copilotkit 4.20.0 → 4.22.0

package/README.md

@@ -46,6 +46,14 @@ accepts the connection and then sends nothing therefore ends in a message that
 names the command and the wait, rather than in a CLI that never returns. A stall
 is not retried, because retrying it would spend the same wait a second time.
 
+npm 12 refuses a project install when `npm_config_allow_scripts` is set in the
+environment, and exits with `EALLOWSCRIPTS`. The CLI does not retry that refusal.
+It names the variable and prints one command that runs the install without it,
+such as `env -u npm_config_allow_scripts npm install`. The CLI does not remove the
+variable by itself: with no `allow-scripts` setting, npm 12 runs no install
+scripts, so removing it would change which scripts run. To keep the list, move
+it to the `allowScripts` field in `package.json`.
+
 ## Type-safe agent IDs
 
 `copilotkit typegen` reads a running CopilotKit runtime's `/info` route and
@@ -472,6 +480,10 @@ copilotkit init -n my-agent -f langgraph-py \
   same way `copilotkit project select` does: a typo fails with the available
   slugs instead of creating something you did not ask for. A refused value fails
   before `init` writes any file, so you can retry into the same directory.
+- `--dir <path>` builds the app in that directory instead of
+  `<current directory>/<name>`, so the directory the shell is in does not
+  matter. The app takes the directory's name, and `--dir .` builds in the
+  current directory. `--dir` and `--name` cannot be combined.
 - `-y`/`--yes` installs dependencies without asking; `--no-install` answers the
   same question without installing. `--install` is a longhand for `--yes`.
 - `--no-key-prompt` skips the question about a missing model key. Use it where the
@@ -1049,13 +1061,16 @@ own directory — so a key at the repository root is invisible to an app in a
 subdirectory. `verify` reports the two facts separately: **A project API key is
 present** says the credential exists somewhere in this repository, and **The app
 can load the project API key** says the directory the app runs in supplies it.
-The second is `UNKNOWN` rather than `FAIL` wherever it cannot decide: no package
+The second is `WARN` rather than `FAIL` wherever it cannot decide: no package
 declaring a `@copilotkit/*` dependency was found, more than one was, or a script
 in the app — or in any package above it, up to the project root — names an env
-file itself with `dotenv`, `env-cmd`, or `--env-file`. It is also `UNKNOWN` when
-a runtime answered and reported an Intelligence entitlement, because a runtime
+file itself with `dotenv`, `env-cmd`, or `--env-file`. A correctly wired app
+returns these too, so they do not fail the command. It is `UNKNOWN` when a
+runtime answered and reported an Intelligence entitlement, because a runtime
 cannot report one without having loaded a key: the report then names the
 disagreement instead of claiming the app cannot load a key the runtime is using.
+That one still fails the command, because a runtime URL that points at another
+app produces it too.
 
 That last check is the one a passing build cannot give you. A key in `.env`
 proves only that one was provisioned: the runtime reads no environment variable
@@ -1068,9 +1083,17 @@ when the runtime is unreachable.
 Every check reports `PASS`, `FAIL`, or `UNKNOWN`, and `UNKNOWN` never means the
 check passed — an unreachable Intelligence API leaves the API key unproven
 rather than condemning it. `verify` exits non-zero unless every check passed, so
-a caller can branch on the command instead of parsing it. With `--json` the
-payload is the only thing on stdout and every diagnostic goes to stderr, so
-piping is safe.
+a caller can branch on the command instead of parsing it.
+
+The exception is labeled `WARN`: an `undetermined` result that a correctly
+wired app returns too. The report shows it as `WARN`, `--json` names it in
+`warnings` and keeps `ok` true, and the command exits zero. Two checks can warn.
+`api_key_loadable_by_app` warns in the cases above. `page_context_reaches_agent`
+warns when the agent answers without the context value, because a correctly
+wired agent that keeps to its own task answers that way too.
+
+With `--json` the payload is the only thing on stdout and every diagnostic goes
+to stderr, so piping is safe.
 
 Use `--expect-runtime oss` to prove an open-source runtime instead. In this
 mode, hosted project, key, and thread-route checks do not apply. The command
@@ -1545,3 +1568,31 @@ copilotkit import --source langgraph --langgraph-snapshot native.jsonl \
 The destination frontend must register that catalog. This option works with all import sources and applies to every selected conversation; import applications with different defaults separately. Explicit native `catalogId` values and native A2UI operation payloads take precedence. Native tool arguments/results are preserved; the setting only controls reconstructed UI. Without the option, existing replay behavior is unchanged. Invalid empty/whitespace identifiers fail before upload. No catalog is inferred from message prose.
 
 API callers can set `replayConfig: { defaultCatalogId: "copilotkit://app-dashboard-catalog" }` on each normalized conversation. An unchanged source identity is still deduplicated: changing this option does not update an existing import. Use the existing `--replace` workflow to regenerate its imported history, after accounting for any destination changes.
+
+## Claude Managed Agents starter
+
+```bash
+copilotkit init --template claude-managed-agents
+```
+
+The command clones the Claude Managed Agents starter from CopilotKit, creates a Learning Container and runtime key in the selected Intelligence project, installs dependencies, and provisions the Anthropic agent and environment with Ant. The frontend contains the SDK thread drawer and CopilotChat with the Beautiful Chat styles. The Inspector uses the SDK defaults and is available during local development. The generated README covers daily development and links to the component docs. A separate `REFERENCE.md` covers configuration and deployment. New threads bind to the Learning Container; the starter fetches published Skill files through the Intelligence SDK, uploads them to Anthropic, and pins their native versions for each new session. Existing sessions retain their skills.
+
+Requires Node.js 20.19+, Git, npm, Ant, Intelligence Learning access, and a Claude Console workspace with Managed Agents access and credits. Ant owns and refreshes its OAuth credentials; the CLI never copies them into the app. The project runtime key, container ID, and local app-user ID go into gitignored `.env.local` with private file permissions.
+
+Interactive setup asks for the app directory, opens Intelligence login when needed, and uses the existing project picker to select or create a project. If Ant is missing, setup offers to install it with Homebrew or Go when either is available. Otherwise it prints both installation methods and the [Ant installation guide](https://github.com/anthropics/anthropic-cli#installation). Installation must finish with Ant available on `PATH`. Setup opens Ant login when needed and asks before starting the dev server. Between prompts, setup stops reading terminal input so Ant and npm can receive input and Ctrl-C.
+
+Pass `--name my-app` to name the directory, `--project <slug>` to select a project, or `--create "Project name"` to create one. Use `--profile work` for an Ant profile, `--no-dev` to skip the dev-server offer, and `--skip-install` (or `--no-install`) to install app dependencies yourself. The destination must be a new child directory. `copilotkit with-claude [directory]` opens the same setup flow.
+
+For automation, sign in to both services first, then run:
+
+```bash
+copilotkit init --template claude-managed-agents --name my-app --project your-project-slug --yes
+```
+
+With `--yes` or no terminal, setup never opens prompts, installs Ant, or starts the dev server. It requires existing logins and Ant on `PATH`. Without project flags it uses the current directory's selected Intelligence project; without a name it uses `my-claude-app`.
+
+A failed install leaves the configured app in place: run `npm install`, then `npm run agent:apply`, then `npm run dev` there. Failed Ant provisioning can be retried with `npm run agent:apply`. Neither failure prints Ready. A Learning or key error stops setup and reports the remaining step; remote resources are not deleted automatically.
+
+The starter listens on localhost and uses one local developer identity. Before deployment, add verified user authentication, request limits, and durable Managed Agents session mappings. Intelligence thread storage does not replace that adapter mapping.
+
+Release ordering: merge the CopilotKit starter before releasing this command. The shared starter catalog includes `examples/integrations/claude-managed-agents`, so the release source gate rejects a template revision that omits it. The command uses the build-pinned CopilotKit revision, like the existing starters.

package/cli-build-info.json

@@ -2,20 +2,20 @@
   "schemaVersion": 1,
   "package": {
     "name": "copilotkit",
-    "version": "4.20.0"
+    "version": "4.22.0"
   },
   "intelligence": {
-    "commit": "2dd0ade2a238b05e4b84b6317a929b679a6f21fe"
+    "commit": "eb758b6e228f004116a17404e40de14754423fc8"
   },
   "copilotKit": {
-    "submittedInput": "24c969848df0",
-    "commit": "24c969848df0b217144a93a58dcc3564bffa26ee"
+    "submittedInput": "4b51d880eab2",
+    "commit": "4b51d880eab2617e3196285ddcf0e4ff7b34a237"
   },
   "channel": "production",
   "triggeringActor": "BenTaylorDev",
   "workflow": {
-    "runId": "36644626933",
-    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/36644626933"
+    "runId": "36810989756",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/36810989756"
   },
   "validationResult": "passed",
   "ag2": {
@@ -24,5 +24,5 @@
     "revision": "main",
     "pinned": false
   },
-  "builtAt": "2026-09-29T23:21:50Z"
+  "builtAt": "2026-10-01T03:34:23Z"
 }