copilotkit 4.9.50 → 4.9.60

package/onboarding/prompts/framework/strands-python.md

@@ -27,7 +27,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the context documentation gap.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.50 onboard read frontend/plan`.
+`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/framework/strands-typescript.md

@@ -28,7 +28,7 @@ Record the selected framework, vendor, model, required credential variable names
 URLs, and the context documentation gap.
 
 If the pages support the selection, run
-`npx --yes copilotkit@4.9.50 onboard read frontend/plan`.
+`npx --yes copilotkit@4.9.60 onboard read frontend/plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/angular.md

@@ -5,7 +5,7 @@ Preserve an existing Angular frontend. Use the selected page for a new frontend.
 Use the starter shortcut only if all these facts are true: the target directory contains
 no entries, its name is a valid `init` project name, and the selected framework is ADK.
 If all three facts are true, record Angular as the selected frontend. Then run
-`npx --yes copilotkit@4.9.50 onboard read starter/clone` before you fetch documentation.
+`npx --yes copilotkit@4.9.60 onboard read starter/clone` before you fetch documentation.
 
 ## Documentation
 
@@ -63,7 +63,7 @@ you create or build an Angular project. If the installed version is lower, selec
 supported version first and use it for every later command in this project.
 
 If the pages support the selection, record Angular and these URLs. Then run
-`npx --yes copilotkit@4.9.50 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, or the two version lines do not fit
-together, run `npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+together, run `npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/nextjs.md

@@ -15,7 +15,7 @@ These TypeScript options have starters: Claude Agent SDK TypeScript, LangGraph T
 Mastra, and Strands Agents TypeScript. The .NET option is Microsoft Agent Framework .NET.
 
 If all shortcut conditions are true, record Next.js as the selected frontend. Then run
-`npx --yes copilotkit@4.9.50 onboard read starter/clone` before you fetch documentation.
+`npx --yes copilotkit@4.9.60 onboard read starter/clone` before you fetch documentation.
 
 ## Documentation
 
@@ -27,7 +27,7 @@ agent as the default agent, which is correct only for a project that has no agen
 Do not replace the developer's existing agent with the built-in agent.
 
 If the page supports the selection, record Next.js and this URL. Then run
-`npx --yes copilotkit@4.9.50 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/plan.md

@@ -24,11 +24,11 @@ process.
 
 Use exactly one matching internal route:
 
-1. React SPA: `npx --yes copilotkit@4.9.50 onboard read frontend/react-spa`
-2. Next.js: `npx --yes copilotkit@4.9.50 onboard read frontend/nextjs`
-3. Angular: `npx --yes copilotkit@4.9.50 onboard read frontend/angular`
-4. Vue 3: `npx --yes copilotkit@4.9.50 onboard read frontend/vue`
-5. React Native: `npx --yes copilotkit@4.9.50 onboard read frontend/react-native`
+1. React SPA: `npx --yes copilotkit@4.9.60 onboard read frontend/react-spa`
+2. Next.js: `npx --yes copilotkit@4.9.60 onboard read frontend/nextjs`
+3. Angular: `npx --yes copilotkit@4.9.60 onboard read frontend/angular`
+4. Vue 3: `npx --yes copilotkit@4.9.60 onboard read frontend/vue`
+5. React Native: `npx --yes copilotkit@4.9.60 onboard read frontend/react-native`
 
 If no listed frontend fits, run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-native.md

@@ -15,7 +15,7 @@ documents `useRenderTool`, which is React Native's own hook for drawing a tool t
 already has. That is a different job and needs a tool in the agent.
 
 If the pages support the selection, record React Native and these URLs. Then run
-`npx --yes copilotkit@4.9.50 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/react-spa.md

@@ -11,7 +11,7 @@ not move the agent into it.
 - https://docs.copilotkit.ai/react-spa.md
 
 If the page supports the selection, record React SPA and this URL. Then run
-`npx --yes copilotkit@4.9.50 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/frontend/vue.md

@@ -16,7 +16,7 @@ page above. Vue has its own `useComponent`, which is not the React package. Take
 that reference page rather than from a Vue generative-UI guide, which is not published.
 
 If the pages support the selection, record Vue 3 and these URLs. Then run
-`npx --yes copilotkit@4.9.50 onboard read credentials/finalize-plan`.
+`npx --yes copilotkit@4.9.60 onboard read credentials/finalize-plan`.
 
 If the documentation does not support the selection, run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/implementation/build-and-validate.md

@@ -9,19 +9,38 @@ Approving the plan is the developer agreeing to every path it listed under
 app directory:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard protect --authorize --path <path> --reason "<the plan's sentence>"
+npx --yes copilotkit@4.9.60 onboard protect --authorize --path <path> --reason "<the plan's sentence>"
 ```
 
 Consent has to be on the record before the file moves, so a call made after the change is
 refused. Continue only if every result starts with `Status: passed`. If the plan listed
 nothing there, skip this section.
 
+If a path the plan listed has already changed, the developer changed it after the capture.
+No implementation step has run yet, so the change is theirs rather than this run's. Record
+consent over it by adding one flag:
+
+```text
+npx --yes copilotkit@4.9.60 onboard protect --authorize --path <path> --reason "<the plan's sentence>" --with-prior-change
+```
+
+The flag records their change as drift beside the consent, so the closing report names both
+the change they made and the change this run was allowed to make. Use it only here, before
+any implementation step runs. After one has run, a changed path is this run's own work, and
+the route-out rules apply.
+
+This section is the only place the plan's own authorizations are recorded. Once this run
+reports its plan, the CLI refuses `--authorize` for every path the plan did not name. The
+developer approved a plan, not a permission to reach further, so there is no consent to
+record for a path that comes up later. If you find such a path mid-run, use the route below
+rather than this section.
+
 ## Protected-path audit
 
 Run the audit from the target app directory:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard audit
+npx --yes copilotkit@4.9.60 onboard audit
 ```
 
 It compares every protected path with the digest the CLI captured for it. Its result starts
@@ -45,19 +64,50 @@ run collected. If it appears in one, or the sections do not settle it, the chang
 run's own: use the route-out rules. A plan names a protected path only under
 `Authorization requested`, so a plan that does not name it there proves nothing on its own.
 
+A Files changed section is the only evidence that settles who wrote a file. Reading the
+file settles nothing. Recognizing the code, knowing what it is for, seeing that it matches
+what this run was building, believing this run wrote it, or finding it broken in a way this
+run explains are all readings of the file, and the file cannot say who wrote it.
+A path you cannot find in a Files changed section is the developer's, however sure you are
+that it is not.
+
 A path that no Files changed section names changed outside the run, and it is the
 developer's own file. Accept it by name:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard protect --accept-external --path <path>
+npx --yes copilotkit@4.9.60 onboard protect --accept-external --path <path>
 ```
 
+A changed env file is its own case. This run asked the developer to place a credential
+there, so it takes the credential route rather than this one:
+
+```text
+npx --yes copilotkit@4.9.60 onboard protect --accept-credential --path <path>
+```
+
+That route proves no recorded credential was lost, instead of taking the run's word that it
+did not write the file. Read its refusal and stop if it names a lost variable.
+
 Pass one `--path` for each path you accept. Accept only a path the audit named, and only
 when no step of this run wrote it. The command re-captures that path, records that this
 run accepted the change, and prints it. Run the audit again afterwards: it passes and
 names every accepted path, and the closing summary must name them too. An acceptance is
 not a repair. It proves nothing about what the file now holds.
 
+The prohibition on repairing a protected path holds wherever the path comes up, not only
+here. A failing check is the usual way it comes up: the diagnosis lands on a file, and the
+file turns out to be protected. A correct diagnosis does not make the file this run's, and
+neither does a one-line fix. Never repair, reset, or revert it. Ask the developer to allow
+the change, and record the answer they give:
+
+```text
+npx --yes copilotkit@4.9.60 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"
+```
+
+Use it only for an answer a developer actually gave. It records the consent as taken
+outside the approved plan, and every later audit and the closing report say so, which is
+what tells the developer they were asked mid-run. If you cannot ask, route out.
+
 `Status: blocked` means the audit has no baseline to read. A blocked audit compared
 nothing and proved nothing changed. It is not a preservation failure: do not report a
 protected path as changed. Report the printed reason and use the route-out rules.
@@ -68,11 +118,11 @@ acceptance clears it, or route out. Do not send an audit result to a repair work
 Report the plan this run is about to implement:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard checkpoint --phase plan-written
+npx --yes copilotkit@4.9.60 onboard checkpoint --phase plan-written
 ```
 
 Spawn one implementation subagent. Tell it to run
-`npx --yes copilotkit@4.9.50 onboard read subagent/implement-and-validate` first and follow
+`npx --yes copilotkit@4.9.60 onboard read subagent/implement-and-validate` first and follow
 the prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the plan, selected framework, frontend, model, exact target app
@@ -92,11 +142,11 @@ returned. Continue to proof only when that audit passes.
 After the selected implementation path passes, report it:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard checkpoint --phase build-validated
+npx --yes copilotkit@4.9.60 onboard checkpoint --phase build-validated
 ```
 
 Then run
-`npx --yes copilotkit@4.9.50 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.9.60 onboard read proof/round-trip`.
 
 ## Repair rules
 
@@ -114,4 +164,4 @@ Route out for `Status: blocked`. Route out only when the failure is not yours to
 failure is in code this run did not write, the fix requires changing the developer's existing
 agent or frontend, the same command still fails after three repair attempts, or the
 documentation does not support the plan. In those cases run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/proof/complete.md

@@ -64,7 +64,7 @@ Name the debugging surface this journey's frontend can reach, rather than the on
 of the documentation leads with. For a web frontend it is the CopilotKit Inspector. For
 React Native there is no Inspector: it is a browser overlay built on a DOM custom element,
 and `@copilotkit/react-native` does not ship it. Give a mobile developer
-`npx --yes copilotkit@4.9.50 verify --round-trip`, the runtime's own log, the AG-UI
+`npx --yes copilotkit@4.9.60 verify --round-trip`, the runtime's own log, the AG-UI
 Event Inspector in the CopilotKit VS Code extension, and the Intelligence thread view
 instead. Naming the Inspector to a developer who cannot open it costs them the time it
 takes to conclude their own wiring is broken.
@@ -76,7 +76,7 @@ the friction commands without another developer question. The CLI telemetry gate
 whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.50 onboard friction --category <slug> --cost-seconds <seconds>
+npx --yes copilotkit@4.9.60 onboard friction --category <slug> --cost-seconds <seconds>
 ```
 
 Write one or two sentences on the command's standard input. Pick one category from
@@ -88,7 +88,7 @@ Pass --docs-path only for a docs-missing or docs-wrong report, naming the page t
 is about:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard friction --category docs-wrong --cost-seconds 300 --docs-path /docs/threads/drawer
+npx --yes copilotkit@4.9.60 onboard friction --category docs-wrong --cost-seconds 300 --docs-path /docs/threads/drawer
 ```
 
 Give the page's site-relative path or its full URL, with no spaces, query string, or
@@ -102,17 +102,17 @@ a failed step and not a failed onboarding run. Reword it and send it again, or m
 on. A run that proves a round trip is complete whether or not it reported friction.
 
 Tell the developer when you send a friction report. Do not quote or summarize the report
-unless the developer asks. If the CLI says that telemetry is disabled or unavailable,
-state that the report was not sent and continue without another question.
+unless the developer asks. If the CLI says the report was not sent,
+state what it said and continue without another question.
 
-When the evidence is gathered, run `npx --yes copilotkit@4.9.50 onboard complete`, carrying
+When the evidence is gathered, run `npx --yes copilotkit@4.9.60 onboard complete`, carrying
 the surface-check outcome the proof subagent returned. Pass exactly one flag, and pass the
 one that matches this journey's surface.
 
 For a web frontend -- React SPA, Next.js, Angular, Vue:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard complete --visual-check <outcome>
+npx --yes copilotkit@4.9.60 onboard complete --visual-check <outcome>
 ```
 
 The outcome is one of `performed`, `skipped-no-browser-tool`, or `failed`.
@@ -120,7 +120,7 @@ The outcome is one of `performed`, `skipped-no-browser-tool`, or `failed`.
 For React Native:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard complete --device-check <outcome>
+npx --yes copilotkit@4.9.60 onboard complete --device-check <outcome>
 ```
 
 The outcome is one of `performed`, `skipped-no-device`, or `failed`.
@@ -132,7 +132,7 @@ browser-origin CORS, so the flag you pass is how this run states which surface i
 For a web frontend, also pass the URL the browser opened:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard complete --visual-check <outcome> \
+npx --yes copilotkit@4.9.60 onboard complete --visual-check <outcome> \
   --frontend-url <the url you opened>
 ```
 
@@ -151,7 +151,7 @@ If the round trip proved and something after it still blocked this run, add `--b
 to the same command:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard complete --visual-check performed --blocked-by <cause>
+npx --yes copilotkit@4.9.60 onboard complete --visual-check performed --blocked-by <cause>
 ```
 
 The cause is one of `inspector` for a debugging surface that did not open,

package/onboarding/prompts/proof/oss-baseline.md

@@ -1,7 +1,7 @@
 # Prove the existing OSS baseline
 
 Do not prove the baseline yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.9.50 onboard read subagent/prove-oss-baseline` first and follow the
+`npx --yes copilotkit@4.9.60 onboard read subagent/prove-oss-baseline` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the repository findings and exact CLI package spec.
@@ -17,7 +17,7 @@ Wait for the subagent to finish.
 Record what that proof returned before you route on it:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
+npx --yes copilotkit@4.9.60 onboard proof --step oss-baseline --outcome <passed|failed|skipped> [--predicate <1-6>]
 ```
 
 Report the gate whatever it returned. Pass `passed` when the subagent proved a predicate,
@@ -35,14 +35,23 @@ Do not change project files before this proof ends. Starting existing developmen
 processes and their ignored runtime files is allowed.
 
 If the subagent proves the `both-oss` predicate, keep its evidence with the plan and run
-`npx --yes copilotkit@4.9.50 onboard read conversion/plan`. That project already works.
+`npx --yes copilotkit@4.9.60 onboard read conversion/plan`. That project already works.
 What it needs is the conversion, not a build.
 
-If it proves another supported starting state, record that state and run
-`npx --yes copilotkit@4.9.50 onboard read credentials/plan`. This prompt is served
+If the proof does not establish the baseline, record the starting state
+`both-copilotkit-unproved` and run
+`npx --yes copilotkit@4.9.60 onboard read credentials/plan`. This prompt is served
 whenever a project looks like an OSS integration, so a baseline that did not prove is an
-ordinary starting state rather than a failure.
+ordinary starting state rather than a failure. Keep the failing predicate with the plan.
+
+Do not record a state that says the CopilotKit integration is absent. This prompt is
+reached only when the merged findings prove that the integration is there, so `both` is
+a different project from this one, and `classify` refuses it later in the run.
+
+Where the proof fails predicate 3, the live runtime already holds an Intelligence
+client. Say so in the plan. Part of the work this run exists for is in place already,
+and the plan preserves it rather than repeating it.
 
 If it cannot identify the running process safely, exposes a secret, or finds a baseline
 failure that cannot be classified, run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/proof/round-trip.md

@@ -1,7 +1,7 @@
 # Prove the user journey
 
 Do not do the proof work yourself. Spawn one proof subagent. Tell it to run
-`npx --yes copilotkit@4.9.50 onboard read subagent/prove-round-trip` first and follow the
+`npx --yes copilotkit@4.9.60 onboard read subagent/prove-round-trip` first and follow the
 prompt it returns. If that read fails because the subagent cannot use the shell, stop that
 subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
 and the same handoff. Give it the selected framework, frontend, model, approved plan, selected
@@ -23,13 +23,13 @@ pass the time.
 Report each attempt at the journey as it ends, counting from one:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard checkpoint --phase journey-attempted --attempt 1
+npx --yes copilotkit@4.9.60 onboard checkpoint --phase journey-attempted --attempt 1
 ```
 
 Record what that proof returned before you route on it:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard proof --step round-trip --outcome <passed|failed|skipped>
+npx --yes copilotkit@4.9.60 onboard proof --step round-trip --outcome <passed|failed|skipped>
 ```
 
 Report the gate whatever it returned. A proof that never ran is `skipped`, not failed. The
@@ -37,7 +37,7 @@ command prints one line and sends nothing else. Where a repair cycle runs the pr
 record each attempt as it ends.
 
 For every protected-path audit in this prompt, run
-`npx --yes copilotkit@4.9.50 onboard audit` from the target app directory. If its result
+`npx --yes copilotkit@4.9.60 onboard audit` from the target app directory. If its result
 starts with `Status: blocked`, report the printed reason and use the route-out rules below.
 A blocked audit proved nothing changed and is not a preservation failure. If a
 protected-path audit reports a changed path, decide it the way the implementation prompt
@@ -46,13 +46,20 @@ returns none, so a finding with no Files changed section to test against routes
 path one of those sections names is this run's own change and routes out too. Accept a
 path only when a section this run collected covers the step that wrote it and does not
 name it:
-`npx --yes copilotkit@4.9.50 onboard protect --accept-external --path <path>`. Then run
+`npx --yes copilotkit@4.9.60 onboard protect --accept-external --path <path>`. Then run
 the audit again and name the path in the closing summary. Never repair, reset, or revert a
 protected path.
 
+That holds for a repair cycle too. When the fix for a failing check lands on a protected
+path, the path is still the developer's, however right the diagnosis is and however small
+the fix. Reading the file never settles who wrote it. Ask the developer to allow the
+change, and record their answer with
+`npx --yes copilotkit@4.9.60 onboard protect --authorize --unplanned --path <path> --reason "<what the developer said>"`,
+or route out. Never repair it, and never send it to a repair worker.
+
 If the proof result starts with `Status: passed`, run the protected-path audit. Continue to
 `proof/complete` only if that audit passes. After the audit passes, run
-`npx --yes copilotkit@4.9.50 onboard read proof/complete`. A performed surface outcome with
+`npx --yes copilotkit@4.9.60 onboard read proof/complete`. A performed surface outcome with
 the full round trip is core success even if a continued-development tool fails. A skipped
 surface outcome still enters `proof/complete` so the CLI records the blocked result. Do not
 describe a skipped surface as proved. Keep the Skills and MCP results separate from the proof
@@ -108,7 +115,7 @@ Restart each project-owned process changed by the repair. Report the cycle, coun
 one:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard checkpoint --phase repair-attempted --attempt 1
+npx --yes copilotkit@4.9.60 onboard checkpoint --phase repair-attempted --attempt 1
 ```
 
 Then spawn a fresh proof subagent
@@ -126,7 +133,7 @@ and proof cycles.
 
 Route out only when the failure is not yours to fix, when the same proof still fails after
 three attempts, or when no evidence of the round trip can be produced. In those cases run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`. All three are
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`. All three are
 about the round trip itself. A round trip that proved is not one of them, whatever failed
 after it.
 
@@ -136,7 +143,7 @@ Run the feedback command without another developer question. The CLI telemetry g
 whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.50 onboard feedback
+npx --yes copilotkit@4.9.60 onboard feedback
 ```
 
 Write at most four lines to standard input: the step you stopped at and what stopped it.

package/onboarding/prompts/starter/clone.md

@@ -43,7 +43,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --yes copilotkit@4.9.50 project list --json`
+`npx --yes copilotkit@4.9.60 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -53,7 +53,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument.
 
-`npx --yes copilotkit@4.9.50 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
+`npx --yes copilotkit@4.9.60 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
 
 Pass the confirmed name to both `--name` and `--create`: the app directory and its
 Intelligence project take the same name here. If the developer names an existing project,
@@ -69,14 +69,14 @@ account. The command does not need terminal input.
 If the command succeeds, do not rebuild the starter by hand. Report the clone first:
 
 ```text
-npx --yes copilotkit@4.9.50 onboard checkpoint --phase starter-cloned
+npx --yes copilotkit@4.9.60 onboard checkpoint --phase starter-cloned
 ```
 
 Then inspect only the generated
 paths inside the target directory. Record the files, install result, project connection,
 and validation commands. Then run
-`npx --yes copilotkit@4.9.50 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.9.60 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --yes copilotkit@4.9.50 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.

