@github/copilot-sdk 1.0.0-beta.7 → 1.0.0-beta.9

package/dist/generated/rpc.d.ts

@@ -24,6 +24,136 @@ export type AgentInfoSource =
  | "plugin"
 /** Agent built into the Copilot runtime. */
  | "builtin";
+/**
+ * Process kind tag for the registry entry
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntryKind".
+ */
+/** @experimental */
+export type AgentRegistryLiveTargetEntryKind = 
+/** Interactive Copilot CLI exposing a UI server (legacy/normal CLI process) */
+"ui-server"
+/** Headless `--server --managed-server` child spawned by a controller */
+ | "managed-server";
+/**
+ * Coarse lifecycle status of the foreground session
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntryStatus".
+ */
+/** @experimental */
+export type AgentRegistryLiveTargetEntryStatus = 
+/** Session is actively processing a turn */
+"working"
+/** Session is idle, waiting for input */
+ | "waiting"
+/** Last turn completed successfully */
+ | "done"
+/** Session needs user attention (see attentionKind for the specific reason) */
+ | "attention";
+/**
+ * Kind of attention required when status === "attention". Meaningful only when status === "attention".
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntryAttentionKind".
+ */
+/** @experimental */
+export type AgentRegistryLiveTargetEntryAttentionKind = 
+/** Session is blocked on an unrecoverable error */
+"error"
+/** Session is waiting for a tool-permission decision */
+ | "permission"
+/** Session is waiting for the user to approve or reject a plan */
+ | "exit_plan"
+/** Session is waiting on an elicitation prompt */
+ | "elicitation"
+/** Session is waiting for free-form user input */
+ | "user_input";
+/**
+ * How the most recent turn ended (clean vs aborted). Lets the renderer distinguish done from done_cancelled.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntryLastTerminalEvent".
+ */
+/** @experimental */
+export type AgentRegistryLiveTargetEntryLastTerminalEvent = 
+/** Last turn ended cleanly (model returned a final assistant message) */
+"turn_end"
+/** Last turn was aborted (e.g. user interrupted) */
+ | "abort";
+/**
+ * Categorized reason for log-open failure
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLogCaptureOpenErrorReason".
+ */
+/** @experimental */
+export type AgentRegistryLogCaptureOpenErrorReason = 
+/** Filesystem permission denied opening the log file */
+"permission"
+/** No space left on device */
+ | "disk_full"
+/** Other / uncategorized open failure */
+ | "other";
+/**
+ * Permission posture for the new session. 'yolo' requires the controller-local session to currently be in allow-all mode.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnPermissionMode".
+ */
+/** @experimental */
+export type AgentRegistrySpawnPermissionMode = 
+/** Standard permission posture (prompts for each request) */
+"default"
+/** Full allow-all (requires the controller-local session to currently be in allow-all mode) */
+ | "yolo";
+/**
+ * Outcome of an agentRegistry.spawn call.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnResult".
+ */
+/** @experimental */
+export type AgentRegistrySpawnResult = AgentRegistrySpawnSpawned | AgentRegistrySpawnError | AgentRegistrySpawnRegistryTimeout | AgentRegistrySpawnValidationError;
+/**
+ * Categorized reason for the rejection. Low-cardinality enum so telemetry can aggregate by reason without leaking raw paths or agent/model names.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnValidationErrorReason".
+ */
+/** @experimental */
+export type AgentRegistrySpawnValidationErrorReason = 
+/** Provided cwd does not exist on disk */
+"cwd-not-found"
+/** Provided cwd exists but is not a directory */
+ | "cwd-not-directory"
+/** Session name failed validateSessionName */
+ | "invalid-name"
+/** Requested agent name was not found in builtin or custom agents */
+ | "unknown-agent"
+/** Requested model is not available to this session */
+ | "unknown-model"
+/** Caller asked for permissionMode='yolo' but the controller is not currently in allow-all mode */
+ | "yolo-not-allowed";
+/**
+ * Which parameter field was invalid. Omitted when the rejection is not field-specific.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnValidationErrorField".
+ */
+/** @experimental */
+export type AgentRegistrySpawnValidationErrorField = 
+/** The cwd parameter */
+"cwd"
+/** The session name parameter */
+ | "name"
+/** The agentName parameter */
+ | "agentName"
+/** The model parameter */
+ | "model"
+/** The permissionMode parameter */
+ | "permissionMode";
 /**
  * The new auth credentials to install on the session. When omitted or `undefined`, the call is a no-op and the session's existing credentials are preserved. The runtime stores the value verbatim and uses it for outbound model/API requests; it does NOT re-validate or re-fetch the associated Copilot user response. Several variants carry secret material; treat this method's params as containing secrets at rest and in transit.
  *
@@ -428,6 +558,13 @@ export type McpAppsSetHostContextDetailsPlatform =
  * via the `definition` "McpServerConfig".
  */
 export type McpServerConfig = McpServerConfigStdio | McpServerConfigHttp;
+/**
+ * Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerAuthConfig".
+ */
+export type McpServerAuthConfig = boolean | McpServerAuthConfigRedirectPort;
 /**
  * Remote transport type. Defaults to "http" when omitted.
  *
@@ -612,6 +749,18 @@ export type OptionsUpdateEnvValueMode =
 "direct"
 /** Resolve MCP server environment values from host-side references. */
  | "indirect";
+/**
+ * Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "OptionsUpdateToolFilterPrecedence".
+ */
+/** @experimental */
+export type OptionsUpdateToolFilterPrecedence = 
+/** If availableTools is set, it is the only constraint that applies (excludedTools is ignored). Preserves CLI / pre-existing client behavior. Default. */
+"available"
+/** A tool is enabled if and only if it matches the allowlist (or the allowlist is unset) AND it does not match the denylist. Makes 'all except X' expressible by combining the two lists. */
+ | "excluded";
 /**
  * The client's response to the pending permission prompt
  *
@@ -790,6 +939,7 @@ export type SessionContextHostType =
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsErrorCode".
  */
+/** @experimental */
 export type SessionFsErrorCode = 
 /** The requested path does not exist. */
 "ENOENT"
@@ -801,6 +951,7 @@ export type SessionFsErrorCode =
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsReaddirWithTypesEntryType".
  */
+/** @experimental */
 export type SessionFsReaddirWithTypesEntryType = 
 /** The entry is a file. */
 "file"
@@ -823,6 +974,7 @@ export type SessionFsSetProviderConventions =
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsSqliteQueryType".
  */
+/** @experimental */
 export type SessionFsSqliteQueryType = 
 /** Execute DDL or multi-statement SQL without returning rows. */
 "exec"
@@ -1060,6 +1212,34 @@ export type UIExitPlanModeAction =
  | "autopilot"
 /** Exit plan mode and continue in autopilot mode with parallel subagent execution. */
  | "autopilot_fleet";
+/**
+ * Type of change represented by this file diff.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspaceDiffFileChangeType".
+ */
+/** @experimental */
+export type WorkspaceDiffFileChangeType = 
+/** The file was added. */
+"added"
+/** The file was modified. */
+ | "modified"
+/** The file was deleted. */
+ | "deleted"
+/** The file was renamed. */
+ | "renamed";
+/**
+ * Diff mode requested by the client.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspaceDiffMode".
+ */
+/** @experimental */
+export type WorkspaceDiffMode = 
+/** Return staged, unstaged, and untracked working tree changes. */
+"unstaged"
+/** Return changes compared with the default branch. */
+ | "branch";
 /**
  * Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
  *
@@ -1239,6 +1419,204 @@ export interface AgentList {
      */
     agents: AgentInfo[];
 }
+/**
+ * Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntry".
+ */
+/** @experimental */
+export interface AgentRegistryLiveTargetEntry {
+    /**
+     * Registry entry schema version (1 = ui-server, 2 = managed-server)
+     */
+    schemaVersion: number;
+    kind: AgentRegistryLiveTargetEntryKind;
+    /**
+     * Operating-system pid of the process owning this entry
+     */
+    pid: number;
+    /**
+     * Bind host for the entry's JSON-RPC server
+     */
+    host: string;
+    /**
+     * TCP port the entry's JSON-RPC server is listening on
+     */
+    port: number;
+    /**
+     * Session ID of the foreground session for this entry
+     */
+    sessionId?: string;
+    /**
+     * Friendly session name (when set)
+     */
+    sessionName?: string;
+    /**
+     * Working directory of the session (when known)
+     */
+    cwd?: string;
+    /**
+     * Git branch of the session (when known)
+     */
+    branch?: string;
+    /**
+     * Model identifier currently selected for the session
+     */
+    model?: string;
+    status?: AgentRegistryLiveTargetEntryStatus;
+    attentionKind?: AgentRegistryLiveTargetEntryAttentionKind;
+    /**
+     * Monotonic per-publisher revision counter incremented on every status update. Lets watchers detect transient flips.
+     */
+    statusRevision?: number;
+    lastTerminalEvent?: AgentRegistryLiveTargetEntryLastTerminalEvent;
+    /**
+     * ISO 8601 timestamp captured at registration
+     */
+    startedAt: string;
+    /**
+     * Copilot CLI version that wrote the entry
+     */
+    copilotVersion: string;
+    /**
+     * Wall-clock milliseconds since the watcher last observed this entry (heartbeat freshness)
+     */
+    lastSeenMs: number;
+}
+/**
+ * Per-spawn log-capture outcome; populated from spawnLiveTarget.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLogCapture".
+ */
+/** @experimental */
+export interface AgentRegistryLogCapture {
+    /**
+     * Whether per-spawn log capture is on (false when env-disabled or open failed)
+     */
+    enabled: boolean;
+    /**
+     * Absolute path to the per-spawn log file (only set when enabled)
+     */
+    path?: string;
+    /**
+     * Human-readable open failure message (only set when enabled === false AND the env-disable opt-out was NOT used)
+     */
+    openError?: string;
+    openErrorReason?: AgentRegistryLogCaptureOpenErrorReason;
+}
+/**
+ * `child_process.spawn` itself failed before the child entered the registry.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnError".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnError {
+    /**
+     * Discriminator: child_process.spawn itself failed
+     */
+    kind: "spawn-error";
+    /**
+     * Human-readable error message
+     */
+    message: string;
+    /**
+     * Underlying errno code (e.g. ENOENT, EACCES) when available
+     */
+    code?: string;
+}
+/**
+ * Spawn succeeded but the child did not publish a matching managed-server entry within the timeout.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnRegistryTimeout".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnRegistryTimeout {
+    /**
+     * Discriminator: spawn succeeded but child never registered
+     */
+    kind: "registry-timeout";
+    /**
+     * Process ID of the orphaned child (so the caller can offer 'kill the pid' guidance)
+     */
+    childPid: number;
+    logCapture?: AgentRegistryLogCapture;
+}
+/**
+ * Inputs to spawn a managed-server child via the controller's spawn delegate.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnRequest".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnRequest {
+    /**
+     * Working directory for the spawned child (must be an existing directory)
+     */
+    cwd: string;
+    /**
+     * Custom or built-in agent name (e.g. 'explore'). When omitted, the child uses its own default.
+     */
+    agentName?: string;
+    /**
+     * Model identifier to apply to the new session
+     */
+    model?: string;
+    /**
+     * Friendly session name. Must satisfy validateSessionName: non-empty, no leading/trailing whitespace, <=100 chars, no control chars, no double quotes.
+     */
+    name?: string;
+    permissionMode?: AgentRegistrySpawnPermissionMode;
+    /**
+     * Optional first user message. Forwarded to the caller (the CLI's spawn wrapper sends it post-attach via the standard LocalRpcSession.send path).
+     */
+    initialPrompt?: string;
+}
+/**
+ * Managed-server child was spawned and registered successfully.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnSpawned".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnSpawned {
+    /**
+     * Discriminator: managed-server child spawned successfully
+     */
+    kind: "spawned";
+    entry: AgentRegistryLiveTargetEntry;
+    /**
+     * Whether the delegate already sent the initial prompt. Always omitted in the current wiring: the controller sends the prompt post-attach via the standard LocalRpcSession.send path.
+     */
+    initialPromptSent?: boolean;
+    /**
+     * If the delegate attempted to send the initial prompt and failed, the categorized error message.
+     */
+    initialPromptError?: string;
+    logCapture?: AgentRegistryLogCapture;
+}
+/**
+ * Synchronous pre-validation rejected the spawn request.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnValidationError".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnValidationError {
+    /**
+     * Discriminator: synchronous pre-validation rejected the request
+     */
+    kind: "validation-error";
+    reason: AgentRegistrySpawnValidationErrorReason;
+    field?: AgentRegistrySpawnValidationErrorField;
+    /**
+     * Human-readable explanation; safe to surface in the UI banner. Never logged to unrestricted telemetry.
+     */
+    message: string;
+}
 /**
  * Custom agents available to the session after reloading definitions from disk.
  *
@@ -1275,6 +1653,36 @@ export interface AgentSelectRequest {
 export interface AgentSelectResult {
     agent: AgentInfo;
 }
+/**
+ * Indicates whether the operation succeeded and reports the post-mutation state.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AllowAllPermissionSetResult".
+ */
+/** @experimental */
+export interface AllowAllPermissionSetResult {
+    /**
+     * Whether the operation succeeded
+     */
+    success: boolean;
+    /**
+     * Authoritative allow-all state after the mutation
+     */
+    enabled: boolean;
+}
+/**
+ * Current full allow-all permission state.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AllowAllPermissionState".
+ */
+/** @experimental */
+export interface AllowAllPermissionState {
+    /**
+     * Whether full allow-all permissions are currently active
+     */
+    enabled: boolean;
+}
 /**
  * Schema for the `ApiKeyAuthInfo` type.
  *
@@ -1629,6 +2037,29 @@ export interface CanvasCloseRequest {
      */
     instanceId: string;
 }
+/**
+ * Host context supplied by the runtime.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasHostContext".
+ */
+/** @experimental */
+export interface CanvasHostContext {
+    capabilities?: CanvasHostContextCapabilities;
+}
+/**
+ * Host capabilities
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasHostContextCapabilities".
+ */
+/** @experimental */
+export interface CanvasHostContextCapabilities {
+    /**
+     * Whether canvas rendering is supported
+     */
+    canvases?: boolean;
+}
 /**
  * Canvas action invocation parameters.
  *
@@ -1653,19 +2084,14 @@ export interface CanvasInvokeActionRequest {
     };
 }
 /**
- * Canvas action invocation result.
+ * Provider-supplied action result.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "CanvasInvokeActionResult".
  */
 /** @experimental */
 export interface CanvasInvokeActionResult {
-    /**
-     * Provider-supplied action result
-     */
-    result?: {
-        [k: string]: unknown | undefined;
-    };
+    [k: string]: unknown | undefined;
 }
 /**
  * Declared canvases available in this session.
@@ -1802,6 +2228,137 @@ export interface CanvasOpenRequest {
         [k: string]: unknown | undefined;
     };
 }
+/**
+ * Canvas close parameters sent to the provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasProviderCloseRequest".
+ */
+/** @experimental */
+export interface CanvasProviderCloseRequest {
+    /**
+     * Target session identifier
+     */
+    sessionId: string;
+    /**
+     * Owning provider identifier
+     */
+    extensionId: string;
+    /**
+     * Provider-local canvas identifier
+     */
+    canvasId: string;
+    /**
+     * Canvas instance identifier
+     */
+    instanceId: string;
+    host?: CanvasHostContext;
+    session?: CanvasSessionContext;
+}
+/**
+ * Session context supplied by the runtime.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasSessionContext".
+ */
+/** @experimental */
+export interface CanvasSessionContext {
+    /**
+     * Active session working directory, when known.
+     */
+    workingDirectory?: string;
+}
+/**
+ * Canvas action invocation parameters sent to the provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasProviderInvokeActionRequest".
+ */
+/** @experimental */
+export interface CanvasProviderInvokeActionRequest {
+    /**
+     * Target session identifier
+     */
+    sessionId: string;
+    /**
+     * Owning provider identifier
+     */
+    extensionId: string;
+    /**
+     * Provider-local canvas identifier
+     */
+    canvasId: string;
+    /**
+     * Canvas instance identifier
+     */
+    instanceId: string;
+    /**
+     * Action name to invoke
+     */
+    actionName: string;
+    /**
+     * Action input
+     */
+    input?: {
+        [k: string]: unknown | undefined;
+    };
+    host?: CanvasHostContext;
+    session?: CanvasSessionContext;
+}
+/**
+ * Canvas open parameters sent to the provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasProviderOpenRequest".
+ */
+/** @experimental */
+export interface CanvasProviderOpenRequest {
+    /**
+     * Target session identifier
+     */
+    sessionId: string;
+    /**
+     * Owning provider identifier
+     */
+    extensionId: string;
+    /**
+     * Provider-local canvas identifier
+     */
+    canvasId: string;
+    /**
+     * Stable caller-supplied canvas instance identifier
+     */
+    instanceId: string;
+    /**
+     * Canvas open input
+     */
+    input?: {
+        [k: string]: unknown | undefined;
+    };
+    host?: CanvasHostContext;
+    session?: CanvasSessionContext;
+}
+/**
+ * Canvas open result returned by the provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasProviderOpenResult".
+ */
+/** @experimental */
+export interface CanvasProviderOpenResult {
+    /**
+     * URL for web-rendered canvases
+     */
+    url?: string;
+    /**
+     * Provider-supplied title
+     */
+    title?: string;
+    /**
+     * Provider-supplied status text
+     */
+    status?: string;
+}
 /**
  * Slash commands available in the session, after applying any include/exclude filters.
  *
@@ -3283,6 +3840,8 @@ export interface McpServerConfigStdio {
      * Timeout in milliseconds for tool calls to this server.
      */
     timeout?: number;
+    oidc?: McpServerAuthConfig;
+    auth?: McpServerAuthConfig;
     /**
      * Executable command used to start the Stdio MCP server process.
      */
@@ -3302,6 +3861,19 @@ export interface McpServerConfigStdio {
         [k: string]: string | undefined;
     };
 }
+/**
+ * Authentication settings with optional redirect port configuration.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerAuthConfigRedirectPort".
+ */
+export interface McpServerAuthConfigRedirectPort {
+    /**
+     * Fixed port for the OAuth redirect callback server.
+     */
+    redirectPort?: number;
+    [k: string]: unknown | undefined;
+}
 /**
  * Remote MCP server configuration accessed over HTTP or SSE.
  *
@@ -3323,6 +3895,8 @@ export interface McpServerConfigHttp {
      * Timeout in milliseconds for tool calls to this server.
      */
     timeout?: number;
+    oidc?: McpServerAuthConfig;
+    auth?: McpServerAuthConfig;
     /**
      * URL of the remote MCP server endpoint.
      */
@@ -3342,19 +3916,6 @@ export interface McpServerConfigHttp {
      */
     oauthPublicClient?: boolean;
     oauthGrantType?: McpServerConfigHttpOauthGrantType;
-    auth?: McpServerConfigHttpAuth;
-}
-/**
- * Additional authentication configuration for this server.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpServerConfigHttpAuth".
- */
-export interface McpServerConfigHttpAuth {
-    /**
-     * Fixed port for the OAuth redirect callback server.
-     */
-    redirectPort?: number;
 }
 /**
  * MCP server names to disable for new sessions.
@@ -5296,6 +5857,14 @@ export interface PermissionsFolderTrustAddTrustedResult {
      */
     success: boolean;
 }
+/**
+ * No parameters.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionsGetAllowAllRequest".
+ */
+export interface PermissionsGetAllowAllRequest {
+}
 /**
  * Indicates whether the operation succeeded.
  *
@@ -5420,6 +5989,19 @@ export interface PermissionsResetSessionApprovalsResult {
      */
     success: boolean;
 }
+/**
+ * Whether to enable full allow-all permissions for the session.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionsSetAllowAllRequest".
+ */
+/** @experimental */
+export interface PermissionsSetAllowAllRequest {
+    /**
+     * Whether to enable full allow-all permissions
+     */
+    enabled: boolean;
+}
 /**
  * Allow-all toggle for tool permission requests, with an optional telemetry source.
  *
@@ -6211,7 +6793,7 @@ export interface SessionContext {
     branch?: string;
 }
 /**
- * The same metadata records, with summary and context fields backfilled where available.
+ * The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionEnrichMetadataResult".
@@ -6219,7 +6801,7 @@ export interface SessionContext {
 /** @experimental */
 export interface SessionEnrichMetadataResult {
     /**
-     * Same records, with summary and context backfilled
+     * Enriched records, with summary and context backfilled. Sessions confirmed empty and unnamed may be omitted.
      */
     sessions: SessionMetadata[];
 }
@@ -6251,10 +6833,18 @@ export interface SessionMetadata {
      * Optional human-friendly name set via /rename
      */
     name?: string;
+    /**
+     * Runtime client name that created/last resumed this session
+     */
+    clientName?: string;
     /**
      * True for remote (GitHub) sessions; false for local
      */
     isRemote: boolean;
+    /**
+     * True for detached maintenance sessions that should be hidden from normal resume lists.
+     */
+    isDetached?: boolean;
     context?: SessionContext;
     /**
      * GitHub task ID, when this local session is bound to one. Only present for local sessions exported to remote control.
@@ -6267,6 +6857,7 @@ export interface SessionMetadata {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsAppendFileRequest".
  */
+/** @experimental */
 export interface SessionFsAppendFileRequest {
     /**
      * Target session identifier
@@ -6291,6 +6882,7 @@ export interface SessionFsAppendFileRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsError".
  */
+/** @experimental */
 export interface SessionFsError {
     code: SessionFsErrorCode;
     /**
@@ -6304,6 +6896,7 @@ export interface SessionFsError {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsExistsRequest".
  */
+/** @experimental */
 export interface SessionFsExistsRequest {
     /**
      * Target session identifier
@@ -6320,6 +6913,7 @@ export interface SessionFsExistsRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsExistsResult".
  */
+/** @experimental */
 export interface SessionFsExistsResult {
     /**
      * Whether the path exists
@@ -6332,6 +6926,7 @@ export interface SessionFsExistsResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsMkdirRequest".
  */
+/** @experimental */
 export interface SessionFsMkdirRequest {
     /**
      * Target session identifier
@@ -6356,6 +6951,7 @@ export interface SessionFsMkdirRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsReaddirRequest".
  */
+/** @experimental */
 export interface SessionFsReaddirRequest {
     /**
      * Target session identifier
@@ -6372,6 +6968,7 @@ export interface SessionFsReaddirRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsReaddirResult".
  */
+/** @experimental */
 export interface SessionFsReaddirResult {
     /**
      * Entry names in the directory
@@ -6385,6 +6982,7 @@ export interface SessionFsReaddirResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsReaddirWithTypesEntry".
  */
+/** @experimental */
 export interface SessionFsReaddirWithTypesEntry {
     /**
      * Entry name
@@ -6398,6 +6996,7 @@ export interface SessionFsReaddirWithTypesEntry {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsReaddirWithTypesRequest".
  */
+/** @experimental */
 export interface SessionFsReaddirWithTypesRequest {
     /**
      * Target session identifier
@@ -6414,6 +7013,7 @@ export interface SessionFsReaddirWithTypesRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsReaddirWithTypesResult".
  */
+/** @experimental */
 export interface SessionFsReaddirWithTypesResult {
     /**
      * Directory entries with type information
@@ -6427,6 +7027,7 @@ export interface SessionFsReaddirWithTypesResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsReadFileRequest".
  */
+/** @experimental */
 export interface SessionFsReadFileRequest {
     /**
      * Target session identifier
@@ -6443,6 +7044,7 @@ export interface SessionFsReadFileRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsReadFileResult".
  */
+/** @experimental */
 export interface SessionFsReadFileResult {
     /**
      * File content as UTF-8 string
@@ -6456,6 +7058,7 @@ export interface SessionFsReadFileResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsRenameRequest".
  */
+/** @experimental */
 export interface SessionFsRenameRequest {
     /**
      * Target session identifier
@@ -6476,6 +7079,7 @@ export interface SessionFsRenameRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsRmRequest".
  */
+/** @experimental */
 export interface SessionFsRmRequest {
     /**
      * Target session identifier
@@ -6542,6 +7146,7 @@ export interface SessionFsSetProviderResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsSqliteExistsResult".
  */
+/** @experimental */
 export interface SessionFsSqliteExistsResult {
     /**
      * Whether the session database already exists
@@ -6554,6 +7159,7 @@ export interface SessionFsSqliteExistsResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsSqliteQueryRequest".
  */
+/** @experimental */
 export interface SessionFsSqliteQueryRequest {
     /**
      * Target session identifier
@@ -6577,6 +7183,7 @@ export interface SessionFsSqliteQueryRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsSqliteQueryResult".
  */
+/** @experimental */
 export interface SessionFsSqliteQueryResult {
     /**
      * For SELECT: array of row objects. For others: empty array.
@@ -6604,6 +7211,7 @@ export interface SessionFsSqliteQueryResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsStatRequest".
  */
+/** @experimental */
 export interface SessionFsStatRequest {
     /**
      * Target session identifier
@@ -6620,6 +7228,7 @@ export interface SessionFsStatRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsStatResult".
  */
+/** @experimental */
 export interface SessionFsStatResult {
     /**
      * Whether the path is a file
@@ -6649,6 +7258,7 @@ export interface SessionFsStatResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsWriteFileRequest".
  */
+/** @experimental */
 export interface SessionFsWriteFileRequest {
     /**
      * Target session identifier
@@ -6838,6 +7448,10 @@ export interface SessionMetadataSnapshot {
      * User-provided name supplied at session construction (via `--name`), if any. Immutable after construction.
      */
     initialName?: string;
+    /**
+     * Runtime client name associated with the session (telemetry identifier).
+     */
+    clientName?: string;
     remoteMetadata?: MetadataSnapshotRemoteMetadata;
     /**
      * Short human-readable summary of the session, if known. Omitted when no summary has been generated.
@@ -7164,7 +7778,7 @@ export interface SessionSizes {
     };
 }
 /**
- * Optional metadata-load limit and context filter applied to the returned sessions.
+ * Optional metadata-load limit and filters applied to the returned sessions.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionsListRequest".
@@ -7176,6 +7790,10 @@ export interface SessionsListRequest {
      */
     metadataLimit?: number;
     filter?: SessionListFilter;
+    /**
+     * When true, include detached maintenance sessions. Defaults to false for user-facing session lists.
+     */
+    includeDetached?: boolean;
 }
 /**
  * Active session ID whose deferred repo-level hooks should be loaded.
@@ -7365,6 +7983,7 @@ export interface SessionUpdateOptionsParams {
      * Denylist of tool names for this session.
      */
     excludedTools?: string[];
+    toolFilterPrecedence?: OptionsUpdateToolFilterPrecedence;
     /**
      * Whether shell-script safety heuristics are enabled.
      */
@@ -9035,6 +9654,55 @@ export interface UsageMetricsModelMetricTokenDetail {
      */
     tokenCount: number;
 }
+/**
+ * A single changed file and its unified diff.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspaceDiffFileChange".
+ */
+/** @experimental */
+export interface WorkspaceDiffFileChange {
+    /**
+     * Path to the changed file, relative to the workspace root.
+     */
+    path: string;
+    /**
+     * Unified diff content for the file. Empty when the diff was truncated.
+     */
+    diff: string;
+    changeType: WorkspaceDiffFileChangeType;
+    /**
+     * Original file path for renamed files.
+     */
+    oldPath?: string;
+    /**
+     * Whether the diff content was omitted because it exceeded the per-file size limit.
+     */
+    isTruncated?: boolean;
+}
+/**
+ * Workspace diff result for the requested mode.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspaceDiffResult".
+ */
+/** @experimental */
+export interface WorkspaceDiffResult {
+    requestedMode: WorkspaceDiffMode;
+    mode: WorkspaceDiffMode;
+    /**
+     * Changed files and their unified diffs.
+     */
+    changes: WorkspaceDiffFileChange[];
+    /**
+     * Default branch used for a branch diff, when branch mode was requested.
+     */
+    baseBranch?: string;
+    /**
+     * Whether a requested branch diff fell back to unstaged changes because branch diff failed.
+     */
+    isFallback: boolean;
+}
 /**
  * Schema for the `WorkspacesCheckpoints` type.
  *
@@ -9073,6 +9741,16 @@ export interface WorkspacesCreateFileRequest {
      */
     content: string;
 }
+/**
+ * Parameters for computing a workspace diff.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspacesDiffRequest".
+ */
+/** @experimental */
+export interface WorkspacesDiffRequest {
+    mode: WorkspaceDiffMode;
+}
 /**
  * Current workspace metadata for the session, including its absolute filesystem path when available.
  *
@@ -9092,6 +9770,7 @@ export interface WorkspacesGetWorkspaceResult {
         host_type?: WorkspacesWorkspaceDetailsHostType;
         branch?: string;
         name?: string;
+        client_name?: string;
         user_named?: boolean;
         summary_count?: number;
         created_at?: string;
@@ -9240,6 +9919,7 @@ export interface SessionMcpAppsCallToolResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsSqliteExistsRequest".
  */
+/** @experimental */
 export interface SessionFsSqliteExistsRequest {
     /**
      * Target session identifier
@@ -9393,7 +10073,7 @@ export declare function createServerRpc(connection: MessageConnection): {
         /**
          * Lists persisted sessions, optionally filtered by working-directory context.
          *
-         * @param params Optional metadata-load limit and context filter applied to the returned sessions.
+         * @param params Optional metadata-load limit and filters applied to the returned sessions.
          *
          * @returns Persisted sessions matching the filter, ordered most-recently-modified first.
          */
@@ -9497,7 +10177,7 @@ export declare function createServerRpc(connection: MessageConnection): {
          *
          * @param params Session metadata records to enrich with summary and context information.
          *
-         * @returns The same metadata records, with summary and context fields backfilled where available.
+         * @returns The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.
          */
         enrichMetadata: (params: SessionsEnrichMetadataRequest) => Promise<SessionEnrichMetadataResult>;
         /**
@@ -9525,6 +10205,17 @@ export declare function createServerRpc(connection: MessageConnection): {
          */
         setAdditionalPlugins: (params: SessionsSetAdditionalPluginsRequest) => Promise<SessionsSetAdditionalPluginsResult>;
     };
+    /** @experimental */
+    agentRegistry: {
+        /**
+         * Spawns a managed-server child with the supplied configuration and returns a discriminated-union result. The caller (typically the CLI controller) is responsible for attaching to the spawned child and sending any follow-up prompt. When the controller-local spawn gate is closed the server returns JSON-RPC MethodNotFound.
+         *
+         * @param params Inputs to spawn a managed-server child via the controller's spawn delegate.
+         *
+         * @returns Outcome of an agentRegistry.spawn call.
+         */
+        spawn: (params: AgentRegistrySpawnRequest) => Promise<AgentRegistrySpawnResult>;
+    };
 };
 /** Create typed session-scoped RPC methods. */
 export declare function createSessionRpc(connection: MessageConnection, sessionId: string): {
@@ -9748,6 +10439,14 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Descriptor for the saved paste file, or null when the workspace is unavailable.
          */
         saveLargePaste: (params: WorkspacesSaveLargePasteRequest) => Promise<WorkspacesSaveLargePasteResult>;
+        /**
+         * Computes a diff for the session workspace.
+         *
+         * @param params Parameters for computing a workspace diff.
+         *
+         * @returns Workspace diff result for the requested mode.
+         */
+        diff: (params: WorkspacesDiffRequest) => Promise<WorkspaceDiffResult>;
     };
     /** @experimental */
     instructions: {
@@ -10261,6 +10960,20 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Indicates whether the operation succeeded.
          */
         setApproveAll: (params: PermissionsSetApproveAllRequest) => Promise<PermissionsSetApproveAllResult>;
+        /**
+         * Enables or disables full allow-all permissions (tools, paths, and URLs) for the session. Used by attach-mode clients (e.g. LocalRpcSession's `/allow-all` forwarder) to flip the target session's permission state. Unlike `setApproveAll`, this swaps in the unrestricted path and URL managers and emits `session.permissions_changed` on transition. The result returns the authoritative post-mutation state so callers can update their local mirrors without racing the `session.permissions_changed` notification on the same wire.
+         *
+         * @param params Whether to enable full allow-all permissions for the session.
+         *
+         * @returns Indicates whether the operation succeeded and reports the post-mutation state.
+         */
+        setAllowAll: (params: PermissionsSetAllowAllRequest) => Promise<AllowAllPermissionSetResult>;
+        /**
+         * Returns whether full allow-all permissions are currently active for the session.
+         *
+         * @returns Current full allow-all permission state.
+         */
+        getAllowAll: () => Promise<AllowAllPermissionState>;
         /**
          * Adds or removes session-scoped or location-scoped permission rules.
          *
@@ -10606,6 +11319,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
     };
 };
 /** Handler for `sessionFs` client session API methods. */
+/** @experimental */
 export interface SessionFsHandler {
     /**
      * Reads a file from the client-provided session filesystem.
@@ -10704,9 +11418,36 @@ export interface SessionFsHandler {
      */
     sqliteExists(params: SessionFsSqliteExistsRequest): Promise<SessionFsSqliteExistsResult>;
 }
+/** Handler for `canvas` client session API methods. */
+/** @experimental */
+export interface CanvasHandler {
+    /**
+     * Opens a canvas instance on the provider.
+     *
+     * @param params Canvas open parameters sent to the provider.
+     *
+     * @returns Canvas open result returned by the provider.
+     */
+    open(params: CanvasProviderOpenRequest): Promise<CanvasProviderOpenResult>;
+    /**
+     * Closes a canvas instance on the provider.
+     *
+     * @param params Canvas close parameters sent to the provider.
+     */
+    close(params: CanvasProviderCloseRequest): Promise<void>;
+    /**
+     * Invokes an action on an open canvas instance via the provider.
+     *
+     * @param params Canvas action invocation parameters sent to the provider.
+     *
+     * @returns Provider-supplied action result.
+     */
+    invokeAction(params: CanvasProviderInvokeActionRequest): Promise<CanvasInvokeActionResult>;
+}
 /** All client session API handler groups. */
 export interface ClientSessionApiHandlers {
     sessionFs?: SessionFsHandler;
+    canvas?: CanvasHandler;
 }
 /**
  * Register client session API handlers on a JSON-RPC connection.