copilotkit 4.8.4 → 4.9.0

package/README.md

@@ -44,6 +44,7 @@ answer up front and run anywhere:
 
 ```bash
 copilotkit project list --json                     # see the choices
+copilotkit project list --search support --json    # search name, slug, or id
 copilotkit project select --project <slug-or-id>   # pick an existing one
 copilotkit project select --create "My App" --json # create one and select it
 ```
@@ -57,12 +58,19 @@ slugs instead of recording a selection that points at nothing.
 ```json
 {
   "type": "completed",
+  "selected_project_slug": "my-app",
   "project": { "id": "220", "slug": "my-app", "organizationId": "org_123" },
   "config_path": "/work/my-repo/.copilotkit/project.json",
-  "api_key_provisioned": true
+  "project_file_written": true,
+  "api_key_provisioned": true,
+  "environment_file_written": true
 }
 ```
 
+The four top-level summary fields let a coding agent read the result without
+searching the nested object or reading either file. The payload never contains
+the API key.
+
 `config_path` is absolute, and it is not always under the directory you ran in.
 The project record is repository-scoped: it goes into an existing `.copilotkit/`
 at or above the current directory when there is one, and otherwise into the
@@ -75,11 +83,12 @@ directory you ran in, because that is the file the app process loads — so in a
 repository with a `web/` and an `agent/` half, run `project select` in the half
 that needs the key.
 
-**Check `api_key_provisioned`, not just the exit code.** Key provisioning is
+**Check all four summary fields, not just the exit code.** Key provisioning is
 deliberately non-fatal: if it fails, the selection is still persisted, a warning
 goes to stderr, and the command still exits 0 — leaving a scaffold with no
 `INTELLIGENCE_API_KEY`, whose first run fails with an opaque "Failed to
-initialize thread". That field is the only machine-readable signal of it.
+initialize thread". `api_key_provisioned` and `environment_file_written` are
+false in this state.
 Re-running `project select` is a valid recovery.
 
 Failures use the `login --json` shape, `{"error": "...", "type": "failed"}`, and
@@ -454,6 +463,7 @@ copilotkit verify
 copilotkit verify --json                                    # machine-readable output
 copilotkit verify --runtime-url http://localhost:8080/copilotkit
 copilotkit verify --round-trip                              # also run the agent
+copilotkit verify --expect-runtime oss --round-trip --agent incident_triage
 ```
 
 It checks that a hosted project is selected, that a project API key is present
@@ -485,6 +495,12 @@ a caller can branch on the command instead of parsing it. With `--json` the
 payload is the only thing on stdout and every diagnostic goes to stderr, so
 piping is safe.
 
+Use `--expect-runtime oss` to prove an open-source runtime instead. In this
+mode, hosted project, key, and thread-route checks do not apply. The command
+exits zero only when `/info` is valid, declares the agent named by `--agent`,
+omits `licenseStatus`, and `--round-trip` passes. Both `--round-trip` and
+`--agent` are required for an OSS pass.
+
 The runtime URL defaults to `http://localhost:3000/api/copilotkit` and the
 report always states which URL it probed, because a wrong default is the most
 likely reason for a runtime failure. Pass `--runtime-url` when the frontend
@@ -634,8 +650,9 @@ report `<version>-pre.<shortsha>` from `copilotkit --version`, so a tester's
 build is always identifiable. `copilotkit version` also reports the canonical
 Intelligence and first-party CopilotKit commits embedded in the artifact.
 
-Pushes and PRs continue to publish `CLI_ENV=local` builds automatically, as
-before.
+Pushes publish `CLI_ENV=local` builds automatically. Pull requests publish
+`CLI_ENV=production` builds under the separate `copilotkit-pr` package name so
+testers can use hosted login without confusing the artifact with a release.
 
 Note: `workflow_dispatch` only works against refs that contain the dispatch
 trigger — branches cut before this workflow landed need a merge from `main`

package/cli-build-info.json

@@ -2,20 +2,20 @@
   "schemaVersion": 1,
   "package": {
     "name": "copilotkit",
-    "version": "4.8.4"
+    "version": "4.9.0"
   },
   "intelligence": {
-    "commit": "6483664ecea767ad39fe52106d85b94731740150"
+    "commit": "fab380427c6324aaf090b195af0f51eaf4a1a407"
   },
   "copilotKit": {
-    "submittedInput": "47c5510b4909f6728288ecf28d7b14cd14922d33",
-    "commit": "47c5510b4909f6728288ecf28d7b14cd14922d33"
+    "submittedInput": "bf2068734bcc42b9dc9999b183d0fd07a673f713",
+    "commit": "bf2068734bcc42b9dc9999b183d0fd07a673f713"
   },
   "channel": "production",
   "triggeringActor": "MikeRyanDev",
   "workflow": {
-    "runId": "32806721876",
-    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/32806721876"
+    "runId": "32886074334",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/32886074334"
   },
   "validationResult": "passed",
   "ag2": {
@@ -24,5 +24,5 @@
     "revision": "main",
     "pinned": false
   },
-  "builtAt": "2026-08-25T03:52:56Z"
+  "builtAt": "2026-08-25T18:51:51Z"
 }

package/index.js

@@ -96,14 +96,14 @@ function getTelemetryEndpointUrl() {
 }
 function getBuildInfo() {
   return {
-    version: true ? "4.8.4" : "dev",
-    buildNumber: true ? "32806721876" : "dev",
-    commitSha: true ? "6483664ecea767ad39fe52106d85b94731740150" : "dev",
+    version: true ? "4.9.0" : "dev",
+    buildNumber: true ? "32886074334" : "dev",
+    commitSha: true ? "fab380427c6324aaf090b195af0f51eaf4a1a407" : "dev",
     copilotKitCommit: getTemplateRef()
   };
 }
 function getTemplateRef() {
-  return true ? "47c5510b4909f6728288ecf28d7b14cd14922d33" : "main";
+  return true ? "bf2068734bcc42b9dc9999b183d0fd07a673f713" : "main";
 }
 function getC15tBackendUrl() {
   return true ? "https://calm-hazelnut-joy-copilotkit.inth.app" : "";
@@ -94890,8 +94890,12 @@ var project_list_exports = {};
 __export(project_list_exports, {
   runProjectList: () => runProjectList
 });
-function renderTable(projects, selectedId, organizationId) {
+function renderTable(projects, selectedId, organizationId, search) {
   if (projects.length === 0) {
+    if (search !== void 0) {
+      return `No hosted Intelligence projects match "${search}" in ${organizationId}.
+`;
+    }
     return `No hosted Intelligence projects exist in ${organizationId} yet.
 Run \`copilotkit project select --create <name>\` to create one.
 `;
@@ -94933,8 +94937,16 @@ async function driveProjectList(options) {
     return { kind: "api-error", error: error98 };
   }
   const selectedId = findProjectConfig(process.cwd())?.projectId;
+  const trimmedSearch = options.search?.trim();
+  const search = trimmedSearch === "" ? void 0 : trimmedSearch;
+  const matchedProjects = search === void 0 || search.length === 0 ? projects : projects.filter((project) => {
+    const query = search.toLocaleLowerCase();
+    return [project.id, project.slug, project.name].some(
+      (value) => value.toLocaleLowerCase().includes(query)
+    );
+  });
   if (options.json) {
-    const rows = projects.map((project) => ({
+    const rows = matchedProjects.map((project) => ({
       id: project.id,
       slug: project.slug,
       name: project.name,
@@ -94947,6 +94959,7 @@ async function driveProjectList(options) {
         {
           organizationId: auth2.clerkOrgId,
           selectedProjectId: selectedId ?? null,
+          search: search ?? null,
           projects: rows
         },
         null,
@@ -94956,7 +94969,9 @@ async function driveProjectList(options) {
     );
     return { kind: "success" };
   }
-  process.stdout.write(renderTable(projects, selectedId, auth2.clerkOrgId));
+  process.stdout.write(
+    renderTable(matchedProjects, selectedId, auth2.clerkOrgId, search)
+  );
   return { kind: "success" };
 }
 async function runProjectList(options) {
@@ -95691,13 +95706,16 @@ Run \`copilotkit project list --json\` to see ids alongside slugs.
 function buildProjectSelectJson(selection, apiKeyProvisioned, configPath) {
   return {
     type: "completed",
+    selected_project_slug: selection.projectSlug,
     project: {
       id: selection.projectId,
       slug: selection.projectSlug,
       organizationId: selection.organizationId
     },
     config_path: configPath,
-    api_key_provisioned: apiKeyProvisioned
+    project_file_written: true,
+    api_key_provisioned: apiKeyProvisioned,
+    environment_file_written: apiKeyProvisioned
   };
 }
 var init_project_select_flags = __esm({
@@ -373441,7 +373459,7 @@ function intelligenceConsumedCheck(credential, runtime) {
   }
   if (runtime.info.licenseStatus === void 0) {
     return {
-      detail: `The key authenticates, but the runtime reports no license, which means it was built without an Intelligence client and is running in SSE mode. The key is never read: threads are not durable and nothing reaches the platform. Pass \`intelligence: new CopilotKitIntelligence({ apiKey })\` where the runtime is constructed \u2014 https://docs.copilotkit.ai/premium/connect-your-runtime`,
+      detail: `The key authenticates, but the runtime reports no license, which means it was built without an Intelligence client and is running in OSS/SSE mode. The key is never read and nothing reaches the platform. The default in-memory OSS runner is ephemeral. SQLite, custom, or framework persistence can be durable. Pass \`intelligence: new CopilotKitIntelligence({ apiKey })\` where the runtime is constructed \u2014 https://docs.copilotkit.ai/premium/connect-your-runtime`,
       id: "intelligence_consumed",
       status: "fail",
       title
@@ -373454,6 +373472,31 @@ function intelligenceConsumedCheck(credential, runtime) {
     title
   };
 }
+function ossRuntimeModeCheck(runtime) {
+  const title = "The runtime uses the expected OSS mode";
+  if (runtime.kind !== "ok") {
+    return {
+      detail: "Not attempted: the runtime did not return valid /info data. Fix the runtime check above first.",
+      id: "runtime_mode",
+      status: "undetermined",
+      title
+    };
+  }
+  if (runtime.info.licenseStatus !== void 0) {
+    return {
+      detail: `The runtime reports license ${runtime.info.licenseStatus}, so it uses Intelligence rather than OSS mode.`,
+      id: "runtime_mode",
+      status: "fail",
+      title
+    };
+  }
+  return {
+    detail: "The runtime returned valid /info data without licenseStatus, as expected for OSS mode.",
+    id: "runtime_mode",
+    status: "pass",
+    title
+  };
+}
 function intelligenceThreadRoutesCheck(runtime) {
   const title = "The runtime serves the Intelligence thread routes";
   if (runtime.kind !== "ok") {
@@ -373515,8 +373558,12 @@ function collectFacts(input) {
     runtimeVersion: info?.version
   };
 }
-function runVerifyChecks(input) {
-  const checks = [
+function runVerifyChecks(input, expectedRuntime = "intelligence") {
+  const checks = expectedRuntime === "oss" ? [
+    runtimeReachableCheck(input.runtime),
+    runtimeAgentsCheck(input.runtime),
+    ossRuntimeModeCheck(input.runtime)
+  ] : [
     projectSelectedCheck(input.projectConfig),
     apiKeyPresentCheck(
       input.apiKeyVariableName,
@@ -373861,18 +373908,24 @@ async function runVerify(options, overrides = {}) {
     probeRuntimeInfo(runtimeUrl, deps.fetchImpl)
   ]);
   const apiKeySource = apiKey === void 0 || deps.env[apiKey.variableName] !== void 0 ? void 0 : projectEnv.origins[apiKey.variableName];
-  const result = runVerifyChecks({
-    apiKeySource,
-    apiKeyVariableName: apiKey?.variableName,
-    credential,
-    envSearch: {
-      ceiling: projectEnv.ceiling,
-      searchedFrom: projectEnv.searchedFrom
+  const expectedRuntime = options.expectRuntime ?? "intelligence";
+  const result = runVerifyChecks(
+    {
+      apiKeySource,
+      apiKeyVariableName: apiKey?.variableName,
+      credential,
+      envSearch: {
+        ceiling: projectEnv.ceiling,
+        searchedFrom: projectEnv.searchedFrom
+      },
+      projectConfig,
+      runtime
     },
-    projectConfig,
-    runtime
-  });
-  const roundTrip = options.roundTrip === true ? await runLiveRoundTrip(options, deps, runtimeUrl, runtime) : void 0;
+    expectedRuntime
+  );
+  const roundTrip = expectedRuntime === "oss" && (options.roundTrip !== true || options.agent === void 0) ? notAttempted(
+    "Not attempted: --expect-runtime oss requires --round-trip --agent <id> so the named agent must answer before this command can pass."
+  ) : options.roundTrip === true ? await runLiveRoundTrip(options, deps, runtimeUrl, runtime) : void 0;
   const context3 = { runtimeUrl, runtimeUrlSource };
   deps.stdout(
     options.json ? renderVerifyJson(result, context3, roundTrip) : renderVerifyReport(result, context3, roundTrip)
@@ -384402,6 +384455,7 @@ refused before anything is sent, and the reason is printed. Both commands print
 what they sent. Every refusal exits zero and leaves onboarding unaffected.
 `,
   verify: `Usage: copilotkit verify [--json] [--runtime-url <url>] [--round-trip]
+                         [--expect-runtime <mode>]
 
 Check that this project's CopilotKit wiring works, and report what it found.
 
@@ -384418,10 +384472,15 @@ the answer back from the thread, which is the only check here that proves the
 agent runs rather than that it is configured. That costs a model call and
 records a thread, so it is opt-in.
 
+With --expect-runtime oss, hosted project and credential checks do not apply.
+The command exits zero only when valid /info data declares the named agent,
+licenseStatus is absent, and --round-trip --agent <id> passes.
+
 Options:
   --json                 Emit a machine-readable payload alone on stdout
   --runtime-url <url>    The CopilotKit runtime endpoint to probe
                          (default: http://localhost:3000/api/copilotkit)
+  --expect-runtime <mode> Require intelligence (default) or oss runtime mode
   --round-trip           Also run the agent and read its answer back
   --agent <id>           Which declared agent to run, when there are several
   --timeout <seconds>    How long to wait for the answer (default: 90)
@@ -384612,6 +384671,7 @@ one currently selected in .copilotkit/project.json.
 
 Options:
       --json             Emit a machine-readable payload instead of a table
+      --search <query>   Match a project name, slug, or id
   -h, --help             Show help for project list
 
 Runs with no TTY, so a coding agent can read the choices before selecting one.
@@ -384641,9 +384701,10 @@ organization's real projects, so a typo fails with the available slugs rather
 than recording a selection that points at nothing. Run
 \`copilotkit project list --json\` first to see them.
 
---json reports api_key_provisioned. Key provisioning is deliberately non-fatal,
-so a run can persist the selection, warn on stderr, and still exit 0 with no key
-written; that field is how a caller detects it without reading stderr.
+--json reports selected_project_slug, project_file_written,
+api_key_provisioned, and environment_file_written. Key provisioning is
+deliberately non-fatal, so the key fields can be false after exit 0. The payload
+never contains the API key.
 
 With --json the payload is the ONLY thing on stdout: warnings, errors, and the
 interactive picker itself all render to stderr, so piping stdout into a parser
@@ -385196,15 +385257,22 @@ async function runProjectCommand(argv) {
     const parsed2 = parseArgs4({
       args: [...argv.slice(1)],
       options: {
-        json: { type: "boolean" }
+        json: { type: "boolean" },
+        search: { type: "string" }
       },
       strict: true,
       allowPositionals: false
     });
-    await withTelemetry({ command: "project", subcommand: "list" }, async () => {
-      const { runProjectList: runProjectList2 } = await Promise.resolve().then(() => (init_project_list(), project_list_exports));
-      await runProjectList2({ json: parsed2.values["json"] === true });
-    });
+    await withTelemetry(
+      { command: "project", subcommand: "list" },
+      async () => {
+        const { runProjectList: runProjectList2 } = await Promise.resolve().then(() => (init_project_list(), project_list_exports));
+        await runProjectList2({
+          json: parsed2.values["json"] === true,
+          search: parsed2.values["search"]
+        });
+      }
+    );
     return;
   }
   if (subcommand !== "select") {
@@ -385558,6 +385626,7 @@ async function runVerifyCommand(argv) {
     args: [...argv],
     options: {
       agent: { type: "string" },
+      "expect-runtime": { type: "string" },
       header: { multiple: true, type: "string" },
       json: { type: "boolean" },
       "round-trip": { type: "boolean" },
@@ -385581,6 +385650,14 @@ async function runVerifyCommand(argv) {
   if (timeoutSeconds !== void 0 && !/^\d+$/.test(timeoutSeconds)) {
     process.stderr.write(
       `Error: --timeout must be a whole number of seconds (received "${timeoutSeconds}").
+`
+    );
+    await exitWithFlush(1);
+  }
+  const expectedRuntime = parsed.values["expect-runtime"];
+  if (expectedRuntime !== void 0 && expectedRuntime !== "intelligence" && expectedRuntime !== "oss") {
+    process.stderr.write(
+      `Error: --expect-runtime must be intelligence or oss (received "${expectedRuntime}").
 `
     );
     await exitWithFlush(1);
@@ -385589,9 +385666,7 @@ async function runVerifyCommand(argv) {
     parsed.values["header"] ?? []
   );
   if (headers === void 0) {
-    process.stderr.write(
-      'Error: --header expects "Name: value".\n'
-    );
+    process.stderr.write('Error: --header expects "Name: value".\n');
     await exitWithFlush(1);
   }
   const agent = parsed.values["agent"];
@@ -385599,6 +385674,7 @@ async function runVerifyCommand(argv) {
   await runVerify2({
     json: parsed.values["json"] === true,
     ...agent === void 0 ? {} : { agent },
+    ...expectedRuntime === void 0 ? {} : { expectRuntime: expectedRuntime },
     ...headers === void 0 || Object.keys(headers).length === 0 ? {} : { headers },
     ...parsed.values["round-trip"] === true ? { roundTrip: true } : {},
     ...runtimeUrl === void 0 ? {} : { runtimeUrl },

package/onboarding/index.json

@@ -3,6 +3,7 @@
   "prompts": [
     {
       "edges": [
+        "proof/oss-baseline",
         "credentials/plan",
         "unsupported/no-validated-path"
       ],
@@ -19,17 +20,91 @@
     },
     {
       "edges": [
+        "framework/ag2",
+        "framework/agno",
+        "framework/built-in",
+        "framework/claude-sdk-python",
+        "framework/claude-sdk-typescript",
+        "framework/crewai-flows",
+        "framework/deep-agents",
         "framework/langgraph-python",
+        "framework/langgraph-fastapi",
         "framework/langgraph-typescript",
+        "framework/llamaindex",
         "framework/google-adk",
         "framework/ms-agent-python",
         "framework/ms-agent-dotnet",
         "framework/mastra",
+        "framework/ms-agent-harness-dotnet",
+        "framework/pydantic-ai",
+        "framework/strands-python",
+        "framework/strands-typescript",
         "unsupported/no-validated-path"
       ],
       "milestone": "credentials",
       "name": "credentials/plan"
     },
+    {
+      "edges": [],
+      "milestone": "fallback",
+      "name": "fallback/best-effort"
+    },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/ag2"
+    },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/agno"
+    },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/built-in"
+    },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/claude-sdk-python"
+    },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/claude-sdk-typescript"
+    },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/crewai-flows"
+    },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/deep-agents"
+    },
     {
       "edges": [
         "frontend/plan",
@@ -38,6 +113,14 @@
       "milestone": "framework",
       "name": "framework/google-adk"
     },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/langgraph-fastapi"
+    },
     {
       "edges": [
         "frontend/plan",
@@ -54,6 +137,14 @@
       "milestone": "framework",
       "name": "framework/langgraph-typescript"
     },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/llamaindex"
+    },
     {
       "edges": [
         "frontend/plan",
@@ -70,6 +161,14 @@
       "milestone": "framework",
       "name": "framework/ms-agent-dotnet"
     },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/ms-agent-harness-dotnet"
+    },
     {
       "edges": [
         "frontend/plan",
@@ -78,6 +177,30 @@
       "milestone": "framework",
       "name": "framework/ms-agent-python"
     },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/pydantic-ai"
+    },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/strands-python"
+    },
+    {
+      "edges": [
+        "frontend/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "framework",
+      "name": "framework/strands-typescript"
+    },
     {
       "edges": [
         "credentials/finalize-plan",
@@ -116,6 +239,7 @@
     },
     {
       "edges": [
+        "credentials/finalize-plan",
         "unsupported/no-validated-path"
       ],
       "milestone": "frontend",
@@ -142,6 +266,14 @@
       "milestone": "proof",
       "name": "proof/complete"
     },
+    {
+      "edges": [
+        "credentials/plan",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "proof",
+      "name": "proof/oss-baseline"
+    },
     {
       "edges": [
         "proof/complete",
@@ -168,10 +300,17 @@
     {
       "edges": [],
       "milestone": "subagent",
-      "name": "subagent/prove-round-trip"
+      "name": "subagent/prove-oss-baseline"
     },
     {
       "edges": [],
+      "milestone": "subagent",
+      "name": "subagent/prove-round-trip"
+    },
+    {
+      "edges": [
+        "fallback/best-effort"
+      ],
       "milestone": "unsupported",
       "name": "unsupported/no-validated-path"
     }

package/onboarding/prompts/authenticate/start.md

@@ -14,7 +14,12 @@ question from the documentation this graph gives you. Another checkout on this m
 not a source. The developer running this has none, so an answer taken from one is an
 answer they cannot get, and it hides the documentation gap that blocks them.
 
-Run `npx copilotkit@4.8.4 login --json` before any project work. This command checks the
+Tell the developer that onboarding can send feedback outside this machine. Explain that
+the reports contain short descriptions of CLI or documentation problems. Ask whether the
+developer permits these reports before project work starts. Record the answer. Do not send
+feedback unless the developer permits it.
+
+Run `npx --yes copilotkit@4.9.0 login --json` before any project work. This command checks the
 current session. It starts sign-in only as needed.
 
 Read its JSON Lines output in order:
@@ -34,10 +39,17 @@ prompt and tell it to follow that brief and return only its findings. Add these
 - Check whether `.copilotkit/project.json` has `projectId`, `projectSlug`, and `clerkOrgId`.
 - Check whether `.env` has a non-empty `INTELLIGENCE_API_KEY` entry.
 - Record the `.env` file modification time without returning it.
+- Report whether an agent, frontend, and CopilotKit integration are present.
+- Report whether the runtime constructor uses a `runner` option, an `intelligence`
+  option, or neither can be proved from project files.
 
 Do not print either file or any secret value. Return only paths, presence checks, and missing
 field names. Wait for the subagent to finish.
 
+If the findings show an empty project and do not prove its purpose, ask what the developer
+wants to build before you select a framework. Ask this question immediately. Record the
+answer and give it to each later subagent.
+
 If a repository file exists, each finding must cite it. For an empty project, the subagent
 must cite its directory check and report absent parts.
 
@@ -45,11 +57,16 @@ The findings must cover what the project is for, the agent, frontend, CopilotKit
 authentication, credential names, and validation path. Do not ask the developer for facts
 that the repository answers.
 
-When the evidence is complete, run
-`npx copilotkit@4.8.4 onboard read credentials/plan`.
+Do not infer a working OSS path from packages, imports, project files, or keys. If an
+agent, frontend, and CopilotKit integration are present, prove the live starting state
+before any project file changes. Run
+`npx --yes copilotkit@4.9.0 onboard read proof/oss-baseline`.
+
+For every other inspected state, run
+`npx --yes copilotkit@4.9.0 onboard read credentials/plan`.
 
 If authentication or inspection stops onboarding, run
-`npx copilotkit@4.8.4 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.0 onboard read unsupported/no-validated-path`.
 
 ## Research subagent brief