copilotkit 4.9.47 → 4.9.60

package/README.md

@@ -72,6 +72,22 @@ copilotkit project select --create "My App" --json # create one and select it
 against the organization's real projects, so a typo fails with the available
 slugs instead of recording a selection that points at nothing.
 
+A `--create` name that an existing project already uses is refused, and the
+refusal names a free name computed from the list the CLI already holds, so a
+caller retries once rather than guessing. Under `--json` the same name is
+carried as `suggested_name`:
+
+```json
+{
+  "error": "You already have a project named \"My App\". \"My App-2\" is free.",
+  "suggested_name": "My App-2",
+  "type": "failed"
+}
+```
+
+The interactive picker offers the same name and never applies it silently:
+press Enter again to take it, or type a different one.
+
 `--json` emits one object on stdout:
 
 ```json
@@ -188,6 +204,44 @@ The bundled onboarding prompt gives one short explanation before it opens the
 page: sign-in lets the coding agent create a project and API key, and the user
 can remove the key later to disconnect the workspace.
 
+## Feature onboarding for existing apps
+
+Use the optional `--intent` flag when an existing CopilotKit app needs one
+specific feature. The CLI prints a feature-specific Markdown path; the coding
+agent follows its inspection, plan, implementation, and visible-proof steps.
+Without `--intent`, `onboard start` keeps the generic onboarding path unchanged.
+
+```bash
+npx --yes copilotkit@latest onboard start \
+  --intent add-a2ui \
+  --run <12-character-id> \
+  --coding-agent <slug>
+```
+
+`--intent` is a closed outcome, not free-form text. The supported values are:
+
+| Intent                   | Outcome                                                     |
+| ------------------------ | ----------------------------------------------------------- |
+| `add-rich-threads`       | Managed Rich Threads with durable thread UI/API proof       |
+| `add-learning`           | Assign real runs to a selected Learning Container           |
+| `add-a2ui`               | Render an A2UI surface in an existing OSS app               |
+| `add-open-generative-ui` | Render a sandboxed generated UI in chat                     |
+| `add-chat-suggestions`   | Configure and send visible chat suggestions                 |
+| `add-voice`              | Add documented voice transcription to the existing composer |
+| `add-realtime-sync`      | Prove managed thread changes sync between active clients    |
+
+The intent describes the developer's requested outcome, not a claim about the
+current project state. Each path inspects the app first: it preserves a proven
+existing configuration, stops rather than inventing credentials or identities,
+and sends an app that lacks a CopilotKit baseline to generic onboarding first.
+The CLI retains the selected intent with its repository-bound run, so every
+onboarding event a later step reports carries the requested outcome.
+
+Each path checks in at the steps where a run goes quiet: when the inspection
+subagent returns, when the plan is approved, when implementation validation
+passes, and on each proof attempt and repair cycle. A run that cannot go on
+reads `feature/stop`, reports from there, and does not run `onboard complete`.
+
 The onboarding commands are:
 
 - `copilotkit init`
@@ -356,6 +410,104 @@ prompts, and never opens a browser. See
 [Managed Channel CLI contracts](../../docs/channels-cli-contracts.md) for the
 declared-Channels file, the envelope shape, and the credential resolution order.
 
+## Learning Containers
+
+Run the Learning commands from a directory with a selected hosted project:
+
+```bash
+copilotkit learning containers list
+copilotkit learning containers get support-quality
+copilotkit learning containers create
+copilotkit learning containers select
+copilotkit learning containers update support-quality
+copilotkit learning containers delete support-quality
+```
+
+The create and update commands prompt for missing fields in a human terminal.
+The delete command shows the exact container and asks for approval. The CLI
+cannot delete a container with bound Threads or Learning history.
+
+`select` offers the containers this project already has and prints the one you
+pick, and its create form opens on an id derived from the project slug, because
+one container per project is the default scope. Route runs to different
+containers per user or per tier from `getLearningContainerId` in your own
+runtime, which receives the resolved application user; a container per user
+rarely reaches the 15 distinct conversations a first Learning run needs. Choose `Create a new container` to make one instead. It reads the first
+page before it draws the list and reads a later page only when you choose
+`Show more`, so a project with one container costs one read. `select` needs a
+terminal: with `--json`, or with no TTY, it refuses and names `list` and
+`create` instead.
+
+Pass flags for a script or coding agent:
+
+```bash
+copilotkit learning containers list --json
+copilotkit learning containers create --id support-quality --name "Support quality" --json
+copilotkit learning containers update support-quality --prompt-context "Use approved answers." --json
+copilotkit learning containers update support-quality --clear-prompt-context --json
+copilotkit learning containers delete support-quality --yes --json
+```
+
+`--json` emits one versioned JSON object on stdout and never prompts. Create
+requires `--id` and `--name`. Update requires at least one change flag. Delete
+requires `--yes`. Errors use the same JSON envelope and exit with a nonzero
+status.
+
+A container keeps its stable ID. The list command returns at most 500 containers.
+If `nextCursor` is not null, pass it to `--cursor` to read the next page.
+
+Writes are rate limited per organization, project, and caller: 10 creates, 30
+updates, and 30 deletes each minute. Updates and deletes are counted separately,
+so a cleanup loop does not spend its delete budget on the renames before it.
+Each API replica counts on its own, so these are the lowest limits a script can
+rely on. A call over the limit returns `RATE_LIMIT_EXCEEDED`. Wait one minute,
+then retry.
+
+## Learning Insights and Skill review
+
+Use the same selected project to inspect Learning output:
+
+```bash
+copilotkit learning insights list support-quality
+copilotkit learning candidates list support-quality
+copilotkit learning candidates review support-quality <candidate-id>
+copilotkit learning candidates approve support-quality <candidate-id>
+copilotkit learning candidates reject support-quality <candidate-id>
+copilotkit learning skills list support-quality
+copilotkit learning skills list support-quality --full
+```
+
+The `review` command is an alias of `candidates get`. Both commands show the
+candidate reason, supporting Insights, and all proposed Skill files.
+
+Approval and rejection show the full candidate before they ask for approval.
+Approval publishes the proposed add, update, or removal. Rejection does not
+change the published Skill Registry.
+
+Agents and scripts must add `--json`. Add `--yes` to `approve` and `reject`.
+Use `learning skills list --full` to include `SKILL.md` in human output. JSON
+list output contains the full records, always includes `skillMd`, and sets
+`resultLimit` to `500`. Insight, candidate, and Skill lists return at most 500
+items and do not support a cursor.
+
+Malformed Insight, candidate, or Skill command input returns
+`LEARNING_INPUT_INVALID`. Malformed Container command input returns
+`LEARNING_CONTAINER_INPUT_INVALID`. Reviewing a candidate that is already
+approved or rejected returns `LEARNING_CANDIDATE_SETTLED` before any request is
+sent. `LEARNING_CANDIDATE_CONFLICT` is different: the server refused because the
+candidate changed during the review, so read it again and retry.
+
+The CLI sends command telemetry such as `insights.list` and
+`candidates.approve`. Human reviews also send bounded review-viewed and
+review-decided events. The CLI does not send Container IDs, candidate IDs,
+Insight text, or Skill content in these events.
+
+Three properties describe a review. `review_mode` is `human` when the CLI showed
+the proposal and waited for an answer, and `agent` when `--yes` skipped that
+prompt. `review_action` is the command the caller ran, `approve` or `reject`.
+`review_decision` is the answer a person gave at the prompt, `confirmed` or
+`canceled`, and it is sent only in `human` mode.
+
 ## Skills And Agent-Assisted Onboarding
 
 Use `copilotkit create` to start a **new** project. Use `copilotkit skills onboard`
@@ -479,7 +631,7 @@ A real key exported in your shell environment satisfies the check too. An
 exported empty or whitespace value falls back to the `.env` value, while an
 exported placeholder-shaped value fails the gate outright.
 
-The Microsoft Agent Framework .NET template uses GitHub Models. Set its C# agent token with `dotnet user-secrets set GitHubToken "<your-token>"` from the generated `agent/` directory.
+The Microsoft Agent Framework .NET template uses OpenAI by default. Set its API key with `dotnet user-secrets set OPENAI_API_KEY "<your-openai-api-key>"` from the generated `agent/` directory.
 
 Do not commit generated `.env` files or personal secrets.
 
@@ -559,7 +711,7 @@ anything else:
 copilotkit verify
 copilotkit verify --json                                    # machine-readable output
 copilotkit verify --runtime-url http://localhost:8080/copilotkit
-copilotkit verify --frontend-url http://127.0.0.1:3000      # check that host's assets
+copilotkit verify --frontend-url http://127.0.0.1:3000      # that host's assets and CORS
 copilotkit verify --round-trip                              # also run the agent
 copilotkit verify --expect-runtime oss --round-trip --agent incident_triage
 ```
@@ -568,9 +720,15 @@ It checks that a hosted project is selected, that a project API key is present,
 that the app's own process can load that key, that the key authenticates
 against Intelligence, that the CopilotKit runtime responds, that the runtime
 declares at least one agent, that the runtime is actually using the credential,
-and that it serves the thread routes the license pays for. It also reports the
-runtime version, the agent framework in use, the realtime gateway wiring, the
-plan, and the license state.
+and that it serves the thread routes the license pays for. It also checks that
+the runtime accepts the origin a browser opens -- same-origin projects are
+decided from the two URLs, and a cross-origin runtime is asked with a real
+preflight when `--frontend-url` names the origin -- and that the CopilotKit
+packages installed here are on the same version the runtime reports. The
+version check is skipped when the runtime being probed is not on this
+machine, because a deployed runtime and this checkout are two installations. It also reports the runtime
+version, the agent framework in use, whether transcription is wired, the
+realtime gateway wiring, the plan, and the license state.
 
 The selected project is read from the nearest `.copilotkit/project.json` at or
 above the current directory, stopping at the repository root, so running from
@@ -592,7 +750,11 @@ present** says the credential exists somewhere in this repository, and **The app
 can load the project API key** says the directory the app runs in supplies it.
 The second is `UNKNOWN` rather than `FAIL` wherever it cannot decide: no package
 declaring a `@copilotkit/*` dependency was found, more than one was, or a script
-in the app names an env file itself with `dotenv`, `env-cmd`, or `--env-file`.
+in the app — or in any package above it, up to the project root — names an env
+file itself with `dotenv`, `env-cmd`, or `--env-file`. It is also `UNKNOWN` when
+a runtime answered and reported an Intelligence entitlement, because a runtime
+cannot report one without having loaded a key: the report then names the
+disagreement instead of claiming the app cannot load a key the runtime is using.
 
 That last check is the one a passing build cannot give you. A key in `.env`
 proves only that one was provisioned: the runtime reads no environment variable
@@ -688,9 +850,17 @@ closed.
 A runtime mounted `mode: "single-route"` refuses `GET /info`, so `verify` asks
 the same question again through the POST envelope that mount does answer.
 Reaching it that way counts as reachable, and the report says which shape
-answered. That mount carries no thread or memory route, though, so a licensed
-project on it fails the thread-route check with the mount named as the cause.
-Removing `mode: "single-route"` fixes it.
+answered.
+
+That mount serves its thread and memory routes too, inside the same envelope as
+the `resource/request` method, and the client rewrites every such fetch into it.
+So the thread-route check passes there and says the routes were served that way,
+rather than as REST paths. It reads the `singleRoute` block of `/info` to decide,
+because the top-level `threadEndpoints` block reports the routes absent on that
+mount whatever it serves: the runtime resolves that block from whether the
+request in hand is a `resource/request`, and an `info` call never is. A runtime
+below `@copilotkit/runtime` 1.70.2 reports no `singleRoute` block and therefore
+cannot say, so the check is `UNKNOWN` there and names the upgrade.
 
 ### Proving the agent runs, not just that it is configured
 

package/cli-build-info.json

@@ -2,20 +2,20 @@
   "schemaVersion": 1,
   "package": {
     "name": "copilotkit",
-    "version": "4.9.47"
+    "version": "4.9.60"
   },
   "intelligence": {
-    "commit": "85f6b2eb2b4c8fef747bbfb0e3f5991b196ecc43"
+    "commit": "5f0f9a7cf15492544f1341f562fa5cd55387099c"
   },
   "copilotKit": {
-    "submittedInput": "380ad1220a7bc78104baedc469c4d086c8910494",
-    "commit": "380ad1220a7bc78104baedc469c4d086c8910494"
+    "submittedInput": "d1584b840f904674b470be5d2b16c4ccca99c4f4",
+    "commit": "d1584b840f904674b470be5d2b16c4ccca99c4f4"
   },
   "channel": "production",
-  "triggeringActor": "MikeRyanDev",
+  "triggeringActor": "BenTaylorDev",
   "workflow": {
-    "runId": "34279600219",
-    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/34279600219"
+    "runId": "34616405214",
+    "runUrl": "https://github.com/CopilotKit/Intelligence/actions/runs/34616405214"
   },
   "validationResult": "passed",
   "ag2": {
@@ -24,5 +24,5 @@
     "revision": "main",
     "pinned": false
   },
-  "builtAt": "2026-09-08T21:17:26Z"
+  "builtAt": "2026-09-11T15:30:58Z"
 }