@github/copilot-sdk-win32-x64 1.0.16 → 1.0.17-preview.1

package/schemas/api.schema.json

@@ -1061,7 +1061,7 @@
     "managedSettings": {
       "read": {
         "rpcMethod": "managedSettings.read",
-        "description": "Discovers device-managed settings from production MDM and managed-file sources, validates them against the runtime-owned managed-settings schema, and returns the canonical JSON without requiring a session.",
+        "description": "Discovers device-managed settings from production MDM and managed-file sources, validates them against the runtime-owned managed-settings schema, and returns the canonical JSON without requiring a session. `managedSettings.resolve` returns the same device settings together with the account's server policy.",
         "params": null,
         "result": {
           "$ref": "#/definitions/ManagedSettingsReadResult",
@@ -1071,12 +1071,61 @@
       },
       "clearCache": {
         "rpcMethod": "managedSettings.clearCache",
-        "description": "Force-refreshes enterprise managed settings for every account: wipes the persistent server-policy cache (the whole `<cacheHome>/managed-settings` directory) and drops this runtime process's in-memory retained server policy. It does not itself fetch policy — the effect is that the next time a session resolves managed settings for an account, that resolution re-fetches the account's org policy from the network instead of serving a cached response. Note that `managedSettings.read` returns only device/MDM settings and never triggers the account server-policy fetch, so a host implementing \"sync account policy\" should start a fresh session resolution rather than treat a subsequent `managedSettings.read` as the refreshed org policy. Mirrors the invalidation a sign-out performs, broadened from the one signing-out account to all of them; device/MDM layers describe the machine, not the account, and are left untouched. Rejects if the on-disk cache cannot be removed.",
+        "description": "Force-refreshes enterprise managed settings for every account: wipes the persistent server-policy cache (the whole `<cacheHome>/managed-settings` directory) and drops this runtime process's in-memory retained server policy. It does not itself fetch policy — the effect is that the next time a session resolves managed settings for an account, that resolution re-fetches the account's org policy from the network instead of serving a cached response. Note that `managedSettings.read` returns only device/MDM settings and never triggers the account server-policy fetch, so a host implementing \"sync account policy\" should call `managedSettings.resolve` or start a fresh session resolution rather than treat a subsequent `managedSettings.read` as the refreshed org policy. Mirrors the invalidation a sign-out performs, broadened from the one signing-out account to all of them; device/MDM layers describe the machine, not the account, and are left untouched. Rejects if the on-disk cache cannot be removed.",
         "params": null,
         "result": {
           "type": "null"
         },
         "stability": "experimental"
+      },
+      "resolve": {
+        "rpcMethod": "managedSettings.resolve",
+        "description": "Resolves the effective enterprise managed settings without a session, from the device channel and, when an account is available, the account's server policy through the same per-account cache sessions use. A cached server policy less than an hour old is used without a fetch; otherwise the policy is fetched, and when the fetch fails a cached policy up to 24 hours old is used instead, unless `forceRemoteSettingsRefresh` requires a live fetch. With no account requested or signed in, it reports device policy only; signing out removes the account's cached policy. It can fetch server policy over the network when the cache is stale, so call it off latency-critical paths such as startup rather than before listing models. The policy helper is not run. `layers` lists each channel's document before merging, and `values` and `meta` carry typed effective values and their lock state for the keys typed so far.",
+        "params": {
+          "$ref": "#/definitions/ManagedSettingsResolveRequest",
+          "description": "Optional opaque account selection or GitHub token whose managed settings are resolved."
+        },
+        "result": {
+          "$ref": "#/definitions/ManagedSettingsResolveResult",
+          "description": "Effective enterprise managed settings for an account, resolved without a session."
+        },
+        "stability": "experimental"
+      },
+      "schema": {
+        "rpcMethod": "managedSettings.schema",
+        "description": "Returns the managed-settings authoring JSON schema with descriptive `x-composition` annotations aligned with the shared settings-engine vocabulary. These annotations are not a complete runtime composition contract: model, effortLevel, and contextTier remain coupled. Use `managedSettings.compose` for the runtime's effective result. Performs no I/O.",
+        "params": null,
+        "result": {
+          "$ref": "#/definitions/ManagedSettingsSchemaResult",
+          "description": "The authoring JSON schema for managed settings recognized by this runtime."
+        },
+        "stability": "experimental"
+      },
+      "validate": {
+        "rpcMethod": "managedSettings.validate",
+        "description": "Validates a candidate managed-settings document the way the runtime validates delivered policy, without applying it. Reports errors that would reject the document, warnings for content the runtime ignores, and the canonical document it would apply. Document text nested more than 64 levels deep is rejected. Performs no I/O.",
+        "params": {
+          "$ref": "#/definitions/ManagedSettingsValidateRequest",
+          "description": "A candidate managed-settings document to validate without applying it."
+        },
+        "result": {
+          "$ref": "#/definitions/ManagedSettingsValidateResult",
+          "description": "Result of validating a managed-settings document."
+        },
+        "stability": "experimental"
+      },
+      "compose": {
+        "rpcMethod": "managedSettings.compose",
+        "description": "Merges candidate managed-settings documents for the device, server, and policy-helper channels into the effective settings the runtime would enforce on this host, using the same precedence and composition rules as live resolution, without applying them. Like live resolution, a server's advisory sandbox force-enable is declined on a host that cannot run the sandbox. Does not fetch policy or read policy files, but may perform blocking OS or subprocess probes for sandbox support. Preview documents are limited to 1 MiB and 64 levels of nesting.",
+        "params": {
+          "$ref": "#/definitions/ManagedSettingsComposeRequest",
+          "description": "Candidate managed-settings documents to merge without applying them."
+        },
+        "result": {
+          "$ref": "#/definitions/ManagedSettingsComposeResult",
+          "description": "The effective managed settings the runtime would enforce for the given documents, in the same shape `managedSettings.resolve` returns."
+        },
+        "stability": "experimental"
       }
     },
     "runtime": {
@@ -6331,6 +6380,11 @@
                 "$ref": "#/definitions/McpOauthLoginGrantType",
                 "description": "Optional OAuth grant type override for this login. Defaults to the server configuration, or authorization_code when no grant type is specified."
               },
+              "redirectUri": {
+                "type": "string",
+                "format": "uri",
+                "description": "Optional externally visible HTTPS redirect URI for a host-managed callback endpoint. When supplied, the runtime still owns discovery, PKCE, token exchange, persistence, and reconnect, but does not bind a loopback listener or terminate HTTPS. The URI must not contain query parameters or a fragment and must be registered for the selected CIMD, DCR, or static OAuth client."
+              },
               "loginId": {
                 "type": "string",
                 "description": "Required for owned login. Consumes the exact prepareLogin handle once.\nSet forceReauth and display options during preparation, not consumption."
@@ -6345,7 +6399,7 @@
               "serverName"
             ],
             "additionalProperties": false,
-            "description": "Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.",
+            "description": "Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback handling, and static OAuth client selection.",
             "title": "McpOauthLoginRequest",
             "stability": "experimental",
             "x-legacy-parameters": [
@@ -6365,6 +6419,42 @@
           },
           "stability": "experimental"
         },
+        "complete": {
+          "rpcMethod": "session.mcp.oauth.complete",
+          "description": "Completes a runtime-managed MCP OAuth login after the authorization server redirects to a host-managed callback URL.",
+          "params": {
+            "type": "object",
+            "properties": {
+              "sessionId": {
+                "type": "string",
+                "description": "Target session identifier"
+              },
+              "authorizationId": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Opaque identifier returned by session.mcp.oauth.login for the pending external callback."
+              },
+              "callbackUrl": {
+                "type": "string",
+                "format": "uri",
+                "description": "Full externally visible HTTPS callback URL received by the host, including the authorization response query parameters. Applications behind a reverse proxy must reconstruct the public URL rather than passing an internal proxy URL."
+              }
+            },
+            "required": [
+              "sessionId",
+              "authorizationId",
+              "callbackUrl"
+            ],
+            "additionalProperties": false,
+            "description": "Host-delivered callback for a runtime-managed MCP OAuth login.",
+            "title": "McpOauthCompleteRequest",
+            "stability": "experimental"
+          },
+          "result": {
+            "type": "null"
+          },
+          "stability": "experimental"
+        },
         "probe": {
           "rpcMethod": "session.mcp.oauth.probe",
           "description": "Passively probes a configured remote MCP server to classify whether OAuth is required or a cached/override token is accepted. Does not start OAuth, emit pending OAuth requests, or mutate MCP connection state.",
@@ -6832,6 +6922,89 @@
           },
           "stability": "experimental"
         }
+      },
+      "prompts": {
+        "list": {
+          "rpcMethod": "session.mcp.prompts.list",
+          "description": "Enumerate one page of prompts a connected MCP server exposes (proxies MCP `prompts/list`). Pass `cursor` to continue from a prior result's `nextCursor`.",
+          "params": {
+            "type": "object",
+            "properties": {
+              "sessionId": {
+                "type": "string",
+                "description": "Target session identifier"
+              },
+              "serverName": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$",
+                "description": "Name of the MCP server whose prompts to enumerate"
+              },
+              "cursor": {
+                "type": "string",
+                "description": "Opaque MCP pagination cursor from a prior `nextCursor` value"
+              }
+            },
+            "required": [
+              "sessionId",
+              "serverName"
+            ],
+            "additionalProperties": false,
+            "description": "MCP server whose prompts to enumerate.",
+            "title": "McpPromptsListRequest",
+            "stability": "experimental"
+          },
+          "result": {
+            "$ref": "#/definitions/McpPromptsListResult",
+            "description": "One page of prompts advertised by the named MCP server."
+          },
+          "stability": "experimental"
+        },
+        "get": {
+          "rpcMethod": "session.mcp.prompts.get",
+          "description": "Get a prompt's messages from a connected MCP server (proxies MCP `prompts/get`). Content is preserved as opaque JSON. Does not send messages to the model, execute tools, or fetch referenced resources.",
+          "params": {
+            "type": "object",
+            "properties": {
+              "sessionId": {
+                "type": "string",
+                "description": "Target session identifier"
+              },
+              "serverName": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$",
+                "description": "Name of the MCP server hosting the prompt"
+              },
+              "promptName": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The programmatic name of the prompt"
+              },
+              "arguments": {
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string"
+                },
+                "description": "String-valued arguments to pass to the prompt"
+              }
+            },
+            "required": [
+              "sessionId",
+              "serverName",
+              "promptName"
+            ],
+            "additionalProperties": false,
+            "description": "MCP server, prompt name, and optional string-valued arguments.",
+            "title": "McpPromptsGetRequest",
+            "stability": "experimental"
+          },
+          "result": {
+            "$ref": "#/definitions/McpPromptsGetResult",
+            "description": "Prompt messages returned by the MCP server without sending them to the model."
+          },
+          "stability": "experimental"
+        }
       }
     },
     "diagnostics": {
@@ -6940,6 +7113,29 @@
         },
         "stability": "experimental"
       },
+      "getAccount": {
+        "rpcMethod": "session.connectors.getAccount",
+        "description": "Returns the session account selection, or null.",
+        "params": {
+          "type": "object",
+          "properties": {
+            "sessionId": {
+              "type": "string",
+              "description": "Target session identifier"
+            }
+          },
+          "required": [
+            "sessionId"
+          ],
+          "additionalProperties": false,
+          "description": "Identifies the target session."
+        },
+        "result": {
+          "$ref": "#/definitions/ConnectorSessionAccountResult",
+          "description": "Session account selection, or null."
+        },
+        "stability": "experimental"
+      },
       "getStatus": {
         "rpcMethod": "session.connectors.getStatus",
         "description": "Returns authoritative session Connector state from current availability, pinned account selection, cached catalog, and live MCP projection without performing a Connector service request.",
@@ -7196,6 +7392,10 @@
             "refreshCatalog": {
               "type": "boolean",
               "description": "When true, refresh the catalog before reconciling. A disabled Connector API performs no service request."
+            },
+            "forceConnectorName": {
+              "type": "string",
+              "description": "Optional Connector name to reinitialize. Requires the targetedReconcile capability."
             }
           },
           "required": [
@@ -7205,7 +7405,11 @@
           "additionalProperties": false,
           "description": "Requests authoritative Connector-to-MCP reconciliation for the pinned account.",
           "title": "ConnectorReconcileRequest",
-          "stability": "experimental"
+          "stability": "experimental",
+          "x-legacy-parameters": [
+            "accountId",
+            "refreshCatalog"
+          ]
         },
         "result": {
           "$ref": "#/definitions/ConnectorStatus",
@@ -7289,7 +7493,7 @@
         },
         "result": {
           "$ref": "#/definitions/ManagedSettingsResolvedData",
-          "description": "Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively across device, server, policy-helper, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes."
+          "description": "Effective enterprise managed settings and contributing channels. Session events report applied policy; sessionless resolve reports an account/device snapshot, and compose reports a non-applying preview of candidate documents. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively. Session-local SDK-client policy is included only in session results. Marked experimental while the managed-settings surface stabilizes."
         },
         "stability": "experimental"
       }
@@ -10469,7 +10673,7 @@
     "shell": {
       "exec": {
         "rpcMethod": "session.shell.exec",
-        "description": "Starts a shell command and streams output through session notifications. The command runs as the leader of its own process group (POSIX) or in a dedicated job object (Windows), so a forced termination — via \"shell.kill\", the request timeout, or session disposal — signals that whole group/job rather than only the direct child. Two gaps are worth planning for: a command that exits on its own does not trigger that teardown, and on POSIX a descendant that moves itself into a new session or process group (for example via \"setsid\") leaves the signalled group, so either can leave a background process running.",
+        "description": "Starts a shell command, returning an RPC error if it cannot be spawned. The command runs as the leader of its own process group (POSIX) or in a dedicated job object (Windows), so a forced termination — via \"shell.kill\", the request timeout, or session disposal — signals that whole group/job rather than only the direct child. Two gaps are worth planning for: a command that exits on its own does not trigger that teardown, and on POSIX a descendant that moves itself into a new session or process group (for example via \"setsid\") leaves the signalled group, so either can leave a background process running.",
         "params": {
           "type": "object",
           "properties": {
@@ -10497,13 +10701,13 @@
             "command"
           ],
           "additionalProperties": false,
-          "description": "Shell command to run, with optional working directory and timeout in milliseconds.",
+          "description": "Shell command to run, with optional working directory and timeout in milliseconds. Spawn failures return an RPC error.",
           "title": "ShellExecRequest",
           "stability": "experimental"
         },
         "result": {
           "$ref": "#/definitions/ShellExecResult",
-          "description": "Identifier of the spawned process, used to correlate streamed output and exit notifications."
+          "description": "Identifier of the spawned shell process, usable with shell.kill while the process is running."
         },
         "stability": "experimental"
       },
@@ -15320,6 +15524,32 @@
       "description": "Credential-free authentication identity safe to expose to hosts and user interfaces.",
       "title": "AuthIdentity"
     },
+    "AuthIdentityMetadata": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "$ref": "#/definitions/AuthInfoType",
+          "description": "Authentication type."
+        },
+        "host": {
+          "type": "string",
+          "description": "Identity host."
+        },
+        "login": {
+          "type": "string",
+          "description": "User login."
+        }
+      },
+      "required": [
+        "type",
+        "host",
+        "login"
+      ],
+      "additionalProperties": false,
+      "description": "Credential-free identity metadata.",
+      "title": "AuthIdentityMetadata",
+      "stability": "experimental"
+    },
     "AuthInfo": {
       "anyOf": [
         {
@@ -19522,6 +19752,16 @@
           "type": "boolean",
           "description": "Whether callers select a host-owned GitHub account through an opaque selection ID rather than supplying a provider token."
         },
+        "sessionAccountSelection": {
+          "type": "boolean",
+          "default": false,
+          "description": "Whether getAccount is supported. Absence means false."
+        },
+        "targetedReconcile": {
+          "type": "boolean",
+          "default": false,
+          "description": "Whether reconcile accepts forceConnectorName. Absence means false."
+        },
         "maxPollAttempts": {
           "type": "integer",
           "minimum": 0,
@@ -19550,7 +19790,16 @@
       "additionalProperties": false,
       "description": "Feature detection and hard polling limits for the EXPERIMENTAL session connector API.",
       "title": "ConnectorCapabilities",
-      "stability": "experimental"
+      "stability": "experimental",
+      "x-legacy-parameters": [
+        "apiVersion",
+        "availability",
+        "consentContinuation",
+        "opaqueAccountSelection",
+        "maxPollAttempts",
+        "maxPollIntervalMs",
+        "maxDeadlineMs"
+      ]
     },
     "ConnectorCatalogEntry": {
       "type": "object",
@@ -19567,6 +19816,18 @@
           "type": "string",
           "description": "Untrusted service description, when present."
         },
+        "logo": {
+          "type": "string",
+          "description": "Optional catalog logo."
+        },
+        "tier": {
+          "type": "string",
+          "description": "Optional catalog tier."
+        },
+        "releaseTag": {
+          "type": "string",
+          "description": "Optional catalog release tag."
+        },
         "status": {
           "$ref": "#/definitions/ConnectorCatalogStatus",
           "description": "Current authoritative service connection state."
@@ -19588,7 +19849,14 @@
       "additionalProperties": false,
       "description": "Credential-free Connector catalog entry.",
       "title": "ConnectorCatalogEntry",
-      "stability": "experimental"
+      "stability": "experimental",
+      "x-legacy-parameters": [
+        "name",
+        "displayName",
+        "description",
+        "status",
+        "runtimeServerIds"
+      ]
     },
     "ConnectorCatalogResult": {
       "type": "object",
@@ -19830,6 +20098,10 @@
         "refreshCatalog": {
           "type": "boolean",
           "description": "When true, refresh the catalog before reconciling. A disabled Connector API performs no service request."
+        },
+        "forceConnectorName": {
+          "type": "string",
+          "description": "Optional Connector name to reinitialize. Requires the targetedReconcile capability."
         }
       },
       "required": [
@@ -19838,7 +20110,11 @@
       "additionalProperties": false,
       "description": "Requests authoritative Connector-to-MCP reconciliation for the pinned account.",
       "title": "ConnectorReconcileRequest",
-      "stability": "experimental"
+      "stability": "experimental",
+      "x-legacy-parameters": [
+        "accountId",
+        "refreshCatalog"
+      ]
     },
     "ConnectorRuntimeStatus": {
       "type": "object",
@@ -19866,6 +20142,41 @@
       "title": "ConnectorRuntimeStatus",
       "stability": "experimental"
     },
+    "ConnectorSessionAccount": {
+      "type": "object",
+      "properties": {
+        "accountId": {
+          "type": "string",
+          "description": "Opaque session-scoped account selection ID."
+        },
+        "authInfo": {
+          "$ref": "#/definitions/AuthIdentityMetadata",
+          "description": "Credential-free identity metadata."
+        }
+      },
+      "required": [
+        "accountId",
+        "authInfo"
+      ],
+      "additionalProperties": false,
+      "description": "Session account selection.",
+      "title": "ConnectorSessionAccount",
+      "stability": "experimental"
+    },
+    "ConnectorSessionAccountResult": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/ConnectorSessionAccount",
+          "description": "Session account selection."
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "description": "Session account selection, or null.",
+      "title": "ConnectorSessionAccountResult",
+      "stability": "experimental"
+    },
     "ConnectorStatus": {
       "type": "object",
       "properties": {
@@ -25629,6 +25940,202 @@
       "description": "Non-secret host-managed HTTP MCP server configuration. The containing map key is the stable managed identity; credentials are supplied dynamically by the host.",
       "title": "ManagedMcpServerConfig"
     },
+    "ManagedSettingMeta": {
+      "type": "object",
+      "properties": {
+        "overridable": {
+          "type": "boolean",
+          "description": "Whether users and repositories may choose a different value. `false` means policy locks the value."
+        },
+        "source": {
+          "type": "string",
+          "description": "Channel that supplied this scalar value, matching a `layers[].source`: `device`, `server`, or `policyHelper`. These scalar defaults select one winning channel, not a mixed source. Treat unknown values as additional channels; more may be added."
+        }
+      },
+      "required": [
+        "overridable",
+        "source"
+      ],
+      "additionalProperties": false,
+      "description": "Lock state and provenance of one managed setting.",
+      "title": "ManagedSettingMeta",
+      "stability": "experimental"
+    },
+    "ManagedSettingsChannel": {
+      "type": "string",
+      "enum": [
+        "device",
+        "server",
+        "policyHelper"
+      ],
+      "description": "A channel accepted by managedSettings.compose.",
+      "title": "ManagedSettingsChannel",
+      "x-enumDescriptions": {
+        "device": "Device policy, the strongest channel.",
+        "server": "Account or organization policy.",
+        "policyHelper": "Session-local helper output, the weakest channel."
+      },
+      "stability": "experimental"
+    },
+    "ManagedSettingsComposeLayer": {
+      "type": "object",
+      "properties": {
+        "source": {
+          "$ref": "#/definitions/ManagedSettingsChannel",
+          "description": "The channel whose candidate document is being supplied."
+        },
+        "settings": {
+          "description": "Candidate managed-settings document. Omit when the channel delivered none, as in resolve output.",
+          "x-opaque-json": true
+        }
+      },
+      "required": [
+        "source"
+      ],
+      "additionalProperties": false,
+      "description": "One candidate channel; absent settings represents a channel that delivered no document.",
+      "title": "ManagedSettingsComposeLayer",
+      "stability": "experimental"
+    },
+    "ManagedSettingsComposeRequest": {
+      "type": "object",
+      "properties": {
+        "layers": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ManagedSettingsComposeLayer",
+            "description": "One candidate channel; absent settings represents a channel that delivered no document."
+          },
+          "description": "One entry per channel. `source` must be `device`, `server`, or `policyHelper`, each at most once (checked at runtime); order does not matter, because channel precedence is fixed. To preview documents from resolve output, map recognized source strings to ManagedSettingsChannel and copy their settings; generated resolve and compose layer types are distinct. Omitted settings means this channel delivered no document. Supplied documents must be valid within the preview limits; warnings are returned in diagnostics. Compose does not reproduce source-failure state or retained enforcement floors from resolve."
+        }
+      },
+      "required": [
+        "layers"
+      ],
+      "additionalProperties": false,
+      "description": "Candidate managed-settings documents to merge without applying them.",
+      "title": "ManagedSettingsComposeRequest",
+      "stability": "experimental"
+    },
+    "ManagedSettingsComposeResult": {
+      "type": "object",
+      "properties": {
+        "resolved": {
+          "$ref": "#/definitions/ManagedSettingsResolvedData",
+          "description": "Effective managed settings, in the same shape as `session.managedSettings.get`."
+        },
+        "values": {
+          "$ref": "#/definitions/ManagedSettingsValues",
+          "description": "Typed effective values, as in `managedSettings.resolve`."
+        },
+        "meta": {
+          "$ref": "#/definitions/ManagedSettingsMeta",
+          "description": "Per-key lock state and provenance for `values`."
+        },
+        "layers": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ManagedSettingsLayer",
+            "description": "One managed-settings channel and the document it delivered."
+          },
+          "description": "Only the supplied channels, strongest first, with canonical documents. Empty canonical documents are represented as absent settings, as in live resolution."
+        },
+        "diagnostics": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ManagedSettingsDiagnostic",
+            "description": "One validation finding for a managed-settings document."
+          },
+          "description": "Warnings about ignored content, with paths prefixed by the channel name."
+        }
+      },
+      "required": [
+        "resolved",
+        "layers",
+        "diagnostics"
+      ],
+      "additionalProperties": false,
+      "description": "The effective managed settings the runtime would enforce for the given documents, in the same shape `managedSettings.resolve` returns.",
+      "title": "ManagedSettingsComposeResult",
+      "stability": "experimental"
+    },
+    "ManagedSettingsDiagnostic": {
+      "type": "object",
+      "properties": {
+        "path": {
+          "type": "string",
+          "description": "Dot-separated path of the offending setting, such as `autoTier.overridable`. Empty for the document as a whole."
+        },
+        "severity": {
+          "$ref": "#/definitions/ManagedSettingsDiagnosticSeverity",
+          "description": "Whether the finding rejects the document."
+        },
+        "message": {
+          "type": "string",
+          "description": "Human-readable description of the finding."
+        }
+      },
+      "required": [
+        "path",
+        "severity",
+        "message"
+      ],
+      "additionalProperties": false,
+      "description": "One validation finding for a managed-settings document.",
+      "title": "ManagedSettingsDiagnostic",
+      "stability": "experimental"
+    },
+    "ManagedSettingsDiagnosticSeverity": {
+      "type": "string",
+      "enum": [
+        "error",
+        "warning"
+      ],
+      "description": "Severity of a managed-settings validation finding.",
+      "title": "ManagedSettingsDiagnosticSeverity",
+      "x-enumDescriptions": {
+        "error": "The runtime rejects the document.",
+        "warning": "The runtime accepts the document but ignores the flagged content."
+      },
+      "stability": "experimental"
+    },
+    "ManagedSettingsLayer": {
+      "type": "object",
+      "properties": {
+        "source": {
+          "type": "string",
+          "description": "Channel identifier: `device` (MDM, plist, registry, or managed file), `server` (account or organization policy), or `policyHelper` (session-local helper output, supported by compose). Treat unknown output values as additional channels; more may be added."
+        },
+        "settings": {
+          "description": "Validated managed-settings document this channel delivered. Absent when the channel delivered none.",
+          "x-opaque-json": true
+        }
+      },
+      "required": [
+        "source"
+      ],
+      "additionalProperties": false,
+      "description": "One managed-settings channel and the document it delivered.",
+      "title": "ManagedSettingsLayer",
+      "stability": "experimental"
+    },
+    "ManagedSettingsMeta": {
+      "type": "object",
+      "properties": {
+        "model": {
+          "$ref": "#/definitions/ManagedSettingMeta",
+          "description": "Lock state and provenance of `values.model`."
+        },
+        "autoTier": {
+          "$ref": "#/definitions/ManagedSettingMeta",
+          "description": "Lock state and provenance of `values.autoTier`."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Per-key lock state and provenance for `ManagedSettingsValues`, with the same field names. Producers emit each typed key in values and meta together; both outer objects are omitted when no typed key is set.",
+      "title": "ManagedSettingsMeta",
+      "stability": "experimental"
+    },
     "ManagedSettingsReadResult": {
       "type": "object",
       "properties": {
@@ -25705,7 +26212,7 @@
         "managedKeys"
       ],
       "additionalProperties": false,
-      "description": "Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively across device, server, policy-helper, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.",
+      "description": "Effective enterprise managed settings and contributing channels. Session events report applied policy; sessionless resolve reports an account/device snapshot, and compose reports a non-applying preview of candidate documents. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively. Session-local SDK-client policy is included only in session results. Marked experimental while the managed-settings surface stabilizes.",
       "title": "ManagedSettingsResolvedData",
       "stability": "experimental"
     },
@@ -25730,6 +26237,167 @@
         "none": "No managed policy is in force (no channel contributed)."
       }
     },
+    "ManagedSettingsResolveRequest": {
+      "anyOf": [
+        {
+          "not": {}
+        },
+        {
+          "type": "object",
+          "properties": {
+            "selectionId": {
+              "type": "string",
+              "description": "Opaque account identifier returned by `account.getAllUsers`. When omitted, the current account is used, or device policy only when no account is signed in."
+            },
+            "gitHubToken": {
+              "type": "string",
+              "description": "GitHub token to resolve instead of the current account. The call fails when the token cannot be resolved."
+            },
+            "clientName": {
+              "type": "string",
+              "description": "Embedding client identity for server policy requests, as in session creation. Omit for the CLI identity."
+            }
+          },
+          "additionalProperties": false
+        }
+      ],
+      "description": "Optional opaque account selection or GitHub token whose managed settings are resolved.",
+      "title": "ManagedSettingsResolveRequest",
+      "stability": "experimental"
+    },
+    "ManagedSettingsResolveResult": {
+      "type": "object",
+      "properties": {
+        "account": {
+          "type": "string",
+          "description": "Printable opaque identity of the account the settings were resolved for, suitable for comparison and storage, not an account selectionId. Absent when no account was available, in which case only device policy is reported."
+        },
+        "resolved": {
+          "$ref": "#/definitions/ManagedSettingsResolvedData",
+          "description": "Effective managed settings from the device and account (server) channels, in the same shape as `session.managedSettings.get`, excluding session-local injection."
+        },
+        "values": {
+          "$ref": "#/definitions/ManagedSettingsValues",
+          "description": "Typed effective values of managed settings, keyed like the managed-settings schema and already resolved across channels, with the `{ \"overridable\": ... }` wrapper removed. Present when policy sets at least one typed key. Keys not typed here are available in `resolved.settings`."
+        },
+        "meta": {
+          "$ref": "#/definitions/ManagedSettingsMeta",
+          "description": "Per-key lock state and provenance for the entries in `values`, using the same key names."
+        },
+        "layers": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ManagedSettingsLayer",
+            "description": "One managed-settings channel and the document it delivered."
+          },
+          "description": "Each managed-settings channel consulted, strongest first, with the validated document it delivered before merging. `resolved.settings` is the merged result. More channels may be added over time."
+        },
+        "diagnostics": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ManagedSettingsDiagnostic",
+            "description": "One validation finding for a managed-settings document."
+          },
+          "description": "Warnings about unavailable policy sources or a failed refresh served from cache. A cached response is not proof of a successful live fetch; `resolved.failClosed` separately describes enforcement."
+        }
+      },
+      "required": [
+        "resolved",
+        "layers",
+        "diagnostics"
+      ],
+      "additionalProperties": false,
+      "description": "Effective enterprise managed settings for an account, resolved without a session.",
+      "title": "ManagedSettingsResolveResult",
+      "stability": "experimental"
+    },
+    "ManagedSettingsSchemaResult": {
+      "type": "object",
+      "properties": {
+        "schema": {
+          "description": "JSON schema (draft 2020-12) with descriptive shared `x-composition` annotations, not a complete runtime composition contract. Model, effortLevel, and contextTier remain coupled; use `managedSettings.compose` for the runtime's effective result.",
+          "x-opaque-json": true
+        },
+        "runtimeVersion": {
+          "type": "string",
+          "description": "Version of the runtime that owns this schema."
+        }
+      },
+      "required": [
+        "schema",
+        "runtimeVersion"
+      ],
+      "additionalProperties": false,
+      "description": "The authoring JSON schema for managed settings recognized by this runtime.",
+      "title": "ManagedSettingsSchemaResult",
+      "stability": "experimental"
+    },
+    "ManagedSettingsValidateRequest": {
+      "type": "object",
+      "properties": {
+        "content": {
+          "description": "The document to validate: a JSON object, or a string containing the document's JSON text. Preview documents are limited to 1 MiB and 64 levels of nesting, a stricter resource limit than delivered-policy parsing; violations are returned as diagnostics.",
+          "x-opaque-json": true
+        },
+        "layer": {
+          "type": "string",
+          "description": "Channel the document is meant for (`device`, `server`, or `policyHelper`). Some keys are only honored in some channels; for example, a `policyHelper` registration is ignored in policy-helper output. When omitted, no channel-specific checks run."
+        }
+      },
+      "required": [
+        "content"
+      ],
+      "additionalProperties": false,
+      "description": "A candidate managed-settings document to validate without applying it.",
+      "title": "ManagedSettingsValidateRequest",
+      "stability": "experimental"
+    },
+    "ManagedSettingsValidateResult": {
+      "type": "object",
+      "properties": {
+        "valid": {
+          "type": "boolean",
+          "description": "Whether the runtime would accept the document within the preview resource limits. Always equals whether `settings` is present. An invalid document is rejected as a whole."
+        },
+        "settings": {
+          "description": "Canonical form of the document the runtime would apply, with unrecognized keys removed. Absent when the document is invalid.",
+          "x-opaque-json": true
+        },
+        "diagnostics": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/ManagedSettingsDiagnostic",
+            "description": "One validation finding for a managed-settings document."
+          },
+          "description": "Errors that reject the document and warnings about content the runtime ignores."
+        }
+      },
+      "required": [
+        "valid",
+        "diagnostics"
+      ],
+      "additionalProperties": false,
+      "description": "Result of validating a managed-settings document.",
+      "title": "ManagedSettingsValidateResult",
+      "stability": "experimental"
+    },
+    "ManagedSettingsValues": {
+      "type": "object",
+      "properties": {
+        "model": {
+          "type": "string",
+          "description": "Managed default model identifier, as configured. New sessions start with it; it can name a model the account cannot use, so hosts match it against the listed models."
+        },
+        "autoTier": {
+          "$ref": "#/definitions/AutoTier",
+          "description": "Managed Auto routing preference, used when the selected model is `auto`."
+        }
+      },
+      "additionalProperties": false,
+      "description": "Typed effective values of managed settings. Each field mirrors the managed-settings schema key of the same name; more keys are added as they are typed.",
+      "title": "ManagedSettingsValues",
+      "stability": "experimental"
+    },
     "MarketplaceAddResult": {
       "type": "object",
       "properties": {
@@ -28210,6 +28878,29 @@
       "additionalProperties": false,
       "description": "Honest terminal cancellation result; persistence or recovery failures remain RPC errors."
     },
+    "McpOauthCompleteRequest": {
+      "type": "object",
+      "properties": {
+        "authorizationId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Opaque identifier returned by session.mcp.oauth.login for the pending external callback."
+        },
+        "callbackUrl": {
+          "type": "string",
+          "format": "uri",
+          "description": "Full externally visible HTTPS callback URL received by the host, including the authorization response query parameters. Applications behind a reverse proxy must reconstruct the public URL rather than passing an internal proxy URL."
+        }
+      },
+      "required": [
+        "authorizationId",
+        "callbackUrl"
+      ],
+      "additionalProperties": false,
+      "description": "Host-delivered callback for a runtime-managed MCP OAuth login.",
+      "title": "McpOauthCompleteRequest",
+      "stability": "experimental"
+    },
     "McpOauthHandlePendingRequest": {
       "type": "object",
       "properties": {
@@ -28296,6 +28987,11 @@
           "$ref": "#/definitions/McpOauthLoginGrantType",
           "description": "Optional OAuth grant type override for this login. Defaults to the server configuration, or authorization_code when no grant type is specified."
         },
+        "redirectUri": {
+          "type": "string",
+          "format": "uri",
+          "description": "Optional externally visible HTTPS redirect URI for a host-managed callback endpoint. When supplied, the runtime still owns discovery, PKCE, token exchange, persistence, and reconnect, but does not bind a loopback listener or terminate HTTPS. The URI must not contain query parameters or a fragment and must be registered for the selected CIMD, DCR, or static OAuth client."
+        },
         "loginId": {
           "type": "string",
           "description": "Required for owned login. Consumes the exact prepareLogin handle once.\nSet forceReauth and display options during preparation, not consumption."
@@ -28309,7 +29005,7 @@
         "serverName"
       ],
       "additionalProperties": false,
-      "description": "Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.",
+      "description": "Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback handling, and static OAuth client selection.",
       "title": "McpOauthLoginRequest",
       "stability": "experimental",
       "x-legacy-parameters": [
@@ -28337,7 +29033,11 @@
         "authorizationUrl": {
           "type": "string",
           "format": "uri",
-          "description": "URL the caller should open in a browser to complete OAuth. Omitted when cached tokens were still valid and no browser interaction was needed — the server is already reconnected in that case. When present, the runtime starts the callback listener before returning and continues the flow in the background; completion is signaled via session.mcp_server_status_changed."
+          "description": "URL the caller should open in a browser to complete OAuth. Omitted when cached tokens were still valid and no browser interaction was needed — the server is already reconnected in that case. For the default loopback flow, the runtime starts its listener before returning. With redirectUri, the host receives the callback and completes it through session.mcp.oauth.complete. The runtime continues the flow in the background and signals completion via session.mcp_server_status_changed."
+        },
+        "authorizationId": {
+          "type": "string",
+          "description": "Opaque authorization identifier returned only for a host-managed redirect URI. The runtime also sends it as the OAuth state value, so the callback endpoint can read state and pass it with the full callback URL to session.mcp.oauth.complete."
         }
       },
       "additionalProperties": false,
@@ -29551,6 +30251,307 @@
       "description": "Side-effect-free preparation of one original bound remote MCP choice.",
       "title": "McpPrepareInstallRequest"
     },
+    "McpPrompt": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "The programmatic name of the prompt"
+        },
+        "title": {
+          "type": "string",
+          "description": "Human-readable display title"
+        },
+        "description": {
+          "type": "string",
+          "description": "Description of what this prompt provides"
+        },
+        "arguments": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/McpPromptArgument",
+            "description": "An argument accepted by an MCP prompt."
+          },
+          "description": "Arguments accepted by the prompt"
+        },
+        "icons": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/McpPromptIcon",
+            "description": "An MCP prompt icon with standard size hints and preserved non-standard fields."
+          },
+          "description": "Icons associated with this prompt"
+        },
+        "_meta": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Prompt-level metadata"
+        },
+        "additionalProperties": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Server-provided non-standard descriptor fields"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false,
+      "description": "An MCP prompt descriptor. Server-provided non-standard fields are exposed under `additionalProperties`.",
+      "title": "McpPrompt"
+    },
+    "McpPromptArgument": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Name of the argument"
+        },
+        "description": {
+          "type": "string",
+          "description": "Description of the argument"
+        },
+        "required": {
+          "type": "boolean",
+          "description": "Whether the argument is required; omission is distinct from false"
+        },
+        "_meta": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Argument-level metadata"
+        },
+        "additionalProperties": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Server-provided non-standard argument fields"
+        }
+      },
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false,
+      "description": "An argument accepted by an MCP prompt.",
+      "title": "McpPromptArgument"
+    },
+    "McpPromptIcon": {
+      "type": "object",
+      "properties": {
+        "src": {
+          "type": "string",
+          "description": "Icon URI"
+        },
+        "mimeType": {
+          "type": "string",
+          "description": "Icon MIME type, when known"
+        },
+        "sizes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Icon sizes, such as `48x48` or `any`"
+        },
+        "theme": {
+          "type": "string",
+          "description": "Theme hint for this icon"
+        },
+        "additionalProperties": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Server-provided non-standard icon fields"
+        }
+      },
+      "required": [
+        "src"
+      ],
+      "additionalProperties": false,
+      "description": "An MCP prompt icon with standard size hints and preserved non-standard fields.",
+      "title": "McpPromptIcon"
+    },
+    "McpPromptMessage": {
+      "type": "object",
+      "properties": {
+        "role": {
+          "$ref": "#/definitions/McpPromptRole",
+          "description": "The role of the message sender"
+        },
+        "content": {
+          "description": "The original MCP content block, including nested metadata and unfamiliar content types",
+          "x-opaque-json": true
+        },
+        "_meta": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Message-level metadata"
+        },
+        "additionalProperties": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Server-provided non-standard message fields"
+        }
+      },
+      "required": [
+        "role",
+        "content"
+      ],
+      "additionalProperties": false,
+      "description": "An MCP prompt message with opaque JSON content preserved without flattening or content-type filtering.",
+      "title": "McpPromptMessage"
+    },
+    "McpPromptRole": {
+      "type": "string",
+      "enum": [
+        "user",
+        "assistant"
+      ],
+      "description": "The sender role of an MCP prompt message.",
+      "title": "McpPromptRole",
+      "x-enumDescriptions": {
+        "user": "A message from the user.",
+        "assistant": "A message from the assistant."
+      }
+    },
+    "McpPromptsGetRequest": {
+      "type": "object",
+      "properties": {
+        "serverName": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$",
+          "description": "Name of the MCP server hosting the prompt"
+        },
+        "promptName": {
+          "type": "string",
+          "minLength": 1,
+          "description": "The programmatic name of the prompt"
+        },
+        "arguments": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "String-valued arguments to pass to the prompt"
+        }
+      },
+      "required": [
+        "serverName",
+        "promptName"
+      ],
+      "additionalProperties": false,
+      "description": "MCP server, prompt name, and optional string-valued arguments.",
+      "title": "McpPromptsGetRequest",
+      "stability": "experimental"
+    },
+    "McpPromptsGetResult": {
+      "type": "object",
+      "properties": {
+        "description": {
+          "type": "string",
+          "description": "Description of the prompt"
+        },
+        "messages": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/McpPromptMessage",
+            "description": "An MCP prompt message with opaque JSON content preserved without flattening or content-type filtering."
+          },
+          "description": "Ordered prompt messages"
+        },
+        "_meta": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "MCP result metadata"
+        },
+        "additionalProperties": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Server-provided non-standard result fields"
+        }
+      },
+      "required": [
+        "messages"
+      ],
+      "additionalProperties": false,
+      "description": "Prompt messages returned by the MCP server without sending them to the model.",
+      "title": "McpPromptsGetResult"
+    },
+    "McpPromptsListRequest": {
+      "type": "object",
+      "properties": {
+        "serverName": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^[^\\x00-\\x1f/\\x7f-\\x9f}]+(?:\\/[^\\x00-\\x1f/\\x7f-\\x9f}]+)*$",
+          "description": "Name of the MCP server whose prompts to enumerate"
+        },
+        "cursor": {
+          "type": "string",
+          "description": "Opaque MCP pagination cursor from a prior `nextCursor` value"
+        }
+      },
+      "required": [
+        "serverName"
+      ],
+      "additionalProperties": false,
+      "description": "MCP server whose prompts to enumerate.",
+      "title": "McpPromptsListRequest",
+      "stability": "experimental"
+    },
+    "McpPromptsListResult": {
+      "type": "object",
+      "properties": {
+        "prompts": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/McpPrompt",
+            "description": "An MCP prompt descriptor. Server-provided non-standard fields are exposed under `additionalProperties`."
+          },
+          "description": "Prompts advertised by the server"
+        },
+        "nextCursor": {
+          "type": "string",
+          "description": "Opaque cursor for the next page, if the server has more prompts"
+        },
+        "_meta": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "MCP result metadata"
+        },
+        "additionalProperties": {
+          "type": "object",
+          "additionalProperties": {
+            "x-opaque-json": true
+          },
+          "description": "Server-provided non-standard result fields"
+        }
+      },
+      "required": [
+        "prompts"
+      ],
+      "additionalProperties": false,
+      "description": "One page of prompts advertised by the named MCP server.",
+      "title": "McpPromptsListResult"
+    },
     "McpRegisterExternalClientRequest": {
       "type": "object",
       "properties": {
@@ -39642,7 +40643,7 @@
       "properties": {
         "name": {
           "$ref": "#/definitions/SandboxHostCapabilityName",
-          "description": "The policy feature, as an extensible string: ignore names you do not recognize. Known values: `network` (sandboxed commands can reach the network; on Linux this needs the tooling for Bubblewrap's private network namespace, such as slirp4netns), `network_filtering` (host rules and the sandbox proxy; on Linux this needs the same tooling as `network`; on Windows it needs Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set `network.allowLocalNetwork`), `denied_paths` (native enforcement of `filesystem.deniedPaths`), and `shell` (shell commands inside the sandbox; on Windows this needs Process Security Environment 1.1 filesystem enumeration support)."
+          "description": "The policy feature, as an extensible string: ignore names you do not recognize. Known values: `network` (sandboxed commands can reach the network; on Linux this needs the tooling for Bubblewrap's private network namespace, such as slirp4netns), `network_filtering` (host rules and the sandbox proxy; on Linux this needs the same tooling as `network`; on Windows it needs Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set `network.allowLocalNetwork`), `denied_paths` (native enforcement of `filesystem.deniedPaths`), `shell` (shell commands inside the sandbox), and `filesystem_enumeration` (enumerate-only filesystem grants; on Windows this needs Process Security Environment 1.1 filesystem enumeration support, and without it sandboxed PowerShell still runs but cannot resolve its current location; other platforms always report it)."
         },
         "supported": {
           "type": "boolean",
@@ -39658,7 +40659,7 @@
         "supported"
       ],
       "additionalProperties": false,
-      "description": "Whether this host can run one sandbox policy feature. A session whose effective policy uses an unsupported feature fails each sandboxed command with `reason`.",
+      "description": "Whether this host can run one sandbox policy feature. A session whose effective policy uses an unsupported feature fails each sandboxed command with `reason`, except `filesystem_enumeration`, whose absence degrades sandboxed PowerShell instead of failing it.",
       "title": "SandboxHostCapability"
     },
     "SandboxHostCapabilityName": {
@@ -39666,7 +40667,7 @@
       "minLength": 1,
       "maxLength": 64,
       "pattern": "^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$",
-      "description": "Extensible identifier of a sandbox policy feature whose availability varies between hosts. A plain string, so an older client decodes a name added by a newer runtime; ignore names you do not recognize. Known values: `network` — sandboxed commands can reach the network (`network.allowOutbound`, on by default); on Linux this needs the tooling for Bubblewrap's private network namespace, such as slirp4netns. `network_filtering` — host rules and the sandbox proxy (`network.allowedHosts`, `network.blockedHosts`, `network.proxy`); on Linux this needs the same tooling as `network`; on Windows it needs a version with Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set `network.allowLocalNetwork`, because Windows reaches the local proxy only together with private-network access. `denied_paths` — native enforcement of `filesystem.deniedPaths`; on Windows this needs a version whose sandbox contract reports denied-path support. `shell` — shell commands inside the sandbox: bash on macOS and Linux, PowerShell on Windows; on Windows this needs a version with Process Security Environment 1.1 filesystem enumeration support.",
+      "description": "Extensible identifier of a sandbox policy feature whose availability varies between hosts. A plain string, so an older client decodes a name added by a newer runtime; ignore names you do not recognize. Known values: `network` — sandboxed commands can reach the network (`network.allowOutbound`, on by default); on Linux this needs the tooling for Bubblewrap's private network namespace, such as slirp4netns. `network_filtering` — host rules and the sandbox proxy (`network.allowedHosts`, `network.blockedHosts`, `network.proxy`); on Linux this needs the same tooling as `network`; on Windows it needs a version with Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set `network.allowLocalNetwork`, because Windows reaches the local proxy only together with private-network access. `denied_paths` — native enforcement of `filesystem.deniedPaths`; on Windows this needs a version whose sandbox contract reports denied-path support. `shell` — shell commands inside the sandbox: bash on macOS and Linux, PowerShell on Windows. `filesystem_enumeration` — enumerate-only filesystem grants, which PowerShell's drive roots use on Windows; this needs a version with Process Security Environment 1.1 filesystem enumeration support. Without it, sandboxed PowerShell still runs, but `Get-Location` may report the drive root, `Set-Location` may fail, and relative paths may resolve against the drive root; the session also receives a `session.warning` with `warningType` `sandbox`. Other platforms always report it.",
       "title": "SandboxHostCapabilityName"
     },
     "SandboxHostSupport": {
@@ -39684,7 +40685,7 @@
           "type": "array",
           "items": {
             "$ref": "#/definitions/SandboxHostCapability",
-            "description": "Whether this host can run one sandbox policy feature. A session whose effective policy uses an unsupported feature fails each sandboxed command with `reason`."
+            "description": "Whether this host can run one sandbox policy feature. A session whose effective policy uses an unsupported feature fails each sandboxed command with `reason`, except `filesystem_enumeration`, whose absence degrades sandboxed PowerShell instead of failing it."
           },
           "description": "Sandbox policy features whose availability varies between hosts that can run the backend. Empty when `supported` is false, because no feature can run without a backend. Later runtimes can add entries; ignore an entry whose `name` you do not recognize."
         }
@@ -45059,7 +46060,7 @@
         "command"
       ],
       "additionalProperties": false,
-      "description": "Shell command to run, with optional working directory and timeout in milliseconds.",
+      "description": "Shell command to run, with optional working directory and timeout in milliseconds. Spawn failures return an RPC error.",
       "title": "ShellExecRequest",
       "stability": "experimental"
     },
@@ -45068,14 +46069,14 @@
       "properties": {
         "processId": {
           "type": "string",
-          "description": "Unique identifier for tracking streamed output"
+          "description": "Identifier usable with shell.kill while the process is running"
         }
       },
       "required": [
         "processId"
       ],
       "additionalProperties": false,
-      "description": "Identifier of the spawned process, used to correlate streamed output and exit notifications.",
+      "description": "Identifier of the spawned shell process, usable with shell.kill while the process is running.",
       "title": "ShellExecResult"
     },
     "ShellExecuteUserRequestedRequest": {