@github/copilot-sdk-darwin-arm64 1.0.16-preview.0 → 1.0.17-preview.0

package/copilot-sdk/index.js

@@ -3876,7 +3876,7 @@ var init_ffiRuntimeHost = __esm({
           );
           if (!this.connectionId) {
             this.unregisterCallback();
-            this.lib.hostShutdown(this.serverId);
+            await this.shutdownHost();
             this.serverId = 0;
             throw new Error("copilot_runtime_connection_open failed.");
           }
@@ -3885,7 +3885,7 @@ var init_ffiRuntimeHost = __esm({
         } finally {
           this.starting = false;
           if (this.disposed) {
-            void this.tryFinalizeCleanup();
+            await this.tryFinalizeCleanup();
           }
         }
       }
@@ -3924,6 +3924,17 @@ var init_ffiRuntimeHost = __esm({
           );
         }
       }
+      shutdownHost() {
+        return new Promise((resolvePromise, rejectPromise) => {
+          this.lib.hostShutdown.async(this.serverId, (error, result) => {
+            if (error) {
+              rejectPromise(error);
+            } else {
+              resolvePromise(result);
+            }
+          });
+        });
+      }
       unregisterCallback() {
         if (this.outboundCallback === void 0) {
           return true;
@@ -3996,7 +4007,7 @@ var init_ffiRuntimeHost = __esm({
           }
           if (this.serverId) {
             try {
-              if (!this.lib.hostShutdown(this.serverId)) {
+              if (!await this.shutdownHost()) {
                 console.error(
                   `In-process FFI host shutdown did not recognize server ${this.serverId}.`
                 );
@@ -4660,15 +4671,45 @@ function createServerRpc(connection) {
     /** @experimental */
     managedSettings: {
       /**
-       * Discovers device-managed settings from production MDM and managed-file sources, validates them against the runtime-owned managed-settings schema, and returns the canonical JSON without requiring a session.
+       * Discovers device-managed settings from production MDM and managed-file sources, validates them against the runtime-owned managed-settings schema, and returns the canonical JSON without requiring a session. `managedSettings.resolve` returns the same device settings together with the account's server policy.
        *
        * @returns Validated device-managed settings discovered before a session exists.
        */
       read: async () => connection.sendRequest("managedSettings.read", {}),
       /**
-       * Force-refreshes enterprise managed settings for every account: wipes the persistent server-policy cache (the whole `<cacheHome>/managed-settings` directory) and drops this runtime process's in-memory retained server policy. It does not itself fetch policy — the effect is that the next time a session resolves managed settings for an account, that resolution re-fetches the account's org policy from the network instead of serving a cached response. Note that `managedSettings.read` returns only device/MDM settings and never triggers the account server-policy fetch, so a host implementing "sync account policy" should start a fresh session resolution rather than treat a subsequent `managedSettings.read` as the refreshed org policy. Mirrors the invalidation a sign-out performs, broadened from the one signing-out account to all of them; device/MDM layers describe the machine, not the account, and are left untouched. Rejects if the on-disk cache cannot be removed.
+       * Force-refreshes enterprise managed settings for every account: wipes the persistent server-policy cache (the whole `<cacheHome>/managed-settings` directory) and drops this runtime process's in-memory retained server policy. It does not itself fetch policy — the effect is that the next time a session resolves managed settings for an account, that resolution re-fetches the account's org policy from the network instead of serving a cached response. Note that `managedSettings.read` returns only device/MDM settings and never triggers the account server-policy fetch, so a host implementing "sync account policy" should call `managedSettings.resolve` or start a fresh session resolution rather than treat a subsequent `managedSettings.read` as the refreshed org policy. Mirrors the invalidation a sign-out performs, broadened from the one signing-out account to all of them; device/MDM layers describe the machine, not the account, and are left untouched. Rejects if the on-disk cache cannot be removed.
+       */
+      clearCache: async () => connection.sendRequest("managedSettings.clearCache", {}),
+      /**
+       * Resolves the effective enterprise managed settings without a session, from the device channel and, when an account is available, the account's server policy through the same per-account cache sessions use. A cached server policy less than an hour old is used without a fetch; otherwise the policy is fetched, and when the fetch fails a cached policy up to 24 hours old is used instead, unless `forceRemoteSettingsRefresh` requires a live fetch. With no account requested or signed in, it reports device policy only; signing out removes the account's cached policy. It can fetch server policy over the network when the cache is stale, so call it off latency-critical paths such as startup rather than before listing models. The policy helper is not run. `layers` lists each channel's document before merging, and `values` and `meta` carry typed effective values and their lock state for the keys typed so far.
