copilotkit 4.12.0 → 4.13.0

package/onboarding/prompts/proof/oss-baseline.md

@@ -1,7 +1,7 @@
 # Prove the existing OSS baseline
 
 Do not prove the baseline yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.12.0 onboard read subagent/prove-oss-baseline` first and follow the
+`npx --yes copilotkit@4.13.0 onboard read subagent/prove-oss-baseline` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the repository findings and exact CLI package spec.
@@ -17,7 +17,7 @@ Wait for the subagent to finish.
 Record what that proof returned before you route on it:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
+npx --yes copilotkit@4.13.0 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
 ```
 
 Report the gate whatever it returned. Pass `passed` when the subagent proved a predicate,
@@ -35,12 +35,12 @@ Do not change project files before this proof ends. Starting existing developmen
 processes and their ignored runtime files is allowed.
 
 If the subagent proves the `both-oss` predicate, keep its evidence with the plan and run
-`npx --yes copilotkit@4.12.0 onboard read conversion/plan`. That project already works.
+`npx --yes copilotkit@4.13.0 onboard read conversion/plan`. That project already works.
 What it needs is the conversion, not a build.
 
 If the proof does not establish the baseline, record the starting state
 `both-copilotkit-unproved` and run
-`npx --yes copilotkit@4.12.0 onboard read credentials/plan`. This prompt is served
+`npx --yes copilotkit@4.13.0 onboard read credentials/plan`. This prompt is served
 whenever a project looks like an OSS integration, so a baseline that did not prove is an
 ordinary starting state rather than a failure. Keep the failing predicate with the plan.
 
@@ -54,5 +54,5 @@ and the plan preserves it rather than repeating it.
 
 If it cannot identify the running process safely, exposes a secret, or finds a baseline
 failure that cannot be classified, run
-`npx --yes copilotkit@4.12.0 onboard read stopped/run-failed`. None of those mean the
+`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`. None of those mean the
 project is unsupported: they mean this run did not establish what it needed to.

package/onboarding/prompts/proof/round-trip.md

@@ -1,7 +1,7 @@
 # Prove the user journey
 
 Do not do the proof work yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.12.0 onboard read subagent/prove-round-trip` first and follow the
+`npx --yes copilotkit@4.13.0 onboard read subagent/prove-round-trip` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the selected framework, frontend, model, approved plan, selected
@@ -33,13 +33,13 @@ pass the time.
 Report each attempt at the journey as it ends, counting from one:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard checkpoint --phase journey-attempted --attempt 1
+npx --yes copilotkit@4.13.0 onboard checkpoint --phase journey-attempted --attempt 1
 ```
 
 Record what that proof returned before you route on it:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard proof --step round-trip --outcome <passed|failed|skipped>
+npx --yes copilotkit@4.13.0 onboard proof --step round-trip --outcome <passed|failed|skipped>
 ```
 
 Report the gate whatever it returned. A proof that never ran is `skipped`, not failed. The
@@ -47,7 +47,7 @@ command prints one line and sends nothing else. Where a repair cycle runs the pr
 record each attempt as it ends.
 
 For every protected-path audit in this prompt, run
-`npx --yes copilotkit@4.12.0 onboard audit` from the target app directory. If its result
+`npx --yes copilotkit@4.13.0 onboard audit` from the target app directory. If its result
 starts with `Status: blocked`, report the printed reason and use the route-out rules below.
 A blocked audit proved nothing changed and is not a preservation failure. If a
 protected-path audit reports a changed path, decide it the way the implementation prompt
@@ -56,7 +56,7 @@ returns none, so a finding with no Files changed section to test against routes
 path one of those sections names is this run's own change and routes out too. Accept a
 path only when a section this run collected covers the step that wrote it and does not
 name it:
-`npx --yes copilotkit@4.12.0 onboard protect --accept-external --path <path>`. Then run
+`npx --yes copilotkit@4.13.0 onboard protect --accept-external --path <path>`. Then run
 the audit again and name the path in the closing summary. Never repair, reset, or revert a
 protected path.
 
@@ -64,12 +64,12 @@ That holds for a repair cycle too. When the fix for a failing check lands on a p
 path, the path is still the developer's, however right the diagnosis is and however small
 the fix. Reading the file never settles who wrote it. Ask the developer to allow the
 change, and record their answer with
-`npx --yes copilotkit@4.12.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
+`npx --yes copilotkit@4.13.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
 or route out. Never repair it, and never send it to a repair worker.
 
 If the proof result starts with `Status: passed`, run the protected-path audit. Continue to
 `proof/complete` only if that audit passes. After the audit passes, run
-`npx --yes copilotkit@4.12.0 onboard read proof/complete`. A performed surface outcome with
+`npx --yes copilotkit@4.13.0 onboard read proof/complete`. A performed surface outcome with
 the full round trip is core success even if a continued-development tool fails. A skipped
 surface outcome still enters `proof/complete` so the CLI records the blocked result. Do not
 describe a skipped surface as proved. Keep the Skills and MCP results separate from the proof
@@ -97,6 +97,17 @@ times. Use the route-out rules below for a blocked or third failed result.
 Enter the code-repair branch only for a source, configuration, dependency, or tracked-file
 defect.
 
+The existing agent's behavior stays outside that branch. It is four things: the agent's
+system prompt and instructions, its tools and what those tools do, its model and provider
+configuration, and its memory or state handling. Repair a failing proof on the CopilotKit
+side first -- the frontend rendering, the tool schema, the runtime wiring. Where the only
+fix the repair worker can find is a change to the agent's instructions or tools, it stops
+and returns the failing predicate with the change it proposes. Report both to the
+developer and send that repair only after they approve it. An approved change is a
+behavior change and the closing report names it as one. Never call a change to the agent's
+instructions or tools a repair, and never send one to a repair worker without that
+approval. If you cannot ask, or the developer declines, use the route-out rules below.
+
 If the starter shortcut created the selected path, spawn one repair subagent. Give it the
 failed step, proof evidence, generated path list, selected framework, frontend, model, exact
 target app directory, documentation, and policy.
@@ -125,7 +136,7 @@ Restart each project-owned process changed by the repair. Report the cycle, coun
 one:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard checkpoint --phase repair-attempted --attempt 1
+npx --yes copilotkit@4.13.0 onboard checkpoint --phase repair-attempted --attempt 1
 ```
 
 Then spawn a fresh proof subagent
@@ -143,18 +154,18 @@ and proof cycles.
 
 Route out only when the failure is not yours to fix, when the same proof still fails after
 three attempts, or when no evidence of the round trip can be produced. In those cases run
-`npx --yes copilotkit@4.12.0 onboard read stopped/run-failed`. The stack is supported:
+`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`. The stack is supported:
 this run did not finish, which is a different ending and a different report. All three are
 about the round trip itself. A round trip that proved is not one of them, whatever failed
 after it.
 
 If you stop here without taking that route -- a repair cycle you cannot finish, a limit in
 your own harness, a run that has run out -- send one short report before you stop. Run the
-friction command without another developer question. Do not ask the developer about
-telemetry: the command applies the setting they already have.
+friction command without another developer question: it applies the telemetry setting the
+developer already set.
 
 ```text
-npx --yes copilotkit@4.12.0 onboard friction --phase stop --category <slug>
+npx --yes copilotkit@4.13.0 onboard friction --phase stop --category <slug>
 ```
 
 Write one or two sentences to standard input: the step you stopped at and what stopped it.

package/onboarding/prompts/research/gather.md

@@ -14,14 +14,12 @@ notification. Where your own harness hands you the report from the dispatch itse
 you already hold the result. Either way there is nothing to poll.
 
 After you dispatch, do the work that does not depend on the result -- dispatch the other
-subagent, run the preflight below -- and then stop and wait. Wherever a prompt in this graph
-says to wait for a subagent to finish, that is what it means.
+subagent, run the preflight the next prompt gives you -- and then stop and wait. Wherever a
+prompt in this graph says to wait for a subagent to finish, that is what it means.
 
 Do not sleep to pass the time. Not `sleep`, not `/bin/sleep`, not a timer under another
 name, and not a loop that re-checks whether a result has arrived. Sleeping tells you nothing
-that waiting for the result does not, and it spends wall clock, which is one of the things
-this journey is measured on. One recorded run spent most of two hours asleep between
-dispatches that had all returned in seconds.
+that waiting for the result does not, and it spends wall clock.
 
