copilotkit 4.16.0 → 4.18.0

package/onboarding/index.json

@@ -1,5 +1,5 @@
 {
-  "graphTree": "a8ea88ef874865c0c245c2ae4df6221a8667b569",
+  "graphTree": "07aa5486282bd324b41fecac4685d20b5ed11bfa",
   "intentRoots": {
     "add-a2ui": "feature/a2ui/start",
     "add-chat-suggestions": "feature/chat-suggestions/start",

package/onboarding/prompts/authenticate/start.md

@@ -15,7 +15,7 @@ does is hidden from the developer.
 Run each CLI call exactly as written, as its own command: no pipe, `tee`, `&&`, redirect,
 or variable prefix. If your harness asks the developer to approve commands, request
 escalation on the `onboard identify` call with the prefix rule
-`["npx", "--prefer-offline", "--yes", "copilotkit@4.16.0"]`. Every CLI call in this run
+`["npx", "--prefer-offline", "--yes", "copilotkit@4.18.0"]`. Every CLI call in this run
 matches it. Say then that the install, the dev servers, `curl` to the local app, and `ps`,
 `lsof`, and `kill` ask for approval later.
 
@@ -24,21 +24,23 @@ matches it. Say then that the install, the dev servers, `curl` to the local app,
 Run this before anything else in this prompt, including the welcome message below:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard identify --coding-agent <coding-agent-slug>
+npx --prefer-offline --yes copilotkit@4.18.0 onboard identify --coding-agent <coding-agent-slug> --model <model-id>
 ```
 
-Report your own product with one short slug, such as `codex` or `claude-code`.
+Report your own product with one short slug, such as `codex` or `claude-code`. For
+`--model`, give the exact model id your instructions name. If they name none, leave out
+`--model` rather than guess.
 
 ## How to run this onboarding
 
-Act only as the orchestrator. Rely on subagents for all project work.
+Act only as the orchestrator.
 Give every project task to a subagent.
 Do not inspect, change, implement, or validate the project yourself.
 Prompt names, internal route IDs, subagent names and storage field names are this graph's
 own bookkeeping. Say what the run is doing in the developer's words instead.
 
-Work from the target project directory. For an existing project, start at its inspection
-root.
+Work from the target project directory. When `onboard start` listed several projects, the
+one the developer chose is that directory.
 
 The command that began this run printed a line reading `onboarding_run_id:` followed by an
 id. Keep that id for the whole run. Every later command reports against it, and it is
@@ -47,10 +49,10 @@ printed once.
 Every later command must run from the directory this run started in. A command run
 somewhere else is refused, because the run it belongs to cannot be found from there. That
 refusal is a step, not a stop to report: run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard start --run <onboarding_run_id>` where you are
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard start --run <onboarding_run_id>` where you are
 standing, then run the refused command again.
 
-If you no longer hold the id, run `npx --prefer-offline --yes copilotkit@4.16.0 onboard start` in the
+If you no longer hold the id, run `npx --prefer-offline --yes copilotkit@4.18.0 onboard start` in the
 directory this run started in, with no `--run` and no `--intent`. It reprints the id of the
 run under way and starts nothing. An id this project does not already hold starts a second
 run, and the work already done stops counting toward the first.
@@ -113,11 +115,11 @@ record to the repository root by itself and prints where it put it.
 This run reports its own stops. If you stop this run at any point, send one short report
 before you stop. That covers a stop this prompt names, a stop a later prompt names, and a
 stop no prompt anticipated, including one your own harness causes. A turn that ends while
-the run waits is a pause, not a stop, even when your harness ends it. Run the friction
-command without another developer question.
+the run waits is a pause, not a stop, even when your harness ends it. A terminal that sends
+the report itself, or says to file none, overrides this.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.18.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.
@@ -127,13 +129,12 @@ sdk-gap, environment, port-collision, credential, validation-loop, and other. Le
 report that carries any of those, prints the reason, and exits zero. A refused report is
 not a failed step. Reword it and send it again, or stop without a report.
 
