#LoadAgentState is returning all state (including internal state)

1 messages · Page 1 of 1 (latest)

prime island
#

Hello,
I'm facing the same issue as described in this Github issue: https://github.com/CopilotKit/CopilotKit/issues/2113

I see an open PR to address the issue but there hasn't been an update since July: https://github.com/CopilotKit/CopilotKit/pull/2125

Can someone point me in the correct direction?

Here are the packages I am using:

    "@copilotkit/runtime": "1.10.3",
    "@copilotkit/react-core": "1.10.3",
    "@copilotkit/react-ui": "1.10.3",
    "@copilotkit/runtime-client-gql": "1.10.3",

    Python backend:
    copilotkit>=0.1.72
GitHub

♻️ Reproduction Steps define agent use inputs-outputs schema: https://docs.copilotkit.ai/coagents/shared-state/state-inputs-outputs <CopilotKit threadId="8c954fea-b40c-468d-8fcb-5fdad9d7492...

GitHub

In fact, the get_input_jsonschema and get_output_jsonschema of langgraph do not use the config parameter.
The get_state has been improved to only return the output data, avoiding returning the inpu...

cloud coyoteBOT
#

This solution has been AI generated

You're hitting a known issue: loadAgentState currently returns all non-message state, including internal keys. This is due to missing filtering in the runtime implementation; the open PR proposes limiting the response to user-facing state.

What’s happening

In the runtime’s loadAgentState (LangGraph path), the code does not filter internal fields:

// copilot-runtime.ts (simplified)
const { messages, ...stateWithoutMessages } = state;
return {
  threadId: threadId || "",
  threadExists: true,
  state: JSON.stringify(stateWithoutMessages), // exposes internal state
  messages: JSON.stringify(copilotkitMessages),
};

Fix (as proposed in PR #2125)

Return only the user-facing portion of state:

const { messages, ...fullStateWithoutMessages } = state;
const userFacingState = fullStateWithoutMessages.userFacing || {};
return {
  threadId: threadId || "",
  threadExists: true,
  state: JSON.stringify(userFacingState),
  messages: JSON.stringify(copilotkitMessages),
};

Workarounds for 1.10.3

  • Client-side filtering (quickest):
const res = await loadAgentState(...);
const full = JSON.parse(res.state || "{}");
const safe = full.userFacing ?? {};
// Use `safe` instead of `full` when rendering or persisting
  • Server-side patch (preferred if possible): fork/patch the runtime to apply the filtering above before returning state.

Notes

  • This primarily affects the LangGraph agent runtime path; the Python backend isn’t the source of the exposure.
  • Once the PR is merged and a new runtime is published, updating should resolve the issue.

Was this helpful?

If this solution worked for you, please click on the appropriate option below to help us improve:

#

Thank you for your feedback! Our team will provide additional assistance. 🔄

prime island
prime island
#

@edgy flax Any guidance on the above?

cloud coyoteBOT
#

@prime island Thanks for your question! I've shared this with the team and get back to you soon.

prime island
#

Related question someone else has posted: #♢│ag-ui message
cc @unborn charm

cloud coyoteBOT
#

Thanks for the additional context! I've shared these with the team as well!