[plauzy]

Reworks ag-ui-protocol#2216 to what was asked in this review: a Dojo entry that runs against a real local cao-server with a real agent process, marked localOnly, with no hosted deployment and no CI lane, plus a README in the integration folder. This PR targets cao-integration-458; once approved there, that branch (and so ag-ui-protocol#2216) carries it.

What changes

• Dojo: one feature, tool_approval, wired directly to ${CAO_URL}/agui/v1/run (default http://127.0.0.1:9889), localOnly: true. The Python mock/projection example server is deleted, so nothing simulated is left in the Dojo path.
• Shared page tool_approval/page.tsx: a CAO branch in readApprovalRequest, checked after the Mastra return. It matches only an interrupt carrying string metadata.provider and metadata.terminalId, renders reason, provider and terminal id, and resolves with the same {approved} payload. The Mastra path is unchanged.
• integrations/cli-agent-orchestrator/:
  • README.md: prerequisites, install, start, approve, reject, teardown, troubleshooting.
  • agui-approver.md: a CAO profile for Claude Code with permissionMode: default and allowedTools: [fs_read, fs_write], so the agent's limits are enforced by the CLI, not only by the prompt.
  • scripts/run-local.sh: brings up a loopback cao-server with AG-UI enabled and the agent in a temp dir; --down tears it all down.
• TypeScript client: README example uses the real runAgent() / resume[] API; peer deps >=1.0.0; runtime code unchanged.
• Removed: the render.yaml service, the dojo-e2e.yml lane, the CAO e2e specs, and every apps/dojo/e2e/** change. All of those files are now byte-identical to upstream/main.
• Docs: docs/introduction.mdx links the integration README instead of a hosted demo.

Left out, because CAO can't genuinely back them today: agentic_chat (the run endpoint doesn't read messages), shared_state (CAO ignores RunAgentInput.state), human_in_the_loop (client-declared tools[] are never called), agentic_generative_ui (no agent step state on CAO's stream), the interrupt page (its {chosen_time} payload is rejected by CAO), and the edit resume option (on Claude Code the edited text is ignored).

Known limits: the agent's task starts outside the Dojo (the README's launch step), and the card shows no prompt text because CAO keeps prompt bodies off the wire.

CAO version

Needs two CAO fixes, in plauzy/cli-agent-orchestrator#44: /agui/v1/run now finishes after a resume and when nothing is pending, and Claude Code 2.1.310 tool-permission prompts are detected. Until a CAO release carries them, the README installs from acbb1538; the line moves to the PyPI release once it ships.

Verification

Live, against an isolated cao-server built from ed6e0193 (same code as acbb1538, which adds only a docstring) and a real Claude Code 2.1.310 agent, driving the real tool_approval page:

• The profile's Write prompt raised a card (claude-code:permission_request / claude_code in terminal …).
• Approve wrote approved-by-dojo.txt; Reject (fresh demo per README step 6) left no file, pane User rejected write to approved-by-dojo.txt.
• Both runs closed: collect → RUN_FINISHED(interrupt), resume → RUN_FINISHED(success), and the chat left its running state.
• With allowedTools set, the Claude process carried --disallowedTools for Bash, Agent, Task, web and background tools, and the Write prompt still appeared.

Gates, all exit 0: pnpm install --frozen-lockfile, pnpm run check-types, @ag-ui/cli-agent-orchestrator build, test (5/5) and test:exports, generate-content-json, published-mode.test.js (12/12), bash -n (3.2) + shellcheck on the launcher. files.json is regenerated with the repo script.

Not verified:

• The full repo-wide pnpm run test is not green on this machine. It has three failures, none in touched packages: one needs dotnet, and two are timeouts that pass when rerun alone.
• The pre-commit hooks were not installed in this worktree, so their steps were run by hand.

Evidence (recorded 2026-10-26)

integrations/cli-agent-orchestrator/scripts/e2e-local.sh drives the real tool_approval page against an isolated cao-server and a real Claude Code 2.1.310 agent: approve, then a fresh agent and reject, then a run with nothing pending. Every frame has a stamp bar naming the CAO build and the ag-ui sha.

Before: CAO 2.5.4 (PyPI)	After: CAO acbb1538 (ag-ui-protocol#44)
No card for the Write prompt; approve, reject and nothing-pending runs never finish (stop button stays).	Card appears; approve writes the file, reject leaves none; every run finishes (send arrow returns).

Videos (click to play; same runs as the GIFs above):

Before (CAO 2.5.4 from PyPI): the Write prompt raises no approval card, and every run stays open.

before.mp4

After (CAO acbb1538, ag-ui d1c21086): the card appears. Approve writes approved-by-dojo.txt, Reject leaves no file, and every run finishes.

after-1.mp4

Approve: the card, then the file it wrote

Reject: the card, then no file

The run passed 3 out of 3 on CAO acbb1538 (after-1 to after-3, 19/19 assertions each); after-4 reran the committed script, also 19/19. On 2.5.4 it failed.

Full resolution: before MP4 · after MP4 · after per phase: approve.webm, reject.webm, none.webm · settled chat after approve / reject / none: png, png, png · before, 15 s after asking: approve, reject, none.

CODEOWNERS

The per-folder line integrations/cli-agent-orchestrator @ag-ui-protocol/copilotkit @plauzy @haofeif from the original PR is dropped; the catch-all * @ag-ui-protocol/copilotkit already covers this folder.

[github-actions]

Python Preview Packages — Publish Failed

Preview publish failed for commit 033e155.
See the workflow run for details.