copilotkit 4.9.24 → 4.9.31

package/onboarding/prompts/frontend/angular.md

@@ -5,7 +5,7 @@ Preserve an existing Angular frontend. Use the selected page for a new frontend.
 Use the starter shortcut only if all these facts are true: the target directory contains
 no entries, its name is a valid `init` project name, and the selected framework is ADK.
 If all three facts are true, record Angular as the selected frontend. Then run
-`npx --yes copilotkit@4.9.24 onboard read starter/clone` before you fetch documentation.
+`npx --yes copilotkit@4.9.31 onboard read starter/clone` before you fetch documentation.
 
 ## Documentation
 
@@ -30,12 +30,40 @@ same `component` and `handler: async () => {}` instead, and record that substitu
 not give the handler a body: a display-only tool that returns a value writes it into the
 thread as the tool's result.
 
+## Version lines
+
+`@copilotkit/angular` publishes on a `0.x` line of its own. Every other `@copilotkit/*`
+package publishes on the `1.x` line. Never move either onto the other's line.
+
+The two lines are released separately, so a published `@copilotkit/angular` declares a
+`@copilotkit/core` chosen when that Angular release was cut, not when this run happens.
+Read that declaration before you plan any dependency change:
+
+```text
+npm view @copilotkit/angular@latest dependencies
+```
+
+If the `@copilotkit/core` it declares cannot be satisfied by the version the floor
+requires, the two published packages do not fit together. Installing both resolves two
+copies of `@copilotkit/core`, the Angular package's calls land on the copy that does not
+export what they need, and the threads drawer and the Inspector threads view throw in the
+browser while every command-line check passes.
+
+That is a version-line mismatch. Report it naming both versions -- the `@copilotkit/core`
+the Angular package declares, and the one the floor requires -- and take the unsupported
+route at the end of this page. Do not add an `overrides`, `resolutions`, or
+`pnpm.overrides` block to force them together. That is a repair the developer did not
+approve, it silently pins their whole tree, and it hides a mismatch between two packages
+CopilotKit publishes rather than reporting it.
+
+## Node
+
 Angular CLI 22 requires Node `^22.22.3 || ^24.15.0 || >=26`. Check the Node version before
 you create or build an Angular project. If the installed version is lower, select a
 supported version first and use it for every later command in this project.
 
 If the pages support the selection, record Angular and these URLs. Then run
-`npx --yes copilotkit@4.9.24 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.31 onboard read credentials/finalize-plan`.
 
-If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`.
+If the documentation does not support the selection, or the two version lines do not fit
+together, run `npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/nextjs.md

@@ -15,7 +15,7 @@ These TypeScript options have starters: Claude Agent SDK TypeScript, LangGraph T
 Mastra, and Strands Agents TypeScript. The .NET option is Microsoft Agent Framework .NET.
 
 If all shortcut conditions are true, record Next.js as the selected frontend. Then run
-`npx --yes copilotkit@4.9.24 onboard read starter/clone` before you fetch documentation.
+`npx --yes copilotkit@4.9.31 onboard read starter/clone` before you fetch documentation.
 
 ## Documentation
 
@@ -27,7 +27,7 @@ agent as the default agent, which is correct only for a project that has no agen
 Do not replace the developer's existing agent with the built-in agent.
 
 If the page supports the selection, record Next.js and this URL. Then run
-`npx --yes copilotkit@4.9.24 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.31 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/plan.md

@@ -24,11 +24,11 @@ process.
 
 Use exactly one matching internal route:
 
-1. React SPA: `npx --yes copilotkit@4.9.24 onboard read frontend/react-spa`
-2. Next.js: `npx --yes copilotkit@4.9.24 onboard read frontend/nextjs`
-3. Angular: `npx --yes copilotkit@4.9.24 onboard read frontend/angular`
-4. Vue 3: `npx --yes copilotkit@4.9.24 onboard read frontend/vue`
-5. React Native: `npx --yes copilotkit@4.9.24 onboard read frontend/react-native`
+1. React SPA: `npx --yes copilotkit@4.9.31 onboard read frontend/react-spa`
+2. Next.js: `npx --yes copilotkit@4.9.31 onboard read frontend/nextjs`
+3. Angular: `npx --yes copilotkit@4.9.31 onboard read frontend/angular`
+4. Vue 3: `npx --yes copilotkit@4.9.31 onboard read frontend/vue`
+5. React Native: `npx --yes copilotkit@4.9.31 onboard read frontend/react-native`
 
 If no listed frontend fits, run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-native.md

@@ -15,7 +15,7 @@ documents `useRenderTool`, which is React Native's own hook for drawing a tool t
 already has. That is a different job and needs a tool in the agent.
 
 If the pages support the selection, record React Native and these URLs. Then run
-`npx --yes copilotkit@4.9.24 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.31 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-spa.md

@@ -11,7 +11,7 @@ not move the agent into it.
 - https://docs.copilotkit.ai/react-spa.md
 
 If the page supports the selection, record React SPA and this URL. Then run
-`npx --yes copilotkit@4.9.24 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.31 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/vue.md

@@ -16,7 +16,7 @@ page above. Vue has its own `useComponent`, which is not the React package. Take
 that reference page rather than from a Vue generative-UI guide, which is not published.
 
 If the pages support the selection, record Vue 3 and these URLs. Then run
-`npx --yes copilotkit@4.9.24 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.31 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/implementation/build-and-validate.md

@@ -7,25 +7,46 @@ Do not implement the plan yourself. Use the step order in the approved plan.
 Run the audit from the target app directory:
 
 ```text
-npx --yes copilotkit@4.9.24 onboard audit
+npx --yes copilotkit@4.9.31 onboard audit
 ```
 
 It compares every protected path with the digest the CLI captured for it. Its result starts
 with `Status: passed`, `Status: failed`, or `Status: blocked`. The audit passes only when
 the result starts with `Status: passed`.
 
-`Status: failed` names each protected path that changed and how. If an audit reports a
-changed protected path, use the route-out rules. Never repair, reset, or revert a protected
-path. Also do not retry the audit: it reads files, so a second run of it answers the same.
+`Status: failed` names each protected path that changed and how. Never repair, reset, or
+revert a protected path. Also do not retry the audit: it reads files, so a second run of it
+answers the same.
+
+Decide each path the audit names, one at a time. Accept a path only when you can show that
+this run did not write it. Every implementation subagent reports what it touched in its
+Files changed section, so the test is whether the path appears in any Files changed section
+this run collected. If it appears in one, or the sections do not settle it, the change is
+this run's own: use the route-out rules. The plan cannot name a protected path, so a plan
+that does not name it proves nothing on its own.
+
+A path that no Files changed section names changed outside the run, and it is the
+developer's own file. Accept it by name:
+
+```text
+npx --yes copilotkit@4.9.31 onboard protect --accept-external --path <path>
+```
+
+Pass one `--path` for each path you accept. Accept only a path the audit named, and only
+when no step of this run wrote it. The command re-captures that path, records that this
+run accepted the change, and prints it. Run the audit again afterwards: it passes and
+names every accepted path, and the closing summary must name them too. An acceptance is
+not a repair. It proves nothing about what the file now holds.
 
 `Status: blocked` means the audit has no baseline to read. A blocked audit compared
 nothing and proved nothing changed. It is not a preservation failure: do not report a
 protected path as changed. Report the printed reason and use the route-out rules.
 
-A non-pass audit never continues the run. Do not send an audit result to a repair worker.
+An audit that has not passed never continues the run by itself. Continue only after an
+acceptance clears it, or route out. Do not send an audit result to a repair worker.
 
 Spawn one implementation subagent. Tell it to run
-`npx --yes copilotkit@4.9.24 onboard read subagent/implement-and-validate` first and follow
+`npx --yes copilotkit@4.9.31 onboard read subagent/implement-and-validate` first and follow
 the prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the plan, selected framework, frontend, model, exact target app
@@ -38,11 +59,12 @@ One subagent implements the whole plan. Do not divide the work across concurrent
 and do not spawn a second subagent to reconcile a split.
 
 If the implementation result does not start with `Status: passed`, do not continue to proof.
-Run the protected-path audit after the implementation subagent passes. If any protected path
-changed, use the route-out rules. Continue to proof only when that audit passes.
+Run the protected-path audit after the implementation subagent passes. Decide each path it
+names the same way as above, against the Files changed section that subagent just
+returned. Continue to proof only when that audit passes.
 
 After the selected implementation path passes, run
-`npx --yes copilotkit@4.9.24 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.9.31 onboard read proof/round-trip`.
 
 ## Repair rules
 
@@ -60,4 +82,4 @@ Route out for `Status: blocked`. Route out only when the failure is not yours to
 failure is in code this run did not write, the fix requires changing the developer's existing
 agent or frontend, the same command still fails after three repair attempts, or the
 documentation does not support the plan. In those cases run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/proof/complete.md

@@ -47,6 +47,10 @@ The handoff must include:
 - On a conversion, the criterion this run was judged against, in the words the run was
   given.
 - Any path this run created that git does not ignore, and what to do with each.
+- Any protected path this run accepted as changed from outside it, and what changed. The
+  command at the end of this prompt prints each one, so copy them from its output rather
+  than from memory. This run did not change them and cannot say what did, so the developer
+  decides what to do about each.
 
 A run leaves paths beside the credential file. Tool output such as `.playwright-mcp/` and
 `.langgraph_api/` is regenerable, so the developer normally wants it ignored.
@@ -60,7 +64,7 @@ Name the debugging surface this journey's frontend can reach, rather than the on
 of the documentation leads with. For a web frontend it is the CopilotKit Inspector. For
 React Native there is no Inspector: it is a browser overlay built on a DOM custom element,
 and `@copilotkit/react-native` does not ship it. Give a mobile developer
-`npx --yes copilotkit@4.9.24 verify --round-trip`, the runtime's own log, the AG-UI
+`npx --yes copilotkit@4.9.31 verify --round-trip`, the runtime's own log, the AG-UI
 Event Inspector in the CopilotKit VS Code extension, and the Intelligence thread view
 instead. Naming the Inspector to a developer who cannot open it costs them the time it
 takes to conclude their own wiring is broken.
@@ -72,7 +76,7 @@ the friction commands without another developer question. The CLI telemetry gate
 whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.24 onboard friction --category <slug> --cost-seconds <seconds>
+npx --yes copilotkit@4.9.31 onboard friction --category <slug> --cost-seconds <seconds>
 ```
 
 Write one or two sentences on the command's standard input. Pick one category from
@@ -89,14 +93,14 @@ Tell the developer when you send a friction report. Do not quote or summarize th
 unless the developer asks. If the CLI says that telemetry is disabled or unavailable,
 state that the report was not sent and continue without another question.
 
-When the evidence is gathered, run `npx --yes copilotkit@4.9.24 onboard complete`, carrying
+When the evidence is gathered, run `npx --yes copilotkit@4.9.31 onboard complete`, carrying
 the surface-check outcome the proof subagent returned. Pass exactly one flag, and pass the
 one that matches this journey's surface.
 
 For a web frontend -- React SPA, Next.js, Angular, Vue:
 
 ```text
-npx --yes copilotkit@4.9.24 onboard complete --visual-check <outcome>
+npx --yes copilotkit@4.9.31 onboard complete --visual-check <outcome>
 ```
 
 The outcome is one of `performed`, `skipped-no-browser-tool`, or `failed`.
@@ -104,7 +108,7 @@ The outcome is one of `performed`, `skipped-no-browser-tool`, or `failed`.
 For React Native:
 
 ```text
-npx --yes copilotkit@4.9.24 onboard complete --device-check <outcome>
+npx --yes copilotkit@4.9.31 onboard complete --device-check <outcome>
 ```
 
 The outcome is one of `performed`, `skipped-no-device`, or `failed`.
@@ -122,7 +126,7 @@ If the round trip proved and something after it still blocked this run, add `--b
 to the same command:
 
 ```text
-npx --yes copilotkit@4.9.24 onboard complete --visual-check performed --blocked-by <cause>
+npx --yes copilotkit@4.9.31 onboard complete --visual-check performed --blocked-by <cause>
 ```
 
 The cause is one of `inspector` for a debugging surface that did not open,

package/onboarding/prompts/proof/oss-baseline.md

@@ -1,24 +1,31 @@
 # Prove the existing OSS baseline
 
 Do not prove the baseline yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.9.24 onboard read subagent/prove-oss-baseline` first and follow the
+`npx --yes copilotkit@4.9.31 onboard read subagent/prove-oss-baseline` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
-and the same handoff. Give it the repository findings and exact CLI package spec. Wait for the
-subagent to finish.
+and the same handoff. Give it the repository findings and exact CLI package spec.
+
+Give it the browser or device control you recorded in the preflight as well. The subagent
+proves the runtime from a shell and needs no browser for that. The control is for the one
+predicate that drives the existing frontend. Where the preflight recorded `unavailable`, say
+so, so the subagent records that predicate as skipped instead of spending the step looking
+for a substitute.
+
+Wait for the subagent to finish.
 
 Do not change project files before this proof ends. Starting existing development
 processes and their ignored runtime files is allowed.
 
 If the subagent proves the `both-oss` predicate, keep its evidence with the plan and run
-`npx --yes copilotkit@4.9.24 onboard read conversion/plan`. That project already works.
+`npx --yes copilotkit@4.9.31 onboard read conversion/plan`. That project already works.
 What it needs is the conversion, not a build.
 
 If it proves another supported starting state, record that state and run
-`npx --yes copilotkit@4.9.24 onboard read credentials/plan`. This prompt is served
+`npx --yes copilotkit@4.9.31 onboard read credentials/plan`. This prompt is served
 whenever a project looks like an OSS integration, so a baseline that did not prove is an
 ordinary starting state rather than a failure.
 
 If it cannot identify the running process safely, exposes a secret, or finds a baseline
 failure that cannot be classified, run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/proof/round-trip.md

@@ -1,7 +1,7 @@
 # Prove the user journey
 
 Do not do the proof work yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.9.24 onboard read subagent/prove-round-trip` first and follow the
+`npx --yes copilotkit@4.9.31 onboard read subagent/prove-round-trip` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the selected framework, frontend, model, approved plan, selected
@@ -17,18 +17,26 @@ this frontend needs reports the skip outcome rather than looking for a way aroun
 Give the subagent this guide for continued-development tools:
 https://docs.copilotkit.ai/build-with-agents.md
 
-Wait for the subagent to finish.
+Wait for the subagent to finish. Its result arrives as a notification. Do not sleep to
+pass the time.
 
 For every protected-path audit in this prompt, run
-`npx --yes copilotkit@4.9.24 onboard audit` from the target app directory. If its result
+`npx --yes copilotkit@4.9.31 onboard audit` from the target app directory. If its result
 starts with `Status: blocked`, report the printed reason and use the route-out rules below.
 A blocked audit proved nothing changed and is not a preservation failure. If a
-protected-path audit reports a changed path, use the route-out rules below. Never repair,
-reset, or revert a protected path.
+protected-path audit reports a changed path, decide it the way the implementation prompt
+does, against the Files changed sections this run has collected. The proof subagent
+returns none, so a finding with no Files changed section to test against routes out. A
+path one of those sections names is this run's own change and routes out too. Accept a
+path only when a section this run collected covers the step that wrote it and does not
+name it:
+`npx --yes copilotkit@4.9.31 onboard protect --accept-external --path <path>`. Then run
+the audit again and name the path in the closing summary. Never repair, reset, or revert a
+protected path.
 
 If the proof result starts with `Status: passed`, run the protected-path audit. Continue to
 `proof/complete` only if that audit passes. After the audit passes, run
-`npx --yes copilotkit@4.9.24 onboard read proof/complete`. A performed surface outcome with
+`npx --yes copilotkit@4.9.31 onboard read proof/complete`. A performed surface outcome with
 the full round trip is core success even if a continued-development tool fails. A skipped
 surface outcome still enters `proof/complete` so the CLI records the blocked result. Do not
 describe a skipped surface as proved. Keep the Skills and MCP results separate from the proof
@@ -95,7 +103,7 @@ and proof cycles.
 
 Route out only when the failure is not yours to fix, when the same proof still fails after
 three attempts, or when no evidence of the round trip can be produced. In those cases run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`. All three are
+`npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`. All three are
 about the round trip itself. A round trip that proved is not one of them, whatever failed
 after it.
 
@@ -105,7 +113,7 @@ Run the feedback command without another developer question. The CLI telemetry g
 whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.24 onboard feedback
+npx --yes copilotkit@4.9.31 onboard feedback
 ```
 
 Write at most four lines to standard input: the step you stopped at and what stopped it.

package/onboarding/prompts/starter/clone.md

@@ -43,7 +43,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --yes copilotkit@4.9.24 project list --json`
+`npx --yes copilotkit@4.9.31 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -53,7 +53,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument.
 
-`npx --yes copilotkit@4.9.24 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
+`npx --yes copilotkit@4.9.31 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
 
 Pass the confirmed name to both `--name` and `--create`: the app directory and its
 Intelligence project take the same name here. If the developer names an existing project,
@@ -69,8 +69,8 @@ account. The command does not need terminal input.
 If the command succeeds, do not rebuild the starter by hand. Inspect only the generated
 paths inside the target directory. Record the files, install result, project connection,
 and validation commands. Then run
-`npx --yes copilotkit@4.9.24 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.9.31 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --yes copilotkit@4.9.24 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.31 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/subagent/create-plan.md

@@ -47,6 +47,28 @@ authority from that version. A runtime below it reports its license from a self-
 token alone. A managed project holds no such token, so the threads drawer this conversion
 adds lists nothing even after every command-line check passes.
 
+The upgrade moves more than the `@copilotkit/*` namespace. Intersect the dependencies the
+app declares directly with what the target `@copilotkit/*` versions require, and name in the
+plan every one whose declared range excludes the version the target needs, with the version
+it moves to. The `@ag-ui/*` packages are the CopilotKit protocol layer, on their own version
+line, so they are the ones this meets most often, but the rule is the intersection rather
+than that namespace.
+
+The intersection includes what a `@copilotkit/*` package on its own version line declares
+about the `1.x` line. `@copilotkit/angular` is the one that has this, and its declaration
+is materialized at publish time rather than written in the repository, so read it from the
+registry rather than from any checkout. Where it cannot be satisfied by the version the
+floor requires, there is no upgrade to plan: that is `unsupported/no-validated-path`.
+
+An exact pin is usually deliberate. Naming the move here is what makes it a step the
+developer approved rather than a repair the run invents halfway through. Do not move a pin
+the developer did not approve moving. Where the developer needs one held, that is
+`unsupported/no-validated-path`, and the upgrade step's revert is the way back.
+
+Name the exact version the target requires. A caret does not stand in for it below `0.1.0`:
+`^0.0.59` admits only `0.0.59`, so a pin rewritten that way is the same pin under a
+different spelling, and it breaks again as soon as CopilotKit moves to `0.0.60`.
+
 Plan the upgrade as its own step before the Intelligence runtime wiring, and plan to
 re-run the recorded baseline checks immediately after it. Name the revert: restore the
 manifest and lockfile to their recorded state and stop, rather than wiring Intelligence
@@ -100,7 +122,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --yes copilotkit@4.9.24 verify --round-trip`, which needs no browser. Do not plan a
+`npx --yes copilotkit@4.9.31 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps

package/onboarding/prompts/subagent/implement-and-validate.md

@@ -51,7 +51,36 @@ Where the plan names a CopilotKit dependency upgrade:
 
 1. Apply the planned CopilotKit dependency upgrade before you wire Intelligence.
 2. Report each `@copilotkit/*` version before and after the upgrade.
-3. Then re-run the recorded baseline checks.
+3. Prove that every dependency the app declares directly resolves to exactly one version in
+   the installed tree.
+4. Then re-run the recorded baseline checks.
+
+The package manager does not fail on this. Where the app pins a package exactly and the
+upgraded CopilotKit needs a different version of it, npm keeps the pin at the top of the
+tree and nests the other copy, so the install exits zero and `--dry-run` shows nothing.
+Two copies of a package that carries types fail the type check in some field that has
+nothing to do with either version, so the developer reads it as a bug in their own code.
+Read the installed tree, not the manifest: ask the package manager how many versions of
+each direct dependency it resolved, with `npm ls <name>`, `pnpm why <name>`, or the
+equivalent for the lockfile this project uses. Direct dependencies are a short list, and
+they are the ones whose duplicate breaks a build, so this catches `react`, `zod`,
+`graphql`, and the next protocol package as well as `@ag-ui/*`.
+
+`@copilotkit/*` counts here, not only third-party packages. `@copilotkit/angular`
+publishes on a version line of its own and declares a `@copilotkit/core` chosen when that
+Angular release was cut, so the upgrade can install one `@copilotkit/core` while the
+Angular package demands another. That is the case this catches most expensively, because
+it fails in the threads drawer rather than at the install.
+
+If one of them resolves to more than one version, restore the manifest and lockfile to
+their recorded state, leave Intelligence unwired, and report which package resolved to more
+than one version, which versions, and which declared range held the top of the tree. Stop.
+Do not wire Intelligence onto a tree carrying two copies of a package.
+
+Never add an `overrides`, `resolutions`, or `pnpm.overrides` block to collapse the two
+copies. It forces a version the developer did not approve onto their whole tree, and it
+turns a reportable mismatch between two published packages into a local workaround nobody
+else can see.
 
 If the baseline regresses, restore the manifest and lockfile to their recorded state, leave
 Intelligence unwired, and report the regression with the failing check. Stop. Where the plan

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -16,17 +16,26 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --yes copilotkit@4.9.24 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --yes copilotkit@4.9.31 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected
-   agent. Require the existing user-visible result. If no browser tool is available, the
-   round trip is not proved and the state is `unproved`.
+   agent. Require the existing user-visible result.
 
-Classify the state as `both-oss` only when all six predicates are true: agent present,
-interface present, CopilotKit present, CopilotKit round trip proven, runtime connection
-`oss`, and managed Intelligence not configured. Return each predicate and its secret-safe
-evidence.
+Use the surface control the main coding agent recorded for your environment. It either had
+one already or registered one before this step, so that finding is the answer and there is
+nothing here for you to go looking for. Do not add a browser or device driver to this
+project: a devDependency and a browser download land in the diff of a repository that never
+asked for one, which is a different thing from a server registered against the coding agent.
+Where the recorded control is `unavailable`, record predicate 6 as skipped, with that as the
+reason, and prove the rest.
+
+Classify the state as `both-oss` when predicates 1 to 5 are all true. Predicate 5 proves the
+CopilotKit round trip from a shell, so those five settle the starting state on their own.
+Predicate 6 adds the user-visible surface on top of a state already proved: record it as
+passed, failed, or skipped, and do not withhold `both-oss` for a skip. A failed predicate 6
+on an available surface is a baseline failure and is not a skip. Return each predicate and
+its secret-safe evidence.
 
 The default in-memory OSS runner is ephemeral. SQLite, custom, or framework persistence
 can be durable. Report the persistence that project evidence proves, or `unproved`. Do not

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -120,15 +120,25 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --yes copilotkit@4.9.24 verify --json`. Add `--runtime-url` when the runtime is not at
-`http://localhost:3000/api/copilotkit`. Read the individual checks rather than the summary
-alone: a check reported `undetermined` did not run, and that is not a pass. Repair a failed
-check only within the limits above. Otherwise, return the check and its evidence before the
-browser.
+`npx --yes copilotkit@4.9.31 verify --json`. It reads the port from this project, so a
+non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
+`runtimeUrlSource` of `default` means nothing in the project named a port, so pass
+`--runtime-url` with the URL from step 1 in that case. Read the individual checks rather than
+the summary alone: a check reported `undetermined` did not run, and that is not a pass.
+Repair a failed check only within the limits above. Otherwise, return the check and its
+evidence before the browser.
 
 Treat `intelligence_consumed` as the check that matters most here. It proves that the runtime
 used the Intelligence credential. `api_key_authenticates` proves only that the key is valid.
 
+`api_key_loadable_by_app` fails when the key is in a file the application's own process
+will not read. `verify` searches upward for the credential and a framework's env loader
+does not, so a key at the repository root is invisible to an app in a subdirectory. The
+check names the file to write instead. Write the key there, or run
+`npx --yes copilotkit@4.9.31 project select` from the app directory. Do not link,
+copy, or symlink the file to work around it, and do not treat the credential as missing:
+the check above already reported that it exists.
+
 `intelligence_thread_routes` fails when a licensed runtime serves no thread routes. A handler
 mounted `mode: "single-route"` is the usual cause. Return it for implementation to remove the
 option and use a catch-all route. Do not edit it. If the check is `undetermined` because no
@@ -136,7 +146,7 @@ thread-endpoint state exists, the runtime predates the field. Record that and co
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --yes copilotkit@4.9.24 verify --round-trip --json`. It sends one request through
+Run `npx --yes copilotkit@4.9.31 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -213,7 +223,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --yes copilotkit@4.9.24 verify --round-trip`, which reads the
+that thread with `npx --yes copilotkit@4.9.31 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. It either had

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -6,6 +6,10 @@ Explain the exact step that failed. State whether authentication, project select
 credentials, the journey, a documentation URL, implementation, validation, or the round
 trip caused the route change. Do not say a path works when this release does not support it.
 
+If a protected path stopped this run, name that path and how it changed, in the words the
+audit printed. A report that says only that protected files changed cannot be acted on:
+nobody reading it can tell which file moved, or whether this run or the developer moved it.
+
 Stop onboarding without making more repository changes by default.
 
 The documentation-gap exception applies only before implementation starts. If implementation,
@@ -26,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --yes copilotkit@4.9.24 onboard read fallback/best-effort`.
+`npx --yes copilotkit@4.9.31 onboard read fallback/best-effort`.
 
 Send one short report. Run the feedback command without another developer question. The
 CLI telemetry gate decides whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.24 onboard feedback
+npx --yes copilotkit@4.9.31 onboard feedback
 ```
 
 Write the feedback message to the command's standard input, in at most four lines.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.9.24",
+  "version": "4.9.31",
   "type": "module",
   "repository": {
     "type": "git",

package/release/release-tool.js

@@ -14698,7 +14698,7 @@ import * as path4 from "node:path";
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "2d44d3ff00910e9f3494d5e57aaa7bdd69a82e04" : "main";
+  return true ? "c2038cf52ced16dc814e2ff0bd60894f2a53f5c1" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts
@@ -14881,6 +14881,20 @@ var TELEMETRY_ERROR_CODES = {
    * tell "the caller guessed a slug" from a malformed request.
    */
   PROJECT_NOT_FOUND: "PROJECT_NOT_FOUND",
+  /**
+   * `project select` persisted the record and the key-provisioning call did
+   * not succeed. Buckets as `network` because that is what it almost always
+   * is, and because the funnel needs half-applied selections visible next to
+   * the upstream failures that cause them (OSS-1089).
+   */
+  KEY_PROVISION_FAILED: "KEY_PROVISION_FAILED",
+  /**
+   * `project select` persisted the record and declined to write the key
+   * because git tracks the env file. Distinct from
+   * {@link TELEMETRY_ERROR_CODES.KEY_PROVISION_FAILED}: nothing upstream
+   * failed, and a retry alone will not clear it.
+   */
+  KEY_PROVISION_REFUSED: "KEY_PROVISION_REFUSED",
   CLI_PRODUCT_BINARY_TOO_LARGE: "CLI_PRODUCT_BINARY_TOO_LARGE",
   LEARNING_CONTAINER_ID_INVALID: "LEARNING_CONTAINER_ID_INVALID",
   LEARNING_PROJECT_ID_INVALID: "LEARNING_PROJECT_ID_INVALID",