copilotkit 4.24.0 → 4.25.0

package/onboarding/prompts/frontend/react-native.md

@@ -2,6 +2,13 @@
 
 Preserve an existing React Native frontend. Use the selected page for a new frontend.
 
+This step asks the developer nothing. If the run must wait for the developer anyway, report
+the pause first:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
 React Native has no starter. For a target directory that holds no project, build the new
 frontend from the documentation below.
 
@@ -18,7 +25,7 @@ documents `useRenderTool`, which is React Native's own hook for drawing a tool t
 already has. That is a different job and needs a tool in the agent.
 
 If the pages support the selection, record React Native and these URLs. Then run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read credentials/finalize-plan`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-spa.md

@@ -2,6 +2,13 @@
 
 Preserve an existing React SPA. Use the selected page for a new frontend.
 
+This step asks the developer nothing. If the run must wait for the developer anyway, report
+the pause first:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
 React SPA has no starter. For a target directory that holds no project, build the new
 frontend from the documentation below.
 
@@ -14,7 +21,7 @@ not move the agent into it.
 - https://docs.copilotkit.ai/react-spa.md
 
 If the page supports the selection, record React SPA and this URL. Then run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read credentials/finalize-plan`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/vue.md

@@ -2,6 +2,13 @@
 
 Preserve an existing Vue 3 frontend. Use the selected page for a new frontend.
 
+This step asks the developer nothing. If the run must wait for the developer anyway, report
+the pause first:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
 Vue 3 has no starter. For a target directory that holds no project, build the new
 frontend from the documentation below.
 
@@ -19,7 +26,7 @@ page above. Vue has its own `useComponent`, which is not the React package. Take
 that reference page rather than from a Vue generative-UI guide, which is not published.
 
 If the pages support the selection, record Vue 3 and these URLs. Then run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read credentials/finalize-plan`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/implementation/build-and-validate.md

@@ -12,7 +12,7 @@ acted on. Send one short report before you stop. The friction command follows th
 setting the developer already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.25.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.
@@ -49,6 +49,13 @@ spawn a fresh implementation subagent with the same handoff. Add that file to th
 as a path the developer approved, and record it as a departure. If you cannot ask, or the
 developer declines, the failure ending in the route-out rules below applies.
 
+This prompt pauses for the developer in several places. Before you end your turn to wait
+for the developer, report the pause:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
 The existing agent's behavior is never a departure to record and carry on from. It is four
 things: its system prompt and instructions, its tools and what those tools do, its model
 and provider configuration, and its memory or state handling. Repair a failing check on
@@ -60,6 +67,12 @@ change is a behavior change, and the closing report names it as one. Never call
 to the agent's instructions or tools a repair. If you cannot ask, or the developer
 declines, use the route-out rules below.
 
+Before you end your turn to wait for the developer, report the pause:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
 ## Authorization requested by the plan
 
 Approving the plan is the developer agreeing to every path it listed under
@@ -67,7 +80,7 @@ Approving the plan is the developer agreeing to every path it listed under
 app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard protect --authorize --path <path> --reason "<the plan's sentence>"
+npx --prefer-offline --yes copilotkit@4.25.0 onboard protect --authorize --path <path> --reason "<the plan's sentence>"
 ```
 
 Consent has to be on the record before the file moves, so a call made after the change is
@@ -101,7 +114,7 @@ No implementation step has run yet, so the change is theirs rather than this run
 consent over it by adding one flag:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard protect --authorize --path <path> --reason "<the plan's sentence>" --with-prior-change
+npx --prefer-offline --yes copilotkit@4.25.0 onboard protect --authorize --path <path> --reason "<the plan's sentence>" --with-prior-change
 ```
 
 The flag records their change as drift beside the consent, so the closing report names both
@@ -116,12 +129,18 @@ to record for a path that comes up later. If you find such a path mid-run, ask t
 developer and record their answer with `--authorize --unplanned`, as the protected-path
 audit below describes, rather than use this section.
 
