copilotkit 4.9.37 → 4.9.47

package/index.js

@@ -96,14 +96,14 @@ function getTelemetryEndpointUrl() {
 }
 function getBuildInfo() {
   return {
-    version: true ? "4.9.37" : "dev",
-    buildNumber: true ? "33790889389" : "dev",
-    commitSha: true ? "760576e30fb6301f29f82a14f5d02d40bdf9e22a" : "dev",
+    version: true ? "4.9.47" : "dev",
+    buildNumber: true ? "34279600219" : "dev",
+    commitSha: true ? "85f6b2eb2b4c8fef747bbfb0e3f5991b196ecc43" : "dev",
     copilotKitCommit: getTemplateRef()
   };
 }
 function getTemplateRef() {
-  return true ? "aec312634129f97f90154bb416a07e8cc0c13a2a" : "main";
+  return true ? "380ad1220a7bc78104baedc469c4d086c8910494" : "main";
 }
 function getC15tBackendUrl() {
   return true ? "https://calm-hazelnut-joy-copilotkit.inth.app" : "";
@@ -27932,6 +27932,7 @@ __export(src_exports, {
   cliProductCredentialExchangeResponseSchema: () => cliProductCredentialExchangeResponseSchema,
   cliProductCredentialPayloadSchema: () => cliProductCredentialPayloadSchema,
   cliProductCredentialSchema: () => cliProductCredentialSchema,
+  cliProductCredentialTokenPayloadSchema: () => cliProductCredentialTokenPayloadSchema,
   cliTelemetryIdentityRequestSchema: () => cliTelemetryIdentityRequestSchema,
   cliTelemetryIdentityResponseSchema: () => cliTelemetryIdentityResponseSchema,
   cliTelemetryProjectIdSchema: () => cliTelemetryProjectIdSchema,
@@ -28090,7 +28091,7 @@ function parseEntitlementGrantedEvent(input) {
 function parseManagedFeatureAvailability(input) {
   return managedFeatureAvailabilitySchema.parse(input);
 }
-var ENTITLEMENT_SOURCES, ENTITLEMENT_STATES, ENTERPRISE_SUBSCRIPTION_STATUSES, WAITLIST_OFFER_CODES, featureValueSchema, catalogFeatureMapSchema, enterpriseFeaturesSchema, adminClerkOrganizationSchema, enterpriseSubscriptionStatusSchema, planCodeSchema, organizationPlanSelectionGateCompletionReasonSchema, organizationPlanSelectionGateSchema, organizationPlanSelectionGateResponseSchema, organizationPlanSelectionGateRequestSchema, organizationPlanSelectionRequestSchema, organizationPlanSelectionResponseSchema, entitlementSourceSchema, entitlementStateSchema, waitlistOfferCodeSchema, joinWaitlistRequestSchema, waitlistEntrySchema, currentWaitlistResponseSchema, joinWaitlistResponseSchema, adminEnterpriseSubscriptionSchema, customerEffectiveEntitlementSchema, adminEffectiveEntitlementSchema, currentEntitlementResponseSchema, inspectorEntitlementProjectionVariants, inspectorEntitlementProjectionSchema, inspectorEntitlementProjectionTransportSchema, organizationEntitlementResponseSchema, customerEffectiveEntitlementTransportSchema, organizationEntitlementResponseTransportSchema, CLI_PRODUCT_CREDENTIAL_CAPABILITIES, APP_PROJECT_ID_MAX, CLI_TELEMETRY_BINDING_ID_MAX_LENGTH, cliTelemetryProjectIdSchema, cliTelemetryIdentityRequestSchema, cliTelemetryIdentityResponseSchema, cliProductCredentialCapabilitySchema, cliProductCredentialActorSchema, cliProductCredentialSchema, cliProductCredentialPayloadSchema, cliProductCredentialExchangeResponseSchema, ACCOUNT_PROFILE_EMAIL_MAX_LENGTH, ACCOUNT_PROFILE_DISPLAY_NAME_MAX_LENGTH, ACCOUNT_PROFILE_AVATAR_URL_MAX_LENGTH, managedIntelligenceDestinationAppSchema, absoluteUrlSchema, managedHandoffTimestampSchema, emailValidationSchema, optionalAccountProfileEmailSchema, optionalAccountProfileDisplayNameSchema, optionalAccountProfileAvatarUrlSchema, nullableAccountProfileEmailSchema, nullableAccountProfileDisplayNameSchema, nullableAccountProfileAvatarUrlSchema, accountProfileSchema, managedClerkOrganizationSchema, managedHandoffActorSchema, managedIntelligenceSessionSchema, managedIntelligenceHandoffIssueRequestSchema, managedIntelligenceHandoffIssueResponseSchema, managedIntelligenceHandoffExchangeRequestSchema, managedIntelligenceHandoffExchangeResponseSchema, managedIntelligenceHandoffExchangeResponseTransportSchema, intelligenceAuthSessionResponseSchema, adminEnterpriseSubscriptionListResponseSchema, adminEnterpriseSubscriptionResponseSchema, adminEnterpriseSubscriptionDetailResponseSchema, createAdminEnterpriseSubscriptionRequestSchema, updateAdminEnterpriseSubscriptionRequestSchema, entitlementGrantedEventSchema, MANAGED_FEATURE_DISABLED_REASONS, managedFeatureDisabledReasonSchema, managedFeatureAvailabilitySchema, MANAGED_FEATURE_AVAILABLE, MANAGED_FEATURE_DISABLED_BY_FEATURE_FLAG, MANAGED_FEATURE_DISABLED_BY_ENTITLEMENT;
+var ENTITLEMENT_SOURCES, ENTITLEMENT_STATES, ENTERPRISE_SUBSCRIPTION_STATUSES, WAITLIST_OFFER_CODES, featureValueSchema, catalogFeatureMapSchema, enterpriseFeaturesSchema, adminClerkOrganizationSchema, enterpriseSubscriptionStatusSchema, planCodeSchema, organizationPlanSelectionGateCompletionReasonSchema, organizationPlanSelectionGateSchema, organizationPlanSelectionGateResponseSchema, organizationPlanSelectionGateRequestSchema, organizationPlanSelectionRequestSchema, organizationPlanSelectionResponseSchema, entitlementSourceSchema, entitlementStateSchema, waitlistOfferCodeSchema, joinWaitlistRequestSchema, waitlistEntrySchema, currentWaitlistResponseSchema, joinWaitlistResponseSchema, adminEnterpriseSubscriptionSchema, customerEffectiveEntitlementSchema, adminEffectiveEntitlementSchema, currentEntitlementResponseSchema, inspectorEntitlementProjectionVariants, inspectorEntitlementProjectionSchema, inspectorEntitlementProjectionTransportSchema, organizationEntitlementResponseSchema, customerEffectiveEntitlementTransportSchema, organizationEntitlementResponseTransportSchema, CLI_PRODUCT_CREDENTIAL_CAPABILITIES, APP_PROJECT_ID_MAX, CLI_TELEMETRY_BINDING_ID_MAX_LENGTH, cliTelemetryProjectIdSchema, cliTelemetryIdentityRequestSchema, cliTelemetryIdentityResponseSchema, cliProductCredentialCapabilitySchema, cliProductCredentialActorSchema, cliProductCredentialSchema, cliProductCredentialPayloadSchema, cliProductCredentialTokenPayloadSchema, cliProductCredentialExchangeResponseSchema, ACCOUNT_PROFILE_EMAIL_MAX_LENGTH, ACCOUNT_PROFILE_DISPLAY_NAME_MAX_LENGTH, ACCOUNT_PROFILE_AVATAR_URL_MAX_LENGTH, managedIntelligenceDestinationAppSchema, absoluteUrlSchema, managedHandoffTimestampSchema, emailValidationSchema, optionalAccountProfileEmailSchema, optionalAccountProfileDisplayNameSchema, optionalAccountProfileAvatarUrlSchema, nullableAccountProfileEmailSchema, nullableAccountProfileDisplayNameSchema, nullableAccountProfileAvatarUrlSchema, accountProfileSchema, managedClerkOrganizationSchema, managedHandoffActorSchema, managedIntelligenceSessionSchema, managedIntelligenceHandoffIssueRequestSchema, managedIntelligenceHandoffIssueResponseSchema, managedIntelligenceHandoffExchangeRequestSchema, managedIntelligenceHandoffExchangeResponseSchema, managedIntelligenceHandoffExchangeResponseTransportSchema, intelligenceAuthSessionResponseSchema, adminEnterpriseSubscriptionListResponseSchema, adminEnterpriseSubscriptionResponseSchema, adminEnterpriseSubscriptionDetailResponseSchema, createAdminEnterpriseSubscriptionRequestSchema, updateAdminEnterpriseSubscriptionRequestSchema, entitlementGrantedEventSchema, MANAGED_FEATURE_DISABLED_REASONS, managedFeatureDisabledReasonSchema, managedFeatureAvailabilitySchema, MANAGED_FEATURE_AVAILABLE, MANAGED_FEATURE_DISABLED_BY_FEATURE_FLAG, MANAGED_FEATURE_DISABLED_BY_ENTITLEMENT;
 var init_src3 = __esm({
   "libs/ops-contracts/src/index.ts"() {
     "use strict";
@@ -28353,6 +28354,9 @@ var init_src3 = __esm({
     cliProductCredentialPayloadSchema = cliProductCredentialSchema.omit({
       token: true
     });
+    cliProductCredentialTokenPayloadSchema = cliProductCredentialPayloadSchema.extend({
+      organizationName: external_exports.string().trim().min(1).optional()
+    }).strict();
     cliProductCredentialExchangeResponseSchema = external_exports.object({
       productCredential: cliProductCredentialSchema
     }).strict();
@@ -98449,6 +98453,196 @@ var init_src6 = __esm({
   }
 });
 
+// apps/cli/src/services/runtime-url.ts
+import * as path22 from "node:path";
+function portInCommand(command2) {
+  for (const pattern of PORT_PATTERNS) {
+    const match = pattern.exec(command2);
+    if (match?.[1] !== void 0) {
+      const port = Number.parseInt(match[1], 10);
+      if (port > 0 && port < 65536) {
+        return port;
+      }
+    }
+  }
+  return void 0;
+}
+function discoverWebDevPort(appDir, projectEnvValues) {
+  const appEnv = resolveProjectEnv(appDir, appDir);
+  const values = { ...projectEnvValues, ...appEnv.values };
+  const declared = values["PORT"];
+  if (declared !== void 0 && /^\d{2,5}$/.test(declared.trim())) {
+    const port2 = Number.parseInt(declared.trim(), 10);
+    if (port2 > 0 && port2 < 65536) {
+      return {
+        origin: `PORT in ${appEnv.origins["PORT"] ?? "the project environment"}`,
+        port: port2
+      };
+    }
+  }
+  const scripts = readAppManifest(appDir)?.scripts ?? {};
+  const dev = scripts["dev"];
+  if (dev === void 0) {
+    return void 0;
+  }
+  const considered = /* @__PURE__ */ new Map([["dev", dev]]);
+  const queue2 = [dev];
+  while (queue2.length > 0) {
+    const body = queue2.shift();
+    for (const match of body.matchAll(DELEGATION_PATTERN)) {
+      const name = match[1];
+      const delegate = name === void 0 ? void 0 : scripts[name];
+      if (name !== void 0 && delegate !== void 0 && !considered.has(name)) {
+        considered.set(name, delegate);
+        queue2.push(delegate);
+      }
+    }
+  }
+  const ports = /* @__PURE__ */ new Map();
+  for (const [name, body] of considered) {
+    if (!WEB_DEV_COMMANDS.test(body)) {
+      continue;
+    }
+    const port2 = portInCommand(body);
+    if (port2 !== void 0 && !ports.has(port2)) {
+      ports.set(port2, `the "${name}" script in ${path22.join(appDir, "package.json")}`);
+    }
+  }
+  if (ports.size !== 1) {
+    return void 0;
+  }
+  const [[port, origin]] = [...ports];
+  return { origin, port };
+}
+function resolveRuntimeUrl(inputs) {
+  if (inputs.flagUrl !== void 0) {
+    return { source: "flag", url: inputs.flagUrl };
+  }
+  const pinned = inputs.pinnedUrl?.trim();
+  if (pinned !== void 0 && pinned !== "" && URL.canParse(pinned)) {
+    return {
+      origin: "runtimeUrl in .copilotkit/project.json",
+      source: "project-file",
+      url: pinned
+    };
+  }
+  const declared = inputs.projectEnvValues[RUNTIME_URL_VARIABLE]?.trim();
+  if (declared !== void 0 && declared !== "" && URL.canParse(declared)) {
+    return {
+      origin: `${RUNTIME_URL_VARIABLE} in the project environment`,
+      source: "env",
+      url: declared
+    };
+  }
+  const { apps: apps2 } = resolveAppDirectories(inputs.cwd, inputs.ceiling);
+  if (apps2.length > 1) {
+    return {
+      ambiguousApps: apps2,
+      source: "default",
+      url: DEFAULT_RUNTIME_URL
+    };
+  }
+  const appDir = apps2[0];
+  const discovered = appDir === void 0 ? void 0 : discoverWebDevPort(appDir, inputs.projectEnvValues);
+  if (discovered === void 0) {
+    return { source: "default", url: DEFAULT_RUNTIME_URL };
+  }
+  return {
+    origin: discovered.origin,
+    source: "discovered",
+    url: `http://localhost:${String(discovered.port)}${DEFAULT_RUNTIME_PATH}`
+  };
+}
+var DEFAULT_RUNTIME_URL, ASSUMED_RUNTIME_URL_CAVEAT, DEFAULT_RUNTIME_PATH, RUNTIME_URL_VARIABLE, WEB_DEV_COMMANDS, PORT_PATTERNS, DELEGATION_PATTERN;
+var init_runtime_url = __esm({
+  "apps/cli/src/services/runtime-url.ts"() {
+    "use strict";
+    init_app_directory();
+    init_project_env();
+    DEFAULT_RUNTIME_URL = "http://localhost:3000/api/copilotkit";
+    ASSUMED_RUNTIME_URL_CAVEAT = `The URL is this command's assumed default rather than one this project stated, so which project answered is unverified: another checkout serving this port answers exactly the same. Pass --runtime-url, or record "runtimeUrl" in .copilotkit/project.json, to probe the URL your own project names.`;
+    DEFAULT_RUNTIME_PATH = "/api/copilotkit";
+    RUNTIME_URL_VARIABLE = "COPILOTKIT_RUNTIME_URL";
+    WEB_DEV_COMMANDS = /\b(next|vite|ng serve|react-scripts|nuxt|remix|astro|rsbuild|webpack serve|parcel)\b/;
+    PORT_PATTERNS = [
+      /(?:^|\s)--port[= ](\d{2,5})\b/,
+      /(?:^|\s)-p[= ](\d{2,5})\b/,
+      /(?:^|\s|^)PORT=(\d{2,5})\b/
+    ];
+    DELEGATION_PATTERN = /\b(?:npm run|pnpm run|pnpm|yarn run|yarn|bun run)\s+([\w:.-]+)/g;
+  }
+});
+
+// apps/cli/src/services/frontend-url.ts
+var frontend_url_exports = {};
+__export(frontend_url_exports, {
+  FRONTEND_HOST_KINDS: () => FRONTEND_HOST_KINDS,
+  classifyFrontendHost: () => classifyFrontendHost,
+  isFrontendUrl: () => isFrontendUrl,
+  isIpLiteralHost: () => isIpLiteralHost,
+  resolveFrontendUrl: () => resolveFrontendUrl
+});
+function isIpLiteralHost(host) {
+  const bare = host.replace(/^\[|\]$/gu, "");
+  return IPV4_PATTERN.test(bare) || bare.includes(":");
+}
+function resolveFrontendUrl(inputs) {
+  if (inputs.flagUrl !== void 0) {
+    return { source: "flag", url: inputs.flagUrl };
+  }
+  const { apps: apps2 } = resolveAppDirectories(inputs.cwd, inputs.ceiling);
+  if (apps2.length > 1) {
+    return { ambiguousApps: apps2, source: "unknown" };
+  }
+  const appDir = apps2[0];
+  const discovered = appDir === void 0 ? void 0 : discoverWebDevPort(appDir, inputs.projectEnvValues);
+  if (discovered === void 0) {
+    return { source: "unknown" };
+  }
+  return {
+    origin: discovered.origin,
+    source: "discovered",
+    url: `http://localhost:${String(discovered.port)}`
+  };
+}
+function isFrontendUrl(value) {
+  if (!URL.canParse(value)) {
+    return false;
+  }
+  const parsed = new URL(value);
+  return (parsed.protocol === "http:" || parsed.protocol === "https:") && parsed.hostname !== "";
+}
+function classifyFrontendHost(url4) {
+  if (!isFrontendUrl(url4)) {
+    return void 0;
+  }
+  const host = new URL(url4).hostname.toLowerCase();
+  if (isIpLiteralHost(host)) {
+    const bare = host.replace(/^\[|\]$/gu, "");
+    return bare === "::1" || bare.startsWith("127.") ? "loopback-ip" : "other-ip";
+  }
+  return host === "localhost" || host.endsWith(".localhost") ? "loopback-hostname" : "other-hostname";
+}
+var IPV4_PATTERN, FRONTEND_HOST_KINDS;
+var init_frontend_url = __esm({
+  "apps/cli/src/services/frontend-url.ts"() {
+    "use strict";
+    init_runtime_url();
+    init_app_directory();
+    IPV4_PATTERN = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
+    FRONTEND_HOST_KINDS = [
+      /** `localhost`, or a name under it. The state a healthy run is in. */
+      "loopback-hostname",
+      /** `127.0.0.0/8` or `::1`. The failure this field exists to count. */
+      "loopback-ip",
+      /** Any other IP literal, such as a LAN address. It fails the same way. */
+      "other-ip",
+      /** Any other name. One bucket, so no private hostname is ever sent. */
+      "other-hostname"
+    ];
+  }
+});
+
 // apps/cli/src/services/verify-checks.ts
 function eitherKeyName() {
   return API_KEY_VARIABLE_NAMES.join(" or ");
@@ -98622,8 +98816,9 @@ function runtimeReachableCheck(probe, runtimeUrl) {
       title
     };
   }
+  const answered = probe.transport === "single-route" ? `CopilotKit runtime ${probe.info.version} answered its single-route envelope. It refuses GET /info, so it is mounted \`mode: "single-route"\`.` : `CopilotKit runtime ${probe.info.version} answered.`;
   return {
-    detail: probe.transport === "single-route" ? `CopilotKit runtime ${probe.info.version} answered its single-route envelope. It refuses GET /info, so it is mounted \`mode: "single-route"\`.` : `CopilotKit runtime ${probe.info.version} answered.`,
+    detail: runtimeUrl.source === "default" ? `${answered} ${ASSUMED_RUNTIME_URL_CAVEAT}` : answered,
     id: "runtime_reachable",
     status: "pass",
     title
@@ -98639,7 +98834,7 @@ function describeIntelligenceEntitlement(info) {
   }
   return `reports its license as ${info.licenseStatus}`;
 }
-function runtimeAgentsCheck(probe) {
+function runtimeAgentsCheck(probe, runtimeUrl) {
   const title = "The runtime declares at least one agent";
   if (probe.kind !== "ok") {
     return {
@@ -98662,8 +98857,9 @@ function runtimeAgentsCheck(probe) {
   const described = agents.map(
     (agent) => agent.className ? `${agent.name} (${agent.className})` : agent.name
   ).join(", ");
+  const whose = runtimeUrl.source === "default" ? " These are the agents of whatever answered the assumed default URL, not proof that this project declares them." : "";
   return {
-    detail: `Declares ${String(agents.length)}: ${described}.`,
+    detail: `Declares ${String(agents.length)}: ${described}.${whose}`,
     id: "runtime_agents_declared",
     status: "pass",
     title
@@ -98697,7 +98893,7 @@ function intelligenceConsumedCheck(credential, runtime) {
   }
   if (!reportsIntelligenceClient(runtime.info)) {
     return {
-      detail: `The key authenticates, but the runtime reports no entitlement, which means it was built without an Intelligence client and is running in OSS/SSE mode. The key is never read and nothing reaches the platform. The default in-memory OSS runner is ephemeral. SQLite, custom, or framework persistence can be durable. Pass \`intelligence: new CopilotKitIntelligence({ apiKey })\` where the runtime is constructed \u2014 https://docs.copilotkit.ai/premium/connect-your-runtime`,
+      detail: `The key authenticates, but the runtime reports no entitlement, which means it was built without an Intelligence client and is running in OSS/SSE mode. The key is never read and nothing reaches the platform. The default in-memory OSS runner is ephemeral. SQLite, custom, or framework persistence can be durable. Pass \`intelligence: new CopilotKitIntelligence({ apiKey })\` where the runtime is constructed \u2014 https://docs.copilotkit.ai/intelligence/connect-your-runtime`,
       id: "intelligence_consumed",
       status: "fail",
       title
@@ -98796,11 +98992,70 @@ function collectFacts(input) {
     runtimeVersion: info?.version
   };
 }
+function frontendAssetsCheck(frontendUrl, probe) {
+  const title = "The frontend serves its own static assets";
+  const id = "frontend_assets_served";
+  if (probe.kind === "unreachable") {
+    return {
+      detail: `Nothing answered at ${probe.url}: ${probe.message}. Start the frontend dev server, then run this again.`,
+      id,
+      status: "undetermined",
+      title
+    };
+  }
+  if (probe.kind === "page-not-served") {
+    return {
+      detail: `A server at ${frontendUrl} answered status ${String(probe.status)} for its own page, so its assets were never asked for. That is the page to fix before a browser step is worth running.`,
+      id,
+      status: "undetermined",
+      title
+    };
+  }
+  if (probe.kind === "no-asset") {
+    return {
+      detail: `The page at ${frontendUrl} named no script or stylesheet on its own origin, so there was nothing to test. A production build inlines its assets, and a dev server normally does not.`,
+      id,
+      status: "undetermined",
+      title
+    };
+  }
+  if (probe.kind === "asset-inconclusive") {
+    return {
+      detail: `The page at ${frontendUrl} was served, and ${probe.assetUrl} answered status ${String(probe.status)} \u2014 neither served nor refused. Read that server's own output for the reason.`,
+      id,
+      status: "undetermined",
+      title
+    };
+  }
+  if (probe.kind === "assets-refused") {
+    const asked = new URL(frontendUrl);
+    const hostname5 = asked.hostname;
+    const withName = new URL(asked.toString());
+    withName.hostname = "localhost";
+    const remedy = isIpLiteralHost(hostname5) ? ` You reached it on an IP literal. Open ${withName.origin} instead, and the assets are served.` : ` Read that server's own output: it decides which hosts it serves assets to, and ${hostname5} is not one of them.`;
+    return {
+      detail: `The dev server at ${frontendUrl} served its page but answered status ${String(probe.status)} for ${probe.assetUrl}, one of the assets that page loads. A page that renders without its own chunks leaves the CopilotKit control dead, which reads as a broken integration rather than as a refused asset.${remedy}`,
+      id,
+      status: "fail",
+      title
+    };
+  }
+  return {
+    detail: `${frontendUrl} served its page and ${probe.assetUrl}, so this host is one the dev server serves assets on.`,
+    id,
+    status: "pass",
+    title
+  };
+}
+function frontendAssetChecks(input) {
+  return input.frontendUrl.url === void 0 || input.frontendAssets === void 0 ? [] : [frontendAssetsCheck(input.frontendUrl.url, input.frontendAssets)];
+}
 function runVerifyChecks(input, expectedRuntime = "intelligence") {
   const checks = expectedRuntime === "oss" ? [
     runtimeReachableCheck(input.runtime, input.runtimeUrl),
-    runtimeAgentsCheck(input.runtime),
-    ossRuntimeModeCheck(input.runtime)
+    runtimeAgentsCheck(input.runtime, input.runtimeUrl),
+    ossRuntimeModeCheck(input.runtime),
+    ...frontendAssetChecks(input)
   ] : [
     projectSelectedCheck(input.projectConfig),
     apiKeyPresentCheck(
@@ -98811,9 +99066,10 @@ function runVerifyChecks(input, expectedRuntime = "intelligence") {
     apiKeyLoadableCheck(input.credentialLoad),
     apiKeyAuthenticatesCheck(input.credential),
     runtimeReachableCheck(input.runtime, input.runtimeUrl),
-    runtimeAgentsCheck(input.runtime),
+    runtimeAgentsCheck(input.runtime, input.runtimeUrl),
     intelligenceConsumedCheck(input.credential, input.runtime),
-    intelligenceThreadRoutesCheck(input.runtime)
+    intelligenceThreadRoutesCheck(input.runtime),
+    ...frontendAssetChecks(input)
   ];
   return {
     checks,
@@ -98827,6 +99083,8 @@ var API_KEY_VARIABLE_NAMES;
 var init_verify_checks = __esm({
   "apps/cli/src/services/verify-checks.ts"() {
     "use strict";
+    init_frontend_url();
+    init_runtime_url();
     API_KEY_VARIABLE_NAMES = [
       "CPK_INTELLIGENCE_API_KEY",
       "COPILOTKIT_API_KEY",
@@ -150047,7 +150305,7 @@ function getApiKeyFromEnv() {
   }
   return envGoogleApiKey || envGeminiApiKey || void 0;
 }
-var import_p_retry, import_google_auth_library, _defaultBaseGeminiUrl, _defaultBaseVertexUrl, BaseModule, Language, Outcome, FunctionResponseScheduling, Type, Environment, AuthType, HttpElementLocation, ApiSpec, PhishBlockThreshold, Behavior, DynamicRetrievalConfigMode, FunctionCallingConfigMode, ThinkingLevel, PersonGeneration, ProminentPeople, HarmCategory, HarmBlockMethod, HarmBlockThreshold, FinishReason, HarmProbability, HarmSeverity, UrlRetrievalStatus, BlockedReason, TrafficType, Modality, ModelStage, MediaResolution, TuningMode, AdapterSize, JobState, TuningJobState, AggregationMetric, PairwiseChoice, TuningTask, DocumentState, PartMediaResolutionLevel, ToolType, ResourceScope, ServiceTier, FeatureSelectionPreference, EmbeddingApiType, SafetyFilterLevel, ImagePromptLanguage, MaskReferenceMode, ControlReferenceType, SubjectReferenceType, EditMode, SegmentMode, VideoGenerationReferenceType, VideoGenerationMaskMode, VideoCompressionQuality, ImageResizeMode, TuningMethod, FileState, FileSource, TurnCompleteReason, MediaModality, VadSignalType, VoiceActivityType, StartSensitivity, EndSensitivity, ActivityHandling, TurnCoverage, Scale, MusicGenerationMode, LiveMusicPlaybackControl, HttpResponse, GenerateContentResponse, EmbedContentResponse, GenerateImagesResponse, EditImageResponse, UpscaleImageResponse, RecontextImageResponse, SegmentImageResponse, ListModelsResponse, DeleteModelResponse, CountTokensResponse, ComputeTokensResponse, GenerateVideosOperation, ListTuningJobsResponse, CancelTuningJobResponse, DeleteCachedContentResponse, ListCachedContentsResponse, ListDocumentsResponse, ListFileSearchStoresResponse, UploadToFileSearchStoreResumableResponse, ImportFileOperation, ListFilesResponse, CreateFileResponse, DeleteFileResponse, RegisterFilesResponse, ListBatchJobsResponse, LiveServerMessage, LiveMusicServerMessage, UploadToFileSearchStoreOperation, PagedItem, Pager, Batches, Caches, Chats, Chat, ApiError, Files, CONTENT_TYPE_HEADER, SERVER_TIMEOUT_HEADER, USER_AGENT_HEADER, GOOGLE_API_CLIENT_HEADER, SDK_VERSION, LIBRARY_LABEL, VERTEX_AI_API_DEFAULT_VERSION, GOOGLE_AI_API_DEFAULT_VERSION, MULTI_REGIONAL_LOCATIONS, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_HTTP_STATUS_CODES, ApiClient, MCP_LABEL, hasMcpToolUsageFromMcpToTool, McpCallableTool, LiveMusic, LiveMusicSession, FUNCTION_RESPONSE_REQUIRES_ID, Live, defaultLiveSendClientContentParamerters, Session, DEFAULT_MAX_REMOTE_CALLS, Models, Operations, Tokens, Documents, FileSearchStores, uuid4Internal, uuid42, castToError, GeminiNextGenAPIClientError, APIError, APIUserAbortError, APIConnectionError, APIConnectionTimeoutError, BadRequestError, AuthenticationError, PermissionDeniedError, NotFoundError, ConflictError, UnprocessableEntityError, RateLimitError, InternalServerError, startsWithSchemeRegexp, isAbsoluteURL, isArrayInternal, isArray, isReadonlyArrayInternal, isReadonlyArray, validatePositiveInteger, safeJSON, sleep$1, FallbackEncoder, VERSION2, checkFileSupport, isAsyncIterable, isBlobLike, isFileLike, isResponseLike, APIResource, EMPTY, createPathTagFunction, path22, BaseInteractions, Interactions, BaseWebhooks, Webhooks, encodeUTF8_, decodeUTF8_, LineDecoder, levelNumbers, parseLogLevel, noopLogger, cachedLoggers, formatRequestDetails, Stream4, SSEDecoder, APIPromise, brand_privateNullableHeaders, buildHeaders, readEnv, _a3, BaseGeminiNextGenAPIClient, GeminiNextGenAPIClient, GOOGLE_API_KEY_HEADER, REQUIRED_VERTEX_AI_SCOPE, NodeAuth, NodeDownloader, NodeWebSocketFactory, NodeWebSocket, Tunings, MAX_CHUNK_SIZE, MAX_RETRY_COUNT, INITIAL_RETRY_DELAY_MS, DELAY_MULTIPLIER, X_GOOG_UPLOAD_STATUS_HEADER_FIELD, NodeUploader, NodeFiles, LANGUAGE_LABEL_PREFIX, GoogleGenAI;
+var import_p_retry, import_google_auth_library, _defaultBaseGeminiUrl, _defaultBaseVertexUrl, BaseModule, Language, Outcome, FunctionResponseScheduling, Type, Environment, AuthType, HttpElementLocation, ApiSpec, PhishBlockThreshold, Behavior, DynamicRetrievalConfigMode, FunctionCallingConfigMode, ThinkingLevel, PersonGeneration, ProminentPeople, HarmCategory, HarmBlockMethod, HarmBlockThreshold, FinishReason, HarmProbability, HarmSeverity, UrlRetrievalStatus, BlockedReason, TrafficType, Modality, ModelStage, MediaResolution, TuningMode, AdapterSize, JobState, TuningJobState, AggregationMetric, PairwiseChoice, TuningTask, DocumentState, PartMediaResolutionLevel, ToolType, ResourceScope, ServiceTier, FeatureSelectionPreference, EmbeddingApiType, SafetyFilterLevel, ImagePromptLanguage, MaskReferenceMode, ControlReferenceType, SubjectReferenceType, EditMode, SegmentMode, VideoGenerationReferenceType, VideoGenerationMaskMode, VideoCompressionQuality, ImageResizeMode, TuningMethod, FileState, FileSource, TurnCompleteReason, MediaModality, VadSignalType, VoiceActivityType, StartSensitivity, EndSensitivity, ActivityHandling, TurnCoverage, Scale, MusicGenerationMode, LiveMusicPlaybackControl, HttpResponse, GenerateContentResponse, EmbedContentResponse, GenerateImagesResponse, EditImageResponse, UpscaleImageResponse, RecontextImageResponse, SegmentImageResponse, ListModelsResponse, DeleteModelResponse, CountTokensResponse, ComputeTokensResponse, GenerateVideosOperation, ListTuningJobsResponse, CancelTuningJobResponse, DeleteCachedContentResponse, ListCachedContentsResponse, ListDocumentsResponse, ListFileSearchStoresResponse, UploadToFileSearchStoreResumableResponse, ImportFileOperation, ListFilesResponse, CreateFileResponse, DeleteFileResponse, RegisterFilesResponse, ListBatchJobsResponse, LiveServerMessage, LiveMusicServerMessage, UploadToFileSearchStoreOperation, PagedItem, Pager, Batches, Caches, Chats, Chat, ApiError, Files, CONTENT_TYPE_HEADER, SERVER_TIMEOUT_HEADER, USER_AGENT_HEADER, GOOGLE_API_CLIENT_HEADER, SDK_VERSION, LIBRARY_LABEL, VERTEX_AI_API_DEFAULT_VERSION, GOOGLE_AI_API_DEFAULT_VERSION, MULTI_REGIONAL_LOCATIONS, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_HTTP_STATUS_CODES, ApiClient, MCP_LABEL, hasMcpToolUsageFromMcpToTool, McpCallableTool, LiveMusic, LiveMusicSession, FUNCTION_RESPONSE_REQUIRES_ID, Live, defaultLiveSendClientContentParamerters, Session, DEFAULT_MAX_REMOTE_CALLS, Models, Operations, Tokens, Documents, FileSearchStores, uuid4Internal, uuid42, castToError, GeminiNextGenAPIClientError, APIError, APIUserAbortError, APIConnectionError, APIConnectionTimeoutError, BadRequestError, AuthenticationError, PermissionDeniedError, NotFoundError, ConflictError, UnprocessableEntityError, RateLimitError, InternalServerError, startsWithSchemeRegexp, isAbsoluteURL, isArrayInternal, isArray, isReadonlyArrayInternal, isReadonlyArray, validatePositiveInteger, safeJSON, sleep$1, FallbackEncoder, VERSION2, checkFileSupport, isAsyncIterable, isBlobLike, isFileLike, isResponseLike, APIResource, EMPTY, createPathTagFunction, path23, BaseInteractions, Interactions, BaseWebhooks, Webhooks, encodeUTF8_, decodeUTF8_, LineDecoder, levelNumbers, parseLogLevel, noopLogger, cachedLoggers, formatRequestDetails, Stream4, SSEDecoder, APIPromise, brand_privateNullableHeaders, buildHeaders, readEnv, _a3, BaseGeminiNextGenAPIClient, GeminiNextGenAPIClient, GOOGLE_API_KEY_HEADER, REQUIRED_VERTEX_AI_SCOPE, NodeAuth, NodeDownloader, NodeWebSocketFactory, NodeWebSocket, Tunings, MAX_CHUNK_SIZE, MAX_RETRY_COUNT, INITIAL_RETRY_DELAY_MS, DELAY_MULTIPLIER, X_GOOG_UPLOAD_STATUS_HEADER_FIELD, NodeUploader, NodeFiles, LANGUAGE_LABEL_PREFIX, GoogleGenAI;
 var init_node3 = __esm({
   "node_modules/.pnpm/@google+genai@1.52.0_@modelcontextprotocol+sdk@1.29.0_@cfworker+json-schema@4.1.1_zod@4.3.6_/node_modules/@google/genai/dist/node/index.mjs"() {
     "use strict";
@@ -155650,7 +155908,7 @@ ${underline}`);
       }
       return path46;
     };
-    path22 = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
+    path23 = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
     BaseInteractions = class extends APIResource {
       create(params, options) {
         var _a21;
@@ -155661,7 +155919,7 @@ ${underline}`);
         if ("agent" in body && "generation_config" in body) {
           throw new GeminiNextGenAPIClientError(`Invalid request: specified \`agent\` and \`generation_config\`. If specifying \`agent\`, use \`agent_config\`.`);
         }
-        return this._client.post(path22`/${api_version}/interactions`, Object.assign(Object.assign({ body }, options), { stream: (_a21 = params.stream) !== null && _a21 !== void 0 ? _a21 : false }));
+        return this._client.post(path23`/${api_version}/interactions`, Object.assign(Object.assign({ body }, options), { stream: (_a21 = params.stream) !== null && _a21 !== void 0 ? _a21 : false }));
       }
       /**
        * Deletes the interaction by id.
@@ -155675,7 +155933,7 @@ ${underline}`);
        */
       delete(id, params = {}, options) {
         const { api_version = this._client.apiVersion } = params !== null && params !== void 0 ? params : {};
-        return this._client.delete(path22`/${api_version}/interactions/${id}`, options);
+        return this._client.delete(path23`/${api_version}/interactions/${id}`, options);
       }
       /**
        * Cancels an interaction by id. This only applies to background interactions that
@@ -155690,12 +155948,12 @@ ${underline}`);
        */
       cancel(id, params = {}, options) {
         const { api_version = this._client.apiVersion } = params !== null && params !== void 0 ? params : {};
-        return this._client.post(path22`/${api_version}/interactions/${id}/cancel`, options);
+        return this._client.post(path23`/${api_version}/interactions/${id}/cancel`, options);
       }
       get(id, params = {}, options) {
         var _a21;
         const _b10 = params !== null && params !== void 0 ? params : {}, { api_version = this._client.apiVersion } = _b10, query = __rest(_b10, ["api_version"]);
-        return this._client.get(path22`/${api_version}/interactions/${id}`, Object.assign(Object.assign({ query }, options), { stream: (_a21 = params === null || params === void 0 ? void 0 : params.stream) !== null && _a21 !== void 0 ? _a21 : false }));
+        return this._client.get(path23`/${api_version}/interactions/${id}`, Object.assign(Object.assign({ query }, options), { stream: (_a21 = params === null || params === void 0 ? void 0 : params.stream) !== null && _a21 !== void 0 ? _a21 : false }));
       }
     };
     BaseInteractions._key = Object.freeze(["interactions"]);
@@ -155707,49 +155965,49 @@ ${underline}`);
        */
       create(params, options) {
         const { api_version = this._client.apiVersion } = params, body = __rest(params, ["api_version"]);
-        return this._client.post(path22`/${api_version}/webhooks`, Object.assign({ body }, options));
+        return this._client.post(path23`/${api_version}/webhooks`, Object.assign({ body }, options));
       }
       /**
        * Updates an existing Webhook.
        */
       update(id, params = {}, options) {
         const _a21 = params !== null && params !== void 0 ? params : {}, { api_version = this._client.apiVersion, update_mask } = _a21, body = __rest(_a21, ["api_version", "update_mask"]);
-        return this._client.patch(path22`/${api_version}/webhooks/${id}`, Object.assign({ query: { update_mask }, body }, options));
+        return this._client.patch(path23`/${api_version}/webhooks/${id}`, Object.assign({ query: { update_mask }, body }, options));
       }
       /**
        * Lists all Webhooks.
        */
       list(params = {}, options) {
         const _a21 = params !== null && params !== void 0 ? params : {}, { api_version = this._client.apiVersion } = _a21, query = __rest(_a21, ["api_version"]);
-        return this._client.get(path22`/${api_version}/webhooks`, Object.assign({ query }, options));
+        return this._client.get(path23`/${api_version}/webhooks`, Object.assign({ query }, options));
       }
       /**
        * Deletes a Webhook.
        */
       delete(id, params = {}, options) {
         const { api_version = this._client.apiVersion } = params !== null && params !== void 0 ? params : {};
-        return this._client.delete(path22`/${api_version}/webhooks/${id}`, options);
+        return this._client.delete(path23`/${api_version}/webhooks/${id}`, options);
       }
       /**
        * Gets a specific Webhook.
        */
       get(id, params = {}, options) {
         const { api_version = this._client.apiVersion } = params !== null && params !== void 0 ? params : {};
-        return this._client.get(path22`/${api_version}/webhooks/${id}`, options);
+        return this._client.get(path23`/${api_version}/webhooks/${id}`, options);
       }
       /**
        * Sends a ping event to a Webhook.
        */
       ping(id, params = void 0, options) {
         const { api_version = this._client.apiVersion, body } = params !== null && params !== void 0 ? params : {};
-        return this._client.post(path22`/${api_version}/webhooks/${id}:ping`, Object.assign({ body }, options));
+        return this._client.post(path23`/${api_version}/webhooks/${id}:ping`, Object.assign({ body }, options));
       }
       /**
        * Generates a new signing secret for a Webhook.
        */
       rotateSigningSecret(id, params = {}, options) {
         const _a21 = params !== null && params !== void 0 ? params : {}, { api_version = this._client.apiVersion } = _a21, body = __rest(_a21, ["api_version"]);
-        return this._client.post(path22`/${api_version}/webhooks/${id}:rotateSigningSecret`, Object.assign({ body }, options));
+        return this._client.post(path23`/${api_version}/webhooks/${id}:rotateSigningSecret`, Object.assign({ body }, options));
       }
     };
     BaseWebhooks._key = Object.freeze(["webhooks"]);
@@ -235376,7 +235634,7 @@ var init_notification = __esm({
 
 // node_modules/.pnpm/@google-cloud+storage@7.21.0_encoding@0.1.13/node_modules/@google-cloud/storage/build/esm/src/bucket.js
 import * as fs26 from "fs";
-import * as path23 from "path";
+import * as path24 from "path";
 import { promisify as promisify9 } from "util";
 import { Readable as Readable3 } from "stream";
 import { URL as URL4 } from "url";
@@ -238448,7 +238706,7 @@ var init_bucket = __esm({
             preconditionOpts: this.instancePreconditionOpts
           });
         } else {
-          const destination = path23.basename(pathString);
+          const destination = path24.basename(pathString);
           newFile = this.file(destination, {
             encryptionKey: options.encryptionKey,
             kmsKeyName: options.kmsKeyName,
@@ -246845,29 +247103,29 @@ var require_src17 = __commonJS({
 // node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/utils/file_utils.js
 import { createRequire as topLevelCreateRequire85 } from "module";
 import * as fs27 from "node:fs/promises";
-import * as path24 from "node:path";
+import * as path25 from "node:path";
 async function materializeFiles(files, dir = process.cwd()) {
-  const resolvedBaseDir = path24.resolve(dir);
+  const resolvedBaseDir = path25.resolve(dir);
   const createdFiles = [];
   for (const file3 of files) {
-    const fullPath = path24.resolve(dir, file3.name);
+    const fullPath = path25.resolve(dir, file3.name);
     if (!fullPath.startsWith(resolvedBaseDir)) {
       throw new Error(
         `Path traversal detected: ${file3.name} resolves outside of ${dir}`
       );
     }
-    const ext = path24.extname(fullPath);
-    const dirName = path24.dirname(fullPath);
-    const base = path24.basename(fullPath, ext);
+    const ext = path25.extname(fullPath);
+    const dirName = path25.dirname(fullPath);
+    const base = path25.basename(fullPath, ext);
     let finalPath = fullPath;
     let counter = 2;
     while (true) {
       try {
         await fs27.access(finalPath);
         const newName = `${base}_${counter}${ext}`;
-        finalPath = path24.join(dirName, newName);
-        const originalDir = path24.dirname(file3.name);
-        file3.name = originalDir === "." ? newName : path24.join(originalDir, newName);
+        finalPath = path25.join(dirName, newName);
+        const originalDir = path25.dirname(file3.name);
+        file3.name = originalDir === "." ? newName : path25.join(originalDir, newName);
         counter++;
       } catch {
         break;
@@ -246878,14 +247136,14 @@ async function materializeFiles(files, dir = process.cwd()) {
         `Path traversal detected: ${file3.name} resolves outside of ${dir}`
       );
     }
-    await fs27.mkdir(path24.dirname(finalPath), { recursive: true });
+    await fs27.mkdir(path25.dirname(finalPath), { recursive: true });
     await fs27.writeFile(
       finalPath,
       Buffer.from(file3.content, file3.contentEncoding)
     );
     createdFiles.push({
       ...file3,
-      name: path24.relative(dir, finalPath)
+      name: path25.relative(dir, finalPath)
     });
   }
   return createdFiles;
@@ -254284,7 +254542,7 @@ var init_list_skills_tool = __esm({
 
 // node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/tools/skill/load_skill_resource_tool.js
 import { createRequire as topLevelCreateRequire128 } from "module";
-import path25 from "node:path";
+import path26 from "node:path";
 var require129, __defProp8, __getOwnPropDesc8, __decorateClass7, BINARY_FILE_DETECTED_MSG, LoadSkillResourceTool;
 var init_load_skill_resource_tool = __esm({
   "node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/tools/skill/load_skill_resource_tool.js"() {
@@ -254353,7 +254611,7 @@ var init_load_skill_resource_tool = __esm({
             error_code: "MISSING_RESOURCE_PATH"
           };
         }
-        resourcePath = path25.posix.normalize(resourcePath);
+        resourcePath = path26.posix.normalize(resourcePath);
         let skill;
         try {
           skill = await this.toolset.getOrFetchSkill(
@@ -254772,7 +255030,7 @@ var init_run_skill_inline_script_tool = __esm({
 
 // node_modules/.pnpm/@google+adk@1.3.0_@bufbuild+protobuf@2.12.1_@cfworker+json-schema@4.1.1_@grpc+grpc-js@1.14.4__5mkmwgy3xddtjib6vsxkdydt4e/node_modules/@google/adk/dist/esm/tools/skill/run_skill_script_tool.js
 import { createRequire as topLevelCreateRequire132 } from "module";
-import * as path26 from "node:path";
+import * as path27 from "node:path";
 function buildWrapperCode(scriptPath, language) {
   switch (language) {
     case CodeExecutionLanguage.JAVASCRIPT:
@@ -254812,7 +255070,7 @@ function getSkillResourceFiles(skill) {
       if (fileContent === void 0) {
         continue;
       }
-      const ext = path26.extname(resourceName2).toLowerCase();
+      const ext = path27.extname(resourceName2).toLowerCase();
       const { encoding, mimeType } = getMimeTypeAndEncoding(ext);
       files.push({
         name: `${resourceType}/${resourceName2}`,
@@ -254942,7 +255200,7 @@ var init_run_skill_script_tool = __esm({
           };
         }
         try {
-          const language = getScriptLanguageByExtension(path26.extname(scriptPath));
+          const language = getScriptLanguageByExtension(path27.extname(scriptPath));
           const result = await codeExecutor.executeCode({
             invocationContext: toolContext.invocationContext,
             codeExecutionInput: {
@@ -354418,11 +354676,11 @@ function unlinkSync2(filePath) {
 function readFileSync14(filePath) {
   return nodeFs.readFileSync(filePath, "utf-8");
 }
-var path27;
+var path28;
 var init_fs = __esm({
   "node_modules/.pnpm/langsmith@0.5.14_@opentelemetry+api@1.9.1_@opentelemetry+exporter-trace-otlp-proto@0.221.0_@o_totymzifgyhkpjllfvyp65mp54/node_modules/langsmith/dist/utils/fs.js"() {
     "use strict";
-    path27 = nodePath;
+    path28 = nodePath;
   }
 });
 
@@ -354594,7 +354852,7 @@ var init_prompt_cache = __esm({
         for (const [key, entry] of this.cache.entries()) {
           entries[key] = entry.value;
         }
-        const dir = path27.dirname(filePath);
+        const dir = path28.dirname(filePath);
         if (!existsSync16(dir)) {
           mkdirSync8(dir);
         }
@@ -359347,7 +359605,7 @@ var init_client4 = __esm({
             body_base64: bodyBuffer.toString("base64")
           });
           const filename = `trace_${Date.now()}_${v4_default2().slice(0, 8)}.json`;
-          const filepath = path27.join(directory, filename);
+          const filepath = path28.join(directory, filename);
           if (!_Client._fallbackDirsCreated.has(directory)) {
             await mkdir3(directory);
             _Client._fallbackDirsCreated.add(directory);
@@ -359358,7 +359616,7 @@ var init_client4 = __esm({
               const traceFiles = entries.filter((f4) => f4.startsWith("trace_") && f4.endsWith(".json"));
               let total = 0;
               for (const name of traceFiles) {
-                const { size } = await stat4(path27.join(directory, name));
+                const { size } = await stat4(path28.join(directory, name));
                 total += size;
               }
               if (total >= maxBytes) {
@@ -374507,7 +374765,14 @@ var init_telemetry2 = __esm({
 });
 
 // apps/cli/src/services/round-trip-checks.ts
-function runRoundTripCheck(agentId, probe) {
+function runRoundTripCheck(agentId, probe, runtimeUrlSource) {
+  const check4 = decideRoundTrip(agentId, probe);
+  if (runtimeUrlSource !== "default" || probe.kind === "unreachable") {
+    return check4;
+  }
+  return { ...check4, detail: `${check4.detail} ${ASSUMED_RUNTIME_URL_CAVEAT}` };
+}
+function decideRoundTrip(agentId, probe) {
   if (probe.kind === "answered") {
     const toolNote = probe.toolCallNames.length > 0 ? ` It called ${probe.toolCallNames.join(", ")}.` : "";
     return {
@@ -374558,6 +374823,7 @@ var TITLE;
 var init_round_trip_checks = __esm({
   "apps/cli/src/services/round-trip-checks.ts"() {
     "use strict";
+    init_runtime_url();
     TITLE = "The agent answers a real request";
   }
 });
@@ -374860,7 +375126,64 @@ async function probeCredential(appApiUrl, apiKey, fetchImpl = fetch) {
     ...plan === void 0 ? {} : { planLabel: plan.label }
   };
 }
-var runtimeInfoSchema, metadataSchema;
+function firstSameOriginAsset(html, pageUrl) {
+  const pageOrigin = new URL(pageUrl).origin;
+  for (const pattern of ASSET_PATTERNS) {
+    const reference = pattern.exec(html)?.[1];
+    if (reference === void 0) {
+      continue;
+    }
+    let resolved;
+    try {
+      resolved = new URL(reference, pageUrl);
+    } catch {
+      continue;
+    }
+    if (resolved.origin === pageOrigin) {
+      return resolved.toString();
+    }
+  }
+  return void 0;
+}
+async function probeFrontendAssets(frontendUrl, fetchImpl = fetch) {
+  const pageUrl = new URL("/", frontendUrl).toString();
+  let page;
+  try {
+    page = await fetchImpl(pageUrl, {
+      headers: { accept: "text/html" },
+      method: "GET"
+    });
+  } catch (error98) {
+    return { kind: "unreachable", message: messageOf(error98), url: pageUrl };
+  }
+  if (!page.ok) {
+    return { kind: "page-not-served", status: page.status };
+  }
+  let html;
+  try {
+    html = await page.text();
+  } catch (error98) {
+    return { kind: "unreachable", message: messageOf(error98), url: pageUrl };
+  }
+  const assetUrl = firstSameOriginAsset(html, pageUrl);
+  if (assetUrl === void 0) {
+    return { kind: "no-asset" };
+  }
+  let asset;
+  try {
+    asset = await fetchImpl(assetUrl, { headers: { referer: pageUrl }, method: "GET" });
+  } catch (error98) {
+    return { kind: "unreachable", message: messageOf(error98), url: assetUrl };
+  }
+  if (asset.status === 401 || asset.status === 403) {
+    return { assetUrl, kind: "assets-refused", status: asset.status };
+  }
+  if (!asset.ok) {
+    return { assetUrl, kind: "asset-inconclusive", status: asset.status };
+  }
+  return { assetUrl, kind: "assets-served" };
+}
+var runtimeInfoSchema, metadataSchema, ASSET_PATTERNS;
 var init_verify_probes = __esm({
   "apps/cli/src/services/verify-probes.ts"() {
     "use strict";
@@ -374890,6 +375213,10 @@ var init_verify_probes = __esm({
       license: external_exports.object({ state: external_exports.string() }).optional(),
       plan: external_exports.object({ label: external_exports.string() }).optional()
     });
+    ASSET_PATTERNS = [
+      /<script\b[^>]*\bsrc\s*=\s*["']([^"']+)["']/iu,
+      /<link\b[^>]*\bhref\s*=\s*["']([^"']+)["']/iu
+    ];
   }
 });
 
@@ -374906,7 +375233,17 @@ function describeRuntimeUrlSource(context3) {
     case "discovered":
       return `(read from this project${origin})`;
     case "default":
-      return "(assumed \u2014 nothing in this project named a port; pass --runtime-url to change it)";
+      return "(assumed \u2014 nothing in this project named a port, so which project answered is unverified. Pass --runtime-url to change it.)";
+  }
+}
+function describeFrontendUrlSource(resolution) {
+  switch (resolution.source) {
+    case "flag":
+      return "(from --frontend-url)";
+    case "discovered":
+      return resolution.origin === void 0 ? "(read from this project)" : `(read from this project, from ${resolution.origin})`;
+    case "unknown":
+      return "(not resolved)";
   }
 }
 function factRows(facts) {
@@ -374961,7 +375298,14 @@ function renderSummary(result, roundTrip) {
 }
 function renderVerifyReport(result, context3, roundTrip) {
   const urlNote = `Runtime URL: ${context3.runtimeUrl} ${describeRuntimeUrlSource(context3)}`;
-  const lines = ["CopilotKit wiring check", "", urlNote, ""];
+  const frontendNote = context3.frontendUrl.url === void 0 ? "Frontend URL: not resolved (nothing in this project named the port its frontend serves; pass --frontend-url)" : `Frontend URL: ${context3.frontendUrl.url} ${describeFrontendUrlSource(context3.frontendUrl)}`;
+  const lines = [
+    "CopilotKit wiring check",
+    "",
+    urlNote,
+    frontendNote,
+    ""
+  ];
   for (const check4 of result.checks) {
     lines.push(`  ${STATUS_LABELS[check4.status].padEnd(7)} ${check4.title}`);
     lines.push(`          ${check4.detail}`);
@@ -374993,6 +375337,11 @@ function renderVerifyJson(result, context3, roundTrip) {
       // would let the strongest evidence in the report contradict its summary.
       ok: result.ok && (roundTrip === void 0 || roundTrip.status === "pass"),
       ...roundTrip === void 0 ? {} : { roundTrip },
+      // The origin a caller opens, so it never composes one. Absent rather than
+      // guessed when the project named no port (OSS-1126).
+      ...context3.frontendUrl.url === void 0 ? {} : { frontendUrl: context3.frontendUrl.url },
+      ...context3.frontendUrl.origin === void 0 ? {} : { frontendUrlOrigin: context3.frontendUrl.origin },
+      frontendUrlSource: context3.frontendUrl.source,
       runtimeUrl: context3.runtimeUrl,
       ...context3.runtimeUrlOrigin === void 0 ? {} : { runtimeUrlOrigin: context3.runtimeUrlOrigin },
       runtimeUrlSource: context3.runtimeUrlSource
@@ -375014,125 +375363,6 @@ var init_verify_report = __esm({
   }
 });
 
-// apps/cli/src/services/runtime-url.ts
-import * as path28 from "node:path";
-function portInCommand(command2) {
-  for (const pattern of PORT_PATTERNS) {
-    const match = pattern.exec(command2);
-    if (match?.[1] !== void 0) {
-      const port = Number.parseInt(match[1], 10);
-      if (port > 0 && port < 65536) {
-        return port;
-      }
-    }
-  }
-  return void 0;
-}
-function portForApp(appDir, projectEnvValues) {
-  const appEnv = resolveProjectEnv(appDir, appDir);
-  const values = { ...projectEnvValues, ...appEnv.values };
-  const declared = values["PORT"];
-  if (declared !== void 0 && /^\d{2,5}$/.test(declared.trim())) {
-    const port2 = Number.parseInt(declared.trim(), 10);
-    if (port2 > 0 && port2 < 65536) {
-      return {
-        origin: `PORT in ${appEnv.origins["PORT"] ?? "the project environment"}`,
-        port: port2
-      };
-    }
-  }
-  const scripts = readAppManifest(appDir)?.scripts ?? {};
-  const dev = scripts["dev"];
-  if (dev === void 0) {
-    return void 0;
-  }
-  const considered = /* @__PURE__ */ new Map([["dev", dev]]);
-  const queue2 = [dev];
-  while (queue2.length > 0) {
-    const body = queue2.shift();
-    for (const match of body.matchAll(DELEGATION_PATTERN)) {
-      const name = match[1];
-      const delegate = name === void 0 ? void 0 : scripts[name];
-      if (name !== void 0 && delegate !== void 0 && !considered.has(name)) {
-        considered.set(name, delegate);
-        queue2.push(delegate);
-      }
-    }
-  }
-  const ports = /* @__PURE__ */ new Map();
-  for (const [name, body] of considered) {
-    if (!WEB_DEV_COMMANDS.test(body)) {
-      continue;
-    }
-    const port2 = portInCommand(body);
-    if (port2 !== void 0 && !ports.has(port2)) {
-      ports.set(port2, `the "${name}" script in ${path28.join(appDir, "package.json")}`);
-    }
-  }
-  if (ports.size !== 1) {
-    return void 0;
-  }
-  const [[port, origin]] = [...ports];
-  return { origin, port };
-}
-function resolveRuntimeUrl(inputs) {
-  if (inputs.flagUrl !== void 0) {
-    return { source: "flag", url: inputs.flagUrl };
-  }
-  const pinned = inputs.pinnedUrl?.trim();
-  if (pinned !== void 0 && pinned !== "" && URL.canParse(pinned)) {
-    return {
-      origin: "runtimeUrl in .copilotkit/project.json",
-      source: "project-file",
-      url: pinned
-    };
-  }
-  const declared = inputs.projectEnvValues[RUNTIME_URL_VARIABLE]?.trim();
-  if (declared !== void 0 && declared !== "" && URL.canParse(declared)) {
-    return {
-      origin: `${RUNTIME_URL_VARIABLE} in the project environment`,
-      source: "env",
-      url: declared
-    };
-  }
-  const { apps: apps2 } = resolveAppDirectories(inputs.cwd, inputs.ceiling);
-  if (apps2.length > 1) {
-    return {
-      ambiguousApps: apps2,
-      source: "default",
-      url: DEFAULT_RUNTIME_URL
-    };
-  }
-  const appDir = apps2[0];
-  const discovered = appDir === void 0 ? void 0 : portForApp(appDir, inputs.projectEnvValues);
-  if (discovered === void 0) {
-    return { source: "default", url: DEFAULT_RUNTIME_URL };
-  }
-  return {
-    origin: discovered.origin,
-    source: "discovered",
-    url: `http://localhost:${String(discovered.port)}${DEFAULT_RUNTIME_PATH}`
-  };
-}
-var DEFAULT_RUNTIME_URL, DEFAULT_RUNTIME_PATH, RUNTIME_URL_VARIABLE, WEB_DEV_COMMANDS, PORT_PATTERNS, DELEGATION_PATTERN;
-var init_runtime_url = __esm({
-  "apps/cli/src/services/runtime-url.ts"() {
-    "use strict";
-    init_app_directory();
-    init_project_env();
-    DEFAULT_RUNTIME_URL = "http://localhost:3000/api/copilotkit";
-    DEFAULT_RUNTIME_PATH = "/api/copilotkit";
-    RUNTIME_URL_VARIABLE = "COPILOTKIT_RUNTIME_URL";
-    WEB_DEV_COMMANDS = /\b(next|vite|ng serve|react-scripts|nuxt|remix|astro|rsbuild|webpack serve|parcel)\b/;
-    PORT_PATTERNS = [
-      /(?:^|\s)--port[= ](\d{2,5})\b/,
-      /(?:^|\s)-p[= ](\d{2,5})\b/,
-      /(?:^|\s|^)PORT=(\d{2,5})\b/
-    ];
-    DELEGATION_PATTERN = /\b(?:npm run|pnpm run|pnpm|yarn run|yarn|bun run)\s+([\w:.-]+)/g;
-  }
-});
-
 // apps/cli/src/commands/verify.ts
 var verify_exports = {};
 __export(verify_exports, {
@@ -375169,10 +375399,21 @@ async function runVerify(options, overrides = {}) {
     ...projectConfig.kind === "found" && projectConfig.config.runtimeUrl !== void 0 ? { pinnedUrl: projectConfig.config.runtimeUrl } : {}
   });
   const runtimeUrl = runtimeUrlResolution.url;
+  const frontendUrlResolution = resolveFrontendUrl({
+    ceiling,
+    cwd: deps.cwd,
+    projectEnvValues: projectEnv.values,
+    ...options.frontendUrl === void 0 ? {} : { flagUrl: options.frontendUrl }
+  });
   const appApiUrl = (mergedEnv["INTELLIGENCE_API_URL"] ?? "").trim() || deps.appApiUrl;
-  const [credential, runtime] = await Promise.all([
+  const [credential, runtime, frontendAssets] = await Promise.all([
     probeCredential(appApiUrl, apiKey?.key, deps.fetchImpl),
-    probeRuntimeInfo(runtimeUrl, deps.fetchImpl)
+    probeRuntimeInfo(runtimeUrl, deps.fetchImpl),
+    // Probed only when the caller named the origin it opens. An origin this
+    // command resolved is always `localhost`, and a frontend dev server is not
+    // a surface `verify` requires to be running, so probing an unasked-for one
+    // would sink the verdict of a correctly wired project (OSS-1126).
+    options.frontendUrl === void 0 || frontendUrlResolution.url === void 0 ? Promise.resolve(void 0) : probeFrontendAssets(frontendUrlResolution.url, deps.fetchImpl)
   ]);
   const apiKeySource = apiKey === void 0 || deps.env[apiKey.variableName] !== void 0 ? void 0 : projectEnv.origins[apiKey.variableName];
   const credentialLoad = resolveCredentialLoad({
@@ -375194,6 +375435,8 @@ async function runVerify(options, overrides = {}) {
         searchedFrom: projectEnv.searchedFrom,
         ...projectEnv.appDirectory === void 0 ? {} : { appDirectory: projectEnv.appDirectory }
       },
+      frontendAssets,
+      frontendUrl: frontendUrlResolution,
       projectConfig,
       runtime,
       runtimeUrl: runtimeUrlResolution
@@ -375202,8 +375445,9 @@ async function runVerify(options, overrides = {}) {
   );
   const roundTrip = expectedRuntime === "oss" && (options.roundTrip !== true || options.agent === void 0) ? notAttempted(
     "Not attempted: --expect-runtime oss requires --round-trip --agent <id> so the named agent must answer before this command can pass."
-  ) : options.roundTrip === true ? await runLiveRoundTrip(options, deps, runtimeUrl, runtime) : void 0;
+  ) : options.roundTrip === true ? await runLiveRoundTrip(options, deps, runtimeUrlResolution, runtime) : void 0;
   const context3 = {
+    frontendUrl: frontendUrlResolution,
     runtimeUrl,
     runtimeUrlSource: runtimeUrlResolution.source,
     ...runtimeUrlResolution.origin === void 0 ? {} : { runtimeUrlOrigin: runtimeUrlResolution.origin }
@@ -375245,12 +375489,12 @@ async function runLiveRoundTrip(options, deps, runtimeUrl, runtime) {
     fetchImpl: deps.fetchImpl,
     newId: deps.newId,
     newThreadId: deps.newThreadId,
-    runtimeUrl,
+    runtimeUrl: runtimeUrl.url,
     sleep: deps.sleep,
     ...options.headers === void 0 ? {} : { headers: options.headers },
     ...options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
   });
-  return runRoundTripCheck(agentId, probe);
+  return runRoundTripCheck(agentId, probe, runtimeUrl.source);
 }
 function notAttempted(detail) {
   return {
@@ -375273,6 +375517,7 @@ var init_verify = __esm({
     init_verify_probes();
     init_verify_report();
     init_runtime_url();
+    init_frontend_url();
     init_runtime_url();
   }
 });
@@ -378131,7 +378376,7 @@ function decodePng(bytes, expectedSize) {
       return { status: "invalid_png" };
     }
     const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-    const decoder = new TextDecoder("ascii");
+    const decoder = new TextDecoder();
     let offset = signature.length;
     let header = null;
     let palette = null;
@@ -382350,6 +382595,19 @@ function writeJsonLine(stdout, value) {
   stdout.write(`${JSON.stringify(value)}
 `);
 }
+function recordAuthStarted(dependencies) {
+  try {
+    dependencies.recordEvent({
+      event: "cli.login.auth_started",
+      properties: {
+        command: "login",
+        already_authenticated: false,
+        ...dependencies.readOnboardingRun()
+      }
+    });
+  } catch {
+  }
+}
 function recordAuthCompleted(dependencies, alreadyAuthenticated) {
   try {
     dependencies.recordEvent({
@@ -382387,6 +382645,7 @@ async function runLoginJson(dependencies = {
     }
     let loginUrlWritten = false;
     await dependencies.login({
+      authHandoff: { source: "cli", mode: "agent_onboarding" },
       openBrowser: false,
       onLoginUrl: (url4) => {
         if (loginUrlWritten) {
@@ -382397,8 +382656,9 @@ async function runLoginJson(dependencies = {
           type: "authentication_url",
           url: url4
         });
+        recordAuthStarted(dependencies);
         writeJsonLine(dependencies.stdout, {
-          action: "Open the URL in a browser and complete sign-in.",
+          action: "Open authentication_url once in the default browser. Keep this process running until it emits a terminal event.",
           type: "action_required"
         });
       }
@@ -383531,7 +383791,10 @@ async function runOnboard(argv, dependencies) {
     );
   }
   if (subcommand === "complete") {
-    const blocked2 = parseBlocker(argv.slice(1));
+    const opened = parseFrontendUrl(argv.slice(1));
+    if (opened === void 0)
+      throw new Error(FRONTEND_URL_USAGE);
+    const blocked2 = parseBlocker(opened.rest);
     if (blocked2 === void 0)
       throw new Error(BLOCKER_USAGE);
     const check4 = parseSurfaceCheck(blocked2.rest);
@@ -383547,6 +383810,11 @@ async function runOnboard(argv, dependencies) {
         accepted_count: accepted.length,
         ...check4.kind === "visual" ? { visual_check: check4.outcome } : { device_check: check4.outcome },
         ...blocked2.blocker === void 0 ? {} : { blocked_by: blocked2.blocker },
+        // The kind of host a browser was pointed at. A run that opened the
+        // loopback IP literal loses every static chunk to a 403 and reads the
+        // dead page as a broken integration, and the recurrence used to be
+        // visible only in a friction report (OSS-1126).
+        ...opened.hostKind === void 0 ? {} : { frontend_host_kind: opened.hostKind },
         ...describeResolvedDependencies(deps.readDependencies())
       }
     });
@@ -383924,6 +384192,21 @@ ${detail}${NOTHING_PROVED}`;
     ""
   ].join("\n");
 }
+function parseFrontendUrl(rest) {
+  const flagIndex = rest.indexOf("--frontend-url");
+  if (flagIndex === -1)
+    return { rest };
+  const value = rest[flagIndex + 1];
+  if (value === void 0)
+    return void 0;
+  const hostKind = classifyFrontendHost(value);
+  if (hostKind === void 0)
+    return void 0;
+  return {
+    hostKind,
+    rest: [...rest.slice(0, flagIndex), ...rest.slice(flagIndex + 2)]
+  };
+}
 function parseBlocker(rest) {
   const flagIndex = rest.indexOf("--blocked-by");
   if (flagIndex === -1)
@@ -384461,7 +384744,7 @@ function recordBestEffort(dependencies, event) {
   } catch {
   }
 }
-var ONBOARD_SUBCOMMANDS, RUN_NOT_BOUND, REBASELINE_USAGE, ACCEPT_USAGE, EXCLUSIVE_MODE_USAGE, NOTHING_PROVED, NOTHING_ACCEPTED, VISUAL_CHECK_OUTCOMES, DEVICE_CHECK_OUTCOMES, BLOCKER_CAUSES, BLOCKER_USAGE, SURFACE_CHECK_USAGE, PROOF_STEPS, PROOF_OUTCOMES, BASELINE_PREDICATE_COUNT, PROOF_USAGE, BLOCKER_REPORTS;
+var ONBOARD_SUBCOMMANDS, RUN_NOT_BOUND, REBASELINE_USAGE, ACCEPT_USAGE, EXCLUSIVE_MODE_USAGE, NOTHING_PROVED, NOTHING_ACCEPTED, VISUAL_CHECK_OUTCOMES, DEVICE_CHECK_OUTCOMES, BLOCKER_CAUSES, BLOCKER_USAGE, SURFACE_CHECK_USAGE, FRONTEND_URL_USAGE, PROOF_STEPS, PROOF_OUTCOMES, BASELINE_PREDICATE_COUNT, PROOF_USAGE, BLOCKER_REPORTS;
 var init_onboard = __esm({
   async "apps/cli/src/commands/onboard.ts"() {
     "use strict";
@@ -384477,6 +384760,7 @@ var init_onboard = __esm({
     init_framework_vocabulary();
     await init_telemetry();
     init_app_directory();
+    init_frontend_url();
     init_repository_root();
     init_resolved_dependencies();
     ONBOARD_SUBCOMMANDS = [
@@ -384520,6 +384804,7 @@ Use \`other\` rather than leaving the flag off. A run with no way to say it was
 blocked reads the unsupported terminal instead, and reports a path that works
 as one this release does not carry.`;
     SURFACE_CHECK_USAGE = "Usage: copilotkit onboard complete --visual-check <performed|skipped-no-browser-tool|failed>\n   or: copilotkit onboard complete --device-check <performed|skipped-no-device|failed>\nPass exactly one. A web journey is proven in a browser and a mobile one on a device;\nwhich flag you pass is how this run states which surface it proved.";
+    FRONTEND_URL_USAGE = "Usage: copilotkit onboard complete <surface-check> --frontend-url <absolute url>\nPass the URL a browser actually opened, for example http://localhost:3000.\nOnly the kind of host is recorded -- loopback hostname, loopback IP literal,\nother IP literal, other name -- never the host itself.";
     PROOF_STEPS = ["oss-baseline", "round-trip"];
     PROOF_OUTCOMES = ["passed", "failed", "skipped"];
     BASELINE_PREDICATE_COUNT = 6;
@@ -387843,7 +388128,7 @@ refused before anything is sent, and the reason is printed. Both commands print
 what they sent. Every refusal exits zero and leaves onboarding unaffected.
 `,
   verify: `Usage: copilotkit verify [--json] [--runtime-url <url>] [--round-trip]
-                         [--expect-runtime <mode>]
+                         [--expect-runtime <mode>] [--frontend-url <url>]
 
 Check that this project's CopilotKit wiring works, and report what it found.
 
@@ -387876,6 +388161,10 @@ Options:
                          .copilotkit/project.json, COPILOTKIT_RUNTIME_URL, or
                          the port the app's dev configuration declares \u2014
                          falling back to http://localhost:3000/api/copilotkit
+  --frontend-url <url>   The origin a browser opens. Without it, the origin is
+                         read from the port the app's dev configuration
+                         declares, always as localhost. Pass the URL you
+                         actually opened to have its static assets checked
   --expect-runtime <mode> Require intelligence (default) or oss runtime mode
   --round-trip           Also run the agent and read its answer back
   --agent <id>           Which declared agent to run, when there are several
@@ -389072,6 +389361,7 @@ async function runVerifyCommand(argv) {
     options: {
       agent: { type: "string" },
       "expect-runtime": { type: "string" },
+      "frontend-url": { type: "string" },
       header: { multiple: true, type: "string" },
       json: { type: "boolean" },
       "round-trip": { type: "boolean" },
@@ -389091,6 +389381,15 @@ async function runVerifyCommand(argv) {
       await exitWithFlush(1);
     }
   }
+  const frontendUrl = parsed.values["frontend-url"];
+  const { isFrontendUrl: isFrontendUrl2 } = await Promise.resolve().then(() => (init_frontend_url(), frontend_url_exports));
+  if (frontendUrl !== void 0 && !isFrontendUrl2(frontendUrl)) {
+    process.stderr.write(
+      `Error: --frontend-url must be an absolute http or https URL with a host (received "${frontendUrl}").
+`
+    );
+    await exitWithFlush(1);
+  }
   const timeoutSeconds = parsed.values["timeout"];
   if (timeoutSeconds !== void 0 && !/^\d+$/.test(timeoutSeconds)) {
     process.stderr.write(
@@ -389121,6 +389420,7 @@ async function runVerifyCommand(argv) {
     ...agent === void 0 ? {} : { agent },
     ...expectedRuntime === void 0 ? {} : { expectRuntime: expectedRuntime },
     ...headers === void 0 || Object.keys(headers).length === 0 ? {} : { headers },
+    ...frontendUrl === void 0 ? {} : { frontendUrl },
     ...parsed.values["round-trip"] === true ? { roundTrip: true } : {},
     ...runtimeUrl === void 0 ? {} : { runtimeUrl },
     ...timeoutSeconds === void 0 ? {} : { timeoutMs: Number(timeoutSeconds) * 1e3 }