+       *
+       * @param params Optional opaque account selection or GitHub token whose managed settings are resolved.
+       *
+       * @returns Effective enterprise managed settings for an account, resolved without a session.
+       */
+      resolve: async (params) => connection.sendRequest("managedSettings.resolve", params),
+      /**
+       * Returns the managed-settings authoring JSON schema with descriptive `x-composition` annotations aligned with the shared settings-engine vocabulary. These annotations are not a complete runtime composition contract: model, effortLevel, and contextTier remain coupled. Use `managedSettings.compose` for the runtime's effective result. Performs no I/O.
+       *
+       * @returns The authoring JSON schema for managed settings recognized by this runtime.
+       */
+      schema: async () => connection.sendRequest("managedSettings.schema", {}),
+      /**
+       * Validates a candidate managed-settings document the way the runtime validates delivered policy, without applying it. Reports errors that would reject the document, warnings for content the runtime ignores, and the canonical document it would apply. Document text nested more than 64 levels deep is rejected. Performs no I/O.
+       *
+       * @param params A candidate managed-settings document to validate without applying it.
+       *
+       * @returns Result of validating a managed-settings document.
+       */
+      validate: async (params) => connection.sendRequest("managedSettings.validate", params),
+      /**
+       * Merges candidate managed-settings documents for the device, server, and policy-helper channels into the effective settings the runtime would enforce on this host, using the same precedence and composition rules as live resolution, without applying them. Like live resolution, a server's advisory sandbox force-enable is declined on a host that cannot run the sandbox. Does not fetch policy or read policy files, but may perform blocking OS or subprocess probes for sandbox support. Preview documents are limited to 1 MiB and 64 levels of nesting.
+       *
+       * @param params Candidate managed-settings documents to merge without applying them.
+       *
+       * @returns The effective managed settings the runtime would enforce for the given documents, in the same shape `managedSettings.resolve` returns.
        */
-      clearCache: async () => connection.sendRequest("managedSettings.clearCache", {})
+      compose: async (params) => connection.sendRequest("managedSettings.compose", params)
     },
     /** @experimental */
     runtime: {
@@ -6116,6 +6157,12 @@ function createSessionRpc(connection, sessionId) {
        * @returns Feature detection and hard polling limits for the EXPERIMENTAL session connector API.
        */
       getCapabilities: async () => connection.sendRequest("session.connectors.getCapabilities", { sessionId }),
+      /**
+       * Returns the session account selection, or null.
+       *
+       * @returns Session account selection, or null.
+       */
+      getAccount: async () => connection.sendRequest("session.connectors.getAccount", { sessionId }),
       /**
        * Returns authoritative session Connector state from current availability, pinned account selection, cached catalog, and live MCP projection without performing a Connector service request.
        *
@@ -6184,7 +6231,7 @@ function createSessionRpc(connection, sessionId) {
       /**
        * Waits for the live session's in-flight managed-settings application, then returns the retained effective snapshot used by runtime enforcement and by `session.managed_settings_resolved`. It does not perform another account, device, or server resolution, and rejects when resolution has not produced a snapshot.
        *
-       * @returns Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively across device, server, policy-helper, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.
+       * @returns Effective enterprise managed settings and contributing channels. Session events report applied policy; sessionless resolve reports an account/device snapshot, and compose reports a non-applying preview of candidate documents. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively. Session-local SDK-client policy is included only in session results. Marked experimental while the managed-settings surface stabilizes.
        */
       get: async () => connection.sendRequest("session.managedSettings.get", { sessionId })
     },
@@ -9054,6 +9101,7 @@ var CopilotSession = class {
   sessionId;
   connection;
   _workspacePath;
+  _transcriptRecovery;
   eventHandlers = /* @__PURE__ */ new Set();
   typedEventHandlers = /* @__PURE__ */ new Map();
   toolHandlers = /* @__PURE__ */ new Map();
@@ -9243,6 +9291,14 @@ var CopilotSession = class {
   get workspacePath() {
     return this._workspacePath;
   }
+  /** Recovery observed while loading this session; undefined on a clean resume. */
+  get transcriptRecovery() {
+    return this._transcriptRecovery;
+  }
+  /** @internal */
+  setTranscriptRecovery(recovery) {
+    this._transcriptRecovery = recovery;
+  }
   /**
    * Host capabilities reported when the session was created or resumed.
    * Use this to check feature support before calling capability-gated APIs.
@@ -11447,6 +11503,7 @@ var CopilotClient = class _CopilotClient {
   requestAdapter = null;
   messageWriter = null;
   connectionClosed = false;
+  connectionEpoch = 0;
   socket = null;
   runtimePort = null;
   actualHost = "localhost";
@@ -11856,6 +11913,7 @@ var CopilotClient = class _CopilotClient {
   }
   async doStart() {
     this.forceStopping = false;
+    this.connectionEpoch++;
     this.connectionClosed = false;
     this.processTransportError = null;
     this.state = "connecting";
@@ -11891,6 +11949,9 @@ var CopilotClient = class _CopilotClient {
       if (this.requestHandler) {
         await this.connection.sendRequest("llmInference.setProvider", {});
       }
+      if (this.connectionClosed) {
+        throw new Error("CLI server connection closed during startup");
+      }
       this.state = "connected";
     } catch (error) {
       const startupError = this.processTransportError ?? error;
@@ -12010,10 +12071,23 @@ var CopilotClient = class _CopilotClient {
       this.socket = null;
       try {
         if (!socket.destroyed) {
-          await new Promise((resolve22) => {
-            socket.once("close", () => resolve22());
-            socket.end();
-          });
+          let timeout;
+          try {
+            await new Promise((resolve22) => {
+              socket.once("close", () => resolve22());
+              if (this.connectionClosed) {
+                socket.destroy();
+              } else {
+                timeout = setTimeout(
+                  () => socket.destroy(),
+                  RUNTIME_SHUTDOWN_TIMEOUT_MS
+                );
+                socket.end();
+              }
+            });
+          } finally {
+            if (timeout !== void 0) clearTimeout(timeout);
+          }
         }
       } catch (error) {
         errors.push(
@@ -12676,6 +12750,7 @@ var CopilotClient = class _CopilotClient {
         allowedModels: config.allowedModels,
         ...await getTraceContext(this.onGetTraceContext),
         sessionId,
+        allowTranscriptRecovery: config.allowTranscriptRecovery,
         clientName: config.clientName,
         model: config.model,
         reasoningEffort: config.reasoningEffort,
@@ -12782,10 +12857,11 @@ var CopilotClient = class _CopilotClient {
           }
         }
       }
-      const { workspacePath, capabilities, openCanvases } = response;
+      const { workspacePath, capabilities, openCanvases, transcriptRecovery } = response;
       session["_workspacePath"] = workspacePath;
       session.setCapabilities(capabilities);
       session.setOpenCanvases(openCanvases ?? []);
+      session.setTranscriptRecovery(transcriptRecovery);
       if (config.onMcpAuthRequest) {
         await this.connection.sendRequest("session.eventLog.registerInterest", {
           sessionId,
@@ -13774,8 +13850,13 @@ stderr: ${stderrOutput}` : ""}`
     );
     const connection = this.connection;
     const messageWriter = this.messageWriter;
+    const cliProcess = this.isExternalServer ? null : this.cliProcess;
+    const connectionEpoch = this.connectionEpoch;
+    const isCurrentConnection = () => connectionEpoch === this.connectionEpoch && this.connection === connection && (cliProcess === null || this.cliProcess === cliProcess);
+    let disconnecting = false;
+    let exitFallback;
     const markDisconnected = () => {
-      if (this.connection !== connection) {
+      if (!isCurrentConnection()) {
         connection.dispose();
         return;
       }
@@ -13789,13 +13870,48 @@ stderr: ${stderrOutput}` : ""}`
       this.githubTokenProviders.clear();
       this.requestAdapter?.cancelPending();
       connection.dispose();
+      this.socket?.destroy();
+      this.connection = null;
+      this.messageWriter = null;
+      this._rpc = null;
+      this._internalRpc = null;
+      this.modelsCache = null;
     };
-    this.connection.onClose(() => {
+    const disconnectAfterDrain = () => {
+      if (exitFallback !== void 0) {
+        clearTimeout(exitFallback);
+        exitFallback = void 0;
+      }
+      if (!isCurrentConnection()) {
+        connection.dispose();
+        return;
+      }
+      if (disconnecting) return;
+      disconnecting = true;
+      this.connectionClosed = true;
       if (messageWriter) messageWriter.suppressWriteErrors = true;
       void connection.drain().then(markDisconnected);
-    });
+    };
+    this.connection.onClose(disconnectAfterDrain);
+    if (cliProcess) {
+      cliProcess.once("exit", () => {
+        if (!isCurrentConnection()) {
+          connection.dispose();
+          return;
+        }
+        if (disconnecting) return;
+        if (this.socket) {
+          disconnectAfterDrain();
+          return;
+        }
+        this.connectionClosed = true;
+        if (messageWriter) messageWriter.suppressWriteErrors = true;
+        exitFallback = setTimeout(disconnectAfterDrain, RUNTIME_SHUTDOWN_TIMEOUT_MS);
+        exitFallback.unref();
+      });
+    }
     this.connection.onError(() => {
-      if (this.connection === connection) {
+      if (connectionEpoch === this.connectionEpoch && this.connection === connection) {
         this.state = "disconnected";
       }
     });