package/onboarding/prompts/subagent/create-plan.md

@@ -122,7 +122,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --yes copilotkit@4.9.50 verify --round-trip`, which needs no browser. Do not plan a
+`npx --yes copilotkit@4.9.60 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -19,7 +19,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --yes copilotkit@4.9.50 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --yes copilotkit@4.9.60 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -123,7 +123,7 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --yes copilotkit@4.9.50 verify --json`. It reads the port from this project, so a
+`npx --yes copilotkit@4.9.60 verify --json`. It reads the port from this project, so a
 non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
 `runtimeUrlSource` of `default` means nothing in the project named a port, so pass
 `--runtime-url` with the URL from step 1 in that case. Read the individual checks rather than
@@ -138,14 +138,17 @@ used the Intelligence credential. `api_key_authenticates` proves only that the k
 will not read. `verify` searches upward for the credential and a framework's env loader
 does not, so a key at the repository root is invisible to an app in a subdirectory. The
 check names the file to write instead. Write the key there, or run
-`npx --yes copilotkit@4.9.50 project select` from the app directory. Do not link,
+`npx --yes copilotkit@4.9.60 project select` from the app directory. Do not link,
 copy, or symlink the file to work around it, and do not treat the credential as missing:
 the check above already reported that it exists.
 
-`intelligence_thread_routes` fails when a licensed runtime serves no thread routes. A handler
-mounted `mode: "single-route"` is the usual cause. Return it for implementation to remove the
-option and use a catch-all route. Do not edit it. If the check is `undetermined` because no
-thread-endpoint state exists, the runtime predates the field. Record that and continue.
+`intelligence_thread_routes` fails when a licensed runtime serves no thread routes. A missing
+`identifyUser` is the usual cause: it gates the whole web surface. Return the check for
+implementation to pass `identifyUser` where the runtime is constructed. Do not edit it.
+A handler mounted `mode: "single-route"` is not a cause and must never be removed to satisfy
+this check: that mount serves the thread routes inside its envelope. If the check is
+`undetermined`, the runtime cannot report the state, and the check names the upgrade. Record
+that and continue.
 
 Take the frontend URL from the payload's `frontendUrl`. It replaces whatever step 2
 recorded, and every later step uses it unchanged. Where the field is absent, the project
@@ -153,7 +156,7 @@ named no port the CLI can read: keep step 2's URL, and rewrite its host as `loca
 before you use it.
 
 Then run the command once more with the URL you are about to open:
-`npx --yes copilotkit@4.9.50 verify --frontend-url <that url> --json`. The
+`npx --yes copilotkit@4.9.60 verify --frontend-url <that url> --json`. The
 `frontend_assets_served` check asks that server for its page and for one of the page's own
 assets, on that exact host. A `fail` there means the dev server refuses its own static
 assets on the host you were about to use, and the check names the URL to use instead. This
@@ -161,7 +164,7 @@ is the cheapest step that can save the most expensive one, so run it before the
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --yes copilotkit@4.9.50 verify --round-trip --json`. It sends one request through
+Run `npx --yes copilotkit@4.9.60 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -238,7 +241,7 @@ For a recorded `both-oss` starting state, this step has no component to render.
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --yes copilotkit@4.9.50 verify --round-trip`, which reads the
+that thread with `npx --yes copilotkit@4.9.60 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. It either had
@@ -266,7 +269,7 @@ request never exercises. Drive it with the browser control step 6 named.
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --yes copilotkit@4.9.50 verify --frontend-url <the url you opened> --json`
+   `npx --yes copilotkit@4.9.60 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -30,13 +30,13 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --yes copilotkit@4.9.50 onboard read fallback/best-effort`.
+`npx --yes copilotkit@4.9.60 onboard read fallback/best-effort`.
 
 Send one short report. Run the feedback command without another developer question. The
 CLI telemetry gate decides whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.50 onboard feedback
+npx --yes copilotkit@4.9.60 onboard feedback
 ```
 
 Write the feedback message to the command's standard input, in at most four lines.
@@ -44,5 +44,5 @@ Send no secrets, source code, logs, or command output. The command refuses a rep
 that carries any of those, prints the reason, and exits zero. A refused report is not
 a failed step. Reword it and send it again, or stop without a report. The command
 prints what it sent. This is the channel for a stop. Report friction only from a run that
-finished, never from here. If the CLI says that telemetry is disabled or unavailable,
-state that the report was not sent and stop without another question.
+finished, never from here. If the CLI says the report was not sent,
+state what it said and stop without another question.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.9.50",
+  "version": "4.9.60",
   "type": "module",
   "repository": {
     "type": "git",

package/release/release-tool.js

@@ -14698,7 +14698,7 @@ import * as path4 from "node:path";
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "380ad1220a7bc78104baedc469c4d086c8910494" : "main";
+  return true ? "d1584b840f904674b470be5d2b16c4ccca99c4f4" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts