copilotkit 4.8.4 → 4.9.1

package/onboarding/prompts/framework/strands-python.md

@@ -0,0 +1,42 @@
+# Configure Strands Agents Python
+
+Preserve an existing Strands model setup. Start with OpenAI for a new agent. Offer another
+vendor only after an exact CopilotKit Markdown page names it. The page must name its
+credential variables and setup steps.
+
+Name the default model credential `OPENAI_API_KEY`.
+
+Keep `INTELLIGENCE_API_KEY` separate from model-vendor credentials. Do not read, show,
+store, or request a secret value.
+
+## Documentation
+
+- https://docs.copilotkit.ai/strands/quickstart.md
+- https://docs.copilotkit.ai/strands/inspector.md
+- https://docs.copilotkit.ai/strands/generative-ui/a2ui/fixed-schema.md
+- https://docs.copilotkit.ai/strands/shared-state/agent-readonly.md
+
+Fetch all four pages in one step rather than one after another.
+
+The documentation scope is `strands`. Use the Python examples from these pages.
+The fixed-schema A2UI tool makes its own OpenAI call. Set `injectA2UITool` to `false` when
+the fixed-schema A2UI tool makes its own OpenAI call. This prevents a second injected A2UI
+tool from changing the documented setup.
+
+No Strands agent-app-context Markdown page is available. Do not invent an
+agent-app-context setup. If the requested work needs that missing setup, run the
+unsupported route below.
+
+Record the selected framework, vendor, model, required credential variable names, these
+URLs, and the context documentation gap. Do not use remembered CopilotKit instructions.
+
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Treat a page as
+unavailable only after a second method also fails.
+
+If the pages support the selection, run
+`npx --yes copilotkit@4.9.1 onboard read frontend/plan`.
+
+If a second method also fails, or a page that loads does not support the selection, run
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/strands-typescript.md

@@ -0,0 +1,42 @@
+# Configure Strands Agents TypeScript
+
+Preserve an existing Strands model setup. Start with OpenAI for a new agent. Offer another
+vendor only after an exact CopilotKit Markdown page names it. The page must name its
+credential variables and setup steps.
+
+Name the default model credential `OPENAI_API_KEY`.
+
+Keep `INTELLIGENCE_API_KEY` separate from model-vendor credentials. Do not read, show,
+store, or request a secret value.
+
+## Documentation
+
+- https://docs.copilotkit.ai/strands-typescript/quickstart.md
+- https://docs.copilotkit.ai/strands-typescript/inspector.md
+- https://docs.copilotkit.ai/strands-typescript/generative-ui/a2ui/fixed-schema.md
+- https://docs.copilotkit.ai/strands-typescript/shared-state/agent-readonly.md
+
+Fetch all four pages in one step rather than one after another.
+
+The documentation scope is `strands-typescript`. Use only the TypeScript examples from
+these pages. Install `@modelcontextprotocol/sdk` as a runtime dependency.
+`@strands-agents/sdk` loads it even when the application does not use MCP.
+
+The fixed-schema page has no Strands TypeScript backend example. No Strands TypeScript
+agent-app-context Markdown page is available. Do not translate another language's backend
+example or invent either missing setup. If the requested work needs either missing setup,
+run the unsupported route below.
+
+Record the selected framework, vendor, model, required credential variable names, these
+URLs, and both documentation gaps. Do not use remembered CopilotKit instructions.
+
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Treat a page as
+unavailable only after a second method also fails.
+
+If the pages support the selection, run
+`npx --yes copilotkit@4.9.1 onboard read frontend/plan`.
+
+If a second method also fails, or a page that loads does not support the selection, run
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/angular.md

@@ -20,8 +20,14 @@ Angular CLI 22 requires Node `^22.22.3 || ^24.15.0 || >=26`. Check the Node vers
 you create or build an Angular project. If the installed version is lower, select a
 supported version first and use it for every later command in this project.
 
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Treat a page as
+unavailable only after a second method also fails.
+
 If the page supports the selection, run
-`npx copilotkit@4.8.4 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.1 onboard read credentials/finalize-plan`.
 
-If the page does not load or support the selection, run
-`npx copilotkit@4.8.4 onboard read unsupported/no-validated-path`.
+If a second method also fails, or the page that loads does not support the selection,
+run
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/nextjs.md

@@ -16,8 +16,13 @@ agent framework documentation instead. This page configures the CopilotKit built
 agent as the default agent, which is correct only for a project that has no agent.
 Do not replace the developer's existing agent with the built-in agent.
 
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Treat a page as
+unavailable only after a second method also fails.
+
 If the pages support the selection, run
-`npx copilotkit@4.8.4 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.1 onboard read credentials/finalize-plan`.
 
-If a page does not load or support the selection, run
-`npx copilotkit@4.8.4 onboard read unsupported/no-validated-path`.
+If a second method also fails, or a page that loads does not support the selection, run
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/plan.md

@@ -3,6 +3,12 @@
 Use the repository findings to select the frontend. Ask the developer only for choices
 that the repository does not show. Do not change application code in this phase.
 
+Use a gentle wizard. Ask one short question at a time. Do not combine separate choices in
+one question. Put the recommendation first, give its evidence in one sentence, and keep
+the alternatives short. When the frontend is unknown, ask only whether to use the
+recommended frontend. If the developer declines it, ask one follow-up question that lists
+the valid frontend choices. Do not ask about the model or project in this step.
+
 If the project has a frontend, preserve it and use the matching route below. If the project
 needs a frontend, show the valid choices and one recommendation based on repository
 evidence, then ask the developer to choose.
@@ -10,18 +16,24 @@ evidence, then ask the developer to choose.
 The valid choices are React SPA, Next.js, Angular, Vue 3, and React Native. They are valid
 in every starting state. Do not show the internal route.
 
-React SPA has no documented implementation or proof in this release, so it cannot reach a
-validated outcome. Do not recommend it. Recommend one of Next.js, Angular, Vue 3, or React
-Native. Offer React SPA only when the developer names it, and say that this release cannot
-validate that choice.
+Recommend the frontend the project already uses. Where there is no existing frontend,
+recommend the one the developer names, and say what each choice implies for where the
+CopilotKit runtime lives: Next.js hosts it in a route handler, Angular in its SSR
+server, and Vue 3, React SPA and React Native reach a runtime that runs as its own
+process.
+
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Treat a page as
+unavailable only after a second method also fails.
 
 Use exactly one matching internal route:
 
-1. React SPA: `npx copilotkit@4.8.4 onboard read frontend/react-spa`
-2. Next.js: `npx copilotkit@4.8.4 onboard read frontend/nextjs`
-3. Angular: `npx copilotkit@4.8.4 onboard read frontend/angular`
-4. Vue 3: `npx copilotkit@4.8.4 onboard read frontend/vue`
-5. React Native: `npx copilotkit@4.8.4 onboard read frontend/react-native`
+1. React SPA: `npx --yes copilotkit@4.9.1 onboard read frontend/react-spa`
+2. Next.js: `npx --yes copilotkit@4.9.1 onboard read frontend/nextjs`
+3. Angular: `npx --yes copilotkit@4.9.1 onboard read frontend/angular`
+4. Vue 3: `npx --yes copilotkit@4.9.1 onboard read frontend/vue`
+5. React Native: `npx --yes copilotkit@4.9.1 onboard read frontend/react-native`
 
 If no listed frontend fits, run
-`npx copilotkit@4.8.4 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-native.md

@@ -11,8 +11,14 @@ Preserve an existing React Native frontend. Use the selected page for a new fron
 Fetch the selected documentation page. Record React Native as the selected frontend and
 keep this URL. Do not use remembered CopilotKit instructions.
 
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Treat a page as
+unavailable only after a second method also fails.
+
 If the page supports the selection, run
-`npx copilotkit@4.8.4 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.1 onboard read credentials/finalize-plan`.
 
-If the page does not load or support the selection, run
-`npx copilotkit@4.8.4 onboard read unsupported/no-validated-path`.
+If a second method also fails, or the page that loads does not support the selection,
+run
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-spa.md

@@ -1,12 +1,27 @@
 # Configure React SPA
 
-Preserve an existing React SPA. This release has no documented implementation or proof
-path for React SPA. Do not change the project from remembered CopilotKit instructions.
+Preserve an existing React SPA. Use the selected page for a new frontend.
+
+A React SPA has no server of its own, so the CopilotKit runtime is a separate process
+rather than a route inside the app. Do not add a runtime route to the SPA build, and do
+not move the agent into it.
 
 ## Documentation
 
 - Credentials and plan: `Not applicable`
-- Implementation and validation: `Not documented`
-- Proof: `Not documented`
+- Implementation and validation: https://docs.copilotkit.ai/react-spa.md
+- Proof: https://docs.copilotkit.ai/react-spa.md
+
+Fetch the selected documentation page. Record React SPA as the selected frontend and
+keep this URL. Do not use remembered CopilotKit instructions.
+
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Treat a page as
+unavailable only after a second method also fails.
+
+If the page supports the selection, run
+`npx --yes copilotkit@4.9.1 onboard read credentials/finalize-plan`.
 
-Run `npx copilotkit@4.8.4 onboard read unsupported/no-validated-path`.
+If a second method also fails, or a page that loads does not support the selection, run
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/vue.md

@@ -11,8 +11,14 @@ Preserve an existing Vue 3 frontend. Use the selected page for a new frontend.
 Fetch the selected documentation page. Record Vue 3 as the selected frontend and keep
 this URL. Do not use remembered CopilotKit instructions.
 
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Treat a page as
+unavailable only after a second method also fails.
+
 If the page supports the selection, run
-`npx copilotkit@4.8.4 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.1 onboard read credentials/finalize-plan`.
 
-If the page does not load or support the selection, run
-`npx copilotkit@4.8.4 onboard read unsupported/no-validated-path`.
+If a second method also fails, or the page that loads does not support the selection,
+run
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/implementation/build-and-validate.md

@@ -8,7 +8,7 @@ documentation URLs.
 Wait for the subagent to finish.
 
 If all implementation and validation steps pass, run
-`npx copilotkit@4.8.4 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.9.1 onboard read proof/round-trip`.
 
 If a validation command fails, decide which kind of failure it is before you route.
 
@@ -20,7 +20,7 @@ Route out only when the failure is not yours to fix: the failure is in code this
 not write, or the fix requires changing the developer's existing agent or frontend,
 or the same command still fails after three repair attempts, or the documentation does not
 support the plan. In those cases run
-`npx copilotkit@4.8.4 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.
 
 ## Implementation subagent brief
 
@@ -34,6 +34,11 @@ Use only the approved plan and the selected documentation URLs. Fetch every URL
 step, before you change the project, rather than one after another.
 Do not use remembered CopilotKit instructions.
 
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Report a
+documentation gap only after a second method also fails.
+
 Add only the props, options, and imports that appear in the fetched documentation. A
 remembered API from an earlier CopilotKit version will fail type checking against this
 release, so do not decorate a documented example with anything it does not show.
@@ -50,6 +55,11 @@ file outside the project directory: not for a credential, and not for an API que
 fetched documentation answers. A missing credential is the main coding agent's to ask
 for.
 
+For a recorded `both-oss` baseline, preserve the existing agent, frontend, CopilotKit
+integration, user-visible request, and runtime behavior. Do not replace the existing
+persistence. Change only the approved project selection and Intelligence runtime wiring.
+Run the recorded baseline checks after the change and report any regression.
+
 When the documentation creates the frontend with the framework's own scaffolder,
 run that scaffolder rather than hand-authoring what it emits.
 Do not re-declare a compiler option it set. Every real project of that framework

package/onboarding/prompts/proof/complete.md

@@ -1,13 +1,20 @@
-# Complete onboarding
+# Close out onboarding
 
 Report the selected framework, frontend, model, and complete round-trip evidence to the developer.
 Report the exact interaction, visible result, validation commands, and evidence locations.
 
 Do not complete onboarding without this evidence.
 
-Report whether the real UI was driven in a browser, using the outcome the proof subagent
+Report whether the real UI was driven on this journey's own surface -- in a browser for a
+web frontend, on a device for React Native -- using the outcome the proof subagent
 returned. Do not soften it and do not leave it out: a run that never drove the UI proved
-the agent, not the browser path, and the developer needs to know which they have.
+the agent, not the surface, and the developer needs to know which they have.
+
+**Whether this run is complete is decided by the command at the end of this prompt, not
+here.** Run it before you write the summary, and let its output decide which summary you
+write. A run whose surface was never driven is blocked, not complete: say so in the first
+line, name the evidence the command lists as missing, and do not describe the run as
+finished, working, or ready. Everything else below applies to either outcome.
 
 Report only the project this run worked in. The summary and every report below describe
 that project and nothing else. Do not name or describe a file outside the project
@@ -25,11 +32,22 @@ about it: keep this version pin, wire this constructor, run this build. It never
 as an account of hitting it. No count of what went wrong, no list of fixes made along the
 way, no argument that a failed check is not a defect.
 
-After reporting the evidence, report each thing that slowed this run down. Send at most
-four reports, worst first:
+The handoff must include:
+
+- The URL of the running app.
+- The command that starts the app in the future.
+- How to use the CopilotKit Inspector.
+- How to use https://intelligence.copilotkit.ai to manage the Intelligence installation.
+- The process IDs and stop commands for the running agent and frontend.
+
+State that the servers remain running after proof.
+
+Report each thing that slowed this run down. Send at most four reports, worst first. Run
+the friction commands without another developer question. The CLI telemetry gate decides
+whether the report is sent.
 
 ```text
-npx copilotkit@4.8.4 onboard friction --category <slug> --cost-seconds <seconds>
+npx --yes copilotkit@4.9.1 onboard friction --category <slug> --cost-seconds <seconds>
 ```
 
 Write one or two sentences on the command's standard input. Pick one category from
@@ -42,18 +60,35 @@ that carries any of those, prints the reason, and exits zero. A refused report i
 a failed step and not a failed onboarding run. Reword it and send it again, or move
 on. A run that proves a round trip is complete whether or not it reported friction.
 
-Send the friction reports and tell the developer nothing about them. Do not quote, count,
-or summarize them, and do not say that any were sent. Keeping them out of the summary is
-not a reason to soften them. The people who read them maintain this graph and want the
-blunt version.
+Tell the developer when you send a friction report. Do not quote or summarize the report
+unless the developer asks. If the CLI says that telemetry is disabled or unavailable,
+state that the report was not sent and continue without another question.
+
+When the evidence is gathered, run `npx --yes copilotkit@4.9.1 onboard complete`, carrying
+the surface-check outcome the proof subagent returned. Pass exactly one flag, and pass the
+one that matches this journey's surface.
+
+For a web frontend -- React SPA, Next.js, Angular, Vue:
 
-When the evidence is complete, run `npx copilotkit@4.8.4 onboard complete`, carrying
-the visual-check outcome the proof subagent returned:
+```text
+npx --yes copilotkit@4.9.1 onboard complete --visual-check <outcome>
+```
+
+The outcome is one of `performed`, `skipped-no-browser-tool`, or `failed`.
+
+For React Native:
 
 ```text
-npx copilotkit@4.8.4 onboard complete --visual-check <outcome>
+npx --yes copilotkit@4.9.1 onboard complete --device-check <outcome>
 ```
 