-Reporting a stop is not a route change. It does not resume the run, it is not a question
-for the developer, and it does not replace whatever the rule that stopped you says to do
-next: send the report, then stop.
+Reporting a stop is not a route change. It does not resume the run or replace what the
+rule that stopped you says next: send the report, then stop.
 
 ## Check sign-in
 
-Run `npx --prefer-offline --yes copilotkit@4.16.0 login --json` before any project work. This command
+Run `npx --prefer-offline --yes copilotkit@4.18.0 login --json` before any project work. This command
 checks the current session. It starts sign-in only as needed. Treat this as a long-lived
 streaming process. Do not wait for the command to exit before you read its standard output.
 
@@ -161,27 +162,27 @@ Read each JSON Lines record as the running command writes it:
    - Windows PowerShell: `Start-Process "<authentication_url>"`
      Pass the exact URL as one quoted argument, unchanged.
 4. If the matching opener is unavailable or exits with an error, show the clickable URL to
-   the developer and ask them to finish sign-in there. Show any `user_code` too. The page
-   works from any device. Do not retry the opener.
+   the developer and ask them to finish sign-in there. Do not retry the opener.
 5. Keep monitoring the original login process after the open attempt. Do not start a
    second login command. Do not treat the opener command finishing as sign-in finishing.
 6. Continue onboarding only after that same process emits `type: completed`.
 7. On `type: failed` with `reason: expired`, ask once whether to retry. If yes, start one
-   new `login --json`.
-8. If that process emits `type: failed`, report the error and stop onboarding.
+   new `login --json`. Use `--force` only when the developer asks.
+8. If that process emits `type: failed`, report the error and stop onboarding. On
+   `reason: repeated_expiry`, rerun `login` with `--force` only if the developer asks.
 
 If your harness ends the login process or your turn before the process emits
 `type: completed` or `type: failed`, that is a pause, not a failed sign-in. If the process
 still runs, end your turn and wait for the developer to say they signed in, then read the
-same process. If the process ended, run `login --json` again and handle a new
-`authentication_url` as above. Step 5 forbids a second login only while the first one runs.
+same process. If the process ended without emitting `type: failed`, run `login --json`
+again and handle a new `authentication_url` as above. Step 5 forbids a second login only while the first one runs.
 
 Do not use `whoami` for this check. Do not put account tokens or credentials in the
 conversation.
 
 When sign-in is settled, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read research/gather`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read research/gather`.
 
 If sign-in stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read stopped/run-failed`. It says nothing about
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read stopped/run-failed`. It says nothing about
 whether this project's stack is supported, which is not yet known at this point.

package/onboarding/prompts/conversion/plan.md

@@ -100,7 +100,7 @@ of this journey, and a drawer that lists nothing is not a reason to mint one. Li
 tokens stay a self-hosted concern.
 
 Where this journey's frontend framework ships no threads drawer -- React Native --, the
-fifth item is proved by `npx --prefer-offline --yes copilotkit@4.16.0 verify --round-trip`, which sends a
+fifth item is proved by `npx --prefer-offline --yes copilotkit@4.18.0 verify --round-trip`, which sends a
 real request and reads the answer back off the thread it landed on. The run says which of
 the two it proved. Do not send a run to the managed Intelligence dashboard to prove this.
 An authenticated browser session at a hosted dashboard is the one thing an agent-driven run
@@ -116,7 +116,7 @@ and passed -- so a run scored on either one was scored on the same fact. Every r
 resolves that condition from, while `licenseStatus` is a compatibility projection of it
 for older thread surfaces and outlives them only until those surfaces go.
 
-Then run `npx --prefer-offline --yes copilotkit@4.16.0 onboard read credentials/finalize-plan`.
+Then run `npx --prefer-offline --yes copilotkit@4.18.0 onboard read credentials/finalize-plan`.
 
 If a selected page does not load after the second method, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/credentials/finalize-plan.md

@@ -1,241 +1,98 @@
 # Select the Intelligence project
 
 Use the selected framework, frontend, model vendor, model, documentation URLs, and
-repository findings. On a conversion these were read from the baseline rather than
-selected, and the conversion prompt recorded them: use those values and ask no framework
-or frontend question here. Ask the developer only for choices that the repository does not
-show. Do not change application code in this phase. Do not read, show, store, or request
-a secret value.
-
-Use a gentle wizard. Ask one short question at a time. End your turn and wait for each
-answer. Do not combine separate choices in one question. Put the recommendation first,
-give its evidence in one sentence, and keep the alternatives short. When project selection
-is unknown, ask only which project to use. Keep final plan approval a separate, later
-question.
-
-## If you stop in this phase
-
-Several rules below stop onboarding: a refused classification value, a project selection
-that reports a false field, a failed credential check, a model credential nobody can
-place. Each one ends a run that reached project selection and never got a plan. Name the
-exact file, value, or check that stopped you: a report that names only the step cannot be
-acted on. Send one short report before you stop. Run the friction command without another
-developer question. Do not ask the developer about telemetry: the command applies the
-setting they already have.
+repository findings. On a conversion, use the values the conversion prompt recorded, and
+ask no framework or frontend question. Do not change application code in this phase. Do
+not read, show, store, or request a secret value.
 
-```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard friction --phase stop --category <slug> --message "<sentences>"
-```
-
-`--message` takes one or two sentences: the step you stopped at and what stopped it.
-Pick the category that fits from docs-missing, docs-wrong, docs-sequential, cli-gap,
-sdk-gap, environment, port-collision, credential, validation-loop, and other. Leave
---cost-seconds off. A run that stopped cannot separate one papercut's cost from the cost
-of the whole run, so the estimate is optional on a stop report and only there.
-Send no secrets, source code, logs, or command output. The command refuses a report that
-carries any of those, prints the reason, and exits zero. A refused report is not a failed
-step. Send the report, then stop the way the rule that stopped you says to. Reporting is
-not a route change and does not resume the run.
+Ask one short question at a time, and end your turn to wait for each answer. Do not
+combine separate choices in one question. Put the recommendation first, with its evidence
+in one sentence. Keep plan approval a separate, later question.
 
 ## Record the audit cell
 
-Use the repository findings and selected choices to record the path before project work
-starts. Choose one starting state: empty, agent-only, frontend-only, both,
-both-copilotkit-unproved, both-oss.
+Choose the starting state from the repository findings:
 
 - `empty`: no agent and no frontend.
 - `agent-only`: an agent and no frontend.
 - `frontend-only`: a frontend and no agent.
 - `both`: an agent and frontend with no CopilotKit integration.
-- `both-copilotkit-unproved`: an agent, a frontend and a CopilotKit integration whose
+- `both-copilotkit-unproved`: an agent, a frontend, and a CopilotKit integration whose
   round trip did not prove.
 - `both-oss`: an agent and frontend with the proved OSS CopilotKit baseline.
 
-The last two are the states of a project that has CopilotKit, and the baseline proof
-decides which one is true. A run served `proof/oss-baseline` records one of them. The
-first four say that an agent, a frontend, or the CopilotKit integration is absent, and
-the command refuses one of them from a run that was served that node.
-
-Run this command with the exact selected slugs:
+A run served `proof/oss-baseline` records one of the last two.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard classify --starting-state <starting-state> --agent-framework <agent-framework> --frontend <frontend>
+npx --prefer-offline --yes copilotkit@4.18.0 onboard classify --starting-state <starting-state> --agent-framework <agent-framework> --frontend <frontend>
 ```
 
-Do not continue if a value is refused. Fix the value from the choices that the earlier
-prompts gave, then run the command again.
-
-## Select the Intelligence project
-
-Use the target app or runtime directory from the repository findings. If a nested app owns
-the runtime `.env` file, do not default to the repository root.
-Set the environment path to `<target>/.env`.
+If a value is refused, fix it from the choices the earlier prompts gave, and run the
+command again.
 
-Every credential this run writes goes to the environment path. That covers the project
-key and the model credential. Do not write a credential to `.env.local`, or to any second
-env file beside it. A project ignore file usually covers `.env` and not
-`.env.local`, so a credential written there is untracked, visible, and added by the first
-`git add -A`. And a second env file beside `.env` outranks it when a key is read back, so
-the value the run depends on is the one it did not write.
+## Settle the project
 
-### Prove the environment path is ignored
-
-Do this before the first credential is written. Ask git whether it ignores the environment
-path, from the repository the path lives in:
+Run every command below from the target app or runtime directory. If a nested app owns the
+runtime `.env` file, that directory is the target, not the repository root. Do not send
+the developer to another terminal.
 
 ```text
-git check-ignore -q <environment path>
+npx --prefer-offline --yes copilotkit@4.18.0 onboard credentials --json
 ```
 
-Ask git rather than reading `.gitignore`. The answer also comes from a parent ignore file,
-a global excludes file, or a pattern the developer already has, and reading one file gets
-each of those wrong.
-
-Exit zero means git ignores the path and nothing more is needed. Exit one means git tracks
-the path, and the credential this run is about to write lands in the first commit. Add the
-missing pattern to the ignore file the developer already keeps, and list that edit in the
-plan with every other file change. Any other exit means there is no work tree here to
-protect. Say so once and carry on.
-
-If the path cannot be made ignored, stop onboarding and report it. Do not write the
-credential and leave the problem in the closing report. A developer who commits before
-reading the last screen has already published the token.
-
-If valid project fields and a non-empty `CPK_INTELLIGENCE_API_KEY` already exist, use this
-rule: Reuse that project without another question. Do not mint another key. The round-trip
-proof later runs the authenticated Intelligence checks. Record the reused project
-credentials as unverified in the plan until those checks pass.
-If you reuse a project, set the project-record path to the exact evidence path from the
-project research subagent.
-
-If the developer needs a project, do the work yourself from the target directory.
-Do not send the developer to another terminal.
-
-Project selection writes the environment path. It updates the nearest project record from
-the target through the repository root. If no project record exists there, it writes one at
-the repository root. If no repository exists, use the target. If the repository root is the
-home directory, use the target.
-
-Before project selection, derive the expected project-record path from the repository
-findings. Compare that path and the environment path with the paths the first capture
-printed as `protected`. Use the path-segment overlap rule. Ignore every path it printed as
-`deferred`. Those are the files project selection exists to write, so the environment path
-always overlaps one of them, and a run that stops on that overlap never reaches the step
-that provisions its key.
-
-If an output path overlaps a `protected` path, do not stop. Name the path, say what
-project selection writes there, list that file in the plan with every other change, and
-carry on. Nothing before project selection ends the run. It is the step that provisions
-this project's key, so a run that stops earlier leaves the developer with no key and no
-way to finish.
-
-### Create a project for this directory
-
-No project is bound to this directory, so creating a project for this directory is the
-default. Take the name from the directory that holds the expected project-record path.
-
-The CLI refuses a name that says nothing: a layer word from `project`, `app`, `apps`,
-`src`, `web`, `frontend`, `backend`, `server`, `packages`, `repo`, a scratch name such as
-`run-a`, `test-2`, or `tmp`, and anything under three characters. When the directory name
-is one of those, use the nearest enclosing directory whose name is not. Ask when no
-enclosing directory passes either: the parent of a scratch directory is usually another
-one, and a second derived guess collides with the first.
-
-Ask one question: confirm that name, give another, or ask to use a project they already
-have. Name that third answer, so a developer who has one is not asked to guess
-that it is available. Do not list the organization's projects as part of the question: a
-menu of projects is what bound one onboarding to another one's project, and a developer who
-wants theirs will say so. If they ask for an existing project, take the branch below.
-
-Do not combine this question with a frontend, framework, model, credential, or
-plan-approval question. If no developer answers, create with the derived name. Never select
-a project from a listing without an answer that names it. A project another run created
-minutes ago reads exactly like this directory's own, and every check after the selection
-passes against the wrong one.
-
-Create it, from the target directory, passing the port research settled:
+Every credential this run writes goes to the target's `.env`, the environment path. The
+one exception is a model credential whose framework node names another file. Never write a
+credential to `.env.local` or a second env file beside `.env`: an ignore file often misses
+it, and the app reads its value ahead of the one in `.env`.
 
-```text
-npx --prefer-offline --yes copilotkit@4.16.0 project select --create <name> \
-  --runtime-url http://localhost:<port>/api/copilotkit --json
-```
+Read `status`:
 
-`--runtime-url` is the only place the settled port is written down. Give the URL the
-application serves on, mount path included.
+- `ready`: go to the last section.
+- `needs-developer`: ask the question the next section describes.
+- `stopped`: the command already filed the stop report. Tell the developer
+  `stopReason.detail` in one sentence, then stop onboarding.
 
-If the command fails as a duplicate, the organization already holds that display name and
-the refusal names the colliding slug. Do not select the colliding project. Ask whether that
-project is this app's. If no developer answers, run the command again with the next free
-`-2`, `-3` suffix on the name.
+### Ask the question
 
-### Select an existing project instead
+`project-name` means that no project is bound here, so creating a project for this
+directory is the default. Ask one question: use `suggestedName`, give another name, or ask
+to use a project they already have. When there is no `suggestedName`, ask for a name. Do
+not list the organization's projects as part of the question. When `question.taken` is
+present, an existing project already has that name. Do not select the colliding project
+unless the developer says that it is this app's.
 
-Take this branch only when the developer asks for an existing project, or asks to see the
-projects they have. Read the choices:
+If no developer answers, create with the derived name in `suggestedName`. Never select a
+project from a listing without an answer that names it.
 
-```text
-npx --prefer-offline --yes copilotkit@4.16.0 project list --json
-```
-
-Narrow them:
+`--runtime-url` is the URL port research settled, mount path included:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 project list --search <query> --json
+npx --prefer-offline --yes copilotkit@4.18.0 onboard credentials --create <name> \
+  --runtime-url http://localhost:<port>/api/copilotkit --json
+npx --prefer-offline --yes copilotkit@4.18.0 onboard credentials --project <slug-or-id> \
+  --runtime-url http://localhost:<port>/api/copilotkit --json
 ```
 
-With `--json` the payload is the only thing on standard output, so it is safe to parse. Do
-not run either list command unless the developer asks. Show what they asked for and nothing
-more. Do not order the projects by creation time: the newest project in the organization is
-the one another run created while this one was working, and it is the least likely to be
-this directory's.
-
-Then record the project they name, from the target directory, with the same
-`--runtime-url`:
+When `question.notFound` is present, the organization has no project with that slug or
+id. Search for it and ask which project the developer meant. Do not run either list
+command unless the developer asks to see their projects, or `notFound` is present. Then
+show only what they asked for, and do not order it by creation time:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 project select --project <slug-or-id> \
-  --runtime-url http://localhost:<port>/api/copilotkit --json
+npx --prefer-offline --yes copilotkit@4.18.0 project list --json
+npx --prefer-offline --yes copilotkit@4.18.0 project list --search <query> --json
 ```
 
-The two flags cannot be combined. A slug that does not exist fails and lists the real ones,
-so a typo cannot record a selection that points at nothing.
-
-Read the JSON result. It reports `selected_project_slug`, `config_path`,
-`api_key_provisioned`, `project_file_written`, `environment_file_written`, and
-`environment_file` at the top level. The result does not contain a secret. Report
-`selected_project_slug` as the project slug that the server selected or created.
-Require `api_key_provisioned`, `project_file_written`, and `environment_file_written`
-to be true.
-
-A run that wrote the project record without a key exits 75 and reports `"type": "partial"`
-with a `retry_command`. That is the recoverable half: the record is kept, and the failure
-is usually transient. Run the `retry_command` once. If the retry also reports
-`api_key_provisioned` false, report the error and stop onboarding.
-A scaffold with no key looks finished and is not.
-
-After project selection, set the project-record path to the absolute `config_path` from the
-JSON result. If it differs from the expected project-record path, report both paths and stop
-onboarding.
-
-Never print the payload or any secret value.
-
-After project reuse or a warning-free selection result, send the environment
-research subagent a focused follow-up check. Give it the exact target app directory and both
-credential paths. Require it to report these facts without values:
-
-- The project-record path has non-empty `projectId` and `projectSlug` fields. Unless
-  `COPILOTKIT_DEPLOYMENT` is `self-hosted`, it also has a non-empty `clerkOrgId` field.
-- The environment path has a non-empty `CPK_INTELLIGENCE_API_KEY` entry.
-- If project selection ran, its selected slug matches `projectSlug`.
-- If project selection ran, the `.env` file was created or its modification time advanced.
+`app-directory` means that the key landed where no app reads it. Pick the directory in
+`question.apps` that runs the CopilotKit runtime. If the findings do not show it, ask. Run
+the `--project` command from there with `project.slug`. Do not copy or link the key file.
 
-Do not print either file or any secret value. If a check fails, stop onboarding. A project
-selection success message alone does not prove key readiness. The CLI cannot prove key scope
-before an authenticated Intelligence call succeeds.
+## Carry the result into the plan
 
-Continue only if the environment follow-up result starts with `Status: passed`. Retain the
-project-record path and environment path as the credential setup path list. Do not add them
-to the baseline yet.
+- `planChanges`: list each file in the plan. `"protected": true` marks an overlap with a
+  protected path. Name it in the plan. It does not end the run.
+- `project.slug` is the selected project. `"key": "unverified"` means the project was
+  reused. The round-trip proof later runs the authenticated Intelligence checks, so record
+  the reused project credentials as unverified in the plan until those checks pass.
 
-When project selection is settled, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read credentials/settle-credentials`.
+Then run `npx --prefer-offline --yes copilotkit@4.18.0 onboard read credentials/settle-credentials`.

package/onboarding/prompts/credentials/plan.md

@@ -20,7 +20,7 @@ If the target directory holds no project and the copied prompt came from the Sla
 Microsoft Teams docs page, do not ask the framework question. The Channel starter brings
 its own agent, so an answer here decides nothing. Tell the developer that the Channel
 starter decides the agent, then run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/plan`.
 
 Use a gentle wizard. Ask one short question at a time. Do not combine separate choices in
 one question. Put the recommendation first, give its evidence in one sentence, and keep
@@ -69,31 +69,32 @@ Python, Microsoft Agent Framework .NET, and Mastra. Explain which default matche
 developer's stated purpose. Show the other listed frameworks as options. Do not describe a
 documented default as a repository-based recommendation.
 
-Do not offer a framework that is not listed above. Do not port an existing agent to
-another framework. Do not show the internal route.
+Do not offer a framework that is not listed above. Do not port an existing agent to another
+framework. Route names are this graph's own bookkeeping. Say what the run is doing in the
+developer's words instead.
 
 Use exactly one matching internal route:
 
-1. AG2: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/ag2`
-2. Agno: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/agno`
-3. Built-in CopilotKit agent: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/built-in`
-4. Claude Agent SDK Python: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/claude-sdk-python`
-5. Claude Agent SDK TypeScript: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/claude-sdk-typescript`
-6. CrewAI Flows: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/crewai-flows`
-7. Deep Agents: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/deep-agents`
-8. LangGraph Python: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/langgraph-python`
-9. LangGraph FastAPI: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/langgraph-fastapi`
-10. LangGraph TypeScript: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/langgraph-typescript`
-11. LlamaIndex: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/llamaindex`
-12. ADK: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/google-adk`
-13. Microsoft Agent Framework Python: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/ms-agent-python`
-14. Microsoft Agent Framework .NET: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/ms-agent-dotnet`
-15. Mastra: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/mastra`
-16. MS Agent Harness .NET: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/ms-agent-harness-dotnet`
-17. Pydantic AI: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/pydantic-ai`
-18. Strands Agents Python: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/strands-python`
-19. Strands Agents TypeScript: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read framework/strands-typescript`
+1. AG2: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/ag2`
+2. Agno: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/agno`
+3. Built-in CopilotKit agent: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/built-in`
+4. Claude Agent SDK Python: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/claude-sdk-python`
+5. Claude Agent SDK TypeScript: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/claude-sdk-typescript`
+6. CrewAI Flows: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/crewai-flows`
+7. Deep Agents: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/deep-agents`
+8. LangGraph Python: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/langgraph-python`
+9. LangGraph FastAPI: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/langgraph-fastapi`
+10. LangGraph TypeScript: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/langgraph-typescript`
+11. LlamaIndex: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/llamaindex`
+12. ADK: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/google-adk`
+13. Microsoft Agent Framework Python: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/ms-agent-python`
+14. Microsoft Agent Framework .NET: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/ms-agent-dotnet`
+15. Mastra: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/mastra`
+16. MS Agent Harness .NET: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/ms-agent-harness-dotnet`
+17. Pydantic AI: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/pydantic-ai`
+18. Strands Agents Python: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/strands-python`
+19. Strands Agents TypeScript: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read framework/strands-typescript`
 
 If the project has an agent in another framework, or no listed framework fits, keep the
 developer's current agent and run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.