copilotkit 4.18.0 → 4.19.0

package/onboarding/prompts/starter/clone.md

@@ -55,7 +55,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --prefer-offline --yes copilotkit@4.18.0 project list --json`
+`npx --prefer-offline --yes copilotkit@4.19.0 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -82,7 +82,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument. If the directory name holds a space, put it in double quotes.
 
-`npx --prefer-offline --yes copilotkit@4.18.0 init --name <directory-name> --framework <framework-id> --channel none --no-banner --no-key-prompt --create <name> --install`
+`npx --prefer-offline --yes copilotkit@4.19.0 init --name <directory-name> --framework <framework-id> --channel none --no-banner --no-key-prompt --create <name> --install`
 
 `--name` is always the target directory name derived above, because `init` creates the
 app at `<parent>/<name>`. Any other value puts the app in a new folder beside the target,
@@ -108,7 +108,7 @@ account. The command does not need terminal input.
 Report the clone before you inspect anything:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 onboard checkpoint --phase starter-cloned
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase starter-cloned
 ```
 
 This is its own step, not an aside. A run that clones and then goes quiet is
@@ -153,7 +153,7 @@ When you ask, name each variable and the file it goes in, and say that the run c
 when they reply or resume this session. Then report the pause and end your turn:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 onboard checkpoint --phase awaiting-model-credential
+npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase awaiting-model-credential
 ```
 
 This is a pause, not a stop. Do not send a stop report, and do not take a stop route.
@@ -164,10 +164,10 @@ call.
 
 If no credential is missing, report no pause and continue.
 
-Then run `npx --prefer-offline --yes copilotkit@4.18.0 onboard read proof/round-trip`.
+Then run `npx --prefer-offline --yes copilotkit@4.19.0 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --prefer-offline --yes copilotkit@4.18.0 onboard read stopped/run-failed`. The starter is one this
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`. The starter is one this
 graph ships and the stack was chosen from its own supported list, so a command that
 returned an error is a run that broke, not a setup this release does not support.

package/onboarding/prompts/stopped/run-failed.md

@@ -41,7 +41,7 @@ put to them, stop here and send the report below.
 If they approve it, make that one fix and nothing else. Then come back into this run:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 onboard resume --message "<approval>"
+npx --prefer-offline --yes copilotkit@4.19.0 onboard resume --message "<approval>"
 ```
 
 Put the developer's approval in `--message`, in one or two sentences: the fix they
@@ -64,7 +64,7 @@ Send one short report. The friction command follows the telemetry setting the de
 already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.19.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped

package/onboarding/prompts/subagent/create-plan.md

@@ -103,6 +103,15 @@ it moves to. The `@ag-ui/*` packages are the CopilotKit protocol layer, on their
 line, so they are the ones this meets most often, but the rule is the intersection rather
 than that namespace.
 
+A package the plan adds that a `@copilotkit/*` or `@ag-ui/*` package also depends on, such
+as `zod`, takes the version that tree resolves, not the latest published one. A peer range
+does not settle it. `@copilotkit/react-core@1.75.0` declares `zod >=3.25`, while
+`@ag-ui/core@0.0.59` requires `zod ^3.22.4`, so a plan that adds zod 4 installs two copies.
+Read the range with `npm view @ag-ui/core@<version> dependencies`, for the `@ag-ui/core`
+version the target `@copilotkit/*` release requires, and plan the latest version inside it.
+Where the project already depends on that package, keep its version if that tree accepts
+it. Otherwise name the move as above.
+
 The intersection includes what a `@copilotkit/*` package on its own version line declares
 about the `1.x` line. `@copilotkit/angular` is the one that has this, and its declaration
 is materialized at publish time rather than written in the repository, so read it from the
@@ -174,7 +183,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --prefer-offline --yes copilotkit@4.18.0 verify --round-trip`, which needs no browser. Do not plan a
+`npx --prefer-offline --yes copilotkit@4.19.0 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps

package/onboarding/prompts/subagent/inspect-repository.md

@@ -7,7 +7,7 @@ Work only on the packet you were assigned. Inspect the repository without changi
 Run this first, from the target project directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 onboard inspect --json
+npx --prefer-offline --yes copilotkit@4.19.0 onboard inspect --json
 ```
 
 It answers the deterministic half of both packets exactly, from the same code
@@ -24,6 +24,13 @@ from. A `null` `source` means the process environment supplied it. A coding agen
 passes that value on to every dev server it starts, so it decides where the model calls
 go before any project file does. Carry its `warning` as it came back.
 
