copilotkit 4.11.0 → 4.13.0

package/onboarding/prompts/subagent/inspect-repository.md

@@ -2,16 +2,41 @@
 
 Work only on the packet you were assigned. Inspect the repository without changing it.
 
+## Start with what the CLI already knows
+
+Run this first, from the target project directory:
+
+```text
+npx --yes copilotkit@4.13.0 onboard inspect --json
+```
+
+It answers the deterministic half of both packets exactly, from the same code
+`copilotkit verify` uses: the project record by presence, and, for each app or runtime
+directory on its own, the env files, which variable carries the Intelligence key and which
+file it came from, whether that directory's own process can load it, the package manager
+its lockfile proves, the port it declares, and the exact installed version of every
+`@copilotkit/*` dependency. It reads only and prints no secret value.
+
+Carry those readings into your findings as they came back. Do not work one of them out
+again by reading files. The directory that owns `.env` is the hard case and the CLI holds
+the fixes for it, so a second answer derived here is a guess competing with a proof.
+
+An empty `apps` array is an answer, not a failed probe. App discovery keys on a declared
+`@copilotkit/*` dependency, so a project that has not installed CopilotKit reports no apps
+however much else its tree holds. `appDiscovery` says why it is empty: `no-project` for a
+target directory that holds no project yet, and `no-declared-dependency` for a project
+where no directory declares one. Report that reason as the finding. Do not report that
+the inspection found nothing.
+
 ## Project evidence packet
 
 Find evidence for:
 
 - what the project is for, in the project's own words
-- the target app or runtime directory that owns `.env` and the CopilotKit setup
 - whether the target project directory contains any entries
-- any existing agent framework and frontend
-- current CopilotKit integration and configuration, including whether
-  `.copilotkit/project.json` has `projectId`, `projectSlug`, and `clerkOrgId`
+- any existing agent framework and frontend, confirming or contradicting the
+  `detection` block the CLI proposed
+- current CopilotKit integration and configuration
 - authentication boundaries
 - initial changed and untracked paths, without file contents
 
@@ -21,25 +46,27 @@ protected-path audit compares against, so nothing later in the run depends on th
 subagent still existing, and a path that can hold secrets is captured as a digest you
 never read.
 
+Take the target app or runtime directory from the CLI packet rather than working it out
+here. `copilotkit verify` resolves it, and two fixes live in that resolution which a
+reading of the files will not reproduce.
+
 ## Environment evidence packet
 
-- names of required credential variables and whether `.env` has a non-empty
-  `CPK_INTELLIGENCE_API_KEY`
+- names of required credential variables, beyond the Intelligence key the CLI reported
 - retain the `.env` modification time for a later comparison without returning it
-- package manager and lockfile
 - required toolchains and their installed versions
-- declared ports and whether each port is available
+- whether each port the CLI reported as declared is free
 - whether the runtime constructor uses a `runner` option, an `intelligence` option, or
   neither can be proved from project files
-- CopilotKit package versions and package compatibility risks
+- package compatibility risks, and whether any `@copilotkit/*` version the CLI reported is
+  below 1.70.0
 
 Key every environment finding by its app or runtime directory. Do not combine findings
-from different directories.
+from different directories. The CLI packet keys its own readings the same way.
 
-For the CopilotKit versions, report the exact installed version of every `@copilotkit/*`
-dependency, read from the lockfile rather than a manifest range, and state whether any of
-them is below 1.70.0. The conversion decides its upgrade from exactly that, and a caret
-range does not answer it.
+The CLI reports the exact installed version of every `@copilotkit/*` dependency, read from
+the installed tree rather than from a manifest range. The conversion decides its upgrade
+from exactly that, and a caret range does not answer it.
 
 A project states what it is for in its `README.md`, in its package description, or in
 the prompt of an agent it already has. Quote that statement rather than rewriting it. An
@@ -59,5 +86,5 @@ Return one row for each assigned item with its status, evidence path, and a shor
 Use only `proved`, `absent`, or `unproved` for the status. State each absent or unproved item.
 Do not read, print, or return secret values. For `.env` and `.copilotkit/project.json`
 checks, return only paths, presence checks, and missing field names. Do not read a file
-outside the project directory. Do not run or return another onboarding command. Stop after
-returning the findings to the main coding agent.
+outside the project directory. Do not run or return an onboarding command other than
+`onboard inspect`. Stop after returning the findings to the main coding agent.

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -19,7 +19,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --yes copilotkit@4.11.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --yes copilotkit@4.13.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -9,6 +9,16 @@ You can make only operational repairs to project-owned processes, ports, and req
 Do not write a path that overlaps a protected path. If a required proof or tool path
 overlaps one, return `Status: blocked` before writing it.
 
+The existing agent's behavior is outside every step of this proof. It is four things: the
+agent's system prompt and instructions, its tools and what those tools do, its model and
+provider configuration, and its memory or state handling. A failing predicate is repaired
+on the CopilotKit side -- the frontend rendering, the tool schema, the runtime wiring.
+Where the only fix you can find is a change to the agent's instructions or tools, stop and
+return the failing predicate with the change you propose, for the developer to approve.
+Such a change is a behavior change rather than a repair: it changes how the agent answers
+everywhere, not only in CopilotKit. Never rewrite the agent's prompt to make a component
+render, and never report a round trip proved by a prompt this run rewrote.
+
 Run the steps below in the order they appear. They are the proof. Do not design a
 different sequence of your own, and do not drop a step because an earlier one looked
 convincing. Step 6 has a web form and a React Native form: run the one that matches this
@@ -135,7 +145,7 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --yes copilotkit@4.11.0 verify --json`. It reads the port from this project, so a
+`npx --yes copilotkit@4.13.0 verify --json`. It reads the port from this project, so a
 non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
 `runtimeUrlSource` of `default` means nothing in the project named a port, so pass
 `--runtime-url` with the URL from step 1 in that case. Read the individual checks rather than
@@ -149,10 +159,11 @@ used the Intelligence credential. `api_key_authenticates` proves only that the k
 `api_key_loadable_by_app` fails when the key is in a file the application's own process
 will not read. `verify` searches upward for the credential and a framework's env loader
 does not, so a key at the repository root is invisible to an app in a subdirectory. The
-check names the file to write instead. Write the key there, or run
-`npx --yes copilotkit@4.11.0 project select` from the app directory. Do not link,
-copy, or symlink the file to work around it, and do not treat the credential as missing:
-the check above already reported that it exists.
+check names the file to write instead, and it names the exact command to re-run with this
+project already chosen. Write the key there, or run the command the check names, from the
+app directory. Do not run a bare `project select`: with no project named it needs a
+terminal you do not have. Do not link, copy, or symlink the file to work around it, and do
+not treat the credential as missing: the check above already reported that it exists.
 
 `intelligence_thread_routes` fails when a licensed runtime serves no thread routes. A missing
 `identifyUser` is the usual cause: it gates the whole web surface. Return the check for
@@ -168,7 +179,7 @@ named no port the CLI can read: keep step 2's URL, and rewrite its host as `loca
 before you use it.
 
 Then run the command once more with the URL you are about to open:
-`npx --yes copilotkit@4.11.0 verify --frontend-url <that url> --json`. The
+`npx --yes copilotkit@4.13.0 verify --frontend-url <that url> --json`. The
 `frontend_assets_served` check asks that server for its page and for one of the page's own
 assets, on that exact host. A `fail` there means the dev server refuses its own static
 assets on the host you were about to use, and the check names the URL to use instead. This
@@ -176,7 +187,7 @@ is the cheapest step that can save the most expensive one, so run it before the
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --yes copilotkit@4.11.0 verify --round-trip --json`. It sends one request through
+Run `npx --yes copilotkit@4.13.0 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -189,7 +200,7 @@ Where this run settled a Learning Container, add the flag to the call above rath
 running a second round trip:
 
 ```text
-npx --yes copilotkit@4.11.0 verify --round-trip --expect-learning-container <container id> --json
+npx --yes copilotkit@4.13.0 verify --round-trip --expect-learning-container <container id> --json
 ```
 
 The check reads the thread that this run created, so a second round trip proves a second
@@ -217,6 +228,22 @@ callback rather than from an assigned thread. Never report either one as proof.
 
 Where this run skipped the Learning step, leave the flag off.
 
+Where the runtime answers with a 401 from the model provider, check the processes before
+you change anything. A process reads its env file once, at launch, so one started before
+the credential was written holds an empty key while the file beside it carries the real
+one. Run this from the target app directory:
+
+```text
+npx --yes copilotkit@4.13.0 onboard env-staleness
+```
+
+A `stale` line names the env file and how long after launch it was written. Report that,
+with the process and the file it named, and say the process has to be started again before
+the 401 means anything. Do not restart it yourself and do not stop it: the reading names a
+process and never its owner, and one project's dev script often serves the agent and the
+frontend together. Editing a file to answer a 401 that a restart clears changes the project
+for a fault it does not have.
+
 ### Step 5a -- Prove that the page's data reaches the model
 
 `verify --round-trip` sends `context: []` and asks a question that needs no context. It
@@ -285,7 +312,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --yes copilotkit@4.11.0 verify --round-trip`, which reads the
+that thread with `npx --yes copilotkit@4.13.0 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. It either had
@@ -313,7 +340,7 @@ request never exercises. Drive it with the browser control step 6 named.
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --yes copilotkit@4.11.0 verify --frontend-url <the url you opened> --json`
+   `npx --yes copilotkit@4.13.0 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -30,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --yes copilotkit@4.11.0 onboard read fallback/best-effort`.
+`npx --yes copilotkit@4.13.0 onboard read fallback/best-effort`.
 
 Send one short report. Run the friction command without another developer question. Do not
 ask the developer about telemetry: the command applies the setting they already have.
 
 ```text
-npx --yes copilotkit@4.11.0 onboard friction --phase stop --category <slug>
+npx --yes copilotkit@4.13.0 onboard friction --phase stop --category <slug>
 ```
 
 Write one or two sentences to standard input: the step you stopped at and what stopped it.

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "copilotkit",
-  "version": "4.11.0",
+  "version": "4.13.0",
   "type": "module",
+  "engines": {
+    "node": ">=20.9.0"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/CopilotKit/Intelligence.git",
@@ -10,7 +13,8 @@
   "bin": {
     "copilotkit": "./index.js"
   },
-  "dependencies": {
+  "optionalDependencies": {
     "@microsoft/teams.cli": "3.0.3"
-  }
+  },
+  "license": "SEE LICENSE IN LICENSE"
 }

package/release/release-tool.js

@@ -14698,7 +14698,7 @@ import * as path4 from "node:path";
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "dc1238c0bd473e259c992b85026cb30fe6b3b726" : "main";
+  return true ? "1e13b4945b44c6afa2e398a0c9935415d4aa7577" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts