copilotkit 4.17.0 → 4.19.0

package/onboarding/prompts/proof/round-trip.md

@@ -1,7 +1,7 @@
 # Prove the user journey
 
 Do not do the proof work yourself. Spawn one proof subagent. Tell it to run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read subagent/prove-round-trip` first and follow the
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read subagent/prove-round-trip` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the selected framework, frontend, model, approved plan, selected
@@ -13,6 +13,8 @@ Give it the browser or device control you recorded in the preflight as well. The
 drives the surface and cannot see your environment, so without that finding it spends the
 step discovering what you already know. A subagent told it has no control for the surface
 this frontend needs reports the skip outcome rather than looking for a way around it.
+A web run with no browser tool reports `skipped-no-browser-tool`. That outcome completes the
+run once the round trip is recorded as `passed`.
 
 A run that cloned a starter is the exception. Tell that subagent that this run cloned a
 starter, to finish after `verify --round-trip`, and to open no browser. The cloned code is what this repository's
@@ -22,7 +24,7 @@ expensive step in this setup. `verify --round-trip` reads the answer back off th
 so it holds for every runtime mount and needs no browser. Give that subagent no browser or
 device control, and have it report `skipped-cloned-starter` rather than a missing
 capability: nothing was unavailable, the run declined to spend it. That outcome completes
-the run. Every other skip says nothing drove the surface, and blocks it.
+the run.
 
 Give the subagent this guide for continued-development tools:
 https://docs.copilotkit.ai/build-with-agents.md
@@ -33,21 +35,22 @@ pass the time.
 Report each attempt at the journey as it ends, counting from one:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard checkpoint --phase journey-attempted --attempt 1
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase journey-attempted --attempt 1
 ```
 
 Record what that proof returned before you route on it:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard proof --step round-trip --outcome <passed|failed|skipped>
+npx --prefer-offline --yes copilotkit@4.19.0 onboard proof --step round-trip --outcome <passed|failed|skipped>
 ```
 
-Report the gate whatever it returned. A proof that never ran is `skipped`, not failed. The
-command prints one line and sends nothing else. Where a repair cycle runs the proof again,
+Report the gate whatever it returned. A proof that never ran is `skipped`, not failed. A
+round trip that `verify --round-trip` ran and saw fail is `failed`, and the command refuses
+to record it as `skipped`. The command prints one line and sends nothing else. Where a repair cycle runs the proof again,
 record each attempt as it ends.
 
 For every protected-path audit in this prompt, run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard audit` from the target app directory. If its result
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard audit` from the target app directory. If its result
 starts with `Status: blocked`, report the printed reason and use the route-out rules below.
 A blocked audit proved nothing changed and is not a preservation failure. If a
 protected-path audit reports a changed path, decide it the way the implementation prompt
@@ -56,7 +59,7 @@ returns none, so a finding with no Files changed section to test against routes
 path one of those sections names is this run's own change and routes out too. Accept a
 path only when a section this run collected covers the step that wrote it and does not
 name it:
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard protect --accept-external --path <path>`. Then run
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard protect --accept-external --path <path>`. Then run
 the audit again and name the path in the closing summary. Never repair, reset, or revert a
 protected path.
 
@@ -64,17 +67,23 @@ That holds for a repair cycle too. When the fix for a failing check lands on a p
 path, the path is still the developer's, however right the diagnosis is and however small
 the fix. Reading the file never settles who wrote it. Ask the developer to allow the
 change, and record their answer with
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
 or route out. Never repair it, and never send it to a repair worker.
 
 If the proof result starts with `Status: passed`, run the protected-path audit. Continue to
 `proof/complete` only if that audit passes. After the audit passes, run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read proof/complete`. A performed surface outcome with
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read proof/complete`. A performed surface outcome with
 the full round trip is core success even if a continued-development tool fails. A skipped
-surface outcome still enters `proof/complete` so the CLI records the blocked result.
-`skipped-cloned-starter` is the exception: the CLI records that run as complete. Do not
-describe a skipped surface as proved. Keep the Skills and MCP results separate from the proof
-result.
+surface outcome still enters `proof/complete`. The CLI records `skipped-cloned-starter` and
+`skipped-no-browser-tool` after a passed round trip as complete, and `skipped-no-device` as
+blocked. Do not describe a
+skipped surface as proved. Keep the Skills result separate from the proof result.
+
+A passed result can carry the surface-check outcome `failed` with the cause
+`browser-control-unresponsive`. It means that the browser tool stopped answering, not that
+the journey failed. Record the round trip as `passed`, and carry the cause to
+`proof/complete`. Do not send it to a repair worker, and do not run the proof again. No
+repair to the project reaches the tool, and a second attempt waits on the same hang.
 
 If the round trip proves and something after it blocks this run anyway -- the debugging
 surface, or a capability the approved plan already excluded for this framework -- read
@@ -147,7 +156,7 @@ Restart each project-owned process changed by the repair. Report the cycle, coun
 one:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard checkpoint --phase repair-attempted --attempt 1
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase repair-attempted --attempt 1
 ```
 
 Then spawn a fresh proof subagent
@@ -165,18 +174,18 @@ proof cycles, use the route-out rules below.
 
 Route out only when the failure is not yours to fix, when the same proof still fails after
 three attempts, or when no evidence of the round trip can be produced. In those cases run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read stopped/run-failed`. The stack is supported:
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`. The stack is supported:
 this run did not finish, which is a different ending and a different report. All three are
 about the round trip itself. A round trip that proved is not one of them, whatever failed
 after it.
 
 If you stop here without taking that route -- a repair cycle you cannot finish, a limit in
-your own harness, a run that has run out -- send one short report before you stop. Run the
-friction command without another developer question: it applies the telemetry setting the
-developer already set.
+your own harness, a run that has run out -- send one short report before you stop. The
+friction command follows the telemetry setting the developer already chose, so it needs no
+separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.19.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.

package/onboarding/prompts/research/gather.md

@@ -44,7 +44,7 @@ Before you end your turn to wait for the developer where the prompt states no de
 report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard checkpoint --phase awaiting-developer
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase awaiting-developer
 ```
 
 When the answer or the result arrives, continue from the step that paused. Do not read an
@@ -64,7 +64,7 @@ Both research subagents failing means this harness has no working subagent at al
 is worth recording once:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard checkpoint --phase delegation-unavailable
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase delegation-unavailable
 ```
 
 Then say once, in your own words, that this environment has no working subagents, so you
@@ -77,7 +77,7 @@ Before you ask the developer any setup question, finish every read-only investig
 preflight check in this section.
 
 Prepare two research assignments. Give each research subagent one assignment. Tell it to run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read subagent/inspect-repository` first and follow the
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read subagent/inspect-repository` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Require only its assigned packet.
@@ -91,7 +91,7 @@ Start both research subagents in parallel:
 Report that both subagents started:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard checkpoint --phase research-dispatched
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase research-dispatched
 ```
 
 A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
@@ -100,8 +100,8 @@ failed step.
 The research is under way. Continue to the surface-control preflight while it runs:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard read research/preflight
+npx --prefer-offline --yes copilotkit@4.19.0 onboard read research/preflight
 ```
 
 If inspection stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/merge.md

@@ -21,7 +21,7 @@ Project selection is where the settled port is written down, through `--runtime-
 Then report that the research came back:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard checkpoint --phase research-returned
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase research-returned
 ```
 
 A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
@@ -39,7 +39,8 @@ verifier result.
 
 A target project directory that holds no project has no app directory to key on, and
 that is a merged result rather than a failed merge. Record that this run has no target app
-directory and no environment row, then take the read below. Do not send a focused directory
+directory and no environment row. Keep the toolchain reading: it is about this machine, not
+a directory, and the framework question reads it. Then take the read below. Do not send a focused directory
 check, and do not use the stop route: neither worker can find a directory a developer has
 not created yet, and the route below is where such a project picks its starter.
 
@@ -54,7 +55,7 @@ worker a focused directory check. Continue only when both workers return the sam
 app directory. Both results must start with `Status: passed`. Otherwise, use the stop route.
 
 When both research results are merged, run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read research/route`.
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read research/route`.
 
 If inspection stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/preflight.md

@@ -5,71 +5,36 @@ every later step reads one recorded answer instead of guessing. Do not change ap
 code here, and do not wait for the research packets yet.
 
 Prove whether your coding-agent environment has browser or device control. Do not assume it
-either way, and do not report what you expect to be true. Use a browser or device tool already
-configured for the coding agent you are running as, the same way a later step uses the
-CopilotKit documentation server. With a browser tool, open one inert page such as
+either way, and do not report what you expect to be true. Use a browser or device tool that
+is already loaded in this session. With a browser tool, open one inert page such as
 `about:blank` and read its title. With a device tool and no browser, list the booted devices
 in one command: `adb devices -l`. Record the outcome of that attempt: `available` when the
-tool answered, `unavailable` when there was none to call or the page did not open. Use
-the control that matches the selected surface later.
+tool answered, `unavailable` when there was none to call or the page did not open. Use the
+control that matches the selected surface later.
 
-Where the browser probe answered, register nothing. The harness came equipped.
-
-Where no browser tool answered, register one for the coding agent you are running as, then
-run the same probe again and record what the second attempt did.
-
-Tell the developer in one line what you are about to register, that it lives in this coding
-agent's configuration rather than in their repository, and that they can remove it again.
-Say that before you run the command. The run does not ask again.
-
-Register this server:
-
-```text
-npx --yes @playwright/mcp@latest --browser chrome --isolated --output-dir <project>/.copilotkit/proof/browser
-```
-
-Replace `<project>` with the absolute path of the target project directory. The server is
-registered against the coding agent rather than against a directory, so a relative path here
-resolves wherever that server happens to start.
-
-`--browser chrome` drives an installed Google Chrome. Where this machine has none, use
-`--browser chromium` instead and expect Playwright to download a browser build. Tell the
-developer before that download starts. If the server then reports no build, run
-`npx playwright install chromium`, and if it still cannot find one, run
-`npx @playwright/mcp install-browser chrome-for-testing`. `--isolated` keeps the profile in
-memory, so it never touches their own Chrome profile. `--output-dir` keeps the snapshots and
-screenshots out of the developer's repository root: without it this server writes them to
-`.playwright-mcp/` beside their code, which a project that never asked for a browser has no
-reason to carry. Register it the way your own harness registers a server, which is the
-mechanism a later step uses for the CopilotKit documentation server.
-
-Some coding agents, Claude Code among them, load a newly registered MCP server only at the
-next session start. Tell the developer in one line to expect one restart, then restart and
-re-bind with `npx --prefer-offline --yes copilotkit@4.17.0 onboard start --run <onboarding_run_id>`. That
-restart is a step here, not an error.
+Register nothing. Do not add a browser MCP server to this coding agent, and do not install a
+browser. A server registered during a run loads only in the next session, so it cannot help
+this one. Where no tool answered, the run still completes: the proof step reports
+`skipped-no-browser-tool`, and the closing report tells the developer how to add a browser
+for their next session. Say in one line that the live UI check will be skipped and that the
+run can still complete.
 
 Do not add a browser or device driver to the project. A driver added there is a
-devDependency and a browser download in the diff of a repository that never asked for one,
-which is a different thing from a server registered against the coding agent.
-
-Where the second probe still does not answer -- no browser to drive, no network, or a
-harness that cannot register a server -- record `unavailable` and carry it. Do not keep
-trying. Say so in one line. Nothing here is for the developer to decide.
+devDependency and a browser download in the diff of a repository that never asked for one.
 
-Registering a server does not boot a device. Where the device probe found none, that is the
-whole finding.
+Where the device probe found no booted device, that is the whole finding.
 
 Report that the probe settled, whichever way it came out:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard checkpoint --phase surface-probed
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase surface-probed
 ```
 
 Then merge the research:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard read research/merge
+npx --prefer-offline --yes copilotkit@4.19.0 onboard read research/merge
 ```
 
 If inspection stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/route.md

@@ -9,11 +9,12 @@ sends the run down one path.
 Before you route on, run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard protect
+npx --prefer-offline --yes copilotkit@4.19.0 onboard protect
 ```
 
 It reads the working tree itself, records every changed or untracked path with a digest,
-and prints the list. Require its result to start with `Status: passed`.
+and prints the list. Require its result to start with `Status: passed`. On a restart of the
+same run, it prints the baseline the run already holds and re-reads nothing.
 
 Use the printed list as the protected path list for the rest of the run. Do not assemble
 that list yourself, and do not ask a subagent to hold it: every later audit reads the
@@ -41,7 +42,7 @@ On either, run this before you read the three findings below, and without asking
 purpose question:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard read feature/channels/start
+npx --prefer-offline --yes copilotkit@4.19.0 onboard read feature/channels/start
 ```
 
 Name the provider to that node so it does not ask again. A Slack page names Slack. A Teams
@@ -96,7 +97,7 @@ settle these three from your own reading of the project. Each one comes from the
 packets or it is not proved.
 
 If all three are proved, prove the live starting state before any project file changes. Run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read proof/oss-baseline`.
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read proof/oss-baseline`.
 
