copilotkit 4.12.0 → 4.13.1

package/onboarding/prompts/starter/clone.md

@@ -46,7 +46,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --yes copilotkit@4.12.0 project list --json`
+`npx --yes copilotkit@4.13.1 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -56,7 +56,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument.
 
-`npx --yes copilotkit@4.12.0 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
+`npx --yes copilotkit@4.13.1 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
 
 Pass the confirmed name to both `--name` and `--create`: the app directory and its
 Intelligence project take the same name here. If the developer names an existing project,
@@ -72,7 +72,7 @@ account. The command does not need terminal input.
 Report the clone before you inspect anything:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard checkpoint --phase starter-cloned
+npx --yes copilotkit@4.13.1 onboard checkpoint --phase starter-cloned
 ```
 
 This is its own step, not an aside. A run that clones and then goes quiet is
@@ -82,10 +82,10 @@ separates them.
 Do not rebuild the starter by hand. Then inspect only the generated
 paths inside the target directory. Record the files, install result, project connection,
 and validation commands. Then run
-`npx --yes copilotkit@4.12.0 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.13.1 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --yes copilotkit@4.12.0 onboard read stopped/run-failed`. The starter is one this
+`npx --yes copilotkit@4.13.1 onboard read stopped/run-failed`. The starter is one this
 graph ships and the stack was chosen from its own supported list, so a command that
 returned an error is a run that broke, not a setup this release does not support.

package/onboarding/prompts/stopped/run-failed.md

@@ -35,7 +35,7 @@ put to them, stop here and send the report below.
 If they approve it, make that one fix and nothing else. Then come back into this run:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard resume
+npx --yes copilotkit@4.13.1 onboard resume
 ```
 
 Write the developer's approval to standard input, in one or two sentences: the fix they
@@ -58,7 +58,7 @@ Send one short report. Run the friction command without another developer questi
 ask the developer about telemetry: the command applies the setting they already have.
 
 ```text
-npx --yes copilotkit@4.12.0 onboard friction --phase stop --category <slug>
+npx --yes copilotkit@4.13.1 onboard friction --phase stop --category <slug>
 ```
 
 Write one or two sentences to standard input: the step you stopped at and what stopped

package/onboarding/prompts/subagent/create-plan.md

@@ -15,6 +15,23 @@ URLs you were given, not from another checkout on this machine.
 List the required credential variable names. Do not read or return credential values.
 Preserve each agent or frontend that already exists.
 
+## What the existing agent's behavior is
+
+The existing agent's behavior is four things: its system prompt and instructions, its
+tools and what those tools do, its model and provider configuration, and its memory or
+state handling.
+
+Wiring is not behavior. The CopilotKit SDK dependency, the middleware the agent is wrapped
+in, the runtime mount, the AG-UI connection, and a frontend that renders what the agent
+already returns are wiring. Plan them as ordinary steps.
+
+Every item on the behavior list is a change the developer has to approve. Where a step
+needs one, plan it as its own item, name the file and the exact change, and state that it
+changes how the agent answers everywhere, not only in CopilotKit. A system prompt the
+developer wrote is the agent's behavior rather than a setting this run tunes until a
+component renders. Where the plan cannot be written without such a change and you cannot
+state it that way, return `Status: blocked`.
+
 Plan the runtime to consume the Intelligence credential. The runtime takes an
 `intelligence` option holding a client built from the project key. A runtime given a
 `runner` option instead is the OSS runtime. It never reads the Intelligence key, and the
@@ -153,7 +170,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --yes copilotkit@4.12.0 verify --round-trip`, which needs no browser. Do not plan a
+`npx --yes copilotkit@4.13.1 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps

package/onboarding/prompts/subagent/implement-and-validate.md

@@ -13,6 +13,13 @@ Change only the files and directories the approved plan names as changeable. If
 requires a file the plan does not name, stop and return the blocker. Do not run a
 repository-wide formatter.
 
+All implementation work happens in the run root's own working tree: the target app
+directory the main coding agent named. Never work in a separate worktree, a branch
+checkout, or a copy of the project. If any of your changes are already somewhere else,
+bring them into the run root before you report, and name them under Files changed. The
+completion step verifies that the changed files exist in this project, so work left in
+another tree ends the run with nothing in the developer's hands.
+
 Before validation, read the protected path list. Inspect the current changed and untracked
 paths. Keep protected paths out of the run path set. Compare every changed path with the
 paths the plan named. Here, a changed path means one in the run path set. If a changed path
@@ -26,6 +33,19 @@ Add only the props, options, and imports that appear in the fetched documentatio
 remembered API from an earlier CopilotKit version will fail type checking against this
 release. Do not add details that the fetched documentation omits.
 
+A symbol the installed package marks `@deprecated` in its type definitions is not a valid
+choice, whatever documentation found elsewhere shows. Read the installed type definitions
+for the symbol you are about to write. Where the selected documentation page itself shows
+a deprecated symbol, name that page under Blockers as `docs-wrong` friction and use the
+current symbol the package's own type definitions or changelog names.
+
+A symbol this graph names is not that case. The approved plan and the framework
+node carry the connection API for this stack, and `LangGraphAgent` from
+`@copilotkit/runtime/langgraph` is one of them: deprecated at its entrypoint,
+still the documented LangSmith path, and given no replacement by its own tooltip.
+Write what the plan names. Do not rewrite a cloned starter to satisfy this rule,
+and do not name the page that shows it under Blockers.
+
 The documentation supplies the wiring. The project supplies the application. Use that
 wiring in the project's domain. Do not copy an example's agent name, tools, or data.
 
@@ -34,6 +54,23 @@ connection. Do not read, show, store, or return secrets. Do not read a file outs
 project directory: not for a credential, and not for an API question the fetched
 documentation answers. Ask the main coding agent for a missing credential.
 
+## What the existing agent's behavior is
+
+The existing agent's behavior is four things: its system prompt and instructions, its
+tools and what those tools do, its model and provider configuration, and its memory or
+state handling. Write none of them unless the approved plan named that exact change as its
+own item.
+
+Wiring is not behavior. Add the CopilotKit SDK dependency, wrap the agent in the
+middleware, mount the runtime, connect AG-UI, and render what the agent already returns.
+Those are the parts this run adds.
+
+A change on the behavior list changes how the agent answers everywhere, not only in
+CopilotKit, so the developer approves it before it is written. Where a step cannot be
+built without one the plan did not name, return `Status: blocked` and name the file, the
+change, and the check that asked for it. Do not edit the agent's prompt to make a
+component render.
+
 An existing `README.md` is the developer's, not this run's. Leave it exactly as you found
 it: not the title, not a section, not a line. Where this run has documentation to write,
 write it to a new file and name that file when you report the result. On an empty project

package/onboarding/prompts/subagent/inspect-repository.md

@@ -7,7 +7,7 @@ Work only on the packet you were assigned. Inspect the repository without changi
 Run this first, from the target project directory:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard inspect --json
+npx --yes copilotkit@4.13.1 onboard inspect --json
 ```
 
 It answers the deterministic half of both packets exactly, from the same code

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -19,7 +19,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --yes copilotkit@4.12.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --yes copilotkit@4.13.1 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -9,6 +9,16 @@ You can make only operational repairs to project-owned processes, ports, and req
 Do not write a path that overlaps a protected path. If a required proof or tool path
 overlaps one, return `Status: blocked` before writing it.
 
+The existing agent's behavior is outside every step of this proof. It is four things: the
+agent's system prompt and instructions, its tools and what those tools do, its model and
+provider configuration, and its memory or state handling. A failing predicate is repaired
+on the CopilotKit side -- the frontend rendering, the tool schema, the runtime wiring.
+Where the only fix you can find is a change to the agent's instructions or tools, stop and
+return the failing predicate with the change you propose, for the developer to approve.
+Such a change is a behavior change rather than a repair: it changes how the agent answers
+everywhere, not only in CopilotKit. Never rewrite the agent's prompt to make a component
+render, and never report a round trip proved by a prompt this run rewrote.
+
 Run the steps below in the order they appear. They are the proof. Do not design a
 different sequence of your own, and do not drop a step because an earlier one looked
 convincing. Step 6 has a web form and a React Native form: run the one that matches this
@@ -135,7 +145,7 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --yes copilotkit@4.12.0 verify --json`. It reads the port from this project, so a
+`npx --yes copilotkit@4.13.1 verify --json`. It reads the port from this project, so a
 non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
 `runtimeUrlSource` of `default` means nothing in the project named a port, so pass
 `--runtime-url` with the URL from step 1 in that case. Read the individual checks rather than
@@ -169,7 +179,7 @@ named no port the CLI can read: keep step 2's URL, and rewrite its host as `loca
 before you use it.
 
 Then run the command once more with the URL you are about to open:
-`npx --yes copilotkit@4.12.0 verify --frontend-url <that url> --json`. The
+`npx --yes copilotkit@4.13.1 verify --frontend-url <that url> --json`. The
 `frontend_assets_served` check asks that server for its page and for one of the page's own
 assets, on that exact host. A `fail` there means the dev server refuses its own static
 assets on the host you were about to use, and the check names the URL to use instead. This
@@ -177,7 +187,7 @@ is the cheapest step that can save the most expensive one, so run it before the
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --yes copilotkit@4.12.0 verify --round-trip --json`. It sends one request through
+Run `npx --yes copilotkit@4.13.1 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -190,7 +200,7 @@ Where this run settled a Learning Container, add the flag to the call above rath
 running a second round trip:
 
 ```text
-npx --yes copilotkit@4.12.0 verify --round-trip --expect-learning-container <container id> --json
+npx --yes copilotkit@4.13.1 verify --round-trip --expect-learning-container <container id> --json
 ```
 
 The check reads the thread that this run created, so a second round trip proves a second
@@ -224,7 +234,7 @@ the credential was written holds an empty key while the file beside it carries t
 one. Run this from the target app directory:
 
 ```text
-npx --yes copilotkit@4.12.0 onboard env-staleness
+npx --yes copilotkit@4.13.1 onboard env-staleness
 ```
 
 A `stale` line names the env file and how long after launch it was written. Report that,
@@ -302,7 +312,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --yes copilotkit@4.12.0 verify --round-trip`, which reads the
+that thread with `npx --yes copilotkit@4.13.1 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. It either had
@@ -330,7 +340,7 @@ request never exercises. Drive it with the browser control step 6 named.
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --yes copilotkit@4.12.0 verify --frontend-url <the url you opened> --json`
+   `npx --yes copilotkit@4.13.1 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -30,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --yes copilotkit@4.12.0 onboard read fallback/best-effort`.
+`npx --yes copilotkit@4.13.1 onboard read fallback/best-effort`.
 
 Send one short report. Run the friction command without another developer question. Do not
 ask the developer about telemetry: the command applies the setting they already have.
 
 ```text
-npx --yes copilotkit@4.12.0 onboard friction --phase stop --category <slug>
+npx --yes copilotkit@4.13.1 onboard friction --phase stop --category <slug>
 ```
 
 Write one or two sentences to standard input: the step you stopped at and what stopped it.

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "copilotkit",
-  "version": "4.12.0",
+  "version": "4.13.1",
   "type": "module",
+  "engines": {
+    "node": ">=20.9.0"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/CopilotKit/Intelligence.git",

package/release/release-tool.js

@@ -14696,9 +14696,109 @@ import * as fs4 from "node:fs";
 import * as os2 from "node:os";
 import * as path4 from "node:path";
 
+// libs/feature-flags/src/registry.ts
+function defineFlags(defs) {
+  return Object.fromEntries(
+    Object.entries(defs).map(([key, body]) => [key, { ...body, key }])
+  );
+}
+var FLAG_DEFINITIONS = defineFlags({
+  // Ops can auto-deploy before App API, including in staging. Keep issuance
+  // off in every environment until all verifiers accept this signed claim.
+  "cli.organization-slug": {
+    purpose: "Include the Clerk organization slug in CLI product credentials after App API rollout.",
+    owner: "platform",
+    createdAt: "2026-09-17",
+    status: "rollout",
+    surfaces: ["ops-api"],
+    defaultByEnv: { dev: false, ci: false, prod: false },
+    envVar: "OPS_CLI_ORGANIZATION_SLUG_ENABLED"
+  },
+  // Self-hosted is a seam, not an offered choice yet (PE-94): the target moves
+  // only the app API URL, and no onboarding path offers it. Keep released
+  // binaries on managed until a self-hosted deployment can serve the product.
+  "cli.self-hosted-deployment": {
+    purpose: "Lets the CLI target a self-hosted Intelligence deployment through --deployment or COPILOTKIT_DEPLOYMENT.",
+    owner: "platform",
+    createdAt: "2026-09-22",
+    status: "rollout",
+    surfaces: ["cli"],
+    defaultByEnv: { dev: true, ci: true, prod: false }
+  },
+  "threads.bounded-replay": {
+    purpose: "Stage connect history on disk and require SDK acknowledgements for bounded delivery.",
+    owner: "realtime",
+    createdAt: "2026-09-16",
+    status: "rollout",
+    surfaces: ["realtime-gateway", "copilotkit-core"],
+    defaultByEnv: { dev: true, ci: true, prod: false },
+    envVar: "REALTIME_GATEWAY_BOUNDED_REPLAY_ENABLED"
+  },
+  // `active` (not `rollout`): a long-lived operational kill-switch, default-on
+  // in every env; `envVar` adopts the pre-existing INSPECT_ROUTES_ENABLED name.
+  "inspect.routes": {
+    purpose: "Gates the /api/_inspect/* introspection routes used by the web inspector; operational kill-switch.",
+    owner: "platform",
+    createdAt: "2026-06-23",
+    status: "active",
+    surfaces: ["app-api"],
+    defaultByEnv: { dev: true, ci: true, prod: true },
+    envVar: "INSPECT_ROUTES_ENABLED"
+  },
+  // Rollout flag for the in-progress Channels feature (OSS-373). Lets the
+  // SDK, UI, and infra land incrementally and deploy dark; production stays off
+  // until the rollout completes and the prod default is flipped in a later
+  // build. Server boundaries enforce it via the shared `resolveChannelsRollout`
+  // helper; `envVar` pins the pre-existing FF_MANAGED_BOTS toggle name so the
+  // operational override is byte-identical across the rename.
+  channels: {
+    purpose: "Gates the Channels feature (activation, listener, delivery, egress) so unfinished customer behavior stays dark until rollout completes.",
+    owner: "channels",
+    createdAt: "2026-06-25",
+    status: "rollout",
+    surfaces: ["app-api", "realtime-gateway", "app-frontend"],
+    defaultByEnv: { dev: true, ci: true, prod: false },
+    envVar: "FF_MANAGED_BOTS"
+  },
+  "managed-channels": {
+    purpose: "Canonical Managed Channels rollout gate, evaluated alongside the legacy FF_MANAGED_BOTS override while deployments migrate.",
+    owner: "channels",
+    createdAt: "2026-07-09",
+    status: "rollout",
+    surfaces: ["app-api", "realtime-gateway", "app-frontend"],
+    defaultByEnv: { dev: true, ci: true, prod: true }
+  },
+  "learning.platform-v1": {
+    purpose: "Gates the Learning V1 control API, runtime workers, product UI, and CLI download while the platform rolls out.",
+    owner: "learning",
+    createdAt: "2026-08-06",
+    status: "rollout",
+    surfaces: ["app-api", "app-frontend", "cli"],
+    defaultByEnv: { dev: false, ci: false, prod: false },
+    envVar: "LEARNING_ENABLED"
+  },
+  "analytics.pipeline": {
+    purpose: "Gates project-scoped analytics reads and realtime projection while the durable pipeline rolls out.",
+    owner: "analytics",
+    createdAt: "2026-08-16",
+    status: "rollout",
+    surfaces: ["app-api", "realtime-gateway"],
+    defaultByEnv: { dev: false, ci: false, prod: false },
+    envVar: "ANALYTICS_ENABLED"
+  },
+  "ops.stripe-billing-v1": {
+    purpose: "Gates the direct Stripe Checkout, Portal, projection, and provider-aware billing API during rollout.",
+    owner: "ops",
+    createdAt: "2026-09-08",
+    status: "rollout",
+    surfaces: ["ops-api"],
+    defaultByEnv: { dev: true, ci: true, prod: false }
+  }
+});
+
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "0048ba241fdf14a9036cdad11a4f31aa021a9c8d" : "main";
+  return true ? "f8047217b909a3e18404034f31f47157c4312241" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts