@github/copilot-sdk-darwin-x64 1.0.13 → 1.0.14-preview.1

package/schemas/session-events.schema.json

@@ -1755,6 +1755,10 @@
     "AssistantUsageCopilotUsage": {
       "type": "object",
       "properties": {
+        "model": {
+          "type": "string",
+          "description": "Default billing model for token details that do not identify their own model"
+        },
         "tokenDetails": {
           "type": "array",
           "items": {
@@ -1790,6 +1794,10 @@
           "minimum": 0,
           "description": "Cost per batch of tokens"
         },
+        "model": {
+          "type": "string",
+          "description": "Model responsible for this billing entry"
+        },
         "tokenCount": {
           "type": "integer",
           "minimum": 0,
@@ -3424,16 +3432,91 @@
       "enum": [
         "efficiency",
         "balance",
-        "intelligence"
+        "intelligence",
+        "fast"
       ],
-      "description": "Routing preference used when the session model is `auto`.",
+      "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference.",
       "title": "AutoTier",
       "x-enumDescriptions": {
         "efficiency": "Optimize for efficiency.",
         "balance": "Balance efficiency and intelligence.",
-        "intelligence": "Optimize for intelligence."
+        "intelligence": "Optimize for intelligence.",
+        "fast": "Integrator-only preset that optimizes for latency."
       }
     },
+    "AutoTierRecommendationData": {
+      "type": "object",
+      "properties": {
+        "recommendedAutoTier": {
+          "$ref": "#/definitions/RecommendedAutoTier",
+          "description": "Recommended Auto preference."
+        }
+      },
+      "required": [
+        "recommendedAutoTier"
+      ],
+      "additionalProperties": false,
+      "description": "Live-only Auto preference recommendation from Copilot API after a successful Auto model call.",
+      "title": "AutoTierRecommendationData",
+      "stability": "experimental"
+    },
+    "AutoTierRecommendationEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "const": true,
+          "description": "Always true for events that are transient and not persisted to the session event log on disk."
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "session.auto_tier_recommendation",
+          "description": "Type discriminator. Always \"session.auto_tier_recommendation\"."
+        },
+        "data": {
+          "$ref": "#/definitions/AutoTierRecommendationData",
+          "description": "Live-only Auto preference recommendation from Copilot API after a successful Auto model call."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "ephemeral",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"session.auto_tier_recommendation\". Live-only Auto preference recommendation from Copilot API after a successful Auto model call.",
+      "title": "AutoTierRecommendationEvent",
+      "stability": "experimental"
+    },
     "AutoTierSwitchFailedData": {
       "type": "object",
       "properties": {
@@ -3445,7 +3528,7 @@
           "anyOf": [
             {
               "$ref": "#/definitions/AutoTier",
-              "description": "Routing preference used when the session model is `auto`."
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
             },
             {
               "type": "null"
@@ -5112,6 +5195,11 @@
     "CompactionCompleteCompactionTokensUsedCopilotUsage": {
       "type": "object",
       "properties": {
+        "model": {
+          "type": "string",
+          "description": "Default billing model for token details that do not identify their own model",
+          "visibility": "internal"
+        },
         "tokenDetails": {
           "type": "array",
           "items": {
@@ -5148,6 +5236,10 @@
           "minimum": 0,
           "description": "Cost per batch of tokens"
         },
+        "model": {
+          "type": "string",
+          "description": "Model responsible for this billing entry"
+        },
         "tokenCount": {
           "type": "integer",
           "minimum": 0,
@@ -5212,6 +5304,11 @@
           "type": "string",
           "description": "LLM-generated summary of the compacted conversation history"
         },
+        "activeFactorySummary": {
+          "type": "string",
+          "description": "Authoritative active-factory reminder appended to the compacted context",
+          "visibility": "internal"
+        },
         "behaviorModelId": {
           "type": "string",
           "description": "Canonical model identifier used for model-specific behavior when replaying compaction"
@@ -5815,6 +5912,10 @@
           "type": "boolean",
           "description": "Whether the agent can be selected by the user"
         },
+        "disableModelInvocation": {
+          "type": "boolean",
+          "description": "Whether model-driven invocation is disabled for this agent."
+        },
         "model": {
           "type": "string",
           "description": "Model override for this agent, if set"
@@ -7170,6 +7271,7 @@
       "enum": [
         "completed",
         "halted",
+        "paused",
         "cancelled",
         "error"
       ],
@@ -7178,6 +7280,7 @@
       "x-enumDescriptions": {
         "completed": "The factory body resolved and its result was committed.",
         "halted": "The run was stopped by a limit, an approval refusal or another policy decision.",
+        "paused": "The attempt paused intentionally while preserving resumable run state.",
         "cancelled": "The run was cancelled by its caller or by session disposal.",
         "error": "The run failed, with `failureType` carrying the class when it has one."
       }
@@ -11503,7 +11606,7 @@
           "anyOf": [
             {
               "$ref": "#/definitions/AutoTier",
-              "description": "Routing preference used when the session model is `auto`."
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
             },
             {
               "type": "null"
@@ -11932,6 +12035,96 @@
       "description": "Permission response variant indicating the request was cancelled before use, with an optional reason.",
       "title": "PermissionCancelled"
     },
+    "PermissionCarriedForwardData": {
+      "type": "object",
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "description": "Authorization edge minted for this admission. Not a prompt id: no prompt was raised, so no client should expect a request with this id.",
+          "stability": "experimental"
+        },
+        "toolCallId": {
+          "type": "string",
+          "description": "Tool call this admission authorizes. Its execution receipts the prior grant, which is how a single-effect approval is spent rather than carried forward again.",
+          "stability": "experimental"
+        },
+        "recordId": {
+          "type": "string",
+          "description": "Identity of the prior authorization record that contained the proposal.",
+          "stability": "experimental"
+        },
+        "decisionSource": {
+          "$ref": "#/definitions/PermissionDecisionSource",
+          "description": "Always `authorization_carry_forward`. Stated explicitly so a consumer reading this event cannot mistake it for a human, host-policy, or assisted-approval decision.",
+          "stability": "experimental"
+        }
+      },
+      "required": [
+        "requestId",
+        "toolCallId",
+        "recordId",
+        "decisionSource"
+      ],
+      "additionalProperties": false,
+      "description": "Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.",
+      "title": "PermissionCarriedForwardData",
+      "stability": "experimental"
+    },
+    "PermissionCarriedForwardEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "description": "When true, the event is transient and not persisted to the session event log on disk"
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "permission.carriedForward",
+          "description": "Type discriminator. Always \"permission.carriedForward\"."
+        },
+        "data": {
+          "$ref": "#/definitions/PermissionCarriedForwardData",
+          "description": "Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"permission.carriedForward\". Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.",
+      "title": "PermissionCarriedForwardEvent",
+      "stability": "experimental"
+    },
     "PermissionCompletedData": {
       "type": "object",
       "properties": {
@@ -11946,6 +12139,11 @@
         "result": {
           "$ref": "#/definitions/PermissionResult",
           "description": "The result of the permission request"
+        },
+        "decisionSource": {
+          "$ref": "#/definitions/PermissionDecisionSource",
+          "description": "Who decided this permission request. Absent on completions recorded before this field existed, which consumers must treat as \"not a human decision\" rather than assuming one. Authorization records are minted only for `human_response`; an assisted-approval verdict, a host policy, an unattended fallback, and a hook resolution all produce the same `result` a person does, so this is the only field that distinguishes them.",
+          "stability": "experimental"
         }
       },
       "required": [
@@ -12010,6 +12208,25 @@
       "description": "Session event \"permission.completed\". Permission request completion notification signaling UI dismissal",
       "title": "PermissionCompletedEvent"
     },
+    "PermissionDecisionSource": {
+      "type": "string",
+      "enum": [
+        "assisted_approval",
+        "human_response",
+        "host_policy",
+        "unattended_fallback",
+        "authorization_carry_forward"
+      ],
+      "description": "Controlled reason or actor responsible for a permission response.",
+      "title": "PermissionDecisionSource",
+      "x-enumDescriptions": {
+        "assisted_approval": "The response followed the assisted-approval judge recommendation.",
+        "human_response": "A human supplied the response through an interactive prompt.",
+        "host_policy": "The host applied a standing policy or override rather than a judge recommendation or human decision.",
+        "unattended_fallback": "The host denied the request because no interactive user response was available.",
+        "authorization_carry_forward": "A live authorization record from an earlier human decision in this session contained the proposal, so it ran without another prompt. This is not a new human decision and never mints authority of its own."
+      }
+    },
     "PermissionDeniedByContentExclusionPolicy": {
       "type": "object",
       "properties": {
@@ -12125,84 +12342,368 @@
       "description": "Permission response variant denied because no approval rule matched and user confirmation was unavailable.",
       "title": "PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser"
     },
-    "PermissionMode": {
-      "type": "string",
-      "enum": [
-        "manual",
-        "assisted",
-        "allow-all"
-      ],
-      "description": "Permission mode for the session.",
-      "title": "PermissionMode",
-      "x-enumDescriptions": {
-        "manual": "Permission requests follow the normal approval flow.",
-        "assisted": "Permission requests include an LLM safety recommendation; clients may automatically approve requests judged acceptable.",
-        "allow-all": "Tool, path, and URL permission requests are automatically approved."
-      },
-      "stability": "experimental"
-    },
-    "PermissionPromptRequest": {
-      "anyOf": [
-        {
-          "$ref": "#/definitions/PermissionPromptRequestCommands",
-          "description": "Shell command permission prompt"
-        },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestWrite",
-          "description": "File write permission prompt"
-        },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestRead",
-          "description": "File read permission prompt"
-        },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestMcp",
-          "description": "MCP tool invocation permission prompt"
-        },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestUrl",
-          "description": "URL access permission prompt"
+    "PermissionMessageAuthorizationData": {
+      "type": "object",
+      "properties": {
+        "recordId": {
+          "type": "string",
+          "description": "Deterministic identity of the record, derived from the turn and span offsets so re-extracting the same span mints nothing new.",
+          "stability": "experimental"
         },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestMemory",
-          "description": "Memory operation permission prompt"
+        "turnIndex": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The human turn the quoted span was read from.",
+          "stability": "experimental"
         },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestCustomTool",
-          "description": "Custom tool invocation permission prompt"
+        "polarity": {
+          "$ref": "#/definitions/PermissionMessageAuthorizationPolarity",
+          "description": "Whether the claim granted or denied authority.",
+          "stability": "experimental"
         },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestPath",
-          "description": "Path access permission prompt"
+        "actionClass": {
+          "type": "string",
+          "description": "The kind of effect authorized, as an action-class identifier.",
+          "stability": "experimental"
         },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestHook",
-          "description": "Hook confirmation permission prompt"
+        "spanStart": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Start byte offset of the authorizing span within the turn.",
+          "stability": "experimental"
         },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestExtensionManagement",
-          "description": "Extension management permission prompt"
+        "spanEnd": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "End byte offset of the authorizing span within the turn.",
+          "stability": "experimental"
         },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestFactory",
-          "description": "Factory run or authoring permission prompt"
+        "targetMembers": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "default": [],
+          "description": "Concrete named targets that appear verbatim inside the span.",
+          "stability": "experimental"
         },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestExtensionPermissionAccess",
-          "description": "Extension permission access prompt"
+        "task": {
+          "type": "string",
+          "description": "The task the permission is scoped to, when the human named one.",
+          "stability": "experimental"
         },
-        {
-          "$ref": "#/definitions/PermissionPromptRequestExtensionEnvAccess",
-          "description": "Extension sensitive environment variable access prompt"
+        "world": {
+          "description": "The trusted version discriminator, when one exists. Exact shell-command grants carry the byte-identical commands grounded in the human span; world-derived classes carry a file object, remote tip, or runner only when that state was captured safely. An opaque object mirroring the runtime's adjacently-tagged resolution.",
+          "x-opaque-json": true,
+          "stability": "experimental"
         }
+      },
+      "required": [
+        "recordId",
+        "turnIndex",
+        "polarity",
+        "actionClass",
+        "spanStart",
+        "spanEnd"
       ],
-      "description": "Derived user-facing permission prompt details for UI consumers",
-      "title": "PermissionPromptRequest"
+      "additionalProperties": false,
+      "description": "Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.",
+      "title": "PermissionMessageAuthorizationData",
+      "stability": "experimental"
     },
-    "PermissionPromptRequestCommands": {
+    "PermissionMessageAuthorizationDegradedData": {
       "type": "object",
       "properties": {
-        "kind": {
+        "turnIndex": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The human turn that could not be represented safely.",
+          "stability": "experimental"
+        }
+      },
+      "required": [
+        "turnIndex"
+      ],
+      "additionalProperties": false,
+      "description": "Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.",
+      "title": "PermissionMessageAuthorizationDegradedData",
+      "stability": "experimental"
+    },
+    "PermissionMessageAuthorizationDegradedEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "description": "When true, the event is transient and not persisted to the session event log on disk"
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "permission.messageAuthorizationDegraded",
+          "description": "Type discriminator. Always \"permission.messageAuthorizationDegraded\"."
+        },
+        "data": {
+          "$ref": "#/definitions/PermissionMessageAuthorizationDegradedData",
+          "description": "Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"permission.messageAuthorizationDegraded\". Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.",
+      "title": "PermissionMessageAuthorizationDegradedEvent",
+      "stability": "experimental"
+    },
+    "PermissionMessageAuthorizationEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "description": "When true, the event is transient and not persisted to the session event log on disk"
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "permission.messageAuthorization",
+          "description": "Type discriminator. Always \"permission.messageAuthorization\"."
+        },
+        "data": {
+          "$ref": "#/definitions/PermissionMessageAuthorizationData",
+          "description": "Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"permission.messageAuthorization\". Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.",
+      "title": "PermissionMessageAuthorizationEvent",
+      "stability": "experimental"
+    },
+    "PermissionMessageAuthorizationPolarity": {
+      "type": "string",
+      "enum": [
+        "grant",
+        "denial"
+      ],
+      "description": "Which direction a message-backed authorization claim moves authority in.",
+      "title": "PermissionMessageAuthorizationPolarity",
+      "x-enumDescriptions": {
+        "grant": "The human's words authorized an effect.",
+        "denial": "The human's words refused an effect."
+      },
+      "stability": "experimental"
+    },
+    "PermissionMessageAuthorizationReadData": {
+      "type": "object",
+      "properties": {
+        "turnIndex": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "The human turn that was read by the proposer.",
+          "stability": "experimental"
+        }
+      },
+      "required": [
+        "turnIndex"
+      ],
+      "additionalProperties": false,
+      "description": "Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.",
+      "title": "PermissionMessageAuthorizationReadData",
+      "stability": "experimental"
+    },
+    "PermissionMessageAuthorizationReadEvent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "uuid",
+          "description": "Unique event identifier (UUID v4), generated when the event is emitted"
+        },
+        "timestamp": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the event was created"
+        },
+        "parentId": {
+          "anyOf": [
+            {
+              "type": "string",
+              "format": "uuid"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event."
+        },
+        "ephemeral": {
+          "type": "boolean",
+          "description": "When true, the event is transient and not persisted to the session event log on disk"
+        },
+        "agentId": {
+          "type": "string",
+          "description": "Sub-agent instance identifier. Absent for events from the root/main agent and session-level events."
+        },
+        "type": {
+          "type": "string",
+          "const": "permission.messageAuthorizationRead",
+          "description": "Type discriminator. Always \"permission.messageAuthorizationRead\"."
+        },
+        "data": {
+          "$ref": "#/definitions/PermissionMessageAuthorizationReadData",
+          "description": "Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism."
+        }
+      },
+      "required": [
+        "id",
+        "timestamp",
+        "parentId",
+        "type",
+        "data"
+      ],
+      "additionalProperties": false,
+      "description": "Session event \"permission.messageAuthorizationRead\". Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.",
+      "title": "PermissionMessageAuthorizationReadEvent",
+      "stability": "experimental"
+    },
+    "PermissionMode": {
+      "type": "string",
+      "enum": [
+        "manual",
+        "assisted",
+        "allow-all"
+      ],
+      "description": "Permission mode for the session.",
+      "title": "PermissionMode",
+      "x-enumDescriptions": {
+        "manual": "Permission requests follow the normal approval flow.",
+        "assisted": "Permission requests include an LLM safety recommendation; clients may automatically approve requests judged acceptable.",
+        "allow-all": "Tool, path, and URL permission requests are automatically approved."
+      },
+      "stability": "experimental"
+    },
+    "PermissionPromptRequest": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/PermissionPromptRequestCommands",
+          "description": "Shell command permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestWrite",
+          "description": "File write permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestRead",
+          "description": "File read permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestMcp",
+          "description": "MCP tool invocation permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestUrl",
+          "description": "URL access permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestMemory",
+          "description": "Memory operation permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestCustomTool",
+          "description": "Custom tool invocation permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestPath",
+          "description": "Path access permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestHook",
+          "description": "Hook confirmation permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestExtensionManagement",
+          "description": "Extension management permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestFactory",
+          "description": "Factory run or authoring permission prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestExtensionPermissionAccess",
+          "description": "Extension permission access prompt"
+        },
+        {
+          "$ref": "#/definitions/PermissionPromptRequestExtensionEnvAccess",
+          "description": "Extension sensitive environment variable access prompt"
+        }
+      ],
+      "description": "Derived user-facing permission prompt details for UI consumers",
+      "title": "PermissionPromptRequest"
+    },
+    "PermissionPromptRequestCommands": {
+      "type": "object",
+      "properties": {
+        "kind": {
           "type": "string",
           "const": "commands",
           "description": "Prompt kind discriminator"
@@ -12242,6 +12743,18 @@
         "managedApprovalRequired": {
           "type": "boolean",
           "description": "Whether managed policy requires a human response and forbids host auto-approval"
+        },
+        "requestSandboxBypass": {
+          "type": "boolean",
+          "description": "True when the shell command is requesting sandbox escalation. This is a request, not a grant."
+        },
+        "requestSandboxPermissive": {
+          "type": "boolean",
+          "description": "True when the escalation is a permissive retry that keeps the sandbox and network policy attached while recording file and process accesses instead of blocking them."
+        },
+        "requestSandboxBypassReason": {
+          "type": "string",
+          "description": "Reason for the sandbox escalation request."
         }
       },
       "required": [
@@ -12718,6 +13231,11 @@
           "type": "string",
           "description": "Path of the file or directory being read"
         },
+        "resolvedPath": {
+          "type": "string",
+          "description": "Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.",
+          "stability": "experimental"
+        },
         "assistedApproval": {
           "$ref": "#/definitions/PermissionAssistedApproval",
           "description": "Assisted-approval judge information for this request; present only in assisted mode.",
@@ -12808,6 +13326,11 @@
           "type": "string",
           "description": "Path of the file being written to"
         },
+        "resolvedPath": {
+          "type": "string",
+          "description": "Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.",
+          "stability": "experimental"
+        },
         "diff": {
           "type": "string",
           "description": "Unified diff showing the proposed changes"
@@ -13425,6 +13948,11 @@
           "type": "string",
           "description": "Path of the file or directory being read"
         },
+        "resolvedPath": {
+          "type": "string",
+          "description": "Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.",
+          "stability": "experimental"
+        },
         "requestSandboxBypass": {
           "type": "boolean",
           "description": "True when the tool is asking to re-run this search outside the sandbox, after a sandboxed run looked blocked (host opted in via sandbox.allowBypass). The model cannot ask for this; only the tool raises it. This is a request, not a grant: the search runs unsandboxed only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
@@ -13490,6 +14018,19 @@
           },
           "description": "File paths that may be read or written by the command"
         },
+        "resolvedWorkingDirectory": {
+          "type": "string",
+          "description": "Runtime-resolved canonical working directory the command runs in, used for authorization identity checks. Internal and experimental; clients should not display it.",
+          "stability": "experimental"
+        },
+        "resolvedPaths": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "Runtime-resolved canonical object each possiblePaths entry names, keyed by the requested spelling, used for authorization identity checks. Internal and experimental; clients should continue to display possiblePaths.",
+          "stability": "experimental"
+        },
         "possibleUrls": {
           "type": "array",
           "items": {
@@ -13514,6 +14055,10 @@
           "type": "boolean",
           "description": "True when the tool is asking to run this command outside the sandbox, either because the command detaches and cannot be sandboxed at all, or because a sandboxed run looked blocked (host opted in via sandbox.allowBypass). The model cannot ask for this; only the tool raises it. This is a request, not a grant: the command runs unsandboxed only if the user approves this permission request. Hosts should highlight the elevated risk in the approval UI."
         },
+        "requestSandboxPermissive": {
+          "type": "boolean",
+          "description": "True when the requested escalation is a permissive retry rather than a full bypass: the command re-runs inside the sandbox with its file and process restrictions recording instead of blocking, while the network policy stays enforced. Always accompanied by requestSandboxBypass, so hosts that do not recognize this field still treat the request as the escalation it is. Hosts that do recognize it must not describe the command as running outside the sandbox, which would overstate the privilege being granted."
+        },
         "requestSandboxBypassReason": {
           "type": "string",
           "description": "What the tool tells the user about the bypass on offer: which policy rule blocked the call, or why it cannot be sandboxed. Only meaningful when requestSandboxBypass is true."
@@ -13658,6 +14203,11 @@
           "type": "string",
           "description": "Path of the file being written to"
         },
+        "resolvedPath": {
+          "type": "string",
+          "description": "Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.",
+          "stability": "experimental"
+        },
         "diff": {
           "type": "string",
           "description": "Unified diff showing the proposed changes"
@@ -13774,10 +14324,6 @@
           "stability": "experimental"
         }
       },
-      "required": [
-        "previousMode",
-        "mode"
-      ],
       "additionalProperties": false,
       "description": "Permission-mode transition details.",
       "title": "PermissionsChangedData",
@@ -14234,6 +14780,21 @@
         "detailed": "Request a detailed summary of the model's reasoning."
       }
     },
+    "RecommendedAutoTier": {
+      "type": "string",
+      "enum": [
+        "efficiency",
+        "balance",
+        "intelligence"
+      ],
+      "description": "Auto preferences that Copilot API can recommend.",
+      "title": "RecommendedAutoTier",
+      "x-enumDescriptions": {
+        "efficiency": "Optimize for efficiency.",
+        "balance": "Balance efficiency and intelligence.",
+        "intelligence": "Optimize for intelligence."
+      }
+    },
     "RemediationAction": {
       "type": "string",
       "enum": [
@@ -14827,51 +15388,200 @@
           "properties": {
             "control": {
               "$ref": "#/definitions/SandboxControl",
-              "description": "Enforcement mechanism this decision describes"
+              "description": "Enforcement mechanism this decision describes"
+            },
+            "outcome": {
+              "$ref": "#/definitions/SandboxOutcome",
+              "description": "Whether the sandboxed process launched under the named backend. Not the exit status of the command that ran inside it."
+            },
+            "toolCallId": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Internal tool-call ID, used only to correlate the decision with its owning span. Omitted when the decision is not attributable to a tool call."
+            },
+            "platform": {
+              "$ref": "#/definitions/SandboxPlatform",
+              "description": "Host platform the sandbox is running on"
+            },
+            "backend": {
+              "$ref": "#/definitions/SandboxBackend",
+              "description": "Process-containment implementation backing the sandbox"
+            },
+            "enforcementPoint": {
+              "$ref": "#/definitions/SandboxEnforcementPoint",
+              "description": "Runtime subsystem that applied the policy"
+            },
+            "durationMs": {
+              "type": "number",
+              "minimum": 0,
+              "description": "Wall-clock time spent spawning the sandboxed process, in milliseconds"
+            },
+            "degradationReason": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDegradationReason",
+                  "description": "Finite reason why sandbox enforcement is weaker than configured"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Why enforcement is weaker than configured, when it is"
+            },
+            "kind": {
+              "type": "string",
+              "const": "spawn_completed",
+              "description": "Sandbox decision variant discriminator."
+            }
+          },
+          "required": [
+            "kind",
+            "control",
+            "outcome",
+            "platform",
+            "backend",
+            "enforcementPoint",
+            "durationMs"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "control": {
+              "$ref": "#/definitions/SandboxControl",
+              "description": "Enforcement mechanism this decision describes"
+            },
+            "outcome": {
+              "$ref": "#/definitions/SandboxOutcome",
+              "description": "Observed enforcement state: `engaged`, `inactive`, or `failed`. Derived from runtime evidence, never from the configured posture or the compile-time target platform."
+            },
+            "toolCallId": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Internal tool-call ID, used only to correlate the decision with its owning span. Omitted when the decision is not attributable to a tool call."
+            },
+            "platform": {
+              "$ref": "#/definitions/SandboxPlatform",
+              "description": "Host platform the sandbox is running on"
+            },
+            "backend": {
+              "$ref": "#/definitions/SandboxBackend",
+              "description": "Containment backend that engaged. `unsupported` for any state other than `engaged`, since no backend is known to have run."
+            },
+            "enforcementPoint": {
+              "$ref": "#/definitions/SandboxEnforcementPoint",
+              "description": "Runtime subsystem whose enforcement this describes"
+            },
+            "attestation": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxAttestation",
+                  "description": "Runtime observation backing an enforcement-state or denial claim. Absent on `enforcement_state` when no observation backs the state."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Runtime observation backing the state. Omitted for `inactive`, which has nothing to attest."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command the enforcement governed. Populated only when content capture is enabled, and only for shell commands; MCP, LSP, and search command lines are runtime plumbing."
+            },
+            "kind": {
+              "type": "string",
+              "const": "enforcement_state",
+              "description": "Sandbox decision variant discriminator."
+            }
+          },
+          "required": [
+            "kind",
+            "control",
+            "outcome",
+            "platform",
+            "backend",
+            "enforcementPoint"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "control": {
+              "$ref": "#/definitions/SandboxControl",
+              "description": "Sandbox control the denial belongs to. Follows from `denialClass`."
             },
             "outcome": {
               "$ref": "#/definitions/SandboxOutcome",
-              "description": "Whether the sandboxed process launched under the named backend. Not the exit status of the command that ran inside it."
+              "description": "Always `denied`."
             },
             "toolCallId": {
               "type": [
                 "string",
                 "null"
               ],
-              "description": "Internal tool-call ID, used only to correlate the decision with its owning span. Omitted when the decision is not attributable to a tool call."
+              "description": "Tool call the denial belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
             },
             "platform": {
               "$ref": "#/definitions/SandboxPlatform",
-              "description": "Host platform the sandbox is running on"
-            },
-            "backend": {
-              "$ref": "#/definitions/SandboxBackend",
-              "description": "Process-containment implementation backing the sandbox"
+              "description": "Host operating-system family"
             },
             "enforcementPoint": {
               "$ref": "#/definitions/SandboxEnforcementPoint",
-              "description": "Runtime subsystem that applied the policy"
+              "description": "Runtime subsystem that performed the check"
             },
-            "durationMs": {
-              "type": "number",
-              "minimum": 0,
-              "description": "Wall-clock time spent spawning the sandboxed process, in milliseconds"
+            "denialClass": {
+              "$ref": "#/definitions/SandboxDenialClass",
+              "description": "Bounded class of the refused access."
             },
-            "degradationReason": {
+            "attestation": {
+              "$ref": "#/definitions/SandboxAttestation",
+              "description": "Runtime observation backing the denial."
+            },
+            "confidence": {
               "anyOf": [
                 {
-                  "$ref": "#/definitions/SandboxDegradationReason",
-                  "description": "Finite reason why sandbox enforcement is weaker than configured"
+                  "$ref": "#/definitions/SandboxDenialConfidence",
+                  "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement."
                 },
                 {
                   "type": "null"
                 }
               ],
-              "description": "Why enforcement is weaker than configured, when it is"
+              "description": "How strong the evidence behind this denial is. Lets an analysis separate denials the sandbox recorded from ones inferred from output text, which otherwise look identical."
+            },
+            "deniedResource": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Resource the check refused, when identified and content capture is enabled."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command whose execution the denial arose from. Populated only when content capture is enabled."
+            },
+            "processName": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Executable image associated with the captured denial, normalized to a basename. Populated only when content capture is enabled."
             },
             "kind": {
               "type": "string",
-              "const": "spawn_completed",
+              "const": "access_denied",
               "description": "Sandbox decision variant discriminator."
             }
           },
@@ -14880,57 +15590,91 @@
             "control",
             "outcome",
             "platform",
-            "backend",
             "enforcementPoint",
-            "durationMs"
+            "denialClass",
+            "attestation"
           ],
-          "additionalProperties": false
+          "additionalProperties": false,
+          "description": "An enforcement check refused a specific access. Emitted per refusal with no deduplication, including when policy permits the caller to bypass the denial. Carries no backend: the built-in checks that produce this run in-process against the effective policy."
         },
         {
           "type": "object",
           "properties": {
             "control": {
               "$ref": "#/definitions/SandboxControl",
-              "description": "Enforcement mechanism this decision describes"
+              "description": "Always `bypass`."
             },
             "outcome": {
               "$ref": "#/definitions/SandboxOutcome",
-              "description": "Observed enforcement state: `engaged`, `inactive`, or `failed`. Derived from runtime evidence, never from the configured posture or the compile-time target platform."
+              "description": "Whether the bypass was granted: `approved` or `declined`. `declined` also covers the cases where nobody answered, since the sandboxed denial stands either way."
             },
             "toolCallId": {
               "type": [
                 "string",
                 "null"
               ],
-              "description": "Internal tool-call ID, used only to correlate the decision with its owning span. Omitted when the decision is not attributable to a tool call."
+              "description": "Tool call the decision belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
             },
             "platform": {
               "$ref": "#/definitions/SandboxPlatform",
-              "description": "Host platform the sandbox is running on"
-            },
-            "backend": {
-              "$ref": "#/definitions/SandboxBackend",
-              "description": "Containment backend that engaged. `unsupported` for any state other than `engaged`, since no backend is known to have run."
+              "description": "Host operating-system family"
             },
             "enforcementPoint": {
               "$ref": "#/definitions/SandboxEnforcementPoint",
-              "description": "Runtime subsystem whose enforcement this describes"
+              "description": "Runtime subsystem the bypass applies to"
             },
-            "attestation": {
+            "source": {
+              "$ref": "#/definitions/SandboxBypassSource",
+              "description": "Where the request originated. Orthogonal to `outcome`."
+            },
+            "denialClass": {
               "anyOf": [
                 {
-                  "$ref": "#/definitions/SandboxAttestation",
-                  "description": "Runtime observation backing an enforcement-state or denial claim. Absent on `enforcement_state` when no observation backs the state."
+                  "$ref": "#/definitions/SandboxDenialClass",
+                  "description": "Bounded class of access an enforcement check refused. Raw resources, commands, and process names accompany it only when content capture is enabled; diagnostic text and matched rules are never exported."
                 },
                 {
                   "type": "null"
                 }
               ],
-              "description": "Runtime observation backing the state. Omitted for `inactive`, which has nothing to attest."
+              "description": "Bounded class of the access whose refusal raised this escalation. Omitted for a pre-execution bypass, such as a detached command that cannot be sandboxed and therefore resolves no denial."
+            },
+            "confidence": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialConfidence",
+                  "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "How strong the evidence behind `denialClass` was. Present exactly when `denialClass` is, so a verdict that relaxed the sandbox on a guess is distinguishable from one that relaxed it on a recorded refusal. Named to match `access_denied`, which reports the same pair."
+            },
+            "deniedResource": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Resource whose refusal raised this escalation. Populated only when content capture is enabled."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command the verdict governs. Populated only when content capture is enabled."
+            },
+            "processName": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Executable image associated with the denial that raised this escalation, normalized to a basename. Populated only when content capture is enabled."
             },
             "kind": {
               "type": "string",
-              "const": "enforcement_state",
+              "const": "bypass_decided",
               "description": "Sandbox decision variant discriminator."
             }
           },
@@ -14939,28 +15683,29 @@
             "control",
             "outcome",
             "platform",
-            "backend",
-            "enforcementPoint"
+            "enforcementPoint",
+            "source"
           ],
-          "additionalProperties": false
+          "additionalProperties": false,
+          "description": "A request to run outside the process sandbox was resolved. This is what makes an `inactive` `enforcement_state` readable: without it, a command that ran unsandboxed because a person approved a bypass looks identical to one that ran unsandboxed because the session never had a sandbox. Reported only when a sandbox was in force, since bypassing a disabled sandbox bypasses nothing. Carries neither backend nor attestation: the verdict comes from the runtime's own permission flow or the local escalation prompt, not from a containment backend and not from the built-in policy check, so `source` is what records where it came from."
         },
         {
           "type": "object",
           "properties": {
             "control": {
               "$ref": "#/definitions/SandboxControl",
-              "description": "Sandbox control the denial belongs to. Follows from `denialClass`."
+              "description": "Always `process`: the process container is what this rung relaxes, and the network control is deliberately untouched."
             },
             "outcome": {
               "$ref": "#/definitions/SandboxOutcome",
-              "description": "Always `denied`."
+              "description": "Whether the permissive retry was granted: `approved` or `declined`. `declined` also covers the cases where nobody answered, since the sandboxed denial stands either way."
             },
             "toolCallId": {
               "type": [
                 "string",
                 "null"
               ],
-              "description": "Tool call the denial belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
+              "description": "Tool call the decision belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
             },
             "platform": {
               "$ref": "#/definitions/SandboxPlatform",
@@ -14968,19 +15713,60 @@
             },
             "enforcementPoint": {
               "$ref": "#/definitions/SandboxEnforcementPoint",
-              "description": "Runtime subsystem that performed the check"
+              "description": "Runtime subsystem the retry applies to"
+            },
+            "source": {
+              "$ref": "#/definitions/SandboxBypassSource",
+              "description": "Where the request originated. Orthogonal to `outcome`."
             },
             "denialClass": {
-              "$ref": "#/definitions/SandboxDenialClass",
-              "description": "Bounded class of the refused access. The only part of the denial that crosses the telemetry boundary."
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialClass",
+                  "description": "Bounded class of access an enforcement check refused. Raw resources, commands, and process names accompany it only when content capture is enabled; diagnostic text and matched rules are never exported."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Bounded class of the access whose refusal raised this escalation."
             },
-            "attestation": {
-              "$ref": "#/definitions/SandboxAttestation",
-              "description": "Runtime observation backing the denial."
+            "confidence": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialConfidence",
+                  "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "How strong the evidence behind `denialClass` was. Present exactly when `denialClass` is."
+            },
+            "deniedResource": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Resource whose refusal raised this escalation. Populated only when content capture is enabled."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command the verdict governs. Populated only when content capture is enabled."
+            },
+            "processName": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Executable image associated with the denial that raised this escalation, normalized to a basename. Populated only when content capture is enabled."
             },
             "kind": {
               "type": "string",
-              "const": "access_denied",
+              "const": "permissive_retry_decided",
               "description": "Sandbox decision variant discriminator."
             }
           },
@@ -14990,29 +15776,28 @@
             "outcome",
             "platform",
             "enforcementPoint",
-            "denialClass",
-            "attestation"
+            "source"
           ],
           "additionalProperties": false,
-          "description": "An enforcement check refused a specific access. Emitted per refusal with no deduplication, including when policy permits the caller to bypass the denial. Carries no backend: the built-in checks that produce this run in-process against the effective policy."
+          "description": "A permissive retry was resolved. Distinct from `bypass_decided` because this rung never requests a run outside the process sandbox: it relaxes the process container for one run while the sandbox, and with it the network policy, stays attached. Reported for both outcomes, so an escalation the user declined still leaves evidence that the runtime asked and that the sandboxed denial stood."
         },
         {
           "type": "object",
           "properties": {
             "control": {
               "$ref": "#/definitions/SandboxControl",
-              "description": "Always `bypass`."
+              "description": "Always `process`: the retry changes process-container enforcement while leaving network policy attached."
             },
             "outcome": {
               "$ref": "#/definitions/SandboxOutcome",
-              "description": "Whether the bypass was granted: `approved` or `declined`. `declined` also covers the cases where nobody answered, since the sandboxed denial stands either way."
+              "description": "Whether the permissive retry completed successfully: `succeeded` or `failed`."
             },
             "toolCallId": {
               "type": [
                 "string",
                 "null"
               ],
-              "description": "Tool call the decision belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
+              "description": "Tool call the completion belongs to, for span correlation only. Never exported as a telemetry attribute or metric dimension."
             },
             "platform": {
               "$ref": "#/definitions/SandboxPlatform",
@@ -15020,15 +15805,56 @@
             },
             "enforcementPoint": {
               "$ref": "#/definitions/SandboxEnforcementPoint",
-              "description": "Runtime subsystem the bypass applies to"
+              "description": "Runtime subsystem that ran the retry"
             },
-            "source": {
-              "$ref": "#/definitions/SandboxBypassSource",
-              "description": "Where the request originated. Orthogonal to `outcome`."
+            "denialClass": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialClass",
+                  "description": "Bounded class of access an enforcement check refused. Raw resources, commands, and process names accompany it only when content capture is enabled; diagnostic text and matched rules are never exported."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Bounded class of the access whose refusal raised the permissive retry."
+            },
+            "confidence": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/SandboxDenialConfidence",
+                  "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "How strong the evidence behind `denialClass` was."
+            },
+            "deniedResource": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Resource whose refusal raised the retry. Populated only when content capture is enabled."
+            },
+            "command": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Command the retry executed. Populated only when content capture is enabled."
+            },
+            "processName": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "description": "Executable image associated with the denial that raised the retry, normalized to a basename. Populated only when content capture is enabled."
             },
             "kind": {
               "type": "string",
-              "const": "bypass_decided",
+              "const": "permissive_retry_completed",
               "description": "Sandbox decision variant discriminator."
             }
           },
@@ -15037,11 +15863,10 @@
             "control",
             "outcome",
             "platform",
-            "enforcementPoint",
-            "source"
+            "enforcementPoint"
           ],
           "additionalProperties": false,
-          "description": "A request to run outside the process sandbox was resolved. This is what makes an `inactive` `enforcement_state` readable: without it, a command that ran unsandboxed because a person approved a bypass looks identical to one that ran unsandboxed because the session never had a sandbox. Reported only when a sandbox was in force, since bypassing a disabled sandbox bypasses nothing. Carries neither backend nor attestation: the verdict comes from the runtime's own permission flow or the local escalation prompt, not from a containment backend and not from the built-in policy check, so `source` is what records where it came from."
+          "description": "An approved permissive retry finished. `succeeded` means the retry exited successfully without another correlated sandbox denial; `failed` means it failed or remained blocked and may therefore be followed by a full bypass."
         }
       ],
       "description": "Payload of `sandbox.decision`, a bounded governance record of what the process sandbox was configured to do and whether it took effect. Discriminated by `kind`.",
@@ -15122,16 +15947,49 @@
       "enum": [
         "filesystem_read",
         "filesystem_write",
+        "process_startup",
+        "registry_access",
+        "ipc_access",
+        "process_access",
+        "job_access",
+        "ui_access",
+        "service_access",
         "network_outbound",
-        "network_local"
+        "network_local",
+        "other_access"
       ],
-      "description": "Bounded class of access an enforcement check refused. The only part of a denial that crosses the telemetry boundary; the diagnostic text, matched rule, path, and host never do.",
+      "description": "Bounded class of access an enforcement check refused. Raw resources, commands, and process names accompany it only when content capture is enabled; diagnostic text and matched rules are never exported.",
       "title": "SandboxDenialClass",
       "x-enumDescriptions": {
         "filesystem_read": "A read was refused because the effective policy does not grant it.",
         "filesystem_write": "A write was refused. Distinct from `filesystem_read` because a read-only grant denies writes to a path it otherwise permits.",
+        "process_startup": "A process could not start because the sandbox refused a required process-scoped resource. Currently emitted for the Windows MSYS `BaseNamedObjects` fork failure confirmed by learning-mode capture.",
+        "registry_access": "Windows registry access was refused and correlated with capture evidence.",
+        "ipc_access": "Windows ALPC or RPC access was refused and correlated with capture evidence.",
+        "process_access": "Access to another Windows process was refused and correlated with capture evidence.",
+        "job_access": "Windows job-object access was refused and correlated with capture evidence.",
+        "ui_access": "Windows UI-handle access was refused and correlated with capture evidence.",
+        "service_access": "Windows service-control-manager access was refused and correlated with capture evidence.",
         "network_outbound": "An outbound connection was refused by `network.allowOutbound`.",
-        "network_local": "A connection to a local or loopback destination was refused by `network.allowLocalNetwork`."
+        "network_local": "A connection to a local or loopback destination was refused by `network.allowLocalNetwork`.",
+        "other_access": "The sandbox's denial capture recorded a refusal its record does not attribute to a more specific control: an unclassified resource (registry, COM, section object) or an AppContainer capability with no network meaning. Deliberately generic — the capture proves the denial happened, and naming a narrower class than the record supports would be a guess."
+      }
+    },
+    "SandboxDenialConfidence": {
+      "type": "string",
+      "enum": [
+        "captured",
+        "policy_corroborated",
+        "sandbox_reported",
+        "output_classified"
+      ],
+      "description": "How strong the evidence behind a denial is. A denial the sandbox itself recorded is a fact; one inferred from a command's output text is a judgement, and an analysis that cannot tell them apart will treat a false positive as enforcement.",
+      "title": "SandboxDenialConfidence",
+      "x-enumDescriptions": {
+        "captured": "The sandbox's own denial capture recorded the refused access. The strongest evidence available: the kernel observed it, not the runtime.",
+        "policy_corroborated": "The command named a path that the effective policy independently denies. No capture confirmed it, but the policy did.",
+        "sandbox_reported": "The failure carried a fingerprint the sandbox itself emits, so the sandbox is known to have refused something even though the resource was not confirmed.",
+        "output_classified": "Classified from the command's own output text alone. The weakest evidence: a command that merely prints sandbox-like wording reaches this level."
       }
     },
     "SandboxEnforcementPoint": {
@@ -15202,7 +16060,7 @@
         "approved",
         "declined"
       ],
-      "description": "Finite result of a sandbox decision. Each `SandboxDecisionData` variant uses a disjoint subset: `policy_resolved` is `resolved | degraded`, `spawn_completed` is `succeeded | failed`, `enforcement_state` is `engaged | inactive | failed`, `access_denied` is `denied`, and `bypass_decided` is `approved | declined`.",
+      "description": "Finite result of a sandbox decision. Each `SandboxDecisionData` variant uses a disjoint subset: `policy_resolved` is `resolved | degraded`, `spawn_completed` and `permissive_retry_completed` are `succeeded | failed`, `enforcement_state` is `engaged | inactive | failed`, `access_denied` is `denied`, and escalation decisions are `approved | declined`.",
       "title": "SandboxOutcome",
       "x-enumDescriptions": {
         "resolved": "The sandbox policy resolved successfully. Describes configuration only and makes no claim that a backend engaged.",
@@ -15210,7 +16068,7 @@
         "engaged": "A runtime-owned containment backend accepted the workload. Evidence of engagement, not of verified containment for the workload's lifetime.",
         "succeeded": "The sandbox operation completed successfully.",
         "failed": "The sandbox operation failed.",
-        "degraded": "The sandbox is active with one or more controls weakened by platform limitations.",
+        "degraded": "The sandbox is active with one or more controls weakened by platform limitations or an explicitly selected relaxed mode.",
         "denied": "An enforcement check refused the requested access.",
         "approved": "A request to run outside the process sandbox was granted.",
         "declined": "A request to run outside the process sandbox was not granted."
@@ -15584,6 +16442,10 @@
           "$ref": "#/definitions/ModelChangeEvent",
           "description": "Session event \"session.model_change\". Model change details including previous and new model identifiers"
         },
+        {
+          "$ref": "#/definitions/AutoTierRecommendationEvent",
+          "description": "Session event \"session.auto_tier_recommendation\". Live-only Auto preference recommendation from Copilot API after a successful Auto model call."
+        },
         {
           "$ref": "#/definitions/AutoTierSwitchFailedEvent",
           "description": "Session event \"session.auto_tier_switch_failed\". A transient Auto preference failure emitted when the runtime cannot mint or accept a usable model and token pair. The previously effective preference remains active, so SDK clients can surface a non-blocking failure without changing their committed-tier state. This event is ephemeral and is not persisted or replayed on resume."
@@ -15892,6 +16754,22 @@
           "$ref": "#/definitions/PermissionCompletedEvent",
           "description": "Session event \"permission.completed\". Permission request completion notification signaling UI dismissal"
         },
+        {
+          "$ref": "#/definitions/PermissionCarriedForwardEvent",
+          "description": "Session event \"permission.carriedForward\". Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left."
+        },
+        {
+          "$ref": "#/definitions/PermissionMessageAuthorizationEvent",
+          "description": "Session event \"permission.messageAuthorization\". Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume."
+        },
+        {
+          "$ref": "#/definitions/PermissionMessageAuthorizationReadEvent",
+          "description": "Session event \"permission.messageAuthorizationRead\". Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism."
+        },
+        {
+          "$ref": "#/definitions/PermissionMessageAuthorizationDegradedEvent",
+          "description": "Session event \"permission.messageAuthorizationDegraded\". Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt."
+        },
         {
           "$ref": "#/definitions/UserInputRequestedEvent",
           "description": "Session event \"user_input.requested\". User input request notification with question and optional predefined choices"
@@ -17307,6 +18185,10 @@
           "type": "string",
           "description": "Why an explicit task-call model did not become the effective model"
         },
+        "modelSelectionSource": {
+          "$ref": "#/definitions/SubagentModelSelectionSource",
+          "description": "Authority or runtime mechanism responsible for sub-agent model selection"
+        },
         "configuredModelMatchesActual": {
           "type": "boolean",
           "description": "Whether the first model actually dispatched matched the user's configured preference"
@@ -17581,6 +18463,10 @@
           "type": "string",
           "description": "Why an explicit task-call model did not become the effective model"
         },
+        "modelSelectionSource": {
+          "$ref": "#/definitions/SubagentModelSelectionSource",
+          "description": "Authority or runtime mechanism responsible for sub-agent model selection"
+        },
         "configuredModelMatchesActual": {
           "type": "boolean",
           "description": "Whether the first model actually dispatched matched the user's configured preference"
@@ -17666,6 +18552,29 @@
       "description": "Session event \"subagent.failed\". Sub-agent failure details including error message and agent information",
       "title": "SubagentFailedEvent"
     },
+    "SubagentModelSelectionSource": {
+      "type": "string",
+      "enum": [
+        "explicit_override",
+        "configured_required",
+        "configured_preference",
+        "complementary_default",
+        "session_inheritance",
+        "agent_definition_default",
+        "runtime_policy"
+      ],
+      "description": "Authority or runtime mechanism responsible for sub-agent model selection.",
+      "title": "SubagentModelSelectionSource",
+      "x-enumDescriptions": {
+        "explicit_override": "Explicit model supplied by the parent agent on the task call and selected for dispatch.",
+        "configured_required": "Required model policy configured for the sub-agent.",
+        "configured_preference": "Non-required model preference configured for the sub-agent.",
+        "complementary_default": "Complementary-model default selected for the sub-agent.",
+        "session_inheritance": "Model inherited from the parent session.",
+        "agent_definition_default": "Default model declared by the agent definition.",
+        "runtime_policy": "Runtime policy, Auto mode, or an experiment selected the model."
+      }
+    },
     "SubagentSelectedData": {
       "type": "object",
       "properties": {
@@ -17778,6 +18687,10 @@
           "type": "string",
           "description": "Model the sub-agent will run with, when known at start."
         },
+        "taskModelSource": {
+          "$ref": "#/definitions/SubagentTaskModelSource",
+          "description": "Where the model input for this sub-agent came from. Present when the task planner resolved the launch (the task tool and factory agents); absent for sub-agents created through other runtime paths."
+        },
         "factoryRunId": {
           "type": "string",
           "description": "Root id of the factory run that spawned this sub-agent, when it was spawned by one."
@@ -17863,6 +18776,23 @@
       "description": "Session event \"subagent.started\". Sub-agent startup details including parent tool call and agent information",
       "title": "SubagentStartedEvent"
     },
+    "SubagentTaskModelSource": {
+      "type": "string",
+      "enum": [
+        "task_argument",
+        "subagent_configuration",
+        "custom_agent_definition",
+        "unset"
+      ],
+      "description": "Where the model input for a task-tool sub-agent came from.",
+      "title": "SubagentTaskModelSource",
+      "x-enumDescriptions": {
+        "task_argument": "The spawning agent supplied the task tool's model argument.",
+        "subagent_configuration": "The task omitted a model and the per-sub-agent settings entry supplied a concrete one.",
+        "custom_agent_definition": "The task omitted a model and the user-defined custom agent's definition supplied one.",
+        "unset": "Neither the task call, the per-sub-agent settings entry, nor a custom agent definition supplied a model."
+      }
+    },
     "SystemMessageData": {
       "type": "object",
       "properties": {
@@ -18235,6 +19165,10 @@
         "retryGuidance": {
           "type": "string",
           "description": "Actionable run_factory resume guidance for a resource-limit failure."
+        },
+        "pauseInfo": {
+          "$ref": "#/definitions/SystemNotificationFactoryPauseInfo",
+          "description": "Pause initiator metadata when this attempt settled as paused."
         }
       },
       "required": [
@@ -18256,6 +19190,7 @@
       "enum": [
         "completed",
         "halted",
+        "paused",
         "cancelled",
         "error"
       ],
@@ -18264,10 +19199,48 @@
       "x-enumDescriptions": {
         "completed": "The factory completed successfully.",
         "halted": "The factory was halted.",
+        "paused": "The factory attempt paused intentionally.",
         "cancelled": "The factory was cancelled.",
         "error": "The factory failed."
       }
     },
+    "SystemNotificationFactoryPauseInfo": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "user",
+              "description": "Factory pause initiator discriminator."
+            }
+          },
+          "required": [
+            "type"
+          ]
+        },
+        {
+          "type": "object",
+          "properties": {
+            "key": {
+              "type": "string",
+              "description": "Stable author-defined checkpoint key that initiated the pause."
+            },
+            "type": {
+              "type": "string",
+              "const": "checkpoint",
+              "description": "Factory pause initiator discriminator."
+            }
+          },
+          "required": [
+            "type",
+            "key"
+          ]
+        }
+      ],
+      "description": "Durable metadata describing who initiated a factory pause.",
+      "title": "SystemNotificationFactoryPauseInfo"
+    },
     "SystemNotificationInstructionDiscovered": {
       "type": "object",
       "properties": {
@@ -19574,6 +20547,10 @@
           "type": "string",
           "description": "Original tool name on the MCP server, when the tool is an MCP tool"
         },
+        "mcpTransport": {
+          "$ref": "#/definitions/McpServerTransport",
+          "description": "Transport the MCP server hosting this tool is connected over, when the tool is an MCP tool and the server is configured"
+        },
         "turnId": {
           "type": "string",
           "description": "Identifier for the agent loop turn this tool was invoked in, matching the corresponding assistant.turn_start event"