copilotkit 4.21.0 → 4.22.0

package/README.md

@@ -46,6 +46,14 @@ accepts the connection and then sends nothing therefore ends in a message that
 names the command and the wait, rather than in a CLI that never returns. A stall
 is not retried, because retrying it would spend the same wait a second time.
 
+npm 12 refuses a project install when `npm_config_allow_scripts` is set in the
+environment, and exits with `EALLOWSCRIPTS`. The CLI does not retry that refusal.
+It names the variable and prints one command that runs the install without it,
+such as `env -u npm_config_allow_scripts npm install`. The CLI does not remove the
+variable by itself: with no `allow-scripts` setting, npm 12 runs no install
+scripts, so removing it would change which scripts run. To keep the list, move
+it to the `allowScripts` field in `package.json`.
+
 ## Type-safe agent IDs
 
 `copilotkit typegen` reads a running CopilotKit runtime's `/info` route and
@@ -472,6 +480,10 @@ copilotkit init -n my-agent -f langgraph-py \
   same way `copilotkit project select` does: a typo fails with the available
   slugs instead of creating something you did not ask for. A refused value fails
   before `init` writes any file, so you can retry into the same directory.
+- `--dir <path>` builds the app in that directory instead of
+  `<current directory>/<name>`, so the directory the shell is in does not
+  matter. The app takes the directory's name, and `--dir .` builds in the
+  current directory. `--dir` and `--name` cannot be combined.
 - `-y`/`--yes` installs dependencies without asking; `--no-install` answers the
   same question without installing. `--install` is a longhand for `--yes`.
 - `--no-key-prompt` skips the question about a missing model key. Use it where the
@@ -1049,13 +1061,16 @@ own directory — so a key at the repository root is invisible to an app in a
 subdirectory. `verify` reports the two facts separately: **A project API key is
 present** says the credential exists somewhere in this repository, and **The app
 can load the project API key** says the directory the app runs in supplies it.
-The second is `UNKNOWN` rather than `FAIL` wherever it cannot decide: no package
+The second is `WARN` rather than `FAIL` wherever it cannot decide: no package
 declaring a `@copilotkit/*` dependency was found, more than one was, or a script
 in the app — or in any package above it, up to the project root — names an env
-file itself with `dotenv`, `env-cmd`, or `--env-file`. It is also `UNKNOWN` when
-a runtime answered and reported an Intelligence entitlement, because a runtime
+file itself with `dotenv`, `env-cmd`, or `--env-file`. A correctly wired app
+returns these too, so they do not fail the command. It is `UNKNOWN` when a
+runtime answered and reported an Intelligence entitlement, because a runtime
 cannot report one without having loaded a key: the report then names the
 disagreement instead of claiming the app cannot load a key the runtime is using.
+That one still fails the command, because a runtime URL that points at another
+app produces it too.
 
 That last check is the one a passing build cannot give you. A key in `.env`
 proves only that one was provisioned: the runtime reads no environment variable
@@ -1068,9 +1083,17 @@ when the runtime is unreachable.
 Every check reports `PASS`, `FAIL`, or `UNKNOWN`, and `UNKNOWN` never means the
 check passed — an unreachable Intelligence API leaves the API key unproven
 rather than condemning it. `verify` exits non-zero unless every check passed, so
-a caller can branch on the command instead of parsing it. With `--json` the
-payload is the only thing on stdout and every diagnostic goes to stderr, so
-piping is safe.
+a caller can branch on the command instead of parsing it.
+
+The exception is labeled `WARN`: an `undetermined` result that a correctly
+wired app returns too. The report shows it as `WARN`, `--json` names it in
+`warnings` and keeps `ok` true, and the command exits zero. Two checks can warn.
+`api_key_loadable_by_app` warns in the cases above. `page_context_reaches_agent`
+warns when the agent answers without the context value, because a correctly
+wired agent that keeps to its own task answers that way too.
+
+With `--json` the payload is the only thing on stdout and every diagnostic goes
+to stderr, so piping is safe.
 
 Use `--expect-runtime oss` to prove an open-source runtime instead. In this
 mode, hosted project, key, and thread-route checks do not apply. The command

package/cli-build-info.json

@@ -2,20 +2,20 @@
   "schemaVersion": 1,
   "package": {
     "name": "copilotkit",
-    "version": "4.21.0"
+    "version": "4.22.0"
   },
   "intelligence": {
-    "commit": "83dc327eb0243ab1d5a74b9fd1496b9f8679d3df"
+    "commit": "eb758b6e228f004116a17404e40de14754423fc8"
   },
   "copilotKit": {
-    "submittedInput": "3dc45f8bdca6665af9b4cc5cecfbcb8ab057e426",
-    "commit": "3dc45f8bdca6665af9b4cc5cecfbcb8ab057e426"
+    "submittedInput": "4b51d880eab2",
+    "commit": "4b51d880eab2617e3196285ddcf0e4ff7b34a237"
   },
   "channel": "production",
-  "triggeringActor": "MikeRyanDev",
+  "triggeringActor": "BenTaylorDev",
   "workflow": {
-    "runId": "36646329163",
-    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/36646329163"
+    "runId": "36810989756",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/36810989756"
   },
   "validationResult": "passed",
   "ag2": {
@@ -24,5 +24,5 @@
     "revision": "main",
     "pinned": false
   },
-  "builtAt": "2026-09-29T23:41:18Z"
+  "builtAt": "2026-10-01T03:34:23Z"
 }