copilotkit 4.25.1 → 4.26.0

package/onboarding/prompts/starter/clone.md

@@ -16,7 +16,7 @@ project to use, or to open the coding agent in a new empty folder.
 Before you end your turn to wait for the developer, report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-developer
+npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-developer
 ```
 
 Match the selected agent framework and frontend to this table:
@@ -71,7 +71,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --prefer-offline --yes copilotkit@4.25.1 project list --json`
+`npx --prefer-offline --yes copilotkit@4.26.0 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -80,7 +80,7 @@ store a secret value.
 Before you end your turn to wait for the developer, report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-developer
+npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-developer
 ```
 
 ## Ask where the model credential lives
@@ -100,14 +100,14 @@ value. Never ask for the value itself. If no answer comes, clone anyway. The ste
 the clone pauses for the key.
 
 If the developer has no key file yet and wants to create one, ask them to put it outside the
-target directory, such as in its parent folder. `init` refuses a target that holds a `.env`
-file, so a new `.env` in the target stops the clone. Pass the new file with
-`--model-key-file`, as for any other key file.
+target directory, such as in its parent folder. Tell them only where it goes. The reason is
+for you: `init` refuses a target that holds a `.env` file, so a new `.env` in the target
+stops the clone. Pass the new file with `--model-key-file`, as for any other key file.
 
 Before you end your turn to wait for the developer, report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-model-credential
+npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-model-credential
 ```
 
 A path the developer names is theirs to give, including one outside the project. A path
@@ -120,7 +120,7 @@ This route skips the plan step that records the path, so record it here, once, b
 the clone:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard classify --starting-state <starting-state> --agent-framework <agent-framework> --frontend <frontend> --model-vendor <model-vendor> --model-vendor-choice <model-vendor-choice>
+npx --prefer-offline --yes copilotkit@4.26.0 onboard classify --starting-state <starting-state> --agent-framework <agent-framework> --frontend <frontend> --model-vendor <model-vendor> --model-vendor-choice <model-vendor-choice>
 ```
 
 - `<starting-state>`: the starting state the research recorded, usually `empty`.
@@ -143,7 +143,7 @@ Do not inspect another entry in the parent directory. Replace each placeholder w
 recorded value. Do not run a placeholder as a shell argument. If the path holds a space,
 put it in double quotes.
 
-`npx --prefer-offline --yes copilotkit@4.25.1 init --dir <absolute-target-directory> --framework <framework-id> --channel none --no-banner --no-key-prompt --create <name> --install`
+`npx --prefer-offline --yes copilotkit@4.26.0 init --dir <absolute-target-directory> --framework <framework-id> --channel none --no-banner --no-key-prompt --create <name> --install`
 
 `--dir` is always the absolute path of the target directory. `init` builds the app in that
 directory and gives the app the directory's name. Do not add `--name`: `init` refuses
@@ -164,23 +164,23 @@ the developer for the right path, or run the command again without the flag.
 Before you end your turn to wait for the developer, report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-model-credential
+npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-model-credential
 ```
 
 If you cannot pass the key file to `init`, for example because a sandbox refuses the path,
 clone without `--model-key-file`. Then copy the key from `<target>` with one command:
-`cd <target> && npx --prefer-offline --yes copilotkit@4.25.1 onboard credentials --model-key <VARIABLE> --env-path <key-file> --copy-to <env file> --json`.
+`cd <target> && npx --prefer-offline --yes copilotkit@4.26.0 onboard credentials --model-key <VARIABLE> --env-path <key-file> --copy-to <env file> --json`.
 `<env file>` is `.env`, or `agent/.env` for the Microsoft Agent Framework Python starter.
 The command writes the key into that file without printing it. If the
 command is refused too, ask the developer to run it. Give them exactly this one line:
-`! cd <target> && npx --prefer-offline --yes copilotkit@4.25.1 onboard credentials --model-key <VARIABLE> --env-path <key-file> --copy-to <env file>`.
+`! cd <target> && npx --prefer-offline --yes copilotkit@4.26.0 onboard credentials --model-key <VARIABLE> --env-path <key-file> --copy-to <env file>`.
 The command needs no input. Without `!`, they run the same command in a terminal.
 Do not write a `sed`, `grep`, or `cat` command to copy the key.
 
 Before you end your turn to wait for the developer, report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-model-credential
+npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-model-credential
 ```
 
 ### For a recorded local choice
@@ -190,7 +190,7 @@ command instead of the hosted command above. Do not ask the project questions ab
 Local evaluation creates its own empty project, and `init --local` refuses `--create` and
 `--project`.
 
-`npx --prefer-offline --yes copilotkit@4.25.1 init --dir <absolute-target-directory> --framework <framework-id> --channel none --no-banner --no-key-prompt --local --defer-model --install`
+`npx --prefer-offline --yes copilotkit@4.26.0 init --dir <absolute-target-directory> --framework <framework-id> --channel none --no-banner --no-key-prompt --local --defer-model --install`
 
 Use the model choice from `deployment/choose-local`. If the developer deferred it, keep
 `--defer-model`. If the developer gave model settings, replace `--defer-model` with
@@ -205,7 +205,7 @@ After `init` reports the stack ready:
 Ask the developer to run this command in their own terminal window, in `<target>`:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 local setup
+npx --prefer-offline --yes copilotkit@4.26.0 local setup
 ```
 
 Do not give it as a `!` line, and do not run it yourself. Its guided model prompt needs a
@@ -214,9 +214,9 @@ changes nothing. The prompt asks for the model and its key, and it saves them pr
 On a running stack, it restarts only Learning. Do not ask for a model file.
 
 Say that the run continues when they reply or resume this session. Report the pause with
-`npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-model-credential`, end your
+`npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-model-credential`, end your
 turn, and wait. When the developer replies, run
-`npx --prefer-offline --yes copilotkit@4.25.1 local status --json` from `<target>` and read `learning.configuration`.
+`npx --prefer-offline --yes copilotkit@4.26.0 local status --json` from `<target>` and read `learning.configuration`.
 
 The command installs the local stack, then connects the starter to it. It writes the
 gitignored `.copilotkit/local.json` stack reference and `.copilotkit/project.json` with the
@@ -270,7 +270,7 @@ When you ask, name each variable and the file it goes in, and say that the run c
 when they reply or resume this session. Then report the pause and end your turn:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-model-credential
+npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-model-credential
 ```
 
 This is a pause, not a stop. Do not send a stop report, and do not take a stop route.
@@ -281,7 +281,7 @@ call.
 
 If no credential is missing, report no pause and continue.
 
-Then run `npx --prefer-offline --yes copilotkit@4.25.1 onboard read proof/round-trip`.
+Then run `npx --prefer-offline --yes copilotkit@4.26.0 onboard read proof/round-trip`.
 
 If the local command fails, `init` keeps the cloned starter in `<target>`. Do not run
 `init` again, because the target is no longer empty. Do not delete the starter or the stack.
@@ -292,14 +292,14 @@ available memory, or 40 GiB storage. Tell the developer what to change in Docker
 memory, pass on the amount the message names. Then report the pause and end your turn:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-developer
+npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-developer
 ```
 
 When the developer says that Docker is ready, resume from `<target>` with the same model
 choice. If the run used a `--candidate`, add the same one:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 local setup --defer-model --json
+npx --prefer-offline --yes copilotkit@4.26.0 local setup --defer-model --json
 ```
 
 If the run used model settings, replace `--defer-model` with `--model-config <private-file>`.
@@ -307,7 +307,7 @@ Read blockers and the recorded failed step. Do not delete or recreate a failed s
 setup reports the stack ready, connect the starter from `<target>`:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 local connect --approve-connection --json
+npx --prefer-offline --yes copilotkit@4.26.0 local connect --approve-connection --json
 ```
 
 The connection writes `.copilotkit/local.json`, `.copilotkit/project.json`, and the local
@@ -316,6 +316,6 @@ setup fails again with an error that does not name Docker, take the route below.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --prefer-offline --yes copilotkit@4.25.1 onboard read stopped/run-failed`. The starter is one this
+`npx --prefer-offline --yes copilotkit@4.26.0 onboard read stopped/run-failed`. The starter is one this
 graph ships and the stack was chosen from its own supported list, so a command that
 returned an error is a run that broke, not a setup this release does not support.

package/onboarding/prompts/stopped/run-failed.md

@@ -40,13 +40,13 @@ put to them, stop here and send the report below.
 Before you end your turn to wait for the developer, report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-developer
+npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-developer
 ```
 
 If they approve it, make that one fix and nothing else. Then come back into this run:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard resume --message "<approval>"
+npx --prefer-offline --yes copilotkit@4.26.0 onboard resume --message "<approval>"
 ```
 
 Put the developer's approval in `--message`, in one or two sentences: the fix they
@@ -69,7 +69,7 @@ Send one short report. The friction command follows the telemetry setting the de
 already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.26.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped

package/onboarding/prompts/subagent/create-plan.md

@@ -39,6 +39,9 @@ developer wrote is the agent's behavior rather than a setting this run tunes unt
 component renders. Where the plan cannot be written without such a change and you cannot
 state it that way, return `Status: blocked`.
 
+A run whose `environmentPath` ends in `.env.local` hosts the CopilotKit runtime in that
+Next.js app, never in a separate server: no other process reads the key from that file.
+
 Plan the runtime to consume the Intelligence credential. The runtime takes an
 `intelligence` option holding a client built from the project key. A runtime given a
 `runner` option instead is the OSS runtime. It never reads the Intelligence key, and the
@@ -94,7 +97,7 @@ against a dead host, and the failure arrives as an empty-body 404 with no cause
 Ask the CLI for the dependency upgrade, from the target directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard upgrade-plan --json
+npx --prefer-offline --yes copilotkit@4.26.0 onboard upgrade-plan --json
 ```
 
 It reads the installed tree and the registry. Read `status`:
@@ -177,7 +180,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --prefer-offline --yes copilotkit@4.25.1 verify --round-trip`, which needs no browser. Do not plan a
+`npx --prefer-offline --yes copilotkit@4.26.0 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Name the files the run writes itself
@@ -186,9 +189,10 @@ List these in the plan under `Files the run writes itself`, apart from the imple
 steps. They are not steps, and they need no separate approval. A developer who approved a plan
 without them reads each one later as a change they never agreed to.
 
-- Each `planChanges` entry from `onboard credentials`: the project key in `.env`, the
-  project record, and, where it lists `ignore-entries`, the lines `project select` adds to
-  `.gitignore` so that no `.env` file can be committed.
+- Each `planChanges` entry from `onboard credentials`: the project key in the env file
+  `environmentPath` names, the project record, and, where it lists `ignore-entries`, the
+  lines `project select` adds to `.gitignore` so that no credential env file can be
+  committed.
 - `.copilotkit/proof/`, where the proof writes its evidence. It holds no source. The
   developer can delete it after the run.
 - The CopilotKit Skills, as a line the developer approves or declines:

package/onboarding/prompts/subagent/implement-and-validate.md

@@ -84,6 +84,9 @@ Wiring is not behavior. Add the CopilotKit SDK dependency, wrap the agent in the
 middleware, mount the runtime, connect AG-UI, and render what the agent already returns.
 Those are the parts this run adds.
 
+A run whose `environmentPath` ends in `.env.local` hosts the CopilotKit runtime in that
+Next.js app, never in a separate server: no other process reads the key from that file.
+
 A change on the behavior list changes how the agent answers everywhere, not only in
 CopilotKit, so the developer approves it before it is written. Where a step cannot be
 built without one the plan did not name, return `Status: blocked` and name the file, the
@@ -110,7 +113,7 @@ Intelligence: declare each exact version in its app's manifest, then install wit
 project's package manager. Then check the installed tree:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard upgrade-plan --check --json
+npx --prefer-offline --yes copilotkit@4.26.0 onboard upgrade-plan --check --json
 ```
 
 `single` means every direct dependency resolved to one version. `duplicates` names each
@@ -125,7 +128,7 @@ If the check finds duplicates or the baseline regresses, put the manifests and l
 back, leave Intelligence unwired, and report what failed:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard upgrade-plan --revert --json
+npx --prefer-offline --yes copilotkit@4.26.0 onboard upgrade-plan --revert --json
 ```
 
 Then end your turn. Never add an `overrides`, `resolutions`, or `pnpm.overrides` block to
@@ -161,7 +164,7 @@ Where the plan names a Learning Container id, check that the container exists fi
 this from the target app directory, before you write any selector:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 learning containers get <id> --json
+npx --prefer-offline --yes copilotkit@4.26.0 learning containers get <id> --json
 ```
 
 `"status": "success"` means the container exists. An `error.code` of

package/onboarding/prompts/subagent/inspect-repository.md

@@ -8,7 +8,7 @@ Your handoff holds the JSON of this command, which the main coding agent ran fro
 target project directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard inspect --json
+npx --prefer-offline --yes copilotkit@4.26.0 onboard inspect --json
 ```
 
 Read that JSON. Do not run the command again. If the handoff holds no inspection JSON, run

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -32,7 +32,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --prefer-offline --yes copilotkit@4.25.1 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --prefer-offline --yes copilotkit@4.26.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -75,7 +75,7 @@ about the failure it was spawned to clear.
 Run this from the target app directory:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard proof-check --json
+npx --prefer-offline --yes copilotkit@4.26.0 onboard proof-check --json
 ```
 
 It starts each app's `dev` script unless a server from that app already listens, and
@@ -126,7 +126,7 @@ Otherwise sort `firstFailure`, and run the command again after each repair:
   asking. Read the port from the log, not from the plan, and record it:
 
   ```text
-  npx --prefer-offline --yes copilotkit@4.25.1 onboard runtime-url --url <runtime-url>
+  npx --prefer-offline --yes copilotkit@4.26.0 onboard runtime-url --url <runtime-url>
   ```
 
   `<runtime-url>` is the project's runtime URL, or the plan's, with its port replaced by the
@@ -296,7 +296,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --prefer-offline --yes copilotkit@4.25.1 verify --round-trip`, which reads the
+that thread with `npx --prefer-offline --yes copilotkit@4.26.0 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Where the proof checks needed `--thread`,
 prove the thread for this request with `verify --thread <id>` instead. Record which of the
 two you proved.
@@ -326,7 +326,7 @@ limit can be ten minutes. You cannot interrupt a call while it runs, so the limi
 what you do after one. If a browser call took longer than 60 seconds to return, the browser
 control is unresponsive. Do not call the browser again in this attempt. A second call to a
 hung tool waits as long as the first one did. Run
-`npx --prefer-offline --yes copilotkit@4.25.1 verify --frontend-url <the frontendUrl the proof checks resolved> --json` once,
+`npx --prefer-offline --yes copilotkit@4.26.0 verify --frontend-url <the frontendUrl the proof checks resolved> --json` once,
 and record the `frontend_assets_served` result. Report the outcome `failed` with the cause
 `browser-control-unresponsive`. The application is not at fault on this evidence: every
 step before the browser proved the runtime without one, and no repair to the project can
@@ -336,7 +336,7 @@ reach the tool.
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --prefer-offline --yes copilotkit@4.25.1 verify --frontend-url <the url you opened> --json`
+   `npx --prefer-offline --yes copilotkit@4.26.0 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -35,17 +35,17 @@ Before you show the best-effort plan, require this complete packet:
 Before you end your turn to wait for the developer, report the pause:
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard checkpoint --phase awaiting-developer
+npx --prefer-offline --yes copilotkit@4.26.0 onboard checkpoint --phase awaiting-developer
 ```
 
 After the developer approves the best-effort plan, run
-`npx --prefer-offline --yes copilotkit@4.25.1 onboard read fallback/best-effort`.
+`npx --prefer-offline --yes copilotkit@4.26.0 onboard read fallback/best-effort`.
 
 Send one short report. The friction command follows the telemetry setting the developer
 already chose, so it needs no separate question.
 
 ```text
-npx --prefer-offline --yes copilotkit@4.25.1 onboard friction --phase stop --category <slug> --message "<sentences>"
+npx --prefer-offline --yes copilotkit@4.26.0 onboard friction --phase stop --category <slug> --message "<sentences>"
 ```
 
 `--message` takes one or two sentences: the step you stopped at and what stopped it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.25.1",
+  "version": "4.26.0",
   "type": "module",
   "engines": {
     "node": ">=20.9.0"