 Route there before you ask the developer anything else. The questions after this prompt
 select a framework and a frontend that the findings already name, so a developer who
@@ -109,7 +110,7 @@ developer nor the repository findings prove what the project is for, ask one gui
 question about the user outcome. This asks what the developer wants to build before you
 select a framework. Give two or three short examples. Record the answer and give it to
 each later subagent. Then run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read credentials/plan`.
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read credentials/plan`.
 
 Do not ask that question on the route above. A project carrying all three states its
 purpose in the application it already serves.
@@ -123,5 +124,5 @@ A purpose question here names a domain before that choice.
 Take the same read named above without asking.
 
 If authentication, inspection, or the baseline capture stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read stopped/run-failed`. None of them says anything
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`. None of them says anything
 about whether this project's stack is supported, which is not yet known at this point.

package/onboarding/prompts/starter/clone.md

@@ -55,7 +55,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --prefer-offline --yes copilotkit@4.17.0 project list --json`
+`npx --prefer-offline --yes copilotkit@4.19.0 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -82,7 +82,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument. If the directory name holds a space, put it in double quotes.
 
-`npx --prefer-offline --yes copilotkit@4.17.0 init --name <directory-name> --framework <framework-id> --channel none --no-banner --no-key-prompt --create <name> --install`
+`npx --prefer-offline --yes copilotkit@4.19.0 init --name <directory-name> --framework <framework-id> --channel none --no-banner --no-key-prompt --create <name> --install`
 
 `--name` is always the target directory name derived above, because `init` creates the
 app at `<parent>/<name>`. Any other value puts the app in a new folder beside the target,
@@ -108,7 +108,7 @@ account. The command does not need terminal input.
 Report the clone before you inspect anything:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard checkpoint --phase starter-cloned
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase starter-cloned
 ```
 
 This is its own step, not an aside. A run that clones and then goes quiet is
@@ -149,10 +149,11 @@ The two Microsoft Agent Framework starters keep their key outside `<target>/.env
   `cd <target>/agent && dotnet user-secrets set OPENAI_API_KEY "<key>"` themselves, even
   if they named a key file.
 
-Then report the pause and end your turn:
+When you ask, name each variable and the file it goes in, and say that the run continues
+when they reply or resume this session. Then report the pause and end your turn:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard checkpoint --phase awaiting-developer
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase awaiting-model-credential
 ```
 
 This is a pause, not a stop. Do not send a stop report, and do not take a stop route.
@@ -163,10 +164,10 @@ call.
 
 If no credential is missing, report no pause and continue.
 
-Then run `npx --prefer-offline --yes copilotkit@4.17.0 onboard read proof/round-trip`.
+Then run `npx --prefer-offline --yes copilotkit@4.19.0 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --prefer-offline --yes copilotkit@4.17.0 onboard read stopped/run-failed`. The starter is one this
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`. The starter is one this
 graph ships and the stack was chosen from its own supported list, so a command that
 returned an error is a run that broke, not a setup this release does not support.

package/onboarding/prompts/stopped/run-failed.md

@@ -41,7 +41,7 @@ put to them, stop here and send the report below.
 If they approve it, make that one fix and nothing else. Then come back into this run:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard resume --message "<approval>"
+npx --prefer-offline --yes copilotkit@4.19.0 onboard resume --message "<approval>"
 ```
 
 Put the developer's approval in `--message`, in one or two sentences: the fix they
@@ -60,11 +60,11 @@ said and stop.
 
 Stop onboarding without making more repository changes.
 
-Send one short report. Run the friction command without another developer question. Do not
-ask the developer about telemetry: the command applies the setting they already have.
+Send one short report. The friction command follows the telemetry setting the developer
+already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.19.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped

package/onboarding/prompts/subagent/create-plan.md

@@ -103,6 +103,15 @@ it moves to. The `@ag-ui/*` packages are the CopilotKit protocol layer, on their
 line, so they are the ones this meets most often, but the rule is the intersection rather
 than that namespace.
 
+A package the plan adds that a `@copilotkit/*` or `@ag-ui/*` package also depends on, such
+as `zod`, takes the version that tree resolves, not the latest published one. A peer range
+does not settle it. `@copilotkit/react-core@1.75.0` declares `zod >=3.25`, while
+`@ag-ui/core@0.0.59` requires `zod ^3.22.4`, so a plan that adds zod 4 installs two copies.
+Read the range with `npm view @ag-ui/core@<version> dependencies`, for the `@ag-ui/core`
+version the target `@copilotkit/*` release requires, and plan the latest version inside it.
+Where the project already depends on that package, keep its version if that tree accepts
+it. Otherwise name the move as above.
+
 The intersection includes what a `@copilotkit/*` package on its own version line declares
 about the `1.x` line. `@copilotkit/angular` is the one that has this, and its declaration
 is materialized at publish time rather than written in the repository, so read it from the
@@ -174,7 +183,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --prefer-offline --yes copilotkit@4.17.0 verify --round-trip`, which needs no browser. Do not plan a
+`npx --prefer-offline --yes copilotkit@4.19.0 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps
@@ -219,6 +228,15 @@ to make a build pass during onboarding.
 
 The type check runs against the project's own configuration. If the project has no
 type-check command, add one that uses the configuration the project already has.
+Where the repository findings carry a `typescript.migration` for an app, plan it as its
+own step, before the first step that imports a CopilotKit package in that app. Name the
+migration `file` and each change in `changes`, and give its `reason` in one sentence.
+Under `node` or `node10` resolution, TypeScript ignores a package's `exports` map, so
+every CopilotKit subpath import fails the type check while the app still runs. A plan
+without this step stops after approval to ask for it. If the file is a protected path,
+list it under `Authorization requested`. Where no migration is reported, do not change
+`moduleResolution` or `module`. This change does not weaken type safety.
+
 Do not add compiler strictness the project did not have. Nothing later in the run is
 allowed to weaken type safety, so a stricter gate named here is one the run cannot get
 back out of.

package/onboarding/prompts/subagent/inspect-repository.md

@@ -7,7 +7,7 @@ Work only on the packet you were assigned. Inspect the repository without changi
 Run this first, from the target project directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.17.0 onboard inspect --json
+npx --prefer-offline --yes copilotkit@4.19.0 onboard inspect --json
 ```
 
 It answers the deterministic half of both packets exactly, from the same code
@@ -15,7 +15,8 @@ It answers the deterministic half of both packets exactly, from the same code
 directory on its own, the env files, which variable carries the Intelligence key and which
 file it came from, whether that directory's own process can load it, the package manager
 its lockfile proves, the port it declares, the exact installed version of every
-`@copilotkit/*` dependency, and every provider base URL its process will read. It reads
+`@copilotkit/*` dependency, every provider base URL its process will read, and the
+module resolution its `tsconfig.json` sets, read through the `extends` chain. It reads
 only and prints no secret value.
 
 Report each `providerEndpoints` entry with the variable, its origin, and where it came
@@ -23,6 +24,13 @@ from. A `null` `source` means the process environment supplied it. A coding agen
 passes that value on to every dev server it starts, so it decides where the model calls
 go before any project file does. Carry its `warning` as it came back.
 
+The packet's `toolchains` block reads the .NET SDK, Node.js, and Python 3 from PATH. Its
+`unready` list names every framework that this machine cannot run yet, with the toolchain
+each one needs. Report both as they came back. The framework question reads them before
+the developer chooses. This reading is about the machine, not about one directory, so
+report it once and not per app. Report it when `apps` is empty too: a project that does
+not exist yet still picks a framework.
+
 Carry those readings into your findings as they came back. Do not work one of them out
 again by reading files. The directory that owns `.env` is the hard case and the CLI holds
 the fixes for it, so a second answer derived here is a guess competing with a proof.
@@ -61,12 +69,19 @@ reading of the files will not reproduce.
 - names of required credential variables, beyond the Intelligence key the CLI reported
 - the `.env` modification time, or that no `.env` exists, for a later comparison. It is a
   timestamp, not a value from the file
-- required toolchains and their installed versions
+- required toolchains and their installed versions. Start from the CLI's `toolchains`
+  block, and add only the version of each toolchain it reported as present
 - whether each port the CLI reported as declared is free
 - whether the runtime constructor uses a `runner` option, an `intelligence` option, or
   neither can be proved from project files
 - package compatibility risks, and whether any `@copilotkit/*` version the CLI reported is
   below 1.70.0
+- the `tsconfig.json` change each app needs, from `typescript.migration`: its file and each
+  change, as they came back. The change lets CopilotKit subpath imports such as
+  `@copilotkit/runtime/v2` type-check. A `null` migration means that no change is needed.
+  Where `typescript.status` is `unreadable` or `typescript.unresolvedExtends` is not
+  empty, read that app's `tsconfig.json` chain and report its `moduleResolution` and
+  `module` values, or report them as unproved
 
 Key every environment finding by its app or runtime directory. Do not combine findings
 from different directories. The CLI packet keys its own readings the same way.

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -32,7 +32,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --prefer-offline --yes copilotkit@4.17.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --prefer-offline --yes copilotkit@4.19.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected