chore: release v1.40.0

[jpr5]

Cuts the accumulated [Unreleased] work. 72 non-merge commits since v1.39.0, 42 of them feat:/fix: — minor, not patch: two additive features, no breaking changes.

Prepared, not merged. publish-release.yml fires on push-to-main, so merging this publishes to npm, tags, cuts the GitHub Release, dispatches the Docker build, and posts to #oss-alerts. Merge when you want it live.

What ships

Added — GET /__aimock/fixtures fixture-count introspection (#407) · recorded OpenAI/OpenRouter token usage incl. OpenRouter usage.cost (#368) · AG-UI subagent lifecycle events + subagentRunId attribution (#391)

Fixed — X-AIMock-Strict parsed case-insensitively with whitespace tolerated (#408) · non-websocket upgrade probes no longer 404 and the body survives on every supported Node (#410 → #418) · AG-UI drift collector no longer reports clean for an unreadable failure · AG-UI canonical parser no longer drops a field after a trailing comment · openrouter no longer logged as an unknown SSE provider when recording

Changed — the AG-UI drift CI lane runs every agui-*.drift.ts guard rather than one hardcoded file

Version surfaces — seven

Found by grepping the repo for 1.39.0 rather than working from a checklist, because the checklist is what went wrong at v1.34.0 (four of six surfaces shipped stale). Zero occurrences of the old string remain:

#	file
1	package.json	version
2	charts/aimock/Chart.yaml	appVersion
3	.claude-plugin/plugin.json	version
4	.claude-plugin/marketplace.json	the ^ range under plugins[0].source
5	packages/aimock-pytest/.../_version.py	AIMOCK_VERSION — the npm pin the pytest harness downloads by default
6	docs/index.html	the version badge
7	packages/aimock-pytest/README.md	the documented --aimock-version default

Two of those (6, 7) aren't in the release SOP's list but carry the version string and would have shipped stale.

packages/aimock-pytest/pyproject.toml stays at 0.5.3 — that's the Python package's own version, on its own PyPI cadence.

Two things I checked rather than assumed

Bumping _version.py in the release commit is safe. publish-pytest runs npm view @copilotkit/aimock@$AIMOCK_VERSION, which would fail against an unpublished version — but it's needs: [build, publish] and gated on needs.publish.result == 'success', so 1.40.0 is on npm by the time it reads the pin. No chicken-and-egg.

package.json.description is deliberately not hand-synced. It diverges from the README subtitle in git, which looks like the drift the SOP warns about. It isn't: publish-release.yml rewrites it from the README subtitle in the runner before npm publish, without committing. Editing it here would fight the workflow.

README

Gains a Recorded token usage and cost bullet. The feature list enumerates record/replay capabilities individually (timing-aware replay, multi-turn, ordered blocks), so a user-visible one landing without an entry is a real omission. The new control-API route needs no README line — the README documents no /__aimock/* routes at all; that lives in docs/control-api.

Verification

typecheck (all three configs) exit 0 · build exit 0 · release/publish-pin/drift-script workflow tests 44 passing · prettier clean · commit body wrapped ≤100 cols for commitlint.

Full-suite note: five tests failed on a first run and all five passed in isolation — cli.test.ts SIGTERM, multimedia.test.ts transcription frame scheduling, proxy-buffer-cap.test.ts, and both publish-pin-workflow.test.ts real-pip cases. All wall-clock or network-bound, and none reachable from a version-string change. CI is the arbiter.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y445N6QQBeAdiLcEvEpqGe

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@copilotkit/aimock@420

commit: b88a941