
lukasmoschitz
approved these changes
Sep 28, 2026
remote-controlled-man
deleted the
codex/copilotkit-single-route-basepath
branch
October 13, 2026 01:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
In single-route mode, the
basePathcheck inresolveSingleRouteused a barestartsWith, so a path that merely shares a string prefix with the configured base was accepted as a runtime endpoint. WithbasePath: "/api/copilotkit", aPOSTto/api/copilotkit-extrawith a valid envelope (e.g.{"method":"info"}) is served200with runtime info instead of404.Multi-route mode already guards this:
matchRouterequires the character afterbasePathto be/or end-of-string (fetch-router.ts), with a pinned regression test that/api/copilotkitextra/infodoes not match (matchRoutereturnsnull, so the handler answers 404). This change applies the same boundary rule to single-route mode, keeping the/basePath "match everything" special case intact.Reachability: the documented headless setups (
Bun.serve({ fetch: handler }),Deno.serve(handler)) forward every request path to the handler, so prefix-colliding paths are realistically reachable there; the Express/Hono adapters mask this with their own exact routing, which is why the fix belongs in the shared handler.Test
New regression test in
single-route-resource-operations.test.ts: aPOSTto/api/copilotkit-extra(string-prefix collision with the configured/api/copilotkitbase) must 404. RED on base (returns 200 today), GREEN after the fix.@copilotkit/runtimetest suite — 2552 passed (184 files), including the new test.pnpm run check-types— clean.No changeset / version bump per repo conventions.
Summary by CodeRabbit