+Before you end your turn to wait for the developer, report the pause:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
 ## Protected-path audit
 
 Run the audit from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard audit
+npx --prefer-offline --yes copilotkit@4.25.0 onboard audit
 ```
 
 It compares every protected path with the digest the CLI captured for it. Its result starts
@@ -156,14 +175,14 @@ A path that no Files changed section names changed outside the run, and it is th
 developer's own file. Accept it by name:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard protect --accept-external --path <path>
+npx --prefer-offline --yes copilotkit@4.25.0 onboard protect --accept-external --path <path>
 ```
 
 A changed env file is its own case. This run asked the developer to place a credential
 there, so it takes the credential route rather than this one:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard protect --accept-credential --path <path>
+npx --prefer-offline --yes copilotkit@4.25.0 onboard protect --accept-credential --path <path>
 ```
 
 That route proves no recorded credential was lost, instead of taking the run's word that it
@@ -179,10 +198,16 @@ The prohibition on repairing a protected path holds wherever the path comes up,
 here. A failing check is the usual way it comes up: the diagnosis lands on a file, and the
 file turns out to be protected. A correct diagnosis does not make the file this run's, and
 neither does a one-line fix. Never repair, reset, or revert it. Ask the developer to allow
-the change, and record the answer they give:
+the change. Before you end your turn to wait for the developer, report the pause:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
+Record the answer they give:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"
+npx --prefer-offline --yes copilotkit@4.25.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"
 ```
 
 Use it only for an answer a developer actually gave. It records the consent as taken
@@ -217,7 +242,7 @@ directory. The developer approved the id before it was made, so this is the firs
 which it can be created:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 learning containers create --id <id> --name <name> --json
+npx --prefer-offline --yes copilotkit@4.25.0 learning containers create --id <id> --name <name> --json
 ```
 
 Pass the id the plan names. Take the name from the selected project's own display name, so
@@ -234,16 +259,17 @@ plan names no container, skip this section.
 ## Implement the plan
 
 Spawn one implementation subagent. Tell it to run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read subagent/implement-and-validate` first and follow
-the prompt it returns. If that read fails because the subagent cannot use the shell, stop that
-subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
-and the same handoff. Give it the plan, selected framework, frontend, model, exact target app
-directory, selected documentation URLs, and the
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read subagent/implement-and-validate` first and
+follow the prompt it returns. Tell it to return at once, and say so, if that read is refused
+or fails, and not to wait for an approval. If it returns that way, stop that subagent. Run
+the same command yourself, then spawn a fresh subagent with the returned prompt and the same
+handoff. Give it the plan, selected framework, frontend, model, exact target app directory,
+selected documentation URLs, and the
 documentation policy recorded during framework selection or conversion planning. On a
 conversion, also give it the frozen criterion. Give it the protected path list and the
 authorized list. Give it the developer's answer on the Skills install, so that it runs an
-approved install and skips a declined one. Require it
-to implement every step in plan order and run the full validation list. Wait for it.
+approved install and skips a declined one. Require it to implement every step in plan order
+and run the full validation list. Wait for it.
 
 One subagent implements the whole plan. Do not divide the work across concurrent subagents,
 and do not spawn a second subagent to reconcile a split.
@@ -262,7 +288,7 @@ names the same way as above, against the Files changed section that subagent jus
 returned. Continue to proof only when that audit passes.
 
 Then run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read proof/round-trip`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read proof/round-trip`.
 
 ## Repair rules
 
@@ -288,9 +314,9 @@ the same command still fails after three repair attempts, a result starts with
 declined a file the plan does not name, or the run cannot ask them about it. A defect in a
 package this run installed is not a stack CopilotKit does not serve, a command this run cannot get to pass is not one either, and a blocked audit
 proved nothing about the stack. In those cases run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read stopped/run-failed`.
 
 A plan with no path to follow takes the unsupported ending: the fix requires changing the
 developer's existing agent or frontend, or the documentation does not support the plan. In
 those cases run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read unsupported/no-validated-path`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/proof/complete.md

@@ -24,7 +24,7 @@ friction commands follow the telemetry setting the developer already chose, so t
 separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard friction --category <slug> --cost-seconds <seconds> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.25.0 onboard friction --category <slug> --cost-seconds <seconds> --message "<sentences>"
 ```
 
 Put one or two sentences in `--message`. Pick one category from docs-missing, docs-wrong,
@@ -46,7 +46,7 @@ Pass the surface-check outcome the proof subagent returned, not the one you want
 web frontend, pass `--visual-check` and the URL the browser opened, unchanged:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard complete --visual-check <outcome> \
+npx --prefer-offline --yes copilotkit@4.25.0 onboard complete --visual-check <outcome> \
   --frontend-url <the url you opened>
 ```
 
@@ -74,7 +74,7 @@ this graph opens.
 nothing drove the frontend:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard complete --visual-check failed --blocked-by browser-control-unresponsive
+npx --prefer-offline --yes copilotkit@4.25.0 onboard complete --visual-check failed --blocked-by browser-control-unresponsive
 ```
 
 ## Write the handoff

package/onboarding/prompts/proof/oss-baseline.md

@@ -1,10 +1,11 @@
 # Prove the existing OSS baseline
 
 Do not prove the baseline yourself. Spawn one proof subagent. Tell it to run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read subagent/prove-oss-baseline` first and follow the
-prompt it returns. If that read fails because the subagent cannot use the shell, stop that
-subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
-and the same handoff. Give it the repository findings and exact CLI package spec.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read subagent/prove-oss-baseline` first and follow
+the prompt it returns. Tell it to return at once, and say so, if that read is refused or
+fails, and not to wait for an approval. If it returns that way, stop that subagent. Run the
+same command yourself, then spawn a fresh subagent with the returned prompt and the same
+handoff. Give it the repository findings and exact CLI package spec.
 
 Give it the browser or device control you recorded in the preflight as well. The subagent
 proves the runtime from a shell and needs no browser for that. The control is for the one
@@ -17,7 +18,7 @@ Wait for the subagent to finish.
 Record what that proof returned before you route on it:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
+npx --prefer-offline --yes copilotkit@4.25.0 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
 ```
 
 Report the gate whatever it returned. Use the list below. A proof that never ran is `skipped`, not failed. The command prints one line and sends
@@ -39,14 +40,27 @@ Do not change project files before this proof ends. Starting existing developmen
 processes and their ignored runtime files is allowed.
 
 If the subagent proves the `both-oss` predicate, keep its evidence with the plan and run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read conversion/plan`. That project already works.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read conversion/plan`. That project already works.
 What it needs is the conversion, not a build.
 
-If the proof does not establish the baseline, record the starting state
+A failed baseline does not end the run, and this step does not repair it. Decide which
+kind of failure it is before you route, the way `proof/round-trip` does.
+
+An operational failure says nothing about the project: a project-owned process or port, a
+request option, or a sandbox that blocked a local request. Spawn a fresh proof subagent
+with the same handoff and the failure evidence, and record each attempt as it ends. Run
+the proof at most three times in total. Never edit a project file to make the baseline
+pass. This proof only reads.
+
+A failed baseline whose cause is in the project is the starting state of this project. So
+is an operational failure still there after the third attempt. Record the starting state
 `both-copilotkit-unproved` and run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read credentials/plan`. This prompt is served
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read credentials/plan`. This prompt is served
 whenever a project looks like an OSS integration, so a baseline that did not prove is an
-ordinary starting state rather than a failure. Keep the failing predicate with the plan.
+ordinary starting state rather than a failure. The build that follows fixes the
+integration, and `proof/round-trip` proves the result, with its own bounded repair cycle.
+Keep the failing predicate and the check the subagent named with the plan, and tell the
+developer that the existing integration did not prove before you ask for plan approval.
 
 Do not record a state that says the CopilotKit integration is absent. This prompt is
 reached only when the merged findings prove that the integration is there, so `both` is
@@ -56,7 +70,10 @@ Where the proof fails predicate 3, the live runtime already holds an Intelligenc
 client. Say so in the plan. Part of the work this run exists for is in place already,
 and the plan preserves it rather than repeating it.
 
-If it cannot identify the running process safely, exposes a secret, or finds a baseline
-failure that cannot be classified, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read stopped/run-failed`. None of those mean the
-project is unsupported: they mean this run did not establish what it needed to.
+If you cannot tell whether the cause is operational or in the project, treat it as
+operational. Run the proof again, three times in total, then record the starting state
+above and go on. Both causes lead to the same plan.
+
+If the proof cannot identify the running process safely, or it exposes a secret, run
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read stopped/run-failed`. Neither means the
+project is unsupported: each means this run did not establish what it needed to.

package/onboarding/prompts/proof/round-trip.md

@@ -1,14 +1,15 @@
 # Prove the user journey
 
 Do not do the proof work yourself. Spawn one proof subagent. Tell it to run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read subagent/prove-round-trip` first and follow the
-prompt it returns. If that read fails because the subagent cannot use the shell, stop that
-subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
-and the same handoff. Give it the selected framework, frontend, model, approved plan, selected
-documentation URLs, and validation evidence. Give it the documentation policy recorded during
-framework selection or conversion planning. On a conversion, also give it the frozen
-criterion. Give it the protected path list. Give it the developer's answer on the Skills
-install and the Skills result the implementation returned.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read subagent/prove-round-trip` first and follow the
+prompt it returns. Tell it to return at once, and say so, if that read is refused or fails,
+and not to wait for an approval. If it returns that way, stop that subagent. Run the same
+command yourself, then spawn a fresh subagent with the returned prompt and the same handoff.
+Give it the selected framework, frontend, model, approved plan, selected documentation URLs,
+and validation evidence. Give it the documentation policy recorded during framework
+selection or conversion planning. On a conversion, also give it the frozen criterion. Give
+it the protected path list. Give it the developer's answer on the Skills install and the
+Skills result the implementation returned.
 
 Give it the frontend files that publish the page context and register the tools, by path,
 from the Files changed sections the implementation returned. The subagent sends what those
@@ -40,7 +41,7 @@ pass the time.
 Record what that proof returned before you route on it:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard proof --step round-trip --outcome <passed|failed|skipped>
+npx --prefer-offline --yes copilotkit@4.25.0 onboard proof --step round-trip --outcome <passed|failed|skipped>
 ```
 
 Report the gate whatever it returned. A proof that never ran is `skipped`, not failed. A
@@ -49,7 +50,7 @@ to record it as `skipped`. The command prints one line and sends nothing else. W
 record each attempt as it ends.
 
 For every protected-path audit in this prompt, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard audit` from the target app directory. If its result
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard audit` from the target app directory. If its result
 starts with `Status: blocked`, report the printed reason and use the route-out rules below.
 A blocked audit proved nothing changed and is not a preservation failure. If a
 protected-path audit reports a changed path, decide it the way the implementation prompt
@@ -58,7 +59,7 @@ returns none, so a finding with no Files changed section to test against routes
 path one of those sections names is this run's own change and routes out too. Accept a
 path only when a section this run collected covers the step that wrote it and does not
 name it:
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard protect --accept-external --path <path>`. Then run
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard protect --accept-external --path <path>`. Then run
 the audit again and name the path in the closing summary. Never repair, reset, or revert a
 protected path.
 
@@ -66,12 +67,19 @@ That holds for a repair cycle too. When the fix for a failing check lands on a p
 path, the path is still the developer's, however right the diagnosis is and however small
 the fix. Reading the file never settles who wrote it. Ask the developer to allow the
 change, and record their answer with
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
 or route out. Never repair it, and never send it to a repair worker.
 
+This prompt pauses for the developer in several places. Before you end your turn to wait
+for the developer, report the pause:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
 If the proof result starts with `Status: passed`, run the protected-path audit. Continue to
 `proof/complete` only if that audit passes. After the audit passes, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read proof/complete`. A performed surface outcome with
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read proof/complete`. A performed surface outcome with
 the full round trip is core success even if a continued-development tool fails. A skipped
 surface outcome still enters `proof/complete`. The CLI records `skipped-cloned-starter` and
 `skipped-no-browser-tool` after a passed round trip as complete, and `skipped-no-device` as
@@ -93,6 +101,15 @@ not for a journey that worked and then hit a wall: routing a proved run there te
 developer that a framework and frontend that just worked are unsupported, and hands them a
 stop report instead of the application they now have.
 
+If the proof returns a `model-key` failure, it is not a defect in the new work. The
+credentials step found the model key missing, or the vendor refused it, and the proof
+started nothing. Do not send it to a repair worker. Run the `onboard credentials` command
+that its detail names, and act on its answer as `credentials/settle-credentials` says. Ask
+the developer its question, report the pause with
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-model-credential`, and
+end your turn. When the key settles, run the proof subagent again. This attempt does not
+count toward the three.
+
 If the round trip fails, decide which kind of failure it is before you route. The proof
 subagent can repair only project-owned processes, ports, and request options, and it can
 run the credential command that `verify:api_key_loadable_by_app` names. A failure caused
@@ -103,7 +120,21 @@ Retry the proof subagent only for a project-owned process, port, request-option,
 Give it the failure evidence and the failed attempt's pinned Step 1 record. Wait for the
 proof subagent after each operational repair.
 If the result passes, use the passed-result route above. Run the proof at most three times
-in total. Use the route-out rules below for a blocked or third failed result.
+in total. Use the route-out rules below for a third failed result, and for a blocked result
+other than the one in the next paragraph.
+
+A proof result can start with `Status: blocked` on `round-trip:agent_answers`: the app
+refused the run the check started, because it reads a session or runs only threads it
+created, and the subagent cannot send a message in the app itself. The app is not at
+fault, so this is not a route-out. Ask the developer to send one message in the app on a new
+thread, and to give you that thread's id. Give them the app URL and the request words from
+the result. Tell them where the id is: in the browser's network tools, the request the page
+sends to the runtime URL carries `threadId` in its body. Report the pause with
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer` and end your
+turn. When the developer gives the id, start a new proof subagent with
+the full original proof handoff, the pinned Step 1 record, and the thread id. Tell it to run
+the proof checks with `--thread <id>`. This attempt does not count toward the three. Use the
+route-out rules below only when the developer declines or cannot give an id.
 
 Enter the code-repair branch only for a source, configuration, dependency, or tracked-file
 defect.
@@ -148,6 +179,12 @@ first. Then spawn a fresh repair worker with this repair handoff, not the whole-
 implementation handoff: the plan, the proof evidence, the protected path list, the
 authorized list from that audit, and the developer's answer on the Skills install.
 
+Before you end your turn to wait for the developer, report the pause:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
 Run the protected-path audit again after validation passes. Continue only if its result
 starts with `Status: passed`.
 
@@ -162,11 +199,12 @@ Wait for the fresh proof subagent to finish.
 If the fresh proof result starts with `Status: passed`, run the protected-path audit and use
 the passed-result route above. If it starts with `Status: failed`, begin the next bounded
 repair cycle. Use the route-out rules below for `Status: blocked`. After three repair and
-proof cycles, use the route-out rules below.
+proof cycles, use the route-out rules below. A blocked result that asks for a thread id
+takes the developer path above instead.
 
 Route out only when the failure is not yours to fix, when the same proof still fails after
 three attempts, or when no evidence of the round trip can be produced. In those cases run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read stopped/run-failed`. The stack is supported:
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read stopped/run-failed`. The stack is supported:
 this run did not finish, which is a different ending and a different report. All three are
 about the round trip itself. A round trip that proved is not one of them, whatever failed
 after it.
@@ -177,7 +215,7 @@ friction command follows the telemetry setting the developer already chose, so i
 separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.25.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.

package/onboarding/prompts/research/gather.md

@@ -41,11 +41,10 @@ and continue when that thing arrives. A pause waits for one of two things:
    pick", gives no answer, and the default that the prompt states applies. Where the
    prompt states no default, ask once more.
 
-Before you end your turn to wait for the developer where the prompt states no default,
-report the pause:
+Before you end your turn to wait for the developer, report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard checkpoint --phase awaiting-developer
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
 ```
 
 When the answer or the result arrives, continue from the step that paused. Do not read an
@@ -65,7 +64,7 @@ Both research subagents failing means this harness has no working subagent at al
 is worth recording once:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard checkpoint --phase delegation-unavailable
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase delegation-unavailable
 ```
 
 Then say once, in your own words, that this environment has no working subagents, so you
@@ -77,11 +76,22 @@ For the rest of this run, wherever a prompt tells you to spawn a subagent, read
 Before you ask the developer any setup question, finish every read-only investigation and
 preflight check in this section.
 
-Prepare two research assignments. Give each research subagent one assignment. Tell it to run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read subagent/inspect-repository` first and follow the
-prompt it returns. If that read fails because the subagent cannot use the shell, stop that
-subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
-and the same handoff. Require only its assigned packet.
+Prepare two research assignments. Before you spawn either subagent, run these two
+read-only commands yourself, from the target project directory:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard read subagent/inspect-repository
+npx --prefer-offline --yes copilotkit@4.25.0 onboard inspect --json
+```
+
+Give each research subagent the prompt that the first command returns, the whole JSON that
+the second command returns, and one assignment. Tell it that its handoff already holds both,
+so it runs no onboarding command. A coding agent's permission layer can refuse a package
+that runs from the registry inside a subagent, even where it lets you run the same command.
+The run then waits for an approval that nobody sees. Require only its assigned packet.
+
+Give the same JSON to every later subagent that this research spawns, such as a retry, a
+focused directory check, or a conflict verifier.
 
 Start both research subagents in parallel:
 
@@ -92,8 +102,8 @@ Start both research subagents in parallel:
 The research is under way. Continue to the surface-control preflight while it runs:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard read research/preflight
+npx --prefer-offline --yes copilotkit@4.25.0 onboard read research/preflight
 ```
 
 If inspection stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/merge.md

@@ -48,8 +48,14 @@ app directory. Both results must start with `Status: passed`. Otherwise, use the
 Read the next step only after `login --json` has emitted `type: completed`. If sign-in still
 waits on the developer, end your turn and wait for it: that is a pause.
 
+Before you end your turn to wait for the developer, report the pause:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
 When both research results are merged and sign-in is done, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read research/route`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read research/route`.
 
 If inspection stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/preflight.md

@@ -27,8 +27,8 @@ Where the device probe found no booted device, that is the whole finding.
 Then merge the research:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard read research/merge
+npx --prefer-offline --yes copilotkit@4.25.0 onboard read research/merge
 ```
 
 If inspection stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read stopped/run-failed`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/route.md

@@ -9,7 +9,7 @@ sends the run down one path.
 Before you route on, run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard protect
+npx --prefer-offline --yes copilotkit@4.25.0 onboard protect
 ```
 
 It reads the working tree itself, records every changed or untracked path with a digest,
@@ -44,7 +44,7 @@ On any one of them, run this before you read the three findings below, and witho
 the purpose question:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.24.0 onboard read feature/channels/start
+npx --prefer-offline --yes copilotkit@4.25.0 onboard read feature/channels/start
 ```
 
 Name the provider to that node so it does not ask again. A `/slack` page names Slack. A
@@ -105,7 +105,7 @@ settle these three from your own reading of the project. Each one comes from the
 packets or it is not proved.
 
 If all three are proved, prove the live starting state before any project file changes. Run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read proof/oss-baseline`.
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read proof/oss-baseline`.
 
 Route there before you ask the developer anything else. The questions after this prompt
 select a framework and a frontend that the findings already name, so a developer who
@@ -116,9 +116,16 @@ these three findings.
 For every other combination of the three, take one more step first. If neither the
 developer nor the repository findings prove what the project is for, ask one guided
 question about the user outcome. This asks what the developer wants to build before you
-select a framework. Give two or three short examples. Record the answer and give it to
-each later subagent. Then run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read credentials/plan`.
+select a framework. Give two or three short examples.
+
+Before you end your turn to wait for the developer, report the pause:
+
+```text
+npx --prefer-offline --yes copilotkit@4.25.0 onboard checkpoint --phase awaiting-developer
+```
+
+Record the answer and give it to each later subagent. Then run
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read credentials/plan`.
 
 Do not ask that question on the route above. A project carrying all three states its
 purpose in the application it already serves.
@@ -132,5 +139,5 @@ A purpose question here names a domain before that choice.
 Take the same read named above without asking.
 
 If authentication, inspection, or the baseline capture stops onboarding, run
-`npx --prefer-offline --yes copilotkit@4.24.0 onboard read stopped/run-failed`. None of them says anything
+`npx --prefer-offline --yes copilotkit@4.25.0 onboard read stopped/run-failed`. None of them says anything
 about whether this project's stack is supported, which is not yet known at this point.