@github/copilot-sdk-linuxmusl-x64 1.0.13-preview.6 → 1.0.14-preview.0

package/schemas/api.schema.json

@@ -400,7 +400,7 @@
         "description": "Enables installed plugins for new sessions.",
         "params": {
           "$ref": "#/definitions/PluginsEnableRequest",
-          "description": "Plugin names (or specs) to enable."
+          "description": "Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against."
         },
         "result": {
           "type": "null"
@@ -412,7 +412,7 @@
         "description": "Disables installed plugins for new sessions.",
         "params": {
           "$ref": "#/definitions/PluginsDisableRequest",
-          "description": "Plugin names (or specs) to disable."
+          "description": "Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against."
         },
         "result": {
           "type": "null"
@@ -666,6 +666,15 @@
           "description": "Validated device-managed settings discovered before a session exists."
         },
         "stability": "experimental"
+      },
+      "clearCache": {
+        "rpcMethod": "managedSettings.clearCache",
+        "description": "Force-refreshes enterprise managed settings for every account: wipes the persistent server-policy cache (the whole `<cacheHome>/managed-settings` directory) and drops this runtime process's in-memory retained server policy. It does not itself fetch policy — the effect is that the next time a session resolves managed settings for an account, that resolution re-fetches the account's org policy from the network instead of serving a cached response. Note that `managedSettings.read` returns only device/MDM settings and never triggers the account server-policy fetch, so a host implementing \"sync account policy\" should start a fresh session resolution rather than treat a subsequent `managedSettings.read` as the refreshed org policy. Mirrors the invalidation a sign-out performs, broadened from the one signing-out account to all of them; device/MDM layers describe the machine, not the account, and are left untouched. Rejects if the on-disk cache cannot be removed.",
+        "params": null,
+        "result": {
+          "type": "null"
+        },
+        "stability": "experimental"
       }
     },
     "runtime": {
@@ -799,9 +808,22 @@
         "stability": "experimental",
         "visibility": "internal"
       },
+      "getClientMetadata": {
+        "rpcMethod": "sessions.getClientMetadata",
+        "description": "Reads client-owned metadata for multiple persisted local sessions without opening them. Results preserve request order and report missing, corrupt, unsupported, or temporarily unavailable sessions independently.",
+        "params": {
+          "$ref": "#/definitions/SessionsGetClientMetadataRequest",
+          "description": "Bounded batch request for client-owned metadata from persisted local sessions."
+        },
+        "result": {
+          "$ref": "#/definitions/SessionsGetClientMetadataResult",
+          "description": "Ordered client metadata outcomes for the requested local sessions."
+        },
+        "stability": "experimental"
+      },
       "readPersistedEvents": {
         "rpcMethod": "sessions.readPersistedEvents",
-        "description": "Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The initial backward read uses a bounded tail scan for fast first paint; cursor continuations preserve the session event-log paging semantics. Persisted events may omit payloads that are reconstructed only for an active session.",
+        "description": "Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The first read pins the currently opened journal generation and its byte-length boundary; opaque cursor continuations remain on that generation across runtime-owned compaction, truncation, and rewrite operations, which replace the live path atomically, and events appended after the boundary are excluded. For cold hydration, await the first successful page before activation and establish lossless live-event buffering before resume; merge subsequent live events by ID, preserving persisted order and letting live payloads win. Continuations are process-local, single-use capabilities bound to the originating session and storage context and must be paged sequentially; concurrent or repeated use of the same cursor expires that duplicate read rather than reading the generation twice. A complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five idle minutes, with at most eight retained per process and idle-only eviction under pressure; completion and cancelled-worker exit release their handles. No transcript copy is created, but retained handles may keep replaced files' disk blocks alive until release. Pages have a soft 1 MiB serialized event-array budget including resolved binary assets; one oversized event is returned alone to guarantee progress. Working memory also includes a record/lookahead and asset resolution; resolving the first binary reference may scan the full pinned generation to build a bounded offset index. If the snapshot expires, is evicted, is cancelled before a continuation is established, or becomes unreadable after an observable unsupported in-place shortening, the continuation returns cursorStatus 'expired' with an empty terminal page and never falls back to a different generation. A missing or initially unreadable journal is an RPC error. Persisted history excludes ephemeral events and may omit payloads that are reconstructed only for an active session; use the active session event stream for post-resume live events.",
         "params": {
           "$ref": "#/definitions/SessionsReadPersistedEventsRequest",
           "description": "Pagination options for reading an inactive or active local session's persisted event journal."
@@ -1367,6 +1389,40 @@
           "description": "Managed sandbox enforcement state for a session."
         },
         "stability": "experimental"
+      },
+      "disableForSession": {
+        "rpcMethod": "session.sandbox.disableForSession",
+        "description": "Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "requestId": {
+              "type": "string",
+              "description": "Identifier of the exact pending sandbox-bypass permission request that authorized the session opt-out."
+            },
+            "decisionContext": {
+              "$ref": "#/definitions/PermissionDecisionContext",
+              "description": "Optional attribution for the permission decision."
+            }
+          },
+          "required": [
+            "sessionId",
+            "requestId"
+          ],
+          "additionalProperties": false,
+          "description": "Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.",
+          "title": "SandboxDisableForSessionRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/SandboxDisableForSessionResult",
+          "description": "Result of attempting to disable sandboxing for the current session."
+        },
+        "stability": "experimental"
       }
     },
     "sendSystemNotification": {
@@ -2432,6 +2488,76 @@
         },
         "stability": "experimental"
       },
+      "pause": {
+        "rpcMethod": "session.factory.pause",
+        "description": "Pauses a running factory and returns its settled run envelope.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "runId": {
+              "type": "string",
+              "description": "Factory run identifier."
+            }
+          },
+          "required": [
+            "sessionId",
+            "runId"
+          ],
+          "additionalProperties": false,
+          "description": "Parameters for pausing a running factory.",
+          "title": "FactoryPauseRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/FactoryRunResult",
+          "description": "Complete current or terminal factory run envelope."
+        },
+        "stability": "experimental"
+      },
+      "pauseAtCheckpoint": {
+        "rpcMethod": "session.factory.pauseAtCheckpoint",
+        "description": "Atomically pauses an owned factory attempt at a durable checkpoint.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "runId": {
+              "type": "string",
+              "description": "Factory run identifier."
+            },
+            "executionToken": {
+              "type": "string",
+              "description": "Opaque token identifying the execution attempt that reached the checkpoint."
+            },
+            "key": {
+              "type": "string",
+              "description": "Stable author-defined checkpoint key."
+            }
+          },
+          "required": [
+            "sessionId",
+            "runId",
+            "executionToken",
+            "key"
+          ],
+          "additionalProperties": false,
+          "description": "Parameters for an owned durable pause checkpoint.",
+          "title": "FactoryPauseCheckpointRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/FactoryPauseCheckpointResult"
+        },
+        "stability": "experimental",
+        "visibility": "internal"
+      },
       "log": {
         "rpcMethod": "session.factory.log",
         "description": "Records a batch of ordered factory progress lines.",
@@ -2612,7 +2738,7 @@
     "model": {
       "getCurrent": {
         "rpcMethod": "session.model.getCurrent",
-        "description": "Gets the currently selected model for the session.",
+        "description": "Gets the session's authoritative model snapshot, including the committed Auto preference and any newer unclaimed Auto preference waiting for a future user turn.",
         "params": {
           "type": "object",
           "properties": {
@@ -2629,7 +2755,7 @@
         },
         "result": {
           "$ref": "#/definitions/CurrentModel",
-          "description": "The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume."
+          "description": "The session's authoritative model snapshot. Auto preference fields are configuration for the virtual `auto` model and do not change the selected model identifier. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume."
         },
         "stability": "experimental"
       },
@@ -2647,6 +2773,18 @@
               "type": "string",
               "description": "Model selection id to switch to, as returned by `list`. A bare id (e.g. `claude-sonnet-4.6`) names a Copilot (CAPI) model; a provider-qualified id (`provider/id`, e.g. `acme/claude-sonnet`) targets a registry BYOK model."
             },
+            "autoTier": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/AutoTier",
+                  "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional Auto routing preference to stage atomically with selecting `auto`. Pass null to return to provider-default Auto routing. This field is rejected when `modelId` is not `auto`."
+            },
             "reasoningEffort": {
               "type": "string",
               "description": "Reasoning effort level to use for the model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. \"none\" disables reasoning. When omitted, no effort override is applied."
@@ -2715,6 +2853,48 @@
         },
         "stability": "experimental"
       },
+      "switchAutoTier": {
+        "rpcMethod": "session.model.switchAutoTier",
+        "description": "Requests an Auto preference change without changing the session's selected model. The latest unclaimed request wins; the runtime commits it only after a later prompt using the `auto` model mints a usable model and token pair. A `pending` response confirms that the request was accepted, not that it committed. Observe eventual success through `session.model_change`, failure through the ephemeral `session.auto_tier_switch_failed` event, or current unclaimed state through `session.model.getCurrent`.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "autoTier": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/AutoTier",
+                  "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Auto preference to activate when a future user turn using the `auto` model safely mints a replacement model and token pair. Pass null to return to provider-default Auto routing."
+            },
+            "source": {
+              "$ref": "#/definitions/ModelChangeSource",
+              "description": "Origin to record on the effective `session.model_change` event. Defaults to `sdk` when omitted."
+            }
+          },
+          "required": [
+            "sessionId",
+            "autoTier"
+          ],
+          "additionalProperties": false,
+          "description": "An Auto preference request for the session. This updates Auto configuration only; it does not change the selected model to `auto`.",
+          "title": "ModelSwitchAutoTierRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/ModelSwitchAutoTierResult",
+          "description": "Immediate acknowledgement and Auto preference snapshot after a switch request. This result never implies that a pending preference committed."
+        },
+        "stability": "experimental"
+      },
       "applyStartupOverlay": {
         "rpcMethod": "session.model.applyStartupOverlay",
         "description": "Resolves and applies organization-managed and repository model overlays.",
@@ -2749,6 +2929,10 @@
               "type": "string",
               "description": "Context tier selected by repository settings, when configured."
             },
+            "repoAutoTier": {
+              "type": "string",
+              "description": "Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant."
+            },
             "cliModel": {
               "type": "string",
               "description": "Model explicitly selected by the CLI, when provided."
@@ -2773,6 +2957,46 @@
         "stability": "experimental",
         "visibility": "internal"
       },
+      "setAllowedModels": {
+        "rpcMethod": "session.model.setAllowedModels",
+        "description": "Replaces or clears the host-supplied model allowlist for a running session.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "allowedModels": {
+              "anyOf": [
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "minItems": 1,
+              "description": "Exact model IDs to permit, or null to clear the host restriction."
+            }
+          },
+          "required": [
+            "sessionId"
+          ],
+          "additionalProperties": false,
+          "description": "Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.",
+          "title": "ModelSetAllowedModelsRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/ModelSetAllowedModelsResult",
+          "description": "The applied host allowlist and effective session model policy after intersection."
+        },
+        "stability": "experimental"
+      },
       "setReasoningEffort": {
         "rpcMethod": "session.model.setReasoningEffort",
         "description": "Updates the session's reasoning effort without changing the selected model.",
@@ -2878,6 +3102,10 @@
               "$ref": "#/definitions/SessionMode",
               "description": "The session mode the agent is operating in"
             },
+            "expectedMode": {
+              "$ref": "#/definitions/SessionMode",
+              "description": "Mode the session must currently be in for the change to apply. When set and the session is in a different mode the request is a no-op and reports status 'unchanged'."
+            },
             "inheritPlanBaseFromSessionId": {
               "type": "string",
               "description": "Session whose plan-mode base state should be inherited."
@@ -3600,6 +3828,31 @@
         "stability": "experimental"
       }
     },
+    "autopilotObjective": {
+      "getState": {
+        "rpcMethod": "session.autopilotObjective.getState",
+        "description": "Reads the current canonical autopilot objective state for this session.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            }
+          },
+          "required": [
+            "sessionId"
+          ],
+          "additionalProperties": false,
+          "description": "Identifies the target session."
+        },
+        "result": {
+          "$ref": "#/definitions/AutopilotObjectiveGetStateResult",
+          "description": "Canonical runtime state for the session's current autopilot objective."
+        },
+        "stability": "experimental"
+      }
+    },
     "completions": {
       "getTriggerCharacters": {
         "rpcMethod": "session.completions.getTriggerCharacters",
@@ -3700,13 +3953,30 @@
             "prompt": {
               "type": "string",
               "description": "Optional user prompt to combine with fleet instructions"
+            },
+            "attachments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/Attachment",
+                "description": "A user message attachment — a file, directory, code selection, blob, GitHub-anchored pointer, or extension-supplied context payload"
+              },
+              "description": "Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request"
+            },
+            "billable": {
+              "type": "boolean",
+              "description": "If false, this request will not trigger a Premium Request Unit charge. User requests default to billable.",
+              "visibility": "internal"
+            },
+            "wait": {
+              "type": "boolean",
+              "description": "If true, await completion of the agentic loop for this fleet request before returning. Defaults to false."
             }
           },
           "required": [
             "sessionId"
           ],
           "additionalProperties": false,
-          "description": "Optional user prompt to combine with the fleet orchestration instructions.",
+          "description": "Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.",
           "title": "FleetStartRequest",
           "stability": "experimental"
         },
@@ -3963,6 +4233,102 @@
         },
         "stability": "experimental"
       },
+      "register": {
+        "rpcMethod": "session.tasks.register",
+        "description": "Registers a client-owned task, or reclaims an orphaned task belonging to the same extension principal.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "type": {
+              "$ref": "#/definitions/TaskClientType",
+              "const": "client",
+              "description": "Task kind"
+            },
+            "clientTaskId": {
+              "type": "string",
+              "description": "Owner-scoped idempotency key used for registration and reclaim"
+            },
+            "description": {
+              "type": "string",
+              "description": "Human-readable description of the external work"
+            },
+            "displayName": {
+              "type": "string",
+              "description": "Optional short display name for the external work"
+            },
+            "cancellable": {
+              "type": "boolean",
+              "description": "Whether the owner supports runtime cancellation requests"
+            },
+            "expectedSequence": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Expected current sequence for idempotent registration or orphan reclaim"
+            }
+          },
+          "required": [
+            "sessionId",
+            "type",
+            "clientTaskId",
+            "description",
+            "cancellable"
+          ],
+          "additionalProperties": false,
+          "description": "Registers or reclaims a client-owned task.",
+          "title": "TasksRegisterRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/TasksRegisterResult",
+          "description": "Result of registering or reclaiming a client-owned task."
+        },
+        "stability": "experimental"
+      },
+      "update": {
+        "rpcMethod": "session.tasks.update",
+        "description": "Publishes generic progress or a terminal outcome for a client-owned task.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "id": {
+              "type": "string",
+              "description": "Canonical runtime-generated task identifier"
+            },
+            "sequence": {
+              "type": "integer",
+              "minimum": 0,
+              "description": "Owner update sequence to apply"
+            },
+            "update": {
+              "$ref": "#/definitions/TaskClientUpdate",
+              "description": "Progress or terminal update payload"
+            }
+          },
+          "required": [
+            "sessionId",
+            "id",
+            "sequence",
+            "update"
+          ],
+          "additionalProperties": false,
+          "description": "Updates a client-owned task.",
+          "title": "TasksUpdateRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/TasksUpdateResult",
+          "description": "Result of publishing a client-owned task update."
+        },
+        "stability": "experimental"
+      },
       "refresh": {
         "rpcMethod": "session.tasks.refresh",
         "description": "Refreshes metadata for any detached background shells the runtime knows about.",
@@ -6403,7 +6769,7 @@
       },
       "updateSubagentSettings": {
         "rpcMethod": "session.tools.updateSubagentSettings",
-        "description": "Updates the current session's live subagent settings after user settings change. The persisted user settings remain the source of truth for future sessions.",
+        "description": "Sets the current session's live subagent settings override, which takes precedence over persisted user settings until cleared. Persisted user settings remain the source of truth for future sessions.",
         "params": {
           "type": "object",
           "properties": {
@@ -7872,6 +8238,74 @@
         },
         "stability": "experimental"
       },
+      "getClientMetadata": {
+        "rpcMethod": "session.metadata.getClientMetadata",
+        "description": "Returns the client-owned string metadata persisted with this local session. The metadata is not included in model context, events, telemetry, snapshots, or remote exports.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            }
+          },
+          "required": [
+            "sessionId"
+          ],
+          "additionalProperties": false,
+          "description": "Identifies the target session."
+        },
+        "result": {
+          "$ref": "#/definitions/ClientMetadata",
+          "description": "Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values."
+        },
+        "stability": "experimental"
+      },
+      "updateClientMetadata": {
+        "rpcMethod": "session.metadata.updateClientMetadata",
+        "description": "Atomically patches the client-owned string metadata persisted with this local session and returns the committed bag.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "clear": {
+              "type": "boolean",
+              "description": "Remove every existing client metadata entry before applying remove and set. Defaults to false."
+            },
+            "remove": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "maxItems": 128,
+              "description": "Case-sensitive keys to remove. Missing keys are ignored. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces."
+            },
+            "set": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "String entries to add or replace. Set wins when a key also appears in remove. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Each value may contain at most 16 KiB of UTF-8 data.",
+              "maxProperties": 128
+            }
+          },
+          "required": [
+            "sessionId"
+          ],
+          "additionalProperties": false,
+          "description": "Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.",
+          "title": "MetadataUpdateClientMetadataRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/ClientMetadata",
+          "description": "Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values."
+        },
+        "stability": "experimental"
+      },
       "isProcessing": {
         "rpcMethod": "session.metadata.isProcessing",
         "description": "Reports whether the local session is currently processing user/agent messages.",
@@ -9954,11 +10388,16 @@
             "runId": {
               "type": "string",
               "description": "Factory run identifier."
+            },
+            "executionToken": {
+              "type": "string",
+              "description": "Opaque token identifying the execution attempt to abort."
             }
           },
           "required": [
             "sessionId",
-            "runId"
+            "runId",
+            "executionToken"
           ],
           "additionalProperties": false,
           "description": "Parameters for cooperatively aborting a factory body.",
@@ -9972,6 +10411,53 @@
         "stability": "experimental"
       }
     },
+    "tasks": {
+      "cancel": {
+        "rpcMethod": "tasks.cancel",
+        "description": "Asks the client currently bound to a client-owned session task to confirm that its external work stopped.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Session that owns the client task"
+            },
+            "id": {
+              "type": "string",
+              "description": "Canonical runtime-generated task identifier"
+            },
+            "clientTaskId": {
+              "type": "string",
+              "description": "Owner-scoped task key included for correlation"
+            },
+            "cancellationId": {
+              "type": "string",
+              "description": "Opaque identifier shared by coalesced cancellation callers"
+            },
+            "reason": {
+              "$ref": "#/definitions/ClientTaskCancelReason",
+              "description": "Reason the runtime requests cancellation"
+            }
+          },
+          "required": [
+            "sessionId",
+            "id",
+            "clientTaskId",
+            "cancellationId",
+            "reason"
+          ],
+          "additionalProperties": false,
+          "description": "Runtime-to-owner cancellation request for a client-owned task.",
+          "title": "ClientTaskCancelRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/ClientTaskCancelResult",
+          "description": "Whether the client authoritatively confirmed its external work stopped."
+        },
+        "stability": "experimental"
+      }
+    },
     "sessionFs": {
       "readFile": {
         "rpcMethod": "sessionFs.readFile",
@@ -10053,7 +10539,7 @@
       },
       "appendFile": {
         "rpcMethod": "sessionFs.appendFile",
-        "description": "Appends content to a file in the client-provided session filesystem.",
+        "description": "Appends content to a file in the client-provided session filesystem, creating parent directories as needed.",
         "params": {
           "type": "object",
           "properties": {
@@ -10081,7 +10567,7 @@
             "content"
           ],
           "additionalProperties": false,
-          "description": "File path, content to append, and optional mode for the client-provided session filesystem.",
+          "description": "File path, content to append, and optional mode for the client-provided session filesystem. Implementations create parent directories as needed.",
           "title": "SessionFsAppendFileRequest",
           "stability": "experimental"
         },
@@ -11100,6 +11586,10 @@
           "type": "boolean",
           "description": "Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only."
         },
+        "disableModelInvocation": {
+          "type": "boolean",
+          "description": "Whether model-driven invocation is disabled for this agent."
+        },
         "tools": {
           "type": "array",
           "items": {
@@ -12686,19 +13176,140 @@
       "description": "Validation errors from the most recent authentication attempt.",
       "title": "AuthValidationErrors"
     },
+    "AutopilotObjectiveCreditLimit": {
+      "type": "object",
+      "properties": {
+        "credits": {
+          "type": "number",
+          "description": "Configured AI-credit cap, when one is set."
+        },
+        "creditsUsed": {
+          "type": "number",
+          "description": "Window consumption in fractional AI credits, for display."
+        },
+        "creditsUsedNanoAiu": {
+          "type": "string",
+          "pattern": "^[0-9]+$",
+          "description": "Exact window consumption in non-negative integer nano-AIU, encoded as a decimal string."
+        }
+      },
+      "required": [
+        "creditsUsed",
+        "creditsUsedNanoAiu"
+      ],
+      "additionalProperties": false,
+      "description": "Current per-window credit limit and consumption for an autopilot objective.",
+      "title": "AutopilotObjectiveCreditLimit",
+      "stability": "experimental"
+    },
+    "AutopilotObjectiveGetStateResult": {
+      "type": "object",
+      "properties": {
+        "state": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutopilotObjectiveState",
+              "description": "Public, persistence-independent projection of an autopilot objective."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Current objective state, or `null` when the session has no objective."
+        }
+      },
+      "required": [
+        "state"
+      ],
+      "additionalProperties": false,
+      "description": "Canonical runtime state for the session's current autopilot objective.",
+      "title": "AutopilotObjectiveGetStateResult",
+      "stability": "experimental"
+    },
+    "AutopilotObjectiveState": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 9007199254740991,
+          "description": "Session-local objective identifier."
+        },
+        "objective": {
+          "type": "string",
+          "description": "User-provided objective text."
+        },
+        "status": {
+          "$ref": "#/definitions/AutopilotObjectiveStatus",
+          "description": "Current normalized lifecycle status."
+        },
+        "turnCount": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 9007199254740991,
+          "description": "Number of objective turns started."
+        },
+        "pauseReason": {
+          "type": "string",
+          "description": "Optional reason the objective is paused."
+        },
+        "completionSummary": {
+          "type": "string",
+          "description": "Optional summary recorded when the objective completed."
+        },
+        "creditCountNanoAiu": {
+          "type": "string",
+          "pattern": "^[0-9]+$",
+          "description": "Exact lifetime AI-credit consumption in non-negative integer nano-AIU, encoded as a decimal string."
+        },
+        "creditLimit": {
+          "$ref": "#/definitions/AutopilotObjectiveCreditLimit",
+          "description": "Current per-window consumption and optional cap, when a credit-tracking window is present."
+        }
+      },
+      "required": [
+        "id",
+        "objective",
+        "status",
+        "turnCount",
+        "creditCountNanoAiu"
+      ],
+      "additionalProperties": false,
+      "description": "Public, persistence-independent projection of an autopilot objective.",
+      "title": "AutopilotObjectiveState",
+      "stability": "experimental"
+    },
+    "AutopilotObjectiveStatus": {
+      "type": "string",
+      "enum": [
+        "active",
+        "paused",
+        "completed"
+      ],
+      "description": "Current normalized autopilot objective lifecycle status.",
+      "title": "AutopilotObjectiveStatus",
+      "x-enumDescriptions": {
+        "active": "The objective is actively running.",
+        "paused": "The objective is paused and may be resumed.",
+        "completed": "The objective completed."
+      },
+      "stability": "experimental"
+    },
     "AutoTier": {
       "type": "string",
       "enum": [
         "efficiency",
         "balance",
-        "intelligence"
+        "intelligence",
+        "fast"
       ],
-      "description": "Routing preference used when the session model is `auto`.",
+      "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference.",
       "title": "AutoTier",
       "x-enumDescriptions": {
         "efficiency": "Optimize for efficiency.",
         "balance": "Balance efficiency and intelligence.",
-        "intelligence": "Optimize for intelligence."
+        "intelligence": "Optimize for intelligence.",
+        "fast": "Integrator-only preset that optimizes for latency."
       }
     },
     "BuiltInModelCatalog": {
@@ -13311,7 +13922,7 @@
       "properties": {
         "autoTier": {
           "$ref": "#/definitions/AutoTier",
-          "description": "Routing preference used when the session model is `auto`. The runtime persists the preference across cold resume. When omitted, the default routing behavior is used. Resuming an already-resident session cannot change its preference."
+          "description": "Routing preference for sessions whose model is `auto`. On create or cold resume, this establishes the preference sent as `tier` on CAPI `/auto` requests; when omitted on cold resume, the runtime restores the last committed preference. On resident resume, a different value requests a safe switch after resume succeeds and cannot change an in-flight turn. Successful switches are persisted for later cold resume. When no preference is supplied or restored, CAPI default routing is used. `fast` is an integrator-only latency preset, not a first-party GitHub Copilot product preference."
         },
         "enableWebSocketResponses": {
           "type": "boolean",
@@ -13414,6 +14025,10 @@
         "provenance": {
           "$ref": "#/definitions/CatalogAiSkillCandidateProvenance",
           "description": "Where the catalog reference was observed, without the card itself or any content digest."
+        },
+        "trust": {
+          "$ref": "#/definitions/CatalogTrustSnapshot",
+          "description": "Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field."
         }
       },
       "required": [
@@ -13585,7 +14200,8 @@
         "legacy-mcp-server-card",
         "ai-skill-discovery",
         "mcp-install-planning",
-        "multiple-transport-choice"
+        "multiple-transport-choice",
+        "trust-snapshot"
       ],
       "description": "A wire feature a caller can require of the catalog surface, negotiated per request. A grant means the runtime understands the feature's contract, not that the deployment has enabled the operation; typed unavailable results report availability separately.",
       "title": "CatalogCapability",
@@ -13594,7 +14210,8 @@
         "legacy-mcp-server-card": "Understands the legacy `application/mcp-server+json` media type.",
         "ai-skill-discovery": "Understands `application/ai-skill` candidates as discovery-only and typed non-installable.",
         "mcp-install-planning": "Understands side-effect-free MCP install-plan requests, results, and plan handles; `planning-unavailable` separately reports that planning is not enabled.",
-        "multiple-transport-choice": "Understands plans that enumerate every eligible transport rather than a single preferred one."
+        "multiple-transport-choice": "Understands plans that enumerate every eligible transport rather than a single preferred one.",
+        "trust-snapshot": "Understands versioned candidate trust snapshots. Protocol-3 callers must require this capability before the runtime adds the optional snapshot field."
       }
     },
     "CatalogCapabilityId": {
@@ -13886,6 +14503,10 @@
         "provenance": {
           "$ref": "#/definitions/CatalogMcpServerCandidateProvenance",
           "description": "Where the catalog reference was observed, without the card itself or any content digest."
+        },
+        "trust": {
+          "$ref": "#/definitions/CatalogTrustSnapshot",
+          "description": "Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field."
         }
       },
       "required": [
@@ -14006,10 +14627,12 @@
         "supportedCapabilities": {
           "type": "array",
           "items": {
-            "$ref": "#/definitions/CatalogCapability",
-            "description": "A wire feature a caller can require of the catalog surface, negotiated per request. A grant means the runtime understands the feature's contract, not that the deployment has enabled the operation; typed unavailable results report availability separately."
+            "$ref": "#/definitions/CatalogCapabilityId",
+            "description": "Bounded extensible wire-feature identifier. Known values are described by `CatalogCapability`; newer callers may send future identifiers so an older runtime can return a typed negotiation refusal instead of failing schema validation. Capability negotiation establishes contract understanding, while each operation's result separately reports runtime availability."
           },
-          "description": "Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation."
+          "maxItems": 32,
+          "uniqueItems": true,
+          "description": "Capabilities this runtime can safely advertise to this caller. The complete five-capability protocol-3 legacy set is always present; every capability added after that baseline appears only when the caller required it, so an older closed-enum decoder can still consume a refusal. This list does not imply that every deployment has enabled every operation."
         },
         "unsupportedCapabilities": {
           "type": "array",
@@ -14327,6 +14950,414 @@
       "description": "A completed catalog search: inert candidate summaries, each carrying a single-use handle.",
       "title": "CatalogSearchSucceeded"
     },
+    "CatalogTrustEligibility": {
+      "type": "string",
+      "enum": [
+        "default",
+        "expanded",
+        "hidden",
+        "unknown"
+      ],
+      "description": "Authority-computed exposure eligibility, kept separate from tier. The current tier-only Agent Finder response maps to `unknown`, never to a locally inferred eligibility.",
+      "title": "CatalogTrustEligibility",
+      "x-enumDescriptions": {
+        "default": "Eligible for default catalogue exposure.",
+        "expanded": "Eligible only when expanded or community results are requested.",
+        "hidden": "Not eligible for normal catalogue exposure.",
+        "unknown": "The authority did not supply an eligibility decision."
+      }
+    },
+    "CatalogTrustProvenance": {
+      "type": "object",
+      "properties": {
+        "source": {
+          "$ref": "#/definitions/CatalogTrustSource",
+          "description": "Bounded authority that supplied the trust field."
+        },
+        "observedAt": {
+          "type": "string",
+          "minLength": 20,
+          "maxLength": 64,
+          "format": "date-time",
+          "description": "ISO 8601 timestamp with a timezone offset at which the runtime observed the search result carrying this trust field."
+        }
+      },
+      "required": [
+        "source",
+        "observedAt"
+      ],
+      "additionalProperties": false,
+      "description": "Where and when the runtime observed the trust metadata. Observation time is not the authority's evaluation time and must not be used to infer staleness.",
+      "title": "CatalogTrustProvenance"
+    },
+    "CatalogTrustSnapshot": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotCurrent",
+          "description": "A recognised current Agent Finder T1 or T2 trust tier."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotAbsent",
+          "description": "Discriminator: the authority omitted trust metadata."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotStale",
+          "description": "Discriminator: the authority explicitly marked the assessment stale."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotDowngraded",
+          "description": "Discriminator: the authority explicitly reported a downgraded assessment."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotRevoked",
+          "description": "Discriminator: the authority explicitly revoked the assessment."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotUnsupported",
+          "description": "Discriminator: the authority supplied a bounded trust value this runtime does not understand."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotMalformed",
+          "description": "Discriminator: the trust field was empty, unbounded, or had the wrong JSON type."
+        }
+      ],
+      "description": "A versioned, bounded trust observation carried unchanged with a catalog candidate and its private handle context. Current observations require a recognised T1/T2 tier; every non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent Finder supplies no exposure decision, and states absent from its current wire are never inferred from age, relevance, popularity, or a tier transition.",
+      "title": "CatalogTrustSnapshot"
+    },
+    "CatalogTrustSnapshotAbsent": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotAbsentStatus",
+          "const": "absent",
+          "description": "Discriminator: the authority omitted trust metadata."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority omitted trust metadata.",
+      "title": "CatalogTrustSnapshotAbsent"
+    },
+    "CatalogTrustSnapshotAbsentStatus": {
+      "type": "string",
+      "enum": [
+        "absent"
+      ],
+      "description": "The authority omitted trust metadata.",
+      "title": "CatalogTrustSnapshotAbsentStatus",
+      "x-enumDescriptions": {
+        "absent": "The authority omitted trust metadata."
+      }
+    },
+    "CatalogTrustSnapshotCurrent": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotCurrentStatus",
+          "const": "current",
+          "description": "Discriminator: a recognised current trust tier was observed."
+        },
+        "tier": {
+          "$ref": "#/definitions/CatalogTrustTier",
+          "description": "Service-computed T1 or T2 trust tier."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "tier",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "A recognised current Agent Finder T1 or T2 trust tier.",
+      "title": "CatalogTrustSnapshotCurrent"
+    },
+    "CatalogTrustSnapshotCurrentStatus": {
+      "type": "string",
+      "enum": [
+        "current"
+      ],
+      "description": "A recognised T1 or T2 service tier was observed.",
+      "title": "CatalogTrustSnapshotCurrentStatus",
+      "x-enumDescriptions": {
+        "current": "A recognised T1 or T2 service tier was observed."
+      }
+    },
+    "CatalogTrustSnapshotDowngraded": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotDowngradedStatus",
+          "const": "downgraded",
+          "description": "Discriminator: the authority explicitly reported a downgraded assessment."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority explicitly reported a downgraded assessment.",
+      "title": "CatalogTrustSnapshotDowngraded"
+    },
+    "CatalogTrustSnapshotDowngradedStatus": {
+      "type": "string",
+      "enum": [
+        "downgraded"
+      ],
+      "description": "The authority explicitly reported a downgraded assessment.",
+      "title": "CatalogTrustSnapshotDowngradedStatus",
+      "x-enumDescriptions": {
+        "downgraded": "The authority explicitly reported a downgraded assessment."
+      }
+    },
+    "CatalogTrustSnapshotMalformed": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotMalformedStatus",
+          "const": "malformed",
+          "description": "Discriminator: the trust field was empty, unbounded, or had the wrong JSON type."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.",
+      "title": "CatalogTrustSnapshotMalformed"
+    },
+    "CatalogTrustSnapshotMalformedStatus": {
+      "type": "string",
+      "enum": [
+        "malformed"
+      ],
+      "description": "The trust field was empty, unbounded, or had the wrong JSON type.",
+      "title": "CatalogTrustSnapshotMalformedStatus",
+      "x-enumDescriptions": {
+        "malformed": "The trust field was empty, unbounded, or had the wrong JSON type."
+      }
+    },
+    "CatalogTrustSnapshotRevoked": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotRevokedStatus",
+          "const": "revoked",
+          "description": "Discriminator: the authority explicitly revoked the assessment."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority explicitly revoked the assessment.",
+      "title": "CatalogTrustSnapshotRevoked"
+    },
+    "CatalogTrustSnapshotRevokedStatus": {
+      "type": "string",
+      "enum": [
+        "revoked"
+      ],
+      "description": "The authority explicitly revoked its assessment.",
+      "title": "CatalogTrustSnapshotRevokedStatus",
+      "x-enumDescriptions": {
+        "revoked": "The authority explicitly revoked its assessment."
+      }
+    },
+    "CatalogTrustSnapshotSchemaVersion": {
+      "type": "string",
+      "enum": [
+        "v1"
+      ],
+      "description": "Schema version of the catalogue trust snapshot envelope",
+      "title": "CatalogTrustSnapshotSchemaVersion",
+      "x-enumDescriptions": {
+        "v1": "Initial envelope carrying one bounded service tier or one explicit unavailable state."
+      }
+    },
+    "CatalogTrustSnapshotStale": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotStaleStatus",
+          "const": "stale",
+          "description": "Discriminator: the authority explicitly marked the assessment stale."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority explicitly marked the assessment stale.",
+      "title": "CatalogTrustSnapshotStale"
+    },
+    "CatalogTrustSnapshotStaleStatus": {
+      "type": "string",
+      "enum": [
+        "stale"
+      ],
+      "description": "The authority explicitly marked its assessment stale.",
+      "title": "CatalogTrustSnapshotStaleStatus",
+      "x-enumDescriptions": {
+        "stale": "The authority explicitly marked its assessment stale."
+      }
+    },
+    "CatalogTrustSnapshotUnsupported": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotUnsupportedStatus",
+          "const": "unsupported",
+          "description": "Discriminator: the authority supplied a bounded trust value this runtime does not understand."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority supplied a bounded trust value this runtime does not understand.",
+      "title": "CatalogTrustSnapshotUnsupported"
+    },
+    "CatalogTrustSnapshotUnsupportedStatus": {
+      "type": "string",
+      "enum": [
+        "unsupported"
+      ],
+      "description": "The authority supplied a bounded trust value this runtime does not understand.",
+      "title": "CatalogTrustSnapshotUnsupportedStatus",
+      "x-enumDescriptions": {
+        "unsupported": "The authority supplied a bounded trust value this runtime does not understand."
+      }
+    },
+    "CatalogTrustSource": {
+      "type": "string",
+      "enum": [
+        "agent-finder"
+      ],
+      "description": "Bounded authority that supplied a catalogue trust observation",
+      "title": "CatalogTrustSource",
+      "x-enumDescriptions": {
+        "agent-finder": "GitHub Agent Finder supplied the trust field on its search result."
+      }
+    },
+    "CatalogTrustTier": {
+      "type": "string",
+      "enum": [
+        "T1",
+        "T2"
+      ],
+      "description": "Service-computed trust tier currently emitted by Agent Finder. It is independent of search score, popularity, and client-side ranking.",
+      "title": "CatalogTrustTier",
+      "x-enumDescriptions": {
+        "T1": "Tier one as assigned by the catalogue authority.",
+        "T2": "Tier two as assigned by the catalogue authority."
+      }
+    },
     "CatalogUnavailableError": {
       "type": "object",
       "properties": {
@@ -14501,6 +15532,79 @@
       "description": "The request asked for a candidate kind this runtime does not serve.",
       "title": "CatalogUnsupportedKindError"
     },
+    "ClientMetadata": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      },
+      "description": "Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.",
+      "title": "ClientMetadata",
+      "maxProperties": 128
+    },
+    "ClientTaskCancelReason": {
+      "type": "string",
+      "enum": [
+        "cancel_requested",
+        "session_shutdown"
+      ],
+      "description": "Why the runtime requests client-task cancellation.",
+      "title": "ClientTaskCancelReason",
+      "x-enumDescriptions": {
+        "cancel_requested": "A caller requested task cancellation.",
+        "session_shutdown": "The session is shutting down."
+      }
+    },
+    "ClientTaskCancelRequest": {
+      "type": "object",
+      "properties": {
+        "sessionId": {
+          "type": "string",
+          "description": "Session that owns the client task"
+        },
+        "id": {
+          "type": "string",
+          "description": "Canonical runtime-generated task identifier"
+        },
+        "clientTaskId": {
+          "type": "string",
+          "description": "Owner-scoped task key included for correlation"
+        },
+        "cancellationId": {
+          "type": "string",
+          "description": "Opaque identifier shared by coalesced cancellation callers"
+        },
+        "reason": {
+          "$ref": "#/definitions/ClientTaskCancelReason",
+          "description": "Reason the runtime requests cancellation"
+        }
+      },
+      "required": [
+        "sessionId",
+        "id",
+        "clientTaskId",
+        "cancellationId",
+        "reason"
+      ],
+      "additionalProperties": false,
+      "description": "Runtime-to-owner cancellation request for a client-owned task.",
+      "title": "ClientTaskCancelRequest",
+      "stability": "experimental"
+    },
+    "ClientTaskCancelResult": {
+      "type": "object",
+      "properties": {
+        "cancelled": {
+          "type": "boolean",
+          "description": "True only when the owner confirms that external work stopped before responding"
+        }
+      },
+      "required": [
+        "cancelled"
+      ],
+      "additionalProperties": false,
+      "description": "Whether the client authoritatively confirmed its external work stopped.",
+      "title": "ClientTaskCancelResult"
+    },
     "CommandList": {
       "type": "object",
       "properties": {
@@ -14937,6 +16041,14 @@
           "$ref": "#/definitions/ConnectClientInfo",
           "description": "Identity of the integrating host. Optional; omit it to keep the default attribution."
         },
+        "supportedTaskKinds": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TaskKind",
+            "description": "Closed set of public task kinds a connection can negotiate."
+          },
+          "description": "Task kinds this connection can decode when observing session tasks. Omit to retain agent and shell compatibility."
+        },
         "token": {
           "type": "string",
           "description": "Connection token; required when the server was started with COPILOT_CONNECTION_TOKEN"
@@ -14963,6 +16075,14 @@
         "version": {
           "type": "string",
           "description": "Server package version"
+        },
+        "taskKinds": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TaskKind",
+            "description": "Closed set of public task kinds a connection can negotiate."
+          },
+          "description": "Task kinds the server may return to this connection."
         }
       },
       "required": [
@@ -15199,6 +16319,10 @@
                       {
                         "type": "object",
                         "properties": {
+                          "id": {
+                            "type": "number",
+                            "description": "Numeric database ID of the organization."
+                          },
                           "login": {
                             "anyOf": [
                               {
@@ -15250,7 +16374,7 @@
               "type": "null"
             }
           ],
-          "description": "Organizations the user belongs to, each with an optional login and display name."
+          "description": "Organizations the user belongs to, each with an optional ID, login, and display name."
         },
         "codex_agent_enabled": {
           "type": "boolean",
@@ -15616,10 +16740,38 @@
         "contextTier": {
           "$ref": "#/definitions/ContextTier",
           "description": "Context tier for models that support multiple context-window sizes."
+        },
+        "autoTier": {
+          "$ref": "#/definitions/AutoTier",
+          "description": "Auto preference currently committed for the session. This can remain available while another model is selected so a later switch to `auto` can reuse it."
+        },
+        "pendingAutoTier": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoTier",
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Latest unclaimed Auto preference waiting for a future user turn. Null means the pending request is returning to provider-default routing."
+        },
+        "activatingAutoTier": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoTier",
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Auto preference currently claimed by an in-progress activation. Null means the activation is returning to provider-default routing."
         }
       },
       "additionalProperties": false,
-      "description": "The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.",
+      "description": "The session's authoritative model snapshot. Auto preference fields are configuration for the virtual `auto` model and do not change the selected model identifier. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.",
       "title": "CurrentModel"
     },
     "CurrentToolMetadata": {
@@ -16217,6 +17369,10 @@
           "type": "string",
           "description": "Plugin version that provided this server, when source is plugin."
         },
+        "effectiveSource": {
+          "$ref": "#/definitions/McpSourceRef",
+          "description": "Canonical identity and location of the effective server declaration."
+        },
         "enabled": {
           "type": "boolean",
           "description": "Whether the server is enabled (not in the disabled list)"
@@ -16491,11 +17647,11 @@
         "ok",
         "expired"
       ],
-      "description": "Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.",
+      "description": "Cursor status: 'ok' means the read succeeded against the requested history; 'expired' means the requested continuation is unavailable. Recovery is endpoint-specific: session.eventLog.read returns a boundary window of remaining active history that may overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page and never switches journal generations. An expired persisted read is not successful completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.",
       "title": "EventsCursorStatus",
       "x-enumDescriptions": {
-        "ok": "The cursor was applied successfully.",
-        "expired": "The cursor referred to history that is no longer available."
+        "ok": "The read succeeded against the requested history.",
+        "expired": "The requested continuation is unavailable; see the endpoint's recovery semantics."
       }
     },
     "EventsReadDirection": {
@@ -16527,11 +17683,11 @@
         },
         "hasMore": {
           "type": "boolean",
-          "description": "True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window."
+          "description": "True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count."
         },
         "cursorStatus": {
           "$ref": "#/definitions/EventsCursorStatus",
-          "description": "Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page."
+          "description": "Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read, 'expired' means the cursor referred to an event that no longer exists in active history and the read fell back to a boundary of the remaining history: the beginning for a forward read or the newest window for a backward read. That fallback may overlap already rendered events, so active-session consumers should reset, rebase, or deduplicate before continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired' returns an empty terminal page and never switches to a replacement journal generation. Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry."
         }
       },
       "required": [
@@ -17239,10 +18395,15 @@
         "runId": {
           "type": "string",
           "description": "Factory run identifier."
+        },
+        "executionToken": {
+          "type": "string",
+          "description": "Opaque token identifying the execution attempt to abort."
         }
       },
       "required": [
-        "runId"
+        "runId",
+        "executionToken"
       ],
       "additionalProperties": false,
       "description": "Parameters for cooperatively aborting a factory body.",
@@ -17273,15 +18434,15 @@
         },
         "reasoningEffort": {
           "type": "string",
-          "description": "Optional reasoning effort for the subagent. This field is accepted but not yet honored."
+          "description": "Optional reasoning effort override for the subagent."
         },
         "contextTier": {
           "$ref": "#/definitions/ContextTier",
-          "description": "Optional context tier for the subagent. This field is accepted but not yet honored."
+          "description": "Optional context tier override for the subagent."
         },
         "agent": {
           "type": "string",
-          "description": "Optional custom agent name for the subagent. This field is accepted but not yet honored."
+          "description": "Optional built-in or custom agent name whose definition configures the subagent."
         }
       },
       "additionalProperties": false,
@@ -17822,6 +18983,111 @@
       "title": "FactoryLogRequest",
       "stability": "experimental"
     },
+    "FactoryPauseCheckpointAction": {
+      "type": "string",
+      "enum": [
+        "continue",
+        "pause"
+      ],
+      "description": "Action the runtime selected for a durable factory pause checkpoint.",
+      "title": "FactoryPauseCheckpointAction",
+      "x-enumDescriptions": {
+        "continue": "The checkpoint was committed by a prior paused attempt, so execution may continue.",
+        "pause": "This attempt claimed the checkpoint and must cooperatively stop."
+      }
+    },
+    "FactoryPauseCheckpointRequest": {
+      "type": "object",
+      "properties": {
+        "runId": {
+          "type": "string",
+          "description": "Factory run identifier."
+        },
+        "executionToken": {
+          "type": "string",
+          "description": "Opaque token identifying the execution attempt that reached the checkpoint."
+        },
+        "key": {
+          "type": "string",
+          "description": "Stable author-defined checkpoint key."
+        }
+      },
+      "required": [
+        "runId",
+        "executionToken",
+        "key"
+      ],
+      "additionalProperties": false,
+      "description": "Parameters for an owned durable pause checkpoint.",
+      "title": "FactoryPauseCheckpointRequest",
+      "stability": "experimental"
+    },
+    "FactoryPauseCheckpointResult": {
+      "type": "object",
+      "properties": {
+        "action": {
+          "$ref": "#/definitions/FactoryPauseCheckpointAction",
+          "description": "Whether this execution attempt must pause or may continue."
+        }
+      },
+      "required": [
+        "action"
+      ],
+      "additionalProperties": false
+    },
+    "FactoryPauseInfo": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "user",
+              "description": "Factory pause initiator discriminator."
+            }
+          },
+          "required": [
+            "type"
+          ]
+        },
+        {
+          "type": "object",
+          "properties": {
+            "key": {
+              "type": "string",
+              "description": "Stable author-defined checkpoint key that initiated the pause."
+            },
+            "type": {
+              "type": "string",
+              "const": "checkpoint",
+              "description": "Factory pause initiator discriminator."
+            }
+          },
+          "required": [
+            "type",
+            "key"
+          ]
+        }
+      ],
+      "description": "Durable metadata describing who initiated a factory pause.",
+      "title": "FactoryPauseInfo"
+    },
+    "FactoryPauseRequest": {
+      "type": "object",
+      "properties": {
+        "runId": {
+          "type": "string",
+          "description": "Factory run identifier."
+        }
+      },
+      "required": [
+        "runId"
+      ],
+      "additionalProperties": false,
+      "description": "Parameters for pausing a running factory.",
+      "title": "FactoryPauseRequest",
+      "stability": "experimental"
+    },
     "FactoryPhaseObservation": {
       "type": "object",
       "properties": {
@@ -18209,6 +19475,10 @@
           ],
           "description": "Terminal run outcome, or null while nonterminal."
         },
+        "canResume": {
+          "type": "boolean",
+          "description": "Whether the durable run state currently passes runtime resume eligibility checks."
+        },
         "phases": {
           "type": "array",
           "items": {
@@ -18250,6 +19520,7 @@
         "observedAt",
         "activeSegmentStartedAt",
         "terminal",
+        "canResume",
         "phases",
         "agents",
         "progress"
@@ -18273,6 +19544,10 @@
               "exclusiveMinimum": 0,
               "description": "Approved effective ceiling that was reached."
             },
+            "suggestedValue": {
+              "type": "number",
+              "description": "Suggested larger ceiling when the runtime can derive one safely."
+            },
             "runId": {
               "type": "string",
               "description": "Factory run identifier."
@@ -18412,25 +19687,37 @@
       "type": "object",
       "properties": {
         "maxConcurrentSubagents": {
-          "type": "integer",
+          "type": [
+            "integer",
+            "null"
+          ],
           "minimum": 0,
           "exclusiveMinimum": 0,
           "description": "Maximum number of factory subagents that may run concurrently."
         },
         "maxTotalSubagents": {
-          "type": "integer",
+          "type": [
+            "integer",
+            "null"
+          ],
           "minimum": 0,
           "exclusiveMinimum": 0,
           "description": "Maximum total number of factory subagents that may be admitted."
         },
         "timeoutSeconds": {
-          "type": "number",
+          "type": [
+            "number",
+            "null"
+          ],
           "exclusiveMinimum": 0,
           "maximum": 2147483.647,
           "description": "Maximum accumulated active-execution time in seconds. Active execution includes the entire extension body, subprocess waits, queued-agent waits, and sleeps; time between resumed attempts is not counted."
         },
         "maxAiCredits": {
-          "type": "number",
+          "type": [
+            "number",
+            "null"
+          ],
           "exclusiveMinimum": 0,
           "description": "Maximum AI credits consumed by factory subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops."
         }
@@ -18501,6 +19788,10 @@
         "snapshot": {
           "description": "Partial journal and progress snapshot for a halted, cancelled, or errored run.",
           "x-opaque-json": true
+        },
+        "pauseInfo": {
+          "$ref": "#/definitions/FactoryPauseInfo",
+          "description": "Structured pause initiator metadata for a paused attempt."
         }
       },
       "required": [
@@ -18518,6 +19809,7 @@
         "running",
         "completed",
         "halted",
+        "paused",
         "cancelled",
         "error"
       ],
@@ -18528,6 +19820,7 @@
         "running": "The run is executing.",
         "completed": "The run completed successfully.",
         "halted": "The run was interrupted while resource budget remained.",
+        "paused": "The current attempt stopped intentionally and the run may be resumed.",
         "cancelled": "The run was cancelled before completion.",
         "error": "The factory body failed or reached a cumulative resource ceiling."
       }
@@ -18646,6 +19939,10 @@
             }
           ],
           "description": "Terminal run outcome, or null while nonterminal."
+        },
+        "canResume": {
+          "type": "boolean",
+          "description": "Whether the durable run state currently passes runtime resume eligibility checks."
         }
       },
       "required": [
@@ -18667,7 +19964,8 @@
         "approved",
         "observedAt",
         "activeSegmentStartedAt",
-        "terminal"
+        "terminal",
+        "canResume"
       ],
       "additionalProperties": false,
       "description": "Durable factory run summary with read-time live overlays.",
@@ -18692,8 +19990,23 @@
         "resultPreview": {
           "type": "string",
           "description": "Prompt-safe preview of the completed result."
+        },
+        "pauseInfo": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/FactoryPauseInfo",
+              "description": "Durable metadata describing who initiated a factory pause."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Pause initiator metadata, or null when the run did not pause."
         }
       },
+      "required": [
+        "pauseInfo"
+      ],
       "additionalProperties": false,
       "description": "Prompt-safe terminal factory outcome.",
       "title": "FactoryRunTerminal",
@@ -18796,10 +20109,27 @@
         "prompt": {
           "type": "string",
           "description": "Optional user prompt to combine with fleet instructions"
+        },
+        "attachments": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Attachment",
+            "description": "A user message attachment — a file, directory, code selection, blob, GitHub-anchored pointer, or extension-supplied context payload"
+          },
+          "description": "Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request"
+        },
+        "billable": {
+          "type": "boolean",
+          "description": "If false, this request will not trigger a Premium Request Unit charge. User requests default to billable.",
+          "visibility": "internal"
+        },
+        "wait": {
+          "type": "boolean",
+          "description": "If true, await completion of the agentic loop for this fleet request before returning. Defaults to false."
         }
       },
       "additionalProperties": false,
-      "description": "Optional user prompt to combine with the fleet orchestration instructions.",
+      "description": "Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.",
       "title": "FleetStartRequest",
       "stability": "experimental"
     },
@@ -21612,6 +22942,10 @@
           "minLength": 1,
           "pattern": "^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$",
           "description": "Name of the MCP server to remove"
+        },
+        "authClientIdMetadataUrl": {
+          "type": "string",
+          "description": "OAuth Client ID Metadata Document URL whose persisted credentials should also be removed."
         }
       },
       "required": [
@@ -21699,6 +23033,10 @@
         "workingDirectory": {
           "type": "string",
           "description": "Working directory used as context for discovery (e.g., plugin resolution)"
+        },
+        "includeEffectiveSource": {
+          "type": "boolean",
+          "description": "Whether to include canonical effectiveSource metadata for each discovered server. Callers must opt in so protocol-3 clients retain the legacy closed response shape."
         }
       },
       "additionalProperties": false,
@@ -23899,6 +25237,10 @@
         "error": {
           "type": "string",
           "description": "Error message if the server failed to connect"
+        },
+        "serverMetadata": {
+          "$ref": "#/definitions/McpServerMetadata",
+          "description": "Server-advertised metadata for a connected server. Omitted when no live connection metadata is available, including while pending or when failed, disabled, stopped, or not configured."
         }
       },
       "required": [
@@ -24555,6 +25897,24 @@
       "description": "MCP servers configured for the session, with their connection status and host-level state.",
       "title": "McpServerList"
     },
+    "McpServerMetadata": {
+      "type": "object",
+      "properties": {
+        "instructions": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Non-empty natural-language guidance for using the server, or null when the server omitted instructions or advertised an empty string."
+        }
+      },
+      "required": [
+        "instructions"
+      ],
+      "additionalProperties": false,
+      "description": "Server-advertised metadata learned through modern discovery or legacy initialization.",
+      "title": "McpServerMetadata"
+    },
     "McpServerNeedsAuthInfo": {
       "type": "object",
       "properties": {
@@ -24655,6 +26015,88 @@
       "description": "Env-value mode recorded on the session after the update.",
       "title": "McpSetEnvValueModeResult"
     },
+    "McpSourceFile": {
+      "type": "object",
+      "properties": {
+        "uri": {
+          "type": "string",
+          "format": "uri",
+          "description": "Canonical file URI for the configuration document"
+        },
+        "jsonPointer": {
+          "type": "string",
+          "description": "RFC 6901 JSON Pointer to the server declaration, when known"
+        }
+      },
+      "required": [
+        "uri"
+      ],
+      "additionalProperties": false,
+      "description": "Concrete configuration file containing an MCP server declaration.",
+      "title": "McpSourceFile"
+    },
+    "McpSourcePlugin": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Canonical plugin identity"
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Human-readable plugin name, when available"
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Plugin version, when available"
+        }
+      },
+      "required": [
+        "id"
+      ],
+      "additionalProperties": false,
+      "description": "Plugin identity associated with an MCP server declaration.",
+      "title": "McpSourcePlugin"
+    },
+    "McpSourceRef": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Open source-kind identifier. Known values include user, workspace, invocation, plugin, builtin, and device-registry."
+        },
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque stable identity for the configuration source. Clients must not parse this value."
+        },
+        "editability": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Open semantic editability identifier. Known values are editable and read-only."
+        },
+        "file": {
+          "$ref": "#/definitions/McpSourceFile",
+          "description": "Configuration file location, when the declaration is file-backed."
+        },
+        "plugin": {
+          "$ref": "#/definitions/McpSourcePlugin",
+          "description": "Plugin identity, when the declaration is plugin-provided."
+        }
+      },
+      "required": [
+        "kind",
+        "id",
+        "editability"
+      ],
+      "additionalProperties": false,
+      "description": "Canonical identity and location of the effective MCP server declaration. The declaration is uniquely addressed by this source id together with the discovered server name.",
+      "title": "McpSourceRef"
+    },
     "McpStartServerRequest": {
       "type": "object",
       "properties": {
@@ -25114,6 +26556,35 @@
         "cli": "Remote task originated from a CLI remote-session invocation."
       }
     },
+    "MetadataUpdateClientMetadataRequest": {
+      "type": "object",
+      "properties": {
+        "clear": {
+          "type": "boolean",
+          "description": "Remove every existing client metadata entry before applying remove and set. Defaults to false."
+        },
+        "remove": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 128,
+          "description": "Case-sensitive keys to remove. Missing keys are ignored. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces."
+        },
+        "set": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "String entries to add or replace. Set wins when a key also appears in remove. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Each value may contain at most 16 KiB of UTF-8 data.",
+          "maxProperties": 128
+        }
+      },
+      "additionalProperties": false,
+      "description": "Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.",
+      "title": "MetadataUpdateClientMetadataRequest",
+      "stability": "experimental"
+    },
     "Model": {
       "type": "object",
       "properties": {
@@ -25129,6 +26600,13 @@
           "$ref": "#/definitions/ModelCapabilities",
           "description": "Model capabilities and limits"
         },
+        "metadata": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Provider-supplied model metadata. Keys and JSON-compatible values are preserved unchanged. This is factual metadata published by the model provider; it carries no picker or UX semantics."
+        },
         "policy": {
           "$ref": "#/definitions/ModelPolicy",
           "description": "Policy state (if applicable)"
@@ -25220,6 +26698,10 @@
           "type": "string",
           "description": "Context tier selected by repository settings, when configured."
         },
+        "repoAutoTier": {
+          "type": "string",
+          "description": "Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant."
+        },
         "cliModel": {
           "type": "string",
           "description": "Model explicitly selected by the CLI, when provided."
@@ -25778,6 +27260,60 @@
         "unconfigured": "No explicit policy is configured for the model."
       }
     },
+    "ModelSetAllowedModelsRequest": {
+      "type": "object",
+      "properties": {
+        "allowedModels": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "minItems": 1,
+          "description": "Exact model IDs to permit, or null to clear the host restriction."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.",
+      "title": "ModelSetAllowedModelsRequest",
+      "stability": "experimental"
+    },
+    "ModelSetAllowedModelsResult": {
+      "type": "object",
+      "properties": {
+        "allowedModels": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Normalized host allowlist. Omitted when the host restriction was cleared, or when a relay client does not return the host policy."
+        },
+        "effectiveAllowedModels": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Effective exact IDs or repository policy patterns after applying the host restriction. Omitted by relay clients that do not return the host policy."
+        },
+        "fallbackModel": {
+          "type": "string",
+          "description": "Effective deterministic fallback model, when the policy defines one."
+        },
+        "modelId": {
+          "type": "string",
+          "description": "Selected session model after reconciling a now-disallowed concrete selection."
+        }
+      },
+      "additionalProperties": false,
+      "description": "The applied host allowlist and effective session model policy after intersection.",
+      "title": "ModelSetAllowedModelsResult"
+    },
     "ModelSetReasoningEffortRequest": {
       "type": "object",
       "properties": {
@@ -25832,6 +27368,104 @@
       "description": "Optional opaque account selection or compatibility GitHub token used to list models.",
       "title": "ModelsListRequest"
     },
+    "ModelSwitchAutoTierRequest": {
+      "type": "object",
+      "properties": {
+        "autoTier": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoTier",
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Auto preference to activate when a future user turn using the `auto` model safely mints a replacement model and token pair. Pass null to return to provider-default Auto routing."
+        },
+        "source": {
+          "$ref": "#/definitions/ModelChangeSource",
+          "description": "Origin to record on the effective `session.model_change` event. Defaults to `sdk` when omitted."
+        }
+      },
+      "required": [
+        "autoTier"
+      ],
+      "additionalProperties": false,
+      "description": "An Auto preference request for the session. This updates Auto configuration only; it does not change the selected model to `auto`.",
+      "title": "ModelSwitchAutoTierRequest",
+      "stability": "experimental"
+    },
+    "ModelSwitchAutoTierResult": {
+      "type": "object",
+      "properties": {
+        "status": {
+          "$ref": "#/definitions/ModelSwitchAutoTierStatus",
+          "description": "Immediate request status. `pending` means accepted but not committed."
+        },
+        "effectiveAutoTier": {
+          "$ref": "#/definitions/AutoTier",
+          "description": "Auto preference currently committed for the session."
+        },
+        "pendingAutoTier": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoTier",
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Latest unclaimed Auto preference waiting for a future user turn."
+        },
+        "activatingAutoTier": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoTier",
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Auto preference currently claimed by an in-progress activation. Null means the activation is returning to provider-default routing."
+        },
+        "supersededAutoTier": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoTier",
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Earlier unclaimed preference replaced by this request. This can be present with either status, including when selecting the effective preference cancels pending work."
+        }
+      },
+      "required": [
+        "status"
+      ],
+      "additionalProperties": false,
+      "description": "Immediate acknowledgement and Auto preference snapshot after a switch request. This result never implies that a pending preference committed.",
+      "title": "ModelSwitchAutoTierResult",
+      "stability": "experimental"
+    },
+    "ModelSwitchAutoTierStatus": {
+      "type": "string",
+      "enum": [
+        "unchanged",
+        "pending"
+      ],
+      "description": "Whether the requested preference was already effective or was accepted for later transactional activation.",
+      "title": "ModelSwitchAutoTierStatus",
+      "x-enumDescriptions": {
+        "unchanged": "The requested preference is already effective. No activation is pending for it, although this request may have cancelled an earlier unclaimed preference reported in `supersededAutoTier`.",
+        "pending": "The request was accepted but has not committed. A later user turn using the `auto` model must mint and validate the replacement before it becomes effective."
+      },
+      "stability": "experimental"
+    },
     "ModelSwitchConfirmation": {
       "type": "object",
       "properties": {
@@ -25862,6 +27496,18 @@
           "type": "string",
           "description": "Model selection id to switch to, as returned by `list`. A bare id (e.g. `claude-sonnet-4.6`) names a Copilot (CAPI) model; a provider-qualified id (`provider/id`, e.g. `acme/claude-sonnet`) targets a registry BYOK model."
         },
+        "autoTier": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoTier",
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Optional Auto routing preference to stage atomically with selecting `auto`. Pass null to return to provider-default Auto routing. This field is rejected when `modelId` is not `auto`."
+        },
         "reasoningEffort": {
           "type": "string",
           "description": "Reasoning effort level to use for the model. CAPI values are model-defined and validated against the selected model; BYOK providers may define additional values. \"none\" disables reasoning. When omitted, no effort override is applied."
@@ -25960,6 +27606,10 @@
             "type": "string"
           },
           "description": "Deprecation warnings associated with the selected model or options."
+        },
+        "modelState": {
+          "$ref": "#/definitions/CurrentModel",
+          "description": "Authoritative model and Auto preference state after an immediate switch. For deferred switches this remains the current state until the queued change drains."
         }
       },
       "required": [],
@@ -25986,6 +27636,10 @@
           "$ref": "#/definitions/SessionMode",
           "description": "The session mode the agent is operating in"
         },
+        "expectedMode": {
+          "$ref": "#/definitions/SessionMode",
+          "description": "Mode the session must currently be in for the change to apply. When set and the session is in a different mode the request is a no-op and reports status 'unchanged'."
+        },
         "inheritPlanBaseFromSessionId": {
           "type": "string",
           "description": "Session whose plan-mode base state should be inherited."
@@ -26046,6 +27700,10 @@
           "type": "boolean",
           "description": "Whether applying the mode changed the active model."
         },
+        "modeApplied": {
+          "type": "boolean",
+          "description": "Whether the requested mode was applied to the session. False only when an 'expectedMode' precondition did not hold, in which case any model change reported alongside it was still applied."
+        },
         "confirmation": {
           "$ref": "#/definitions/ModelSwitchConfirmation",
           "description": "Compaction confirmation required before the mode change can complete."
@@ -27490,7 +29148,8 @@
         "assisted_approval",
         "human_response",
         "host_policy",
-        "unattended_fallback"
+        "unattended_fallback",
+        "authorization_carry_forward"
       ],
       "description": "Controlled reason or actor responsible for a permission response.",
       "title": "PermissionDecisionSource",
@@ -27498,7 +29157,8 @@
         "assisted_approval": "The response followed the assisted-approval judge recommendation.",
         "human_response": "A human supplied the response through an interactive prompt.",
         "host_policy": "The host applied a standing policy or override rather than a judge recommendation or human decision.",
-        "unattended_fallback": "The host denied the request because no interactive user response was available."
+        "unattended_fallback": "The host denied the request because no interactive user response was available.",
+        "authorization_carry_forward": "A live authorization record from an earlier human decision in this session contained the proposal, so it ran without another prompt. This is not a new human decision and never mints authority of its own."
       }
     },
     "PermissionDecisionSurface": {
@@ -28986,6 +30646,10 @@
           "type": "integer",
           "description": "Number of skills discovered and installed from the plugin"
         },
+        "stagingMode": {
+          "$ref": "#/definitions/PluginInstallStagingMode",
+          "description": "Where the completed plugin tree was staged before atomic promotion"
+        },
         "postInstallMessage": {
           "type": "string",
           "description": "Optional post-install message provided by the plugin (e.g. setup instructions)"
@@ -29003,6 +30667,19 @@
       "description": "Result of installing a plugin.",
       "title": "PluginInstallResult"
     },
+    "PluginInstallStagingMode": {
+      "type": "string",
+      "enum": [
+        "external",
+        "destination_sibling"
+      ],
+      "description": "Where completed plugin content was staged before atomic promotion.",
+      "title": "PluginInstallStagingMode",
+      "x-enumDescriptions": {
+        "external": "A sibling of the installed-plugins root, outside the recursively watched tree.",
+        "destination_sibling": "A sibling of the destination plugin directory, used when external staging is unavailable."
+      }
+    },
     "PluginList": {
       "type": "object",
       "properties": {
@@ -29069,13 +30746,17 @@
             "type": "string"
           },
           "description": "Plugin names or \"plugin@marketplace\" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins."
+        },
+        "workingDirectory": {
+          "type": "string",
+          "description": "Working directory whose repository `enabledPlugins` overlay decides whether this mutation is repository-controlled. Hosts that serve sessions across several repositories (the SDK server) should pass the session's directory; otherwise the guard is evaluated against the server process's own working directory, which may belong to a different repository. Defaults to the server's current working directory."
         }
       },
       "required": [
         "names"
       ],
       "additionalProperties": false,
-      "description": "Plugin names (or specs) to disable.",
+      "description": "Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against.",
       "title": "PluginsDisableRequest"
     },
     "PluginsEnableRequest": {
@@ -29087,13 +30768,17 @@
             "type": "string"
           },
           "description": "Plugin names or \"plugin@marketplace\" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API."
+        },
+        "workingDirectory": {
+          "type": "string",
+          "description": "Working directory whose repository `enabledPlugins` overlay decides whether this mutation is repository-controlled. Hosts that serve sessions across several repositories (the SDK server) should pass the session's directory; otherwise the guard is evaluated against the server process's own working directory, which may belong to a different repository. Defaults to the server's current working directory."
         }
       },
       "required": [
         "names"
       ],
       "additionalProperties": false,
-      "description": "Plugin names (or specs) to enable.",
+      "description": "Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against.",
       "title": "PluginsEnableRequest"
     },
     "PluginsInstallRequest": {
@@ -31227,6 +32912,25 @@
       "title": "ReleaseEventInterestParams",
       "stability": "experimental"
     },
+    "RemediationAction": {
+      "type": "string",
+      "enum": [
+        "sign_in",
+        "switch_account",
+        "show_account",
+        "review_sandbox_policy",
+        "allow_sandbox_outbound"
+      ],
+      "description": "What the user must do to recover from a failure, named as an action rather than as one client's affordance. The runtime cannot know which affordance a client offers — a slash command, a settings pane, a link — so the accompanying message stays host-agnostic and each client renders its own copy from this value. Absent when the runtime knows of no action the user can take.",
+      "title": "RemediationAction",
+      "x-enumDescriptions": {
+        "sign_in": "Authenticate again with the Copilot backend. The current credential is absent, expired, or rejected.",
+        "switch_account": "Authenticate as a different account. The current account exists but lacks access to the requested resource.",
+        "show_account": "Inspect which account is currently authenticated before deciding what to change.",
+        "review_sandbox_policy": "Review or widen the sandbox policy. The blocked path or host is named by the accompanying message or by the tool result the action arrived with.",
+        "allow_sandbox_outbound": "Permit outbound network access in the sandbox policy."
+      }
+    },
     "RemoteControlConfig": {
       "type": "object",
       "properties": {
@@ -31759,6 +33463,28 @@
           "type": "boolean",
           "description": "Whether to auto-add the current working directory to readwritePaths. Default: true."
         },
+        "sandboxMcpServers": {
+          "type": "boolean",
+          "description": "Whether MCP servers the session launches are confined by the sandbox. Only an explicit `false` opts out; doing so also lets remote-MCP egress leave the sandbox, so the flag and `enabled` are always read together. Ignored while `enabled` is false. Default: true (enabled by default; set to false to opt out)."
+        },
+        "sandboxLspServers": {
+          "type": "boolean",
+          "description": "Whether language servers the session launches are confined by the sandbox. Only an explicit `false` opts out. Ignored while `enabled` is false. Default: true (enabled by default; set to false to opt out)."
+        },
+        "allowBypass": {
+          "type": "boolean",
+          "description": "Whether the agent may request that an individual command run outside the sandbox, which the host then approves or denies through the usual permission flow. A host capability flag rather than part of the policy: it is stripped from the effective spawn policy and only has an effect while `enabled` is true. Fail-closed, unlike the opt-out flags on this object: omitting it offers no bypass. Default: false (opt-in)."
+        },
+        "managedMcpRoutingLocked": {
+          "type": "boolean",
+          "description": "Set by the runtime when a managed policy forced `sandboxMcpServers` on and took the local opt-out away. Provenance rather than policy: it lets a sandbox startup failure point at the administrator instead of a setting the next managed merge would override, and it is ignored when comparing two configs for change. Only the managed merge may set it; a caller-supplied value is stripped.",
+          "visibility": "internal"
+        },
+        "managedLspRoutingLocked": {
+          "type": "boolean",
+          "description": "The `sandboxLspServers` counterpart of `managedMcpRoutingLocked`.",
+          "visibility": "internal"
+        },
         "auth": {
           "$ref": "#/definitions/SandboxConfigAuth",
           "description": "Credential-injection capability flags."
@@ -31952,6 +33678,46 @@
       "description": "macOS seatbelt-specific options.",
       "title": "SandboxConfigUserPolicySeatbelt"
     },
+    "SandboxDisableForSessionRequest": {
+      "type": "object",
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "description": "Identifier of the exact pending sandbox-bypass permission request that authorized the session opt-out."
+        },
+        "decisionContext": {
+          "$ref": "#/definitions/PermissionDecisionContext",
+          "description": "Optional attribution for the permission decision."
+        }
+      },
+      "required": [
+        "requestId"
+      ],
+      "additionalProperties": false,
+      "description": "Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.",
+      "title": "SandboxDisableForSessionRequest",
+      "stability": "experimental"
+    },
+    "SandboxDisableForSessionResult": {
+      "type": "object",
+      "properties": {
+        "success": {
+          "type": "boolean",
+          "description": "Whether this call resolved the pending request and applied the session opt-out."
+        },
+        "enabled": {
+          "type": "boolean",
+          "description": "The authoritative sandbox enabled state after the operation."
+        }
+      },
+      "required": [
+        "success",
+        "enabled"
+      ],
+      "additionalProperties": false,
+      "description": "Result of attempting to disable sandboxing for the current session.",
+      "title": "SandboxDisableForSessionResult"
+    },
     "SandboxEnforcementStatus": {
       "type": "object",
       "properties": {
@@ -33224,7 +34990,7 @@
         "content"
       ],
       "additionalProperties": false,
-      "description": "File path, content to append, and optional mode for the client-provided session filesystem.",
+      "description": "File path, content to append, and optional mode for the client-provided session filesystem. Implementations create parent directories as needed.",
       "title": "SessionFsAppendFileRequest",
       "stability": "experimental"
     },
@@ -34603,6 +36369,10 @@
           "type": "string",
           "description": "Identifier of the client driving the session."
         },
+        "authClientIdMetadataUrl": {
+          "type": "string",
+          "description": "OAuth Client ID Metadata Document URL used by this host for MCP authorization."
+        },
         "clientKind": {
           "type": "string",
           "description": "Structured client kind used for runtime behavior gates."
@@ -34831,6 +36601,10 @@
           "type": "boolean",
           "description": "Whether to skip custom instruction sources."
         },
+        "refreshCustomInstructions": {
+          "type": "boolean",
+          "description": "Whether to invalidate cached custom-instruction discovery before constructing the session. Use when instruction files may have changed earlier in the same runtime process."
+        },
         "disabledInstructionSources": {
           "type": "array",
           "items": {
@@ -35235,6 +37009,122 @@
       "description": "Session IDs from the input set that are currently in use by another process.",
       "title": "SessionsCheckInUseResult"
     },
+    "SessionsClientMetadataEntry": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "metadata": {
+              "$ref": "#/definitions/ClientMetadata",
+              "description": "Validated client metadata, possibly empty or projected to requested keys."
+            },
+            "status": {
+              "type": "string",
+              "const": "ok",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId",
+            "metadata"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "status": {
+              "type": "string",
+              "const": "notFound",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "status": {
+              "type": "string",
+              "const": "corrupt",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "status": {
+              "type": "string",
+              "const": "unsupportedVersion",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "code": {
+              "type": "string",
+              "description": "Filesystem or provider error code. Clients should not assume every provider uses operating-system error codes."
+            },
+            "message": {
+              "type": "string",
+              "description": "Human-readable diagnostic message. Not stable for programmatic matching."
+            },
+            "status": {
+              "type": "string",
+              "const": "unavailable",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId",
+            "code",
+            "message"
+          ],
+          "additionalProperties": false
+        }
+      ],
+      "description": "Client metadata outcome for one requested local session.",
+      "title": "SessionsClientMetadataEntry"
+    },
     "SessionsCloseRequest": {
       "type": "object",
       "properties": {
@@ -35763,6 +37653,42 @@
       "description": "Dynamic-context board entry count, when available.",
       "title": "SessionsGetBoardEntryCountResult"
     },
+    "SessionsGetClientMetadataRequest": {
+      "type": "object",
+      "properties": {
+        "sessionIds": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 1000,
+          "description": "Session IDs to inspect. Results preserve this order."
+        },
+        "keys": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 128,
+          "description": "Case-sensitive keys to project from each valid bag. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Omit to return every entry."
+        }
+      },
+      "required": [
+        "sessionIds"
+      ],
+      "additionalProperties": false,
+      "description": "Bounded batch request for client-owned metadata from persisted local sessions.",
+      "title": "SessionsGetClientMetadataRequest"
+    },
+    "SessionsGetClientMetadataResult": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/SessionsClientMetadataEntry",
+        "description": "Client metadata outcome for one requested local session."
+      },
+      "description": "Ordered client metadata outcomes for the requested local sessions.",
+      "title": "SessionsGetClientMetadataResult"
+    },
     "SessionsGetEventFilePathRequest": {
       "type": "object",
       "properties": {
@@ -36324,17 +38250,17 @@
         },
         "cursor": {
           "type": "string",
-          "description": "Opaque cursor returned by a previous persisted-event read. Omit on the first call."
+          "description": "Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page."
         },
         "max": {
           "type": "integer",
           "exclusiveMinimum": 0,
           "maximum": 1000,
-          "description": "Maximum number of events to return in this batch (1–1000, default 200)."
+          "description": "Maximum number of events to return in this batch (1–1000, default 200). Pages may contain fewer events to keep the serialized event array within a soft 1 MiB budget including resolved binary assets; one oversized event is returned alone to guarantee progress."
         },
         "direction": {
           "$ref": "#/definitions/EventsReadDirection",
-          "description": "Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological."
+          "description": "Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological. This selects the initial read only; a continuation always uses the direction bound into its cursor."
         }
       },
       "required": [
@@ -38198,6 +40124,10 @@
         "url": {
           "type": "string",
           "description": "Optional URL associated with the timeline entry."
+        },
+        "remediation": {
+          "$ref": "#/definitions/RemediationAction",
+          "description": "What the user must do to recover, when the entry reports a failure the runtime knows an action for. The `text` never names a client affordance, so a client that offers one renders it from this value."
         }
       },
       "required": [
@@ -38215,7 +40145,7 @@
               "type": "object",
               "additionalProperties": {
                 "$ref": "#/definitions/SubagentSettingsEntry",
-                "description": "Subagent model, reasoning effort, and context tier settings"
+                "description": "Subagent model, reasoning effort, context tier, and auto-invocation settings"
               },
               "description": "Per-agent settings keyed by subagent agent_type"
             },
@@ -38267,10 +40197,14 @@
         "contextTier": {
           "$ref": "#/definitions/SubagentSettingsEntryContextTier",
           "description": "Context tier override for matching subagents"
+        },
+        "autoInvoke": {
+          "type": "boolean",
+          "description": "Whether this agent's runtime-defined proactive invocation prompting is enabled, if supported. Currently consumed by the built-in rubber-duck agent."
         }
       },
       "additionalProperties": false,
-      "description": "Subagent model, reasoning effort, and context tier settings",
+      "description": "Subagent model, reasoning effort, context tier, and auto-invocation settings",
       "title": "SubagentSettingsEntry"
     },
     "SubagentSettingsEntryContextTier": {
@@ -38422,6 +40356,426 @@
       "description": "Progress snapshot for an agent task, with recent activity lines and optional latest intent.",
       "title": "TaskAgentProgress"
     },
+    "TaskClientActiveStatus": {
+      "type": "string",
+      "enum": [
+        "running",
+        "idle"
+      ],
+      "description": "Active status a client owner may publish with a progress update.",
+      "title": "TaskClientActiveStatus",
+      "x-enumDescriptions": {
+        "running": "The external owner is actively working.",
+        "idle": "The external owner is connected but waiting."
+      }
+    },
+    "TaskClientExecutionMode": {
+      "type": "string",
+      "enum": [
+        "background"
+      ],
+      "description": "Client-owned tasks always execute outside the runtime in background mode.",
+      "title": "TaskClientExecutionMode"
+    },
+    "TaskClientInfo": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "$ref": "#/definitions/TaskClientType",
+          "const": "client",
+          "description": "Task kind"
+        },
+        "id": {
+          "type": "string",
+          "description": "Canonical runtime-generated task identifier"
+        },
+        "clientTaskId": {
+          "type": "string",
+          "description": "Owner-scoped registration and reclaim key"
+        },
+        "displayName": {
+          "type": "string",
+          "description": "Optional task display name"
+        },
+        "description": {
+          "type": "string",
+          "description": "Task description"
+        },
+        "status": {
+          "$ref": "#/definitions/TaskClientStatus",
+          "description": "Client task lifecycle status"
+        },
+        "owner": {
+          "$ref": "#/definitions/TaskClientOwner",
+          "description": "Public attribution and presence for the task owner"
+        },
+        "startedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the task started"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp of the latest accepted lifecycle change"
+        },
+        "completedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the task reached a terminal status"
+        },
+        "activeTimeMs": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Accumulated active execution time in milliseconds"
+        },
+        "activeStartedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the current active segment started"
+        },
+        "idleSince": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the connected owner entered idle status"
+        },
+        "orphanedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp of the most recent orphan transition"
+        },
+        "reclaimedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp of the most recent successful reclaim"
+        },
+        "executionMode": {
+          "$ref": "#/definitions/TaskClientExecutionMode",
+          "description": "Execution mode, which is always background for client-owned tasks"
+        },
+        "canCancel": {
+          "type": "boolean",
+          "description": "Whether the currently bound owner can receive a cancellation request"
+        },
+        "sequence": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Sequence number of the latest accepted owner update"
+        },
+        "result": {
+          "description": "Opaque successful terminal result supplied by the task owner",
+          "x-opaque-json": true
+        },
+        "error": {
+          "type": "string",
+          "description": "Human-readable terminal failure message"
+        },
+        "errorCode": {
+          "type": "string",
+          "description": "Optional owner-supplied terminal failure code"
+        },
+        "cancellationReason": {
+          "type": "string",
+          "description": "Human-readable reason for terminal cancellation"
+        }
+      },
+      "required": [
+        "type",
+        "id",
+        "clientTaskId",
+        "description",
+        "status",
+        "owner",
+        "startedAt",
+        "updatedAt",
+        "activeTimeMs",
+        "executionMode",
+        "canCancel",
+        "sequence"
+      ],
+      "additionalProperties": false,
+      "description": "Tracked client-owned task metadata.",
+      "title": "TaskClientInfo"
+    },
+    "TaskClientOwner": {
+      "type": "object",
+      "properties": {
+        "participantId": {
+          "type": "string",
+          "description": "Opaque session-scoped participant identity"
+        },
+        "joinId": {
+          "type": "string",
+          "description": "Opaque identity of the currently or most recently bound session join"
+        },
+        "kind": {
+          "$ref": "#/definitions/TaskClientOwnerKind",
+          "description": "Class of the task owner"
+        },
+        "displayName": {
+          "type": "string",
+          "description": "Display-only owner name"
+        },
+        "source": {
+          "type": "string",
+          "description": "Display-only owner source"
+        },
+        "presence": {
+          "$ref": "#/definitions/TaskClientOwnerPresence",
+          "description": "Whether this task's bound join is currently connected"
+        },
+        "disconnectedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp when the bound join disconnected"
+        }
+      },
+      "required": [
+        "participantId",
+        "joinId",
+        "kind",
+        "presence"
+      ],
+      "additionalProperties": false,
+      "description": "Public owner attribution for a client-owned task. Identifiers are opaque and never authorize requests.",
+      "title": "TaskClientOwner"
+    },
+    "TaskClientOwnerKind": {
+      "type": "string",
+      "enum": [
+        "extension",
+        "sdk"
+      ],
+      "description": "Connection class owning a client task.",
+      "title": "TaskClientOwnerKind",
+      "x-enumDescriptions": {
+        "extension": "A discovered extension connection owns the task.",
+        "sdk": "A generic SDK connection owns the task."
+      }
+    },
+    "TaskClientOwnerPresence": {
+      "type": "string",
+      "enum": [
+        "connected",
+        "disconnected"
+      ],
+      "description": "Presence of the task's bound join.",
+      "title": "TaskClientOwnerPresence",
+      "x-enumDescriptions": {
+        "connected": "The bound session join is connected.",
+        "disconnected": "The bound session join is disconnected."
+      }
+    },
+    "TaskClientProgress": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "$ref": "#/definitions/TaskClientType",
+          "const": "client",
+          "description": "Progress kind"
+        },
+        "status": {
+          "$ref": "#/definitions/TaskClientStatus",
+          "description": "Current client task lifecycle status"
+        },
+        "sequence": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Sequence number of the latest accepted owner update"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "ISO 8601 timestamp of the latest accepted lifecycle change"
+        },
+        "phase": {
+          "type": "string",
+          "description": "Current owner-defined progress phase"
+        },
+        "percentage": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 100,
+          "description": "Current completion percentage from zero through one hundred"
+        },
+        "lastMessage": {
+          "type": "string",
+          "description": "Most recent nonempty progress message"
+        },
+        "recentActivity": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/TaskProgressLine",
+            "description": "Timestamped display line for task progress output or recent agent activity."
+          },
+          "description": "Recent server-timestamped progress messages"
+        }
+      },
+      "required": [
+        "type",
+        "status",
+        "sequence",
+        "updatedAt",
+        "recentActivity"
+      ],
+      "additionalProperties": false,
+      "description": "Generic progress for a client-owned task.",
+      "title": "TaskClientProgress"
+    },
+    "TaskClientStatus": {
+      "type": "string",
+      "enum": [
+        "running",
+        "idle",
+        "completed",
+        "failed",
+        "cancelled",
+        "orphaned"
+      ],
+      "description": "Lifecycle status of a client-owned task.",
+      "title": "TaskClientStatus",
+      "x-enumDescriptions": {
+        "running": "The external owner is actively working.",
+        "idle": "The external owner is connected but waiting.",
+        "completed": "The owner reported successful completion.",
+        "failed": "The owner reported failure.",
+        "cancelled": "The owner reported or confirmed cancellation.",
+        "orphaned": "The bound owner join disappeared; external executor state is unknown."
+      }
+    },
+    "TaskClientType": {
+      "type": "string",
+      "enum": [
+        "client"
+      ],
+      "description": "Discriminator for a client-owned task.",
+      "title": "TaskClientType"
+    },
+    "TaskClientUpdate": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "status": {
+              "$ref": "#/definitions/TaskClientActiveStatus",
+              "description": "Optional active status transition"
+            },
+            "message": {
+              "type": "string",
+              "description": "Optional progress message appended to recent activity when nonempty"
+            },
+            "phase": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional progress phase; null clears the current phase"
+            },
+            "percentage": {
+              "anyOf": [
+                {
+                  "type": "number"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "description": "Optional completion percentage; null clears the current percentage"
+            },
+            "kind": {
+              "type": "string",
+              "const": "progress",
+              "description": "Client task update variant discriminator."
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "additionalProperties": false,
+          "description": "Publishes nonterminal progress for a running or idle client task."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "message": {
+              "type": "string",
+              "description": "Optional final progress message"
+            },
+            "result": {
+              "description": "Optional opaque successful terminal result",
+              "x-opaque-json": true
+            },
+            "kind": {
+              "type": "string",
+              "const": "completed",
+              "description": "Client task update variant discriminator."
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "additionalProperties": false,
+          "description": "Reports successful terminal completion."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "message": {
+              "type": "string",
+              "description": "Optional final progress message"
+            },
+            "error": {
+              "type": "string",
+              "description": "Human-readable terminal failure message"
+            },
+            "code": {
+              "type": "string",
+              "description": "Optional owner-supplied terminal failure code"
+            },
+            "kind": {
+              "type": "string",
+              "const": "failed",
+              "description": "Client task update variant discriminator."
+            }
+          },
+          "required": [
+            "kind",
+            "error"
+          ],
+          "additionalProperties": false,
+          "description": "Reports terminal failure."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "message": {
+              "type": "string",
+              "description": "Optional final progress message"
+            },
+            "reason": {
+              "type": "string",
+              "description": "Optional human-readable cancellation reason"
+            },
+            "kind": {
+              "type": "string",
+              "const": "cancelled",
+              "description": "Client task update variant discriminator."
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "additionalProperties": false,
+          "description": "Reports terminal cancellation after external work stopped."
+        }
+      ],
+      "description": "Progress or terminal update for a client-owned task.",
+      "title": "TaskClientUpdate"
+    },
     "TaskCompleteData": {
       "type": "object",
       "properties": {
@@ -38522,14 +40876,33 @@
           "$ref": "#/definitions/TaskAgentInfo",
           "description": "Tracked background agent task metadata, including IDs, status, timing, agent type, prompt, model, result, and latest response."
         },
+        {
+          "$ref": "#/definitions/TaskClientInfo",
+          "description": "Tracked client-owned task metadata."
+        },
         {
           "$ref": "#/definitions/TaskShellInfo",
           "description": "Tracked shell task metadata, including ID, command, status, timing, attachment/execution mode, log path, and PID."
         }
       ],
-      "description": "Tracked task union returned by task APIs, containing either an agent task or a shell task.",
+      "description": "Tracked task union returned by task APIs, containing an agent, client, or shell task.",
       "title": "TaskInfo"
     },
+    "TaskKind": {
+      "type": "string",
+      "enum": [
+        "agent",
+        "shell",
+        "client"
+      ],
+      "description": "Closed set of public task kinds a connection can negotiate.",
+      "title": "TaskKind",
+      "x-enumDescriptions": {
+        "agent": "Runtime-owned background agent task.",
+        "shell": "Runtime-owned shell task.",
+        "client": "Client-owned externally executed task."
+      }
+    },
     "TaskList": {
       "type": "object",
       "properties": {
@@ -38537,7 +40910,7 @@
           "type": "array",
           "items": {
             "$ref": "#/definitions/TaskInfo",
-            "description": "Tracked task union returned by task APIs, containing either an agent task or a shell task."
+            "description": "Tracked task union returned by task APIs, containing an agent, client, or shell task."
           },
           "description": "Currently tracked tasks"
         }
@@ -38552,16 +40925,16 @@
     "TaskProgress": {
       "anyOf": [
         {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/TaskAgentProgress",
-              "description": "Progress snapshot for an agent task, with recent activity lines and optional latest intent."
-            },
-            {
-              "$ref": "#/definitions/TaskShellProgress",
-              "description": "Progress snapshot for a shell task, with recent stdout/stderr output and optional process ID."
-            }
-          ]
+          "$ref": "#/definitions/TaskAgentProgress",
+          "description": "Progress snapshot for an agent task, with recent activity lines and optional latest intent."
+        },
+        {
+          "$ref": "#/definitions/TaskClientProgress",
+          "description": "Generic progress for a client-owned task."
+        },
+        {
+          "$ref": "#/definitions/TaskShellProgress",
+          "description": "Progress snapshot for a shell task, with recent stdout/stderr output and optional process ID."
         },
         {
           "type": "null"
@@ -38825,6 +41198,72 @@
       "description": "Refresh metadata for any detached background shells the runtime knows about. Use after a long pause to pick up exit/output state for shells running outside the agent loop.",
       "title": "TasksRefreshResult"
     },
+    "TasksRegisterRequest": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "$ref": "#/definitions/TaskClientType",
+          "const": "client",
+          "description": "Task kind"
+        },
+        "clientTaskId": {
+          "type": "string",
+          "description": "Owner-scoped idempotency key used for registration and reclaim"
+        },
+        "description": {
+          "type": "string",
+          "description": "Human-readable description of the external work"
+        },
+        "displayName": {
+          "type": "string",
+          "description": "Optional short display name for the external work"
+        },
+        "cancellable": {
+          "type": "boolean",
+          "description": "Whether the owner supports runtime cancellation requests"
+        },
+        "expectedSequence": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Expected current sequence for idempotent registration or orphan reclaim"
+        }
+      },
+      "required": [
+        "type",
+        "clientTaskId",
+        "description",
+        "cancellable"
+      ],
+      "additionalProperties": false,
+      "description": "Registers or reclaims a client-owned task.",
+      "title": "TasksRegisterRequest",
+      "stability": "experimental"
+    },
+    "TasksRegisterResult": {
+      "type": "object",
+      "properties": {
+        "task": {
+          "$ref": "#/definitions/TaskClientInfo",
+          "description": "Authoritative registered or reclaimed task"
+        },
+        "created": {
+          "type": "boolean",
+          "description": "True only when this invocation created a new task"
+        },
+        "reclaimed": {
+          "type": "boolean",
+          "description": "True only when this invocation reclaimed an orphaned task"
+        }
+      },
+      "required": [
+        "task",
+        "created",
+        "reclaimed"
+      ],
+      "additionalProperties": false,
+      "description": "Result of registering or reclaiming a client-owned task.",
+      "title": "TasksRegisterResult"
+    },
     "TasksRemoveRequest": {
       "type": "object",
       "properties": {
@@ -38968,6 +41407,58 @@
         "cancelled": "The task was cancelled before completion."
       }
     },
+    "TasksUpdateRequest": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "Canonical runtime-generated task identifier"
+        },
+        "sequence": {
+          "type": "integer",
+          "minimum": 0,
+          "description": "Owner update sequence to apply"
+        },
+        "update": {
+          "$ref": "#/definitions/TaskClientUpdate",
+          "description": "Progress or terminal update payload"
+        }
+      },
+      "required": [
+        "id",
+        "sequence",
+        "update"
+      ],
+      "additionalProperties": false,
+      "description": "Updates a client-owned task.",
+      "title": "TasksUpdateRequest",
+      "stability": "experimental"
+    },
+    "TasksUpdateResult": {
+      "type": "object",
+      "properties": {
+        "task": {
+          "$ref": "#/definitions/TaskClientInfo",
+          "description": "Authoritative task after processing the update"
+        },
+        "applied": {
+          "type": "boolean",
+          "description": "Whether this invocation changed task state"
+        },
+        "duplicate": {
+          "type": "boolean",
+          "description": "Whether this invocation repeated the latest accepted update"
+        }
+      },
+      "required": [
+        "task",
+        "applied",
+        "duplicate"
+      ],
+      "additionalProperties": false,
+      "description": "Result of publishing a client-owned task update.",
+      "title": "TasksUpdateResult"
+    },
     "TasksWaitForPendingResult": {
       "type": "object",
       "properties": {},