copilotkit 4.9.47 → 4.9.50

package/onboarding/prompts/starter/clone.md

@@ -43,7 +43,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --yes copilotkit@4.9.47 project list --json`
+`npx --yes copilotkit@4.9.50 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -53,7 +53,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument.
 
-`npx --yes copilotkit@4.9.47 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
+`npx --yes copilotkit@4.9.50 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
 
 Pass the confirmed name to both `--name` and `--create`: the app directory and its
 Intelligence project take the same name here. If the developer names an existing project,
@@ -69,14 +69,14 @@ account. The command does not need terminal input.
 If the command succeeds, do not rebuild the starter by hand. Report the clone first:
 
 ```text
-npx --yes copilotkit@4.9.47 onboard checkpoint --phase starter-cloned
+npx --yes copilotkit@4.9.50 onboard checkpoint --phase starter-cloned
 ```
 
 Then inspect only the generated
 paths inside the target directory. Record the files, install result, project connection,
 and validation commands. Then run
-`npx --yes copilotkit@4.9.47 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.9.50 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --yes copilotkit@4.9.47 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/subagent/create-plan.md

@@ -122,7 +122,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --yes copilotkit@4.9.47 verify --round-trip`, which needs no browser. Do not plan a
+`npx --yes copilotkit@4.9.50 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps
@@ -138,8 +138,16 @@ list to re-derive: a path you leave out of it is not protected, and a path you a
 is not in the baseline the audit reads. Do not name a protected path as a path a step
 changes. Do not name a path that overlaps a protected path. The paths overlap when they are
 equal or either path is an ancestor directory on a path-segment boundary. `apps/a` overlaps
-`apps/a/src`, but not `apps/ab`. `app.ts` does not overlap `app.tsx`. If the plan needs
-one, return `Status: blocked` before approval.
+`apps/a/src`, but not `apps/ab`. `app.ts` does not overlap `app.tsx`.
+
+If a step cannot be written any other way, ask for the path instead of taking it. Adding a
+feature to an app the developer already built is the case this exists for: the option lives
+in a file they wrote, and on an app whose work was never committed that file is in the
+baseline. List every such path under `Authorization requested`, one line each, with the path
+and one sentence saying what the step changes there and why no other file will do. Keep the
+step in the plan. Return `Status: blocked` only when the plan needs a protected path you
+cannot justify in that sentence.
+
 Return the protected path list as part of the plan.
 
 Keep final validation and proof outside the implementation steps. The developer approves

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -19,7 +19,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --yes copilotkit@4.9.47 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --yes copilotkit@4.9.50 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -123,7 +123,7 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --yes copilotkit@4.9.47 verify --json`. It reads the port from this project, so a
+`npx --yes copilotkit@4.9.50 verify --json`. It reads the port from this project, so a
 non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
 `runtimeUrlSource` of `default` means nothing in the project named a port, so pass
 `--runtime-url` with the URL from step 1 in that case. Read the individual checks rather than
@@ -138,7 +138,7 @@ used the Intelligence credential. `api_key_authenticates` proves only that the k
 will not read. `verify` searches upward for the credential and a framework's env loader
 does not, so a key at the repository root is invisible to an app in a subdirectory. The
 check names the file to write instead. Write the key there, or run
-`npx --yes copilotkit@4.9.47 project select` from the app directory. Do not link,
+`npx --yes copilotkit@4.9.50 project select` from the app directory. Do not link,
 copy, or symlink the file to work around it, and do not treat the credential as missing:
 the check above already reported that it exists.
 
@@ -153,7 +153,7 @@ named no port the CLI can read: keep step 2's URL, and rewrite its host as `loca
 before you use it.
 
 Then run the command once more with the URL you are about to open:
-`npx --yes copilotkit@4.9.47 verify --frontend-url <that url> --json`. The
+`npx --yes copilotkit@4.9.50 verify --frontend-url <that url> --json`. The
 `frontend_assets_served` check asks that server for its page and for one of the page's own
 assets, on that exact host. A `fail` there means the dev server refuses its own static
 assets on the host you were about to use, and the check names the URL to use instead. This
@@ -161,7 +161,7 @@ is the cheapest step that can save the most expensive one, so run it before the
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --yes copilotkit@4.9.47 verify --round-trip --json`. It sends one request through
+Run `npx --yes copilotkit@4.9.50 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -238,7 +238,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --yes copilotkit@4.9.47 verify --round-trip`, which reads the
+that thread with `npx --yes copilotkit@4.9.50 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. It either had
@@ -266,7 +266,7 @@ request never exercises. Drive it with the browser control step 6 named.
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --yes copilotkit@4.9.47 verify --frontend-url <the url you opened> --json`
+   `npx --yes copilotkit@4.9.50 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -30,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --yes copilotkit@4.9.47 onboard read fallback/best-effort`.
+`npx --yes copilotkit@4.9.50 onboard read fallback/best-effort`.
 
 Send one short report. Run the feedback command without another developer question. The
 CLI telemetry gate decides whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.47 onboard feedback
+npx --yes copilotkit@4.9.50 onboard feedback
 ```
 
 Write the feedback message to the command's standard input, in at most four lines.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.9.47",
+  "version": "4.9.50",
   "type": "module",
   "repository": {
     "type": "git",

package/release/release-tool.js

@@ -14896,8 +14896,15 @@ var TELEMETRY_ERROR_CODES = {
    */
   KEY_PROVISION_REFUSED: "KEY_PROVISION_REFUSED",
   CLI_PRODUCT_BINARY_TOO_LARGE: "CLI_PRODUCT_BINARY_TOO_LARGE",
+  LEARNING_CANDIDATE_CONFLICT: "LEARNING_CANDIDATE_CONFLICT",
+  LEARNING_CANDIDATE_SETTLED: "LEARNING_CANDIDATE_SETTLED",
+  LEARNING_CANDIDATE_ID_INVALID: "LEARNING_CANDIDATE_ID_INVALID",
   LEARNING_CONTAINER_ID_INVALID: "LEARNING_CONTAINER_ID_INVALID",
+  LEARNING_CONTAINER_INPUT_INVALID: "LEARNING_CONTAINER_INPUT_INVALID",
+  LEARNING_CONTAINER_NOT_FOUND: "LEARNING_CONTAINER_NOT_FOUND",
+  LEARNING_CONTAINER_RESPONSE_INVALID: "LEARNING_CONTAINER_RESPONSE_INVALID",
   LEARNING_PROJECT_ID_INVALID: "LEARNING_PROJECT_ID_INVALID",
+  LEARNING_RESPONSE_INVALID: "LEARNING_RESPONSE_INVALID",
   LEARNING_SKILLS_BUNDLE_INVALID: "LEARNING_SKILLS_BUNDLE_INVALID",
   LEARNING_SKILLS_INTEGRITY_FAILED: "LEARNING_SKILLS_INTEGRITY_FAILED",
   LEARNING_SKILLS_OUTPUT_EXISTS: "LEARNING_SKILLS_OUTPUT_EXISTS"
@@ -15173,20 +15180,18 @@ var FRAMEWORK_TEMPLATES = {
       TEMPLATE_REPOS["microsoft-agent-framework-dotnet"],
       `\u{1FA81}\u{1F91D}${FRAMEWORK_EMOJI["microsoft-agent-framework-dotnet"]}`
     ),
-    // No root-`.env` vendor gate: the agent's model credentials are configured
-    // via dotnet user-secrets (GitHub Models, by default) or OpenAI/Azure
-    // OpenAI, none of which live in the root `.env`, so a fixed root-`.env` key
-    // requirement would falsely warn. The GitHub-token user-secrets command is
-    // credential setup (not a generic post-install build step), so it is
-    // surfaced as explicit credential guidance below instead.
+    // No root-`.env` vendor gate: the agent's OpenAI credential is configured
+    // via dotnet user-secrets. It does not live in the root `.env`, so a fixed
+    // root-`.env` key requirement would falsely warn. The user-secrets command
+    // is credential setup (not a generic post-install build step), so it is
+    // surfaced as explicit guidance below.
     environment: [],
     setupNotes: [
       { text: "  Set up the agent model credentials:" },
       {
-        text: "    GitHub Models:  ",
-        code: 'cd agent && dotnet user-secrets set GitHubToken "<your-github-token>"'
-      },
-      { text: "    or OpenAI / Azure OpenAI \u2014 see the agent README" }
+        text: "    OpenAI:  ",
+        code: 'cd agent && dotnet user-secrets set OPENAI_API_KEY "<your-openai-api-key>"'
+      }
     ]
   },
   "microsoft-agent-framework-py": {
@@ -15487,6 +15492,27 @@ async function scaffoldStarterForSmoke(input, scaffold = scaffoldProject) {
     }
     await scaffold({ projectDir, template: configuredTemplate });
     await definition.postScaffold?.(projectDir);
+    if (input.framework === "microsoft-agent-framework-dotnet") {
+      const command = definition.setupNotes?.find(
+        (note) => note.code?.includes("dotnet user-secrets set")
+      )?.code;
+      const credential = command?.match(
+        /dotnet user-secrets set ([A-Za-z0-9_]+)/
+      )?.[1];
+      const programPath = path4.join(projectDir, "agent", "Program.cs");
+      const program = fs4.existsSync(programPath) ? fs4.readFileSync(programPath, "utf8") : "";
+      if (!credential || !program.includes(credential)) {
+        throw new StarterSmokeError(
+          "STARTER_CREDENTIAL_MISMATCH",
+          "Microsoft Agent Framework .NET credential guidance does not match the bound starter",
+          {
+            framework: input.framework,
+            credential,
+            revision: input.template.revision
+          }
+        );
+      }
+    }
     const entries = fs4.readdirSync(projectDir);
     return entries.join("\n");
   } finally {