copilotkit 4.24.0 → 4.25.0

package/README.md

@@ -283,15 +283,22 @@ The CLI prints a page URL that carries an eight-character code, such as
 `WDJB-MJHT`, and prints the code too. Open the URL in a browser on any device
 and sign in if asked. The page opens on the confirmation screen: check that it
 shows the same code and where the request came from, then approve it. You can
-also open the plain page and type the code. The CLI polls until you approve,
-and gives up after 10 minutes.
+also open the plain page and type the code. A code lasts 10 minutes. If
+nobody approves it in time, the CLI prints a new code and keeps polling. It
+does this twice, so it gives up after about 30 minutes.
 
 Under `--json`, the first `authentication_url` record is the URL with the code
-in it, and it also carries `user_code` and `expires_at`. A sign-in that ends without a session writes a `failed`
+in it, and it also carries `user_code` and `expires_at`. A renewed code writes
+another `authentication_url` record, with `renewed: true` and its `renewal`
+number, and another `action_required` record. The old page then shows an
+expired code, so show the developer the new one. A sign-in that ends without a session writes a `failed`
 record with `reason: expired` or `reason: access_denied`, and with
-`retry: ask_developer`: a person must act before a new code can work. After 2
-codes in a row expire with nobody approving them, `login --json` refuses to
-request another. It writes a `failed` record with `reason: repeated_expiry` and
+`retry: ask_developer`: a person must act before a new code can work. If a
+code expired and the request for its replacement failed, for example on a rate
+limit, the record says `reason: renewal_failed` and its `error` names that
+failure. After 2
+sign-ins in a row end with nobody approving any of their codes, `login --json`
+refuses to request another. It writes a `failed` record with `reason: repeated_expiry` and
 exits non-zero. Run `copilotkit login --json --force` when someone is ready to
 approve. Any sign-in that succeeds resets the count, and the count lapses after
 a day.
@@ -387,20 +394,33 @@ frontend.
 Its first prompt records the coding agent with `onboard identify`, including when
 the entry command omitted `--coding-agent`. The agent also passes `--model` with
 the exact model id its instructions name, and leaves it out when they name none.
-It passes `--model-family` with its model family, such as `gpt-5`, for the agent
-that cannot see its exact id. The event records a missing id or family as
-`unknown`, and a value that is not a model, such as a coding-agent product name,
-as `unreportable`. It records the coding agent the environment shows as
+It always passes `--model-family`, picked from a fixed list such as `claude-opus`
+or `gpt-5`. The event reports `coding_agent` and `model_family` normalized to
+fixed lists, so `copilot` and `github-copilot-cli` both read `github-copilot`,
+and keeps what the agent wrote in `coding_agent_raw` and `model_family_raw`. A
+missing family is read from the model id when it names one. The event records a
+missing id or family as `unknown`, a value that is not a model, such as a
+coding-agent product name, as `unreportable`, and a name not on the list as
+`other`. It records the coding agent the environment shows as
 `detected_coding_agent`, and sets `coding_agent_mismatch` when that agent differs
-from the declared one. `cli.onboarding.started` also carries
+from the declared one. The CLI reads the agent from environment variables the
+agent sets. When only markers that leak into child agents are set (`AI_AGENT`,
+`CLAUDECODE`), or several agents' markers are, the nearest parent process that
+is an agent's binary decides. With no marker, it reads the parent processes.
+Set `COPILOTKIT_SKIP_AGENT_PROCESS_PROBE=1` to skip the parent-process walk. It
+sends only the matched agent name, never a path or a command line, and records
+where it found it in `detected_coding_agent_source`. `cli.onboarding.started` also carries
 `detected_coding_agent`, because a run that stops before `onboard identify` sends
 no identify event. It also carries `audience`: `detected-agent` when the
 environment shows an agent, `human-terminal` for a terminal with no detected
 agent, and `non-tty` otherwise. Before sign-in, the first prompt records where the
 app stores data with `onboard deployment --choice <managed|local>`. The
 `cli.onboarding.deployment_chosen` event carries that `deployment` and
-`local_offered`, which this CLI release reads from its local evaluation flag. A
-managed run with `local_offered: false` was never offered local. Channel setup stage events include
+`local_offered`, which this CLI release reads from its local evaluation flag.
+No run is asked to choose, so `local_offered: true` means only that this release
+can run local. A developer who asks for local after the first prompt recorded
+managed sends a second event with `local`, so the last event in a run is its
+choice. Channel setup stage events include
 the existing `onboarding_run_id` when the command runs inside an onboarding run;
 standalone commands omit it. These events use the CLI's existing telemetry consent gate.
 
@@ -1324,6 +1344,31 @@ correctly. Pass what it reads with `--header`, repeatable. `verify` sends
 the header on every request to the runtime, `/info` included, so a runtime
 behind auth needs no local proxy.
 
+### Proving a thread the app created
+
+Some apps refuse a run that `verify` starts: an `identifyUser` that reads a
+signed-in session, or an app that runs only threads it created. For those, send
+one message in the app and pass that thread's id with `--thread`:
+
+```bash
+copilotkit verify --thread <thread-id>
+copilotkit verify --thread <thread-id> --expect-learning-container support-desk
+copilotkit onboard proof-check --thread <thread-id> --json
+```
+
+`--thread` replaces `--round-trip`. It starts no agent run and asks the app for
+no thread. It reads the thread from app-api with the project key, so it needs no session, and
+`--expect-learning-container` checks that same thread. A pass proves that the
+agent's answer was recorded on that thread. It does not prove which end user the
+thread belongs to. A thread app-api does not hold for this project is a `FAIL`.
+Only an answer after the thread's newest user message counts. Inside an
+onboarding run, a thread that did not change after the run started is a `FAIL`,
+because its answer can predate the app as it is now. With `--agent`, a thread
+of another agent is a `FAIL`, and the evidence names the thread's own agent.
+Telemetry marks a proof made this way with `proof_source: app-thread`.
+The page-context check needs a run of its own, so with `--thread` it is a
+warning that names the browser as the place to prove it.
+
 ### What `verify` still does not prove
 
 It does not drive a browser. Realtime delivery to a browser over the gateway,
@@ -1438,10 +1483,16 @@ The command reads the key from the env file (`.env` by default) and sends one
 request with a one-token answer to that vendor. The call costs a fraction of a
 cent. It knows `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, and `GOOGLE_API_KEY`.
 
+When the env file has no real value for the key, the command checks the value
+in the environment instead. A key you export in the shell, or set with direnv or
+`op run`, reaches the dev server the same way. `source` in the JSON says where
+the value came from: `env-file` or `environment`.
+
 - `pass`: the vendor served a model call with the key.
 - `fail`: the vendor refused the key. The cause is `model_quota` (no credits) or
   `model_auth` (a rejected key).
-- `missing`: the env file or the key is absent, or the value is a placeholder.
+- `missing`: neither the env file nor the environment holds a real value for
+  the key.
 - `unsupported` or `undetermined`: the check did not settle it. A rate limit, a
   vendor outage, or a probe model the key may not use proves nothing about the
   key, so none of them is a `fail`.
@@ -1451,6 +1502,10 @@ SDK at another endpoint, or when the shell exports a different value for the
 key. It never prints the key, and it never prints the vendor's error message,
 because a vendor can echo part of the key in it.
 
+During an onboarding run, a `pass` also replaces a `missing` or `fail` that the
+credentials step kept for the same key in the same env file. So after the
+developer fixes the key, `onboard proof-check` runs the round trip again.
+
 ### An onboarding run stops while it selects the project
 
 The onboarding graph settles the project, its key, and the Learning Container
@@ -1724,6 +1779,12 @@ Release ordering: merge the CopilotKit starter before releasing this command. Th
 
 ## Local evaluation candidate setup
 
+Local evaluation is how the CLI offers self-hosting: `init` lists it as
+"Self-hosted: try it on your machine (Docker)". It runs the full stack on the
+developer's machine. The CLI does not install into a cluster; for that, use the
+[self-hosting guide](https://docs.copilotkit.ai/intelligence/self-hosting) and its
+Helm chart.
+
 This preview accepts macOS with Docker Desktop and Linux with rootful Docker Engine.
 The CLI checks daemon identity and refuses unknown engines, rootless Docker, Podman,
 non-Desktop macOS engines, Windows, and Docker Desktop on Linux. The Windows init picker

package/cli-build-info.json

@@ -2,20 +2,20 @@
   "schemaVersion": 1,
   "package": {
     "name": "copilotkit",
-    "version": "4.24.0"
+    "version": "4.25.0"
   },
   "intelligence": {
-    "commit": "414f50da283d14f22e2b350dff662b4b18cb1017"
+    "commit": "9d0e411b31a75cac62342c22a7da942463eaca55"
   },
   "copilotKit": {
-    "submittedInput": "c88a2dd2a4c0",
-    "commit": "c88a2dd2a4c024e956e3f88b6b86d5715951e284"
+    "submittedInput": "1477c8eab6f88833fa93236fe766746c9800a991",
+    "commit": "1477c8eab6f88833fa93236fe766746c9800a991"
   },
   "channel": "production",
   "triggeringActor": "BenTaylorDev",
   "workflow": {
-    "runId": "37064724012",
-    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/37064724012"
+    "runId": "37398681686",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/37398681686"
   },
   "validationResult": "passed",
   "ag2": {
@@ -24,5 +24,5 @@
     "revision": "main",
     "pinned": false
   },
-  "builtAt": "2026-10-02T21:07:52Z"
+  "builtAt": "2026-10-06T01:22:51Z"
 }