package/copilot-sdk/session.d.ts

@@ -1,7 +1,7 @@
 import { createSessionRpc } from "./generated/rpc.js";
 import type { ModelSwitchAutoTierResult } from "./generated/rpc.js";
 import type { OpenCanvasInstance } from "./generated/rpc.js";
-import type { MessageOptions, ResponseSchema, ContextTier, ReasoningEffort, ReasoningSummary, AutoTier, ModelCapabilitiesOverride, SessionCapabilities, SessionEvent, SessionEventHandler, SessionEventType, SessionUiApi, TypedSessionEventHandler } from "./types.js";
+import type { MessageOptions, ResponseSchema, ContextTier, ReasoningEffort, ReasoningSummary, AutoTier, ModelCapabilitiesOverride, SessionCapabilities, SessionEvent, SessionEventHandler, SessionEventType, SessionUiApi, TranscriptRecovery, TypedSessionEventHandler } from "./types.js";
 import { type SessionWorkflowApi } from "./workflow.js";
 /** Assistant message event - the final response from the assistant. */
 export type AssistantMessageEvent = Extract<SessionEvent, {
@@ -41,6 +41,7 @@ export declare class CopilotSession {
     readonly sessionId: string;
     private connection;
     private _workspacePath?;
+    private _transcriptRecovery?;
     private eventHandlers;
     private typedEventHandlers;
     private toolHandlers;
@@ -97,6 +98,8 @@ export declare class CopilotSession {
      * Undefined if infinite sessions are disabled.
      */
     get workspacePath(): string | undefined;
+    /** Recovery observed while loading this session; undefined on a clean resume. */
+    get transcriptRecovery(): TranscriptRecovery | undefined;
     /**
      * Host capabilities reported when the session was created or resumed.
      * Use this to check feature support before calling capability-gated APIs.

package/copilot-sdk/types.d.ts

@@ -14,7 +14,7 @@ import type { ToolSet } from "./toolSet.js";
 export type { RemoteSessionMode } from "./generated/rpc.js";
 export type { CurrentToolMetadata } from "./generated/rpc.js";
 export type { SandboxConfigSource } from "./generated/rpc.js";
-export type { ConnectorAccountRequest, ConnectorAvailability, ConnectorCapabilities, ConnectorCatalogEntry, ConnectorCatalogResult, ConnectorCatalogStatus, ConnectorConnectRequest, ConnectorConnectResult, ConnectorContinueRequest, ConnectorDisconnectResult, ConnectorMcpStatus, ConnectorReconcileRequest, ConnectorRuntimeStatus, ConnectorStatus, ExtensionLaunchProfile, ExtensionLaunchProviderResolveRequest, ExtensionLaunchProviderResolveResult, GitHubTokenAcquireReason, GitHubTokenAcquireResult, GitHubTelemetryNotification, GitHubTelemetryEvent, GitHubTelemetryClientInfo, InstallationConfirmationRequest, InstallationConfirmationResponse, InstallationDecision, InstallationReview, McpInstallationReview, } from "./generated/rpc.js";
+export type { AuthIdentityMetadata, AuthInfoType, ConnectorAccountRequest, ConnectorAvailability, ConnectorCapabilities, ConnectorCatalogEntry, ConnectorCatalogResult, ConnectorCatalogStatus, ConnectorConnectRequest, ConnectorConnectResult, ConnectorContinueRequest, ConnectorDisconnectResult, ConnectorMcpStatus, ConnectorReconcileRequest, ConnectorRuntimeStatus, ConnectorSessionAccount, ConnectorSessionAccountResult, ConnectorStatus, ExtensionLaunchProfile, ExtensionLaunchProviderResolveRequest, ExtensionLaunchProviderResolveResult, GitHubTokenAcquireReason, GitHubTokenAcquireResult, GitHubTelemetryNotification, GitHubTelemetryEvent, GitHubTelemetryClientInfo, InstallationConfirmationRequest, InstallationConfirmationResponse, InstallationDecision, InstallationReview, McpInstallationReview, } from "./generated/rpc.js";
 /**
  * Arguments passed to a session's {@link GitHubTokenProvider}.
  *
@@ -2444,6 +2444,11 @@ export interface SessionConfig extends SessionConfigBase {
  * {@link CopilotClient.resumeSession}.
  */
 export interface ResumeSessionConfig extends SessionConfigBase {
+    /**
+     * Allow the runtime to recover a damaged transcript during resume.
+     * Defaults to true in all modes. Set false to reject recovery.
+     */
+    allowTranscriptRecovery?: boolean;
     /**
      * When true, skips emitting the session.resume event.
      * Useful for reconnecting to a session without triggering resume-related side effects.
@@ -2453,7 +2458,8 @@ export interface ResumeSessionConfig extends SessionConfigBase {
     /**
      * When true, the runtime continues any tool calls or permission prompts that were
      * still pending when the session was last suspended. When false (the default), the
-     * runtime treats pending work as interrupted on resume.
+     * runtime treats pending work as interrupted on resume. Completed tool results
+     * already durably recorded by the runtime are preserved.
      *
      * For permission requests, the runtime re-emits `permission.requested` so the
      * registered `onPermissionRequest` handler can re-prompt; for external tool calls,
@@ -2469,6 +2475,15 @@ export interface ResumeSessionConfig extends SessionConfigBase {
      */
     openCanvases?: OpenCanvasInstance[];
 }
+/** Transcript repair proposed during the most recent resume. */
+export interface TranscriptRecovery {
+    /** Planned backup path; the backup is written on the next append. */
+    plannedBackupPath: string;
+    /** One-based physical line numbers removed from the transcript. */
+    invalidLineNumbers: number[];
+    /** Whether an existing session.start event was moved to the beginning. */
+    sessionStartMoved: boolean;
+}
 /**
  * Arguments passed to a {@link BearerTokenProvider} callback when the runtime needs a
  * fresh bearer token for a BYOK provider.

package/package.json

@@ -1,10 +1,11 @@
 {
     "name": "@github/copilot-sdk-darwin-arm64",
-    "version": "1.0.16-preview.0",
+    "version": "1.0.17-preview.0",
     "description": "Platform runtime for @github/copilot-sdk (darwin-arm64)",
     "repository": {
         "type": "git",
-        "url": "https://github.com/github/copilot-sdk.git"
+        "url": "https://github.com/github/copilot-agent-runtime.git",
+        "directory": "src/sdk/nodejs"
     },
     "license": "MIT",
     "os": [

package/prebuilds/darwin-arm64/runtime.node

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/prebuilds/darwin-arm64/runtime.node
-size: 86098368 bytes
-sha256: 3774727ad123c561c9f719c8dd1e753a393cf0b8ea3b6690ee397a9182c0b267
+size: 86328976 bytes
+sha256: da2170c8c398ca6f7bb93f752e1b982209e05f57b6d8f6c3ed34511caf9d622b