copilotkit 4.13.0 → 4.13.1

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -145,7 +145,7 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --yes copilotkit@4.13.0 verify --json`. It reads the port from this project, so a
+`npx --yes copilotkit@4.13.1 verify --json`. It reads the port from this project, so a
 non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
 `runtimeUrlSource` of `default` means nothing in the project named a port, so pass
 `--runtime-url` with the URL from step 1 in that case. Read the individual checks rather than
@@ -179,7 +179,7 @@ named no port the CLI can read: keep step 2's URL, and rewrite its host as `loca
 before you use it.
 
 Then run the command once more with the URL you are about to open:
-`npx --yes copilotkit@4.13.0 verify --frontend-url <that url> --json`. The
+`npx --yes copilotkit@4.13.1 verify --frontend-url <that url> --json`. The
 `frontend_assets_served` check asks that server for its page and for one of the page's own
 assets, on that exact host. A `fail` there means the dev server refuses its own static
 assets on the host you were about to use, and the check names the URL to use instead. This
@@ -187,7 +187,7 @@ is the cheapest step that can save the most expensive one, so run it before the
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --yes copilotkit@4.13.0 verify --round-trip --json`. It sends one request through
+Run `npx --yes copilotkit@4.13.1 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -200,7 +200,7 @@ Where this run settled a Learning Container, add the flag to the call above rath
 running a second round trip:
 
 ```text
-npx --yes copilotkit@4.13.0 verify --round-trip --expect-learning-container <container id> --json
+npx --yes copilotkit@4.13.1 verify --round-trip --expect-learning-container <container id> --json
 ```
 
 The check reads the thread that this run created, so a second round trip proves a second
@@ -234,7 +234,7 @@ the credential was written holds an empty key while the file beside it carries t
 one. Run this from the target app directory:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard env-staleness
+npx --yes copilotkit@4.13.1 onboard env-staleness
 ```
 
 A `stale` line names the env file and how long after launch it was written. Report that,
@@ -312,7 +312,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --yes copilotkit@4.13.0 verify --round-trip`, which reads the
+that thread with `npx --yes copilotkit@4.13.1 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. It either had
@@ -340,7 +340,7 @@ request never exercises. Drive it with the browser control step 6 named.
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --yes copilotkit@4.13.0 verify --frontend-url <the url you opened> --json`
+   `npx --yes copilotkit@4.13.1 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -30,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --yes copilotkit@4.13.0 onboard read fallback/best-effort`.
+`npx --yes copilotkit@4.13.1 onboard read fallback/best-effort`.
 
 Send one short report. Run the friction command without another developer question. Do not
 ask the developer about telemetry: the command applies the setting they already have.
 
 ```text
-npx --yes copilotkit@4.13.0 onboard friction --phase stop --category <slug>
+npx --yes copilotkit@4.13.1 onboard friction --phase stop --category <slug>
 ```
 
 Write one or two sentences to standard input: the step you stopped at and what stopped it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.13.0",
+  "version": "4.13.1",
   "type": "module",
   "engines": {
     "node": ">=20.9.0"

package/release/release-tool.js

@@ -14696,9 +14696,109 @@ import * as fs4 from "node:fs";
 import * as os2 from "node:os";
 import * as path4 from "node:path";
 
+// libs/feature-flags/src/registry.ts
+function defineFlags(defs) {
+  return Object.fromEntries(
+    Object.entries(defs).map(([key, body]) => [key, { ...body, key }])
+  );
+}
+var FLAG_DEFINITIONS = defineFlags({
+  // Ops can auto-deploy before App API, including in staging. Keep issuance
+  // off in every environment until all verifiers accept this signed claim.
+  "cli.organization-slug": {
+    purpose: "Include the Clerk organization slug in CLI product credentials after App API rollout.",
+    owner: "platform",
+    createdAt: "2026-09-17",
+    status: "rollout",
+    surfaces: ["ops-api"],
+    defaultByEnv: { dev: false, ci: false, prod: false },
+    envVar: "OPS_CLI_ORGANIZATION_SLUG_ENABLED"
+  },
+  // Self-hosted is a seam, not an offered choice yet (PE-94): the target moves
+  // only the app API URL, and no onboarding path offers it. Keep released
+  // binaries on managed until a self-hosted deployment can serve the product.
+  "cli.self-hosted-deployment": {
+    purpose: "Lets the CLI target a self-hosted Intelligence deployment through --deployment or COPILOTKIT_DEPLOYMENT.",
+    owner: "platform",
+    createdAt: "2026-09-22",
+    status: "rollout",
+    surfaces: ["cli"],
+    defaultByEnv: { dev: true, ci: true, prod: false }
+  },
+  "threads.bounded-replay": {
+    purpose: "Stage connect history on disk and require SDK acknowledgements for bounded delivery.",
+    owner: "realtime",
+    createdAt: "2026-09-16",
+    status: "rollout",
+    surfaces: ["realtime-gateway", "copilotkit-core"],
+    defaultByEnv: { dev: true, ci: true, prod: false },
+    envVar: "REALTIME_GATEWAY_BOUNDED_REPLAY_ENABLED"
+  },
+  // `active` (not `rollout`): a long-lived operational kill-switch, default-on
+  // in every env; `envVar` adopts the pre-existing INSPECT_ROUTES_ENABLED name.
+  "inspect.routes": {
+    purpose: "Gates the /api/_inspect/* introspection routes used by the web inspector; operational kill-switch.",
+    owner: "platform",
+    createdAt: "2026-06-23",
+    status: "active",
+    surfaces: ["app-api"],
+    defaultByEnv: { dev: true, ci: true, prod: true },
+    envVar: "INSPECT_ROUTES_ENABLED"
+  },
+  // Rollout flag for the in-progress Channels feature (OSS-373). Lets the
+  // SDK, UI, and infra land incrementally and deploy dark; production stays off
+  // until the rollout completes and the prod default is flipped in a later
+  // build. Server boundaries enforce it via the shared `resolveChannelsRollout`
+  // helper; `envVar` pins the pre-existing FF_MANAGED_BOTS toggle name so the
+  // operational override is byte-identical across the rename.
+  channels: {
+    purpose: "Gates the Channels feature (activation, listener, delivery, egress) so unfinished customer behavior stays dark until rollout completes.",
+    owner: "channels",
+    createdAt: "2026-06-25",
+    status: "rollout",
+    surfaces: ["app-api", "realtime-gateway", "app-frontend"],
+    defaultByEnv: { dev: true, ci: true, prod: false },
+    envVar: "FF_MANAGED_BOTS"
+  },
+  "managed-channels": {
+    purpose: "Canonical Managed Channels rollout gate, evaluated alongside the legacy FF_MANAGED_BOTS override while deployments migrate.",
+    owner: "channels",
+    createdAt: "2026-07-09",
+    status: "rollout",
+    surfaces: ["app-api", "realtime-gateway", "app-frontend"],
+    defaultByEnv: { dev: true, ci: true, prod: true }
+  },
+  "learning.platform-v1": {
+    purpose: "Gates the Learning V1 control API, runtime workers, product UI, and CLI download while the platform rolls out.",
+    owner: "learning",
+    createdAt: "2026-08-06",
+    status: "rollout",
+    surfaces: ["app-api", "app-frontend", "cli"],
+    defaultByEnv: { dev: false, ci: false, prod: false },
+    envVar: "LEARNING_ENABLED"
+  },
+  "analytics.pipeline": {
+    purpose: "Gates project-scoped analytics reads and realtime projection while the durable pipeline rolls out.",
+    owner: "analytics",
+    createdAt: "2026-08-16",
+    status: "rollout",
+    surfaces: ["app-api", "realtime-gateway"],
+    defaultByEnv: { dev: false, ci: false, prod: false },
+    envVar: "ANALYTICS_ENABLED"
+  },
+  "ops.stripe-billing-v1": {
+    purpose: "Gates the direct Stripe Checkout, Portal, projection, and provider-aware billing API during rollout.",
+    owner: "ops",
+    createdAt: "2026-09-08",
+    status: "rollout",
+    surfaces: ["ops-api"],
+    defaultByEnv: { dev: true, ci: true, prod: false }
+  }
+});
+
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "1e13b4945b44c6afa2e398a0c9935415d4aa7577" : "main";
+  return true ? "f8047217b909a3e18404034f31f47157c4312241" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts