copilotkit 4.21.0 → 4.23.0

package/onboarding/index.json

@@ -1,5 +1,5 @@
 {
-  "graphTree": "da1c6185427d9e627b0d6a6b6abda10dea05e09a",
+  "graphTree": "a92d5d4a1d73d583df5be10af020eeee9dc84ca9",
   "intentRoots": {
     "add-a2ui": "feature/a2ui/start",
     "add-chat-suggestions": "feature/chat-suggestions/start",
@@ -13,6 +13,7 @@
   "prompts": [
     {
       "edges": [
+        "deployment/choose-local",
         "research/gather",
         "stopped/run-failed"
       ],
@@ -29,6 +30,7 @@
     },
     {
       "edges": [
+        "deployment/local-evaluation",
         "credentials/settle-credentials"
       ],
       "milestone": "credentials",
@@ -43,6 +45,7 @@
         "framework/claude-sdk-python",
         "framework/claude-sdk-typescript",
         "framework/crewai-flows",
+        "framework/custom-ag-ui",
         "framework/deep-agents",
         "framework/langgraph-python",
         "framework/langgraph-fastapi",
@@ -78,6 +81,21 @@
       "milestone": "credentials",
       "name": "credentials/write-plan"
     },
+    {
+      "edges": [
+        "research/gather",
+        "stopped/run-failed"
+      ],
+      "milestone": "deployment",
+      "name": "deployment/choose-local"
+    },
+    {
+      "edges": [
+        "credentials/settle-credentials"
+      ],
+      "milestone": "deployment",
+      "name": "deployment/local-evaluation"
+    },
     {
       "edges": [],
       "milestone": "fallback",
@@ -91,6 +109,13 @@
       "milestone": "feature",
       "name": "feature/a2ui/implement"
     },
+    {
+      "edges": [
+        "feature/a2ui/implement"
+      ],
+      "milestone": "feature",
+      "name": "feature/a2ui/plan"
+    },
     {
       "edges": [
         "feature/stop",
@@ -102,7 +127,7 @@
     {
       "edges": [
         "feature/stop",
-        "feature/a2ui/implement"
+        "feature/a2ui/plan"
       ],
       "milestone": "feature",
       "name": "feature/a2ui/start"
@@ -120,6 +145,13 @@
       "milestone": "feature",
       "name": "feature/channels/implement"
     },
+    {
+      "edges": [
+        "feature/channels/implement"
+      ],
+      "milestone": "feature",
+      "name": "feature/channels/plan"
+    },
     {
       "edges": [
         "feature/stop",
@@ -131,7 +163,7 @@
     {
       "edges": [
         "feature/stop",
-        "feature/channels/implement"
+        "feature/channels/plan"
       ],
       "milestone": "feature",
       "name": "feature/channels/start"
@@ -144,6 +176,13 @@
       "milestone": "feature",
       "name": "feature/chat-suggestions/implement"
     },
+    {
+      "edges": [
+        "feature/chat-suggestions/implement"
+      ],
+      "milestone": "feature",
+      "name": "feature/chat-suggestions/plan"
+    },
     {
       "edges": [
         "feature/stop",
@@ -155,7 +194,7 @@
     {
       "edges": [
         "feature/stop",
-        "feature/chat-suggestions/implement"
+        "feature/chat-suggestions/plan"
       ],
       "milestone": "feature",
       "name": "feature/chat-suggestions/start"
@@ -174,6 +213,13 @@
       "milestone": "feature",
       "name": "feature/learning/implement"
     },
+    {
+      "edges": [
+        "feature/learning/implement"
+      ],
+      "milestone": "feature",
+      "name": "feature/learning/plan"
+    },
     {
       "edges": [
         "feature/stop",
@@ -186,7 +232,7 @@
       "edges": [
         "feature/blocked-by-plan",
         "feature/stop",
-        "feature/learning/implement"
+        "feature/learning/plan"
       ],
       "milestone": "feature",
       "name": "feature/learning/start"
@@ -199,6 +245,13 @@
       "milestone": "feature",
       "name": "feature/open-generative-ui/implement"
     },
+    {
+      "edges": [
+        "feature/open-generative-ui/implement"
+      ],
+      "milestone": "feature",
+      "name": "feature/open-generative-ui/plan"
+    },
     {
       "edges": [
         "feature/stop",
@@ -210,7 +263,7 @@
     {
       "edges": [
         "feature/stop",
-        "feature/open-generative-ui/implement"
+        "feature/open-generative-ui/plan"
       ],
       "milestone": "feature",
       "name": "feature/open-generative-ui/start"
@@ -223,6 +276,13 @@
       "milestone": "feature",
       "name": "feature/realtime-sync/implement"
     },
+    {
+      "edges": [
+        "feature/realtime-sync/implement"
+      ],
+      "milestone": "feature",
+      "name": "feature/realtime-sync/plan"
+    },
     {
       "edges": [
         "feature/stop",
@@ -234,7 +294,7 @@
     {
       "edges": [
         "feature/stop",
-        "feature/realtime-sync/implement"
+        "feature/realtime-sync/plan"
       ],
       "milestone": "feature",
       "name": "feature/realtime-sync/start"
@@ -247,6 +307,13 @@
       "milestone": "feature",
       "name": "feature/rich-threads/implement"
     },
+    {
+      "edges": [
+        "feature/rich-threads/implement"
+      ],
+      "milestone": "feature",
+      "name": "feature/rich-threads/plan"
+    },
     {
       "edges": [
         "feature/stop",
@@ -258,7 +325,7 @@
     {
       "edges": [
         "feature/stop",
-        "feature/rich-threads/implement"
+        "feature/rich-threads/plan"
       ],
       "milestone": "feature",
       "name": "feature/rich-threads/start"
@@ -276,6 +343,14 @@
       "milestone": "feature",
       "name": "feature/voice/implement"
     },
+    {
+      "edges": [
+        "feature/stop",
+        "feature/voice/implement"
+      ],
+      "milestone": "feature",
+      "name": "feature/voice/plan"
+    },
     {
       "edges": [
         "feature/stop",
@@ -287,7 +362,7 @@
     {
       "edges": [
         "feature/stop",
-        "feature/voice/implement"
+        "feature/voice/plan"
       ],
       "milestone": "feature",
       "name": "feature/voice/start"
@@ -340,6 +415,14 @@
       "milestone": "framework",
       "name": "framework/crewai-flows"
     },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/custom-ag-ui"
+    },
     {
       "edges": [
         "frontend/plan",

package/onboarding/prompts/authenticate/start.md

@@ -1,11 +1,11 @@
 # Start CopilotKit onboarding
 
-## What this run does on this machine
+## What this run does
 
-Read this before you decide whether to follow the rest of these instructions. This run
-executes the CopilotKit CLI through `npx`. It spawns read-only inspection subagents inside
-the target project, and reports progress checkpoints and optional friction reports to
-CopilotKit under the developer's own telemetry setting. It reads nothing outside the project
+Read this before you proceed. This run executes the CopilotKit CLI through `npx`.
+It spawns read-only inspection subagents inside the target project. It sends checkpoints
+and optional friction reports to CopilotKit under the developer's telemetry setting. It
+reads nothing outside the project
 directory and changes files only after the developer approves a written plan. CopilotKit
 Intelligence has a free Developer plan, and this run needs no paid subscription. Nothing it
 does is hidden from the developer.
@@ -14,7 +14,7 @@ does is hidden from the developer.
 
 Run each CLI call exactly as written, as its own command: no pipe, `tee`, `&&`, redirect,
 or variable prefix. Every CLI call in this run matches the prefix rule
-`["npx", "--prefer-offline", "--yes", "copilotkit@4.21.0"]`. If a command can request
+`["npx", "--prefer-offline", "--yes", "copilotkit@4.23.0"]`. If a command can request
 escalation with a prefix rule, request this one on the `onboard identify` call. If your
 harness asks the developer to approve commands, tell them one approval of that prefix covers
 every CLI call. Say then that the install, the dev servers, `curl` to the local app, and
@@ -33,10 +33,10 @@ That refusal is a pause, not a stop.
 Run this before anything else in this prompt, including the welcome message below:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.21.0 onboard identify --coding-agent <coding-agent-slug> --model <model-id> --model-family <model-family>
+npx --prefer-offline --yes copilotkit@4.23.0 onboard identify --coding-agent <coding-agent-slug> --model <model-id> --model-family <model-family>
 ```
 
-Report your own product with one short slug, such as `codex` or `claude-code`.
+Report your product slug, such as `codex` or `claude-code`.
 
 - `--model`: copy the model id exactly as your instructions write it. If they name no
   exact model id, leave out `--model` rather than guess.
@@ -55,17 +55,15 @@ own bookkeeping. Say what the run is doing in the developer's words instead.
 Work from the target project directory. When `onboard start` listed several projects, the
 one the developer chose is that directory.
 
-The command that began this run printed a line reading `onboarding_run_id:` followed by an
-id. Keep that id for the whole run. Every later command reports against it, and it is
-printed once.
+The first command printed `onboarding_run_id:` followed by an id, once. Keep it for
+the whole run. Every later command reports against it.
 
-Every later command must run from the directory this run started in. A command run
-somewhere else is refused, because the run it belongs to cannot be found from there. That
-refusal is a step, not a stop to report: run
-`npx --prefer-offline --yes copilotkit@4.21.0 onboard start --run <onboarding_run_id>` where you are
+Every later command must run from the directory this run started in. Elsewhere, the
+command cannot find its run and refuses. Do not report that refusal as a stop. Run
+`npx --prefer-offline --yes copilotkit@4.23.0 onboard start --run <onboarding_run_id>` where you are
 standing, then run the refused command again.
 
-If you no longer hold the id, run `npx --prefer-offline --yes copilotkit@4.21.0 onboard start` in the
+If you no longer hold the id, run `npx --prefer-offline --yes copilotkit@4.23.0 onboard start` in the
 directory this run started in, with no `--run` and no `--intent`. It reprints the id of the
 run under way and starts nothing. An id this project does not already hold starts a second
 run, and the work already done stops counting toward the first.
@@ -95,44 +93,34 @@ round trip, and leave the app running with its URLs. You finish with working sof
 the evidence that it works.
 
 Everything I need from you comes before that approval: sign-in, a few short setup questions,
-and the plan itself. After you approve it, you can walk away. Building and proving the
-integration is the long part of this run, and I work through it without you. You hear from
-me next when the app is running and I hand you its URLs, or when something stops me and I
-tell you what it was.
+and the plan itself. After you approve it, I build and prove the integration, which is the
+long part of this run. If I need you to approve a command, or something blocks me, I will ask
+you here. Otherwise you hear from me next when the app is running and I hand you its URLs.
 
-If your harness makes the developer approve commands before they run, replace "you can walk
-away" through "without you." with: "I will ask you to approve some commands while I build.
-Keep this window open until the app runs." Decide this from your own approval policy, not
-from your coding-agent slug.
-
-That message belongs to the run, not to this prompt. If you already sent it in this run, do
-not send it again, including on a second read of this prompt.
+That message belongs to the run. Send it only once, including after a second read of this prompt.
 
 Telemetry and friction reports follow the CLI telemetry setting the developer controls with
 `copilotkit telemetry` or `DO_NOT_TRACK=1`. Each report is one or two sentences and carries
-no secrets and no source. The feedback commands enforce that setting on every send, so this
-run says so once instead of asking again at each report.
+no secrets and no source. The feedback commands enforce that setting on every send. Explain it once.
 
 ## Where commands run
 
 The directory this run started in is the run root. Every `--path` argument is read against
 it, so one path names one file from anywhere in the project.
 
-One command is deliberately different. `project select` writes the credential into the
-`.env` beside the directory it runs in, because that is the file the application process
-loads. Run it from the directory whose application reads that file. It hoists the project
-record to the repository root by itself and prints where it put it.
+`project select` differs: it writes the credential into the `.env` in its current directory.
+Run it from the directory whose application reads that file. It hoists the project record
+to the repository root and prints its path.
 
 ## Report a stop, wherever it happens
 
 This run reports its own stops. If you stop this run at any point, send one short report
-before you stop. That covers a stop this prompt names, a stop a later prompt names, and a
-stop no prompt anticipated, including one your own harness causes. A turn that ends while
-the run waits is a pause, not a stop, even when your harness ends it. A terminal that sends
-the report itself, or says to file none, overrides this.
+before you stop. This includes unexpected stops and stops caused by your harness.
+A turn that ends while the run waits is a pause, not a stop, even when your harness ends it.
+A terminal that sends the report itself, or says to file none, overrides this.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.21.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.23.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.
@@ -145,9 +133,20 @@ not a failed step. Reword it and send it again, or stop without a report.
 Reporting a stop is not a route change. It does not resume the run or replace what the
 rule that stopped you says next: send the report, then stop.
 
+## Choose where the app stores data
+
+Before sign-in, run `npx --prefer-offline --yes copilotkit@4.23.0 local --help`.
+If it lists candidate setup and no choice exists, offer managed service or local Docker
+evaluation. If it does not, keep the managed path. Existing local recovery still works.
+
+For a local choice, run
+`npx --prefer-offline --yes copilotkit@4.23.0 onboard read deployment/choose-local`.
+It records the choice for new and existing apps, completes sign-in, and starts research.
+For managed service, continue with “Check sign-in”.
+
 ## Check sign-in
 
-Run `npx --prefer-offline --yes copilotkit@4.21.0 login --json` before any project work. This command
+Run `npx --prefer-offline --yes copilotkit@4.23.0 login --json` before any project work. This command
 checks the current session. It starts sign-in only as needed. Treat this as a long-lived
 streaming process. Do not wait for the command to exit before you read its standard output.
 
@@ -160,6 +159,9 @@ Read each JSON Lines record as the running command writes it:
    When that first URL arrives, send this exact message once. Do not send it when the
    existing session is already valid, and do not add a feature list or another explanation:
 
+   For local evaluation, say: “Sign in to get the renewable evaluation license. Your
+   local dashboard will use CLI approval.” For the managed choice, say:
+
    I am opening a sign-in page. Signing in gives this project a managed CopilotKit project
    and its API key. That key is what lets your users reopen past conversations. You can
    remove it later to disconnect this workspace.
@@ -172,7 +174,7 @@ Read each JSON Lines record as the running command writes it:
    them to finish sign-in there. The page works from any device. Your own built-in browser
    does not carry the session the developer already signed in with, so do not use it.
 4. Keep monitoring the same login process. Do not start a second login command.
-5. Continue onboarding only after that same process emits `type: completed`.
+5. Go past the research only after that same process emits `type: completed`.
 6. On `type: failed` with `reason: expired`, ask once whether to retry. If yes, start one
    new `login --json`. Use `--force` only when the developer asks.
 7. If that process emits `type: failed`, report the error and stop onboarding. On
@@ -187,9 +189,11 @@ again and handle a new `authentication_url` as above. Step 4 forbids a second lo
 Do not use `whoami` for this check. Do not put account tokens or credentials in the
 conversation.
 
-When sign-in is settled, run
-`npx --prefer-offline --yes copilotkit@4.21.0 onboard read research/gather`.
+Research reads only this project and needs no account. Start it as soon as the session is
+valid or the developer has the sign-in page, and keep monitoring the login process while it
+runs: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read research/gather`. If this run already
+started the research, do not start it again.
 
 If sign-in stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.21.0 onboard read stopped/run-failed`. It says nothing about
+`npx --prefer-offline --yes copilotkit@4.23.0 onboard read stopped/run-failed`. It says nothing about
 whether this project's stack is supported, which is not yet known at this point.

package/onboarding/prompts/conversion/plan.md

@@ -100,7 +100,7 @@ of this journey, and a drawer that lists nothing is not a reason to mint one. Li
 tokens stay a self-hosted concern.
 
 Where this journey's frontend framework ships no threads drawer -- React Native --, the
-fifth item is proved by `npx --prefer-offline --yes copilotkit@4.21.0 verify --round-trip`, which sends a
+fifth item is proved by `npx --prefer-offline --yes copilotkit@4.23.0 verify --round-trip`, which sends a
 real request and reads the answer back off the thread it landed on. The run says which of
 the two it proved. Do not send a run to the managed Intelligence dashboard to prove this.
 An authenticated browser session at a hosted dashboard is the one thing an agent-driven run
@@ -116,7 +116,7 @@ and passed -- so a run scored on either one was scored on the same fact. Every r
 resolves that condition from, while `licenseStatus` is a compatibility projection of it
 for older thread surfaces and outlives them only until those surfaces go.
 
-Then run `npx --prefer-offline --yes copilotkit@4.21.0 onboard read credentials/finalize-plan`.
+Then run `npx --prefer-offline --yes copilotkit@4.23.0 onboard read credentials/finalize-plan`.
 
 If a selected page does not load after the second method, run
-`npx --prefer-offline --yes copilotkit@4.21.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.23.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/credentials/finalize-plan.md

@@ -1,5 +1,10 @@
 # Select the Intelligence project
 
+For a recorded local choice, run
+`npx --prefer-offline --yes copilotkit@4.23.0 onboard read deployment/local-evaluation`.
+That path obtains approval and connects the local project. Skip hosted selection.
+Keep the implementation and feature-proof requirements.
+
 Use the selected framework, frontend, model vendor, model, documentation URLs, and
 repository findings. On a conversion, use the values the conversion prompt recorded, and
 ask no framework or frontend question. Do not change application code in this phase. Do
@@ -24,7 +29,7 @@ Choose the starting state from the repository findings:
 A run served `proof/oss-baseline` records one of the last two.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.21.0 onboard classify --starting-state <starting-state> --agent-framework <agent-framework> --frontend <frontend>
+npx --prefer-offline --yes copilotkit@4.23.0 onboard classify --starting-state <starting-state> --agent-framework <agent-framework> --frontend <frontend>
 ```
 
 If a value is refused, fix it from the choices the earlier prompts gave, and run the
@@ -37,7 +42,7 @@ runtime `.env` file, that directory is the target, not the repository root. Do n
 the developer to another terminal.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.21.0 onboard credentials --json
+npx --prefer-offline --yes copilotkit@4.23.0 onboard credentials --json
 ```
 
 Every credential this run writes goes to the target's `.env`, the environment path. The
@@ -67,9 +72,9 @@ project from a listing without an answer that names it.
 `--runtime-url` is the URL port research settled, mount path included:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.21.0 onboard credentials --create <name> \
+npx --prefer-offline --yes copilotkit@4.23.0 onboard credentials --create <name> \
   --runtime-url http://localhost:<port>/api/copilotkit --json
-npx --prefer-offline --yes copilotkit@4.21.0 onboard credentials --project <slug-or-id> \
+npx --prefer-offline --yes copilotkit@4.23.0 onboard credentials --project <slug-or-id> \
   --runtime-url http://localhost:<port>/api/copilotkit --json
 ```
 
@@ -79,8 +84,8 @@ command unless the developer asks to see their projects, or `notFound` is presen
 show only what they asked for, and do not order it by creation time:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.21.0 project list --json
-npx --prefer-offline --yes copilotkit@4.21.0 project list --search <query> --json
+npx --prefer-offline --yes copilotkit@4.23.0 project list --json
+npx --prefer-offline --yes copilotkit@4.23.0 project list --search <query> --json
 ```
 
 `app-directory` means that the key landed where no app reads it. Pick the directory in
@@ -95,4 +100,4 @@ the `--project` command from there with `project.slug`. Do not copy or link the
   reused. The round-trip proof later runs the authenticated Intelligence checks, so record
   the reused project credentials as unverified in the plan until those checks pass.
 
-Then run `npx --prefer-offline --yes copilotkit@4.21.0 onboard read credentials/settle-credentials`.
+Then run `npx --prefer-offline --yes copilotkit@4.23.0 onboard read credentials/settle-credentials`.

package/onboarding/prompts/credentials/plan.md

@@ -20,7 +20,7 @@ If the target directory holds no project and the copied prompt came from the Sla
 Microsoft Teams docs page, do not ask the framework question. The Channel starter brings
 its own agent, so an answer here decides nothing. Tell the developer that the Channel
 starter decides the agent, then run
-`npx --prefer-offline --yes copilotkit@4.21.0 onboard read frontend/plan`.
+`npx --prefer-offline --yes copilotkit@4.23.0 onboard read frontend/plan`.
 
 ## Frameworks this machine cannot run yet
 
@@ -42,7 +42,7 @@ things in one message:
 2. That the coding agent's shell reads PATH when it starts, so it cannot see the new
    toolchain until the developer restarts the coding agent.
 3. That the run resumes after the restart with
-   `npx --prefer-offline --yes copilotkit@4.21.0 onboard start --run <onboarding_run_id>`.
+   `npx --prefer-offline --yes copilotkit@4.23.0 onboard start --run <onboarding_run_id>`.
 
 Then end your turn and wait for the developer. That restart is a step here, not an error.
 
@@ -65,6 +65,7 @@ These are the agent frameworks and their default vendors:
 | Claude Agent SDK (Python)          | Anthropic       |
 | Claude Agent SDK (TypeScript)      | Anthropic       |
 | CrewAI Flows                       | Project-defined |
+| Existing AG-UI agent               | The agent's own |
 | Deep Agents                        | OpenAI          |
 | LangGraph FastAPI                  | OpenAI          |
 | LangGraph Python                   | OpenAI          |
@@ -83,9 +84,18 @@ the vendor with the developer: it keeps the one the repository already uses, and
 single question when the repository shows none. Do not read it as a framework this release
 cannot onboard.
 
+"The agent's own" means that the route keeps the vendor the existing agent already uses.
+Ask no vendor question for it.
+
 If the project already has an agent in a listed framework, preserve that framework and
 its model setup. Ask only about choices that remain unknown.
 
+An existing agent that speaks AG-UI, but is none of the other frameworks above, takes the
+Existing AG-UI agent route. For example, an `AbstractAgent` subclass that the project
+wrote, or a service behind AG-UI middleware. Select it only for an agent that the
+repository already has, and only when the findings prove that it speaks AG-UI. Do not
+offer it for a new agent.
+
 If the project needs an agent, show the options and one recommendation based on repository
 evidence. Match the language the repository already uses. Ask the developer to choose.
 
@@ -101,26 +111,27 @@ developer's words instead.
 
 Use exactly one matching internal route:
 
-1. AG2: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/ag2`
-2. Agno: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/agno`
-3. Built-in CopilotKit agent: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/built-in`
-4. Claude Agent SDK Python: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/claude-sdk-python`
-5. Claude Agent SDK TypeScript: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/claude-sdk-typescript`
-6. CrewAI Flows: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/crewai-flows`
-7. Deep Agents: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/deep-agents`
-8. LangGraph Python: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/langgraph-python`
-9. LangGraph FastAPI: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/langgraph-fastapi`
-10. LangGraph TypeScript: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/langgraph-typescript`
-11. LlamaIndex: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/llamaindex`
-12. ADK: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/google-adk`
-13. Microsoft Agent Framework Python: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/ms-agent-python`
-14. Microsoft Agent Framework .NET: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/ms-agent-dotnet`
-15. Mastra: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/mastra`
-16. MS Agent Harness .NET: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/ms-agent-harness-dotnet`
-17. Pydantic AI: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/pydantic-ai`
-18. Strands Agents Python: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/strands-python`
-19. Strands Agents TypeScript: `npx --prefer-offline --yes copilotkit@4.21.0 onboard read framework/strands-typescript`
-
-If the project has an agent in another framework, or no listed framework fits, keep the
-developer's current agent and run
-`npx --prefer-offline --yes copilotkit@4.21.0 onboard read unsupported/no-validated-path`.
+1. AG2: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/ag2`
+2. Agno: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/agno`
+3. Built-in CopilotKit agent: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/built-in`
+4. Claude Agent SDK Python: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/claude-sdk-python`
+5. Claude Agent SDK TypeScript: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/claude-sdk-typescript`
+6. CrewAI Flows: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/crewai-flows`
+7. Existing AG-UI agent: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/custom-ag-ui`
+8. Deep Agents: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/deep-agents`
+9. LangGraph Python: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/langgraph-python`
+10. LangGraph FastAPI: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/langgraph-fastapi`
+11. LangGraph TypeScript: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/langgraph-typescript`
+12. LlamaIndex: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/llamaindex`
+13. ADK: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/google-adk`
+14. Microsoft Agent Framework Python: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/ms-agent-python`
+15. Microsoft Agent Framework .NET: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/ms-agent-dotnet`
+16. Mastra: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/mastra`
+17. MS Agent Harness .NET: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/ms-agent-harness-dotnet`
+18. Pydantic AI: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/pydantic-ai`
+19. Strands Agents Python: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/strands-python`
+20. Strands Agents TypeScript: `npx --prefer-offline --yes copilotkit@4.23.0 onboard read framework/strands-typescript`
+
+If the project has an agent in another framework that does not speak AG-UI, or no
+listed framework fits, keep the developer's current agent and run
+`npx --prefer-offline --yes copilotkit@4.23.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/credentials/settle-credentials.md

@@ -21,23 +21,26 @@ The plan names the model credential variables. Run this from the directory that
 `environmentPath` in the project step's result, with one `--model-key` for each variable:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.21.0 onboard credentials --model-key <variable> --json
+npx --prefer-offline --yes copilotkit@4.23.0 onboard credentials --model-key <variable> --json
 ```
 
 When the framework node names another env file for the credential, add
-`--env-file <file>`. Add one `--path <file>` for each project file the developer changed for the
-credential. The command asks the vendor whether each key can pay for a model call, and it
+`--env-path <file>`. When the agent runs as its own service, such as a remote AG-UI agent,
+that service reads its own env file. Add `--copy-to <service>/.env` for it. The command
+copies the key there and protects that file, so do not copy the key yourself. Add one
+`--path <file>` for each project file the developer changed for the credential. The command asks the vendor whether each key can pay for a model call, and it
 never prints a value. When every key settles, it protects the credential paths. Read
 `status`:
 
 - `ready`: continue. Name each `unsupported` or `undetermined` `reason` in `modelKeys` in
-  the closing report. When `outsideRepository` names a file, the app does not load it by
+  the closing report. Name each `copiedKeys` entry with the outcome `kept` or `no-value`
+  too: that service does not get the checked key. When `outsideRepository` names a file, the app does not load it by
   itself. By default, plan to copy the key into the app's env file, which git ignores.
   This command protects that env file, and the copy is a file the run writes itself, so
   list the copy under `Files the run writes itself`, not under `Authorization requested`.
   The developer's approval of the plan is their consent to the copy. Copy the key without
   printing it. Then record the copy with
-  `npx --prefer-offline --yes copilotkit@4.21.0 onboard protect --accept-credential --path <env file>`. If the developer declines the copy, the plan has the app read the key from an
+  `npx --prefer-offline --yes copilotkit@4.23.0 onboard protect --accept-credential --path <env file>`. If the developer declines the copy, the plan has the app read the key from an
   environment variable that the developer sets. The plan then says how to set it. Never
   write the outside path into a project file, not even in a config file such as
   `langgraph.json`. A committed file that names a folder in the developer's home directory
@@ -46,7 +49,7 @@ never prints a value. When every key settles, it protects the credential paths.
 - `needs-developer` with `question.status` `missing`: ask the developer `question.ask` in
   those words. It offers three answers: another env file in this project, a file outside it,
   or the developer adds the key to `question.envFile`. If they name a file, rerun the command
-  with `--env-file <path>`. If they add the key, rerun it as it is. Do not replace the
+  with `--env-path <path>`. If they add the key, rerun it as it is. Do not replace the
   question with an instruction to paste the value into a file. The key can already be in a
   file that you can point the check at.
 - `needs-developer` with `question.status` `fail`: tell the developer `question.cause`.
@@ -66,4 +69,4 @@ Never read a file outside the project directory to find a credential: a key foun
 bills another project. Asking for a path is not requesting a secret. A path the developer
 names is theirs to give, including one outside the project. A path this run finds is not.
 
-Then run `npx --prefer-offline --yes copilotkit@4.21.0 onboard read credentials/write-plan`.
+Then run `npx --prefer-offline --yes copilotkit@4.23.0 onboard read credentials/write-plan`.