@github/copilot-sdk-linuxmusl-x64 1.0.13 → 1.0.14-preview.0

package/schemas/api.schema.json

@@ -400,7 +400,7 @@
         "description": "Enables installed plugins for new sessions.",
         "params": {
           "$ref": "#/definitions/PluginsEnableRequest",
-          "description": "Plugin names (or specs) to enable."
+          "description": "Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against."
         },
         "result": {
           "type": "null"
@@ -412,7 +412,7 @@
         "description": "Disables installed plugins for new sessions.",
         "params": {
           "$ref": "#/definitions/PluginsDisableRequest",
-          "description": "Plugin names (or specs) to disable."
+          "description": "Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against."
         },
         "result": {
           "type": "null"
@@ -808,9 +808,22 @@
         "stability": "experimental",
         "visibility": "internal"
       },
+      "getClientMetadata": {
+        "rpcMethod": "sessions.getClientMetadata",
+        "description": "Reads client-owned metadata for multiple persisted local sessions without opening them. Results preserve request order and report missing, corrupt, unsupported, or temporarily unavailable sessions independently.",
+        "params": {
+          "$ref": "#/definitions/SessionsGetClientMetadataRequest",
+          "description": "Bounded batch request for client-owned metadata from persisted local sessions."
+        },
+        "result": {
+          "$ref": "#/definitions/SessionsGetClientMetadataResult",
+          "description": "Ordered client metadata outcomes for the requested local sessions."
+        },
+        "stability": "experimental"
+      },
       "readPersistedEvents": {
         "rpcMethod": "sessions.readPersistedEvents",
-        "description": "Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The initial backward read uses a bounded tail scan for fast first paint; cursor continuations preserve the session event-log paging semantics. Persisted events may omit payloads that are reconstructed only for an active session.",
+        "description": "Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The first read pins the currently opened journal generation and its byte-length boundary; opaque cursor continuations remain on that generation across runtime-owned compaction, truncation, and rewrite operations, which replace the live path atomically, and events appended after the boundary are excluded. For cold hydration, await the first successful page before activation and establish lossless live-event buffering before resume; merge subsequent live events by ID, preserving persisted order and letting live payloads win. Continuations are process-local, single-use capabilities bound to the originating session and storage context and must be paged sequentially; concurrent or repeated use of the same cursor expires that duplicate read rather than reading the generation twice. A complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five idle minutes, with at most eight retained per process and idle-only eviction under pressure; completion and cancelled-worker exit release their handles. No transcript copy is created, but retained handles may keep replaced files' disk blocks alive until release. Pages have a soft 1 MiB serialized event-array budget including resolved binary assets; one oversized event is returned alone to guarantee progress. Working memory also includes a record/lookahead and asset resolution; resolving the first binary reference may scan the full pinned generation to build a bounded offset index. If the snapshot expires, is evicted, is cancelled before a continuation is established, or becomes unreadable after an observable unsupported in-place shortening, the continuation returns cursorStatus 'expired' with an empty terminal page and never falls back to a different generation. A missing or initially unreadable journal is an RPC error. Persisted history excludes ephemeral events and may omit payloads that are reconstructed only for an active session; use the active session event stream for post-resume live events.",
         "params": {
           "$ref": "#/definitions/SessionsReadPersistedEventsRequest",
           "description": "Pagination options for reading an inactive or active local session's persisted event journal."
@@ -1376,6 +1389,40 @@
           "description": "Managed sandbox enforcement state for a session."
         },
         "stability": "experimental"
+      },
+      "disableForSession": {
+        "rpcMethod": "session.sandbox.disableForSession",
+        "description": "Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "requestId": {
+              "type": "string",
+              "description": "Identifier of the exact pending sandbox-bypass permission request that authorized the session opt-out."
+            },
+            "decisionContext": {
+              "$ref": "#/definitions/PermissionDecisionContext",
+              "description": "Optional attribution for the permission decision."
+            }
+          },
+          "required": [
+            "sessionId",
+            "requestId"
+          ],
+          "additionalProperties": false,
+          "description": "Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.",
+          "title": "SandboxDisableForSessionRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/SandboxDisableForSessionResult",
+          "description": "Result of attempting to disable sandboxing for the current session."
+        },
+        "stability": "experimental"
       }
     },
     "sendSystemNotification": {
@@ -2441,6 +2488,76 @@
         },
         "stability": "experimental"
       },
+      "pause": {
+        "rpcMethod": "session.factory.pause",
+        "description": "Pauses a running factory and returns its settled run envelope.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "runId": {
+              "type": "string",
+              "description": "Factory run identifier."
+            }
+          },
+          "required": [
+            "sessionId",
+            "runId"
+          ],
+          "additionalProperties": false,
+          "description": "Parameters for pausing a running factory.",
+          "title": "FactoryPauseRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/FactoryRunResult",
+          "description": "Complete current or terminal factory run envelope."
+        },
+        "stability": "experimental"
+      },
+      "pauseAtCheckpoint": {
+        "rpcMethod": "session.factory.pauseAtCheckpoint",
+        "description": "Atomically pauses an owned factory attempt at a durable checkpoint.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "runId": {
+              "type": "string",
+              "description": "Factory run identifier."
+            },
+            "executionToken": {
+              "type": "string",
+              "description": "Opaque token identifying the execution attempt that reached the checkpoint."
+            },
+            "key": {
+              "type": "string",
+              "description": "Stable author-defined checkpoint key."
+            }
+          },
+          "required": [
+            "sessionId",
+            "runId",
+            "executionToken",
+            "key"
+          ],
+          "additionalProperties": false,
+          "description": "Parameters for an owned durable pause checkpoint.",
+          "title": "FactoryPauseCheckpointRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/FactoryPauseCheckpointResult"
+        },
+        "stability": "experimental",
+        "visibility": "internal"
+      },
       "log": {
         "rpcMethod": "session.factory.log",
         "description": "Records a batch of ordered factory progress lines.",
@@ -2660,7 +2777,7 @@
               "anyOf": [
                 {
                   "$ref": "#/definitions/AutoTier",
-                  "description": "Routing preference used when the session model is `auto`."
+                  "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
                 },
                 {
                   "type": "null"
@@ -2750,7 +2867,7 @@
               "anyOf": [
                 {
                   "$ref": "#/definitions/AutoTier",
-                  "description": "Routing preference used when the session model is `auto`."
+                  "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
                 },
                 {
                   "type": "null"
@@ -2812,6 +2929,10 @@
               "type": "string",
               "description": "Context tier selected by repository settings, when configured."
             },
+            "repoAutoTier": {
+              "type": "string",
+              "description": "Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant."
+            },
             "cliModel": {
               "type": "string",
               "description": "Model explicitly selected by the CLI, when provided."
@@ -2836,6 +2957,46 @@
         "stability": "experimental",
         "visibility": "internal"
       },
+      "setAllowedModels": {
+        "rpcMethod": "session.model.setAllowedModels",
+        "description": "Replaces or clears the host-supplied model allowlist for a running session.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "allowedModels": {
+              "anyOf": [
+                {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "minItems": 1,
+              "description": "Exact model IDs to permit, or null to clear the host restriction."
+            }
+          },
+          "required": [
+            "sessionId"
+          ],
+          "additionalProperties": false,
+          "description": "Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.",
+          "title": "ModelSetAllowedModelsRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/ModelSetAllowedModelsResult",
+          "description": "The applied host allowlist and effective session model policy after intersection."
+        },
+        "stability": "experimental"
+      },
       "setReasoningEffort": {
         "rpcMethod": "session.model.setReasoningEffort",
         "description": "Updates the session's reasoning effort without changing the selected model.",
@@ -2941,6 +3102,10 @@
               "$ref": "#/definitions/SessionMode",
               "description": "The session mode the agent is operating in"
             },
+            "expectedMode": {
+              "$ref": "#/definitions/SessionMode",
+              "description": "Mode the session must currently be in for the change to apply. When set and the session is in a different mode the request is a no-op and reports status 'unchanged'."
+            },
             "inheritPlanBaseFromSessionId": {
               "type": "string",
               "description": "Session whose plan-mode base state should be inherited."
@@ -3788,13 +3953,30 @@
             "prompt": {
               "type": "string",
               "description": "Optional user prompt to combine with fleet instructions"
+            },
+            "attachments": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/Attachment",
+                "description": "A user message attachment — a file, directory, code selection, blob, GitHub-anchored pointer, or extension-supplied context payload"
+              },
+              "description": "Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request"
+            },
+            "billable": {
+              "type": "boolean",
+              "description": "If false, this request will not trigger a Premium Request Unit charge. User requests default to billable.",
+              "visibility": "internal"
+            },
+            "wait": {
+              "type": "boolean",
+              "description": "If true, await completion of the agentic loop for this fleet request before returning. Defaults to false."
             }
           },
           "required": [
             "sessionId"
           ],
           "additionalProperties": false,
-          "description": "Optional user prompt to combine with the fleet orchestration instructions.",
+          "description": "Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.",
           "title": "FleetStartRequest",
           "stability": "experimental"
         },
@@ -6587,7 +6769,7 @@
       },
       "updateSubagentSettings": {
         "rpcMethod": "session.tools.updateSubagentSettings",
-        "description": "Updates the current session's live subagent settings after user settings change. The persisted user settings remain the source of truth for future sessions.",
+        "description": "Sets the current session's live subagent settings override, which takes precedence over persisted user settings until cleared. Persisted user settings remain the source of truth for future sessions.",
         "params": {
           "type": "object",
           "properties": {
@@ -8056,6 +8238,74 @@
         },
         "stability": "experimental"
       },
+      "getClientMetadata": {
+        "rpcMethod": "session.metadata.getClientMetadata",
+        "description": "Returns the client-owned string metadata persisted with this local session. The metadata is not included in model context, events, telemetry, snapshots, or remote exports.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            }
+          },
+          "required": [
+            "sessionId"
+          ],
+          "additionalProperties": false,
+          "description": "Identifies the target session."
+        },
+        "result": {
+          "$ref": "#/definitions/ClientMetadata",
+          "description": "Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values."
+        },
+        "stability": "experimental"
+      },
+      "updateClientMetadata": {
+        "rpcMethod": "session.metadata.updateClientMetadata",
+        "description": "Atomically patches the client-owned string metadata persisted with this local session and returns the committed bag.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            },
+            "clear": {
+              "type": "boolean",
+              "description": "Remove every existing client metadata entry before applying remove and set. Defaults to false."
+            },
+            "remove": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "maxItems": 128,
+              "description": "Case-sensitive keys to remove. Missing keys are ignored. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces."
+            },
+            "set": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "String entries to add or replace. Set wins when a key also appears in remove. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Each value may contain at most 16 KiB of UTF-8 data.",
+              "maxProperties": 128
+            }
+          },
+          "required": [
+            "sessionId"
+          ],
+          "additionalProperties": false,
+          "description": "Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.",
+          "title": "MetadataUpdateClientMetadataRequest",
+          "stability": "experimental"
+        },
+        "result": {
+          "$ref": "#/definitions/ClientMetadata",
+          "description": "Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values."
+        },
+        "stability": "experimental"
+      },
       "isProcessing": {
         "rpcMethod": "session.metadata.isProcessing",
         "description": "Reports whether the local session is currently processing user/agent messages.",
@@ -10138,11 +10388,16 @@
             "runId": {
               "type": "string",
               "description": "Factory run identifier."
+            },
+            "executionToken": {
+              "type": "string",
+              "description": "Opaque token identifying the execution attempt to abort."
             }
           },
           "required": [
             "sessionId",
-            "runId"
+            "runId",
+            "executionToken"
           ],
           "additionalProperties": false,
           "description": "Parameters for cooperatively aborting a factory body.",
@@ -10284,7 +10539,7 @@
       },
       "appendFile": {
         "rpcMethod": "sessionFs.appendFile",
-        "description": "Appends content to a file in the client-provided session filesystem.",
+        "description": "Appends content to a file in the client-provided session filesystem, creating parent directories as needed.",
         "params": {
           "type": "object",
           "properties": {
@@ -10312,7 +10567,7 @@
             "content"
           ],
           "additionalProperties": false,
-          "description": "File path, content to append, and optional mode for the client-provided session filesystem.",
+          "description": "File path, content to append, and optional mode for the client-provided session filesystem. Implementations create parent directories as needed.",
           "title": "SessionFsAppendFileRequest",
           "stability": "experimental"
         },
@@ -11331,6 +11586,10 @@
           "type": "boolean",
           "description": "Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only."
         },
+        "disableModelInvocation": {
+          "type": "boolean",
+          "description": "Whether model-driven invocation is disabled for this agent."
+        },
         "tools": {
           "type": "array",
           "items": {
@@ -13041,14 +13300,16 @@
       "enum": [
         "efficiency",
         "balance",
-        "intelligence"
+        "intelligence",
+        "fast"
       ],
-      "description": "Routing preference used when the session model is `auto`.",
+      "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference.",
       "title": "AutoTier",
       "x-enumDescriptions": {
         "efficiency": "Optimize for efficiency.",
         "balance": "Balance efficiency and intelligence.",
-        "intelligence": "Optimize for intelligence."
+        "intelligence": "Optimize for intelligence.",
+        "fast": "Integrator-only preset that optimizes for latency."
       }
     },
     "BuiltInModelCatalog": {
@@ -13661,7 +13922,7 @@
       "properties": {
         "autoTier": {
           "$ref": "#/definitions/AutoTier",
-          "description": "Routing preference for sessions whose model is `auto`. On create or cold resume, this establishes the preference sent as `tier` on CAPI `/auto` requests; when omitted on cold resume, the runtime restores the last committed preference. On resident resume, a different value requests a safe switch after resume succeeds and cannot change an in-flight turn. Successful switches are persisted for later cold resume. When no preference is supplied or restored, CAPI default routing is used."
+          "description": "Routing preference for sessions whose model is `auto`. On create or cold resume, this establishes the preference sent as `tier` on CAPI `/auto` requests; when omitted on cold resume, the runtime restores the last committed preference. On resident resume, a different value requests a safe switch after resume succeeds and cannot change an in-flight turn. Successful switches are persisted for later cold resume. When no preference is supplied or restored, CAPI default routing is used. `fast` is an integrator-only latency preset, not a first-party GitHub Copilot product preference."
         },
         "enableWebSocketResponses": {
           "type": "boolean",
@@ -13764,6 +14025,10 @@
         "provenance": {
           "$ref": "#/definitions/CatalogAiSkillCandidateProvenance",
           "description": "Where the catalog reference was observed, without the card itself or any content digest."
+        },
+        "trust": {
+          "$ref": "#/definitions/CatalogTrustSnapshot",
+          "description": "Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field."
         }
       },
       "required": [
@@ -13935,7 +14200,8 @@
         "legacy-mcp-server-card",
         "ai-skill-discovery",
         "mcp-install-planning",
-        "multiple-transport-choice"
+        "multiple-transport-choice",
+        "trust-snapshot"
       ],
       "description": "A wire feature a caller can require of the catalog surface, negotiated per request. A grant means the runtime understands the feature's contract, not that the deployment has enabled the operation; typed unavailable results report availability separately.",
       "title": "CatalogCapability",
@@ -13944,7 +14210,8 @@
         "legacy-mcp-server-card": "Understands the legacy `application/mcp-server+json` media type.",
         "ai-skill-discovery": "Understands `application/ai-skill` candidates as discovery-only and typed non-installable.",
         "mcp-install-planning": "Understands side-effect-free MCP install-plan requests, results, and plan handles; `planning-unavailable` separately reports that planning is not enabled.",
-        "multiple-transport-choice": "Understands plans that enumerate every eligible transport rather than a single preferred one."
+        "multiple-transport-choice": "Understands plans that enumerate every eligible transport rather than a single preferred one.",
+        "trust-snapshot": "Understands versioned candidate trust snapshots. Protocol-3 callers must require this capability before the runtime adds the optional snapshot field."
       }
     },
     "CatalogCapabilityId": {
@@ -14236,6 +14503,10 @@
         "provenance": {
           "$ref": "#/definitions/CatalogMcpServerCandidateProvenance",
           "description": "Where the catalog reference was observed, without the card itself or any content digest."
+        },
+        "trust": {
+          "$ref": "#/definitions/CatalogTrustSnapshot",
+          "description": "Versioned trust metadata observed from the catalog authority. Optional for protocol-3 compatibility with runtimes that predate trust snapshots. A trust-capable runtime emits an explicit snapshot even when the authority omitted or malformed its trust field."
         }
       },
       "required": [
@@ -14356,10 +14627,12 @@
         "supportedCapabilities": {
           "type": "array",
           "items": {
-            "$ref": "#/definitions/CatalogCapability",
-            "description": "A wire feature a caller can require of the catalog surface, negotiated per request. A grant means the runtime understands the feature's contract, not that the deployment has enabled the operation; typed unavailable results report availability separately."
+            "$ref": "#/definitions/CatalogCapabilityId",
+            "description": "Bounded extensible wire-feature identifier. Known values are described by `CatalogCapability`; newer callers may send future identifiers so an older runtime can return a typed negotiation refusal instead of failing schema validation. Capability negotiation establishes contract understanding, while each operation's result separately reports runtime availability."
           },
-          "description": "Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation."
+          "maxItems": 32,
+          "uniqueItems": true,
+          "description": "Capabilities this runtime can safely advertise to this caller. The complete five-capability protocol-3 legacy set is always present; every capability added after that baseline appears only when the caller required it, so an older closed-enum decoder can still consume a refusal. This list does not imply that every deployment has enabled every operation."
         },
         "unsupportedCapabilities": {
           "type": "array",
@@ -14677,6 +14950,414 @@
       "description": "A completed catalog search: inert candidate summaries, each carrying a single-use handle.",
       "title": "CatalogSearchSucceeded"
     },
+    "CatalogTrustEligibility": {
+      "type": "string",
+      "enum": [
+        "default",
+        "expanded",
+        "hidden",
+        "unknown"
+      ],
+      "description": "Authority-computed exposure eligibility, kept separate from tier. The current tier-only Agent Finder response maps to `unknown`, never to a locally inferred eligibility.",
+      "title": "CatalogTrustEligibility",
+      "x-enumDescriptions": {
+        "default": "Eligible for default catalogue exposure.",
+        "expanded": "Eligible only when expanded or community results are requested.",
+        "hidden": "Not eligible for normal catalogue exposure.",
+        "unknown": "The authority did not supply an eligibility decision."
+      }
+    },
+    "CatalogTrustProvenance": {
+      "type": "object",
+      "properties": {
+        "source": {
+          "$ref": "#/definitions/CatalogTrustSource",
+          "description": "Bounded authority that supplied the trust field."
+        },
+        "observedAt": {
+          "type": "string",
+          "minLength": 20,
+          "maxLength": 64,
+          "format": "date-time",
+          "description": "ISO 8601 timestamp with a timezone offset at which the runtime observed the search result carrying this trust field."
+        }
+      },
+      "required": [
+        "source",
+        "observedAt"
+      ],
+      "additionalProperties": false,
+      "description": "Where and when the runtime observed the trust metadata. Observation time is not the authority's evaluation time and must not be used to infer staleness.",
+      "title": "CatalogTrustProvenance"
+    },
+    "CatalogTrustSnapshot": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotCurrent",
+          "description": "A recognised current Agent Finder T1 or T2 trust tier."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotAbsent",
+          "description": "Discriminator: the authority omitted trust metadata."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotStale",
+          "description": "Discriminator: the authority explicitly marked the assessment stale."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotDowngraded",
+          "description": "Discriminator: the authority explicitly reported a downgraded assessment."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotRevoked",
+          "description": "Discriminator: the authority explicitly revoked the assessment."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotUnsupported",
+          "description": "Discriminator: the authority supplied a bounded trust value this runtime does not understand."
+        },
+        {
+          "$ref": "#/definitions/CatalogTrustSnapshotMalformed",
+          "description": "Discriminator: the trust field was empty, unbounded, or had the wrong JSON type."
+        }
+      ],
+      "description": "A versioned, bounded trust observation carried unchanged with a catalog candidate and its private handle context. Current observations require a recognised T1/T2 tier; every non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent Finder supplies no exposure decision, and states absent from its current wire are never inferred from age, relevance, popularity, or a tier transition.",
+      "title": "CatalogTrustSnapshot"
+    },
+    "CatalogTrustSnapshotAbsent": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotAbsentStatus",
+          "const": "absent",
+          "description": "Discriminator: the authority omitted trust metadata."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority omitted trust metadata.",
+      "title": "CatalogTrustSnapshotAbsent"
+    },
+    "CatalogTrustSnapshotAbsentStatus": {
+      "type": "string",
+      "enum": [
+        "absent"
+      ],
+      "description": "The authority omitted trust metadata.",
+      "title": "CatalogTrustSnapshotAbsentStatus",
+      "x-enumDescriptions": {
+        "absent": "The authority omitted trust metadata."
+      }
+    },
+    "CatalogTrustSnapshotCurrent": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotCurrentStatus",
+          "const": "current",
+          "description": "Discriminator: a recognised current trust tier was observed."
+        },
+        "tier": {
+          "$ref": "#/definitions/CatalogTrustTier",
+          "description": "Service-computed T1 or T2 trust tier."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "tier",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "A recognised current Agent Finder T1 or T2 trust tier.",
+      "title": "CatalogTrustSnapshotCurrent"
+    },
+    "CatalogTrustSnapshotCurrentStatus": {
+      "type": "string",
+      "enum": [
+        "current"
+      ],
+      "description": "A recognised T1 or T2 service tier was observed.",
+      "title": "CatalogTrustSnapshotCurrentStatus",
+      "x-enumDescriptions": {
+        "current": "A recognised T1 or T2 service tier was observed."
+      }
+    },
+    "CatalogTrustSnapshotDowngraded": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotDowngradedStatus",
+          "const": "downgraded",
+          "description": "Discriminator: the authority explicitly reported a downgraded assessment."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority explicitly reported a downgraded assessment.",
+      "title": "CatalogTrustSnapshotDowngraded"
+    },
+    "CatalogTrustSnapshotDowngradedStatus": {
+      "type": "string",
+      "enum": [
+        "downgraded"
+      ],
+      "description": "The authority explicitly reported a downgraded assessment.",
+      "title": "CatalogTrustSnapshotDowngradedStatus",
+      "x-enumDescriptions": {
+        "downgraded": "The authority explicitly reported a downgraded assessment."
+      }
+    },
+    "CatalogTrustSnapshotMalformed": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotMalformedStatus",
+          "const": "malformed",
+          "description": "Discriminator: the trust field was empty, unbounded, or had the wrong JSON type."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.",
+      "title": "CatalogTrustSnapshotMalformed"
+    },
+    "CatalogTrustSnapshotMalformedStatus": {
+      "type": "string",
+      "enum": [
+        "malformed"
+      ],
+      "description": "The trust field was empty, unbounded, or had the wrong JSON type.",
+      "title": "CatalogTrustSnapshotMalformedStatus",
+      "x-enumDescriptions": {
+        "malformed": "The trust field was empty, unbounded, or had the wrong JSON type."
+      }
+    },
+    "CatalogTrustSnapshotRevoked": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotRevokedStatus",
+          "const": "revoked",
+          "description": "Discriminator: the authority explicitly revoked the assessment."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority explicitly revoked the assessment.",
+      "title": "CatalogTrustSnapshotRevoked"
+    },
+    "CatalogTrustSnapshotRevokedStatus": {
+      "type": "string",
+      "enum": [
+        "revoked"
+      ],
+      "description": "The authority explicitly revoked its assessment.",
+      "title": "CatalogTrustSnapshotRevokedStatus",
+      "x-enumDescriptions": {
+        "revoked": "The authority explicitly revoked its assessment."
+      }
+    },
+    "CatalogTrustSnapshotSchemaVersion": {
+      "type": "string",
+      "enum": [
+        "v1"
+      ],
+      "description": "Schema version of the catalogue trust snapshot envelope",
+      "title": "CatalogTrustSnapshotSchemaVersion",
+      "x-enumDescriptions": {
+        "v1": "Initial envelope carrying one bounded service tier or one explicit unavailable state."
+      }
+    },
+    "CatalogTrustSnapshotStale": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotStaleStatus",
+          "const": "stale",
+          "description": "Discriminator: the authority explicitly marked the assessment stale."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority explicitly marked the assessment stale.",
+      "title": "CatalogTrustSnapshotStale"
+    },
+    "CatalogTrustSnapshotStaleStatus": {
+      "type": "string",
+      "enum": [
+        "stale"
+      ],
+      "description": "The authority explicitly marked its assessment stale.",
+      "title": "CatalogTrustSnapshotStaleStatus",
+      "x-enumDescriptions": {
+        "stale": "The authority explicitly marked its assessment stale."
+      }
+    },
+    "CatalogTrustSnapshotUnsupported": {
+      "type": "object",
+      "properties": {
+        "schemaVersion": {
+          "$ref": "#/definitions/CatalogTrustSnapshotSchemaVersion",
+          "description": "Schema version of this runtime-owned snapshot envelope."
+        },
+        "status": {
+          "$ref": "#/definitions/CatalogTrustSnapshotUnsupportedStatus",
+          "const": "unsupported",
+          "description": "Discriminator: the authority supplied a bounded trust value this runtime does not understand."
+        },
+        "eligibility": {
+          "$ref": "#/definitions/CatalogTrustEligibility",
+          "description": "Service-computed exposure eligibility. `unknown` is required while Agent Finder returns no explicit eligibility field."
+        },
+        "provenance": {
+          "$ref": "#/definitions/CatalogTrustProvenance",
+          "description": "Bounded source and observation time for this snapshot. This is distinct from evidence used by the authority to calculate trust."
+        }
+      },
+      "required": [
+        "schemaVersion",
+        "status",
+        "eligibility",
+        "provenance"
+      ],
+      "additionalProperties": false,
+      "description": "Discriminator: the authority supplied a bounded trust value this runtime does not understand.",
+      "title": "CatalogTrustSnapshotUnsupported"
+    },
+    "CatalogTrustSnapshotUnsupportedStatus": {
+      "type": "string",
+      "enum": [
+        "unsupported"
+      ],
+      "description": "The authority supplied a bounded trust value this runtime does not understand.",
+      "title": "CatalogTrustSnapshotUnsupportedStatus",
+      "x-enumDescriptions": {
+        "unsupported": "The authority supplied a bounded trust value this runtime does not understand."
+      }
+    },
+    "CatalogTrustSource": {
+      "type": "string",
+      "enum": [
+        "agent-finder"
+      ],
+      "description": "Bounded authority that supplied a catalogue trust observation",
+      "title": "CatalogTrustSource",
+      "x-enumDescriptions": {
+        "agent-finder": "GitHub Agent Finder supplied the trust field on its search result."
+      }
+    },
+    "CatalogTrustTier": {
+      "type": "string",
+      "enum": [
+        "T1",
+        "T2"
+      ],
+      "description": "Service-computed trust tier currently emitted by Agent Finder. It is independent of search score, popularity, and client-side ranking.",
+      "title": "CatalogTrustTier",
+      "x-enumDescriptions": {
+        "T1": "Tier one as assigned by the catalogue authority.",
+        "T2": "Tier two as assigned by the catalogue authority."
+      }
+    },
     "CatalogUnavailableError": {
       "type": "object",
       "properties": {
@@ -14851,6 +15532,15 @@
       "description": "The request asked for a candidate kind this runtime does not serve.",
       "title": "CatalogUnsupportedKindError"
     },
+    "ClientMetadata": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "string"
+      },
+      "description": "Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.",
+      "title": "ClientMetadata",
+      "maxProperties": 128
+    },
     "ClientTaskCancelReason": {
       "type": "string",
       "enum": [
@@ -15629,6 +16319,10 @@
                       {
                         "type": "object",
                         "properties": {
+                          "id": {
+                            "type": "number",
+                            "description": "Numeric database ID of the organization."
+                          },
                           "login": {
                             "anyOf": [
                               {
@@ -15680,7 +16374,7 @@
               "type": "null"
             }
           ],
-          "description": "Organizations the user belongs to, each with an optional login and display name."
+          "description": "Organizations the user belongs to, each with an optional ID, login, and display name."
         },
         "codex_agent_enabled": {
           "type": "boolean",
@@ -16055,7 +16749,7 @@
           "anyOf": [
             {
               "$ref": "#/definitions/AutoTier",
-              "description": "Routing preference used when the session model is `auto`."
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
             },
             {
               "type": "null"
@@ -16067,7 +16761,7 @@
           "anyOf": [
             {
               "$ref": "#/definitions/AutoTier",
-              "description": "Routing preference used when the session model is `auto`."
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
             },
             {
               "type": "null"
@@ -16675,6 +17369,10 @@
           "type": "string",
           "description": "Plugin version that provided this server, when source is plugin."
         },
+        "effectiveSource": {
+          "$ref": "#/definitions/McpSourceRef",
+          "description": "Canonical identity and location of the effective server declaration."
+        },
         "enabled": {
           "type": "boolean",
           "description": "Whether the server is enabled (not in the disabled list)"
@@ -16949,11 +17647,11 @@
         "ok",
         "expired"
       ],
-      "description": "Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.",
+      "description": "Cursor status: 'ok' means the read succeeded against the requested history; 'expired' means the requested continuation is unavailable. Recovery is endpoint-specific: session.eventLog.read returns a boundary window of remaining active history that may overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page and never switches journal generations. An expired persisted read is not successful completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.",
       "title": "EventsCursorStatus",
       "x-enumDescriptions": {
-        "ok": "The cursor was applied successfully.",
-        "expired": "The cursor referred to history that is no longer available."
+        "ok": "The read succeeded against the requested history.",
+        "expired": "The requested continuation is unavailable; see the endpoint's recovery semantics."
       }
     },
     "EventsReadDirection": {
@@ -16985,11 +17683,11 @@
         },
         "hasMore": {
           "type": "boolean",
-          "description": "True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window."
+          "description": "True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count."
         },
         "cursorStatus": {
           "$ref": "#/definitions/EventsCursorStatus",
-          "description": "Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history. For a forward read the fallback starts from the beginning of the remaining history; for a backward read it falls back to the tail (the newest window). Because the fallback page is a fresh boundary snapshot rather than a continuation of the requested cursor, it may overlap events the consumer has already rendered — a backward fallback to the tail in particular can repeat the newest window. On 'expired', consumers should reset or rebase their local pagination state (or deduplicate by event id) before continuing from the returned cursor rather than blindly appending/prepending the fallback page."
+          "description": "Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read, 'expired' means the cursor referred to an event that no longer exists in active history and the read fell back to a boundary of the remaining history: the beginning for a forward read or the newest window for a backward read. That fallback may overlap already rendered events, so active-session consumers should reset, rebase, or deduplicate before continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired' returns an empty terminal page and never switches to a replacement journal generation. Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry."
         }
       },
       "required": [
@@ -17697,10 +18395,15 @@
         "runId": {
           "type": "string",
           "description": "Factory run identifier."
+        },
+        "executionToken": {
+          "type": "string",
+          "description": "Opaque token identifying the execution attempt to abort."
         }
       },
       "required": [
-        "runId"
+        "runId",
+        "executionToken"
       ],
       "additionalProperties": false,
       "description": "Parameters for cooperatively aborting a factory body.",
@@ -17731,15 +18434,15 @@
         },
         "reasoningEffort": {
           "type": "string",
-          "description": "Optional reasoning effort for the subagent. This field is accepted but not yet honored."
+          "description": "Optional reasoning effort override for the subagent."
         },
         "contextTier": {
           "$ref": "#/definitions/ContextTier",
-          "description": "Optional context tier for the subagent. This field is accepted but not yet honored."
+          "description": "Optional context tier override for the subagent."
         },
         "agent": {
           "type": "string",
-          "description": "Optional custom agent name for the subagent. This field is accepted but not yet honored."
+          "description": "Optional built-in or custom agent name whose definition configures the subagent."
         }
       },
       "additionalProperties": false,
@@ -18280,6 +18983,111 @@
       "title": "FactoryLogRequest",
       "stability": "experimental"
     },
+    "FactoryPauseCheckpointAction": {
+      "type": "string",
+      "enum": [
+        "continue",
+        "pause"
+      ],
+      "description": "Action the runtime selected for a durable factory pause checkpoint.",
+      "title": "FactoryPauseCheckpointAction",
+      "x-enumDescriptions": {
+        "continue": "The checkpoint was committed by a prior paused attempt, so execution may continue.",
+        "pause": "This attempt claimed the checkpoint and must cooperatively stop."
+      }
+    },
+    "FactoryPauseCheckpointRequest": {
+      "type": "object",
+      "properties": {
+        "runId": {
+          "type": "string",
+          "description": "Factory run identifier."
+        },
+        "executionToken": {
+          "type": "string",
+          "description": "Opaque token identifying the execution attempt that reached the checkpoint."
+        },
+        "key": {
+          "type": "string",
+          "description": "Stable author-defined checkpoint key."
+        }
+      },
+      "required": [
+        "runId",
+        "executionToken",
+        "key"
+      ],
+      "additionalProperties": false,
+      "description": "Parameters for an owned durable pause checkpoint.",
+      "title": "FactoryPauseCheckpointRequest",
+      "stability": "experimental"
+    },
+    "FactoryPauseCheckpointResult": {
+      "type": "object",
+      "properties": {
+        "action": {
+          "$ref": "#/definitions/FactoryPauseCheckpointAction",
+          "description": "Whether this execution attempt must pause or may continue."
+        }
+      },
+      "required": [
+        "action"
+      ],
+      "additionalProperties": false
+    },
+    "FactoryPauseInfo": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "const": "user",
+              "description": "Factory pause initiator discriminator."
+            }
+          },
+          "required": [
+            "type"
+          ]
+        },
+        {
+          "type": "object",
+          "properties": {
+            "key": {
+              "type": "string",
+              "description": "Stable author-defined checkpoint key that initiated the pause."
+            },
+            "type": {
+              "type": "string",
+              "const": "checkpoint",
+              "description": "Factory pause initiator discriminator."
+            }
+          },
+          "required": [
+            "type",
+            "key"
+          ]
+        }
+      ],
+      "description": "Durable metadata describing who initiated a factory pause.",
+      "title": "FactoryPauseInfo"
+    },
+    "FactoryPauseRequest": {
+      "type": "object",
+      "properties": {
+        "runId": {
+          "type": "string",
+          "description": "Factory run identifier."
+        }
+      },
+      "required": [
+        "runId"
+      ],
+      "additionalProperties": false,
+      "description": "Parameters for pausing a running factory.",
+      "title": "FactoryPauseRequest",
+      "stability": "experimental"
+    },
     "FactoryPhaseObservation": {
       "type": "object",
       "properties": {
@@ -18667,6 +19475,10 @@
           ],
           "description": "Terminal run outcome, or null while nonterminal."
         },
+        "canResume": {
+          "type": "boolean",
+          "description": "Whether the durable run state currently passes runtime resume eligibility checks."
+        },
         "phases": {
           "type": "array",
           "items": {
@@ -18708,6 +19520,7 @@
         "observedAt",
         "activeSegmentStartedAt",
         "terminal",
+        "canResume",
         "phases",
         "agents",
         "progress"
@@ -18731,6 +19544,10 @@
               "exclusiveMinimum": 0,
               "description": "Approved effective ceiling that was reached."
             },
+            "suggestedValue": {
+              "type": "number",
+              "description": "Suggested larger ceiling when the runtime can derive one safely."
+            },
             "runId": {
               "type": "string",
               "description": "Factory run identifier."
@@ -18870,25 +19687,37 @@
       "type": "object",
       "properties": {
         "maxConcurrentSubagents": {
-          "type": "integer",
+          "type": [
+            "integer",
+            "null"
+          ],
           "minimum": 0,
           "exclusiveMinimum": 0,
           "description": "Maximum number of factory subagents that may run concurrently."
         },
         "maxTotalSubagents": {
-          "type": "integer",
+          "type": [
+            "integer",
+            "null"
+          ],
           "minimum": 0,
           "exclusiveMinimum": 0,
           "description": "Maximum total number of factory subagents that may be admitted."
         },
         "timeoutSeconds": {
-          "type": "number",
+          "type": [
+            "number",
+            "null"
+          ],
           "exclusiveMinimum": 0,
           "maximum": 2147483.647,
           "description": "Maximum accumulated active-execution time in seconds. Active execution includes the entire extension body, subprocess waits, queued-agent waits, and sleeps; time between resumed attempts is not counted."
         },
         "maxAiCredits": {
-          "type": "number",
+          "type": [
+            "number",
+            "null"
+          ],
           "exclusiveMinimum": 0,
           "description": "Maximum AI credits consumed by factory subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops."
         }
@@ -18959,6 +19788,10 @@
         "snapshot": {
           "description": "Partial journal and progress snapshot for a halted, cancelled, or errored run.",
           "x-opaque-json": true
+        },
+        "pauseInfo": {
+          "$ref": "#/definitions/FactoryPauseInfo",
+          "description": "Structured pause initiator metadata for a paused attempt."
         }
       },
       "required": [
@@ -18976,6 +19809,7 @@
         "running",
         "completed",
         "halted",
+        "paused",
         "cancelled",
         "error"
       ],
@@ -18986,6 +19820,7 @@
         "running": "The run is executing.",
         "completed": "The run completed successfully.",
         "halted": "The run was interrupted while resource budget remained.",
+        "paused": "The current attempt stopped intentionally and the run may be resumed.",
         "cancelled": "The run was cancelled before completion.",
         "error": "The factory body failed or reached a cumulative resource ceiling."
       }
@@ -19104,6 +19939,10 @@
             }
           ],
           "description": "Terminal run outcome, or null while nonterminal."
+        },
+        "canResume": {
+          "type": "boolean",
+          "description": "Whether the durable run state currently passes runtime resume eligibility checks."
         }
       },
       "required": [
@@ -19125,7 +19964,8 @@
         "approved",
         "observedAt",
         "activeSegmentStartedAt",
-        "terminal"
+        "terminal",
+        "canResume"
       ],
       "additionalProperties": false,
       "description": "Durable factory run summary with read-time live overlays.",
@@ -19150,8 +19990,23 @@
         "resultPreview": {
           "type": "string",
           "description": "Prompt-safe preview of the completed result."
+        },
+        "pauseInfo": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/FactoryPauseInfo",
+              "description": "Durable metadata describing who initiated a factory pause."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Pause initiator metadata, or null when the run did not pause."
         }
       },
+      "required": [
+        "pauseInfo"
+      ],
       "additionalProperties": false,
       "description": "Prompt-safe terminal factory outcome.",
       "title": "FactoryRunTerminal",
@@ -19254,10 +20109,27 @@
         "prompt": {
           "type": "string",
           "description": "Optional user prompt to combine with fleet instructions"
+        },
+        "attachments": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Attachment",
+            "description": "A user message attachment — a file, directory, code selection, blob, GitHub-anchored pointer, or extension-supplied context payload"
+          },
+          "description": "Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request"
+        },
+        "billable": {
+          "type": "boolean",
+          "description": "If false, this request will not trigger a Premium Request Unit charge. User requests default to billable.",
+          "visibility": "internal"
+        },
+        "wait": {
+          "type": "boolean",
+          "description": "If true, await completion of the agentic loop for this fleet request before returning. Defaults to false."
         }
       },
       "additionalProperties": false,
-      "description": "Optional user prompt to combine with the fleet orchestration instructions.",
+      "description": "Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.",
       "title": "FleetStartRequest",
       "stability": "experimental"
     },
@@ -22161,6 +23033,10 @@
         "workingDirectory": {
           "type": "string",
           "description": "Working directory used as context for discovery (e.g., plugin resolution)"
+        },
+        "includeEffectiveSource": {
+          "type": "boolean",
+          "description": "Whether to include canonical effectiveSource metadata for each discovered server. Callers must opt in so protocol-3 clients retain the legacy closed response shape."
         }
       },
       "additionalProperties": false,
@@ -25139,6 +26015,88 @@
       "description": "Env-value mode recorded on the session after the update.",
       "title": "McpSetEnvValueModeResult"
     },
+    "McpSourceFile": {
+      "type": "object",
+      "properties": {
+        "uri": {
+          "type": "string",
+          "format": "uri",
+          "description": "Canonical file URI for the configuration document"
+        },
+        "jsonPointer": {
+          "type": "string",
+          "description": "RFC 6901 JSON Pointer to the server declaration, when known"
+        }
+      },
+      "required": [
+        "uri"
+      ],
+      "additionalProperties": false,
+      "description": "Concrete configuration file containing an MCP server declaration.",
+      "title": "McpSourceFile"
+    },
+    "McpSourcePlugin": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Canonical plugin identity"
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Human-readable plugin name, when available"
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Plugin version, when available"
+        }
+      },
+      "required": [
+        "id"
+      ],
+      "additionalProperties": false,
+      "description": "Plugin identity associated with an MCP server declaration.",
+      "title": "McpSourcePlugin"
+    },
+    "McpSourceRef": {
+      "type": "object",
+      "properties": {
+        "kind": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Open source-kind identifier. Known values include user, workspace, invocation, plugin, builtin, and device-registry."
+        },
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque stable identity for the configuration source. Clients must not parse this value."
+        },
+        "editability": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Open semantic editability identifier. Known values are editable and read-only."
+        },
+        "file": {
+          "$ref": "#/definitions/McpSourceFile",
+          "description": "Configuration file location, when the declaration is file-backed."
+        },
+        "plugin": {
+          "$ref": "#/definitions/McpSourcePlugin",
+          "description": "Plugin identity, when the declaration is plugin-provided."
+        }
+      },
+      "required": [
+        "kind",
+        "id",
+        "editability"
+      ],
+      "additionalProperties": false,
+      "description": "Canonical identity and location of the effective MCP server declaration. The declaration is uniquely addressed by this source id together with the discovered server name.",
+      "title": "McpSourceRef"
+    },
     "McpStartServerRequest": {
       "type": "object",
       "properties": {
@@ -25598,6 +26556,35 @@
         "cli": "Remote task originated from a CLI remote-session invocation."
       }
     },
+    "MetadataUpdateClientMetadataRequest": {
+      "type": "object",
+      "properties": {
+        "clear": {
+          "type": "boolean",
+          "description": "Remove every existing client metadata entry before applying remove and set. Defaults to false."
+        },
+        "remove": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 128,
+          "description": "Case-sensitive keys to remove. Missing keys are ignored. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces."
+        },
+        "set": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "String entries to add or replace. Set wins when a key also appears in remove. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Each value may contain at most 16 KiB of UTF-8 data.",
+          "maxProperties": 128
+        }
+      },
+      "additionalProperties": false,
+      "description": "Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.",
+      "title": "MetadataUpdateClientMetadataRequest",
+      "stability": "experimental"
+    },
     "Model": {
       "type": "object",
       "properties": {
@@ -25711,6 +26698,10 @@
           "type": "string",
           "description": "Context tier selected by repository settings, when configured."
         },
+        "repoAutoTier": {
+          "type": "string",
+          "description": "Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant."
+        },
         "cliModel": {
           "type": "string",
           "description": "Model explicitly selected by the CLI, when provided."
@@ -26269,6 +27260,60 @@
         "unconfigured": "No explicit policy is configured for the model."
       }
     },
+    "ModelSetAllowedModelsRequest": {
+      "type": "object",
+      "properties": {
+        "allowedModels": {
+          "anyOf": [
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "minItems": 1,
+          "description": "Exact model IDs to permit, or null to clear the host restriction."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.",
+      "title": "ModelSetAllowedModelsRequest",
+      "stability": "experimental"
+    },
+    "ModelSetAllowedModelsResult": {
+      "type": "object",
+      "properties": {
+        "allowedModels": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Normalized host allowlist. Omitted when the host restriction was cleared, or when a relay client does not return the host policy."
+        },
+        "effectiveAllowedModels": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Effective exact IDs or repository policy patterns after applying the host restriction. Omitted by relay clients that do not return the host policy."
+        },
+        "fallbackModel": {
+          "type": "string",
+          "description": "Effective deterministic fallback model, when the policy defines one."
+        },
+        "modelId": {
+          "type": "string",
+          "description": "Selected session model after reconciling a now-disallowed concrete selection."
+        }
+      },
+      "additionalProperties": false,
+      "description": "The applied host allowlist and effective session model policy after intersection.",
+      "title": "ModelSetAllowedModelsResult"
+    },
     "ModelSetReasoningEffortRequest": {
       "type": "object",
       "properties": {
@@ -26330,7 +27375,7 @@
           "anyOf": [
             {
               "$ref": "#/definitions/AutoTier",
-              "description": "Routing preference used when the session model is `auto`."
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
             },
             {
               "type": "null"
@@ -26366,7 +27411,7 @@
           "anyOf": [
             {
               "$ref": "#/definitions/AutoTier",
-              "description": "Routing preference used when the session model is `auto`."
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
             },
             {
               "type": "null"
@@ -26378,7 +27423,7 @@
           "anyOf": [
             {
               "$ref": "#/definitions/AutoTier",
-              "description": "Routing preference used when the session model is `auto`."
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
             },
             {
               "type": "null"
@@ -26390,7 +27435,7 @@
           "anyOf": [
             {
               "$ref": "#/definitions/AutoTier",
-              "description": "Routing preference used when the session model is `auto`."
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
             },
             {
               "type": "null"
@@ -26455,7 +27500,7 @@
           "anyOf": [
             {
               "$ref": "#/definitions/AutoTier",
-              "description": "Routing preference used when the session model is `auto`."
+              "description": "Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference."
             },
             {
               "type": "null"
@@ -26591,6 +27636,10 @@
           "$ref": "#/definitions/SessionMode",
           "description": "The session mode the agent is operating in"
         },
+        "expectedMode": {
+          "$ref": "#/definitions/SessionMode",
+          "description": "Mode the session must currently be in for the change to apply. When set and the session is in a different mode the request is a no-op and reports status 'unchanged'."
+        },
         "inheritPlanBaseFromSessionId": {
           "type": "string",
           "description": "Session whose plan-mode base state should be inherited."
@@ -26651,6 +27700,10 @@
           "type": "boolean",
           "description": "Whether applying the mode changed the active model."
         },
+        "modeApplied": {
+          "type": "boolean",
+          "description": "Whether the requested mode was applied to the session. False only when an 'expectedMode' precondition did not hold, in which case any model change reported alongside it was still applied."
+        },
         "confirmation": {
           "$ref": "#/definitions/ModelSwitchConfirmation",
           "description": "Compaction confirmation required before the mode change can complete."
@@ -28095,7 +29148,8 @@
         "assisted_approval",
         "human_response",
         "host_policy",
-        "unattended_fallback"
+        "unattended_fallback",
+        "authorization_carry_forward"
       ],
       "description": "Controlled reason or actor responsible for a permission response.",
       "title": "PermissionDecisionSource",
@@ -28103,7 +29157,8 @@
         "assisted_approval": "The response followed the assisted-approval judge recommendation.",
         "human_response": "A human supplied the response through an interactive prompt.",
         "host_policy": "The host applied a standing policy or override rather than a judge recommendation or human decision.",
-        "unattended_fallback": "The host denied the request because no interactive user response was available."
+        "unattended_fallback": "The host denied the request because no interactive user response was available.",
+        "authorization_carry_forward": "A live authorization record from an earlier human decision in this session contained the proposal, so it ran without another prompt. This is not a new human decision and never mints authority of its own."
       }
     },
     "PermissionDecisionSurface": {
@@ -29691,13 +30746,17 @@
             "type": "string"
           },
           "description": "Plugin names or \"plugin@marketplace\" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins."
+        },
+        "workingDirectory": {
+          "type": "string",
+          "description": "Working directory whose repository `enabledPlugins` overlay decides whether this mutation is repository-controlled. Hosts that serve sessions across several repositories (the SDK server) should pass the session's directory; otherwise the guard is evaluated against the server process's own working directory, which may belong to a different repository. Defaults to the server's current working directory."
         }
       },
       "required": [
         "names"
       ],
       "additionalProperties": false,
-      "description": "Plugin names (or specs) to disable.",
+      "description": "Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against.",
       "title": "PluginsDisableRequest"
     },
     "PluginsEnableRequest": {
@@ -29709,13 +30768,17 @@
             "type": "string"
           },
           "description": "Plugin names or \"plugin@marketplace\" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API."
+        },
+        "workingDirectory": {
+          "type": "string",
+          "description": "Working directory whose repository `enabledPlugins` overlay decides whether this mutation is repository-controlled. Hosts that serve sessions across several repositories (the SDK server) should pass the session's directory; otherwise the guard is evaluated against the server process's own working directory, which may belong to a different repository. Defaults to the server's current working directory."
         }
       },
       "required": [
         "names"
       ],
       "additionalProperties": false,
-      "description": "Plugin names (or specs) to enable.",
+      "description": "Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against.",
       "title": "PluginsEnableRequest"
     },
     "PluginsInstallRequest": {
@@ -32615,6 +33678,46 @@
       "description": "macOS seatbelt-specific options.",
       "title": "SandboxConfigUserPolicySeatbelt"
     },
+    "SandboxDisableForSessionRequest": {
+      "type": "object",
+      "properties": {
+        "requestId": {
+          "type": "string",
+          "description": "Identifier of the exact pending sandbox-bypass permission request that authorized the session opt-out."
+        },
+        "decisionContext": {
+          "$ref": "#/definitions/PermissionDecisionContext",
+          "description": "Optional attribution for the permission decision."
+        }
+      },
+      "required": [
+        "requestId"
+      ],
+      "additionalProperties": false,
+      "description": "Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.",
+      "title": "SandboxDisableForSessionRequest",
+      "stability": "experimental"
+    },
+    "SandboxDisableForSessionResult": {
+      "type": "object",
+      "properties": {
+        "success": {
+          "type": "boolean",
+          "description": "Whether this call resolved the pending request and applied the session opt-out."
+        },
+        "enabled": {
+          "type": "boolean",
+          "description": "The authoritative sandbox enabled state after the operation."
+        }
+      },
+      "required": [
+        "success",
+        "enabled"
+      ],
+      "additionalProperties": false,
+      "description": "Result of attempting to disable sandboxing for the current session.",
+      "title": "SandboxDisableForSessionResult"
+    },
     "SandboxEnforcementStatus": {
       "type": "object",
       "properties": {
@@ -33887,7 +34990,7 @@
         "content"
       ],
       "additionalProperties": false,
-      "description": "File path, content to append, and optional mode for the client-provided session filesystem.",
+      "description": "File path, content to append, and optional mode for the client-provided session filesystem. Implementations create parent directories as needed.",
       "title": "SessionFsAppendFileRequest",
       "stability": "experimental"
     },
@@ -35498,6 +36601,10 @@
           "type": "boolean",
           "description": "Whether to skip custom instruction sources."
         },
+        "refreshCustomInstructions": {
+          "type": "boolean",
+          "description": "Whether to invalidate cached custom-instruction discovery before constructing the session. Use when instruction files may have changed earlier in the same runtime process."
+        },
         "disabledInstructionSources": {
           "type": "array",
           "items": {
@@ -35902,6 +37009,122 @@
       "description": "Session IDs from the input set that are currently in use by another process.",
       "title": "SessionsCheckInUseResult"
     },
+    "SessionsClientMetadataEntry": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "metadata": {
+              "$ref": "#/definitions/ClientMetadata",
+              "description": "Validated client metadata, possibly empty or projected to requested keys."
+            },
+            "status": {
+              "type": "string",
+              "const": "ok",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId",
+            "metadata"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "status": {
+              "type": "string",
+              "const": "notFound",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "status": {
+              "type": "string",
+              "const": "corrupt",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "status": {
+              "type": "string",
+              "const": "unsupportedVersion",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Requested session ID."
+            },
+            "code": {
+              "type": "string",
+              "description": "Filesystem or provider error code. Clients should not assume every provider uses operating-system error codes."
+            },
+            "message": {
+              "type": "string",
+              "description": "Human-readable diagnostic message. Not stable for programmatic matching."
+            },
+            "status": {
+              "type": "string",
+              "const": "unavailable",
+              "description": "Client metadata outcome discriminator."
+            }
+          },
+          "required": [
+            "status",
+            "sessionId",
+            "code",
+            "message"
+          ],
+          "additionalProperties": false
+        }
+      ],
+      "description": "Client metadata outcome for one requested local session.",
+      "title": "SessionsClientMetadataEntry"
+    },
     "SessionsCloseRequest": {
       "type": "object",
       "properties": {
@@ -36430,6 +37653,42 @@
       "description": "Dynamic-context board entry count, when available.",
       "title": "SessionsGetBoardEntryCountResult"
     },
+    "SessionsGetClientMetadataRequest": {
+      "type": "object",
+      "properties": {
+        "sessionIds": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 1000,
+          "description": "Session IDs to inspect. Results preserve this order."
+        },
+        "keys": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 128,
+          "description": "Case-sensitive keys to project from each valid bag. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Omit to return every entry."
+        }
+      },
+      "required": [
+        "sessionIds"
+      ],
+      "additionalProperties": false,
+      "description": "Bounded batch request for client-owned metadata from persisted local sessions.",
+      "title": "SessionsGetClientMetadataRequest"
+    },
+    "SessionsGetClientMetadataResult": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/SessionsClientMetadataEntry",
+        "description": "Client metadata outcome for one requested local session."
+      },
+      "description": "Ordered client metadata outcomes for the requested local sessions.",
+      "title": "SessionsGetClientMetadataResult"
+    },
     "SessionsGetEventFilePathRequest": {
       "type": "object",
       "properties": {
@@ -36991,17 +38250,17 @@
         },
         "cursor": {
           "type": "string",
-          "description": "Opaque cursor returned by a previous persisted-event read. Omit on the first call."
+          "description": "Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page."
         },
         "max": {
           "type": "integer",
           "exclusiveMinimum": 0,
           "maximum": 1000,
-          "description": "Maximum number of events to return in this batch (1–1000, default 200)."
+          "description": "Maximum number of events to return in this batch (1–1000, default 200). Pages may contain fewer events to keep the serialized event array within a soft 1 MiB budget including resolved binary assets; one oversized event is returned alone to guarantee progress."
         },
         "direction": {
           "$ref": "#/definitions/EventsReadDirection",
-          "description": "Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological."
+          "description": "Direction to page through persisted history. Forward starts at the beginning; backward starts with the newest events. Events in each page remain chronological. This selects the initial read only; a continuation always uses the direction bound into its cursor."
         }
       },
       "required": [
@@ -38886,7 +40145,7 @@
               "type": "object",
               "additionalProperties": {
                 "$ref": "#/definitions/SubagentSettingsEntry",
-                "description": "Subagent model, reasoning effort, and context tier settings"
+                "description": "Subagent model, reasoning effort, context tier, and auto-invocation settings"
               },
               "description": "Per-agent settings keyed by subagent agent_type"
             },
@@ -38938,10 +40197,14 @@
         "contextTier": {
           "$ref": "#/definitions/SubagentSettingsEntryContextTier",
           "description": "Context tier override for matching subagents"
+        },
+        "autoInvoke": {
+          "type": "boolean",
+          "description": "Whether this agent's runtime-defined proactive invocation prompting is enabled, if supported. Currently consumed by the built-in rubber-duck agent."
         }
       },
       "additionalProperties": false,
-      "description": "Subagent model, reasoning effort, and context tier settings",
+      "description": "Subagent model, reasoning effort, context tier, and auto-invocation settings",
       "title": "SubagentSettingsEntry"
     },
     "SubagentSettingsEntryContextTier": {