+The packet's `toolchains` block reads the .NET SDK, Node.js, and Python 3 from PATH. Its
+`unready` list names every framework that this machine cannot run yet, with the toolchain
+each one needs. Report both as they came back. The framework question reads them before
+the developer chooses. This reading is about the machine, not about one directory, so
+report it once and not per app. Report it when `apps` is empty too: a project that does
+not exist yet still picks a framework.
+
 Carry those readings into your findings as they came back. Do not work one of them out
 again by reading files. The directory that owns `.env` is the hard case and the CLI holds
 the fixes for it, so a second answer derived here is a guess competing with a proof.
@@ -62,7 +69,8 @@ reading of the files will not reproduce.
 - names of required credential variables, beyond the Intelligence key the CLI reported
 - the `.env` modification time, or that no `.env` exists, for a later comparison. It is a
   timestamp, not a value from the file
-- required toolchains and their installed versions
+- required toolchains and their installed versions. Start from the CLI's `toolchains`
+  block, and add only the version of each toolchain it reported as present
 - whether each port the CLI reported as declared is free
 - whether the runtime constructor uses a `runner` option, an `intelligence` option, or
   neither can be proved from project files

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -32,7 +32,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --prefer-offline --yes copilotkit@4.18.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --prefer-offline --yes copilotkit@4.19.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -12,8 +12,9 @@ overlaps one, return `Status: blocked` before writing it.
 
 One CLI command is the exception to both rules. The Step 2 `onboard runtime-url` command
 can write `.copilotkit/project.json` even when that path is protected. It moves the
-protected-path baseline with its own write, and it refuses a record that changed since the
-baseline. Never edit that file any other way.
+protected-path baseline with its own write. If only the record's `runtimeUrl` changed since
+the baseline, it replaces that URL and settles the record. It refuses any other change.
+Never edit that file any other way.
 
 The existing agent's behavior is outside every step of this proof. It is four things: the
 agent's system prompt and instructions, its tools and what those tools do, its model and
@@ -134,7 +135,7 @@ is taken moves to the next free one without asking. Where the runtime runs as a
 its own, this is the runtime's port, not the frontend's.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 onboard runtime-url --url <runtime-url>
+npx --prefer-offline --yes copilotkit@4.19.0 onboard runtime-url --url <runtime-url>
 ```
 
 `<runtime-url>` is the Step 1 runtime URL with its port replaced by the port that server
@@ -184,7 +185,7 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --prefer-offline --yes copilotkit@4.18.0 verify --json`. It reads the port from this project, so a
+`npx --prefer-offline --yes copilotkit@4.19.0 verify --json`. It reads the port from this project, so a
 non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
 `runtimeUrlSource` of `default` means nothing in the project named a port, so the Step 2
 record is missing. Run the Step 2 `onboard runtime-url` command, then run `verify` again. Read the individual checks rather than
@@ -212,13 +213,17 @@ this check: that mount serves the thread routes inside its envelope. If the chec
 `undetermined`, the runtime cannot report the state, and the check names the upgrade. Record
 that and continue.
 
+`single_route_core_supports_intelligence` and `frontend_runtime_url_resolvable` read the
+installed `@copilotkit/core` and the frontend's `runtimeUrl`. Each names the upgrade or the
+URL that fixes it. Return the check for implementation. Do not edit it.
+
 Take the frontend URL from the payload's `frontendUrl`. It replaces whatever step 2
 recorded, and every later step uses it unchanged. Where the field is absent, the project
 named no port the CLI can read: keep step 2's URL, and rewrite its host as `localhost`
 before you use it.
 
 Then run the command once more with the URL you are about to open:
-`npx --prefer-offline --yes copilotkit@4.18.0 verify --frontend-url <that url> --json`. The
+`npx --prefer-offline --yes copilotkit@4.19.0 verify --frontend-url <that url> --json`. The
 `frontend_assets_served` check asks that server for its page and for one of the page's own
 assets, on that exact host. A `fail` there means the dev server refuses its own static
 assets on the host you were about to use, and the check names the URL to use instead. This
@@ -226,20 +231,29 @@ is the cheapest step that can save the most expensive one, so run it before the
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --prefer-offline --yes copilotkit@4.18.0 verify --round-trip --json`. It sends one request through
+Run `npx --prefer-offline --yes copilotkit@4.19.0 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
 session the CLI does not carry: pass what it reads with `--header "Name: value"` and run
 it again, because an auth-gated app refusing an unauthenticated caller is that app
-working. Do not continue until this passes, and never report a round trip proven without
-it.
+working. Do not continue until the `roundTrip` entry passes, and never report a round trip
+proven without it.
+
+The command exits non-zero for any check that is not `pass`, including each `extraChecks`
+entry, so route on each entry's own `status` rather than on the exit status. Where the
+frontend's files call a context hook, one entry has the `id` `page_context_reaches_agent`:
+
+- `pass` proves that the agent's model sees context the page sends.
+- `fail` is a defect: context the page sends never reaches the model. Return it with its
+  evidence as a failed proof step.
+- `undetermined` means the context round trip did not complete. Record it and continue.
 
 Where this run settled a Learning Container, add the flag to the call above rather than
 running a second round trip:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 verify --round-trip --expect-learning-container <container id> --json
+npx --prefer-offline --yes copilotkit@4.19.0 verify --round-trip --expect-learning-container <container id> --json
 ```
 
 The check reads the thread that this run created, so a second round trip proves a second
@@ -273,7 +287,7 @@ the credential was written holds an empty key while the file beside it carries t
 one. Run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 onboard env-staleness
+npx --prefer-offline --yes copilotkit@4.19.0 onboard env-staleness
 ```
 
 A `stale` line names the env file and how long after launch it was written. Report that,
@@ -289,7 +303,7 @@ environment on to every process it starts, so a provider base URL exported for t
 reaches the dev servers. Run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 onboard inspect --json
+npx --prefer-offline --yes copilotkit@4.19.0 onboard inspect --json
 ```
 
 Read `providerEndpoints` for the app directory. An entry with a `null` `source` came from
@@ -300,11 +314,13 @@ edit a project file to answer it: the value lives in the shell, not in the proje
 
 ### Step 5a -- Prove that the page's data reaches the model
 
-`verify --round-trip` sends `context: []` and asks a question that needs no context. It
-passes against an agent the page's data never reaches, and that is the right job for an
-install check. Nothing else before the browser reads that path, so a page whose data the
-agent never sees answers fluently over a record it invented, and the first thing to notice
-is a card in a screenshot.
+`verify --round-trip` asks a question that needs no context. Where the frontend's files call
+a context hook, it also sends one token as context and reports
+`page_context_reaches_agent`, which proves that the agent's model sees context at all. It
+does not prove that the page's own entries arrive in the shape the agent reads. Nothing
+else before the browser reads that path, so a page whose data the agent never sees answers
+fluently over a record it invented, and the first thing to notice is a card in a
+screenshot.
 
 Where this journey shares page data with the agent, prove that path here. Read the context
 entries this project's frontend publishes, from its own context call. Read the tool
@@ -376,16 +392,15 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --prefer-offline --yes copilotkit@4.18.0 verify --round-trip`, which reads the
+that thread with `npx --prefer-offline --yes copilotkit@4.19.0 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
-Use the surface control the main coding agent recorded for your environment. It either had
-one already or registered one before this step, so that finding is the answer and there is
-nothing here for you to go looking for. Do not add a browser driver or a device tool to this
-project: a devDependency and a browser download land in the diff and tax a repository that
-never asked for one, which is a different thing from the server registered against the
-coding agent. If nothing in your environment can drive the surface this journey needs, skip
-this step rather than installing one, and report the skip outcome named below.
+Use the surface control the main coding agent recorded for your environment. That finding
+is the answer, and there is nothing here for you to go looking for. Do not register a
+browser server with the coding agent, and do not add a browser driver or a device tool to
+this project: a devDependency and a browser download land in the diff and tax a repository
+that never asked for one. If nothing in your environment can drive the surface this journey
+needs, skip this step rather than installing one, and report the skip outcome named below.
 
