copilotkit 4.8.4 → 4.9.1

package/onboarding/prompts/subagent/implement-and-validate.md

@@ -4,6 +4,11 @@ Use only the approved plan and the selected documentation URLs. Fetch every URL
 step, before you change the project, rather than one after another.
 Do not use remembered CopilotKit instructions.
 
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Report a
+documentation gap only after a second method also fails.
+
 Add only the props, options, and imports that appear in the fetched documentation. A
 remembered API from an earlier CopilotKit version will fail type checking against this
 release, so do not decorate a documented example with anything it does not show.
@@ -20,6 +25,11 @@ file outside the project directory: not for a credential, and not for an API que
 fetched documentation answers. A missing credential is the main coding agent's to ask
 for.
 
+For a recorded `both-oss` baseline, preserve the existing agent, frontend, CopilotKit
+integration, user-visible request, and runtime behavior. Do not replace the existing
+persistence. Change only the approved project selection and Intelligence runtime wiring.
+Run the recorded baseline checks after the change and report any regression.
+
 When the documentation creates the frontend with the framework's own scaffolder,
 run that scaffolder rather than hand-authoring what it emits.
 Do not re-declare a compiler option it set. Every real project of that framework

package/onboarding/prompts/subagent/inspect-repository.md

@@ -8,6 +8,10 @@ Inspect the repository without changing it. Find evidence for:
 - current CopilotKit packages and configuration
 - authentication boundaries
 - names of required credential variables, without reading their values
+- package manager and lockfile
+- required toolchains and their installed versions
+- declared ports and whether each port is available
+- CopilotKit package versions and package compatibility risks
 
 A project states what it is for in its `README.md`, in its package description, or in
 the prompt of an agent it already has. Quote that statement rather than rewriting it. An
@@ -16,7 +20,8 @@ evidence. State the purpose as unproved when the project never says.
 
 Gather what you need in as few commands as possible. Combine independent reads into one
 command rather than running them one at a time. Split a command only when its result decides
-what you run next.
+what you run next. Keep this preflight read-only. Do not install packages, stop processes,
+or change a port. Check only the toolchains and ports that repository files require.
 
 Return the file paths and a short finding for each item. State each absent or unproved item.
 Do not read, print, or return secret values. Do not read a file outside the project

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -0,0 +1,35 @@
+# Prove the existing OSS CopilotKit baseline
+
+Read and run only inside the project directory. Do not edit source, configuration,
+dependencies, or tracked files. Do not read, show, store, or return secret values.
+
+Find the expected agent id from the project. Start the existing agent and frontend only
+when they are not already running. Before using a port, identify its process and working
+directory. Do not stop a process outside this project.
+
+Prove the live runtime in this order:
+
+1. GET `/info` from the project's CopilotKit runtime and require a valid response.
+2. Require `/info` to declare the expected agent id.
+3. Confirm that `licenseStatus` is absent. Its presence means the live runtime uses
+   Intelligence and is not an OSS starting state.
+4. Confirm from project files that the runtime constructor passes a `runner` option rather
+   than an `intelligence` option. A package, import, project file, or key is not use proof.
+5. Run
+   `npx --yes copilotkit@4.9.1 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   with the runtime URL or auth header options that this project needs. Require exit zero
+   and the JSON `ok` field to be `true`.
+6. Drive one real request through the existing frontend, CopilotKit runtime, and expected
+   agent. Require the existing user-visible result. If no browser tool is available, the
+   round trip is not proved and the state is `unproved`.
+
+Classify the state as `both-oss` only when all six predicates are true: agent present,
+interface present, CopilotKit present, CopilotKit round trip proven, runtime connection
+`oss`, and managed Intelligence not configured. Return each predicate and its secret-safe
+evidence.
+
+The default in-memory OSS runner is ephemeral. SQLite, custom, or framework persistence
+can be durable. Report the persistence that project evidence proves, or `unproved`. Do not
+replace it and do not describe all OSS runs as ephemeral.
+
+Stop after returning the baseline result, process ids and ports used, and evidence paths.

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -4,6 +4,11 @@ Use the proof steps and documentation URLs from the approved plan. Fetch every s
 URL in one step before you start, rather than one after another.
 Do not use remembered CopilotKit instructions.
 
+A fetch tool that refuses a URL, or fails to reach it, reports a limit of the tool and
+not a fact about the page. Retrieve the same URL a second way before you judge it. Run
+`curl -fsSL <url>`, or read the same page without the `.md` suffix. Report a
+documentation gap only after a second method also fails.
+
 Read the port the developer's agent already serves from this project's own
 configuration. Do not assume a default, and do not start a second copy of an agent this
 project is already running. Before you bind any new server, check that the port is free
@@ -11,8 +16,12 @@ and pick another one if it is not. Record every port you used.
 
 Start the agent and the selected frontend.
 
+Leave the agent and frontend servers running after proof. Record each process ID and a
+safe command that stops that process. Record the frontend URL and the commands that start
+both servers again.
+
 With both running, check the wiring in one command before you open a browser:
-`npx copilotkit@4.8.4 verify --json`. Add `--runtime-url` when the runtime is not at
+`npx --yes copilotkit@4.9.1 verify --json`. Add `--runtime-url` when the runtime is not at
 `http://localhost:3000/api/copilotkit`. Read the individual checks rather than the summary
 alone: a check reported `undetermined` did not run, and that is not a pass. Fix anything
 that is not a pass before the browser, because a browser failure stacked on broken wiring
@@ -31,7 +40,7 @@ because the runtime reports no thread-endpoint state, the runtime predates the f
 Record that and move on — there is nothing to repair.
 
 Then prove that the agent actually runs, which is the gate for this node:
-`npx copilotkit@4.8.4 verify --round-trip --json`. It sends one request through the
+`npx --yes copilotkit@4.9.1 verify --round-trip --json`. It sends one request through the
 runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -43,6 +52,11 @@ it.
 Then send one real request through the frontend. Make sure that the request passes through
 CopilotKit and reaches the selected agent.
 
+For a recorded `both-oss` starting state: Compare the final round trip with the recorded
+OSS baseline. The same frontend request must still reach the same agent and produce the
+same kind of user-visible result. The runtime must now report `licenseStatus`, and the
+authenticated Intelligence checks must pass. Record both before and after evidence.
+
 Before you trust the agent, confirm that the process answering is the one in this
 repository. `verify` reports which agents the runtime declares and has nothing to compare
 them against, and `--round-trip` proves an agent answers under the declared id without
@@ -64,20 +78,32 @@ by one.
 Address a local agent by host name rather than by an IP literal. Some local agents bind
 IPv6 only, so an IPv4 literal fails against the correct port.
 
-Drive the real UI in a browser whenever your environment can, and make sure that the
-frontend receives working generative UI from the agent. Prefer this: it is the only step
-that covers realtime delivery to a browser, browser-origin CORS and CSP, the frontend
-provider being wired to this runtime, and a generative UI component actually rendering,
-and no command-line check reaches any of them.
+Drive the real UI on this journey's own surface, and make sure that the frontend receives
+working generative UI from the agent. This is the step that covers realtime delivery, the
+frontend provider being wired to this runtime, and a generative UI component actually
+rendering, and no command-line check reaches any of them. It is not optional polish: a run
+that skips it has proven the agent and not the journey, and the graph ends such a run as
+blocked rather than complete.
+
+For a web frontend, that surface is a browser, and it also covers browser-origin CORS and
+CSP, which a CLI request never exercises. Use a browser MCP server already configured for
+the coding agent you are running as, the same way the CopilotKit documentation MCP server
+below is configured. Do not add a browser driver to this project: a devDependency and a
+browser download land in the diff and tax a repository that never asked for one. If nothing
+in your environment can drive a browser, skip this step rather than installing one.
+
+Report exactly one of `performed`, `skipped-no-browser-tool`, or `failed` for a web
+frontend.
+
+For React Native, that surface is a device or emulator, and a browser cannot stand in for
+it. Run the app on a booted emulator, drive the same request, and capture the terminal
+state with `adb exec-out screencap -p`. Read `adb logcat` as well: a redbox is a runtime
+failure the terminal output never shows. If no device or emulator is available, skip this
+step rather than substituting a browser.
 
-Use a browser MCP server already configured for the coding agent you are running as, the
-same way the CopilotKit documentation MCP server below is configured. Do not add a browser
-driver to this project: a devDependency and a browser download land in the diff and tax a
-repository that never asked for one. If nothing in your environment can drive a
-browser, skip this step rather than installing one, and never report a visual result you
-did not see.
+Report exactly one of `performed`, `skipped-no-device`, or `failed` for React Native.
 
-Report exactly one of `performed`, `skipped-no-browser-tool`, or `failed` for this step.
+Never report a result you did not see, on either surface.
 
 Record the input, visible result, relevant process status, and evidence locations. Do not
 return secret values.
@@ -96,19 +122,18 @@ project's data never reaches the agent, the agent receives it and its instructio
 it, the page loads its data after the context was registered, or the run wired a different
 source than the page renders. Fix that cause, then prove again.
 
-Install the continued-development tools while you drive the round trip, not after it. The
-two are independent, so running them one after the other adds minutes to the journey for
-no reason. Fetch the continued-development guide from the main coding agent at the same
-time as the proof documentation.
+Fetch the continued-development guide from the main coding agent with the proof
+documentation. Try the continued-development tools after the application passes proof.
 Use it to install the project-scoped CopilotKit Skills.
 Use it to configure the CopilotKit documentation MCP server for the current coding agent.
 
-Record the installed Skills and the configured MCP server. If either tool step fails, return
-the exact documentation gap or error.
+Do not validate whether the Skills or MCP server installed correctly. Record the command
+result for each attempt. Report each tool result separately. A tool error does not change
+the proof result.
 
 Gather what you need in as few commands as possible. Combine independent reads into one
 command rather than running them one at a time. Split a command only when its result decides
 what you run next.
 
 Return the proof or the exact failed step to the main coding agent, together with the
-visual-check outcome. Stop after you return the result.
+surface-check outcome and which surface it speaks for. Stop after you return the result.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -1,16 +1,30 @@
-# No validated path in this release
+# Stop without a supported path
 
-Stop onboarding without making more repository changes. Keep the developer's current agent,
-frontend, authentication, and package choices.
+Keep the developer's current agent, frontend, authentication, and package choices.
 
 Explain the exact step that failed. State whether authentication, project selection, project
-credentials, the journey, a documentation URL, implementation, validation, or proof caused
-the stop. Do not invent an adapter or claim that an untested path works.
+credentials, the journey, a documentation URL, implementation, validation, or the round
+trip caused the route change. Do not say a path works when this release does not support it.
 
-If useful, send one short report:
+Stop onboarding without making more repository changes by default.
+
+The documentation-gap exception applies only before implementation starts. If implementation,
+validation, or proof already started, do not use the documentation-gap exception.
+
+If the only cause is a failed documentation URL or missing documentation, use the exception.
+Tell the developer about the gap. Then make a best-effort plan from the official pages that
+are available. Search the broader official CopilotKit documentation before you infer an API.
+Mark each step that the selected pages do not prove. Do not treat the documentation gap as
+proof that the requested integration is unsupported.
+
+After the developer approves the best-effort plan, run
+`npx --yes copilotkit@4.9.1 onboard read fallback/best-effort`.
+
+Send one short report. Run the feedback command without another developer question. The
+CLI telemetry gate decides whether the report is sent.
 
 ```text
-npx copilotkit@4.8.4 onboard feedback
+npx --yes copilotkit@4.9.1 onboard feedback
 ```
 
 Write the feedback message to the command's standard input, in at most four lines.
@@ -18,5 +32,5 @@ Send no secrets, source code, logs, or command output. The command refuses a rep
 that carries any of those, prints the reason, and exits zero. A refused report is not
 a failed step. Reword it and send it again, or stop without a report. The command
 prints what it sent. This is the channel for a stop. Report friction only from a run that
-finished, never from here. Stop after the explanation or optional feedback. This
-unsupported outcome does not complete onboarding.
+finished, never from here. If the CLI says that telemetry is disabled or unavailable,
+state that the report was not sent and stop without another question.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.8.4",
+  "version": "4.9.1",
   "type": "module",
   "repository": {
     "type": "git",

package/release/release-tool.js

@@ -14695,7 +14695,7 @@ import * as path4 from "node:path";
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "47c5510b4909f6728288ecf28d7b14cd14922d33" : "main";
+  return true ? "2ad03320fe1f0834b138113fffe791781e5b226e" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts