copilotkit 4.9.37 → 4.9.50

package/README.md

@@ -175,9 +175,56 @@ For a coding agent that needs an agent-readable sign-in flow, use:
 copilotkit login --json
 ```
 
-The command prints JSON lines for the sign-in URL, the action to take, and the
-final result. It does not open a browser. A failed sign-in prints one final
-failure object and exits nonzero.
+The command prints JSON lines for the sign-in URL, an instruction for the
+machine reader, and the final result. It does not open a browser. Every JSON
+login URL carries the `agent_onboarding` display hint because JSON mode is the
+machine-readable login contract. A machine reader should open the first
+`authentication_url` once with the operating system's default browser, then
+keep reading the same process until its terminal event. If the opener fails,
+show the URL for manual sign-in instead of retrying it. A failed sign-in prints
+one final failure object and exits nonzero.
+
+The bundled onboarding prompt gives one short explanation before it opens the
+page: sign-in lets the coding agent create a project and API key, and the user
+can remove the key later to disconnect the workspace.
+
+## Feature onboarding for existing apps
+
+Use the optional `--intent` flag when an existing CopilotKit app needs one
+specific feature. The CLI prints a feature-specific Markdown path; the coding
+agent follows its inspection, plan, implementation, and visible-proof steps.
+Without `--intent`, `onboard start` keeps the generic onboarding path unchanged.
+
+```bash
+npx --yes copilotkit@latest onboard start \
+  --intent add-a2ui \
+  --run <12-character-id> \
+  --coding-agent <slug>
+```
+
+`--intent` is a closed outcome, not free-form text. The supported values are:
+
+| Intent                   | Outcome                                                     |
+| ------------------------ | ----------------------------------------------------------- |
+| `add-rich-threads`       | Managed Rich Threads with durable thread UI/API proof       |
+| `add-learning`           | Assign real runs to a selected Learning Container           |
+| `add-a2ui`               | Render an A2UI surface in an existing OSS app               |
+| `add-open-generative-ui` | Render a sandboxed generated UI in chat                     |
+| `add-chat-suggestions`   | Configure and send visible chat suggestions                 |
+| `add-voice`              | Add documented voice transcription to the existing composer |
+| `add-realtime-sync`      | Prove managed thread changes sync between active clients    |
+
+The intent describes the developer's requested outcome, not a claim about the
+current project state. Each path inspects the app first: it preserves a proven
+existing configuration, stops rather than inventing credentials or identities,
+and sends an app that lacks a CopilotKit baseline to generic onboarding first.
+The CLI retains the selected intent with its repository-bound run, so every
+onboarding event a later step reports carries the requested outcome.
+
+Each path checks in at the steps where a run goes quiet: when the inspection
+subagent returns, when the plan is approved, when implementation validation
+passes, and on each proof attempt and repair cycle. A run that cannot go on
+reads `feature/stop`, reports from there, and does not run `onboard complete`.
 
 The onboarding commands are:
 
@@ -347,6 +394,92 @@ prompts, and never opens a browser. See
 [Managed Channel CLI contracts](../../docs/channels-cli-contracts.md) for the
 declared-Channels file, the envelope shape, and the credential resolution order.
 
+## Learning Containers
+
+Run the Learning commands from a directory with a selected hosted project:
+
+```bash
+copilotkit learning containers list
+copilotkit learning containers get support-quality
+copilotkit learning containers create
+copilotkit learning containers update support-quality
+copilotkit learning containers delete support-quality
+```
+
+The create and update commands prompt for missing fields in a human terminal.
+The delete command shows the exact container and asks for approval. The CLI
+cannot delete a container with bound Threads or Learning history.
+
+Pass flags for a script or coding agent:
+
+```bash
+copilotkit learning containers list --json
+copilotkit learning containers create --id support-quality --name "Support quality" --json
+copilotkit learning containers update support-quality --prompt-context "Use approved answers." --json
+copilotkit learning containers update support-quality --clear-prompt-context --json
+copilotkit learning containers delete support-quality --yes --json
+```
+
+`--json` emits one versioned JSON object on stdout and never prompts. Create
+requires `--id` and `--name`. Update requires at least one change flag. Delete
+requires `--yes`. Errors use the same JSON envelope and exit with a nonzero
+status.
+
+A container keeps its stable ID. The list command returns at most 500 containers.
+If `nextCursor` is not null, pass it to `--cursor` to read the next page.
+
+Writes are rate limited per organization, project, and caller: 10 creates, 30
