copilotkit 4.3.0 → 4.5.0

package/README.md

@@ -15,10 +15,33 @@ npx copilotkit@latest init
 For this workspace, build and run the local CLI with Nx:
 
 ```bash
-pnpm nx build cli
+CLI_ENV=local pnpm nx build cli
 node dist/apps/cli/index.js --help
 ```
 
+## Manual local validation
+
+For manual login/session and hosted-project validation, run the supported built
+artifact:
+
+```bash
+CLI_ENV=local pnpm nx build cli
+node dist/apps/cli/index.js login
+node dist/apps/cli/index.js whoami
+node dist/apps/cli/index.js project select
+```
+
+`project select` selects or creates a hosted Intelligence project and provisions
+its project-scoped `INTELLIGENCE_API_KEY`. Threads-enabled `init` and `create`
+scaffolds run the same hosted project selection and API-key provisioning path;
+use the built entrypoint when manually validating those steps too.
+
+Do not run raw CLI source with commands such as
+`pnpm exec tsx apps/cli/src/index.ts login`; source execution bypasses the
+supported bundle, build-time defines, and packaging behavior, so it does not
+validate the CLI users receive. An explicitly approved workspace wrapper is
+acceptable only when it runs the built artifact.
+
 ## Discover Commands
 
 Run help first when exploring the CLI:
@@ -54,7 +77,7 @@ persistence, insights), and `init` provisions a free license automatically —
 you sign in with your browser during scaffolding. The `-i`/`--intelligence`
 flag is retained as a deprecated no-op for backward compatibility.
 
-Supported framework values include `langgraph-py`, `langgraph-js`, `mastra`, `pydantic-ai`, `aws-strands-py`, `adk`, `a2a`, `microsoft-agent-framework-dotnet`, `microsoft-agent-framework-py`, `flows`, `llamaindex`, `agno`, `ag2`, `mcp-apps`, `agentcore-langgraph`, `agentcore-strands`, `a2ui`, and `opengenui`.
+Supported framework values include `langgraph-py`, `langgraph-js`, `claude-sdk-typescript`, `claude-sdk-python`, `mastra`, `pydantic-ai`, `aws-strands-py`, `adk`, `adk-angular`, `a2a`, `microsoft-agent-framework-dotnet`, `microsoft-agent-framework-py`, `flows`, `llamaindex`, `agno`, `ag2`, `mcp-apps`, `agentcore-langgraph`, `agentcore-strands`, `a2ui`, and `opengenui`.
 
 `init` and `create` collect your starter choices, then connect project creation
 to your CopilotKit workspace through Ops/Clerk before scaffolding. If you
@@ -252,7 +275,7 @@ explicitly re-enabled. `copilotkit telemetry reset` restores the full
 fresh-install state: the decision is forgotten and the one-time notice shows
 again on the next interactive run.
 
-## Prerelease builds
+## Preview and release builds
 
 Tester-facing prerelease builds are produced by CI via `workflow_dispatch` on
 the `pkg-pr-new (cli)` workflow — never built locally (the repo root `.env`
@@ -261,21 +284,23 @@ targets local services, and CI is the reproducible path).
 ```bash
 gh workflow run "pkg-pr-new (cli)" --ref <feature-branch> \
   -f cli_env=production \
-  -f template_ref=<copilotkit-branch>   # optional; omit to use main
+  -f template_ref=<copilotkit-branch-tag-or-commit>
 ```
 
 - `cli_env` — endpoint set baked into the binary (`local`, `dev`, `staging`,
   `production`; defaults to `production`).
-- `template_ref` — `CopilotKit/CopilotKit` branch or tag that `init` templates
-  and the `_intelligence` overlay are pinned to (the workflow validates it
-  exists before building). Empty means `main`. The `ag2`
-  template comes from the third-party `ag2ai/ag2-copilotkit-starter` repo and
-  is never repinned.
+- `template_ref` — committed `CopilotKit/CopilotKit` branch, tag, or commit.
+  The workflow resolves it to one canonical commit before building. Empty means
+  current remote `main`, which is also resolved before publication. The `ag2`
+  template comes from the third-party `ag2ai/ag2-copilotkit-starter` repository
+  at mutable `main`; build provenance identifies this explicit unpinned
+  exception.
 
 Open the workflow run and copy the `npx https://pkg.pr.new/...` command from
 the **job summary**; hand that one-liner to testers. Prerelease binaries
 report `<version>-pre.<shortsha>` from `copilotkit --version`, so a tester's
-build is always identifiable.
+build is always identifiable. `copilotkit version` also reports the canonical
+Intelligence and first-party CopilotKit commits embedded in the artifact.
 
 Pushes and PRs continue to publish `CLI_ENV=local` builds automatically, as
 before.
@@ -283,3 +308,7 @@ before.
 Note: `workflow_dispatch` only works against refs that contain the dispatch
 trigger — branches cut before this workflow landed need a merge from `main`
 first.
+
+Production validation, publication, provenance inspection, post-npm recovery,
+and rollback are documented in the
+[CLI release runbook](../../docs/runbooks/cli-release.md).

package/cli-build-info.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": 1,
+  "package": {
+    "name": "copilotkit",
+    "version": "4.5.0"
+  },
+  "intelligence": {
+    "commit": "cdb1dbd45dd27adbaa8be1fcfd6843c2927f5943"
+  },
+  "copilotKit": {
+    "submittedInput": "a1c9b3147829ac358bae82df651f45a1aea2a437",
+    "commit": "a1c9b3147829ac358bae82df651f45a1aea2a437"
+  },
+  "channel": "production",
+  "triggeringActor": "MikeRyanDev",
+  "workflow": {
+    "runId": "30390320157",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/30390320157"
+  },
+  "validationResult": "passed",
+  "ag2": {
+    "ownership": "third-party",
+    "repository": "ag2ai/ag2-copilotkit-starter",
+    "revision": "main",
+    "pinned": false
+  },
+  "builtAt": "2026-07-28T19:06:01Z"
+}