copilotkit 4.18.0 → 4.20.0

package/README.md

@@ -242,13 +242,18 @@ copilotkit login --json
 ```
 
 The command prints JSON lines for the sign-in URL, an instruction for the
-machine reader, and the final result. It does not open a browser. Every JSON
-login URL carries the `agent_onboarding` display hint because JSON mode is the
-machine-readable login contract. A machine reader should open the first
-`authentication_url` once with the operating system's default browser, then
-keep reading the same process until its terminal event. If the opener fails,
-show the URL for manual sign-in instead of retrying it. A failed sign-in prints
-one final failure object and exits nonzero.
+machine reader, and the final result. Every JSON login URL carries the
+`agent_onboarding` display hint because JSON mode is the machine-readable login
+contract.
+
+The command opens the page in the default browser itself when a browser can be
+reached. It does not try on CI, over SSH, in a container, on Linux with no
+display, or when `BROWSER=none` is set. A launcher that exits with an error counts
+as not opened, and the CLI does not retry it. The `action_required` record says which
+happened in `browser_opened`. When it is `false`, the machine reader shows the
+URL for manual sign-in. Either way, it keeps reading the same process until its
+terminal event. A failed sign-in prints one final failure object and exits
+nonzero.
 
 After the CLI exchanges the browser token and saves its credentials, the
 agent-onboarding callback page tries to close the tab. If the browser blocks
@@ -342,8 +347,12 @@ frontend.
 Its first prompt records the coding agent with `onboard identify`, including when
 the entry command omitted `--coding-agent`. The agent also passes `--model` with
 the exact model id its instructions name, and leaves it out when they name none.
-The event records a missing id as `unknown`, and the coding agent the environment
-shows as `detected_coding_agent`. `cli.onboarding.started` also carries
+It passes `--model-family` with its model family, such as `gpt-5`, for the agent
+that cannot see its exact id. The event records a missing id or family as
+`unknown`, and a value that is not a model, such as a coding-agent product name,
+as `unreportable`. It records the coding agent the environment shows as
+`detected_coding_agent`, and sets `coding_agent_mismatch` when that agent differs
+from the declared one. `cli.onboarding.started` also carries
 `detected_coding_agent`, because a run that stops before `onboard identify` sends
 no identify event. Channel setup stage events include
 the existing `onboarding_run_id` when the command runs inside an onboarding run;
@@ -1200,7 +1209,9 @@ records a thread, which is why it is opt-in rather than part of the bare command
 `user-not-identified` is reported as `UNKNOWN` rather than `FAIL`. `identifyUser`
 is the project's own code and usually reads a signed-in session, which a CLI
 request does not carry, so an auth-gated app refusing it is that app working
-correctly. Pass what it reads with `--header`, repeatable.
+correctly. Pass what it reads with `--header`, repeatable. `verify` sends
+the header on every request to the runtime, `/info` included, so a runtime
+behind auth needs no local proxy.
 
 ### What `verify` still does not prove
 
@@ -1290,8 +1301,11 @@ project record, it writes nothing and exits non-zero.
 
 An onboarding run protects the record once it selects the project. When the
 bound run protects it, the command moves that baseline with its own write, so
-the next `onboard audit` still passes. It refuses a record that changed since
-the baseline, so a write it did not make is never absorbed.
+the next `onboard audit` still passes. If only the record's `runtimeUrl`
+changed since the baseline, for example by a hand edit after the port moved,
+the command replaces that URL and settles the record. It refuses any other
+change, so a write it did not make is never absorbed. Once the record is
+protected, no other `onboard protect` route accepts a change to it.
 
 ### A model key has no credits or is rejected
 

package/cli-build-info.json

@@ -2,20 +2,20 @@
   "schemaVersion": 1,
   "package": {
     "name": "copilotkit",
-    "version": "4.18.0"
+    "version": "4.20.0"
   },
   "intelligence": {
-    "commit": "3a9266b5fa673a4974ad204d131ed63d5696dc00"
+    "commit": "2dd0ade2a238b05e4b84b6317a929b679a6f21fe"
   },
   "copilotKit": {
-    "submittedInput": "70d1f3c0a832",
-    "commit": "70d1f3c0a832d6274e2fe710e24102f6429f14f4"
+    "submittedInput": "24c969848df0",
+    "commit": "24c969848df0b217144a93a58dcc3564bffa26ee"
   },
   "channel": "production",
   "triggeringActor": "BenTaylorDev",
   "workflow": {
-    "runId": "36480955998",
-    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/36480955998"
+    "runId": "36644626933",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/36644626933"
   },
   "validationResult": "passed",
   "ag2": {
@@ -24,5 +24,5 @@
     "revision": "main",
     "pinned": false
   },
-  "builtAt": "2026-09-28T20:43:08Z"
+  "builtAt": "2026-09-29T23:21:50Z"
 }