copilotkit 4.17.0 → 4.18.0

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -32,7 +32,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --prefer-offline --yes copilotkit@4.17.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --prefer-offline --yes copilotkit@4.18.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -10,6 +10,11 @@ and the credential write that Step 4 names for `api_key_loadable_by_app`.
 Do not write a path that overlaps a protected path. If a required proof or tool path
 overlaps one, return `Status: blocked` before writing it.
 
+One CLI command is the exception to both rules. The Step 2 `onboard runtime-url` command
+can write `.copilotkit/project.json` even when that path is protected. It moves the
+protected-path baseline with its own write, and it refuses a record that changed since the
+baseline. Never edit that file any other way.
+
 The existing agent's behavior is outside every step of this proof. It is four things: the
 agent's system prompt and instructions, its tools and what those tools do, its model and
 provider configuration, and its memory or state handling. A failing predicate is repaired
@@ -123,6 +128,22 @@ A zero exit means the server answered. Any other exit means that it did not answ
 seconds. A server that never answered has written the reason to its own output, and
 reading that output is faster than starting it again.
 
+When the server that serves the runtime answers, record the URL it serves on. Read the port
+from that server's own output or its listener, not from the plan. A dev server whose port
+is taken moves to the next free one without asking. Where the runtime runs as a process of
+its own, this is the runtime's port, not the frontend's.
+
+```text
+npx --prefer-offline --yes copilotkit@4.18.0 onboard runtime-url --url <runtime-url>
+```
+
+`<runtime-url>` is the Step 1 runtime URL with its port replaced by the port that server
+bound. Keep its host and its mount path unchanged.
+
+The command writes `runtimeUrl` into `.copilotkit/project.json` and changes nothing else. It
+mints no key and does not touch `.env`. Step 4 reads that record, so `verify` probes the
+server you started. Run the command again after any restart that binds another port.
+
 That coupling also turns an ordinary restart into a false failure. Where you stop a server
 to pick up an installed dependency, start both again and wait for both to answer before you
 read the round trip. A check run against a frontend whose agent was stopped with it reports
@@ -163,10 +184,10 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --prefer-offline --yes copilotkit@4.17.0 verify --json`. It reads the port from this project, so a
+`npx --prefer-offline --yes copilotkit@4.18.0 verify --json`. It reads the port from this project, so a
 non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
-`runtimeUrlSource` of `default` means nothing in the project named a port, so pass
-`--runtime-url` with the URL from step 1 in that case. Read the individual checks rather than
+`runtimeUrlSource` of `default` means nothing in the project named a port, so the Step 2
+record is missing. Run the Step 2 `onboard runtime-url` command, then run `verify` again. Read the individual checks rather than
 the summary alone: a check reported `undetermined` did not run, and that is not a pass.
 Repair a failed check only within the limits above. Otherwise, return the check and its
 evidence before the browser.
@@ -197,7 +218,7 @@ named no port the CLI can read: keep step 2's URL, and rewrite its host as `loca
 before you use it.
 
 Then run the command once more with the URL you are about to open:
-`npx --prefer-offline --yes copilotkit@4.17.0 verify --frontend-url <that url> --json`. The
+`npx --prefer-offline --yes copilotkit@4.18.0 verify --frontend-url <that url> --json`. The
 `frontend_assets_served` check asks that server for its page and for one of the page's own
 assets, on that exact host. A `fail` there means the dev server refuses its own static
 assets on the host you were about to use, and the check names the URL to use instead. This
@@ -205,7 +226,7 @@ is the cheapest step that can save the most expensive one, so run it before the
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --prefer-offline --yes copilotkit@4.17.0 verify --round-trip --json`. It sends one request through
+Run `npx --prefer-offline --yes copilotkit@4.18.0 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -218,7 +239,7 @@ Where this run settled a Learning Container, add the flag to the call above rath
 running a second round trip:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 verify --round-trip --expect-learning-container <container id> --json
+npx --prefer-offline --yes copilotkit@4.18.0 verify --round-trip --expect-learning-container <container id> --json
 ```
 
 The check reads the thread that this run created, so a second round trip proves a second
@@ -252,7 +273,7 @@ the credential was written holds an empty key while the file beside it carries t
 one. Run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard env-staleness
+npx --prefer-offline --yes copilotkit@4.18.0 onboard env-staleness
 ```
 
 A `stale` line names the env file and how long after launch it was written. Report that,
@@ -268,7 +289,7 @@ environment on to every process it starts, so a provider base URL exported for t
 reaches the dev servers. Run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard inspect --json
+npx --prefer-offline --yes copilotkit@4.18.0 onboard inspect --json
 ```
 
 Read `providerEndpoints` for the app directory. An entry with a `null` `source` came from
@@ -290,13 +311,22 @@ entries this project's frontend publishes, from its own context call. Read the t
 declarations it registers as well, and carry both the way the page carries them, so that
 the agent sees the request the browser sends rather than a thinner one. Send the same run
 body twice, to `<runtime>/agent/<agent id>/run`: once carrying the context entries the page
-publishes, and once carrying `context: []`. Use the step 1 request both times. Record the
-streamed events from each, and name both capture paths.
-
-Read the two answers against each other. The run carrying the page's context has to name
-the project's own records. The run carrying an empty context has to say the page sent
-nothing. Two answers that describe the same record mean the context changed nothing, and
-the page's data is not reaching the model.
+publishes, and once carrying the same entries with one value changed. Use the step 1
+request both times. Record the streamed events from each, and name both capture paths.
+
+For the changed run, pick one record the step 1 request matches. Add a marker to a text
+field that the answer repeats, such as its title or name:
+` [probe-<8 random hex characters>]`. Choose a new marker for each run, record it, and
+change nothing else. Do not remove the entry or send `context: []` instead. The page always
+sends its entries. A model with a request about records, a tool that needs them, and
+nothing to copy invents records. That failure belongs to the probe, not to the integration.
+
+Read each answer against the context it carried. The run carrying the page's context has to
+name the project's own records and no others. The run carrying the changed entry has to
+carry the marker, character for character, and name no record its context did not hold. A
+model that the context never reaches cannot produce the marker. A model that invents a
+different record on every call cannot produce it either, so two answers that only differ
+prove nothing. An answer without the marker means the page's data is not reaching the model.
 
 Return the cause and both captures on a failed comparison. Do not open a browser on a
 failed comparison, and do not edit the project here.
@@ -346,7 +376,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --prefer-offline --yes copilotkit@4.17.0 verify --round-trip`, which reads the
+that thread with `npx --prefer-offline --yes copilotkit@4.18.0 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. It either had
@@ -374,7 +404,7 @@ request never exercises. Drive it with the browser control step 6 named.
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --prefer-offline --yes copilotkit@4.17.0 verify --frontend-url <the url you opened> --json`
+   `npx --prefer-offline --yes copilotkit@4.18.0 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -30,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read fallback/best-effort`.
+`npx --prefer-offline --yes copilotkit@4.18.0 onboard read fallback/best-effort`.
 
-Send one short report. Run the friction command without another developer question. Do not
-ask the developer about telemetry: the command applies the setting they already have.
+Send one short report. The friction command follows the telemetry setting the developer
+already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.18.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.17.0",
+  "version": "4.18.0",
   "type": "module",
   "engines": {
     "node": ">=20.9.0"

package/release/release-tool.js

@@ -14811,7 +14811,7 @@ var FLAG_DEFINITIONS = defineFlags({
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "0c8647a7f4ecf565e58405642539c9d9744f62c5" : "main";
+  return true ? "70d1f3c0a832d6274e2fe710e24102f6429f14f4" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts
@@ -15027,7 +15027,20 @@ var TELEMETRY_ERROR_CODES = {
   LEARNING_RESPONSE_INVALID: "LEARNING_RESPONSE_INVALID",
   LEARNING_SKILLS_BUNDLE_INVALID: "LEARNING_SKILLS_BUNDLE_INVALID",
   LEARNING_SKILLS_INTEGRITY_FAILED: "LEARNING_SKILLS_INTEGRITY_FAILED",
-  LEARNING_SKILLS_OUTPUT_EXISTS: "LEARNING_SKILLS_OUTPUT_EXISTS"
+  LEARNING_SKILLS_OUTPUT_EXISTS: "LEARNING_SKILLS_OUTPUT_EXISTS",
+  /** A device sign-in code ran out before anybody approved it. */
+  DEVICE_LOGIN_EXPIRED: "DEVICE_LOGIN_EXPIRED",
+  /** The person denied a device sign-in request. */
+  DEVICE_LOGIN_DENIED: "DEVICE_LOGIN_DENIED",
+  /** The server does not offer device sign-in. */
+  DEVICE_LOGIN_UNAVAILABLE: "DEVICE_LOGIN_UNAVAILABLE",
+  /** `login --json` refused a new code after repeated unapproved expiries. */
+  LOGIN_REPEATED_EXPIRY: "LOGIN_REPEATED_EXPIRY",
+  /**
+   * An import source's environment is missing a required value or holds one
+   * the importer rejects, such as an unset `MASTRA_IMPORT_AGENT_ID` (PE-397).
+   */
+  IMPORT_SOURCE_CONFIG_INVALID: "IMPORT_SOURCE_CONFIG_INVALID"
 };
 function tagError(err, code) {
   err.code = code;
@@ -15428,9 +15441,10 @@ var projectConfigSchema = external_exports.object({
    * container, a port that only ever appears on a command line — says so once
    * instead of passing `--runtime-url` on every invocation (OSS-1090).
    *
-   * A person writes it, and so does `project select --runtime-url`. An
-   * onboarding run settles a free port and then has nowhere to put it, so
-   * `verify` falls back to its assumed default and reports on whatever holds
+   * A person writes it, and so do `project select --runtime-url` and
+   * `onboard runtime-url`, which records the port a started server bound
+   * (PE-368). An onboarding run settles a free port and then has nowhere to
+   * put it, so `verify` falls back to its assumed default and reports on whatever holds
    * that port — in one run, an unrelated checkout (PE-58). The flag is still
    * a statement rather than a guess: the caller has to name the URL.
    */