copilotkit 4.9.24 → 4.9.37

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -120,15 +120,25 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --yes copilotkit@4.9.24 verify --json`. Add `--runtime-url` when the runtime is not at
-`http://localhost:3000/api/copilotkit`. Read the individual checks rather than the summary
-alone: a check reported `undetermined` did not run, and that is not a pass. Repair a failed
-check only within the limits above. Otherwise, return the check and its evidence before the
-browser.
+`npx --yes copilotkit@4.9.37 verify --json`. It reads the port from this project, so a
+non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
+`runtimeUrlSource` of `default` means nothing in the project named a port, so pass
+`--runtime-url` with the URL from step 1 in that case. Read the individual checks rather than
+the summary alone: a check reported `undetermined` did not run, and that is not a pass.
+Repair a failed check only within the limits above. Otherwise, return the check and its
+evidence before the browser.
 
 Treat `intelligence_consumed` as the check that matters most here. It proves that the runtime
 used the Intelligence credential. `api_key_authenticates` proves only that the key is valid.
 
+`api_key_loadable_by_app` fails when the key is in a file the application's own process
+will not read. `verify` searches upward for the credential and a framework's env loader
+does not, so a key at the repository root is invisible to an app in a subdirectory. The
+check names the file to write instead. Write the key there, or run
+`npx --yes copilotkit@4.9.37 project select` from the app directory. Do not link,
+copy, or symlink the file to work around it, and do not treat the credential as missing:
+the check above already reported that it exists.
+
 `intelligence_thread_routes` fails when a licensed runtime serves no thread routes. A handler
 mounted `mode: "single-route"` is the usual cause. Return it for implementation to remove the
 option and use a catch-all route. Do not edit it. If the check is `undetermined` because no
@@ -136,7 +146,7 @@ thread-endpoint state exists, the runtime predates the field. Record that and co
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --yes copilotkit@4.9.24 verify --round-trip --json`. It sends one request through
+Run `npx --yes copilotkit@4.9.37 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -213,7 +223,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --yes copilotkit@4.9.24 verify --round-trip`, which reads the
+that thread with `npx --yes copilotkit@4.9.37 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. It either had
@@ -318,15 +328,21 @@ Return the cause and its evidence. Do not edit it during proof.
 Run this step only for a recorded `both-oss` starting state. Compare the final round trip
 with the recorded OSS baseline against the criterion the conversion prompt froze. The same
 frontend request must still reach the same agent and produce the same kind of user-visible
-result. The runtime must now report `licenseStatus`, and the authenticated Intelligence
-checks must pass. A thread for that request must be persisted and visible. Record both
-before and after evidence, and record that the criterion was `conversion-v1`.
-
-`licenseStatus` reports `unknown` while the runtime entitlement lookup for this project
-has not resolved yet. That value is transient rather than a failure, and the drawer
-renders its locked view for as long as it stands. Re-read `/info` and re-open the drawer
-before you judge either one. Criterion 4 requires `licenseStatus` to be present, and a
-present `unknown` meets it.
+result. The runtime must now report `runtimeEntitlements`, and the authenticated
+Intelligence checks must pass. A thread for that request must be persisted and
+visible. Record both before and after evidence, and record that the criterion was
+`conversion-v1`.
+
+`runtimeEntitlements` reports a `status` other than `ready` with a retryable error while
+the entitlement lookup for this project has not resolved yet. That state is transient
+rather than a failure, and the drawer renders its locked view for as long as it stands.
+Re-read `/info` and re-open the drawer before you judge either one. Criterion 4 requires
+`runtimeEntitlements` to be present, and a present unresolved lookup meets it.
+
+A runtime that reports `licenseStatus` and no `runtimeEntitlements` is below
+`@copilotkit/runtime` 1.70.0, which is this conversion's dependency floor. Criterion 4 is
+not met by the older field. Record the floor as unmet and say which dependency is below
+it, rather than reading the compatibility field as a pass.
 
 For every other starting state, record Step 8 as not applicable.
 

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -6,6 +6,10 @@ Explain the exact step that failed. State whether authentication, project select
 credentials, the journey, a documentation URL, implementation, validation, or the round
 trip caused the route change. Do not say a path works when this release does not support it.
 
+If a protected path stopped this run, name that path and how it changed, in the words the
+audit printed. A report that says only that protected files changed cannot be acted on:
+nobody reading it can tell which file moved, or whether this run or the developer moved it.
+
 Stop onboarding without making more repository changes by default.
 
 The documentation-gap exception applies only before implementation starts. If implementation,
@@ -26,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --yes copilotkit@4.9.24 onboard read fallback/best-effort`.
+`npx --yes copilotkit@4.9.37 onboard read fallback/best-effort`.
 
 Send one short report. Run the feedback command without another developer question. The
 CLI telemetry gate decides whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.24 onboard feedback
+npx --yes copilotkit@4.9.37 onboard feedback
 ```
 
 Write the feedback message to the command's standard input, in at most four lines.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.9.24",
+  "version": "4.9.37",
   "type": "module",
   "repository": {
     "type": "git",

package/release/release-tool.js

@@ -14698,7 +14698,7 @@ import * as path4 from "node:path";
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "2d44d3ff00910e9f3494d5e57aaa7bdd69a82e04" : "main";
+  return true ? "aec312634129f97f90154bb416a07e8cc0c13a2a" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts
@@ -14881,6 +14881,20 @@ var TELEMETRY_ERROR_CODES = {
    * tell "the caller guessed a slug" from a malformed request.
    */
   PROJECT_NOT_FOUND: "PROJECT_NOT_FOUND",
+  /**
+   * `project select` persisted the record and the key-provisioning call did
+   * not succeed. Buckets as `network` because that is what it almost always
+   * is, and because the funnel needs half-applied selections visible next to
+   * the upstream failures that cause them (OSS-1089).
+   */
+  KEY_PROVISION_FAILED: "KEY_PROVISION_FAILED",
+  /**
+   * `project select` persisted the record and declined to write the key
+   * because git tracks the env file. Distinct from
+   * {@link TELEMETRY_ERROR_CODES.KEY_PROVISION_FAILED}: nothing upstream
+   * failed, and a retry alone will not clear it.
+   */
+  KEY_PROVISION_REFUSED: "KEY_PROVISION_REFUSED",
   CLI_PRODUCT_BINARY_TOO_LARGE: "CLI_PRODUCT_BINARY_TOO_LARGE",
   LEARNING_CONTAINER_ID_INVALID: "LEARNING_CONTAINER_ID_INVALID",
   LEARNING_PROJECT_ID_INVALID: "LEARNING_PROJECT_ID_INVALID",