 Never report a result you did not see, on either surface.
 
@@ -400,11 +415,22 @@ under a name that says what it was.
 The surface is a browser, and it also covers browser-origin CORS and CSP, which a CLI
 request never exercises. Drive it with the browser control step 6 named.
 
+A browser call can hang. It then returns only when the tool's own limit ends it, and that
+limit can be ten minutes. You cannot interrupt a call while it runs, so the limit here is on
+what you do after one. If a browser call took longer than 60 seconds to return, the browser
+control is unresponsive. Do not call the browser again in this attempt. A second call to a
+hung tool waits as long as the first one did. Run
+`npx --prefer-offline --yes copilotkit@4.19.0 verify --frontend-url <the url step 4 resolved> --json` once,
+and record the `frontend_assets_served` result. Report the outcome `failed` with the cause
+`browser-control-unresponsive`. The application is not at fault on this evidence: every
+step before the browser proved the runtime without one, and no repair to the project can
+reach the tool.
+
 1. Open the frontend URL step 4 resolved, exactly as that step recorded it, and wait for
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --prefer-offline --yes copilotkit@4.18.0 verify --frontend-url <the url you opened> --json`
+   `npx --prefer-offline --yes copilotkit@4.19.0 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.
@@ -429,9 +455,12 @@ request never exercises. Drive it with the browser control step 6 named.
    the answer from, and what that element showed.
 
 Report exactly one of `performed`, `skipped-no-browser-tool`, `skipped-cloned-starter`, or
-`failed` for a web frontend. Report `skipped-cloned-starter` when the main coding agent told
-you to open no browser because the run cloned a starter. The cloned-starter exception above
-Step 1 says which steps to run.
+`failed` for a web frontend. With `failed`, also report the cause
+`browser-control-unresponsive` if the browser control stopped answering. Report
+`skipped-cloned-starter` when the main coding agent told you to open no browser because the
+run cloned a starter. Report `skipped-no-browser-tool` when no browser tool is loaded in
+this session. Do not register one yourself in either case.
+The cloned-starter exception above Step 1 says which steps to run.
 
 ### Step 6b -- React Native
 
@@ -517,40 +546,25 @@ Tell the developer what the skills install writes into this project before you r
 `.agents/skills` directory holding one folder per CopilotKit skill, linked into
 `.claude/skills`. Both sit in the working tree, so the install shows up in `git status`
 and can land in a commit. You cannot know whether this project keeps those directories in
-version control, so name them before you write them rather than after. Say the same
-thing about the MCP registration below where it writes `.mcp.json`: that file lands in the
-working tree beside them, for the same reason and with the same consequence.
-
-Use it to install the project-scoped CopilotKit Skills.
-Use it to configure the CopilotKit documentation MCP server for the coding-agent slug this
-run reported to `onboard identify`.
-
-Register it in this project wherever that agent reads a project-scoped file. For
-`claude-code` that is `claude mcp add --scope project`, which writes `.mcp.json` at the
-project root. Without that flag the command writes the agent's own configuration under the
-developer's home directory, outside this project, so pass it even where the command line
-you were given leaves it out. For `github-copilot` the project-scoped file is
-`.vscode/mcp.json`, and for `cursor` it is the project `mcp.json`.
-
-Where the agent reads no project-scoped file at all, do not run the registration. `codex`
-and `windsurf` write only under the home directory, and the desktop and web clients
-register through a settings screen this run cannot reach. Print the exact command or
-setting the guide gives for that agent, and tell the developer it is theirs to run. Record
-that as handed over rather than as failed: nothing went wrong, and this run is not allowed
-to edit configuration outside the project.
-
-Check whether each install succeeded and record what you found. Record the command result
-for each attempt. Report the Skills result and the MCP result separately from the proof
-result. A tool error does not change the proof result: this journey proved or it did not,
-whatever these two tools did.
+version control, so name them before you write them rather than after.
+
+Use it to install the project-scoped CopilotKit Skills. Do not register an MCP server: the
+Skills read the CopilotKit documentation without one.
+
+Check whether the install succeeded and record what you found. Record the command result.
+Report the Skills result separately from the proof result. A tool error does not change the
+proof result: this journey proved or it did not, whatever the install did.
 
 ## Step 10 -- Return the result
 
 Start with `Status: passed`, `Status: failed`, or `Status: blocked`.
 Use `Status: passed` when the proof attempt completed with `performed`,
 `skipped-no-browser-tool`, `skipped-no-device`, or `skipped-cloned-starter`. The parent
-records a skip through the standard completion route, which ends every skip but
-`skipped-cloned-starter` as blocked. Use `Status: failed` for a failed proof step. Use
+records a skip through the standard completion route, which ends `skipped-no-device` as
+blocked and the other two skips as complete. Use `Status: passed` with the surface-check outcome `failed` and the cause
+`browser-control-unresponsive` when every step before the browser passed and the browser
+control then stopped answering. The round trip is proved, and the parent must not send a
+tool fault to a repair. Use `Status: failed` for a failed proof step. Use
 `Status: blocked` when a safety or access limit stops the attempt before a surface outcome.
 Return the proof or the exact failed step to the main coding agent, together with the
 input, the visible result, the relevant process status, the evidence locations, the

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -30,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --prefer-offline --yes copilotkit@4.18.0 onboard read fallback/best-effort`.
+`npx --prefer-offline --yes copilotkit@4.19.0 onboard read fallback/best-effort`.
 
 Send one short report. The friction command follows the telemetry setting the developer
 already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.18.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.19.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.18.0",
+  "version": "4.19.0",
   "type": "module",
   "engines": {
     "node": ">=20.9.0"

package/release/release-tool.js

@@ -14760,6 +14760,14 @@ var FLAG_DEFINITIONS = defineFlags({
     defaultByEnv: { dev: true, ci: true, prod: false },
     envVar: "FF_MANAGED_BOTS"
   },
+  "self-hosted.local-evaluation": {
+    purpose: "Gates new local evaluation discovery and license issuance until exact published artifacts pass promotion checks. Installed lifecycle and renewal stay available.",
+    owner: "platform",
+    createdAt: "2026-09-23",
+    status: "rollout",
+    surfaces: ["cli", "ops-api"],
+    defaultByEnv: { dev: true, ci: true, prod: false }
+  },
   "managed-channels": {
     purpose: "Canonical Managed Channels rollout gate, evaluated alongside the legacy FF_MANAGED_BOTS override while deployments migrate.",
     owner: "channels",
@@ -14811,7 +14819,7 @@ var FLAG_DEFINITIONS = defineFlags({
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "70d1f3c0a832d6274e2fe710e24102f6429f14f4" : "main";
+  return true ? "bb299bd0e71963c139b78c5bc9ac0bc0fd6d614f" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts
@@ -15038,7 +15046,8 @@ var TELEMETRY_ERROR_CODES = {
   LOGIN_REPEATED_EXPIRY: "LOGIN_REPEATED_EXPIRY",
   /**
    * An import source's environment is missing a required value or holds one
-   * the importer rejects, such as an unset `MASTRA_IMPORT_AGENT_ID` (PE-397).
+   * the importer rejects, such as an unset `MASTRA_IMPORT_AGENT_ID` (PE-397),
+   * or a Mastra URL that names a file with no Mastra tables (PE-398).
    */
   IMPORT_SOURCE_CONFIG_INVALID: "IMPORT_SOURCE_CONFIG_INVALID"
 };