copilotkit 4.18.0 → 4.19.0

package/README.md

@@ -1200,7 +1200,9 @@ records a thread, which is why it is opt-in rather than part of the bare command
 `user-not-identified` is reported as `UNKNOWN` rather than `FAIL`. `identifyUser`
 is the project's own code and usually reads a signed-in session, which a CLI
 request does not carry, so an auth-gated app refusing it is that app working
-correctly. Pass what it reads with `--header`, repeatable.
+correctly. Pass what it reads with `--header`, repeatable. `verify` sends
+the header on every request to the runtime, `/info` included, so a runtime
+behind auth needs no local proxy.
 
 ### What `verify` still does not prove
 
@@ -1290,8 +1292,11 @@ project record, it writes nothing and exits non-zero.
 
 An onboarding run protects the record once it selects the project. When the
 bound run protects it, the command moves that baseline with its own write, so
-the next `onboard audit` still passes. It refuses a record that changed since
-the baseline, so a write it did not make is never absorbed.
+the next `onboard audit` still passes. If only the record's `runtimeUrl`
+changed since the baseline, for example by a hand edit after the port moved,
+the command replaces that URL and settles the record. It refuses any other
+change, so a write it did not make is never absorbed. Once the record is
+protected, no other `onboard protect` route accepts a change to it.
 
 ### A model key has no credits or is rejected
 

package/cli-build-info.json

@@ -2,20 +2,20 @@
   "schemaVersion": 1,
   "package": {
     "name": "copilotkit",
-    "version": "4.18.0"
+    "version": "4.19.0"
   },
   "intelligence": {
-    "commit": "3a9266b5fa673a4974ad204d131ed63d5696dc00"
+    "commit": "76b87a74c7887974711242010d86136292a1d56f"
   },
   "copilotKit": {
-    "submittedInput": "70d1f3c0a832",
-    "commit": "70d1f3c0a832d6274e2fe710e24102f6429f14f4"
+    "submittedInput": "bb299bd0e719",
+    "commit": "bb299bd0e71963c139b78c5bc9ac0bc0fd6d614f"
   },
   "channel": "production",
   "triggeringActor": "BenTaylorDev",
   "workflow": {
-    "runId": "36480955998",
-    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/36480955998"
+    "runId": "36608240272",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/36608240272"
   },
   "validationResult": "passed",
   "ag2": {
@@ -24,5 +24,5 @@
     "revision": "main",
     "pinned": false
   },
-  "builtAt": "2026-09-28T20:43:08Z"
+  "builtAt": "2026-09-29T17:56:39Z"
 }