copilotkit 4.13.0 → 4.14.0

package/onboarding/prompts/proof/oss-baseline.md

@@ -1,7 +1,7 @@
 # Prove the existing OSS baseline
 
 Do not prove the baseline yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.13.0 onboard read subagent/prove-oss-baseline` first and follow the
+`npx --yes copilotkit@4.14.0 onboard read subagent/prove-oss-baseline` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the repository findings and exact CLI package spec.
@@ -17,7 +17,7 @@ Wait for the subagent to finish.
 Record what that proof returned before you route on it:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
+npx --yes copilotkit@4.14.0 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
 ```
 
 Report the gate whatever it returned. Pass `passed` when the subagent proved a predicate,
@@ -35,12 +35,12 @@ Do not change project files before this proof ends. Starting existing developmen
 processes and their ignored runtime files is allowed.
 
 If the subagent proves the `both-oss` predicate, keep its evidence with the plan and run
-`npx --yes copilotkit@4.13.0 onboard read conversion/plan`. That project already works.
+`npx --yes copilotkit@4.14.0 onboard read conversion/plan`. That project already works.
 What it needs is the conversion, not a build.
 
 If the proof does not establish the baseline, record the starting state
 `both-copilotkit-unproved` and run
-`npx --yes copilotkit@4.13.0 onboard read credentials/plan`. This prompt is served
+`npx --yes copilotkit@4.14.0 onboard read credentials/plan`. This prompt is served
 whenever a project looks like an OSS integration, so a baseline that did not prove is an
 ordinary starting state rather than a failure. Keep the failing predicate with the plan.
 
@@ -54,5 +54,5 @@ and the plan preserves it rather than repeating it.
 
 If it cannot identify the running process safely, exposes a secret, or finds a baseline
 failure that cannot be classified, run
-`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`. None of those mean the
+`npx --yes copilotkit@4.14.0 onboard read stopped/run-failed`. None of those mean the
 project is unsupported: they mean this run did not establish what it needed to.

package/onboarding/prompts/proof/round-trip.md

@@ -1,7 +1,7 @@
 # Prove the user journey
 
 Do not do the proof work yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.13.0 onboard read subagent/prove-round-trip` first and follow the
+`npx --yes copilotkit@4.14.0 onboard read subagent/prove-round-trip` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the selected framework, frontend, model, approved plan, selected
@@ -14,7 +14,7 @@ drives the surface and cannot see your environment, so without that finding it s
 step discovering what you already know. A subagent told it has no control for the surface
 this frontend needs reports the skip outcome rather than looking for a way around it.
 
-A run that cloned a starter is the exception. Tell that subagent to stop after
+A run that cloned a starter is the exception. Tell that subagent to finish after
 `verify --round-trip` and to open no browser. The cloned code is what this repository's
 starter smoke jobs already drive on every change, so opening a browser re-proves in the
 developer's run what those jobs prove before the starter ships, and it is the most
@@ -33,13 +33,13 @@ pass the time.
 Report each attempt at the journey as it ends, counting from one:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard checkpoint --phase journey-attempted --attempt 1
+npx --yes copilotkit@4.14.0 onboard checkpoint --phase journey-attempted --attempt 1
 ```
 
 Record what that proof returned before you route on it:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard proof --step round-trip --outcome <passed|failed|skipped>
+npx --yes copilotkit@4.14.0 onboard proof --step round-trip --outcome <passed|failed|skipped>
 ```
 
 Report the gate whatever it returned. A proof that never ran is `skipped`, not failed. The
@@ -47,7 +47,7 @@ command prints one line and sends nothing else. Where a repair cycle runs the pr
 record each attempt as it ends.
 
 For every protected-path audit in this prompt, run
-`npx --yes copilotkit@4.13.0 onboard audit` from the target app directory. If its result
+`npx --yes copilotkit@4.14.0 onboard audit` from the target app directory. If its result
 starts with `Status: blocked`, report the printed reason and use the route-out rules below.
 A blocked audit proved nothing changed and is not a preservation failure. If a
 protected-path audit reports a changed path, decide it the way the implementation prompt
@@ -56,7 +56,7 @@ returns none, so a finding with no Files changed section to test against routes
 path one of those sections names is this run's own change and routes out too. Accept a
 path only when a section this run collected covers the step that wrote it and does not
 name it:
-`npx --yes copilotkit@4.13.0 onboard protect --accept-external --path <path>`. Then run
+`npx --yes copilotkit@4.14.0 onboard protect --accept-external --path <path>`. Then run
 the audit again and name the path in the closing summary. Never repair, reset, or revert a
 protected path.
 
@@ -64,12 +64,12 @@ That holds for a repair cycle too. When the fix for a failing check lands on a p
 path, the path is still the developer's, however right the diagnosis is and however small
 the fix. Reading the file never settles who wrote it. Ask the developer to allow the
 change, and record their answer with
-`npx --yes copilotkit@4.13.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
+`npx --yes copilotkit@4.14.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
 or route out. Never repair it, and never send it to a repair worker.
 
 If the proof result starts with `Status: passed`, run the protected-path audit. Continue to
 `proof/complete` only if that audit passes. After the audit passes, run
-`npx --yes copilotkit@4.13.0 onboard read proof/complete`. A performed surface outcome with
+`npx --yes copilotkit@4.14.0 onboard read proof/complete`. A performed surface outcome with
 the full round trip is core success even if a continued-development tool fails. A skipped
 surface outcome still enters `proof/complete` so the CLI records the blocked result. Do not
 describe a skipped surface as proved. Keep the Skills and MCP results separate from the proof
@@ -136,7 +136,7 @@ Restart each project-owned process changed by the repair. Report the cycle, coun
 one:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard checkpoint --phase repair-attempted --attempt 1
+npx --yes copilotkit@4.14.0 onboard checkpoint --phase repair-attempted --attempt 1
 ```
 
 Then spawn a fresh proof subagent
@@ -154,7 +154,7 @@ and proof cycles.
 
 Route out only when the failure is not yours to fix, when the same proof still fails after
 three attempts, or when no evidence of the round trip can be produced. In those cases run
-`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`. The stack is supported:
+`npx --yes copilotkit@4.14.0 onboard read stopped/run-failed`. The stack is supported:
 this run did not finish, which is a different ending and a different report. All three are
 about the round trip itself. A round trip that proved is not one of them, whatever failed
 after it.
@@ -165,7 +165,7 @@ friction command without another developer question: it applies the telemetry se
 developer already set.
 
 ```text
-npx --yes copilotkit@4.13.0 onboard friction --phase stop --category <slug>
+npx --yes copilotkit@4.14.0 onboard friction --phase stop --category <slug>
 ```
 
 Write one or two sentences to standard input: the step you stopped at and what stopped it.

package/onboarding/prompts/research/gather.md

@@ -14,13 +14,42 @@ notification. Where your own harness hands you the report from the dispatch itse
 you already hold the result. Either way there is nothing to poll.
 
 After you dispatch, do the work that does not depend on the result -- dispatch the other
-subagent, run the preflight the next prompt gives you -- and then stop and wait. Wherever a
-prompt in this graph says to wait for a subagent to finish, that is what it means.
+subagent, run the preflight the next prompt gives you -- and then end your turn and wait for
+the result. Wherever a prompt in this graph says to wait for a subagent to finish, that is
+what it means. It is a pause, as "Pausing vs stopping" below describes, and not a stop.
 
 Do not sleep to pass the time. Not `sleep`, not `/bin/sleep`, not a timer under another
 name, and not a loop that re-checks whether a result has arrived. Sleeping tells you nothing
 that waiting for the result does not, and it spends wall clock.
 
+## Pausing vs stopping
+
+This rule covers the whole run, here and in every later prompt.
+
+In this graph, stop means one thing: end the run through a named terminal. You send the
+stop report `authenticate/start` describes, then read the terminal that the rule names.
+Nothing else is a stop.
+
+A pause keeps the run open. "End your turn and wait for" something means: end this turn,
+and continue when that thing arrives. A pause waits for one of two things:
+
+1. A subagent result. The section above says how to wait for one.
+2. The developer. Ask the question, then end your turn and wait for the reply. The reply
+   is the answer. A developer who replies without choosing, such as "go ahead" or "you
+   pick", gives no answer, and the default that the prompt states applies. Where the
+   prompt states no default, ask once more.
+
+Before you end your turn to wait for the developer where the prompt states no default,
+report the pause:
+
+```text
+npx --yes copilotkit@4.14.0 onboard checkpoint --phase awaiting-developer
+```
+
+When the answer or the result arrives, continue from the step that paused. Do not read an
+earlier prompt again, send the welcome again, or start a new run: the run id you hold still
+names this run. A pause is not a stop. It sends no stop report and takes no stop route.
+
 ## When a subagent cannot work
 
 This rule also covers every subagent this run spawns, here and in every later prompt.
@@ -34,7 +63,7 @@ Both research subagents failing means this harness has no working subagent at al
 is worth recording once:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard checkpoint --phase delegation-unavailable
+npx --yes copilotkit@4.14.0 onboard checkpoint --phase delegation-unavailable
 ```
 
 Then say once, in your own words, that this environment has no working subagents, so you
@@ -47,7 +76,7 @@ Before you ask the developer any setup question, finish every read-only investig
 preflight check in this section.
 
 Prepare two research assignments. Give each research subagent one assignment. Tell it to run
-`npx --yes copilotkit@4.13.0 onboard read subagent/inspect-repository` first and follow the
+`npx --yes copilotkit@4.14.0 onboard read subagent/inspect-repository` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Require only its assigned packet.
@@ -61,7 +90,7 @@ Start both research subagents in parallel:
 Report that both subagents started:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard checkpoint --phase research-dispatched
+npx --yes copilotkit@4.14.0 onboard checkpoint --phase research-dispatched
 ```
 
 A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
@@ -70,8 +99,8 @@ failed step.
 The research is under way. Continue to the surface-control preflight while it runs:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard read research/preflight
+npx --yes copilotkit@4.14.0 onboard read research/preflight
 ```
 
 If inspection stops onboarding, run
-`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`.
+`npx --yes copilotkit@4.14.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/merge.md

@@ -21,7 +21,7 @@ Project selection is where the settled port is written down, through `--runtime-
 Then report that the research came back:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard checkpoint --phase research-returned
+npx --yes copilotkit@4.14.0 onboard checkpoint --phase research-returned
 ```
 
 A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
@@ -54,7 +54,7 @@ worker a focused directory check. Continue only when both workers return the sam
 app directory. Both results must start with `Status: passed`. Otherwise, use the stop route.
 
 When both research results are merged, run
-`npx --yes copilotkit@4.13.0 onboard read research/route`.
+`npx --yes copilotkit@4.14.0 onboard read research/route`.
 
 If inspection stops onboarding, run
-`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`.
+`npx --yes copilotkit@4.14.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/preflight.md

@@ -45,7 +45,7 @@ mechanism a later step uses for the CopilotKit documentation server.
 
 Some coding agents, Claude Code among them, load a newly registered MCP server only at the
 next session start. Tell the developer in one line to expect one restart, then restart and
-re-bind with `npx --yes copilotkit@4.13.0 onboard start --run <onboarding_run_id>`. That
+re-bind with `npx --yes copilotkit@4.14.0 onboard start --run <onboarding_run_id>`. That
 restart is a step here, not an error.
 
 Do not add a browser or device driver to the project. A driver added there is a
@@ -62,14 +62,14 @@ whole finding.
 Report that the probe settled, whichever way it came out:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard checkpoint --phase surface-probed
+npx --yes copilotkit@4.14.0 onboard checkpoint --phase surface-probed
 ```
 
 Then merge the research:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard read research/merge
+npx --yes copilotkit@4.14.0 onboard read research/merge
 ```
 
 If inspection stops onboarding, run
-`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`.
+`npx --yes copilotkit@4.14.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/route.md

@@ -9,7 +9,7 @@ sends the run down one path.
 Before you route on, run this from the target app directory:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard protect
+npx --yes copilotkit@4.14.0 onboard protect
 ```
 
 It reads the working tree itself, records every changed or untracked path with a digest,
@@ -41,7 +41,7 @@ On either, run this before you read the three findings below, and without asking
 purpose question:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard read feature/channels/start
+npx --yes copilotkit@4.14.0 onboard read feature/channels/start
 ```
 
 Name the provider to that node so it does not ask again. A Slack page names Slack. A Teams
@@ -96,7 +96,7 @@ settle these three from your own reading of the project. Each one comes from the
 packets or it is not proved.
 
 If all three are proved, prove the live starting state before any project file changes. Run
-`npx --yes copilotkit@4.13.0 onboard read proof/oss-baseline`.
+`npx --yes copilotkit@4.14.0 onboard read proof/oss-baseline`.
 
 Route there before you ask the developer anything else. The questions after this prompt
 select a framework and a frontend that the findings already name, so a developer who
@@ -107,19 +107,21 @@ these three findings.
 For every other combination of the three, take one more step first. If neither the
 developer nor the repository findings prove what the project is for, ask one guided
 question about the user outcome. This asks what the developer wants to build before you
-select a framework. Give two or three short examples and offer a minimal starter. Record
-the answer and give it to each later subagent. Then run
-`npx --yes copilotkit@4.13.0 onboard read credentials/plan`.
+select a framework. Give two or three short examples. Record the answer and give it to
+each later subagent. Then run
+`npx --yes copilotkit@4.14.0 onboard read credentials/plan`.
 
 Do not ask that question on the route above. A project carrying all three states its
 purpose in the application it already serves.
 
 Do not ask it when the target directory holds no project either.
-The frontend they pick next decides the starter.
+The frontend they pick next decides whether a starter exists.
+Next.js and Angular have starters for some agent frameworks.
+React SPA, Vue 3 and React Native have no starter, so the project is built from their documentation.
 Slack and Microsoft Teams are choices at that step.
 A purpose question here names a domain before that choice.
 Take the same read named above without asking.
 
 If authentication or inspection stops onboarding, run
-`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`. Neither says anything
+`npx --yes copilotkit@4.14.0 onboard read stopped/run-failed`. Neither says anything
 about whether this project's stack is supported, which is not yet known at this point.

package/onboarding/prompts/starter/clone.md

@@ -7,25 +7,31 @@ A directory that holds only a Git repository, a coding agent's own configuration
 settings or scratch notes still qualifies. Those are not a project, and `git init` is the
 marker this CLI anchors a run on, so it cannot also be the thing that disqualifies one.
 
+The home folder and system folders never qualify. Neither does a directory with no Git
+repository of its own whose folders, one or two levels down, hold a Git repository or a
+dependency manifest: those folders are the developer's projects. `init` refuses all
+three. If the target is one of them, stop the shortcut and ask the developer which
+project to use, or to open the coding agent in a new empty folder.
+
 Match the selected agent framework and frontend to this table:
 
-| Agent framework                  | Frontend | Framework ID                       |
-| -------------------------------- | -------- | ---------------------------------- |
-| Agno                             | Next.js  | `agno`                             |
-| Claude Agent SDK Python          | Next.js  | `claude-sdk-python`                |
-| Claude Agent SDK TypeScript      | Next.js  | `claude-sdk-typescript`            |
-| CrewAI Flows                     | Next.js  | `flows`                            |
-| LangGraph Python                 | Next.js  | `langgraph-py`                     |
-| LangGraph TypeScript             | Next.js  | `langgraph-js`                     |
-| LlamaIndex                       | Next.js  | `llamaindex`                       |
-| ADK                              | Next.js  | `adk`                              |
-| ADK                              | Angular  | `adk-angular`                      |
-| Microsoft Agent Framework Python | Next.js  | `microsoft-agent-framework-py`     |
-| Microsoft Agent Framework .NET   | Next.js  | `microsoft-agent-framework-dotnet` |
-| Mastra                           | Next.js  | `mastra`                           |
-| Pydantic AI                      | Next.js  | `pydantic-ai`                      |
-| Strands Agents Python            | Next.js  | `aws-strands-py`                   |
-| Strands Agents TypeScript        | Next.js  | `aws-strands-ts`                   |
+| Agent framework                  | Frontend | Framework ID                       | Model key                                 |
+| -------------------------------- | -------- | ---------------------------------- | ----------------------------------------- |
+| Agno                             | Next.js  | `agno`                             | `OPENAI_API_KEY`                          |
+| Claude Agent SDK Python          | Next.js  | `claude-sdk-python`                | `ANTHROPIC_API_KEY`                       |
+| Claude Agent SDK TypeScript      | Next.js  | `claude-sdk-typescript`            | `ANTHROPIC_API_KEY`                       |
+| CrewAI Flows                     | Next.js  | `flows`                            | `OPENAI_API_KEY`                          |
+| LangGraph Python                 | Next.js  | `langgraph-py`                     | `OPENAI_API_KEY`                          |
+| LangGraph TypeScript             | Next.js  | `langgraph-js`                     | `OPENAI_API_KEY`                          |
+| LlamaIndex                       | Next.js  | `llamaindex`                       | `OPENAI_API_KEY`                          |
+| ADK                              | Next.js  | `adk`                              | `GOOGLE_API_KEY`                          |
+| ADK                              | Angular  | `adk-angular`                      | `GOOGLE_API_KEY`                          |
+| Microsoft Agent Framework Python | Next.js  | `microsoft-agent-framework-py`     | `OPENAI_API_KEY` in `agent/.env`          |
+| Microsoft Agent Framework .NET   | Next.js  | `microsoft-agent-framework-dotnet` | `OPENAI_API_KEY` in `dotnet user-secrets` |
+| Mastra                           | Next.js  | `mastra`                           | `OPENAI_API_KEY`                          |
+| Pydantic AI                      | Next.js  | `pydantic-ai`                      | `OPENAI_API_KEY`                          |
+| Strands Agents Python            | Next.js  | `aws-strands-py`                   | `OPENAI_API_KEY`                          |
+| Strands Agents TypeScript        | Next.js  | `aws-strands-ts`                   | `OPENAI_API_KEY`                          |
 
 Each Framework ID selects a starter that the CLI ships with Intelligence. Do not infer a
 different pair from a similar name. AG2 does not use this shortcut because its starter does
@@ -46,24 +52,44 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --yes copilotkit@4.13.0 project list --json`
+`npx --yes copilotkit@4.14.0 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
 store a secret value.
 
+## Ask where the model credential lives
+
+The starter reads a model credential, and the `init` command below does not ask for one.
+Ask for it now, while the developer is still here, and not after the clone. The variable
+is the Model key column of the row you matched. Do not guess it from the framework name.
+
+Ask the developer one question: which file holds that key, or whether they will add it
+themselves after the clone. Asking where a credential lives is not requesting a secret
+value. Never ask for the value itself. If no answer comes, clone anyway. The step after
+the clone pauses for the key.
+
+A path the developer names is theirs to give, including one outside the project. A path
+this run finds is not. Never read a key file the developer did not name. A key found that
+way bills a project nobody chose.
+
+## Clone the starter
+
 Run the command from the parent directory. Do not inspect another entry in the parent
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument.
 
-`npx --yes copilotkit@4.13.0 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
+`npx --yes copilotkit@4.14.0 init --name <directory-name> --framework <framework-id> --channel none --no-banner --no-key-prompt --create <name> --install`
 
-Pass the confirmed name to both `--name` and `--create`: the app directory and its
-Intelligence project take the same name here. If the developer names an existing project,
+`--name` is always the target directory name derived above, because `init` creates the
+app at `<parent>/<name>`. Any other value puts the app in a new folder beside the target,
+outside the directory this run is bound to. Pass the confirmed project name to `--create`
+only. If the developer names an existing project,
 use `--project <slug-or-id>` instead of `--create <name>`. If the developer asked to skip
 the dependency install, use
 `--no-install` instead of `--install`. Do not wait for an interactive prompt. Pass every
-answer as a flag.
+answer as a flag. `--no-key-prompt` stops `init` from asking for a model key. The `init`
+output still names each missing key as `Set <VARIABLE> in .env`.
 
 The command clones the starter into the empty target directory. It also connects the
 starter to the developer's Intelligence project. The earlier login phase supplies the
@@ -72,7 +98,7 @@ account. The command does not need terminal input.
 Report the clone before you inspect anything:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard checkpoint --phase starter-cloned
+npx --yes copilotkit@4.14.0 onboard checkpoint --phase starter-cloned
 ```
 
 This is its own step, not an aside. A run that clones and then goes quiet is
@@ -81,11 +107,56 @@ separates them.
 
 Do not rebuild the starter by hand. Then inspect only the generated
 paths inside the target directory. Record the files, install result, project connection,
-and validation commands. Then run
-`npx --yes copilotkit@4.13.0 onboard read proof/round-trip`.
+and validation commands.
+
+## Settle the model credential
+
+The `init` output names each missing credential as `Set <VARIABLE> in .env`. For each
+one, check the starter's own `.env` without reading the value:
+
+```text
+grep -c '^<VARIABLE>=.' <target>/.env
+```
+
+`1` means the variable holds a value. `0` means it is empty or absent. The command prints
+a count and never the value.
+
+If the developer named a key file, copy that one variable from it into `<target>/.env`,
+in place of the empty line. Do not print either file, and do not print the value. Then
+run the check again.
+
+If a variable is still empty, ask the developer to add it to `<target>/.env` themselves.
+
+The two Microsoft Agent Framework starters keep their key outside `<target>/.env`, so
+`init` prints no `Set` line for them. Settle the key from the Model key column instead:
+
+- For the Python starter, run the same check for `OPENAI_API_KEY` against
+  `<target>/agent/.env`. A missing file counts as `0`. If the developer named a key file,
+  copy the variable into `<target>/agent/.env` the same way. If it is still empty, ask the
+  developer to add it there themselves.
+- For the .NET starter, the key lives in `dotnet user-secrets`, and no check can read it
+  without printing the value. Ask the developer to run
+  `cd <target>/agent && dotnet user-secrets set OPENAI_API_KEY "<key>"` themselves, even
+  if they named a key file.
+
+Then report the pause and end your turn:
+
+```text
+npx --yes copilotkit@4.14.0 onboard checkpoint --phase awaiting-developer
+```
+
+This is a pause, not a stop. Do not send a stop report, and do not take a stop route.
+When the developer says the credential is in place, run the check again, and continue
+when every variable holds a value. For the .NET starter, continue on the developer's word. Do not write a placeholder or an empty value to get
+past this step. A starter with a dummy key looks finished and fails at the first model
+call.
+
+If no credential is missing, report no pause and continue.
+
+Then run `npx --yes copilotkit@4.14.0 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --yes copilotkit@4.13.0 onboard read stopped/run-failed`. The starter is one this
+`npx --yes copilotkit@4.14.0 onboard read stopped/run-failed`. The starter is one this
 graph ships and the stack was chosen from its own supported list, so a command that
 returned an error is a run that broke, not a setup this release does not support.

package/onboarding/prompts/stopped/run-failed.md

@@ -35,7 +35,7 @@ put to them, stop here and send the report below.
 If they approve it, make that one fix and nothing else. Then come back into this run:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard resume
+npx --yes copilotkit@4.14.0 onboard resume
 ```
 
 Write the developer's approval to standard input, in one or two sentences: the fix they
@@ -58,7 +58,7 @@ Send one short report. Run the friction command without another developer questi
 ask the developer about telemetry: the command applies the setting they already have.
 
 ```text
-npx --yes copilotkit@4.13.0 onboard friction --phase stop --category <slug>
+npx --yes copilotkit@4.14.0 onboard friction --phase stop --category <slug>
 ```
 
 Write one or two sentences to standard input: the step you stopped at and what stopped

package/onboarding/prompts/subagent/create-plan.md

@@ -119,8 +119,8 @@ different spelling, and it breaks again as soon as CopilotKit moves to `0.0.60`.
 
 Plan the upgrade as its own step before the Intelligence runtime wiring, and plan to
 re-run the recorded baseline checks immediately after it. Name the revert: restore the
-manifest and lockfile to their recorded state and stop, rather than wiring Intelligence
-onto a baseline the upgrade broke.
+manifest and lockfile to their recorded state and report the break, rather than wiring
+Intelligence onto a baseline the upgrade broke.
 
 Where the SDK requires an application-level value that the repository cannot supply, such
 as an end-user identity for threads, use one clearly marked local placeholder and name what
@@ -170,7 +170,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --yes copilotkit@4.13.0 verify --round-trip`, which needs no browser. Do not plan a
+`npx --yes copilotkit@4.14.0 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps
@@ -223,5 +223,5 @@ command rather than running them one at a time. Split a command only when its re
 what you run next.
 
 Start with `Status: passed`, `Status: failed`, or `Status: blocked`.
-Return the plan, the URLs that you read, and each documentation gap. Stop after you return
+Return the plan, the URLs that you read, and each documentation gap. End your turn after you return
 the findings to the main coding agent.

package/onboarding/prompts/subagent/implement-and-validate.md

@@ -10,7 +10,7 @@ either path is an ancestor directory on a path-segment boundary. `apps/a` overla
 `apps/a/src`, but not `apps/ab`. `app.ts` does not overlap `app.tsx`.
 
 Change only the files and directories the approved plan names as changeable. If the work
-requires a file the plan does not name, stop and return the blocker. Do not run a
+requires a file the plan does not name, return the blocker and end your turn. Do not run a
 repository-wide formatter.
 
 All implementation work happens in the run root's own working tree: the target app
@@ -39,6 +39,13 @@ for the symbol you are about to write. Where the selected documentation page its
 a deprecated symbol, name that page under Blockers as `docs-wrong` friction and use the
 current symbol the package's own type definitions or changelog names.
 
+A symbol this graph names is not that case. The approved plan and the framework
+node carry the connection API for this stack, and `LangGraphAgent` from
+`@copilotkit/runtime/langgraph` is one of them: deprecated at its entrypoint,
+still the documented LangSmith path, and given no replacement by its own tooltip.
+Write what the plan names. Do not rewrite a cloned starter to satisfy this rule,
+and do not name the page that shows it under Blockers.
+
 The documentation supplies the wiring. The project supplies the application. Use that
 wiring in the project's domain. Do not copy an example's agent name, tools, or data.
 
@@ -47,6 +54,17 @@ connection. Do not read, show, store, or return secrets. Do not read a file outs
 project directory: not for a credential, and not for an API question the fetched
 documentation answers. Ask the main coding agent for a missing credential.
 
+Before running a scaffolder, check whether it writes an environment file. Never replace
+an existing `.env` with `.env.example` or scaffolder output. Preserve its existing bytes,
+including the provisioned Intelligence key. Do not use shell redirection or a force flag
+to bypass this rule.
+
+If the scaffolder cannot preserve a protected file, generate into a temporary directory
+inside the project only when the approved plan permits it. Copy only approved paths that
+do not overlap a protected path. Otherwise, return the conflict and end your turn before
+running the scaffolder. Ask the main coding agent to revise credential setup when a
+required variable is missing. Do not provision another key to repair a scaffold overwrite.
+
 ## What the existing agent's behavior is
 
 The existing agent's behavior is four things: its system prompt and instructions, its
@@ -105,8 +123,8 @@ it fails in the threads drawer rather than at the install.
 
 If one of them resolves to more than one version, restore the manifest and lockfile to
 their recorded state, leave Intelligence unwired, and report which package resolved to more
-than one version, which versions, and which declared range held the top of the tree. Stop.
-Do not wire Intelligence onto a tree carrying two copies of a package.
+than one version, which versions, and which declared range held the top of the tree. Then
+end your turn. Do not wire Intelligence onto a tree carrying two copies of a package.
 
 Never add an `overrides`, `resolutions`, or `pnpm.overrides` block to collapse the two
 copies. It forces a version the developer did not approve onto their whole tree, and it
@@ -114,8 +132,9 @@ turns a reportable mismatch between two published packages into a local workarou
 else can see.
 
 If the baseline regresses, restore the manifest and lockfile to their recorded state, leave
-Intelligence unwired, and report the regression with the failing check. Stop. Where the plan
-names no dependency change, report that the installed versions met the floor.
+Intelligence unwired, and report the regression with the failing check. Then end your
+turn. Where the plan names no dependency change, report that the installed versions met
+the floor.
 
 When the documentation uses the framework's scaffolder,
 run that scaffolder rather than hand-authoring what it emits.
@@ -158,4 +177,5 @@ command rather than running them one at a time. Split a command only when its re
 what you run next.
 
 Start with `Status: passed`, `Status: failed`, or `Status: blocked`.
-Return exactly four sections: Status, Files changed, Validation, and Blockers. Stop.
+Return exactly four sections: Status, Files changed, Validation, and Blockers. Then end
+your turn.

package/onboarding/prompts/subagent/inspect-repository.md

@@ -7,7 +7,7 @@ Work only on the packet you were assigned. Inspect the repository without changi
 Run this first, from the target project directory:
 
 ```text
-npx --yes copilotkit@4.13.0 onboard inspect --json
+npx --yes copilotkit@4.14.0 onboard inspect --json
 ```
 
 It answers the deterministic half of both packets exactly, from the same code
@@ -87,4 +87,4 @@ Use only `proved`, `absent`, or `unproved` for the status. State each absent or
 Do not read, print, or return secret values. For `.env` and `.copilotkit/project.json`
 checks, return only paths, presence checks, and missing field names. Do not read a file
 outside the project directory. Do not run or return an onboarding command other than
-`onboard inspect`. Stop after returning the findings to the main coding agent.
+`onboard inspect`. End your turn after returning the findings to the main coding agent.

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -19,7 +19,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --yes copilotkit@4.13.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --yes copilotkit@4.14.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected
@@ -45,4 +45,4 @@ can be durable. Report the persistence that project evidence proves, or `unprove
 replace it and do not describe all OSS runs as ephemeral.
 
 Start with `Status: passed`, `Status: failed`, or `Status: blocked`.
-Stop after returning the baseline result, process ids and ports used, and evidence paths.
+End your turn after returning the baseline result, process ids and ports used, and evidence paths.