copilotkit 4.19.0 → 4.20.0

package/onboarding/prompts/research/gather.md

@@ -44,7 +44,7 @@ Before you end your turn to wait for the developer where the prompt states no de
 report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase awaiting-developer
+npx --prefer-offline --yes copilotkit@4.20.0 onboard checkpoint --phase awaiting-developer
 ```
 
 When the answer or the result arrives, continue from the step that paused. Do not read an
@@ -64,7 +64,7 @@ Both research subagents failing means this harness has no working subagent at al
 is worth recording once:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase delegation-unavailable
+npx --prefer-offline --yes copilotkit@4.20.0 onboard checkpoint --phase delegation-unavailable
 ```
 
 Then say once, in your own words, that this environment has no working subagents, so you
@@ -77,7 +77,7 @@ Before you ask the developer any setup question, finish every read-only investig
 preflight check in this section.
 
 Prepare two research assignments. Give each research subagent one assignment. Tell it to run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read subagent/inspect-repository` first and follow the
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read subagent/inspect-repository` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Require only its assigned packet.
@@ -88,20 +88,11 @@ Start both research subagents in parallel:
 2. Spawn a second research subagent. Assign it the environment evidence packet.
 3. Start both research subagents. Then continue.
 
-Report that both subagents started:
-
-```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase research-dispatched
-```
-
-A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
-failed step.
-
 The research is under way. Continue to the surface-control preflight while it runs:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard read research/preflight
+npx --prefer-offline --yes copilotkit@4.20.0 onboard read research/preflight
 ```
 
 If inspection stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/merge.md

@@ -18,15 +18,6 @@ whatever holds that port answers.
 
 Project selection is where the settled port is written down, through `--runtime-url`.
 
-Then report that the research came back:
-
-```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase research-returned
-```
-
-A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
-failed step.
-
 Continue only if both research results start with `Status: passed`. For `Status: failed`,
 retry only that packet with its failed items, up to three attempts. For `Status: blocked`,
 or a third failed result, use the stop route at the end of this prompt.
@@ -55,7 +46,7 @@ worker a focused directory check. Continue only when both workers return the sam
 app directory. Both results must start with `Status: passed`. Otherwise, use the stop route.
 
 When both research results are merged, run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read research/route`.
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read research/route`.
 
 If inspection stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/preflight.md

@@ -24,17 +24,11 @@ devDependency and a browser download in the diff of a repository that never aske
 
 Where the device probe found no booted device, that is the whole finding.
 
-Report that the probe settled, whichever way it came out:
-
-```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase surface-probed
-```
-
 Then merge the research:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard read research/merge
+npx --prefer-offline --yes copilotkit@4.20.0 onboard read research/merge
 ```
 
 If inspection stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/route.md

@@ -9,7 +9,7 @@ sends the run down one path.
 Before you route on, run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard protect
+npx --prefer-offline --yes copilotkit@4.20.0 onboard protect
 ```
 
 It reads the working tree itself, records every changed or untracked path with a digest,
@@ -42,7 +42,7 @@ On either, run this before you read the three findings below, and without asking
 purpose question:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard read feature/channels/start
+npx --prefer-offline --yes copilotkit@4.20.0 onboard read feature/channels/start
 ```
 
 Name the provider to that node so it does not ask again. A Slack page names Slack. A Teams
@@ -97,7 +97,7 @@ settle these three from your own reading of the project. Each one comes from the
 packets or it is not proved.
 
 If all three are proved, prove the live starting state before any project file changes. Run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read proof/oss-baseline`.
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read proof/oss-baseline`.
 
 Route there before you ask the developer anything else. The questions after this prompt
 select a framework and a frontend that the findings already name, so a developer who
@@ -110,7 +110,7 @@ developer nor the repository findings prove what the project is for, ask one gui
 question about the user outcome. This asks what the developer wants to build before you
 select a framework. Give two or three short examples. Record the answer and give it to
 each later subagent. Then run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read credentials/plan`.
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read credentials/plan`.
 
 Do not ask that question on the route above. A project carrying all three states its
 purpose in the application it already serves.
@@ -124,5 +124,5 @@ A purpose question here names a domain before that choice.
 Take the same read named above without asking.
 
 If authentication, inspection, or the baseline capture stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`. None of them says anything
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read stopped/run-failed`. None of them says anything
 about whether this project's stack is supported, which is not yet known at this point.

package/onboarding/prompts/starter/clone.md

@@ -55,7 +55,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --prefer-offline --yes copilotkit@4.19.0 project list --json`
+`npx --prefer-offline --yes copilotkit@4.20.0 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -82,7 +82,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument. If the directory name holds a space, put it in double quotes.
 
-`npx --prefer-offline --yes copilotkit@4.19.0 init --name <directory-name> --framework <framework-id> --channel none --no-banner --no-key-prompt --create <name> --install`
+`npx --prefer-offline --yes copilotkit@4.20.0 init --name <directory-name> --framework <framework-id> --channel none --no-banner --no-key-prompt --create <name> --install`
 
 `--name` is always the target directory name derived above, because `init` creates the
 app at `<parent>/<name>`. Any other value puts the app in a new folder beside the target,
@@ -105,16 +105,6 @@ The command clones the starter into the empty target directory. It also connects
 starter to the developer's Intelligence project. The earlier login phase supplies the
 account. The command does not need terminal input.
 
-Report the clone before you inspect anything:
-
-```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase starter-cloned
-```
-
-This is its own step, not an aside. A run that clones and then goes quiet is
-indistinguishable from a run that never cloned, and the checkpoint is the only thing that
-separates them.
-
 Do not rebuild the starter by hand. Then inspect only the generated
 paths inside the target directory. Record the files, install result, project connection,
 and validation commands.
@@ -153,7 +143,7 @@ When you ask, name each variable and the file it goes in, and say that the run c
 when they reply or resume this session. Then report the pause and end your turn:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard checkpoint --phase awaiting-model-credential
+npx --prefer-offline --yes copilotkit@4.20.0 onboard checkpoint --phase awaiting-model-credential
 ```
 
 This is a pause, not a stop. Do not send a stop report, and do not take a stop route.
@@ -164,10 +154,10 @@ call.
 
 If no credential is missing, report no pause and continue.
 
-Then run `npx --prefer-offline --yes copilotkit@4.19.0 onboard read proof/round-trip`.
+Then run `npx --prefer-offline --yes copilotkit@4.20.0 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read stopped/run-failed`. The starter is one this
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read stopped/run-failed`. The starter is one this
 graph ships and the stack was chosen from its own supported list, so a command that
 returned an error is a run that broke, not a setup this release does not support.

package/onboarding/prompts/stopped/run-failed.md

@@ -41,7 +41,7 @@ put to them, stop here and send the report below.
 If they approve it, make that one fix and nothing else. Then come back into this run:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard resume --message "<approval>"
+npx --prefer-offline --yes copilotkit@4.20.0 onboard resume --message "<approval>"
 ```
 
 Put the developer's approval in `--message`, in one or two sentences: the fix they
@@ -64,7 +64,7 @@ Send one short report. The friction command follows the telemetry setting the de
 already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.20.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped

package/onboarding/prompts/subagent/create-plan.md

@@ -183,9 +183,24 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --prefer-offline --yes copilotkit@4.19.0 verify --round-trip`, which needs no browser. Do not plan a
+`npx --prefer-offline --yes copilotkit@4.20.0 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
+## Name the files the run writes itself
+
+List these in the plan under `Files the run writes itself`, apart from the implementation
+steps. They are not steps, and they need no authorization. A developer who approved a plan
+without them reads each one later as a change they never agreed to.
+
+- Each `planChanges` entry from `onboard credentials`: the project key in `.env`, the
+  project record, and, where it lists `ignore-entries`, the lines `project select` adds to
+  `.gitignore` so that no `.env` file can be committed.
+- `.copilotkit/proof/`, where the proof writes its evidence. It holds no source. The
+  developer can delete it after the run.
+- The CopilotKit Skills, as a line the developer approves or declines:
+  `npx skills add CopilotKit/CopilotKit/skills -y`. It writes `.agents/skills/` and links
+  it into `.claude/skills/`. Both sit in the working tree and show up in `git status`.
+
 ## Order the plan into steps
 
 Create one ordered list of implementation steps. For each step, name the outcome, the exact

package/onboarding/prompts/subagent/inspect-repository.md

@@ -7,7 +7,7 @@ Work only on the packet you were assigned. Inspect the repository without changi
 Run this first, from the target project directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard inspect --json
+npx --prefer-offline --yes copilotkit@4.20.0 onboard inspect --json
 ```
 
 It answers the deterministic half of both packets exactly, from the same code

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -32,7 +32,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --prefer-offline --yes copilotkit@4.19.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --prefer-offline --yes copilotkit@4.20.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -135,7 +135,7 @@ is taken moves to the next free one without asking. Where the runtime runs as a
 its own, this is the runtime's port, not the frontend's.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard runtime-url --url <runtime-url>
+npx --prefer-offline --yes copilotkit@4.20.0 onboard runtime-url --url <runtime-url>
 ```
 
 `<runtime-url>` is the Step 1 runtime URL with its port replaced by the port that server
@@ -185,7 +185,7 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --prefer-offline --yes copilotkit@4.19.0 verify --json`. It reads the port from this project, so a
+`npx --prefer-offline --yes copilotkit@4.20.0 verify --json`. It reads the port from this project, so a
 non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
 `runtimeUrlSource` of `default` means nothing in the project named a port, so the Step 2
 record is missing. Run the Step 2 `onboard runtime-url` command, then run `verify` again. Read the individual checks rather than
@@ -223,7 +223,7 @@ named no port the CLI can read: keep step 2's URL, and rewrite its host as `loca
 before you use it.
 
 Then run the command once more with the URL you are about to open:
-`npx --prefer-offline --yes copilotkit@4.19.0 verify --frontend-url <that url> --json`. The
+`npx --prefer-offline --yes copilotkit@4.20.0 verify --frontend-url <that url> --json`. The
 `frontend_assets_served` check asks that server for its page and for one of the page's own
 assets, on that exact host. A `fail` there means the dev server refuses its own static
 assets on the host you were about to use, and the check names the URL to use instead. This
@@ -231,7 +231,7 @@ is the cheapest step that can save the most expensive one, so run it before the
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --prefer-offline --yes copilotkit@4.19.0 verify --round-trip --json`. It sends one request through
+Run `npx --prefer-offline --yes copilotkit@4.20.0 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -245,15 +245,18 @@ entry, so route on each entry's own `status` rather than on the exit status. Whe
 frontend's files call a context hook, one entry has the `id` `page_context_reaches_agent`:
 
 - `pass` proves that the agent's model sees context the page sends.
-- `fail` is a defect: context the page sends never reaches the model. Return it with its
-  evidence as a failed proof step.
-- `undetermined` means the context round trip did not complete. Record it and continue.
+- `fail` is a defect: the agent answered the plain request and recorded nothing for the
+  request that carried context. Return it with its evidence as a failed proof step.
+- `undetermined` means the context round trip did not complete, or the agent answered
+  without the value. An agent scoped to its own task declines to repeat an arbitrary value
+  even when the context reaches its model, so this is not a defect. Record it, and prove
+  the path in Step 5a.
 
 Where this run settled a Learning Container, add the flag to the call above rather than
 running a second round trip:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 verify --round-trip --expect-learning-container <container id> --json
+npx --prefer-offline --yes copilotkit@4.20.0 verify --round-trip --expect-learning-container <container id> --json
 ```
 
 The check reads the thread that this run created, so a second round trip proves a second
@@ -287,7 +290,7 @@ the credential was written holds an empty key while the file beside it carries t
 one. Run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard env-staleness
+npx --prefer-offline --yes copilotkit@4.20.0 onboard env-staleness
 ```
 
 A `stale` line names the env file and how long after launch it was written. Report that,
@@ -303,7 +306,7 @@ environment on to every process it starts, so a provider base URL exported for t
 reaches the dev servers. Run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard inspect --json
+npx --prefer-offline --yes copilotkit@4.20.0 onboard inspect --json
 ```
 
 Read `providerEndpoints` for the app directory. An entry with a `null` `source` came from
@@ -314,13 +317,14 @@ edit a project file to answer it: the value lives in the shell, not in the proje
 
 ### Step 5a -- Prove that the page's data reaches the model
 
-`verify --round-trip` asks a question that needs no context. Where the frontend's files call
-a context hook, it also sends one token as context and reports
-`page_context_reaches_agent`, which proves that the agent's model sees context at all. It
-does not prove that the page's own entries arrive in the shape the agent reads. Nothing
-else before the browser reads that path, so a page whose data the agent never sees answers
-fluently over a record it invented, and the first thing to notice is a card in a
-screenshot.
+`verify --round-trip` asks a question that needs no context. Where the frontend's files
+call a context hook, it also sends one token as context and reports
+`page_context_reaches_agent`, whose `pass` proves that the agent's model sees context at
+all. An agent scoped to its own task answers without the token, so that check is often
+`undetermined`, and this step is then the only proof of the path. A `pass` does not prove
+that the page's own entries arrive in the shape the agent reads. Nothing else before the
+browser reads that path, so a page whose data the agent never sees answers fluently over a
+record it invented, and the first thing to notice is a card in a screenshot.
 
 Where this journey shares page data with the agent, prove that path here. Read the context
 entries this project's frontend publishes, from its own context call. Read the tool
@@ -392,7 +396,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --prefer-offline --yes copilotkit@4.19.0 verify --round-trip`, which reads the
+that thread with `npx --prefer-offline --yes copilotkit@4.20.0 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. That finding
@@ -420,7 +424,7 @@ limit can be ten minutes. You cannot interrupt a call while it runs, so the limi
 what you do after one. If a browser call took longer than 60 seconds to return, the browser
 control is unresponsive. Do not call the browser again in this attempt. A second call to a
 hung tool waits as long as the first one did. Run
-`npx --prefer-offline --yes copilotkit@4.19.0 verify --frontend-url <the url step 4 resolved> --json` once,
+`npx --prefer-offline --yes copilotkit@4.20.0 verify --frontend-url <the url step 4 resolved> --json` once,
 and record the `frontend_assets_served` result. Report the outcome `failed` with the cause
 `browser-control-unresponsive`. The application is not at fault on this evidence: every
 step before the browser proved the runtime without one, and no repair to the project can
@@ -430,7 +434,7 @@ reach the tool.
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --prefer-offline --yes copilotkit@4.19.0 verify --frontend-url <the url you opened> --json`
+   `npx --prefer-offline --yes copilotkit@4.20.0 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.
@@ -548,6 +552,10 @@ Tell the developer what the skills install writes into this project before you r
 and can land in a commit. You cannot know whether this project keeps those directories in
 version control, so name them before you write them rather than after.
 
+Install the Skills only when the approved plan includes them. Where the developer declined
+them, do not install them, and do not call that a change from the plan. Report the command
+for them to run later instead: `npx skills add CopilotKit/CopilotKit/skills -y`.
+
 Use it to install the project-scoped CopilotKit Skills. Do not register an MCP server: the
 Skills read the CopilotKit documentation without one.
 

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -30,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --prefer-offline --yes copilotkit@4.19.0 onboard read fallback/best-effort`.
+`npx --prefer-offline --yes copilotkit@4.20.0 onboard read fallback/best-effort`.
 
 Send one short report. The friction command follows the telemetry setting the developer
 already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.19.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.20.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.19.0",
+  "version": "4.20.0",
   "type": "module",
   "engines": {
     "node": ">=20.9.0"

package/release/release-tool.js

@@ -14819,7 +14819,7 @@ var FLAG_DEFINITIONS = defineFlags({
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "bb299bd0e71963c139b78c5bc9ac0bc0fd6d614f" : "main";
+  return true ? "24c969848df0b217144a93a58dcc3564bffa26ee" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts