copilotkit 4.9.1 → 4.9.4

package/cli-build-info.json

@@ -2,20 +2,20 @@
   "schemaVersion": 1,
   "package": {
     "name": "copilotkit",
-    "version": "4.9.1"
+    "version": "4.9.4"
   },
   "intelligence": {
-    "commit": "0528d9de0d7915386d789deb676d44c4668842b1"
+    "commit": "db031f9bc6f6c3918774aa8e375b6938ad66bb5e"
   },
   "copilotKit": {
-    "submittedInput": "2ad03320fe1f0834b138113fffe791781e5b226e",
-    "commit": "2ad03320fe1f0834b138113fffe791781e5b226e"
+    "submittedInput": "f6f2dc4bb62b50d2f09384619f5b9e8fe7edde02",
+    "commit": "f6f2dc4bb62b50d2f09384619f5b9e8fe7edde02"
   },
   "channel": "production",
-  "triggeringActor": "MikeRyanDev",
+  "triggeringActor": "copilotkit-qa-bot[bot]",
   "workflow": {
-    "runId": "32915219082",
-    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/32915219082"
+    "runId": "33113403059",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/33113403059"
   },
   "validationResult": "passed",
   "ag2": {
@@ -24,5 +24,5 @@
     "revision": "main",
     "pinned": false
   },
-  "builtAt": "2026-08-26T00:29:57Z"
+  "builtAt": "2026-08-27T20:28:56Z"
 }

package/index.js

@@ -96,14 +96,14 @@ function getTelemetryEndpointUrl() {
 }
 function getBuildInfo() {
   return {
-    version: true ? "4.9.1" : "dev",
-    buildNumber: true ? "32915219082" : "dev",
-    commitSha: true ? "0528d9de0d7915386d789deb676d44c4668842b1" : "dev",
+    version: true ? "4.9.4" : "dev",
+    buildNumber: true ? "33113403059" : "dev",
+    commitSha: true ? "db031f9bc6f6c3918774aa8e375b6938ad66bb5e" : "dev",
     copilotKitCommit: getTemplateRef()
   };
 }
 function getTemplateRef() {
-  return true ? "2ad03320fe1f0834b138113fffe791781e5b226e" : "main";
+  return true ? "f6f2dc4bb62b50d2f09384619f5b9e8fe7edde02" : "main";
 }
 function getC15tBackendUrl() {
   return true ? "https://calm-hazelnut-joy-copilotkit.inth.app" : "";
@@ -192,6 +192,9 @@ var init_starter_source_catalog = __esm({
     STARTER_SOURCE_CATALOG = {
       "langgraph-py": langGraphPython,
       "langgraph-js": copilotKitStarter("examples/integrations/langgraph-js"),
+      "langgraph-fastapi": copilotKitStarter(
+        "examples/integrations/langgraph-fastapi"
+      ),
       "claude-sdk-typescript": copilotKitStarter(
         "examples/integrations/claude-sdk-typescript"
       ),
@@ -412,6 +415,7 @@ function formatInvalidFrameworkError(value) {
 function standardTemplate(framework, template, successEmoji) {
   const pythonUvTemplates = /* @__PURE__ */ new Set([
     "langgraph-py",
+    "langgraph-fastapi",
     "claude-sdk-python",
     "flows",
     "llamaindex",
@@ -493,6 +497,7 @@ var init_types = __esm({
     FRAMEWORK_EMOJI = {
       "langgraph-py": "\u{1F99C}",
       "langgraph-js": "\u{1F99C}",
+      "langgraph-fastapi": "\u{1F99C}",
       "claude-sdk-typescript": "\u{1F506}",
       "claude-sdk-python": "\u{1F506}",
       flows: "\u{1F465}",
@@ -523,6 +528,10 @@ var init_types = __esm({
         label: `${FRAMEWORK_EMOJI["langgraph-js"]} LangGraph (JavaScript)`,
         value: "langgraph-js"
       },
+      {
+        label: `${FRAMEWORK_EMOJI["langgraph-fastapi"]} LangGraph (Python, FastAPI)`,
+        value: "langgraph-fastapi"
+      },
       {
         label: `${FRAMEWORK_EMOJI["claude-sdk-typescript"]} Claude Agent SDK (TypeScript)`,
         value: "claude-sdk-typescript"
@@ -636,6 +645,11 @@ var init_types = __esm({
         TEMPLATE_REPOS["langgraph-js"],
         `\u{1FA81}\u{1F91D}${FRAMEWORK_EMOJI["langgraph-js"]}`
       ),
+      "langgraph-fastapi": standardTemplate(
+        "langgraph-fastapi",
+        TEMPLATE_REPOS["langgraph-fastapi"],
+        `\u{1FA81}\u{1F91D}${FRAMEWORK_EMOJI["langgraph-fastapi"]}`
+      ),
       "claude-sdk-typescript": {
         ...standardTemplate(
           "claude-sdk-typescript",
@@ -810,6 +824,7 @@ var init_types = __esm({
     THREADS_FRAMEWORKS = /* @__PURE__ */ new Set([
       "langgraph-py",
       "langgraph-js",
+      "langgraph-fastapi",
       "claude-sdk-typescript",
       "claude-sdk-python",
       "mastra",
@@ -833,6 +848,7 @@ var init_types = __esm({
     FRAMEWORK_LANGUAGE = {
       "langgraph-py": "python",
       "langgraph-js": "typescript",
+      "langgraph-fastapi": "python",
       "claude-sdk-typescript": "typescript",
       "claude-sdk-python": "python",
       flows: "python",
@@ -93356,7 +93372,7 @@ var init_cli_tips = __esm({
       },
       {
         id: "server-debug-for-missing-events",
-        text: "Enable server `debug: true` when events, state, or tool calls disappear, then use the Inspector or `/cpk-debug-events` for live AG-UI details.",
+        text: "Enable server `debug: true` when events, state, or tool calls disappear, then read live AG-UI details from the Inspector in a browser, or from the runtime's `/cpk-debug-events` route on any frontend.",
         relevancy: 82,
         insight: 90
       },
@@ -380822,18 +380838,15 @@ function isOnboardingGraphIndex(value) {
   if (typeof value !== "object" || value === null)
     return false;
   const candidate = value;
-  return typeof candidate.root === "string" && Array.isArray(candidate.prompts) && candidate.prompts.every(
-    (prompt) => typeof prompt === "object" && prompt !== null && Array.isArray(prompt.edges) && prompt.edges.every((edge) => typeof edge === "string") && typeof prompt.milestone === "string" && typeof prompt.name === "string"
+  return (
+    // Checked first: a bundle that cannot name the graph it serves is corrupt,
+    // and nothing else about it is worth inspecting.
+    typeof candidate.graphTree === "string" && GRAPH_TREE_PATTERN.test(candidate.graphTree) && typeof candidate.root === "string" && Array.isArray(candidate.prompts) && candidate.prompts.every(
+      (prompt) => typeof prompt === "object" && prompt !== null && Array.isArray(prompt.edges) && prompt.edges.every((edge) => typeof edge === "string") && typeof prompt.milestone === "string" && typeof prompt.name === "string"
+    )
   );
 }
-async function loadOnboardingPrompt(name, graphDirectory = join23(dirname9(fileURLToPath2(import.meta.url)), "onboarding")) {
-  if (!PROMPT_NAME_PATTERN.test(name)) {
-    throw new OnboardingPromptError(
-      "ONBOARDING_PROMPT_NOT_FOUND",
-      `Onboarding prompt "${name}" was not found. Copy an exact prompt name from the prior Markdown.`
-    );
-  }
-  let index2;
+async function readGraphIndex(graphDirectory) {
   try {
     const parsed = JSON.parse(
       await readFile(join23(graphDirectory, "index.json"), "utf8")
@@ -380841,7 +380854,7 @@ async function loadOnboardingPrompt(name, graphDirectory = join23(dirname9(fileU
     if (!isOnboardingGraphIndex(parsed)) {
       throw new Error("Bundled onboarding graph index has an invalid shape");
     }
-    index2 = parsed;
+    return parsed;
   } catch (error98) {
     throw new OnboardingPromptError(
       "ONBOARDING_PROMPT_UNREADABLE",
@@ -380849,6 +380862,18 @@ async function loadOnboardingPrompt(name, graphDirectory = join23(dirname9(fileU
       { cause: error98 }
     );
   }
+}
+async function loadOnboardingGraphTree(graphDirectory = join23(dirname9(fileURLToPath2(import.meta.url)), "onboarding")) {
+  return (await readGraphIndex(graphDirectory)).graphTree;
+}
+async function loadOnboardingPrompt(name, graphDirectory = join23(dirname9(fileURLToPath2(import.meta.url)), "onboarding")) {
+  if (!PROMPT_NAME_PATTERN.test(name)) {
+    throw new OnboardingPromptError(
+      "ONBOARDING_PROMPT_NOT_FOUND",
+      `Onboarding prompt "${name}" was not found. Copy an exact prompt name from the prior Markdown.`
+    );
+  }
+  const index2 = await readGraphIndex(graphDirectory);
   const indexedPrompt = index2.prompts.find((prompt) => prompt.name === name);
   if (indexedPrompt === void 0) {
     throw new OnboardingPromptError(
@@ -380874,11 +380899,12 @@ async function loadOnboardingPrompt(name, graphDirectory = join23(dirname9(fileU
     );
   }
 }
-var PROMPT_NAME_PATTERN, OnboardingPromptError;
+var PROMPT_NAME_PATTERN, GRAPH_TREE_PATTERN, OnboardingPromptError;
 var init_onboarding_graph = __esm({
   "apps/cli/src/services/onboarding-graph.ts"() {
     "use strict";
     PROMPT_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9][a-z0-9._-]*)*$/;
+    GRAPH_TREE_PATTERN = /^[0-9a-f]{40}$/u;
     OnboardingPromptError = class extends Error {
       code;
       constructor(code, message, options) {
@@ -381255,6 +381281,7 @@ async function runOnboard(argv, dependencies) {
     cliVersion: getBuildInfo().version,
     randomRunId: () => randomBytes2(9).toString("base64url"),
     loadPrompt: loadOnboardingPrompt,
+    loadGraphTree: loadOnboardingGraphTree,
     recordEvent: recordTelemetryEvent,
     submitFeedbackEvent: submitTelemetryEvent
   };
@@ -381278,6 +381305,8 @@ async function runOnboard(argv, dependencies) {
       parsed.values.run
     );
     recordStarted(deps, binding2.runId, parsed.values["coding-agent"]);
+    printRunId(deps, binding2.runId);
+    await printGraphTree(deps);
     await printPrompt(deps, binding2.runId, "authenticate/start");
     return;
   }
@@ -381297,7 +381326,10 @@ async function runOnboard(argv, dependencies) {
     return;
   }
   if (subcommand === "complete") {
-    const check4 = parseSurfaceCheck(argv.slice(1));
+    const blocked2 = parseBlocker(argv.slice(1));
+    if (blocked2 === void 0)
+      throw new Error(BLOCKER_USAGE);
+    const check4 = parseSurfaceCheck(blocked2.rest);
     if (check4 === void 0)
       throw new Error(SURFACE_CHECK_USAGE);
     recordBestEffort(deps, {
@@ -381306,11 +381338,12 @@ async function runOnboard(argv, dependencies) {
         command: "onboard",
         onboarding_run_id: binding.runId,
         cli_version: deps.cliVersion,
-        ...check4.kind === "visual" ? { visual_check: check4.outcome } : { device_check: check4.outcome }
+        ...check4.kind === "visual" ? { visual_check: check4.outcome } : { device_check: check4.outcome },
+        ...blocked2.blocker === void 0 ? {} : { blocked_by: blocked2.blocker }
       }
     });
     deps.stdout.write(
-      check4.outcome === "performed" ? "CopilotKit onboarding marked complete.\n" : blockedWithoutSurfaceProof(check4)
+      completionReport({ blocker: blocked2.blocker, check: check4 })
     );
     return;
   }
@@ -381369,6 +381402,17 @@ async function runOnboard(argv, dependencies) {
     "Usage: copilotkit onboard <start|read|classify|complete|feedback|friction>"
   );
 }
+function parseBlocker(rest) {
+  const flagIndex = rest.indexOf("--blocked-by");
+  if (flagIndex === -1)
+    return { rest };
+  if (flagIndex !== rest.length - 2)
+    return void 0;
+  const cause = BLOCKER_CAUSES.find((known) => known === rest[flagIndex + 1]);
+  if (cause === void 0)
+    return void 0;
+  return { blocker: cause, rest: rest.slice(0, flagIndex) };
+}
 function parseSurfaceCheck(rest) {
   if (rest.length !== 2)
     return void 0;
@@ -381429,6 +381473,37 @@ function blockedWithoutSurfaceProof(check4) {
     ""
   ].join("\n");
 }
+function blockedAfterProof(blocker) {
+  const report = BLOCKER_REPORTS[blocker];
+  return [
+    "",
+    "! Onboarding is NOT complete.",
+    "  The round trip was proved, and this run was then blocked by something else:",
+    `  ${report.cause}`,
+    "  Still unverified:",
+    ...report.uncovered.map((line) => `    - ${line}`),
+    "",
+    "  This is a supported path that this run could not finish.",
+    "  It is NOT an unsupported path: do not read unsupported/no-validated-path,",
+    "  and do not tell the developer that their framework or frontend is",
+    "  unsupported. The journey proved; one thing after it did not.",
+    "",
+    "  Report this run as blocked, and name the unverified lines above as the",
+    "  evidence it is missing. Hand over the working application anyway: the URL,",
+    "  the command that starts it again, and the process IDs.",
+    `  To close it, ${report.close}.`,
+    ""
+  ].join("\n");
+}
+function completionReport(input) {
+  if (input.check.outcome !== "performed") {
+    const surface = blockedWithoutSurfaceProof(input.check);
+    if (input.blocker === void 0)
+      return surface;
+    return `${surface}${blockedAfterProof(input.blocker)}`;
+  }
+  return input.blocker === void 0 ? "CopilotKit onboarding marked complete.\n" : blockedAfterProof(input.blocker);
+}
 async function reportFeedback(dependencies, runId) {
   const input = await readFeedbackInput(dependencies.stdin);
   if (!input.ok)
@@ -381539,6 +381614,16 @@ report: ${report.text}
 `
   );
 }
+function printRunId(dependencies, runId) {
+  dependencies.stdout.write(`onboarding_run_id: ${runId}
+`);
+}
+async function printGraphTree(dependencies) {
+  dependencies.stdout.write(
+    `onboarding_graph_tree: ${await dependencies.loadGraphTree()}
+`
+  );
+}
 function recordStarted(dependencies, runId, codingAgent) {
   recordBestEffort(dependencies, {
     event: "cli.onboarding.started",
@@ -381579,7 +381664,7 @@ function recordBestEffort(dependencies, event) {
   } catch {
   }
 }
-var VISUAL_CHECK_OUTCOMES, DEVICE_CHECK_OUTCOMES, SURFACE_CHECK_USAGE;
+var VISUAL_CHECK_OUTCOMES, DEVICE_CHECK_OUTCOMES, BLOCKER_CAUSES, BLOCKER_USAGE, SURFACE_CHECK_USAGE, BLOCKER_REPORTS;
 var init_onboard = __esm({
   async "apps/cli/src/commands/onboard.ts"() {
     "use strict";
@@ -381601,7 +381686,52 @@ var init_onboard = __esm({
       "skipped-no-device",
       "failed"
     ];
+    BLOCKER_CAUSES = [
+      "hosted-dashboard",
+      "inspector",
+      "plan-excluded-capability",
+      "other"
+    ];
+    BLOCKER_USAGE = `Usage: copilotkit onboard complete <surface-check> --blocked-by <${BLOCKER_CAUSES.join("|")}>
+Pass it alongside --visual-check or --device-check, never instead of one: which
+surface this run proved and what blocked it afterwards are separate facts.
+Use \`other\` rather than leaving the flag off. A run with no way to say it was
+blocked reads the unsupported terminal instead, and reports a path that works
+as one this release does not carry.`;
     SURFACE_CHECK_USAGE = "Usage: copilotkit onboard complete --visual-check <performed|skipped-no-browser-tool|failed>\n   or: copilotkit onboard complete --device-check <performed|skipped-no-device|failed>\nPass exactly one. A web journey is proven in a browser and a mobile one on a device;\nwhich flag you pass is how this run states which surface it proved.";
+    BLOCKER_REPORTS = {
+      "hosted-dashboard": {
+        cause: "the managed Intelligence dashboard did not load, or refused a sign-in.",
+        close: "sign in at https://intelligence.copilotkit.ai, confirm this project is\n  listed, then run this command again without `--blocked-by`",
+        uncovered: [
+          "managing this installation from the dashboard, which is where its keys and projects live",
+          "the thread view, which is how a managed run is read back after it ends"
+        ]
+      },
+      inspector: {
+        cause: "the debugging surface for this frontend did not open.",
+        close: "open the debugging surface named in the handoff, confirm it lists this\n  run, then run this command again without `--blocked-by`",
+        uncovered: [
+          "the AG-UI event stream this frontend actually received",
+          "a wiring fault that shows up only as an event that never arrives"
+        ]
+      },
+      "plan-excluded-capability": {
+        cause: "the proof asked for a capability the approved plan had already excluded\n  for this framework.",
+        close: "settle the exclusion against the framework's own documentation before the\n  next run, and give the developer the exclusion as a named limitation",
+        uncovered: [
+          "that capability on this framework, which the plan excluded rather than disproved",
+          "whether the exclusion in the plan is correct, which nothing in this run tested"
+        ]
+      },
+      other: {
+        cause: "a blocker outside the set this command can name.",
+        close: "name the blocker in the summary in the developer's own terms, and say what\n  it leaves unverified",
+        uncovered: [
+          "whatever the blocker covers, which this command cannot name for you"
+        ]
+      }
+    };
   }
 });
 

package/onboarding/index.json

@@ -1,4 +1,5 @@
 {
+  "graphTree": "1c6963da1f044e99a35706e1f6ba533c2ad835c2",
   "root": "authenticate/start",
   "prompts": [
     {
@@ -203,6 +204,7 @@
     },
     {
       "edges": [
+        "starter/clone",
         "credentials/finalize-plan",
         "unsupported/no-validated-path"
       ],
@@ -211,6 +213,7 @@
     },
     {
       "edges": [
+        "starter/clone",
         "credentials/finalize-plan",
         "unsupported/no-validated-path"
       ],
@@ -282,6 +285,14 @@
       "milestone": "proof",
       "name": "proof/round-trip"
     },
+    {
+      "edges": [
+        "proof/round-trip",
+        "unsupported/no-validated-path"
+      ],
+      "milestone": "starter",
+      "name": "starter/clone"
+    },
     {
       "edges": [],
       "milestone": "subagent",

package/onboarding/prompts/authenticate/start.md

@@ -14,16 +14,21 @@ question from the documentation this graph gives you. Another checkout on this m
 not a source. The developer running this has none, so an answer taken from one is an
 answer they cannot get, and it hides the documentation gap that blocks them.
 
-Before you run a command or spawn a subagent, send this exact message:
+Send this exact message once, as your first message in this onboarding run, before
+anything else:
 
 Welcome to CopilotKit. I will check sign-in, inspect your project, recommend a setup, and
 show you a plan before I change files. After you approve the plan, I will build the
 integration, prove the full round trip, and leave the app running with its URLs.
 
+That message belongs to the run, not to this prompt. If you already sent it in this run, do
+not send it again, including on a second read of this prompt. It has no value after the
+first send, and a developer who reads it repeatedly learns to skim the region it sits in.
+
 Do not ask for separate feedback consent. The feedback commands enforce the developer's
 CLI telemetry setting when a later step tries to send a report.
 
-Run `npx --yes copilotkit@4.9.1 login --json` before any project work. This command
+Run `npx --yes copilotkit@4.9.4 login --json` before any project work. This command
 checks the current session. It starts sign-in only as needed. Treat this as a long-lived
 streaming process. Do not wait for the command to exit before you read its standard output.
 
@@ -41,29 +46,63 @@ Do not use `whoami` for this check. It has no JSON output and some failures exit
 zero. Do not put account tokens or credentials in the conversation.
 
 Before you ask the developer any setup question, finish every read-only investigation and
-preflight check in this section. Record whether your coding-agent environment has browser
-or device control. Use the control that matches the selected surface later. Do not install
-a browser or device tool during this preflight. Do not ask the developer about this tool
-limit.
+preflight check in this section.
+
+Prove whether your coding-agent environment has browser or device control. Do not assume it
+either way, and do not report what you expect to be true: a run that guesses here records a
+capability the rest of the graph then trusts. Use a browser or device tool already
+configured for the coding agent you are running as, the same way a later step uses the
+CopilotKit documentation server. With a browser tool, open one inert page such as
+`about:blank` and read its title. With a device tool and no browser, list the booted devices
+in one command: `adb devices -l`. Record the outcome of that attempt: `available` when the
+tool answered, `unavailable` when there was none to call or the page did not open. Use
+the control that matches the selected surface later.
+
+Where the browser probe answered, register nothing. The harness came equipped and the run
+owes it no setup.
+
+Where no browser tool answered, register one for the coding agent you are running as, then
+run the same probe again and record what the second attempt did. Register this server:
+
+```text
+npx --yes @playwright/mcp@latest --browser chrome --isolated --output-dir <project>/.copilotkit/proof/browser
+```
+
+Replace `<project>` with the absolute path of the target project directory. The server is
+registered against the coding agent rather than against a directory, so a relative path here
+resolves wherever that server happens to start.
+
+`--browser chrome` drives the Google Chrome the developer already has, so this downloads no
+browser. `--isolated` keeps the profile in memory, so it never touches their own Chrome
+profile. `--output-dir` is what keeps the snapshots and screenshots out of the developer's
+repository root: without it this server writes them to `.playwright-mcp/` beside their code,
+which a project that never asked for a browser has no reason to carry, and which the graph's
+own evidence rule already has a place for. Register it the way your own harness registers a
+server, which is the mechanism a later step uses for the CopilotKit documentation server.
+
+Tell the developer in one line what you registered, that it drives their installed Chrome,
+and that it lives in this coding agent's configuration rather than in their repository. Do
+not ask them to approve it, and do not ask a second question about it.
+
+Do not add a browser or device driver to the project. A driver added there is a
+devDependency and a browser download in the diff of a repository that never asked for one,
+which is a different thing from a server registered against the coding agent.
+
+Where the second probe still does not answer -- no Chrome to drive, no network, or a
+harness that cannot register a server -- record `unavailable` and carry it. Do not keep
+trying, and do not ask the developer about this tool limit.
+
+Registering a server does not boot a device. Where the device probe found none, that is the
+whole finding, and a browser is not a substitute for a device.
 
 Spawn one research subagent. Give it the full text of the research brief at the end of this
-prompt and tell it to follow that brief and return only its findings. Add these tasks:
-
-- Find the target app or runtime directory that owns `.env` and CopilotKit setup.
-- Check whether `.copilotkit/project.json` has `projectId`, `projectSlug`, and `clerkOrgId`.
-- Check whether `.env` has a non-empty `INTELLIGENCE_API_KEY` entry.
-- Record the `.env` file modification time without returning it.
-- Report whether an agent, frontend, and CopilotKit integration are present.
-- Report whether the runtime constructor uses a `runner` option, an `intelligence`
-  option, or neither can be proved from project files.
+prompt and tell it to follow that brief and return only its findings. Wait for the
+subagent to finish.
 
-Do not print either file or any secret value. Return only paths, presence checks, and missing
-field names. Wait for the subagent to finish.
-
-If the findings show an empty project and do not prove its purpose, ask one guided question
-about the user outcome. This asks what the developer wants to build before you select a
-framework. Give two or three short examples and offer a minimal starter. Record the answer
-and give it to each later subagent.
+If neither the developer nor the repository findings prove what the project is for, ask
+one guided question about the user outcome. This asks what the developer wants to build
+before you select a framework. Give two or three short examples and offer a minimal
+starter. Record the answer and give it to each later subagent.
 
 If a repository file exists, each finding must cite it. For an empty project, the subagent
 must cite its directory check and report absent parts.
@@ -75,13 +114,13 @@ that the repository answers.
 Do not infer a working OSS path from packages, imports, project files, or keys. If an
 agent, frontend, and CopilotKit integration are present, prove the live starting state
 before any project file changes. Run
-`npx --yes copilotkit@4.9.1 onboard read proof/oss-baseline`.
+`npx --yes copilotkit@4.9.4 onboard read proof/oss-baseline`.
 
 For every other inspected state, run
-`npx --yes copilotkit@4.9.1 onboard read credentials/plan`.
+`npx --yes copilotkit@4.9.4 onboard read credentials/plan`.
 
 If authentication or inspection stops onboarding, run
-`npx --yes copilotkit@4.9.1 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.4 onboard read unsupported/no-validated-path`.
 
 ## Research subagent brief
 
@@ -94,16 +133,27 @@ Everything below the rule is the subagent's prompt. Give it verbatim.
 Inspect the repository without changing it. Find evidence for:
 
 - what the project is for, in the project's own words
-- any existing agent framework
-- any existing frontend
-- current CopilotKit packages and configuration
+- the target app or runtime directory that owns `.env` and the CopilotKit setup
+- whether the target project directory contains any entries
+- any existing agent framework and frontend
+- current CopilotKit integration and configuration, including whether
+  `.copilotkit/project.json` has `projectId`, `projectSlug`, and `clerkOrgId`
 - authentication boundaries
-- names of required credential variables, without reading their values
+- names of required credential variables and whether `.env` has a non-empty
+  `INTELLIGENCE_API_KEY`
+- retain the `.env` modification time for a later comparison without returning it
 - package manager and lockfile
 - required toolchains and their installed versions
 - declared ports and whether each port is available
+- whether the runtime constructor uses a `runner` option, an `intelligence` option, or
+  neither can be proved from project files
 - CopilotKit package versions and package compatibility risks
 
+For the CopilotKit versions, report the exact installed version of every `@copilotkit/*`
+dependency, read from the lockfile rather than a manifest range, and state whether any of
+them is below 1.64.0. The conversion decides its upgrade from exactly that, and a caret
+range does not answer it.
+
 A project states what it is for in its `README.md`, in its package description, or in
 the prompt of an agent it already has. Quote that statement rather than rewriting it. An
 empty project carries it in the README alone, and that makes the README the whole of the
@@ -115,6 +165,7 @@ what you run next. Keep this preflight read-only. Do not install packages, stop
 or change a port. Check only the toolchains and ports that repository files require.
 
 Return the file paths and a short finding for each item. State each absent or unproved item.
-Do not read, print, or return secret values. Do not read a file outside the project
-directory. Do not run or return another onboarding command. Stop after returning the
-findings to the main coding agent.
+Do not read, print, or return secret values. For `.env` and `.copilotkit/project.json`
+checks, return only paths, presence checks, and missing field names. Do not read a file
+outside the project directory. Do not run or return another onboarding command. Stop after
+returning the findings to the main coding agent.