@github/copilot-sdk 1.0.0-beta.7 → 1.0.0-beta.9

package/README.md

@@ -957,7 +957,7 @@ const session = await client.createSession({
             };
         },
 
-        // Called after each tool execution
+        // Called after each successful tool execution
         onPostToolUse: async (input, invocation) => {
             console.log(`Tool ${input.toolName} completed`);
             // Optionally modify the result or add context
@@ -966,6 +966,16 @@ const session = await client.createSession({
             };
         },
 
+        // Called after a tool execution whose result was "failure".
+        // onPostToolUse does NOT fire for failed tool calls — register this
+        // hook to observe them. Input includes `error` (the failure message
+        // extracted from the tool's result), not the full result object.
+        onPostToolUseFailure: async (input, invocation) => {
+            console.log(`Tool ${input.toolName} failed: ${input.error}`);
+            // Optionally append hidden guidance to the model.
+            return { additionalContext: "Suggest checking inputs and retrying." };
+        },
+
         // Called when user submits a prompt
         onUserPromptSubmitted: async (input, invocation) => {
             console.log(`User prompt: ${input.prompt}`);
@@ -1001,7 +1011,8 @@ const session = await client.createSession({
 **Available hooks:**
 
 - `onPreToolUse` - Intercept tool calls before execution. Can allow/deny or modify arguments.
-- `onPostToolUse` - Process tool results after execution. Can modify results or add context.
+- `onPostToolUse` - Process tool results after **successful** execution. Can modify results or add context.
+- `onPostToolUseFailure` - Observe and append hidden guidance to the model after tool executions whose result was `"failure"`. Register this in addition to `onPostToolUse` to see failed tool calls.
 - `onUserPromptSubmitted` - Intercept user prompts. Can modify the prompt before processing.
 - `onSessionStart` - Run logic when a session starts or resumes.
 - `onSessionEnd` - Cleanup or logging when session ends.

package/dist/canvas.d.ts

@@ -1,15 +1,15 @@
+import type { CanvasJsonSchema, CanvasProviderCloseRequest, CanvasProviderInvokeActionRequest, CanvasProviderOpenRequest, CanvasProviderOpenResult } from "./generated/rpc.js";
+export type { CanvasJsonSchema, CanvasHostContext } from "./generated/rpc.js";
 /**
  * Extension-owned canvases declared via
  * `joinSession({ canvases: [createCanvas({...})] })`.
  *
- * The runtime sends provider callbacks directly as `canvas.open`,
- * `canvas.close`, and `canvas.action.invoke` JSON-RPC requests. The SDK
- * routes those requests by `canvasId` to the in-process handlers bound by
- * `createCanvas`. Re-opening with an existing `instanceId` is how the host
- * focuses an existing panel; reload is a renderer-only concern.
+ * The runtime sends provider callbacks as `canvas.open`, `canvas.close`, and
+ * `canvas.invokeAction` JSON-RPC requests via the codegen client session API
+ * pipeline. The SDK routes those requests by `canvasId` to the in-process
+ * handlers bound by `createCanvas`. Re-opening with an existing `instanceId`
+ * is how the host focuses an existing panel; reload is a renderer-only concern.
  */
-/** JSON Schema object used for canvas inputs. */
-export type CanvasJsonSchema = Record<string, unknown>;
 /**
  * A single agent-callable action contributed by a canvas. The metadata
  * (`name`, `description`, `inputSchema`) is serialized over the wire on
@@ -27,7 +27,7 @@ export interface CanvasAction {
     /** Optional JSON Schema for the action's `input` payload. */
     inputSchema?: CanvasJsonSchema;
     /** Required per-action dispatch handler. */
-    handler: (ctx: CanvasActionContext) => Promise<unknown> | unknown;
+    handler: (ctx: CanvasProviderInvokeActionRequest) => Promise<unknown> | unknown;
 }
 /**
  * Declarative metadata for a single canvas, serialized over the wire on
@@ -45,66 +45,6 @@ export interface CanvasDeclaration {
     /** Agent-invocable actions exposed via `invoke_canvas_action`. */
     actions?: Omit<CanvasAction, "handler">[];
 }
-/** Response returned from `open`. */
-export interface CanvasOpenResponse {
-    /** URL the host should render. Optional for native canvases. */
-    url?: string;
-    /** Provider-supplied title shown in host chrome. */
-    title?: string;
-    /** Provider-supplied status text shown in host chrome. */
-    status?: string;
-}
-/** Host capabilities passed to canvas callbacks. */
-export interface CanvasHostContext {
-    capabilities?: {
-        canvases?: boolean;
-    };
-}
-/** Context handed to a canvas's `open` handler. */
-export interface CanvasOpenContext {
-    /** Session that requested the canvas. */
-    sessionId: string;
-    /** Extension id that owns the canvas. */
-    extensionId: string;
-    /** Canvas id (matches the declaring `CanvasDeclaration.id`). */
-    canvasId: string;
-    /** Stable instance id supplied by the runtime. */
-    instanceId: string;
-    /** Validated `input` payload, shaped by `CanvasDeclaration.inputSchema`. */
-    input: unknown;
-    /** Host capabilities supplied by the runtime. */
-    host?: CanvasHostContext;
-}
-/** Context handed to a canvas action handler. */
-export interface CanvasActionContext {
-    /** Session that invoked the action. */
-    sessionId: string;
-    /** Extension id that owns the canvas. */
-    extensionId: string;
-    /** Canvas id targeted by the action. */
-    canvasId: string;
-    /** Instance id targeted by the action. */
-    instanceId: string;
-    /** Action name from `CanvasAction.name`. */
-    actionName: string;
-    /** Validated `input` payload, shaped by the action's `inputSchema`. */
-    input: unknown;
-    /** Host capabilities supplied by the runtime. */
-    host?: CanvasHostContext;
-}
-/** Context handed to a canvas's `onClose` handler. */
-export interface CanvasLifecycleContext {
-    /** Session owning the canvas instance. */
-    sessionId: string;
-    /** Extension id that owns the canvas. */
-    extensionId: string;
-    /** Canvas id (matches the declaring `CanvasDeclaration.id`). */
-    canvasId: string;
-    /** Instance id this lifecycle event applies to. */
-    instanceId: string;
-    /** Host capabilities supplied by the runtime. */
-    host?: CanvasHostContext;
-}
 /** Structured error returned from canvas handlers. */
 export declare class CanvasError extends Error {
     readonly code: string;
@@ -132,13 +72,13 @@ export interface CanvasOptions {
      */
     actions?: CanvasAction[];
     /** Required. Open a new canvas instance. */
-    open: (ctx: CanvasOpenContext) => Promise<CanvasOpenResponse> | CanvasOpenResponse;
+    open: (ctx: CanvasProviderOpenRequest) => Promise<CanvasProviderOpenResult> | CanvasProviderOpenResult;
     /**
      * Optional. Notified when a canvas instance is closed by the user, the
      * agent, or the host. Fire-and-forget: the return value is ignored and
      * errors are logged but not surfaced to the runtime.
      */
-    onClose?: (ctx: CanvasLifecycleContext) => Promise<void> | void;
+    onClose?: (ctx: CanvasProviderCloseRequest) => Promise<void> | void;
 }
 /** A registered canvas: declarative metadata + in-process handler closures.
  *

package/dist/canvas.js

@@ -42,51 +42,8 @@ class Canvas {
 function createCanvas(options) {
   return new Canvas(options);
 }
-async function dispatchCanvasProviderRequest(canvas, actionName, params) {
-  switch (actionName) {
-    case "canvas.open": {
-      const result = await canvas.open({
-        sessionId: params.sessionId,
-        extensionId: params.extensionId,
-        canvasId: params.canvasId,
-        instanceId: params.instanceId,
-        input: params.input,
-        host: params.host
-      });
-      return result ?? {};
-    }
-    case "canvas.close": {
-      if (canvas.onClose) {
-        await canvas.onClose({
-          sessionId: params.sessionId,
-          extensionId: params.extensionId,
-          canvasId: params.canvasId,
-          instanceId: params.instanceId,
-          host: params.host
-        });
-      }
-      return void 0;
-    }
-    default: {
-      const perAction = canvas.actionHandlers.get(actionName);
-      if (!perAction) {
-        throw CanvasError.noHandler();
-      }
-      return perAction({
-        sessionId: params.sessionId,
-        extensionId: params.extensionId,
-        canvasId: params.canvasId,
-        instanceId: params.instanceId,
-        actionName,
-        input: params.input,
-        host: params.host
-      });
-    }
-  }
-}
 export {
   Canvas,
   CanvasError,
-  createCanvas,
-  dispatchCanvasProviderRequest
+  createCanvas
 };

package/dist/cjs/canvas.js

@@ -20,8 +20,7 @@ var canvas_exports = {};
 __export(canvas_exports, {
   Canvas: () => Canvas,
   CanvasError: () => CanvasError,
-  createCanvas: () => createCanvas,
-  dispatchCanvasProviderRequest: () => dispatchCanvasProviderRequest
+  createCanvas: () => createCanvas
 });
 module.exports = __toCommonJS(canvas_exports);
 class CanvasError extends Error {
@@ -68,52 +67,9 @@ class Canvas {
 function createCanvas(options) {
   return new Canvas(options);
 }
-async function dispatchCanvasProviderRequest(canvas, actionName, params) {
-  switch (actionName) {
-    case "canvas.open": {
-      const result = await canvas.open({
-        sessionId: params.sessionId,
-        extensionId: params.extensionId,
-        canvasId: params.canvasId,
-        instanceId: params.instanceId,
-        input: params.input,
-        host: params.host
-      });
-      return result ?? {};
-    }
-    case "canvas.close": {
-      if (canvas.onClose) {
-        await canvas.onClose({
-          sessionId: params.sessionId,
-          extensionId: params.extensionId,
-          canvasId: params.canvasId,
-          instanceId: params.instanceId,
-          host: params.host
-        });
-      }
-      return void 0;
-    }
-    default: {
-      const perAction = canvas.actionHandlers.get(actionName);
-      if (!perAction) {
-        throw CanvasError.noHandler();
-      }
-      return perAction({
-        sessionId: params.sessionId,
-        extensionId: params.extensionId,
-        canvasId: params.canvasId,
-        instanceId: params.instanceId,
-        actionName,
-        input: params.input,
-        host: params.host
-      });
-    }
-  }
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Canvas,
   CanvasError,
-  createCanvas,
-  dispatchCanvasProviderRequest
+  createCanvas
 });

package/dist/cjs/client.js

@@ -30,11 +30,11 @@ var import_node_path = require("node:path");
 var import_node_url = require("node:url");
 var import_node = require("vscode-jsonrpc/node.js");
 var import_rpc = require("./generated/rpc.js");
-var import_canvas = require("./canvas.js");
 var import_sdkProtocolVersion = require("./sdkProtocolVersion.js");
 var import_session = require("./session.js");
 var import_sessionFsProvider = require("./sessionFsProvider.js");
 var import_telemetry = require("./telemetry.js");
+var import_toolSet = require("./toolSet.js");
 var import_types = require("./types.js");
 const import_meta = {};
 const MIN_PROTOCOL_VERSION = 3;
@@ -68,15 +68,23 @@ function toWireCustomAgents(agents) {
     return { ...rest, mcpServers: toWireMcpServers(mcpServers) };
   });
 }
-function isCanvasProviderRequestParams(params) {
-  if (!params || typeof params !== "object") {
-    return false;
+function toolFilterListToArray(value) {
+  if (value === void 0) {
+    return void 0;
   }
-  const request = params;
-  return typeof request.sessionId === "string" && typeof request.extensionId === "string" && typeof request.canvasId === "string" && typeof request.instanceId === "string";
+  return value instanceof import_toolSet.ToolSet ? value.toArray() : value;
 }
-function isCanvasActionInvokeParams(params) {
-  return isCanvasProviderRequestParams(params) && typeof params.actionName === "string";
+function validateToolFilterList(field, list) {
+  if (!list) {
+    return;
+  }
+  for (const entry of list) {
+    if (entry === "*") {
+      throw new Error(
+        `Invalid ${field} entry '*': there is no bare wildcard. Use one or more of \`new ToolSet().addBuiltIn('*')\`, \`.addMcp('*')\`, or \`.addCustom('*')\` to target a specific source.`
+      );
+    }
+  }
 }
 function extractTransformCallbacks(systemMessage) {
   if (!systemMessage || systemMessage.mode !== "customize" || !systemMessage.sections) {
@@ -260,8 +268,19 @@ class CopilotClient {
       telemetry: options.telemetry,
       baseDirectory: options.baseDirectory,
       sessionIdleTimeoutSeconds: options.sessionIdleTimeoutSeconds ?? 0,
-      enableRemoteSessions: options.enableRemoteSessions ?? false
+      enableRemoteSessions: options.enableRemoteSessions ?? false,
+      mode: options.mode ?? "copilot-cli"
     };
+    if (this.options.mode === "empty") {
+      const hasPersistence = this.options.baseDirectory !== void 0 || this.sessionFsConfig !== null || // External runtimes manage their own persistence layer; the SDK
+      // can't enforce it from here.
+      conn.kind === "uri" || conn.kind === "parent-process";
+      if (!hasPersistence) {
+        throw new Error(
+          "CopilotClient was created with mode: 'empty' but neither 'baseDirectory' nor 'sessionFs' was set. Empty mode requires an explicit per-session persistence location; pick one."
+        );
+      }
+    }
   }
   connectionExtraArgs = [];
   /**
@@ -571,10 +590,122 @@ class CopilotClient {
    * });
    * ```
    */
+  /**
+   * Normalizes session-level tool filter options. Converts {@link ToolSet}
+   * instances to plain string arrays, rejects misuse (bare `"*"`) and the
+   * missing-availableTools case in `mode = "empty"`.
+   *
+   * The SDK always sends `toolFilterPrecedence: "excluded"` so callers can
+   * compose include + exclude lists naturally (e.g. "everything matching X
+   * except Y") regardless of mode. Allowlist-precedence is intentionally not
+   * exposed — it's available on the runtime side as a CLI-only concession to
+   * legacy behavior, but SDK consumers always get the composable semantics.
+   *
+   * @internal
+   */
+  resolveToolFilterOptions(config) {
+    const availableTools = toolFilterListToArray(config.availableTools);
+    const excludedTools = toolFilterListToArray(config.excludedTools);
+    validateToolFilterList("availableTools", availableTools);
+    validateToolFilterList("excludedTools", excludedTools);
+    if (this.options.mode === "empty") {
+      if (availableTools === void 0) {
+        throw new Error(
+          "CopilotClient is in mode: 'empty' but the session config did not specify 'availableTools'. Empty mode requires every session to explicitly opt into the tools it wants \u2014 e.g. `new ToolSet().addBuiltIn(BuiltInTools.Isolated)`."
+        );
+      }
+    }
+    return { availableTools, excludedTools, toolFilterPrecedence: "excluded" };
+  }
+  /** Mode-specific defaults spread under the caller's config (app values win). */
+  configDefaultsForMode() {
+    if (this.options.mode === "empty") {
+      return { enableSessionTelemetry: false };
+    }
+    return {};
+  }
+  /**
+   * Returns the systemMessage config to use, adjusted for the current mode.
+   * In empty mode we ensure the environment_context section is removed
+   * unless the app has already taken control of it. `append` (and
+   * unspecified) mode is promoted to `customize` so we can also strip
+   * environment_context; the caller's `content` is preserved verbatim
+   * because the runtime appends it as additional instructions in both
+   * customize and append modes.
+   */
+  getSystemMessageConfigForMode(supplied) {
+    if (this.options.mode !== "empty") return supplied;
+    if (!supplied) {
+      return {
+        mode: "customize",
+        sections: { environment_context: { action: "remove" } }
+      };
+    }
+    switch (supplied.mode) {
+      case "replace":
+        return supplied;
+      case "customize":
+        if (supplied.sections?.environment_context) return supplied;
+        return {
+          ...supplied,
+          sections: {
+            ...supplied.sections,
+            environment_context: { action: "remove" }
+          }
+        };
+      case "append":
+      case void 0:
+        return {
+          mode: "customize",
+          content: supplied.content,
+          sections: { environment_context: { action: "remove" } }
+        };
+    }
+  }
+  /**
+   * Mode-specific options applied via session.options.update after create/resume.
+   *
+   * In empty mode, defaults the four overridable feature flags to safe values
+   * (caller values from `config` win). `installedPlugins=[]` is unconditional
+   * in empty mode — apps that need custom plugins should switch modes.
+   */
+  async updateSessionOptionsForMode(session, config) {
+    const patch = {};
+    if (this.options.mode === "empty") {
+      patch.skipCustomInstructions = config.skipCustomInstructions ?? true;
+      patch.customAgentsLocalOnly = config.customAgentsLocalOnly ?? true;
+      patch.coauthorEnabled = config.coauthorEnabled ?? false;
+      patch.manageScheduleEnabled = config.manageScheduleEnabled ?? false;
+      patch.installedPlugins = [];
+    } else {
+      if (config.skipCustomInstructions !== void 0)
+        patch.skipCustomInstructions = config.skipCustomInstructions;
+      if (config.customAgentsLocalOnly !== void 0)
+        patch.customAgentsLocalOnly = config.customAgentsLocalOnly;
+      if (config.coauthorEnabled !== void 0)
+        patch.coauthorEnabled = config.coauthorEnabled;
+      if (config.manageScheduleEnabled !== void 0)
+        patch.manageScheduleEnabled = config.manageScheduleEnabled;
+    }
+    if (Object.keys(patch).length === 0) {
+      return;
+    }
+    try {
+      await session.rpc.options.update(patch);
+    } catch (e) {
+      try {
+        await session.disconnect();
+      } catch {
+      }
+      throw e;
+    }
+  }
   async createSession(config) {
     if (!this.connection) {
       await this.start();
     }
+    config = { ...this.configDefaultsForMode(), ...config };
+    config.systemMessage = this.getSystemMessageConfigForMode(config.systemMessage);
     const sessionId = config.sessionId ?? (0, import_node_crypto.randomUUID)();
     const session = new import_session.CopilotSession(
       sessionId,
@@ -612,6 +743,7 @@ class CopilotClient {
     }
     this.sessions.set(sessionId, session);
     this.setupSessionFs(session, config);
+    const toolFilterOptions = this.resolveToolFilterOptions(config);
     try {
       const response = await this.connection.sendRequest("session.create", {
         ...await (0, import_telemetry.getTraceContext)(this.onGetTraceContext),
@@ -635,8 +767,9 @@ class CopilotClient {
           description: cmd.description
         })),
         systemMessage: wireSystemMessage,
-        availableTools: config.availableTools,
-        excludedTools: config.excludedTools,
+        availableTools: toolFilterOptions.availableTools,
+        excludedTools: toolFilterOptions.excludedTools,
+        toolFilterPrecedence: toolFilterOptions.toolFilterPrecedence,
         provider: config.provider,
         enableSessionTelemetry: config.enableSessionTelemetry,
         modelCapabilities: config.modelCapabilities,
@@ -667,6 +800,7 @@ class CopilotClient {
       const { workspacePath, capabilities } = response;
       session["_workspacePath"] = workspacePath;
       session.setCapabilities(capabilities);
+      await this.updateSessionOptionsForMode(session, config);
     } catch (e) {
       this.sessions.delete(sessionId);
       throw e;
@@ -726,6 +860,8 @@ class CopilotClient {
     if (config.hooks) {
       session.registerHooks(config.hooks);
     }
+    config = { ...this.configDefaultsForMode(), ...config };
+    config.systemMessage = this.getSystemMessageConfigForMode(config.systemMessage);
     const { wirePayload: wireSystemMessage, transformCallbacks } = extractTransformCallbacks(
       config.systemMessage
     );
@@ -737,6 +873,7 @@ class CopilotClient {
     }
     this.sessions.set(sessionId, session);
     this.setupSessionFs(session, config);
+    const toolFilterOptions = this.resolveToolFilterOptions(config);
     try {
       const response = await this.connection.sendRequest("session.resume", {
         ...await (0, import_telemetry.getTraceContext)(this.onGetTraceContext),
@@ -745,8 +882,9 @@ class CopilotClient {
         model: config.model,
         reasoningEffort: config.reasoningEffort,
         systemMessage: wireSystemMessage,
-        availableTools: config.availableTools,
-        excludedTools: config.excludedTools,
+        availableTools: toolFilterOptions.availableTools,
+        excludedTools: toolFilterOptions.excludedTools,
+        toolFilterPrecedence: toolFilterOptions.toolFilterPrecedence,
         enableSessionTelemetry: config.enableSessionTelemetry,
         tools: config.tools?.map((tool) => ({
           name: tool.name,
@@ -795,6 +933,7 @@ class CopilotClient {
       session["_workspacePath"] = workspacePath;
       session.setCapabilities(capabilities);
       session.setOpenCanvases(openCanvases ?? []);
+      await this.updateSessionOptionsForMode(session, config);
     } catch (e) {
       this.sessions.delete(sessionId);
       throw e;
@@ -1173,6 +1312,9 @@ class CopilotClient {
       if (this.options.baseDirectory) {
         envWithoutNodeDebug.COPILOT_HOME = this.options.baseDirectory;
       }
+      if (this.options.mode === "empty") {
+        envWithoutNodeDebug.COPILOT_DISABLE_KEYTAR = "1";
+      }
       if (!this.resolvedCliPath) {
         throw new Error(
           "Path to Copilot CLI is required. Please supply it via `RuntimeConnection.forStdio({ path })` or `RuntimeConnection.forTcp({ path })`, set the COPILOT_CLI_PATH environment variable, or use `RuntimeConnection.forUri(...)` to connect to an already-running runtime."
@@ -1409,18 +1551,6 @@ stderr: ${stderrOutput}`
       "systemMessage.transform",
       async (params) => await this.handleSystemMessageTransform(params)
     );
-    this.connection.onRequest(
-      "canvas.open",
-      async (params) => this.handleCanvasProviderRequest("canvas.open", params)
-    );
-    this.connection.onRequest(
-      "canvas.close",
-      async (params) => this.handleCanvasProviderRequest("canvas.close", params)
-    );
-    this.connection.onRequest(
-      "canvas.action.invoke",
-      async (params) => this.handleCanvasActionInvokeRequest(params)
-    );
     const sessions = this.sessions;
     (0, import_rpc.registerClientSessionApiHandlers)(this.connection, (sessionId) => {
       const session = sessions.get(sessionId);
@@ -1542,26 +1672,6 @@ stderr: ${stderrOutput}`
     }
     return await session._handleSystemMessageTransform(params.sections);
   }
-  async handleCanvasProviderRequest(actionName, params) {
-    if (!isCanvasProviderRequestParams(params)) {
-      throw new Error("Invalid canvas provider request payload");
-    }
-    const session = this.sessions.get(params.sessionId);
-    if (!session) {
-      throw new Error(`Session not found: ${params.sessionId}`);
-    }
-    const canvas = session.getCanvas(params.canvasId);
-    if (!canvas) {
-      throw new Error(`No canvas registered with id "${params.canvasId}"`);
-    }
-    return (0, import_canvas.dispatchCanvasProviderRequest)(canvas, actionName, params);
-  }
-  async handleCanvasActionInvokeRequest(params) {
-    if (!isCanvasActionInvokeParams(params)) {
-      throw new Error("Invalid canvas provider request payload");
-    }
-    return this.handleCanvasProviderRequest(params.actionName, params);
-  }
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/generated/rpc.js

@@ -171,7 +171,7 @@ function createServerRpc(connection) {
       /**
        * Lists persisted sessions, optionally filtered by working-directory context.
        *
-       * @param params Optional metadata-load limit and context filter applied to the returned sessions.
+       * @param params Optional metadata-load limit and filters applied to the returned sessions.
        *
        * @returns Persisted sessions matching the filter, ordered most-recently-modified first.
        */
@@ -275,7 +275,7 @@ function createServerRpc(connection) {
        *
        * @param params Session metadata records to enrich with summary and context information.
        *
-       * @returns The same metadata records, with summary and context fields backfilled where available.
+       * @returns The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.
        */
       enrichMetadata: async (params) => connection.sendRequest("sessions.enrichMetadata", params),
       /**
@@ -302,6 +302,17 @@ function createServerRpc(connection) {
        * @returns Replace the manager-wide additional plugins. New session creations and subsequent hook reloads see the new set; already-running sessions keep their existing hook installation until the next reload.
        */
       setAdditionalPlugins: async (params) => connection.sendRequest("sessions.setAdditionalPlugins", params)
+    },
+    /** @experimental */
+    agentRegistry: {
+      /**
+       * Spawns a managed-server child with the supplied configuration and returns a discriminated-union result. The caller (typically the CLI controller) is responsible for attaching to the spawned child and sending any follow-up prompt. When the controller-local spawn gate is closed the server returns JSON-RPC MethodNotFound.
+       *
+       * @param params Inputs to spawn a managed-server child via the controller's spawn delegate.
+       *
+       * @returns Outcome of an agentRegistry.spawn call.
+       */
+      spawn: async (params) => connection.sendRequest("agentRegistry.spawn", params)
     }
   };
 }
@@ -538,7 +549,15 @@ function createSessionRpc(connection, sessionId) {
        *
        * @returns Descriptor for the saved paste file, or null when the workspace is unavailable.
        */
-      saveLargePaste: async (params) => connection.sendRequest("session.workspaces.saveLargePaste", { sessionId, ...params })
+      saveLargePaste: async (params) => connection.sendRequest("session.workspaces.saveLargePaste", { sessionId, ...params }),
+      /**
+       * Computes a diff for the session workspace.
+       *
+       * @param params Parameters for computing a workspace diff.
+       *
+       * @returns Workspace diff result for the requested mode.
+       */
+      diff: async (params) => connection.sendRequest("session.workspaces.diff", { sessionId, ...params })
     },
     /** @experimental */
     instructions: {
@@ -1052,6 +1071,20 @@ function createSessionRpc(connection, sessionId) {
        * @returns Indicates whether the operation succeeded.
        */
       setApproveAll: async (params) => connection.sendRequest("session.permissions.setApproveAll", { sessionId, ...params }),
+      /**
+       * Enables or disables full allow-all permissions (tools, paths, and URLs) for the session. Used by attach-mode clients (e.g. LocalRpcSession's `/allow-all` forwarder) to flip the target session's permission state. Unlike `setApproveAll`, this swaps in the unrestricted path and URL managers and emits `session.permissions_changed` on transition. The result returns the authoritative post-mutation state so callers can update their local mirrors without racing the `session.permissions_changed` notification on the same wire.
+       *
+       * @param params Whether to enable full allow-all permissions for the session.
+       *
+       * @returns Indicates whether the operation succeeded and reports the post-mutation state.
+       */
+      setAllowAll: async (params) => connection.sendRequest("session.permissions.setAllowAll", { sessionId, ...params }),
+      /**
+       * Returns whether full allow-all permissions are currently active for the session.
+       *
+       * @returns Current full allow-all permission state.
+       */
+      getAllowAll: async () => connection.sendRequest("session.permissions.getAllowAll", { sessionId }),
       /**
        * Adds or removes session-scoped or location-scoped permission rules.
        *
@@ -1458,6 +1491,21 @@ function registerClientSessionApiHandlers(connection, getHandlers) {
     if (!handler) throw new Error(`No sessionFs handler registered for session: ${params.sessionId}`);
     return handler.sqliteExists(params);
   });
+  connection.onRequest("canvas.open", async (params) => {
+    const handler = getHandlers(params.sessionId).canvas;
+    if (!handler) throw new Error(`No canvas handler registered for session: ${params.sessionId}`);
+    return handler.open(params);
+  });
+  connection.onRequest("canvas.close", async (params) => {
+    const handler = getHandlers(params.sessionId).canvas;
+    if (!handler) throw new Error(`No canvas handler registered for session: ${params.sessionId}`);
+    return handler.close(params);
+  });
+  connection.onRequest("canvas.invokeAction", async (params) => {
+    const handler = getHandlers(params.sessionId).canvas;
+    if (!handler) throw new Error(`No canvas handler registered for session: ${params.sessionId}`);
+    return handler.invokeAction(params);
+  });
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {