copilotkit 4.8.3 → 4.9.0

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -1,20 +1,127 @@
 # Prove the complete round trip
 
-Use the proof steps and documentation URLs from the approved plan. Fetch each selected URL
-before you start. Do not use remembered CopilotKit instructions.
+Use the proof steps and documentation URLs from the approved plan. Fetch every selected
+URL in one step before you start, rather than one after another.
+Do not use remembered CopilotKit instructions.
 
-Start the agent and the selected frontend. Send one real request through the frontend.
-Make sure that the request passes through CopilotKit and reaches the selected agent.
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Report a
+documentation gap only after a second method also fails.
 
-Make sure that the frontend receives working generative UI from the agent. Record the input,
-visible result, relevant process status, and evidence locations. Do not return secret values.
+Read the port the developer's agent already serves from this project's own
+configuration. Do not assume a default, and do not start a second copy of an agent this
+project is already running. Before you bind any new server, check that the port is free
+and pick another one if it is not. Record every port you used.
 
-After the round trip works, fetch the continued-development guide from the main coding agent.
+Start the agent and the selected frontend.
+
+Leave the agent and frontend servers running after proof. Record each process ID and a
+safe command that stops that process. Record the frontend URL and the commands that start
+both servers again.
+
+With both running, check the wiring in one command before you open a browser:
+`npx --yes copilotkit@4.9.0 verify --json`. Add `--runtime-url` when the runtime is not at
+`http://localhost:3000/api/copilotkit`. Read the individual checks rather than the summary
+alone: a check reported `undetermined` did not run, and that is not a pass. Fix anything
+that is not a pass before the browser, because a browser failure stacked on broken wiring
+costs a round of debugging to reach an answer this command already gave.
+
+Treat `intelligence_consumed` as the check that matters most here. A journey that finishes
+with the Intelligence credential never read looks complete and proves nothing about the
+paid surface. `api_key_authenticates` passing beside it says the key is real and the
+runtime never used it.
+
+`intelligence_thread_routes` fails when the runtime reports a license but serves no
+thread routes, which means saved Threads cannot load in a browser. The usual cause is a
+handler mounted `mode: "single-route"`: remove that option so the handler serves its full
+route set, and mount it at a catch-all route. If instead that check is `undetermined`
+because the runtime reports no thread-endpoint state, the runtime predates the field.
+Record that and move on — there is nothing to repair.
+
+Then prove that the agent actually runs, which is the gate for this node:
+`npx --yes copilotkit@4.9.0 verify --round-trip --json`. It sends one request through the
+runtime and reads the answer back from the thread, so it separates an agent that is
+configured from an agent that works. Use `--agent <id>` when the runtime declares more
+than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
+session the CLI does not carry: pass what it reads with `--header "Name: value"` and run
+it again, because an auth-gated app refusing an unauthenticated caller is that app
+working. Do not continue until this passes, and never report a round trip proven without
+it.
+
+Then send one real request through the frontend. Make sure that the request passes through
+CopilotKit and reaches the selected agent.
+
+For a recorded `both-oss` starting state: Compare the final round trip with the recorded
+OSS baseline. The same frontend request must still reach the same agent and produce the
+same kind of user-visible result. The runtime must now report `licenseStatus`, and the
+authenticated Intelligence checks must pass. Record both before and after evidence.
+
+Before you trust the agent, confirm that the process answering is the one in this
+repository. `verify` reports which agents the runtime declares and has nothing to compare
+them against, and `--round-trip` proves an agent answers under the declared id without
+proving which deployment did, so this comparison is yours. A health endpoint that returns success proves only that something listens on
+that port. An agent from earlier work often still holds it, and a stale process answers
+as though it were the new one. Ask the running agent which graph or agent id it serves
+and compare that with the id declared in this project.
+
+If they do not match, find out whose process it is before you signal anything.
+`lsof -ti :<port> -sTCP:LISTEN` gives the process id, and `lsof -a -p <pid> -d cwd` gives
+the directory it runs in. Stop it only when that directory is inside this project, and
+stop its children before the parent so nothing survives by reparenting. A holder outside
+this project belongs to other work: leave it running, report it, and bind to another port.
+Never stop a process because its command line matches a name. One `pkill` pattern reaches
+every project on the machine and takes down work that has nothing to do with this run.
+Never continue against a process you cannot identify, and never report a round trip proven
+by one.
+
+Address a local agent by host name rather than by an IP literal. Some local agents bind
+IPv6 only, so an IPv4 literal fails against the correct port.
+
+Drive the real UI in a browser whenever your environment can, and make sure that the
+frontend receives working generative UI from the agent. Prefer this: it is the only step
+that covers realtime delivery to a browser, browser-origin CORS and CSP, the frontend
+provider being wired to this runtime, and a generative UI component actually rendering,
+and no command-line check reaches any of them.
+
+Use a browser MCP server already configured for the coding agent you are running as, the
+same way the CopilotKit documentation MCP server below is configured. Do not add a browser
+driver to this project: a devDependency and a browser download land in the diff and tax a
+repository that never asked for one. If nothing in your environment can drive a
+browser, skip this step rather than installing one, and never report a visual result you
+did not see.
+
+Report exactly one of `performed`, `skipped-no-browser-tool`, or `failed` for this step.
+
+Record the input, visible result, relevant process status, and evidence locations. Do not
+return secret values.
+
+Where the answer is meant to be about data the project holds, check it against that data.
+Read the entities the project holds -- the ids, names, or records the answer claims to
+describe -- and confirm the answer names those and no others. Record the entities you
+compared. Where the outcome of this journey references no project data, record that
+instead, and do not invent a comparison to pass this step.
+
+An answer that renders correctly over entities the project does not hold looks the same as
+a correct one in a browser, in a screenshot, and in a video, so this comparison is the only
+stage that separates them. An answer that names an entity the project does not hold is a
+failed proof, not a passing one. Find which of these it is before you change anything: the
+project's data never reaches the agent, the agent receives it and its instructions ignore
+it, the page loads its data after the context was registered, or the run wired a different
+source than the page renders. Fix that cause, then prove again.
+
+Fetch the continued-development guide from the main coding agent with the proof
+documentation. Try the continued-development tools after the application passes proof.
 Use it to install the project-scoped CopilotKit Skills.
 Use it to configure the CopilotKit documentation MCP server for the current coding agent.
 
-Record the installed Skills and the configured MCP server. If either tool step fails, return
-the exact documentation gap or error.
+Do not validate whether the Skills or MCP server installed correctly. Record the command
+result for each attempt. Report each tool result separately. A tool error does not change
+the proof result.
+
+Gather what you need in as few commands as possible. Combine independent reads into one
+command rather than running them one at a time. Split a command only when its result decides
+what you run next.
 
-Return the proof or the exact failed step to the main coding agent. Stop after you return the
-result.
+Return the proof or the exact failed step to the main coding agent, together with the
+visual-check outcome. Stop after you return the result.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -1,17 +1,35 @@
-# No validated path in this release
+# Stop without a supported path
 
-Stop onboarding without making more repository changes. Keep the developer's current agent,
-frontend, authentication, and package choices.
+Keep the developer's current agent, frontend, authentication, and package choices.
 
 Explain the exact step that failed. State whether authentication, project selection, project
-credentials, the journey, a documentation URL, implementation, validation, or proof caused
-the stop. Do not invent an adapter or claim that an untested path works.
+credentials, the journey, a documentation URL, implementation, validation, or the round
+trip caused the route change. Do not say a path works when this release does not support it.
 
-If useful, send one short report without secrets, source code, logs, or command output:
+Stop onboarding without making more repository changes by default.
+
+The documentation-gap exception applies only before implementation starts. If implementation,
+validation, or proof already started, do not use the documentation-gap exception.
+
+If the only cause is a failed documentation URL or missing documentation, use the exception.
+Tell the developer about the gap. Then make a best-effort plan from the official pages that
+are available. Search the broader official CopilotKit documentation before you infer an API.
+Mark each step that the selected pages do not prove. Do not treat the documentation gap as
+proof that the requested integration is unsupported.
+
+After the developer approves the best-effort plan, run
+`npx --yes copilotkit@4.9.0 onboard read fallback/best-effort`.
+
+If the developer permitted external feedback at the start, you can send one short report:
 
 ```text
-npx copilotkit@4.8.3 onboard feedback
+npx --yes copilotkit@4.9.0 onboard feedback
 ```
 
-Write the feedback message to the command's standard input. Stop after the explanation or
-optional feedback. This unsupported outcome does not complete onboarding.
+Write the feedback message to the command's standard input, in at most four lines.
+Send no secrets, source code, logs, or command output. The command refuses a report
+that carries any of those, prints the reason, and exits zero. A refused report is not
+a failed step. Reword it and send it again, or stop without a report. The command
+prints what it sent. This is the channel for a stop. Report friction only from a run that
+finished, never from here. If the developer did not permit feedback, do not run the
+command.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.8.3",
+  "version": "4.9.0",
   "type": "module",
   "repository": {
     "type": "git",

package/release/release-tool.js

@@ -91,6 +91,9 @@ var STARTER_SOURCE_CATALOG = {
   adk: copilotKitStarter("examples/integrations/adk"),
   "adk-angular": copilotKitStarter("examples/integrations/adk-angular"),
   "aws-strands-py": copilotKitStarter("examples/integrations/strands-python"),
+  "aws-strands-ts": copilotKitStarter(
+    "examples/integrations/strands-typescript"
+  ),
   a2a: copilotKitStarter("examples/integrations/a2a-middleware"),
   "microsoft-agent-framework-dotnet": copilotKitStarter(
     "examples/integrations/ms-agent-framework-dotnet"
@@ -13900,6 +13903,15 @@ config(en_default());
 // apps/cli/src/release/release-schemas.ts
 var import_starter_source_policy2 = __toESM(require_starter_source_policy(), 1);
 var CLI_BUILD_INFO_FILENAME = "cli-build-info.json";
+var PROVENANCE_CHANNELS = [
+  "production",
+  "dev",
+  "staging",
+  "preview",
+  "push",
+  "pull-request",
+  "validation"
+];
 var canonicalCommitSchema = external_exports.string().regex(/^[0-9a-f]{40}$/);
 var instantSchema = external_exports.iso.datetime({ offset: true });
 var packageVersionSchema = external_exports.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/);
@@ -13921,7 +13933,7 @@ var buildInfoSchema = external_exports.object({
     submittedInput: external_exports.string().min(1),
     commit: canonicalCommitSchema
   }).strict(),
-  channel: external_exports.enum(["production", "dev", "staging", "preview", "validation"]),
+  channel: external_exports.enum(PROVENANCE_CHANNELS),
   triggeringActor: external_exports.string().min(1),
   workflow: external_exports.object({
     runId: external_exports.string().min(1),
@@ -14683,7 +14695,7 @@ import * as path4 from "node:path";
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "e0a2f00cca326c76739217e8ca40902e609539a4" : "main";
+  return true ? "bf2068734bcc42b9dc9999b183d0fd07a673f713" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts
@@ -14860,6 +14872,12 @@ var TELEMETRY_ERROR_CODES = {
   USER_ABORTED: "USER_ABORTED",
   NON_INTERACTIVE: "NON_INTERACTIVE",
   FILESYSTEM_WRITE_FAILED: "FILESYSTEM_WRITE_FAILED",
+  /**
+   * `project select --project` named a project the active organization does
+   * not have. Distinct from a generic validation failure so the funnel can
+   * tell "the caller guessed a slug" from a malformed request.
+   */
+  PROJECT_NOT_FOUND: "PROJECT_NOT_FOUND",
   CLI_PRODUCT_BINARY_TOO_LARGE: "CLI_PRODUCT_BINARY_TOO_LARGE",
   LEARNING_CONTAINER_ID_INVALID: "LEARNING_CONTAINER_ID_INVALID",
   LEARNING_PROJECT_ID_INVALID: "LEARNING_PROJECT_ID_INVALID",
@@ -14891,6 +14909,7 @@ var FRAMEWORK_EMOJI = {
   "adk-angular": "\u{1F53A}",
   a2a: "\u{1F916}",
   "aws-strands-py": "\u{1F9EC}",
+  "aws-strands-ts": "\u{1F9EC}",
   "microsoft-agent-framework-dotnet": "\u{1F7E6}",
   "microsoft-agent-framework-py": "\u{1F7E6}",
   "mcp-apps": "\u{1F9E9}",
@@ -14925,6 +14944,10 @@ var FRAMEWORK_CHOICES = [
     label: `${FRAMEWORK_EMOJI["aws-strands-py"]} AWS Strands (Python)`,
     value: "aws-strands-py"
   },
+  {
+    label: `${FRAMEWORK_EMOJI["aws-strands-ts"]} AWS Strands (TypeScript)`,
+    value: "aws-strands-ts"
+  },
   { label: `${FRAMEWORK_EMOJI.adk} ADK`, value: "adk" },
   {
     label: `${FRAMEWORK_EMOJI["adk-angular"]} Angular + ADK`,
@@ -15099,6 +15122,11 @@ var FRAMEWORK_TEMPLATES = {
     TEMPLATE_REPOS["aws-strands-py"],
     `\u{1FA81}\u{1F91D}${FRAMEWORK_EMOJI["aws-strands-py"]}`
   ),
+  "aws-strands-ts": standardTemplate(
+    "aws-strands-ts",
+    TEMPLATE_REPOS["aws-strands-ts"],
+    `\u{1FA81}\u{1F91D}${FRAMEWORK_EMOJI["aws-strands-ts"]}`
+  ),
   a2a: {
     ...standardTemplate(
       "a2a",
@@ -15438,7 +15466,7 @@ async function scaffoldStarterForSmoke(input, scaffold = scaffoldProject) {
   }
 }
 async function executeStarterSmokeChild(command) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     execFile(
       command.executable,
       [...command.args],
@@ -15452,7 +15480,7 @@ async function executeStarterSmokeChild(command) {
           reject(error48);
           return;
         }
-        resolve3(stdout);
+        resolve4(stdout);
       }
     );
   });

package/onboarding/prompts/frontend/slack.md

@@ -1,20 +0,0 @@
-# Configure Slack
-
-Use Slack only for an empty or agent-only starting state. Preserve an existing Slack
-frontend in those states. Record each required credential variable name. Do not read,
-show, store, or request a secret value.
-
-## Documentation
-
-- Credentials and plan: https://docs.copilotkit.ai/slack/intelligence.md
-- Implementation and validation: https://docs.copilotkit.ai/slack/connect.md
-- Proof: https://docs.copilotkit.ai/slack/deploy-and-operate.md
-
-Fetch each selected documentation URL. Record Slack as the selected frontend and keep
-these URLs. Do not use remembered CopilotKit instructions.
-
-If the pages support the selection, run
-`npx copilotkit@4.8.3 onboard read credentials/finalize-plan`.
-
-If a page does not load or support the selection, run
-`npx copilotkit@4.8.3 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/teams.md

@@ -1,20 +0,0 @@
-# Configure Microsoft Teams
-
-Use Microsoft Teams only for an empty or agent-only starting state. Preserve an existing
-Teams frontend in those states. Record each required credential variable name. Do not
-read, show, store, or request a secret value.
-
-## Documentation
-
-- Credentials and plan: https://docs.copilotkit.ai/teams/intelligence.md
-- Implementation and validation: https://docs.copilotkit.ai/teams/connect.md
-- Proof: https://docs.copilotkit.ai/teams/deploy-and-operate.md
-
-Fetch each selected documentation URL. Record Microsoft Teams as the selected frontend
-and keep these URLs. Do not use remembered CopilotKit instructions.
-
-If the pages support the selection, run
-`npx copilotkit@4.8.3 onboard read credentials/finalize-plan`.
-
-If a page does not load or support the selection, run
-`npx copilotkit@4.8.3 onboard read unsupported/no-validated-path`.