[apetraru-uipath]

What changed?

AL-672. generateGuardrailId() minted guardrail-<base36 time>-<random> ids. Agents copies a Tool-scoped guardrail, under the same id, into its tool's guardrail.policies[], and the Agents backend parses that id as a GUID. So agents built with the Apollo builder (on in alpha) couldn't be loaded once deployed (Agent.PackageDeserialization), and their debug and eval starts returned 400.

• generateGuardrailId() now returns an RFC 4122 v4 UUID: crypto.randomUUID() when it exists, otherwise built from crypto.getRandomValues (randomUUID is only defined in secure contexts). Its name, export and string type are unchanged.
• Save as new now hands the copy a fresh id, in both GuardrailBuilder and CustomGuardrailBuilder. Before, the copy kept the original's id, so the Agents host ended up with two guardrails sharing one id. That id is also used as the list key and the dnd id. Flow already mints its own id for the fork, so nothing changes there. The JSDoc and the README contract note say so.
• Edited guardrails keep their id verbatim. Agents saved with a legacy id are handled by the backend fix (UiPath/Agents#6791), which accepts non-GUID ids.

Consumers: Flow's DeterministicGuardrailsBuilder.test.tsx asserts /^guardrail-/ and needs a UUID regex when it bumps. Agents pins 7.9.0 exactly and will bump in a follow-up.

How has this been tested?

• The four tests that asserted the old prefix now assert a v4 UUID. New tests cover: two calls differ; the getRandomValues fallback, which is deterministic with fixed bytes and an exact expected UUID (5 mutants of the version/variant bits all fail it); and Save as new passing a fresh id in both builders.
• vitest --run src/canvas/components/Guardrails: 46 files, 1106 tests passed.
• Full @uipath/apollo-react suite: 4506 passed and 2 failed. The two failures (a JsonTree.import timeout and one other) also fail on a clean main.
• lint, format:check, build (rslib dts) and tsc --noEmit are clean, and commitlint passes.

Labelled dev-packages so Agents can try the preview build before release.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

Static review found no blocking issues in the focused ID changes or accompanying tests; tests were not rerun.

No open issues 🎉

What changed in this PR

Updates Apollo React guardrail IDs to UUIDs compatible with Agents’ GUID parsing and prevents “Save as new” copies from sharing the original’s ID.

Changes:

• Generates v4 UUIDs using crypto.randomUUID(), with a crypto.getRandomValues() fallback.
• Assigns fresh IDs to copies in both builders while preserving IDs during normal edits.
• Updates regression tests and documents the ID contract.

File	Description
packages/​apollo-react/​src/​canvas/​components/​Guardrails/​README.md	Documents new, copied, and edited guardrail ID behavior.
packages/​apollo-react/​src/​canvas/​components/​Guardrails/​guardrail-builder.tsx	Generates a fresh ID for “Save as new.”
packages/​apollo-react/​src/​canvas/​components/​Guardrails/​guardrail-builder.test.tsx	Updates save and copy assertions to expect UUIDs.
packages/​apollo-react/​src/​canvas/​components/​Guardrails/​custom-guardrail-builder.tsx	Generates a fresh ID for custom guardrail copies.
packages/​apollo-react/​src/​canvas/​components/​Guardrails/​custom-guardrail-builder.test.tsx	Checks UUIDs for new and copied custom guardrails.
packages/​apollo-react/​src/​canvas/​components/​Guardrails/​custom-builder-utils.test.ts	Expects UUIDs in default custom guardrails.
packages/​apollo-react/​src/​canvas/​components/​Guardrails/​builder-utils.ts	Implements v4 UUID generation and fallback.
packages/​apollo-react/​src/​canvas/​components/​Guardrails/​builder-utils.test.ts	Covers UUID format, uniqueness, and deterministic fallback output.

_{Review effort: Balanced}

[github-actions]

Dependency License Review

• ✅ 1957 package(s) scanned
• ✅ No license issues found
• ⚠️ 2 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1721
ISC	91
Apache-2.0	57
BSD-3-Clause	28
BSD-2-Clause	23
BlueOak-1.0.0	8
MPL-2.0	4
CC0-1.0	4
MIT-0	3
MIT OR Apache-2.0	2
(MIT OR Apache-2.0)	2
Unlicense	2
LGPL-3.0-or-later	1
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
Unknown	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.3.4	LGPL-3.0-or-later	LGPL pre-built binary, not linked
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json

[github-actions]

📦 Dev Packages

Package	Status	Updated (PT)
@uipath/apollo-react@7.9.0-pr1464.2d286cb	🟢 Published	Oct 23, 2026, 09:38:14 AM

[github-actions]

📊 Coverage + size by package

Per-package coverage and bundle size on this PR. New-line coverage = of the source lines this PR adds or changes, the % hit by tests.

Package	Coverage	New-line coverage	Packed (gzip)	Unpacked	vs main
@uipath/apollo-core	—	—	42.02 MB	50.17 MB	±0
@uipath/apollo-react	58.4%	100.0% (8/8)	8.14 MB	32.17 MB	+57 B
@uipath/apollo-ui-icons	—	—	2.86 MB	6.97 MB	±0
@uipath/apollo-vertex	—	—	—	—	—
@uipath/apollo-wind	—	—	810.7 KB	4.68 MB	+8 B
@uipath/ap-chat	85.8%	—	40.42 MB	45.71 MB	±0

_{"Coverage" is each package's own coverage.include scope (e.g. apollo-core instruments only scripts/). "Packed"/"Unpacked" come from npm pack --dry-run and only cover built packages — "—" means not measured this run (package not affected / not built). "vs main" is the packed (gzipped) delta against the last successful main build (the package-sizes artifact from the Release workflow); "—" there means no main baseline was available this run. The baseline is main's latest build, not this PR's exact merge-base, so it includes any drift since the branch diverged. Packages with no vitest config are omitted.}

[github-actions]

Storybook visual diff

⚠️ Visual changes detected: 12 changed, 4 added, 8 errored (of 548 compared, 524 unchanged). View report

Baseline is the deployed main Storybook, so changes merged to main after this branch was last updated can also appear here. Logs

Updated (PT): Oct 23, 2026, 10:13:56 AM