+updates, and 30 deletes each minute. Updates and deletes are counted separately,
+so a cleanup loop does not spend its delete budget on the renames before it.
+Each API replica counts on its own, so these are the lowest limits a script can
+rely on. A call over the limit returns `RATE_LIMIT_EXCEEDED`. Wait one minute,
+then retry.
+
+## Learning Insights and Skill review
+
+Use the same selected project to inspect Learning output:
+
+```bash
+copilotkit learning insights list support-quality
+copilotkit learning candidates list support-quality
+copilotkit learning candidates review support-quality <candidate-id>
+copilotkit learning candidates approve support-quality <candidate-id>
+copilotkit learning candidates reject support-quality <candidate-id>
+copilotkit learning skills list support-quality
+copilotkit learning skills list support-quality --full
+```
+
+The `review` command is an alias of `candidates get`. Both commands show the
+candidate reason, supporting Insights, and all proposed Skill files.
+
+Approval and rejection show the full candidate before they ask for approval.
+Approval publishes the proposed add, update, or removal. Rejection does not
+change the published Skill Registry.
+
+Agents and scripts must add `--json`. Add `--yes` to `approve` and `reject`.
+Use `learning skills list --full` to include `SKILL.md` in human output. JSON
+list output contains the full records, always includes `skillMd`, and sets
+`resultLimit` to `500`. Insight, candidate, and Skill lists return at most 500
+items and do not support a cursor.
+
+Malformed Insight, candidate, or Skill command input returns
+`LEARNING_INPUT_INVALID`. Malformed Container command input returns
+`LEARNING_CONTAINER_INPUT_INVALID`. Reviewing a candidate that is already
+approved or rejected returns `LEARNING_CANDIDATE_SETTLED` before any request is
+sent. `LEARNING_CANDIDATE_CONFLICT` is different: the server refused because the
+candidate changed during the review, so read it again and retry.
+
+The CLI sends command telemetry such as `insights.list` and
+`candidates.approve`. Human reviews also send bounded review-viewed and
+review-decided events. The CLI does not send Container IDs, candidate IDs,
+Insight text, or Skill content in these events.
+
+Three properties describe a review. `review_mode` is `human` when the CLI showed
+the proposal and waited for an answer, and `agent` when `--yes` skipped that
+prompt. `review_action` is the command the caller ran, `approve` or `reject`.
+`review_decision` is the answer a person gave at the prompt, `confirmed` or
+`canceled`, and it is sent only in `human` mode.
+
 ## Skills And Agent-Assisted Onboarding
 
 Use `copilotkit create` to start a **new** project. Use `copilotkit skills onboard`
@@ -470,7 +603,7 @@ A real key exported in your shell environment satisfies the check too. An
 exported empty or whitespace value falls back to the `.env` value, while an
 exported placeholder-shaped value fails the gate outright.
 
-The Microsoft Agent Framework .NET template uses GitHub Models. Set its C# agent token with `dotnet user-secrets set GitHubToken "<your-token>"` from the generated `agent/` directory.
+The Microsoft Agent Framework .NET template uses OpenAI by default. Set its API key with `dotnet user-secrets set OPENAI_API_KEY "<your-openai-api-key>"` from the generated `agent/` directory.
 
 Do not commit generated `.env` files or personal secrets.
 
@@ -550,6 +683,7 @@ anything else:
 copilotkit verify
 copilotkit verify --json                                    # machine-readable output
 copilotkit verify --runtime-url http://localhost:8080/copilotkit
+copilotkit verify --frontend-url http://127.0.0.1:3000      # that host's assets and CORS
 copilotkit verify --round-trip                              # also run the agent
 copilotkit verify --expect-runtime oss --round-trip --agent incident_triage
 ```
@@ -558,9 +692,15 @@ It checks that a hosted project is selected, that a project API key is present,
 that the app's own process can load that key, that the key authenticates
 against Intelligence, that the CopilotKit runtime responds, that the runtime
 declares at least one agent, that the runtime is actually using the credential,
-and that it serves the thread routes the license pays for. It also reports the
-runtime version, the agent framework in use, the realtime gateway wiring, the
-plan, and the license state.
+and that it serves the thread routes the license pays for. It also checks that
+the runtime accepts the origin a browser opens -- same-origin projects are
+decided from the two URLs, and a cross-origin runtime is asked with a real
+preflight when `--frontend-url` names the origin -- and that the CopilotKit
+packages installed here are on the same version the runtime reports. The
+version check is skipped when the runtime being probed is not on this
+machine, because a deployed runtime and this checkout are two installations. It also reports the runtime
+version, the agent framework in use, whether transcription is wired, the
+realtime gateway wiring, the plan, and the license state.
 
 The selected project is read from the nearest `.copilotkit/project.json` at or
 above the current directory, stopping at the repository root, so running from
@@ -632,11 +772,49 @@ with the two ways to tell the command where to look — a working application on
 another port is not a wiring failure, and reporting it as one is how a developer
 ends up undoing correct work.
 
+An answer at the assumed default is read the same way. The runtime check passes,
+because a runtime did reply, but the line says which project answered is
+unverified. So do the declared agent names and `--round-trip`. Another checkout
+serving that port answers exactly the same, and the runtime version, the agent
+names, and the round trip are all read off whatever replied. Pass
+`--runtime-url`, or record `"runtimeUrl"`, to make the report name your project.
+
 The mount path is not discovered: every first-party starter serves the runtime
 at `/api/copilotkit`, and reading a framework's routing conventions to find out
 otherwise is the kind of check that drifts and starts reporting confident
 nonsense. Where yours is elsewhere, use option 1 or 2.
 
+### Which frontend URL you should open
+
+`verify` also reports `frontendUrl`: the origin to open in a browser, resolved
+from the same web dev server port as option 4 above and always written with
+`localhost`. It is reported so a caller has a URL handed to it rather than one it
+builds from a dev server's startup banner. `--frontend-url` overrides it, and the
+field is absent — never guessed — when the project named no port.
+
+It is a separate field from `runtimeUrl` and is not derived from it. The two are
+the same origin only when one dev server serves the page and mounts the runtime
+on it. A project whose runtime runs as a process of its own puts that runtime on
+port 8200, where no page is served.
+
+Pass `--frontend-url <the url you opened>` to add one more check,
+`frontend_assets_served`. It asks that origin for its page and then for one of
+the page's own scripts or stylesheets, read off the returned HTML, and compares
+the two answers:
+
+- Both served: `PASS`. That host is one the dev server serves assets on.
+- Page served, asset refused with `401` or `403`: `FAIL`. The dev server refuses
+  its own static assets on that host. A page that renders without its own chunks
+  leaves the CopilotKit control dead, which reads as a broken integration rather
+  than as the host name you used. On an IP literal the check names the
+  `localhost` URL to open instead.
+- Anything else: `UNKNOWN`, including a dev server that is not running.
+
+Without the flag the check is absent rather than `UNKNOWN`. A frontend dev
+server is not a surface `verify` requires to be running, so reporting "could not
+prove it" would sink the verdict of a correctly wired project whose browser is
+closed.
+
 A runtime mounted `mode: "single-route"` refuses `GET /info`, so `verify` asks
 the same question again through the POST envelope that mount does answer.
 Reaching it that way counts as reachable, and the report says which shape

package/cli-build-info.json

@@ -2,20 +2,20 @@
   "schemaVersion": 1,
   "package": {
     "name": "copilotkit",
-    "version": "4.9.37"
+    "version": "4.9.50"
   },
   "intelligence": {
-    "commit": "760576e30fb6301f29f82a14f5d02d40bdf9e22a"
+    "commit": "1e703c3c476af7d0a52f801e34fbce2997f6a926"
   },
   "copilotKit": {
-    "submittedInput": "aec312634129f97f90154bb416a07e8cc0c13a2a",
-    "commit": "aec312634129f97f90154bb416a07e8cc0c13a2a"
+    "submittedInput": "380ad1220a7bc78104baedc469c4d086c8910494",
+    "commit": "380ad1220a7bc78104baedc469c4d086c8910494"
   },
   "channel": "production",
   "triggeringActor": "BenTaylorDev",
   "workflow": {
-    "runId": "33790889389",
-    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/33790889389"
+    "runId": "34486444519",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/34486444519"
   },
   "validationResult": "passed",
   "ag2": {
@@ -24,5 +24,5 @@
     "revision": "main",
     "pinned": false
   },
-  "builtAt": "2026-09-03T18:31:55Z"
+  "builtAt": "2026-09-10T14:04:08Z"
 }