-The outcome is one of `performed`, `skipped-no-browser-tool`, or `failed`. The command
-prints what a skipped visual check leaves unverified, so pass the outcome you were given
-rather than the one you wanted.
+The outcome is one of `performed`, `skipped-no-device`, or `failed`.
+
+The two flags are not interchangeable and neither takes the other's outcomes. A browser
+proves nothing about a React Native view tree, and a device capture proves nothing about
+browser-origin CORS, so the flag you pass is how this run states which surface it proved.
+
+Pass the outcome you were given rather than the one you wanted. Anything but `performed`
+prints what the missing check leaves unverified and ends this run as blocked. That output
+is the developer's finding, so carry it into the summary rather than restating it as a
+smaller caveat.

package/onboarding/prompts/proof/oss-baseline.md

@@ -0,0 +1,59 @@
+# Prove the existing OSS baseline
+
+Do not prove the baseline yourself. Spawn one proof subagent.
+
+Give the subagent the full text of the baseline brief at the end of this prompt, the
+repository findings, and the exact CLI package spec. Wait for the subagent to finish.
+
+Do not change project files before this proof ends. Starting existing development
+processes and their ignored runtime files is allowed.
+
+If the subagent proves the `both-oss` predicate, keep its evidence with the plan. If it
+proves another supported starting state, record that state. In either case, run
+`npx --yes copilotkit@4.9.1 onboard read credentials/plan`.
+
+If it cannot identify the running process safely, exposes a secret, or finds a baseline
+failure that cannot be classified, run
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.
+
+## Baseline proof subagent brief
+
+Everything below the rule is the subagent's prompt. Give it verbatim.
+
+---
+
+# Prove the existing OSS CopilotKit baseline
+
+Read and run only inside the project directory. Do not edit source, configuration,
+dependencies, or tracked files. Do not read, show, store, or return secret values.
+
+Find the expected agent id from the project. Start the existing agent and frontend only
+when they are not already running. Before using a port, identify its process and working
+directory. Do not stop a process outside this project.
+
+Prove the live runtime in this order:
+
+1. GET `/info` from the project's CopilotKit runtime and require a valid response.
+2. Require `/info` to declare the expected agent id.
+3. Confirm that `licenseStatus` is absent. Its presence means the live runtime uses
+   Intelligence and is not an OSS starting state.
+4. Confirm from project files that the runtime constructor passes a `runner` option rather
+   than an `intelligence` option. A package, import, project file, or key is not use proof.
+5. Run
+   `npx --yes copilotkit@4.9.1 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   with the runtime URL or auth header options that this project needs. Require exit zero
+   and the JSON `ok` field to be `true`.
+6. Drive one real request through the existing frontend, CopilotKit runtime, and expected
+   agent. Require the existing user-visible result. If no browser tool is available, the
+   round trip is not proved and the state is `unproved`.
+
+Classify the state as `both-oss` only when all six predicates are true: agent present,
+interface present, CopilotKit present, CopilotKit round trip proven, runtime connection
+`oss`, and managed Intelligence not configured. Return each predicate and its secret-safe
+evidence.
+
+The default in-memory OSS runner is ephemeral. SQLite, custom, or framework persistence
+can be durable. Report the persistence that project evidence proves, or `unproved`. Do not
+replace it and do not describe all OSS runs as ephemeral.
+
+Stop after returning the baseline result, process ids and ports used, and evidence paths.

package/onboarding/prompts/proof/round-trip.md

@@ -10,8 +10,10 @@ Wait for the subagent to finish.
 Give the subagent this guide for continued-development tools:
 https://docs.copilotkit.ai/build-with-agents.md
 
-If the subagent proves the complete round trip and configures the tools, run
-`npx copilotkit@4.8.4 onboard read proof/complete`.
+If the subagent proves the complete round trip, run
+`npx --yes copilotkit@4.9.1 onboard read proof/complete`. The round trip proves core success
+even if a continued-development tool fails. Keep the Skills and MCP results separate from
+the proof result.
 
 If the round trip fails, decide which kind of failure it is before you route. A failure
 caused by a file this run created or changed is a defect in the new work. Send it back to
@@ -19,7 +21,7 @@ the proof subagent to fix and prove again, at most three attempts.
 
 Route out only when the failure is not yours to fix, when the same proof still fails after
 three attempts, or when no evidence of the round trip can be produced. In those cases run
-`npx copilotkit@4.8.4 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.
 
 ## Proof subagent brief
 
@@ -33,6 +35,11 @@ Use the proof steps and documentation URLs from the approved plan. Fetch every s
 URL in one step before you start, rather than one after another.
 Do not use remembered CopilotKit instructions.
 
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Report a
+documentation gap only after a second method also fails.
+
 Read the port the developer's agent already serves from this project's own
 configuration. Do not assume a default, and do not start a second copy of an agent this
 project is already running. Before you bind any new server, check that the port is free
@@ -40,8 +47,12 @@ and pick another one if it is not. Record every port you used.
 
 Start the agent and the selected frontend.
 
+Leave the agent and frontend servers running after proof. Record each process ID and a
+safe command that stops that process. Record the frontend URL and the commands that start
+both servers again.
+
 With both running, check the wiring in one command before you open a browser:
-`npx copilotkit@4.8.4 verify --json`. Add `--runtime-url` when the runtime is not at
+`npx --yes copilotkit@4.9.1 verify --json`. Add `--runtime-url` when the runtime is not at
 `http://localhost:3000/api/copilotkit`. Read the individual checks rather than the summary
 alone: a check reported `undetermined` did not run, and that is not a pass. Fix anything
 that is not a pass before the browser, because a browser failure stacked on broken wiring
@@ -60,7 +71,7 @@ because the runtime reports no thread-endpoint state, the runtime predates the f
 Record that and move on — there is nothing to repair.
 
 Then prove that the agent actually runs, which is the gate for this node:
-`npx copilotkit@4.8.4 verify --round-trip --json`. It sends one request through the
+`npx --yes copilotkit@4.9.1 verify --round-trip --json`. It sends one request through the
 runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -72,6 +83,11 @@ it.
 Then send one real request through the frontend. Make sure that the request passes through
 CopilotKit and reaches the selected agent.
 
+For a recorded `both-oss` starting state: Compare the final round trip with the recorded
+OSS baseline. The same frontend request must still reach the same agent and produce the
+same kind of user-visible result. The runtime must now report `licenseStatus`, and the
+authenticated Intelligence checks must pass. Record both before and after evidence.
+
 Before you trust the agent, confirm that the process answering is the one in this
 repository. `verify` reports which agents the runtime declares and has nothing to compare
 them against, and `--round-trip` proves an agent answers under the declared id without
@@ -93,20 +109,32 @@ by one.
 Address a local agent by host name rather than by an IP literal. Some local agents bind
 IPv6 only, so an IPv4 literal fails against the correct port.
 
-Drive the real UI in a browser whenever your environment can, and make sure that the
-frontend receives working generative UI from the agent. Prefer this: it is the only step
-that covers realtime delivery to a browser, browser-origin CORS and CSP, the frontend
-provider being wired to this runtime, and a generative UI component actually rendering,
-and no command-line check reaches any of them.
+Drive the real UI on this journey's own surface, and make sure that the frontend receives
+working generative UI from the agent. This is the step that covers realtime delivery, the
+frontend provider being wired to this runtime, and a generative UI component actually
+rendering, and no command-line check reaches any of them. It is not optional polish: a run
+that skips it has proven the agent and not the journey, and the graph ends such a run as
+blocked rather than complete.
+
+For a web frontend, that surface is a browser, and it also covers browser-origin CORS and
+CSP, which a CLI request never exercises. Use a browser MCP server already configured for
+the coding agent you are running as, the same way the CopilotKit documentation MCP server
+below is configured. Do not add a browser driver to this project: a devDependency and a
+browser download land in the diff and tax a repository that never asked for one. If nothing
+in your environment can drive a browser, skip this step rather than installing one.
+
+Report exactly one of `performed`, `skipped-no-browser-tool`, or `failed` for a web
+frontend.
+
+For React Native, that surface is a device or emulator, and a browser cannot stand in for
+it. Run the app on a booted emulator, drive the same request, and capture the terminal
+state with `adb exec-out screencap -p`. Read `adb logcat` as well: a redbox is a runtime
+failure the terminal output never shows. If no device or emulator is available, skip this
+step rather than substituting a browser.
 
-Use a browser MCP server already configured for the coding agent you are running as, the
-same way the CopilotKit documentation MCP server below is configured. Do not add a browser
-driver to this project: a devDependency and a browser download land in the diff and tax a
-repository that never asked for one. If nothing in your environment can drive a
-browser, skip this step rather than installing one, and never report a visual result you
-did not see.
+Report exactly one of `performed`, `skipped-no-device`, or `failed` for React Native.
 
-Report exactly one of `performed`, `skipped-no-browser-tool`, or `failed` for this step.
+Never report a result you did not see, on either surface.
 
 Record the input, visible result, relevant process status, and evidence locations. Do not
 return secret values.
@@ -125,19 +153,18 @@ project's data never reaches the agent, the agent receives it and its instructio
 it, the page loads its data after the context was registered, or the run wired a different
 source than the page renders. Fix that cause, then prove again.
 
-Install the continued-development tools while you drive the round trip, not after it. The
-two are independent, so running them one after the other adds minutes to the journey for
-no reason. Fetch the continued-development guide from the main coding agent at the same
-time as the proof documentation.
+Fetch the continued-development guide from the main coding agent with the proof
+documentation. Try the continued-development tools after the application passes proof.
 Use it to install the project-scoped CopilotKit Skills.
 Use it to configure the CopilotKit documentation MCP server for the current coding agent.
 
-Record the installed Skills and the configured MCP server. If either tool step fails, return
-the exact documentation gap or error.
+Do not validate whether the Skills or MCP server installed correctly. Record the command
+result for each attempt. Report each tool result separately. A tool error does not change
+the proof result.
 
 Gather what you need in as few commands as possible. Combine independent reads into one
 command rather than running them one at a time. Split a command only when its result decides
 what you run next.
 
 Return the proof or the exact failed step to the main coding agent, together with the
-visual-check outcome. Stop after you return the result.
+surface-check outcome and which surface it speaks for. Stop after you return the result.

package/onboarding/prompts/subagent/create-plan.md

@@ -4,6 +4,11 @@ Use the selected framework, frontend, model, repository findings, and documentat
 from the main coding agent. Fetch every selected URL in one step rather than one after
 another. Do not use remembered CopilotKit instructions.
 
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Report a
+documentation gap only after a second method also fails.
+
 Name the application the project asks for, and plan that application. Each documentation
 page teaches through one worked example, and that example carries a domain of its own.
 The domain belongs to the page. The project's purpose from the repository findings
@@ -19,11 +24,18 @@ Preserve each agent or frontend that already exists.
 
 Plan the runtime to consume the Intelligence credential. The runtime takes an
 `intelligence` option holding a client built from the project key. A runtime given a
-`runner` option instead is the SSE runtime. It never reads the key, threads are not
-durable, and the Inspector reads the project as locked. The two options cannot be
+`runner` option instead is the OSS runtime. It never reads the Intelligence key, and the
+Inspector reads the project as locked. The default in-memory OSS runner is ephemeral.
+SQLite, custom, or framework persistence can be durable. The two options cannot be
 combined. Take the constructor from the connect-your-runtime page. Where a framework
 quickstart shows a `runner` option instead, the connect-your-runtime page wins.
 
+When the starting state is `both-oss`, use its recorded live baseline evidence. Preserve
+the working agent, frontend, CopilotKit integration, and OSS behavior. Plan only the
+project selection, Intelligence runtime configuration, and authenticated proof needed for
+the conversion. Preserve the existing persistence and user-visible request. Do not
+rebuild a path that already works.
+
 Where the SDK requires an application-level value that the repository cannot supply, such
 as an end-user identity for threads, use one clearly marked local placeholder and name what
 production requires instead. Do not stop onboarding to ask the developer for it.