 ## When a subagent cannot work
 
@@ -36,7 +34,7 @@ Both research subagents failing means this harness has no working subagent at al
 is worth recording once:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard checkpoint --phase delegation-unavailable
+npx --yes copilotkit@4.13.0 onboard checkpoint --phase delegation-unavailable
 ```
 
 Then say once, in your own words, that this environment has no working subagents, so you
@@ -49,7 +47,7 @@ Before you ask the developer any setup question, finish every read-only investig
 preflight check in this section.
 
 Prepare two research assignments. Give each research subagent one assignment. Tell it to run
-`npx --yes copilotkit@4.12.0 onboard read subagent/inspect-repository` first and follow the
+`npx --yes copilotkit@4.13.0 onboard read subagent/inspect-repository` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Require only its assigned packet.
@@ -60,108 +58,20 @@ Start both research subagents in parallel:
 2. Spawn a second research subagent. Assign it the environment evidence packet.
 3. Start both research subagents. Then continue.
 
-Continue to the surface-control preflight.
-
-Prove whether your coding-agent environment has browser or device control. Do not assume it
-either way, and do not report what you expect to be true: a run that guesses here records a
-capability every later step then trusts. Use a browser or device tool already
-configured for the coding agent you are running as, the same way a later step uses the
-CopilotKit documentation server. With a browser tool, open one inert page such as
-`about:blank` and read its title. With a device tool and no browser, list the booted devices
-in one command: `adb devices -l`. Record the outcome of that attempt: `available` when the
-tool answered, `unavailable` when there was none to call or the page did not open. Use
-the control that matches the selected surface later.
-
-Where the browser probe answered, register nothing. The harness came equipped and the run
-owes it no setup.
-
-Where no browser tool answered, register one for the coding agent you are running as, then
-run the same probe again and record what the second attempt did. Register this server:
-
-```text
-npx --yes @playwright/mcp@latest --browser chrome --isolated --output-dir <project>/.copilotkit/proof/browser
-```
-
-Replace `<project>` with the absolute path of the target project directory. The server is
-registered against the coding agent rather than against a directory, so a relative path here
-resolves wherever that server happens to start.
-
-`--browser chrome` drives the Google Chrome the developer already has, so this downloads no
-browser. `--isolated` keeps the profile in memory, so it never touches their own Chrome
-profile. `--output-dir` is what keeps the snapshots and screenshots out of the developer's
-repository root: without it this server writes them to `.playwright-mcp/` beside their code,
-which a project that never asked for a browser has no reason to carry, and which this setup's
-own evidence rule already has a place for. Register it the way your own harness registers a
-server, which is the mechanism a later step uses for the CopilotKit documentation server.
-
-Tell the developer in one line what you registered, that it drives their installed Chrome,
-and that it lives in this coding agent's configuration rather than in their repository. Do
-not ask them to approve it, and do not ask a second question about it.
-
-Do not add a browser or device driver to the project. A driver added there is a
-devDependency and a browser download in the diff of a repository that never asked for one,
-which is a different thing from a server registered against the coding agent.
-
-Where the second probe still does not answer -- no Chrome to drive, no network, or a
-harness that cannot register a server -- record `unavailable` and carry it. Do not keep
-trying, and do not ask the developer about this tool limit.
-
-Registering a server does not boot a device. Where the device probe found none, that is the
-whole finding, and a browser is not a substitute for a device.
-
-Wait for both research subagents to finish.
-
-## Settle the port
-
-The findings name the ports this project declares and the ports already held on this
-machine. Pick one free port for the frontend now, and use that number for the rest of the
-run: in the plan, in the implementation, and in the proof. Record it with the findings you
-hand to every later subagent.
-
-Do not let a later step pick again. A run that decides the port three times produces three
-numbers, and `verify` reads none of them: with no recorded URL it assumes port 3000, and
-whatever holds that port answers. An unrelated checkout on this machine then reports as
-this project's proven wiring.
-
-Project selection is where the settled port is written down, through `--runtime-url`.
-
-Then report that the research came back:
+Report that both subagents started:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard checkpoint --phase research-returned
+npx --yes copilotkit@4.13.0 onboard checkpoint --phase research-dispatched
 ```
 
 A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
 failed step.
 
-Continue only if both research results start with `Status: passed`. For `Status: failed`,
-retry only that packet with its failed items, up to three attempts. For `Status: blocked`,
-or a third failed result, use the stop route at the end of this prompt.
+The research is under way. Continue to the surface-control preflight while it runs:
 
-Merge both evidence packets by item. On a conflict, spawn one fresh read-only verifier with
-the item, both cited findings, and the research limits. Require its result to start with
-`Status: passed`, `Status: failed`, or `Status: blocked`. Use only a passed cited result. Do
-not inspect the project to settle the conflict yourself. Use the stop route for a non-pass
-verifier result.
-
-A target project directory that holds no project has no app directory to key on, and
-that is a merged result rather than a failed merge. Record that this run has no target app
-directory and no environment row, then take the read below. Do not send a focused directory
-check, and do not use the stop route: neither worker can find a directory a developer has
-not created yet, and the route below is where such a project picks its starter.
-
-A directory holding only a Git repository, a coding agent's own configuration, editor
-settings or scratch notes holds no project. `onboard inspect` reports that as
-`appDiscovery.reason` of `no-project`.
-
-For a target project that does hold an app, match environment evidence to the target app
-directory from the project packet. Require one target app directory and one matching
-environment row. If either packet gives no match or more than one match, send each research
-worker a focused directory check. Continue only when both workers return the same one target
-app directory. Both results must start with `Status: passed`. Otherwise, use the stop route.
-
-When both research results are merged, run
-`npx --yes copilotkit@4.12.0 onboard read research/route`.
+```text
+npx --yes copilotkit@4.13.0 onboard read research/preflight
+```
 
 If inspection stops onboarding, run
-`npx --yes copilotkit@4.12.0 onboard read stopped/run-failed`.
+`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/merge.md

@@ -0,0 +1,60 @@
+# Merge the research and settle the port
+
+The surface is settled. This phase collects both research packets, picks the port the rest
+of the run uses, and merges the findings into one answer.
+
+Wait for both research subagents to finish.
+
+## Settle the port
+
+The findings name the ports this project declares and the ports already held on this
+machine. Pick one free port for the frontend now, and use that number for the rest of the
+run: in the plan, in the implementation, and in the proof. Record it with the findings you
+hand to every later subagent.
+
+Do not let a later step pick again. A run that decides the port three times produces three
+numbers, and `verify` reads none of them: with no recorded URL it assumes port 3000, and
+whatever holds that port answers.
+
+Project selection is where the settled port is written down, through `--runtime-url`.
+
+Then report that the research came back:
+
+```text
+npx --yes copilotkit@4.13.0 onboard checkpoint --phase research-returned
+```
+
+A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
+failed step.
+
+Continue only if both research results start with `Status: passed`. For `Status: failed`,
+retry only that packet with its failed items, up to three attempts. For `Status: blocked`,
+or a third failed result, use the stop route at the end of this prompt.
+
+Merge both evidence packets by item. On a conflict, spawn one fresh read-only verifier with
+the item, both cited findings, and the research limits. Require its result to start with
+`Status: passed`, `Status: failed`, or `Status: blocked`. Use only a passed cited result. Do
+not inspect the project to settle the conflict yourself. Use the stop route for a non-pass
+verifier result.
+
+A target project directory that holds no project has no app directory to key on, and
+that is a merged result rather than a failed merge. Record that this run has no target app
+directory and no environment row, then take the read below. Do not send a focused directory
+check, and do not use the stop route: neither worker can find a directory a developer has
+not created yet, and the route below is where such a project picks its starter.
+
+A directory holding only a Git repository, a coding agent's own configuration, editor
+settings or scratch notes holds no project. `onboard inspect` reports that as
+`appDiscovery.reason` of `no-project`.
+
+For a target project that does hold an app, match environment evidence to the target app
+directory from the project packet. Require one target app directory and one matching
+environment row. If either packet gives no match or more than one match, send each research
+worker a focused directory check. Continue only when both workers return the same one target
+app directory. Both results must start with `Status: passed`. Otherwise, use the stop route.
+
+When both research results are merged, run
+`npx --yes copilotkit@4.13.0 onboard read research/route`.
+
+If inspection stops onboarding, run
+`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/preflight.md

