copilotkit 4.9.60 → 4.10.0

package/onboarding/prompts/research/gather.md

@@ -0,0 +1,121 @@
+# Gather the evidence this run routes on
+
+Sign-in is settled. This phase inspects the project and proves what this environment can
+drive. Do not change application code here, and do not ask the developer a setup question
+yet: every read-only investigation finishes first.
+
+## How to wait for a subagent
+
+This rule covers every subagent this run spawns, here and in every later prompt.
+
+Spawning a subagent returns almost at once. That return is the dispatch succeeding, not the
+work finishing: the subagent runs in the background, and its result reaches you as a
+notification. Where your own harness hands you the report from the dispatch itself instead,
+you already hold the result. Either way there is nothing to poll.
+
+After you dispatch, do the work that does not depend on the result -- dispatch the other
+subagent, run the preflight below -- and then stop and wait. Wherever a prompt in this graph
+says to wait for a subagent to finish, that is what it means.
+
+Do not sleep to pass the time. Not `sleep`, not `/bin/sleep`, not a timer under another
+name, and not a loop that re-checks whether a result has arrived. Sleeping tells you nothing
+that waiting for the result does not, and it spends wall clock, which is one of the things
+this journey is measured on. One recorded run spent most of two hours asleep between
+dispatches that had all returned in seconds.
+
+Before you ask the developer any setup question, finish every read-only investigation and
+preflight check in this section.
+
+Prepare two research assignments. Give each research subagent one assignment. Tell it to run
+`npx --yes copilotkit@4.10.0 onboard read subagent/inspect-repository` first and follow the
+prompt it returns. If that read fails because the subagent cannot use the shell, stop that
+subagent. Run the same command yourself, then spawn a fresh subagent with the returned prompt
+and the same handoff. Require only its assigned packet.
+
+Start both research subagents in parallel:
+
+1. Spawn one research subagent. Assign it the project evidence packet.
+2. Spawn a second research subagent. Assign it the environment evidence packet.
+3. Start both research subagents. Then continue.
+
+Continue to the surface-control preflight.
+
+Prove whether your coding-agent environment has browser or device control. Do not assume it
+either way, and do not report what you expect to be true: a run that guesses here records a
+capability every later step then trusts. Use a browser or device tool already
+configured for the coding agent you are running as, the same way a later step uses the
+CopilotKit documentation server. With a browser tool, open one inert page such as
+`about:blank` and read its title. With a device tool and no browser, list the booted devices
+in one command: `adb devices -l`. Record the outcome of that attempt: `available` when the
+tool answered, `unavailable` when there was none to call or the page did not open. Use
+the control that matches the selected surface later.
+
+Where the browser probe answered, register nothing. The harness came equipped and the run
+owes it no setup.
+
+Where no browser tool answered, register one for the coding agent you are running as, then
+run the same probe again and record what the second attempt did. Register this server:
+
+```text
+npx --yes @playwright/mcp@latest --browser chrome --isolated --output-dir <project>/.copilotkit/proof/browser
+```
+
+Replace `<project>` with the absolute path of the target project directory. The server is
+registered against the coding agent rather than against a directory, so a relative path here
+resolves wherever that server happens to start.
+
+`--browser chrome` drives the Google Chrome the developer already has, so this downloads no
+browser. `--isolated` keeps the profile in memory, so it never touches their own Chrome
+profile. `--output-dir` is what keeps the snapshots and screenshots out of the developer's
+repository root: without it this server writes them to `.playwright-mcp/` beside their code,
+which a project that never asked for a browser has no reason to carry, and which this setup's
+own evidence rule already has a place for. Register it the way your own harness registers a
+server, which is the mechanism a later step uses for the CopilotKit documentation server.
+
+Tell the developer in one line what you registered, that it drives their installed Chrome,
+and that it lives in this coding agent's configuration rather than in their repository. Do
+not ask them to approve it, and do not ask a second question about it.
+
+Do not add a browser or device driver to the project. A driver added there is a
+devDependency and a browser download in the diff of a repository that never asked for one,
+which is a different thing from a server registered against the coding agent.
+
+Where the second probe still does not answer -- no Chrome to drive, no network, or a
+harness that cannot register a server -- record `unavailable` and carry it. Do not keep
+trying, and do not ask the developer about this tool limit.
+
+Registering a server does not boot a device. Where the device probe found none, that is the
+whole finding, and a browser is not a substitute for a device.
+
+Wait for both research subagents to finish.
+
+Then report that the research came back:
+
+```text
+npx --yes copilotkit@4.10.0 onboard checkpoint --phase research-returned
+```
+
+A refused checkpoint prints its reason and leaves onboarding unaffected. It is not a
+failed step.
+
+Continue only if both research results start with `Status: passed`. For `Status: failed`,
+retry only that packet with its failed items, up to three attempts. For `Status: blocked`,
+or a third failed result, use the stop route at the end of this prompt.
+
+Merge both evidence packets by item. On a conflict, spawn one fresh read-only verifier with
+the item, both cited findings, and the research limits. Require its result to start with
+`Status: passed`, `Status: failed`, or `Status: blocked`. Use only a passed cited result. Do
+not inspect the project to settle the conflict yourself. Use the stop route for a non-pass
+verifier result.
+
+Match environment evidence to the target app directory from the project packet. Require one
+target app directory and one matching environment row. If either packet gives no match or
+more than one match, send each research worker a focused directory check. Continue only when
+both workers return the same one target app directory. Both results must start with
+`Status: passed`. Otherwise, use the stop route.
+
+When both research results are merged, run
+`npx --yes copilotkit@4.10.0 onboard read research/route`.
+
+If inspection stops onboarding, run
+`npx --yes copilotkit@4.10.0 onboard read stopped/run-failed`.

package/onboarding/prompts/research/route.md

@@ -0,0 +1,81 @@
+# Capture the baseline and route on the findings
+
+The merged research findings are in hand. This phase captures the protected-path baseline
+before anything is written, checks that the findings answer what the route needs, and
+sends the run down one path.
+
+## Capture the protected-path baseline
+
+Before you route on, run this from the target app directory:
+
+```text
+npx --yes copilotkit@4.10.0 onboard protect
+```
+
+It reads the working tree itself, records every changed or untracked path with a digest,
+and prints the list. Require its result to start with `Status: passed`.
+
+Use the printed list as the protected path list for the rest of the run. Do not assemble
+that list yourself, and do not ask a subagent to hold it: every later audit reads the
+captured baseline back from the CLI, so no step depends on a subagent that has since
+finished.
+
+Paths printed as `deferred` are the ones onboarding itself writes, `.env` and
+`.copilotkit/project.json`. Every audit reports them and none fails on them until the step
+that writes them re-captures them, so a run whose only untracked files are the two this
+graph exists to create is never stopped by them.
+
+If the result starts with `Status: blocked`, report the printed reason and use the stop
+route at the end of this prompt.
+
+## What the merged findings must contain
+
+If a repository file exists, each finding must cite it. For an empty project, the subagents
+must cite the directory check and report absent parts.
+
+The findings must cover what the project is for, the agent, frontend, CopilotKit setup,
+authentication, credential names, and validation path. Do not ask the developer for facts
+that the repository answers.
+
+## Route on the merged findings
+
+Read the route off the merged findings. Three of them decide it, and you already hold all
+three:
+
+1. an agent is present,
+2. a frontend is present,
+3. a CopilotKit integration is present.
+
+Do not infer a working OSS path from packages, imports, project files, or keys, and do not
+settle these three from your own reading of the project. Each one comes from the merged
+packets or it is not proved.
+
+If all three are proved, prove the live starting state before any project file changes. Run
+`npx --yes copilotkit@4.10.0 onboard read proof/oss-baseline`.
+
+Route there before you ask the developer anything else. The questions after this prompt
+select a framework and a frontend that the findings already name, so a developer who
+answers them has answered for work the next node exists to check. Their existing
+application is what that node protects. Whether it works is what the proof decides, not
+these three findings.
+
+For every other combination of the three, take one more step first. If neither the
+developer nor the repository findings prove what the project is for, ask one guided
+question about the user outcome. This asks what the developer wants to build before you
+select a framework. Give two or three short examples and offer a minimal starter. Record
+the answer and give it to each later subagent. Then run
+`npx --yes copilotkit@4.10.0 onboard read credentials/plan`.
+
+Do not ask that question on the route above. A project carrying all three states its
+purpose in the application it already serves.
+
+Do not ask it when the target directory holds no project either. A greenfield run clones a starter
+the CLI ships, and that starter arrives carrying a working application of its own. The
+answer cannot change which starter lands, because the starter follows from the framework
+and frontend the developer selects next. Asking spends a turn on a decision the run has
+already made, and then names a purpose the cloned code does not serve. Take the same read
+named above without asking, and let the starter state the domain.
+
+If authentication or inspection stops onboarding, run
+`npx --yes copilotkit@4.10.0 onboard read stopped/run-failed`. Neither says anything
+about whether this project's stack is supported, which is not yet known at this point.

package/onboarding/prompts/starter/clone.md

@@ -1,8 +1,11 @@
 # Clone a starter
 
 Use this shortcut only when the repository findings prove that the target project
-directory contains no entries. If the directory contains a file or directory, do not use
-this shortcut.
+directory holds no project yet: no source directory such as `src/`, `app/`, `agent/` or
+`web/`, no dependency manifest such as `package.json` or `pyproject.toml`, and no `.env`.
+A directory that holds only a Git repository, a coding agent's own configuration, editor
+settings or scratch notes still qualifies. Those are not a project, and `git init` is the
+marker this CLI anchors a run on, so it cannot also be the thing that disqualifies one.
 
 Match the selected agent framework and frontend to this table:
 
@@ -43,7 +46,7 @@ the derived name.
 Only if the developer asks for an existing project, or asks to see the projects they have,
 read the choices:
 
-`npx --yes copilotkit@4.9.60 project list --json`
+`npx --yes copilotkit@4.10.0 project list --json`
 
 Then ask which one to use. Do not order the projects by creation time. If the developer
 already gave this answer, do not ask again. Do not read a secret value. Do not show or
@@ -53,7 +56,7 @@ Run the command from the parent directory. Do not inspect another entry in the p
 directory. Replace each placeholder with the recorded value. Do not run a placeholder as
 a shell argument.
 
-`npx --yes copilotkit@4.9.60 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
+`npx --yes copilotkit@4.10.0 init --name <project-name> --framework <framework-id> --channel none --no-banner --create <name> --install`
 
 Pass the confirmed name to both `--name` and `--create`: the app directory and its
 Intelligence project take the same name here. If the developer names an existing project,
@@ -66,17 +69,23 @@ The command clones the starter into the empty target directory. It also connects
 starter to the developer's Intelligence project. The earlier login phase supplies the
 account. The command does not need terminal input.
 
-If the command succeeds, do not rebuild the starter by hand. Report the clone first:
+Report the clone before you inspect anything:
 
 ```text
-npx --yes copilotkit@4.9.60 onboard checkpoint --phase starter-cloned
+npx --yes copilotkit@4.10.0 onboard checkpoint --phase starter-cloned
 ```
 
-Then inspect only the generated
+This is its own step, not an aside. A run that clones and then goes quiet is
+indistinguishable from a run that never cloned, and the checkpoint is the only thing that
+separates them.
+
+Do not rebuild the starter by hand. Then inspect only the generated
 paths inside the target directory. Record the files, install result, project connection,
 and validation commands. Then run
-`npx --yes copilotkit@4.9.60 onboard read proof/round-trip`.
+`npx --yes copilotkit@4.10.0 onboard read proof/round-trip`.
 
 If the command fails, report its exact error and do not claim that the starter is ready.
 Then run
-`npx --yes copilotkit@4.9.60 onboard read unsupported/no-validated-path`.
+`npx --yes copilotkit@4.10.0 onboard read stopped/run-failed`. The starter is one this
+graph ships and the stack was chosen from its own supported list, so a command that
+returned an error is a run that broke, not a setup this release does not support.

package/onboarding/prompts/stopped/run-failed.md

@@ -0,0 +1,44 @@
+# Stop because the run did not finish
+
+This is the ending for a run that broke. The developer's agent, frontend and package
+choices are supported. Something in this run stopped it, and that is what the report has
+to say.
+
+Do not tell the developer their setup is unsupported. It is not, and a run that says so
+sends them to change a stack that was never the problem.
+
+Keep the developer's current agent, frontend, authentication, and package choices.
+
+Name the exact step that stopped the run, and what it returned. State whether
+authentication, project selection, project credentials, the journey, implementation,
+validation, or the round trip stopped it. Give the failure in the words the step printed,
+not a summary of them.
+
+If a protected path stopped this run, name that path and how it changed, in the words the
+audit printed. A report that says only that protected files changed cannot be acted on:
+nobody reading it can tell which file moved, or whether this run or the developer moved
+it.
+
+Say what the developer has now. Name the processes still running and the files this run
+changed, so they can carry on by hand or start again from a known state. A run that stops
+without saying what it left behind leaves the developer to discover it.
+
+Stop onboarding without making more repository changes.
+
+Send one short report. Run the friction command without another developer question. The
+CLI telemetry gate decides whether the report is sent.
+
+```text
+npx --yes copilotkit@4.10.0 onboard friction --phase stop --category <slug>
+```
+
+Write one or two sentences to standard input: the step you stopped at and what stopped
+it. Pick the category that fits from docs-missing, docs-wrong, docs-sequential, cli-gap,
+sdk-gap, environment, port-collision, credential, validation-loop, and other. Leave
+--cost-seconds off. A run that stopped cannot separate one papercut's cost from the cost
+of the whole run, so the estimate is optional on a stop report and only there.
+Send no secrets, source code, logs, or command output. The command refuses a report that
+carries any of those, prints the reason, and exits zero. A refused report is not a failed
+step. Reword it and send it again, or stop without a report. The command prints what it
+sent. This is the channel for a stop. If the CLI says the report was not sent, state what
+it said and stop without another question.

package/onboarding/prompts/subagent/create-plan.md

@@ -23,6 +23,37 @@ SQLite, custom, or framework persistence can be durable. The two options cannot
 combined. Take the constructor from the connect-your-runtime page. Where a framework
 quickstart shows a `runner` option instead, the connect-your-runtime page wins.
 
+## Plan the Learning Container and its selector
+
+The main coding agent gives you a Learning Container id, or tells you the Learning step was
+skipped for this organization.
+
+Where it gives you an id, plan two things and name both in the plan the developer approves:
+the container id itself, and a `getLearningContainerId` callback returning that id on the
+`CopilotKitIntelligence` instance. Take the callback from the Learning page, and fetch it
+here rather than expecting the run to have handed it over:
+
+```text
+https://docs.copilotkit.ai/learning.md
+```
+
+Put the callback in the same runtime edit that connects Intelligence rather than in a step
+of its own: it is one option on the same constructor, so a separate step names a second
+change to a file the first step already changes.
+
+Name the container before the selector, and name the id in both. A container nothing routes
+to stays empty forever, so it buys a name and no learning. A selector pointing at an id the
+platform does not hold answers `LEARNING_CONTAINER_NOT_FOUND` on every thread create, which
+breaks a working chat on the next message.
+
+Per-user routing is the developer's own selector logic rather than more containers. Do not
+plan one container per end user: a project holds at most 500, the first automatic Learning
+run needs threads from 15 distinct conversations in one container, and a container per
+person needs those 15 conversations from that one person.
+
+Where the Learning step was skipped, plan no container and no selector, and say in the plan
+that Learning is not available to this organization.
+
 When the starting state is `both-oss`, use its recorded live baseline evidence. Preserve
 the working agent, frontend, CopilotKit integration, and OSS behavior. Plan the project
 selection, the CopilotKit dependency upgrade below, the Intelligence runtime
@@ -122,7 +153,7 @@ here is work the developer did not ask for.
 Plan the threads drawer itself: add it from the selected drawer page, where this frontend
 does not already render one. Where this journey's frontend framework ships no threads
 drawer -- React Native --, plan that the thread is proved by
-`npx --yes copilotkit@4.9.60 verify --round-trip`, which needs no browser. Do not plan a
+`npx --yes copilotkit@4.10.0 verify --round-trip`, which needs no browser. Do not plan a
 step that opens the managed Intelligence dashboard.
 
 ## Order the plan into steps

package/onboarding/prompts/subagent/implement-and-validate.md

@@ -110,8 +110,16 @@ project does not hold, and the rendered result looks the same either way.
 Run the full validation list. Record changed files, command results, and errors. Do not
 claim that the real user journey works in this phase.
 
+Where the plan names a Learning Container id, set `getLearningContainerId` on the
+`CopilotKitIntelligence` instance in the same edit that constructs the runtime with
+`intelligence`. Return that one id for every run. Do not add a file, a step, or a second
+constructor for it, and never write an id the plan does not name: a selector pointing at an
+id the platform does not hold answers `LEARNING_CONTAINER_NOT_FOUND` on every thread create.
+Where the plan names no container, write no selector.
+
 Report the runtime constructor you wrote. Name whether it passes `intelligence` or
-`runner`. A runtime built with `runner` is the SSE runtime and never reads the credential,
+`runner`, and whether it carries `getLearningContainerId`, with the id it returns.
+A runtime built with `runner` is the SSE runtime and never reads the credential,
 whatever the browser shows.
 
 Gather what you need in as few commands as possible. Combine independent reads into one

package/onboarding/prompts/subagent/prove-oss-baseline.md

@@ -19,7 +19,7 @@ Prove the live runtime in this order:
 4. Confirm from project files that the runtime constructor passes a `runner` option rather
    than an `intelligence` option. A package, import, project file, or key is not use proof.
 5. Run
-   `npx --yes copilotkit@4.9.60 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
+   `npx --yes copilotkit@4.10.0 verify --expect-runtime oss --round-trip --agent <expected-agent-id> --json`,
    with the runtime URL or auth header options that this project needs. Require exit zero
    and the JSON `ok` field to be `true`.
 6. Drive one real request through the existing frontend, CopilotKit runtime, and expected

package/onboarding/prompts/subagent/prove-round-trip.md

@@ -73,6 +73,12 @@ started process's output. The project's configuration wins over the table.
 Where this project's runtime runs as a process of its own, the frontend documentation
 puts it on port 8200. Use the runtime URL from step 1 rather than that number.
 
+Read the project's scripts before you start anything. A scaffolded starter serves both the
+agent and the frontend from one `dev` script, which runs them under
+`concurrently --kill-others`. One command starts both, and stopping either one stops the
+other. A second start against a project already running that script collides with a server
+that is up.
+
 Start each server in the background with the project's own script. Then wait for it to
 answer rather than for a fixed number of seconds:
 
@@ -89,8 +95,14 @@ Read the loop's own last line rather than assuming it ended because the server a
 A server that never answered has written the reason to its own output, and reading that
 output is faster than starting it again.
 
+That coupling also turns an ordinary restart into a false failure. Where you stop a server
+to pick up an installed dependency, start both again and wait for both to answer before you
+read the round trip. A check run against a frontend whose agent was stopped with it reports
+a wiring fault this run does not have.
+
 Leave the agent and frontend servers running after proof. Record each process ID and a
-safe command that stops that process. Record the commands that start both servers again.
+safe command that stops that process. Record whether that command stops both. Record the
+commands that start both servers again.
 
 Record the frontend URL the server you started reports, and treat it as provisional. Step 4
 replaces it with the URL the CLI resolves. Do not compose one of your own from a port you
@@ -123,7 +135,7 @@ IPv6 only, so an IPv4 literal fails against the correct port.
 ## Step 4 -- Check the wiring
 
 With both running, check the wiring in one command before you open a browser:
-`npx --yes copilotkit@4.9.60 verify --json`. It reads the port from this project, so a
+`npx --yes copilotkit@4.10.0 verify --json`. It reads the port from this project, so a
 non-default port needs no flag. The payload reports `runtimeUrl` and `runtimeUrlSource`. A
 `runtimeUrlSource` of `default` means nothing in the project named a port, so pass
 `--runtime-url` with the URL from step 1 in that case. Read the individual checks rather than
@@ -138,7 +150,7 @@ used the Intelligence credential. `api_key_authenticates` proves only that the k
 will not read. `verify` searches upward for the credential and a framework's env loader
 does not, so a key at the repository root is invisible to an app in a subdirectory. The
 check names the file to write instead. Write the key there, or run
-`npx --yes copilotkit@4.9.60 project select` from the app directory. Do not link,
+`npx --yes copilotkit@4.10.0 project select` from the app directory. Do not link,
 copy, or symlink the file to work around it, and do not treat the credential as missing:
 the check above already reported that it exists.
 
@@ -156,7 +168,7 @@ named no port the CLI can read: keep step 2's URL, and rewrite its host as `loca
 before you use it.
 
