copilotkit 4.16.0 → 4.18.0

package/onboarding/prompts/framework/mastra.md

@@ -47,7 +47,7 @@ Record the selected framework, vendor, model, required credential variable names
 these URLs.
 
 If the pages support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/ms-agent-dotnet.md

@@ -36,7 +36,7 @@ Record the selected framework, provider, model, required credential variable nam
 these URLs.
 
 If the pages support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/ms-agent-harness-dotnet.md

@@ -44,7 +44,7 @@ Record the selected framework, provider, model, required credential variable nam
 URLs, and the quickstart gap.
 
 If the pages support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/ms-agent-python.md

@@ -4,10 +4,10 @@ Preserve an existing Microsoft Agent Framework model setup. Start with OpenAI fo
 agent. Offer another vendor only after an exact CopilotKit Markdown page names it. The
 page must name its credential variables and setup steps.
 
-Name the model credential `OPENAI_API_KEY`, in `agent/.env`. This framework also accepts
-Azure OpenAI, through `AZURE_OPENAI_ENDPOINT` and `AZURE_OPENAI_CHAT_DEPLOYMENT_NAME`.
-Pick one of the two and name it. A scaffold that writes one spelling and reads the other
-looks finished and reads no key.
+Name the model credential `OPENAI_API_KEY`, in `agent/.env`, for a new agent. This
+framework also accepts Azure OpenAI, through `AZURE_OPENAI_ENDPOINT` and
+`AZURE_OPENAI_CHAT_DEPLOYMENT_NAME`. Keep Azure OpenAI only when the project already uses
+it. A scaffold that writes one spelling and reads the other looks finished and reads no key.
 
 This framework reads no `.env` on its own. Whatever loads the file is application code,
 so a scaffold that writes `agent/.env` and never loads it starts with no credential.
@@ -30,7 +30,7 @@ Record the selected framework, vendor, model, required credential variable names
 these URLs.
 
 If the pages support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/pydantic-ai.md

@@ -43,7 +43,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the two-step context route.
 
 If the pages support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/strands-python.md

@@ -20,8 +20,8 @@ A2UI tool makes its own OpenAI call, so it bills a second model call this plan d
 account for.
 
 No Strands agent-app-context Markdown page is available. Do not invent an
-agent-app-context setup. If the requested work needs that missing setup, run the
-unsupported route below.
+agent-app-context setup. If the requested work passes project data to the agent, run the unsupported
+route below. Otherwise, record the gap and continue.
 
 Connect the Copilot Runtime with `HttpAgent` from `@ag-ui/client`.
 
@@ -29,7 +29,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the context documentation gap.
 
 If the pages support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/strands-typescript.md

@@ -18,8 +18,8 @@ these pages. Install `@modelcontextprotocol/sdk` as a runtime dependency.
 `@strands-agents/sdk` loads it even when the application does not use MCP.
 
 No Strands TypeScript agent-app-context Markdown page is available. Do not translate
-another language's backend example or invent that setup. If the requested work needs it,
-run the unsupported route below.
+another language's backend example or invent that setup. If the requested work passes project data
+to the agent, run the unsupported route below. Otherwise, record the gap and continue.
 
 A2UI is not on this path. If the developer asks for it, say first that its page has no
 Strands TypeScript backend example, so a TypeScript project has nothing to follow.
@@ -30,7 +30,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the context documentation gap.
 
 If the pages support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/angular.md

@@ -5,7 +5,7 @@ Preserve an existing Angular frontend. Use the selected page for a new frontend.
 Use the starter shortcut only if all these facts are true: the target directory holds no
 project, its name is a valid `init` project name, and the selected framework is ADK.
 If all three facts are true, record Angular as the selected frontend. Then run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read starter/clone` before you fetch documentation.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read starter/clone` before you fetch documentation.
 
 ## Documentation
 
@@ -63,7 +63,7 @@ you create or build an Angular project. If the installed version is lower, selec
 supported version first and use it for every later command in this project.
 
 If the pages support the selection, record Angular and these URLs. Then run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read credentials/finalize-plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, or the two version lines do not fit
-together, run `npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+together, run `npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/nextjs.md

@@ -15,7 +15,7 @@ These TypeScript options have starters: Claude Agent SDK TypeScript, LangGraph T
 Mastra, and Strands Agents TypeScript. The .NET option is Microsoft Agent Framework .NET.
 
 If all shortcut conditions are true, record Next.js as the selected frontend. Then run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read starter/clone` before you fetch documentation.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read starter/clone` before you fetch documentation.
 
 ## Documentation
 
@@ -26,8 +26,21 @@ agent framework documentation instead. This page configures the CopilotKit built
 agent as the default agent, which is correct only for a project that has no agent.
 Do not replace the developer's existing agent with the built-in agent.
 
+## Files that `next dev` writes
+
+If a coding agent starts `next dev` on Next.js 16.3 or later, Next.js writes `AGENTS.md`
+and `CLAUDE.md` in the app directory. If one of the files exists, Next.js adds its own
+block to that file. These files are Next.js output. They are not your work and not the
+developer's work.
+
+- For a new frontend that you create, pass `--no-agents-md` to `create-next-app`. If
+  the installed Next.js is 16.3 or later, also set `agentRules: false` in
+  `next.config.ts`.
+- For an existing frontend, do not change `next.config.ts` for this.
+- Do not claim, revert, or delete these files. Name them in the report as Next.js output.
+
 If the page supports the selection, record Next.js and this URL. Then run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read credentials/finalize-plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/plan.md

@@ -28,7 +28,8 @@ needs a frontend, show the valid choices and one recommendation based on reposit
 evidence, then ask the developer to choose.
 
 The valid choices are React SPA, Next.js, Angular, Vue 3, React Native, Slack, and
-Microsoft Teams. They are valid in every starting state. Do not show the internal route.
+Microsoft Teams. They are valid in every starting state. Route names are this graph's own
+bookkeeping. Say what the run is doing in the developer's words instead.
 
 Recommend the frontend the project already uses. Where there is no existing frontend,
 include Slack and Microsoft Teams in the frontend question. They are chat UIs, not
@@ -36,15 +37,15 @@ CopilotKit web apps. Then recommend the one the developer names, and say what ea
 
 Use exactly one matching internal route:
 
-1. React SPA: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/react-spa`
-2. Next.js: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/nextjs`
-3. Angular: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/angular`
-4. Vue 3: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/vue`
-5. React Native: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read frontend/react-native`
-6. Slack or Microsoft Teams: `npx --prefer-offline --yes copilotkit@4.16.0 onboard read feature/channels/start`
+1. React SPA: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/react-spa`
+2. Next.js: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/nextjs`
+3. Angular: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/angular`
+4. Vue 3: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/vue`
+5. React Native: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read frontend/react-native`
+6. Slack or Microsoft Teams: `npx --prefer-offline --yes copilotkit@4.18.0 onboard read feature/channels/start`
 
 If they chose Slack or Microsoft Teams, tell that node which one they chose so it
 does not ask again.
 
 If no listed frontend fits, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-native.md

@@ -18,7 +18,7 @@ documents `useRenderTool`, which is React Native's own hook for drawing a tool t
 already has. That is a different job and needs a tool in the agent.
 
 If the pages support the selection, record React Native and these URLs. Then run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read credentials/finalize-plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-spa.md

@@ -14,7 +14,7 @@ not move the agent into it.
 - https://docs.copilotkit.ai/react-spa.md
 
 If the page supports the selection, record React SPA and this URL. Then run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read credentials/finalize-plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/vue.md

@@ -19,7 +19,7 @@ page above. Vue has its own `useComponent`, which is not the React package. Take
 that reference page rather than from a Vue generative-UI guide, which is not published.
 
 If the pages support the selection, record Vue 3 and these URLs. Then run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read credentials/finalize-plan`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/implementation/build-and-validate.md

@@ -4,15 +4,15 @@ Do not implement the plan yourself. Use the step order in the approved plan.
 
 ## If you stop in this phase
 
-One rule below stops onboarding: a Learning Container create that fails for a reason other
-than the container already existing. It ends a run the developer has already approved a
-plan for. Name the exact command, id, and error code that stopped you: a report that names
-only the step cannot be acted on. Send one short report before you stop. Run the friction
-command without another developer question. Do not ask the developer about telemetry: the
-command applies the setting they already have.
+Two rules below stop onboarding: a Learning Container create that fails for a reason other
+than the container already existing, and a `--accept-credential` refusal that names a lost
+variable. Each one ends a run the developer has already approved a plan for. Name the exact
+command, id, and error code that stopped you: a report that names only the step cannot be
+acted on. Send one short report before you stop. The friction command follows the telemetry
+setting the developer already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.18.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.
@@ -36,6 +36,19 @@ plan said, what you did instead, and why. Carry that record into the closing sum
 which has an item for it. Do not stop for a departure that is the right call, and do not
 leave it unrecorded either.
 
+The implementation subagent marks its own departures in its Files changed section: a file
+that has the same role as a planned file at a different path, and the documentation file
+it writes. Carry each one into that record.
+
+Any other file the plan does not name comes back as a result that starts with
+`Status: blocked` and names the file under Blockers. That result is a question for the
+developer, not a run that broke. Where that file is a protected path, the protected-path
+rules in the audit section below apply instead. Otherwise, pause: name the file and why the
+work needs it, then end your turn and wait for the developer's answer. If they allow it,
+spawn a fresh implementation subagent with the same handoff. Add that file to the handoff
+as a path the developer approved, and record it as a departure. If you cannot ask, or the
+developer declines, the failure ending in the route-out rules below applies.
+
 The existing agent's behavior is never a departure to record and carry on from. It is four
 things: its system prompt and instructions, its tools and what those tools do, its model
 and provider configuration, and its memory or state handling. Repair a failing check on
@@ -54,13 +67,24 @@ Approving the plan is the developer agreeing to every path it listed under
 app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard protect --authorize --path <path> --reason "<the plan's sentence>"
+npx --prefer-offline --yes copilotkit@4.18.0 onboard protect --authorize --path <path> --reason "<the plan's sentence>"
 ```
 
 Consent has to be on the record before the file moves, so a call made after the change is
 refused. Continue only if every result starts with `Status: passed`. If the plan listed
 nothing there, skip this section.
 
+The implementation subagent cannot change a protected path unless it has the authorized
+list. Take that list from the CLI rather than from the plan: run `onboard audit` after the
+last authorization, and copy the paths under `Authorized to modify:`. An audit that passes
+or fails prints that block whenever an authorization exists, so a passed or failed audit
+with no such block means nothing is authorized. A blocked audit prints no block at all:
+if this audit starts with `Status: blocked`, the CLI cannot supply the list, so report the
+printed reason and use the route-out rules below. A failed audit here is the one exception
+to the rule that an audit that has not passed never continues the run: read only its
+`Authorized to modify:` block now, and decide its findings with the audit rules below,
+after implementation.
+
 What you record here covers changing the file. It does not cover removing it. Never delete,
 move, or rename a protected path, whatever the plan says: the audit fails a path that is
 gone even when consent was recorded for it, and no command clears that. If a step cannot
@@ -71,7 +95,7 @@ No implementation step has run yet, so the change is theirs rather than this run
 consent over it by adding one flag:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard protect --authorize --path <path> --reason "<the plan's sentence>" --with-prior-change
+npx --prefer-offline --yes copilotkit@4.18.0 onboard protect --authorize --path <path> --reason "<the plan's sentence>" --with-prior-change
 ```
 
 The flag records their change as drift beside the consent, so the closing report names both
@@ -81,16 +105,17 @@ the route-out rules apply.
 
 This section is the only place the plan's own authorizations are recorded. Once this run
 reports its plan, the CLI refuses `--authorize` for every path the plan did not name. The
-developer approved a plan, not a permission to reach further, so there is no consent to
-record for a path that comes up later. If you find such a path mid-run, use the route below
-rather than this section.
+developer approved a plan, not a permission to reach further, so there is no plan consent
+to record for a path that comes up later. If you find such a path mid-run, ask the
+developer and record their answer with `--authorize --unplanned`, as the protected-path
+audit below describes, rather than use this section.
 
 ## Protected-path audit
 
 Run the audit from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard audit
+npx --prefer-offline --yes copilotkit@4.18.0 onboard audit
 ```
 
 It compares every protected path with the digest the CLI captured for it. Its result starts
@@ -125,14 +150,14 @@ A path that no Files changed section names changed outside the run, and it is th
 developer's own file. Accept it by name:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard protect --accept-external --path <path>
+npx --prefer-offline --yes copilotkit@4.18.0 onboard protect --accept-external --path <path>
 ```
 
 A changed env file is its own case. This run asked the developer to place a credential
 there, so it takes the credential route rather than this one:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard protect --accept-credential --path <path>
+npx --prefer-offline --yes copilotkit@4.18.0 onboard protect --accept-credential --path <path>
 ```
 
 That route proves no recorded credential was lost, instead of taking the run's word that it
@@ -151,19 +176,25 @@ neither does a one-line fix. Never repair, reset, or revert it. Ask the develope
 the change, and record the answer they give:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"
+npx --prefer-offline --yes copilotkit@4.18.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"
 ```
 
 Use it only for an answer a developer actually gave. It records the consent as taken
 outside the approved plan, and every later audit and the closing report say so, which is
 what tells the developer they were asked mid-run. If you cannot ask, route out.
 
+Then run the audit again, take the authorized list from its `Authorized to modify:` block,
+and spawn a fresh implementation subagent with the same handoff and that list. If that
+audit starts with `Status: blocked`, use the route-out rules instead. A subagent
+that already returned cannot pick up consent recorded after it was spawned.
+
 `Status: blocked` means the audit has no baseline to read. A blocked audit compared
 nothing and proved nothing changed. It is not a preservation failure: do not report a
 protected path as changed. Report the printed reason and use the route-out rules.
 
-An audit that has not passed never continues the run by itself. Continue only after an
-acceptance clears it, or route out. Do not send an audit result to a repair worker.
+An audit that has not passed never continues the run by itself. The failed audit before
+implementation that supplies the authorized list is the one exception. Continue only after
+an acceptance clears it, or route out. Do not send an audit result to a repair worker.
 
 ## Create the approved Learning Container
 
@@ -172,7 +203,7 @@ create it now, from the target app directory. The developer approved the id befo
 made, so this is the first point at which it can be created:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 learning containers create --id <id> --name <name> --json
+npx --prefer-offline --yes copilotkit@4.18.0 learning containers create --id <id> --name <name> --json
 ```
 
 Pass the id the plan names. Take the name from the selected project's own display name, so
@@ -188,26 +219,29 @@ hold.
 Then report that the container is settled, before any edit:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard checkpoint --phase container-settled
+npx --prefer-offline --yes copilotkit@4.18.0 onboard checkpoint --phase container-settled
 ```
 
 Where the plan names a container the platform already held, report the same checkpoint and
 create nothing. Where the plan names no container, skip this section.
 
+## Implement the plan
+
 Report the plan this run is about to implement:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard checkpoint --phase plan-written
+npx --prefer-offline --yes copilotkit@4.18.0 onboard checkpoint --phase plan-written
 ```
 
 Spawn one implementation subagent. Tell it to run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read subagent/implement-and-validate` first and follow
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read subagent/implement-and-validate` first and follow
 the prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the plan, selected framework, frontend, model, exact target app
 directory, selected documentation URLs, and the
 documentation policy recorded during framework selection or conversion planning. On a
-conversion, also give it the frozen criterion. Give it the protected path list. Require it
+conversion, also give it the frozen criterion. Give it the protected path list and the
+authorized list. Require it
 to implement every step in plan order and run the full validation list. Wait for it.
 
 One subagent implements the whole plan. Do not divide the work across concurrent subagents,
@@ -229,11 +263,11 @@ returned. Continue to proof only when that audit passes.
 After the selected implementation path passes, report it:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard checkpoint --phase build-validated
+npx --prefer-offline --yes copilotkit@4.18.0 onboard checkpoint --phase build-validated
 ```
 
 Then run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read proof/round-trip`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read proof/round-trip`.
 
 ## Repair rules
 
@@ -250,14 +284,18 @@ implementation path.
 Route out only when the failure is not yours to fix. Two endings are open from here, and
 what failed decides which one this run takes.
 
+A fix that requires changing the developer's existing agent or frontend always takes the
+unsupported ending below, whatever else it matches.
+
 A run that broke takes the failure ending: the failure is in code this run did not write,
-the same command still fails after three repair attempts, or a result starts with
-`Status: blocked`. A defect in a package this run installed is not a stack CopilotKit does
-not serve, a command this run cannot get to pass is not one either, and a blocked audit
+the same command still fails after three repair attempts, a result starts with
+`Status: blocked` for a reason other than a file the plan does not name, or the developer
+declined a file the plan does not name, or the run cannot ask them about it. A defect in a
+package this run installed is not a stack CopilotKit does not serve, a command this run cannot get to pass is not one either, and a blocked audit
 proved nothing about the stack. In those cases run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read stopped/run-failed`.
 
 A plan with no path to follow takes the unsupported ending: the fix requires changing the
 developer's existing agent or frontend, or the documentation does not support the plan. In
 those cases run
-`npx --prefer-offline --yes copilotkit@4.16.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/proof/complete.md

@@ -12,7 +12,8 @@ the agent, not the surface, and the developer needs to know which they have.
 
 **Whether this run is complete is decided by the command at the end of this prompt, not
 here.** Run it before you write the summary, and let its output decide which summary you
-write. A run whose surface was never driven is blocked, not complete: say so in the first
+write. A run whose surface was never driven is blocked, not complete, unless it cloned a
+starter and records `skipped-cloned-starter`. For a blocked run, say so in the first
 line, name the evidence the command lists as missing, and do not describe the run as
 finished, working, or ready. Everything else below applies to either outcome.
 
@@ -84,7 +85,7 @@ Name the debugging surface this journey's frontend can reach, rather than the on
 of the documentation leads with. For a web frontend it is the CopilotKit Inspector. For
 React Native there is no Inspector: it is a browser overlay built on a DOM custom element,
 and `@copilotkit/react-native` does not ship it. Give a mobile developer
-`npx --prefer-offline --yes copilotkit@4.16.0 verify --round-trip`, the runtime's own log, the AG-UI
+`npx --prefer-offline --yes copilotkit@4.18.0 verify --round-trip`, the runtime's own log, the AG-UI
 Event Inspector in the CopilotKit VS Code extension, and the CopilotKit Intelligence
 thread view
 instead. Naming the Inspector to a developer who cannot open it costs them the time it
@@ -107,14 +108,19 @@ Where the Learning step was skipped because this organization cannot use Learnin
 one line and name what was not created. A skip nobody names reads as a container that
 exists, and the developer then waits for insights from a container this run never made.
 
-State that the servers remain running after proof.
+State that the servers remain running after proof, unless the command at the end of this
+prompt prints `environment_kind: container` or `environment_kind: sandbox`. That run is on
+an isolated host, such as a Docker container or a cloud agent session, which is not a
+Learning Container. The servers end when that host ends, and a `localhost` URL opens on the
+developer's machine only through a forwarded port. Write the items that output lists in
+place of this sentence.
 
-Report each thing that slowed this run down. Send at most four reports, worst first. Run
-the friction commands without another developer question. Do not ask the developer about
-telemetry: the command applies the setting they already have.
+Report each thing that slowed this run down. Send at most four reports, worst first. The
+friction commands follow the telemetry setting the developer already chose, so they need no
+separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard friction --category <slug> --cost-seconds <seconds> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.18.0 onboard friction --category <slug> --cost-seconds <seconds> --message "<sentences>"
 ```
 
 Put one or two sentences in `--message`. Pick one category from
@@ -126,7 +132,7 @@ Pass --docs-path only for a docs-missing or docs-wrong report, naming the page t
 is about:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard friction --category docs-wrong --cost-seconds 300 --docs-path /docs/threads/drawer --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.18.0 onboard friction --category docs-wrong --cost-seconds 300 --docs-path /docs/threads/drawer --message "<sentences>"
 ```
 
 Give the page's site-relative path or its full URL, with no spaces, query string, or
@@ -143,14 +149,14 @@ Tell the developer when you send a friction report. Do not quote or summarize th
 unless the developer asks. If the CLI says the report was not sent,
 state what it said and continue without another question.
 
-When the evidence is gathered, run `npx --prefer-offline --yes copilotkit@4.16.0 onboard complete`, carrying
-the surface-check outcome the proof subagent returned. Pass exactly one flag, and pass the
-one that matches this journey's surface.
+When the evidence is gathered, run `npx --prefer-offline --yes copilotkit@4.18.0 onboard complete`, carrying
+the surface-check outcome the proof subagent returned. Pass exactly one of `--visual-check`
+or `--device-check`, and pass the one that matches this journey's surface.
 
 For a web frontend -- React SPA, Next.js, Angular, Vue:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard complete --visual-check <outcome>
+npx --prefer-offline --yes copilotkit@4.18.0 onboard complete --visual-check <outcome>
 ```
 
 The outcome is one of `performed`, `skipped-no-browser-tool`, `skipped-cloned-starter`, or
@@ -160,7 +166,7 @@ open no browser. It is the one skip that does not block.
 For React Native:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard complete --device-check <outcome>
+npx --prefer-offline --yes copilotkit@4.18.0 onboard complete --device-check <outcome>
 ```
 
 The outcome is one of `performed`, `skipped-no-device`, `skipped-cloned-starter`, or
@@ -173,7 +179,7 @@ browser-origin CORS, so the flag you pass is how this run states which surface i
 For a web frontend, also pass the URL the browser opened:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard complete --visual-check <outcome> \
+npx --prefer-offline --yes copilotkit@4.18.0 onboard complete --visual-check <outcome> \
   --frontend-url <the url you opened>
 ```
 
@@ -183,8 +189,9 @@ name -- and never the host itself. A run that opened the loopback IP literal los
 static chunk to a refusal, and the field is how that stops being invisible. Leave the flag
 off for React Native, which opens no URL.
 
-Pass the outcome you were given rather than the one you wanted. Anything but `performed`
-prints what the missing check leaves unverified and ends this run as blocked. That output
+Pass the outcome you were given rather than the one you wanted. Anything but `performed` or
+`skipped-cloned-starter` prints what the missing check leaves unverified and ends this run
+as blocked. That output
 is the developer's finding, so carry it into the summary rather than restating it as a
 smaller caveat.
 
@@ -192,7 +199,7 @@ If the round trip proved and something after it still blocked this run, add `--b
 to the same command:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.16.0 onboard complete --visual-check performed --blocked-by <cause>
+npx --prefer-offline --yes copilotkit@4.18.0 onboard complete --visual-check performed --blocked-by <cause>
 ```
 
 The cause is one of `inspector` for a debugging surface that did not open,