@github/copilot-sdk-darwin-arm64 1.0.15 → 1.0.16-preview.0

package/schemas/session-events.schema.json

@@ -10959,6 +10959,14 @@
         "error": {
           "type": "string",
           "description": "Error message if the server entered a failed state"
+        },
+        "errorClassification": {
+          "type": "string",
+          "description": "Runtime-produced classification for the final failed connection; unclassified means no classification was supplied. Additional string values may be introduced."
+        },
+        "configSource": {
+          "type": "string",
+          "description": "Runtime configuration provenance for a failed connection, or unknown when unavailable. Additional string values may be introduced."
         }
       },
       "required": [
@@ -11525,6 +11533,112 @@
         "websocket": "WebSocket transport."
       }
     },
+    "ModelCallFinalResult": {
+      "type": "string",
+      "enum": [
+        "success",
+        "http_400",
+        "http_413",
+        "http_429",
+        "http_4xx",
+        "http_5xx",
+        "transport_error",
+        "other_error"
+      ],
+      "description": "Final bounded result of one logical model operation after its internal retry loop settles",
+      "title": "ModelCallFinalResult",
+      "x-enumDescriptions": {
+        "success": "The final attempt succeeded.",
+        "http_400": "The final attempt failed with HTTP 400.",
+        "http_413": "The final attempt failed with HTTP 413.",
+        "http_429": "The final attempt failed with HTTP 429.",
+        "http_4xx": "The final attempt failed with another HTTP 4xx status.",
+        "http_5xx": "The final attempt failed with an HTTP 5xx status.",
+        "transport_error": "The final attempt failed in the request transport.",
+        "other_error": "The final attempt failed without another bounded classification."
+      }
+    },
+    "ModelCallFinalResultData": {
+      "type": "object",
+      "properties": {
+        "model": {
+          "type": "string",
+          "description": "Model identifier used by the final attempt"
+        },
+        "isByok": {
+          "type": "boolean",
+          "description": "Whether the final attempt used a bring-your-own-key provider"
+        },
+        "result": {
+          "$ref": "#/definitions/ModelCallFinalResult",
+          "description": "Bounded result of the final attempt"
+        }
+      },
+      "required": [
+        "model",
+        "result"
+      ],
+      "additionalProperties": false,
+      "description": "Internal telemetry result for one logical model operation after all orchestrator-owned retries settle",
+      "title": "ModelCallFinalResultData"
+    },
+    "ModelCallFinalResultEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "const": true,
+          "description": "Always true for events that are transient and not persisted to the session event log on disk."
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "model.call_final_result",
+          "description": "Type discriminator. Always \"model.call_final_result\"."
+        },
+        "data": {
+          "$ref": "#/definitions/ModelCallFinalResultData",
+          "description": "Internal telemetry result for one logical model operation after all orchestrator-owned retries settle"
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "ephemeral",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"model.call_final_result\". Internal telemetry result for one logical model operation after all orchestrator-owned retries settle",
+      "title": "ModelCallFinalResultEvent",
+      "visibility": "internal"
+    },
     "ModelCallFinishedData": {
       "type": "object",
       "properties": {
@@ -12379,6 +12493,31 @@
       "description": "Permission response variant that approves a request and remembers the provided approval for the rest of the session.",
       "title": "PermissionApprovedForSession"
     },
+    "PermissionApprovedReadOnlyForSession": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "const": "approved-read-only-for-session",
+          "description": "Approved with read-only directory authority for this session"
+        },
+        "directories": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "minItems": 1,
+          "description": "Canonical directories covered by the session read-only grant"
+        }
+      },
+      "required": [
+        "kind",
+        "directories"
+      ],
+      "additionalProperties": false,
+      "description": "Permission response variant that approves a request and records file-tool read authority for specific directories in this logical session.",
+      "title": "PermissionApprovedReadOnlyForSession"
+    },
     "PermissionAssentDetectedData": {
       "type": "object",
       "properties": {
@@ -13348,6 +13487,11 @@
         "requestSandboxBypassReason": {
           "type": "string",
           "description": "Reason for the sandbox escalation request."
+        },
+        "sandboxPathGrant": {
+          "$ref": "#/definitions/PermissionSandboxPathGrant",
+          "description": "Sandbox policy edit that would let the command run inside the sandbox. Only present when requestSandboxBypass is true.",
+          "stability": "experimental"
         }
       },
       "required": [
@@ -13675,6 +13819,14 @@
           },
           "description": "File paths that require explicit approval"
         },
+        "readOnlyDirectories": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Canonical directory candidates that can be granted for file-tool read access in this logical session. Present only for read path prompts.",
+          "stability": "experimental"
+        },
         "assistedApproval": {
           "$ref": "#/definitions/PermissionAssistedApproval",
           "description": "Assisted-approval judge information for this request; present only in assisted mode.",
@@ -14729,6 +14881,11 @@
         "requestSandboxBypassReason": {
           "type": "string",
           "description": "What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true."
+        },
+        "sandboxPathGrant": {
+          "$ref": "#/definitions/PermissionSandboxPathGrant",
+          "description": "Sandbox policy edit that would let the read run inside the sandbox. Only present when requestSandboxBypass is true.",
+          "stability": "experimental"
         }
       },
       "required": [
@@ -14831,6 +14988,11 @@
         "requestSandboxBypassReason": {
           "type": "string",
           "description": "What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true."
+        },
+        "sandboxPathGrant": {
+          "$ref": "#/definitions/PermissionSandboxPathGrant",
+          "description": "Sandbox policy edit that would let the command run inside the sandbox. Only present when requestSandboxBypass is true.",
+          "stability": "experimental"
         }
       },
       "required": [
@@ -15090,6 +15252,11 @@
         "requestSandboxBypassReason": {
           "type": "string",
           "description": "Justification for the sandbox-bypass request. Only meaningful when requestSandboxBypass is true."
+        },
+        "sandboxPathGrant": {
+          "$ref": "#/definitions/PermissionSandboxPathGrant",
+          "description": "Sandbox policy edit that would let the write run inside the sandbox. Only present when requestSandboxBypass is true.",
+          "stability": "experimental"
         }
       },
       "required": [
@@ -15109,6 +15276,10 @@
           "$ref": "#/definitions/PermissionApproved",
           "description": "Permission response variant indicating the request was approved without persisting an approval rule."
         },
+        {
+          "$ref": "#/definitions/PermissionApprovedReadOnlyForSession",
+          "description": "Permission response variant that approves a request and records file-tool read authority for specific directories in this logical session."
+        },
         {
           "$ref": "#/definitions/PermissionApprovedForSession",
           "description": "Permission response variant that approves a request and remembers the provided approval for the rest of the session."
@@ -15168,6 +15339,51 @@
       "description": "A permission approval or denial rule matched against a tool request, identified by a rule kind with an optional argument value.",
       "title": "PermissionRule"
     },
+    "PermissionSandboxPathGrant": {
+      "type": "object",
+      "properties": {
+        "path": {
+          "type": "string",
+          "description": "Absolute path to add to the sandbox filesystem policy"
+        },
+        "deniedPath": {
+          "type": "string",
+          "description": "The path the sandbox refused, present only when it differs from path. That happens when a write under a read-only folder moves the folder to the read-write paths, when a path that does not exist yet is granted through its nearest existing folder, because the OS sandbox cannot grant a path before it exists, and when either is spelled through a symlink, because a grant covers its path as written, so path is then the resolved location. Hosts should then name path in the offer, since the denial names this one."
+        },
+        "access": {
+          "$ref": "#/definitions/PermissionSandboxPathGrantAccess",
+          "description": "Which access the grant confers, and so which policy list the path is added to"
+        },
+        "removedReadonlyPaths": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "readonlyPaths entries the grant removes, exactly as written in the policy, because a read-only entry for the same location would otherwise keep the path read-only. A host that persists the path must remove these entries from its stored readonlyPaths too."
+        }
+      },
+      "required": [
+        "path",
+        "access"
+      ],
+      "additionalProperties": false,
+      "description": "A sandbox filesystem policy edit that would let a blocked operation run inside the sandbox instead of outside it. Offered only on a sandbox escalation request whose denial adding this path lifts, and only when managed policy permits the grant. A host accepts it with session.sandbox.grantPathForRequest, which adds the path to the session's sandbox policy and re-runs the operation sandboxed; a host that persists sandbox settings may also save the path there.",
+      "title": "PermissionSandboxPathGrant",
+      "stability": "experimental"
+    },
+    "PermissionSandboxPathGrantAccess": {
+      "type": "string",
+      "enum": [
+        "read",
+        "readWrite"
+      ],
+      "description": "Access a sandbox path grant confers",
+      "title": "PermissionSandboxPathGrantAccess",
+      "x-enumDescriptions": {
+        "read": "Read access: the path is added to readonlyPaths.",
+        "readWrite": "Read and write access: the path is added to readwritePaths."
+      }
+    },
     "PermissionsChangedData": {
       "type": "object",
       "properties": {
@@ -16485,6 +16701,72 @@
           "additionalProperties": false,
           "description": "An enforcement check refused a specific access. Emitted per refusal with no deduplication, including when policy permits the caller to bypass the denial. Carries no backend: the built-in checks that produce this run in-process against the effective policy."
         },
+        {
+          "type": "object",
+          "properties": {
+            "control": {
+              "$ref": "#/definitions/SandboxControl",
+              "description": "Sandbox control the access belongs to. Follows from `denialClass`."
+            },
+            "outcome": {
+              "$ref": "#/definitions/SandboxOutcome",
+              "description": "Always `allowed`."
+            },
+            "toolCallId": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Tool call the access belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
+            },
+            "platform": {
+              "$ref": "#/definitions/SandboxPlatform",
+              "description": "Host operating-system family"
+            },
+            "enforcementPoint": {
+              "$ref": "#/definitions/SandboxEnforcementPoint",
+              "description": "Runtime subsystem that ran the command"
+            },
+            "denialClass": {
+              "$ref": "#/definitions/SandboxDenialClass",
+              "description": "Bounded class of the access the enforced policy would have refused."
+            },
+            "permissiveSource": {
+              "$ref": "#/definitions/SandboxPermissiveSource",
+              "description": "Why the run recorded and allowed instead of enforcing."
+            },
+            "deniedResource": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Resource the enforced policy would have refused. Populated only when content capture is enabled."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command that made the access. Populated only when content capture is enabled."
+            },
+            "kind": {
+              "type": "string",
+              "const": "access_recorded",
+              "description": "Sandbox decision variant discriminator."
+            }
+          },
+          "required": [
+            "kind",
+            "control",
+            "outcome",
+            "platform",
+            "enforcementPoint",
+            "denialClass",
+            "permissiveSource"
+          ],
+          "additionalProperties": false,
+          "description": "Permissive learning mode (record and allow) recorded an access that the enforced policy would have refused, and allowed it. Emitted once per distinct recorded access of a record-and-allow run, bounded per command. The only per-access record of such a run: nothing was refused, so no `access_denied` is raised for it."
+        },
         {
           "type": "object",
           "properties": {
@@ -16948,9 +17230,10 @@
         "degraded",
         "denied",
         "approved",
-        "declined"
+        "declined",
+        "allowed"
       ],
-      "description": "Finite result of a sandbox decision. Each `SandboxDecisionData` variant uses a disjoint subset: `policy_resolved` is `resolved | degraded`, `spawn_completed` and `permissive_retry_completed` are `succeeded | failed`, `enforcement_state` is `engaged | inactive | failed`, `access_denied` is `denied`, and escalation decisions are `approved | declined`.",
+      "description": "Finite result of a sandbox decision. Each `SandboxDecisionData` variant uses a disjoint subset: `policy_resolved` is `resolved | degraded`, `spawn_completed` and `permissive_retry_completed` are `succeeded | failed`, `enforcement_state` is `engaged | inactive | failed`, `access_denied` is `denied`, `access_recorded` is `allowed`, and escalation decisions are `approved | declined`.",
       "title": "SandboxOutcome",
       "x-enumDescriptions": {
         "resolved": "The sandbox policy resolved successfully. Describes configuration only and makes no claim that a backend engaged.",
@@ -16961,7 +17244,21 @@
         "degraded": "The sandbox is active with one or more controls weakened by platform limitations or an explicitly selected relaxed mode.",
         "denied": "An enforcement check refused the requested access.",
         "approved": "A request to run outside the process sandbox was granted.",
-        "declined": "A request to run outside the process sandbox was not granted."
+        "declined": "A request to run outside the process sandbox was not granted.",
+        "allowed": "Permissive learning mode recorded an access the enforced policy would have refused, and allowed it."
+      }
+    },
+    "SandboxPermissiveSource": {
+      "type": "string",
+      "enum": [
+        "approved_retry",
+        "policy"
+      ],
+      "description": "Why a sandboxed run recorded and allowed its process-container access checks instead of enforcing them.",
+      "title": "SandboxPermissiveSource",
+      "x-enumDescriptions": {
+        "approved_retry": "A person approved the permissive retry for this command after a sandboxed attempt was blocked.",
+        "policy": "Device-managed policy (`sandbox.learningMode: \"allow\"`) starts sandboxed shell commands in permissive learning mode."
       }
     },
     "SandboxPlatform": {
@@ -17559,6 +17856,11 @@
           "$ref": "#/definitions/ModelCallFailureEvent",
           "description": "Session event \"model.call_failure\". Failed LLM API call metadata for telemetry"
         },
+        {
+          "$ref": "#/definitions/ModelCallFinalResultEvent",
+          "description": "Session event \"model.call_final_result\". Internal telemetry result for one logical model operation after all orchestrator-owned retries settle",
+          "visibility": "internal"
+        },
         {
           "$ref": "#/definitions/ModelCallFinishedEvent",
           "description": "Session event \"model.call_finished\". Final lifecycle outcome for one logical model dispatch. A logical dispatch may include internal reconnect or fallback work, so event count is not provider HTTP-request count."