 Then run the command once more with the URL you are about to open:
-`npx --yes copilotkit@4.9.60 verify --frontend-url <that url> --json`. The
+`npx --yes copilotkit@4.10.0 verify --frontend-url <that url> --json`. The
 `frontend_assets_served` check asks that server for its page and for one of the page's own
 assets, on that exact host. A `fail` there means the dev server refuses its own static
 assets on the host you were about to use, and the check names the URL to use instead. This
@@ -164,7 +176,7 @@ is the cheapest step that can save the most expensive one, so run it before the
 
 ## Step 5 -- Prove that the agent runs
 
-Run `npx --yes copilotkit@4.9.60 verify --round-trip --json`. It sends one request through
+Run `npx --yes copilotkit@4.10.0 verify --round-trip --json`. It sends one request through
 the runtime and reads the answer back from the thread, so it separates an agent that is
 configured from an agent that works. Use `--agent <id>` when the runtime declares more
 than one. If it reports `user-not-identified`, this project's `identifyUser` reads a
@@ -173,6 +185,38 @@ it again, because an auth-gated app refusing an unauthenticated caller is that a
 working. Do not continue until this passes, and never report a round trip proven without
 it.
 
+Where this run settled a Learning Container, add the flag to the call above rather than
+running a second round trip:
+
+```text
+npx --yes copilotkit@4.10.0 verify --round-trip --expect-learning-container <container id> --json
+```
+
+The check reads the thread that this run created, so a second round trip proves a second
+thread and leaves the first unexamined. Add `--agent <id>` here too when the runtime
+declares more than one.
+
+It reads the thread back from the platform, so it answers for every runtime mount,
+including a single-route one. Read the `extraChecks` entry whose `id` is
+`learning_container_assigned`, and route on that entry's own `status` rather than on the
+exit status: the command exits non-zero for any check that is not `pass`, and
+`undetermined` is what a runtime the CLI cannot read reports.
+
+- `pass` proves the assignment. The thread came back carrying the container this run
+  settled.
+- `fail` is a defect. Either the thread carries no container, which means the selector
+  returned nothing, or it carries a different one. A thread cannot move between containers
+  after its first assignment, so start a new thread rather than repairing that one.
+- `undetermined` proves nothing either way. Record it and continue. An auth-gated
+  `identifyUser` produces it on an app that works, and so does a runtime the CLI cannot
+  read.
+
+`features.self_learning` and `/info` are not evidence. The first is a plan entitlement and
+is already true before any wiring. The second reports Learning from the presence of a
+callback rather than from an assigned thread. Never report either one as proof.
+
+Where this run skipped the Learning step, leave the flag off.
+
 ### Step 5a -- Prove that the page's data reaches the model
 
 `verify --round-trip` sends `context: []` and asks a question that needs no context. It
@@ -235,13 +279,13 @@ holds. Streamed text alone is not this step's outcome, whatever it says.
 This is the step that covers realtime delivery, the frontend provider being wired to this
 runtime, and the component actually rendering, and no command-line check reaches any of
 them. It is not optional polish: a run that skips it has proven the agent and not the
-journey, and the graph ends such a run as blocked rather than complete.
+journey, and such a run ends as blocked rather than complete.
 
 For a recorded `both-oss` starting state, this step has no component to render. Send the
 same request the baseline recorded, require the same kind of user-visible result the
 baseline produced, and require that the thread for that request is listed in the drawer.
 Where this journey's frontend framework ships no threads drawer -- React Native --, prove
-that thread with `npx --yes copilotkit@4.9.60 verify --round-trip`, which reads the
+that thread with `npx --yes copilotkit@4.10.0 verify --round-trip`, which reads the
 answer back off the thread and needs no browser. Record which of the two you proved.
 
 Use the surface control the main coding agent recorded for your environment. It either had
@@ -269,7 +313,7 @@ request never exercises. Drive it with the browser control step 6 named.
    the page to finish loading. Do not retype the host, and do not substitute a URL a tool
    offers you by default. Where the page loads but its styling is missing or the chat
    control is dead, run
-   `npx --yes copilotkit@4.9.60 verify --frontend-url <the url you opened> --json`
+   `npx --yes copilotkit@4.10.0 verify --frontend-url <the url you opened> --json`
    before you diagnose anything else. A dev server can serve its page and refuse every
    static chunk behind it, and on screen that is indistinguishable from a broken
    integration. The `frontend_assets_served` check tells the two apart.

package/onboarding/prompts/unsupported/no-validated-path.md

@@ -30,19 +30,22 @@ Before you show the best-effort plan, require this complete packet:
 - Give the ordered proof rules.
 
 After the developer approves the best-effort plan, run
-`npx --yes copilotkit@4.9.60 onboard read fallback/best-effort`.
+`npx --yes copilotkit@4.10.0 onboard read fallback/best-effort`.
 
-Send one short report. Run the feedback command without another developer question. The
+Send one short report. Run the friction command without another developer question. The
 CLI telemetry gate decides whether the report is sent.
 
 ```text
-npx --yes copilotkit@4.9.60 onboard feedback
+npx --yes copilotkit@4.10.0 onboard friction --phase stop --category <slug>
 ```
 
-Write the feedback message to the command's standard input, in at most four lines.
+Write one or two sentences to standard input: the step you stopped at and what stopped it.
+Pick the category that fits from docs-missing, docs-wrong, docs-sequential, cli-gap,
+sdk-gap, environment, port-collision, credential, validation-loop, and other. Leave
+--cost-seconds off. A run that stopped cannot separate one papercut's cost from the cost
+of the whole run, so the estimate is optional on a stop report and only there.
 Send no secrets, source code, logs, or command output. The command refuses a report
 that carries any of those, prints the reason, and exits zero. A refused report is not
 a failed step. Reword it and send it again, or stop without a report. The command
-prints what it sent. This is the channel for a stop. Report friction only from a run that
-finished, never from here. If the CLI says the report was not sent,
+prints what it sent. This is the channel for a stop. If the CLI says the report was not sent,
 state what it said and stop without another question.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copilotkit",
-  "version": "4.9.60",
+  "version": "4.10.0",
   "type": "module",
   "repository": {
     "type": "git",

package/release/release-tool.js

@@ -14698,7 +14698,7 @@ import * as path4 from "node:path";
 
 // apps/cli/src/config.ts
 function getTemplateRef() {
-  return true ? "d1584b840f904674b470be5d2b16c4ccca99c4f4" : "main";
+  return true ? "ce490419d046abe697438b070a99ad5d674365cc" : "main";
 }
 
 // apps/cli/src/services/agentcore-config.ts
@@ -15270,13 +15270,49 @@ import * as fs3 from "node:fs";
 import * as path3 from "node:path";
 import * as os from "node:os";
 import { execFileSync } from "node:child_process";
+var PROJECT_DIRECTORY_NAMES = /* @__PURE__ */ new Set([
+  "agent",
+  "api",
+  "app",
+  "components",
+  "lib",
+  "packages",
+  "pages",
+  "server",
+  "src",
+  "web"
+]);
+var PROJECT_MANIFEST_NAMES = /* @__PURE__ */ new Set([
+  "Cargo.toml",
+  "Gemfile",
+  "build.gradle",
+  "composer.json",
+  "go.mod",
+  "package.json",
+  "pom.xml",
+  "pyproject.toml",
+  "requirements.txt"
+]);
+var ENV_TEMPLATE_SUFFIXES = [".example", ".sample", ".template"];
+function isCredentialEnvFile(entry) {
+  if (!entry.startsWith(".env"))
+    return false;
+  if (ENV_TEMPLATE_SUFFIXES.some((suffix) => entry.endsWith(suffix)))
+    return false;
+  return entry === ".env" || entry.startsWith(".env.");
+}
+function entryHoldsProject(entry) {
+  if (isCredentialEnvFile(entry))
+    return true;
+  return PROJECT_DIRECTORY_NAMES.has(entry) || PROJECT_MANIFEST_NAMES.has(entry);
+}
 function isProjectDirOccupied(projectDir) {
-  return fs3.existsSync(projectDir) && fs3.readdirSync(projectDir).length > 0;
+  return fs3.existsSync(projectDir) && fs3.readdirSync(projectDir).some(entryHoldsProject);
 }
 function assertProjectDirAvailable(projectDir) {
   if (isProjectDirOccupied(projectDir)) {
     throw tagError(
-      new Error(`${projectDir} already exists and is not empty`),
+      new Error(`${projectDir} already holds a project`),
       TELEMETRY_ERROR_CODES.PREREQUISITE_MISSING
     );
   }