@@ -0,0 +1,75 @@
+# Prove what this environment can drive
+
+The research subagents are running. This phase settles what your coding agent can drive, so
+every later step reads one recorded answer instead of guessing. Do not change application
+code here, and do not wait for the research packets yet.
+
+Prove whether your coding-agent environment has browser or device control. Do not assume it
+either way, and do not report what you expect to be true. Use a browser or device tool already
+configured for the coding agent you are running as, the same way a later step uses the
+CopilotKit documentation server. With a browser tool, open one inert page such as
+`about:blank` and read its title. With a device tool and no browser, list the booted devices
+in one command: `adb devices -l`. Record the outcome of that attempt: `available` when the
+tool answered, `unavailable` when there was none to call or the page did not open. Use
+the control that matches the selected surface later.
+
+Where the browser probe answered, register nothing. The harness came equipped.
+
+Where no browser tool answered, register one for the coding agent you are running as, then
+run the same probe again and record what the second attempt did.
+
+Tell the developer in one line what you are about to register, that it lives in this coding
+agent's configuration rather than in their repository, and that they can remove it again.
+Say that before you run the command. The run does not ask again.
+
+Register this server:
+
+```text
+npx --yes @playwright/mcp@latest --browser chrome --isolated --output-dir <project>/.copilotkit/proof/browser
+```
+
+Replace `<project>` with the absolute path of the target project directory. The server is
+registered against the coding agent rather than against a directory, so a relative path here
+resolves wherever that server happens to start.
+
+`--browser chrome` drives an installed Google Chrome. Where this machine has none, use
+`--browser chromium` instead and expect Playwright to download a browser build. Tell the
+developer before that download starts. If the server then reports no build, run
+`npx playwright install chromium`, and if it still cannot find one, run
+`npx @playwright/mcp install-browser chrome-for-testing`. `--isolated` keeps the profile in
+memory, so it never touches their own Chrome profile. `--output-dir` keeps the snapshots and
+screenshots out of the developer's repository root: without it this server writes them to
+`.playwright-mcp/` beside their code, which a project that never asked for a browser has no
+reason to carry. Register it the way your own harness registers a server, which is the
+mechanism a later step uses for the CopilotKit documentation server.
+
+Some coding agents, Claude Code among them, load a newly registered MCP server only at the
+next session start. Tell the developer in one line to expect one restart, then restart and
+re-bind with `npx --yes copilotkit@4.13.0 onboard start --run <onboarding_run_id>`. That
+restart is a step here, not an error.
+
+Do not add a browser or device driver to the project. A driver added there is a
+devDependency and a browser download in the diff of a repository that never asked for one,
+which is a different thing from a server registered against the coding agent.
+
+Where the second probe still does not answer -- no browser to drive, no network, or a
+harness that cannot register a server -- record `unavailable` and carry it. Do not keep
+trying. Say so in one line. Nothing here is for the developer to decide.
+
+Registering a server does not boot a device. Where the device probe found none, that is the
+whole finding.
+
+Report that the probe settled, whichever way it came out:
+
+```text
+npx --yes copilotkit@4.13.0 onboard checkpoint --phase surface-probed
+```
+
+Then merge the research:
+
+```text
+npx --yes copilotkit@4.13.0 onboard read research/merge
+```
+
+If inspection stops onboarding, run
+`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/route.md

@@ -9,7 +9,7 @@ sends the run down one path.
 Before you route on, run this from the target app directory:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard protect
+npx --yes copilotkit@4.13.0 onboard protect
 ```
 
 It reads the working tree itself, records every changed or untracked path with a digest,
@@ -28,6 +28,30 @@ graph exists to create is never stopped by them.
 If the result starts with `Status: blocked`, report the printed reason and use the stop
 route at the end of this prompt.
 
+## Route a named Channel before the findings
+
+The prompt the developer copied names the docs page it came from. A Slack or Teams docs
+page names the surface this run is for. So does a developer who has already said Slack or
+Microsoft Teams. Either one settles the frontend.
+
+Record that docs page and give it to every later node and subagent. The copied prompt is
+the only carrier of the surface the developer wants, and no flag states it.
+
+On either, run this before you read the three findings below, and without asking the
+purpose question:
+
+```text
+npx --yes copilotkit@4.13.0 onboard read feature/channels/start
+```
+
+Name the provider to that node so it does not ask again. A Slack page names Slack. A Teams
+page names Teams.
+
+Take this route whatever the three findings prove. An agent, a frontend and a CopilotKit
+integration are a valid start for a Channel, not a reason to convert the application: the
+run keeps that code as it is and wires a managed Channel onto it. Do not send a Channel
+request to the conversion route.
+
 ## What the merged findings must contain
 
 If a repository file exists, each finding must cite it. For an empty project, the subagents
@@ -72,7 +96,7 @@ settle these three from your own reading of the project. Each one comes from the
 packets or it is not proved.
 
 If all three are proved, prove the live starting state before any project file changes. Run
-`npx --yes copilotkit@4.12.0 onboard read proof/oss-baseline`.
+`npx --yes copilotkit@4.13.0 onboard read proof/oss-baseline`.
 
 Route there before you ask the developer anything else. The questions after this prompt
 select a framework and a frontend that the findings already name, so a developer who
@@ -85,7 +109,7 @@ developer nor the repository findings prove what the project is for, ask one gui
 question about the user outcome. This asks what the developer wants to build before you
 select a framework. Give two or three short examples and offer a minimal starter. Record
 the answer and give it to each later subagent. Then run
-`npx --yes copilotkit@4.12.0 onboard read credentials/plan`.
+`npx --yes copilotkit@4.13.0 onboard read credentials/plan`.
 
 Do not ask that question on the route above. A project carrying all three states its
 purpose in the application it already serves.
@@ -97,5 +121,5 @@ A purpose question here names a domain before that choice.
 Take the same read named above without asking.
 
 If authentication or inspection stops onboarding, run
-`npx --yes copilotkit@4.12.0 onboard read stopped/run-failed`. Neither says anything
+`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`. Neither says anything
 about whether this project's stack is supported, which is not yet known at this point.

package/onboarding/prompts/starter/clone.md

@@ -46,7 +46,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --yes copilotkit@4.12.0 project list --json`
+`npx --yes copilotkit@4.13.0 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -56,7 +56,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument.
 
-`npx --yes copilotkit@4.12.0 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
+`npx --yes copilotkit@4.13.0 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
 
 Pass the confirmed name to both `--name` and `--create`: the app directory and its
 Intelligence project take the same name here. If the developer names an existing project,
@@ -72,7 +72,7 @@ account. The command does not need terminal input.
 Report the clone before you inspect anything:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard checkpoint --phase starter-cloned
+npx --yes copilotkit@4.13.0 onboard checkpoint --phase starter-cloned
 ```
 
 This is its own step, not an aside. A run that clones and then goes quiet is
@@ -82,10 +82,10 @@ separates them.
 Do not rebuild the starter by hand. Then inspect only the generated
 paths inside the target directory. Record the files, install result, project connection,
 and validation commands. Then run
-`npx --yes copilotkit@4.12.0 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.13.0 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --yes copilotkit@4.12.0 onboard read stopped/run-failed`. The starter is one this
+`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`. The starter is one this
 graph ships and the stack was chosen from its own supported list, so a command that
 returned an error is a run that broke, not a setup this release does not support.

package/onboarding/prompts/stopped/run-failed.md

@@ -35,7 +35,7 @@ put to them, stop here and send the report below.
 If they approve it, make that one fix and nothing else. Then come back into this run:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard resume
+npx --yes copilotkit@4.13.0 onboard resume
 ```
 
 Write the developer's approval to standard input, in one or two sentences: the fix they
@@ -58,7 +58,7 @@ Send one short report. Run the friction command without another developer questi
 ask the developer about telemetry: the command applies the setting they already have.
 
 ```text
-npx --yes copilotkit@4.12.0 onboard friction --phase stop --category <slug>
+npx --yes copilotkit@4.13.0 onboard friction --phase stop --category <slug>
 ```
 
 Write one or two sentences to standard input: the step you stopped at and what stopped

package/onboarding/prompts/subagent/create-plan.md

@@ -15,6 +15,23 @@ URLs you were given, not from another checkout on this machine.
 List the required credential variable names. Do not read or return credential values.
 Preserve each agent or frontend that already exists.
 
+## What the existing agent's behavior is
+
+The existing agent's behavior is four things: its system prompt and instructions, its
+tools and what those tools do, its model and provider configuration, and its memory or
+state handling.
+
+Wiring is not behavior. The CopilotKit SDK dependency, the middleware the agent is wrapped
+in, the runtime mount, the AG-UI connection, and a frontend that renders what the agent
+already returns are wiring. Plan them as ordinary steps.
+
+Every item on the behavior list is a change the developer has to approve. Where a step
+needs one, plan it as its own item, name the file and the exact change, and state that it
+changes how the agent answers everywhere, not only in CopilotKit. A system prompt the
+developer wrote is the agent's behavior rather than a setting this run tunes until a
+component renders. Where the plan cannot be written without such a change and you cannot
+state it that way, return `Status: blocked`.
+
 Plan the runtime to consume the Intelligence credential. The runtime takes an
 `intelligence` option holding a client built from the project key. A runtime given a
 `runner` option instead is the OSS runtime. It never reads the Intelligence key, and the
@@ -153,7 +170,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --yes copilotkit@4.12.0 verify --round-trip`, which needs no browser. Do not plan a
+`npx --yes copilotkit@4.13.0 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps

package/onboarding/prompts/subagent/implement-and-validate.md

@@ -13,6 +13,13 @@ Change only the files and directories the approved plan names as changeable. If
 requires a file the plan does not name, stop and return the blocker. Do not run a
 repository-wide formatter.
 
+All implementation work happens in the run root's own working tree: the target app
+directory the main coding agent named. Never work in a separate worktree, a branch
+checkout, or a copy of the project. If any of your changes are already somewhere else,
+bring them into the run root before you report, and name them under Files changed. The
+completion step verifies that the changed files exist in this project, so work left in
+another tree ends the run with nothing in the developer's hands.
+
 Before validation, read the protected path list. Inspect the current changed and untracked
 paths. Keep protected paths out of the run path set. Compare every changed path with the
 paths the plan named. Here, a changed path means one in the run path set. If a changed path
@@ -26,6 +33,12 @@ Add only the props, options, and imports that appear in the fetched documentatio
 remembered API from an earlier CopilotKit version will fail type checking against this
 release. Do not add details that the fetched documentation omits.
 
+A symbol the installed package marks `@deprecated` in its type definitions is not a valid
+choice, whatever documentation found elsewhere shows. Read the installed type definitions
+for the symbol you are about to write. Where the selected documentation page itself shows
+a deprecated symbol, name that page under Blockers as `docs-wrong` friction and use the
+current symbol the package's own type definitions or changelog names.
+
 The documentation supplies the wiring. The project supplies the application. Use that
 wiring in the project's domain. Do not copy an example's agent name, tools, or data.
 
@@ -34,6 +47,23 @@ connection. Do not read, show, store, or return secrets. Do not read a file outs
 project directory: not for a credential, and not for an API question the fetched
 documentation answers. Ask the main coding agent for a missing credential.
 
+## What the existing agent's behavior is
+
+The existing agent's behavior is four things: its system prompt and instructions, its
+tools and what those tools do, its model and provider configuration, and its memory or
+state handling. Write none of them unless the approved plan named that exact change as its
+own item.
+
+Wiring is not behavior. Add the CopilotKit SDK dependency, wrap the agent in the
+middleware, mount the runtime, connect AG-UI, and render what the agent already returns.
+Those are the parts this run adds.
+
+A change on the behavior list changes how the agent answers everywhere, not only in
+CopilotKit, so the developer approves it before it is written. Where a step cannot be
+built without one the plan did not name, return `Status: blocked` and name the file, the
+change, and the check that asked for it. Do not edit the agent's prompt to make a
+component render.
+
 An existing `README.md` is the developer's, not this run's. Leave it exactly as you found
 it: not the title, not a section, not a line. Where this run has documentation to write,
 write it to a new file and name that file when you report the result. On an empty project

package/onboarding/prompts/subagent/inspect-repository.md

@@ -7,7 +7,7 @@ Work only on the packet you were assigned. Inspect the repository without changi
 Run this first, from the target project directory:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard inspect --json
+npx --yes copilotkit@4.13.0 onboard inspect --json
 ```
 
 It answers the deterministic half of both packets exactly, from the same code