@github/copilot-sdk 1.0.0-beta.8 → 1.0.0-beta.9

package/dist/generated/rpc.d.ts

@@ -24,6 +24,136 @@ export type AgentInfoSource =
  | "plugin"
 /** Agent built into the Copilot runtime. */
  | "builtin";
+/**
+ * Process kind tag for the registry entry
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntryKind".
+ */
+/** @experimental */
+export type AgentRegistryLiveTargetEntryKind = 
+/** Interactive Copilot CLI exposing a UI server (legacy/normal CLI process) */
+"ui-server"
+/** Headless `--server --managed-server` child spawned by a controller */
+ | "managed-server";
+/**
+ * Coarse lifecycle status of the foreground session
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntryStatus".
+ */
+/** @experimental */
+export type AgentRegistryLiveTargetEntryStatus = 
+/** Session is actively processing a turn */
+"working"
+/** Session is idle, waiting for input */
+ | "waiting"
+/** Last turn completed successfully */
+ | "done"
+/** Session needs user attention (see attentionKind for the specific reason) */
+ | "attention";
+/**
+ * Kind of attention required when status === "attention". Meaningful only when status === "attention".
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntryAttentionKind".
+ */
+/** @experimental */
+export type AgentRegistryLiveTargetEntryAttentionKind = 
+/** Session is blocked on an unrecoverable error */
+"error"
+/** Session is waiting for a tool-permission decision */
+ | "permission"
+/** Session is waiting for the user to approve or reject a plan */
+ | "exit_plan"
+/** Session is waiting on an elicitation prompt */
+ | "elicitation"
+/** Session is waiting for free-form user input */
+ | "user_input";
+/**
+ * How the most recent turn ended (clean vs aborted). Lets the renderer distinguish done from done_cancelled.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntryLastTerminalEvent".
+ */
+/** @experimental */
+export type AgentRegistryLiveTargetEntryLastTerminalEvent = 
+/** Last turn ended cleanly (model returned a final assistant message) */
+"turn_end"
+/** Last turn was aborted (e.g. user interrupted) */
+ | "abort";
+/**
+ * Categorized reason for log-open failure
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLogCaptureOpenErrorReason".
+ */
+/** @experimental */
+export type AgentRegistryLogCaptureOpenErrorReason = 
+/** Filesystem permission denied opening the log file */
+"permission"
+/** No space left on device */
+ | "disk_full"
+/** Other / uncategorized open failure */
+ | "other";
+/**
+ * Permission posture for the new session. 'yolo' requires the controller-local session to currently be in allow-all mode.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnPermissionMode".
+ */
+/** @experimental */
+export type AgentRegistrySpawnPermissionMode = 
+/** Standard permission posture (prompts for each request) */
+"default"
+/** Full allow-all (requires the controller-local session to currently be in allow-all mode) */
+ | "yolo";
+/**
+ * Outcome of an agentRegistry.spawn call.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnResult".
+ */
+/** @experimental */
+export type AgentRegistrySpawnResult = AgentRegistrySpawnSpawned | AgentRegistrySpawnError | AgentRegistrySpawnRegistryTimeout | AgentRegistrySpawnValidationError;
+/**
+ * Categorized reason for the rejection. Low-cardinality enum so telemetry can aggregate by reason without leaking raw paths or agent/model names.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnValidationErrorReason".
+ */
+/** @experimental */
+export type AgentRegistrySpawnValidationErrorReason = 
+/** Provided cwd does not exist on disk */
+"cwd-not-found"
+/** Provided cwd exists but is not a directory */
+ | "cwd-not-directory"
+/** Session name failed validateSessionName */
+ | "invalid-name"
+/** Requested agent name was not found in builtin or custom agents */
+ | "unknown-agent"
+/** Requested model is not available to this session */
+ | "unknown-model"
+/** Caller asked for permissionMode='yolo' but the controller is not currently in allow-all mode */
+ | "yolo-not-allowed";
+/**
+ * Which parameter field was invalid. Omitted when the rejection is not field-specific.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnValidationErrorField".
+ */
+/** @experimental */
+export type AgentRegistrySpawnValidationErrorField = 
+/** The cwd parameter */
+"cwd"
+/** The session name parameter */
+ | "name"
+/** The agentName parameter */
+ | "agentName"
+/** The model parameter */
+ | "model"
+/** The permissionMode parameter */
+ | "permissionMode";
 /**
  * The new auth credentials to install on the session. When omitted or `undefined`, the call is a no-op and the session's existing credentials are preserved. The runtime stores the value verbatim and uses it for outbound model/API requests; it does NOT re-validate or re-fetch the associated Copilot user response. Several variants carry secret material; treat this method's params as containing secrets at rest and in transit.
  *
@@ -429,23 +559,12 @@ export type McpAppsSetHostContextDetailsPlatform =
  */
 export type McpServerConfig = McpServerConfigStdio | McpServerConfigHttp;
 /**
- * OIDC token configuration. When truthy, a token is automatically gathered.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpServerConfigStdioOidc".
- */
-export type McpServerConfigStdioOidc = boolean | {
-    [k: string]: unknown | undefined;
-};
-/**
- * Authentication configuration for this server.
+ * Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpServerConfigStdioAuth".
+ * via the `definition` "McpServerAuthConfig".
  */
-export type McpServerConfigStdioAuth = boolean | {
-    [k: string]: unknown | undefined;
-};
+export type McpServerAuthConfig = boolean | McpServerAuthConfigRedirectPort;
 /**
  * Remote transport type. Defaults to "http" when omitted.
  *
@@ -457,15 +576,6 @@ export type McpServerConfigHttpType =
 "http"
 /** Server-Sent Events transport. */
  | "sse";
-/**
- * OIDC token configuration. When truthy, a token is automatically gathered.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpServerConfigHttpOidc".
- */
-export type McpServerConfigHttpOidc = boolean | {
-    [k: string]: unknown | undefined;
-};
 /**
  * OAuth grant type to use when authenticating to the remote MCP server.
  *
@@ -639,6 +749,18 @@ export type OptionsUpdateEnvValueMode =
 "direct"
 /** Resolve MCP server environment values from host-side references. */
  | "indirect";
+/**
+ * Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "OptionsUpdateToolFilterPrecedence".
+ */
+/** @experimental */
+export type OptionsUpdateToolFilterPrecedence = 
+/** If availableTools is set, it is the only constraint that applies (excludedTools is ignored). Preserves CLI / pre-existing client behavior. Default. */
+"available"
+/** A tool is enabled if and only if it matches the allowlist (or the allowlist is unset) AND it does not match the denylist. Makes 'all except X' expressible by combining the two lists. */
+ | "excluded";
 /**
  * The client's response to the pending permission prompt
  *
@@ -1297,6 +1419,204 @@ export interface AgentList {
      */
     agents: AgentInfo[];
 }
+/**
+ * Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLiveTargetEntry".
+ */
+/** @experimental */
+export interface AgentRegistryLiveTargetEntry {
+    /**
+     * Registry entry schema version (1 = ui-server, 2 = managed-server)
+     */
+    schemaVersion: number;
+    kind: AgentRegistryLiveTargetEntryKind;
+    /**
+     * Operating-system pid of the process owning this entry
+     */
+    pid: number;
+    /**
+     * Bind host for the entry's JSON-RPC server
+     */
+    host: string;
+    /**
+     * TCP port the entry's JSON-RPC server is listening on
+     */
+    port: number;
+    /**
+     * Session ID of the foreground session for this entry
+     */
+    sessionId?: string;
+    /**
+     * Friendly session name (when set)
+     */
+    sessionName?: string;
+    /**
+     * Working directory of the session (when known)
+     */
+    cwd?: string;
+    /**
+     * Git branch of the session (when known)
+     */
+    branch?: string;
+    /**
+     * Model identifier currently selected for the session
+     */
+    model?: string;
+    status?: AgentRegistryLiveTargetEntryStatus;
+    attentionKind?: AgentRegistryLiveTargetEntryAttentionKind;
+    /**
+     * Monotonic per-publisher revision counter incremented on every status update. Lets watchers detect transient flips.
+     */
+    statusRevision?: number;
+    lastTerminalEvent?: AgentRegistryLiveTargetEntryLastTerminalEvent;
+    /**
+     * ISO 8601 timestamp captured at registration
+     */
+    startedAt: string;
+    /**
+     * Copilot CLI version that wrote the entry
+     */
+    copilotVersion: string;
+    /**
+     * Wall-clock milliseconds since the watcher last observed this entry (heartbeat freshness)
+     */
+    lastSeenMs: number;
+}
+/**
+ * Per-spawn log-capture outcome; populated from spawnLiveTarget.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistryLogCapture".
+ */
+/** @experimental */
+export interface AgentRegistryLogCapture {
+    /**
+     * Whether per-spawn log capture is on (false when env-disabled or open failed)
+     */
+    enabled: boolean;
+    /**
+     * Absolute path to the per-spawn log file (only set when enabled)
+     */
+    path?: string;
+    /**
+     * Human-readable open failure message (only set when enabled === false AND the env-disable opt-out was NOT used)
+     */
+    openError?: string;
+    openErrorReason?: AgentRegistryLogCaptureOpenErrorReason;
+}
+/**
+ * `child_process.spawn` itself failed before the child entered the registry.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnError".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnError {
+    /**
+     * Discriminator: child_process.spawn itself failed
+     */
+    kind: "spawn-error";
+    /**
+     * Human-readable error message
+     */
+    message: string;
+    /**
+     * Underlying errno code (e.g. ENOENT, EACCES) when available
+     */
+    code?: string;
+}
+/**
+ * Spawn succeeded but the child did not publish a matching managed-server entry within the timeout.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnRegistryTimeout".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnRegistryTimeout {
+    /**
+     * Discriminator: spawn succeeded but child never registered
+     */
+    kind: "registry-timeout";
+    /**
+     * Process ID of the orphaned child (so the caller can offer 'kill the pid' guidance)
+     */
+    childPid: number;
+    logCapture?: AgentRegistryLogCapture;
+}
+/**
+ * Inputs to spawn a managed-server child via the controller's spawn delegate.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnRequest".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnRequest {
+    /**
+     * Working directory for the spawned child (must be an existing directory)
+     */
+    cwd: string;
+    /**
+     * Custom or built-in agent name (e.g. 'explore'). When omitted, the child uses its own default.
+     */
+    agentName?: string;
+    /**
+     * Model identifier to apply to the new session
+     */
+    model?: string;
+    /**
+     * Friendly session name. Must satisfy validateSessionName: non-empty, no leading/trailing whitespace, <=100 chars, no control chars, no double quotes.
+     */
+    name?: string;
+    permissionMode?: AgentRegistrySpawnPermissionMode;
+    /**
+     * Optional first user message. Forwarded to the caller (the CLI's spawn wrapper sends it post-attach via the standard LocalRpcSession.send path).
+     */
+    initialPrompt?: string;
+}
+/**
+ * Managed-server child was spawned and registered successfully.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnSpawned".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnSpawned {
+    /**
+     * Discriminator: managed-server child spawned successfully
+     */
+    kind: "spawned";
+    entry: AgentRegistryLiveTargetEntry;
+    /**
+     * Whether the delegate already sent the initial prompt. Always omitted in the current wiring: the controller sends the prompt post-attach via the standard LocalRpcSession.send path.
+     */
+    initialPromptSent?: boolean;
+    /**
+     * If the delegate attempted to send the initial prompt and failed, the categorized error message.
+     */
+    initialPromptError?: string;
+    logCapture?: AgentRegistryLogCapture;
+}
+/**
+ * Synchronous pre-validation rejected the spawn request.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentRegistrySpawnValidationError".
+ */
+/** @experimental */
+export interface AgentRegistrySpawnValidationError {
+    /**
+     * Discriminator: synchronous pre-validation rejected the request
+     */
+    kind: "validation-error";
+    reason: AgentRegistrySpawnValidationErrorReason;
+    field?: AgentRegistrySpawnValidationErrorField;
+    /**
+     * Human-readable explanation; safe to surface in the UI banner. Never logged to unrestricted telemetry.
+     */
+    message: string;
+}
 /**
  * Custom agents available to the session after reloading definitions from disk.
  *
@@ -1333,6 +1653,36 @@ export interface AgentSelectRequest {
 export interface AgentSelectResult {
     agent: AgentInfo;
 }
+/**
+ * Indicates whether the operation succeeded and reports the post-mutation state.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AllowAllPermissionSetResult".
+ */
+/** @experimental */
+export interface AllowAllPermissionSetResult {
+    /**
+     * Whether the operation succeeded
+     */
+    success: boolean;
+    /**
+     * Authoritative allow-all state after the mutation
+     */
+    enabled: boolean;
+}
+/**
+ * Current full allow-all permission state.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AllowAllPermissionState".
+ */
+/** @experimental */
+export interface AllowAllPermissionState {
+    /**
+     * Whether full allow-all permissions are currently active
+     */
+    enabled: boolean;
+}
 /**
  * Schema for the `ApiKeyAuthInfo` type.
  *
@@ -1903,6 +2253,20 @@ export interface CanvasProviderCloseRequest {
      */
     instanceId: string;
     host?: CanvasHostContext;
+    session?: CanvasSessionContext;
+}
+/**
+ * Session context supplied by the runtime.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CanvasSessionContext".
+ */
+/** @experimental */
+export interface CanvasSessionContext {
+    /**
+     * Active session working directory, when known.
+     */
+    workingDirectory?: string;
 }
 /**
  * Canvas action invocation parameters sent to the provider.
@@ -1939,6 +2303,7 @@ export interface CanvasProviderInvokeActionRequest {
         [k: string]: unknown | undefined;
     };
     host?: CanvasHostContext;
+    session?: CanvasSessionContext;
 }
 /**
  * Canvas open parameters sent to the provider.
@@ -1971,6 +2336,7 @@ export interface CanvasProviderOpenRequest {
         [k: string]: unknown | undefined;
     };
     host?: CanvasHostContext;
+    session?: CanvasSessionContext;
 }
 /**
  * Canvas open result returned by the provider.
@@ -3474,8 +3840,8 @@ export interface McpServerConfigStdio {
      * Timeout in milliseconds for tool calls to this server.
      */
     timeout?: number;
-    oidc?: McpServerConfigStdioOidc;
-    auth?: McpServerConfigStdioAuth;
+    oidc?: McpServerAuthConfig;
+    auth?: McpServerAuthConfig;
     /**
      * Executable command used to start the Stdio MCP server process.
      */
@@ -3495,6 +3861,19 @@ export interface McpServerConfigStdio {
         [k: string]: string | undefined;
     };
 }
+/**
+ * Authentication settings with optional redirect port configuration.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpServerAuthConfigRedirectPort".
+ */
+export interface McpServerAuthConfigRedirectPort {
+    /**
+     * Fixed port for the OAuth redirect callback server.
+     */
+    redirectPort?: number;
+    [k: string]: unknown | undefined;
+}
 /**
  * Remote MCP server configuration accessed over HTTP or SSE.
  *
@@ -3516,8 +3895,8 @@ export interface McpServerConfigHttp {
      * Timeout in milliseconds for tool calls to this server.
      */
     timeout?: number;
-    oidc?: McpServerConfigHttpOidc;
-    auth?: McpServerConfigHttpAuth;
+    oidc?: McpServerAuthConfig;
+    auth?: McpServerAuthConfig;
     /**
      * URL of the remote MCP server endpoint.
      */
@@ -3538,19 +3917,6 @@ export interface McpServerConfigHttp {
     oauthPublicClient?: boolean;
     oauthGrantType?: McpServerConfigHttpOauthGrantType;
 }
-/**
- * Additional authentication configuration for this server.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "McpServerConfigHttpAuth".
- */
-export interface McpServerConfigHttpAuth {
-    /**
-     * Fixed port for the OAuth redirect callback server.
-     */
-    redirectPort?: number;
-    [k: string]: unknown | undefined;
-}
 /**
  * MCP server names to disable for new sessions.
  *
@@ -5491,6 +5857,14 @@ export interface PermissionsFolderTrustAddTrustedResult {
      */
     success: boolean;
 }
+/**
+ * No parameters.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionsGetAllowAllRequest".
+ */
+export interface PermissionsGetAllowAllRequest {
+}
 /**
  * Indicates whether the operation succeeded.
  *
@@ -5615,6 +5989,19 @@ export interface PermissionsResetSessionApprovalsResult {
      */
     success: boolean;
 }
+/**
+ * Whether to enable full allow-all permissions for the session.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionsSetAllowAllRequest".
+ */
+/** @experimental */
+export interface PermissionsSetAllowAllRequest {
+    /**
+     * Whether to enable full allow-all permissions
+     */
+    enabled: boolean;
+}
 /**
  * Allow-all toggle for tool permission requests, with an optional telemetry source.
  *
@@ -6446,10 +6833,18 @@ export interface SessionMetadata {
      * Optional human-friendly name set via /rename
      */
     name?: string;
+    /**
+     * Runtime client name that created/last resumed this session
+     */
+    clientName?: string;
     /**
      * True for remote (GitHub) sessions; false for local
      */
     isRemote: boolean;
+    /**
+     * True for detached maintenance sessions that should be hidden from normal resume lists.
+     */
+    isDetached?: boolean;
     context?: SessionContext;
     /**
      * GitHub task ID, when this local session is bound to one. Only present for local sessions exported to remote control.
@@ -7053,6 +7448,10 @@ export interface SessionMetadataSnapshot {
      * User-provided name supplied at session construction (via `--name`), if any. Immutable after construction.
      */
     initialName?: string;
+    /**
+     * Runtime client name associated with the session (telemetry identifier).
+     */
+    clientName?: string;
     remoteMetadata?: MetadataSnapshotRemoteMetadata;
     /**
      * Short human-readable summary of the session, if known. Omitted when no summary has been generated.
@@ -7379,7 +7778,7 @@ export interface SessionSizes {
     };
 }
 /**
- * Optional metadata-load limit and context filter applied to the returned sessions.
+ * Optional metadata-load limit and filters applied to the returned sessions.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionsListRequest".
@@ -7391,6 +7790,10 @@ export interface SessionsListRequest {
      */
     metadataLimit?: number;
     filter?: SessionListFilter;
+    /**
+     * When true, include detached maintenance sessions. Defaults to false for user-facing session lists.
+     */
+    includeDetached?: boolean;
 }
 /**
  * Active session ID whose deferred repo-level hooks should be loaded.
@@ -7580,6 +7983,7 @@ export interface SessionUpdateOptionsParams {
      * Denylist of tool names for this session.
      */
     excludedTools?: string[];
+    toolFilterPrecedence?: OptionsUpdateToolFilterPrecedence;
     /**
      * Whether shell-script safety heuristics are enabled.
      */
@@ -9366,6 +9770,7 @@ export interface WorkspacesGetWorkspaceResult {
         host_type?: WorkspacesWorkspaceDetailsHostType;
         branch?: string;
         name?: string;
+        client_name?: string;
         user_named?: boolean;
         summary_count?: number;
         created_at?: string;
@@ -9668,7 +10073,7 @@ export declare function createServerRpc(connection: MessageConnection): {
         /**
          * Lists persisted sessions, optionally filtered by working-directory context.
          *
-         * @param params Optional metadata-load limit and context filter applied to the returned sessions.
+         * @param params Optional metadata-load limit and filters applied to the returned sessions.
          *
          * @returns Persisted sessions matching the filter, ordered most-recently-modified first.
          */
@@ -9800,6 +10205,17 @@ export declare function createServerRpc(connection: MessageConnection): {
          */
         setAdditionalPlugins: (params: SessionsSetAdditionalPluginsRequest) => Promise<SessionsSetAdditionalPluginsResult>;
     };
+    /** @experimental */
+    agentRegistry: {
+        /**
+         * Spawns a managed-server child with the supplied configuration and returns a discriminated-union result. The caller (typically the CLI controller) is responsible for attaching to the spawned child and sending any follow-up prompt. When the controller-local spawn gate is closed the server returns JSON-RPC MethodNotFound.
+         *
+         * @param params Inputs to spawn a managed-server child via the controller's spawn delegate.
+         *
+         * @returns Outcome of an agentRegistry.spawn call.
+         */
+        spawn: (params: AgentRegistrySpawnRequest) => Promise<AgentRegistrySpawnResult>;
+    };
 };
 /** Create typed session-scoped RPC methods. */
 export declare function createSessionRpc(connection: MessageConnection, sessionId: string): {
@@ -10544,6 +10960,20 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Indicates whether the operation succeeded.
          */
         setApproveAll: (params: PermissionsSetApproveAllRequest) => Promise<PermissionsSetApproveAllResult>;
+        /**
+         * Enables or disables full allow-all permissions (tools, paths, and URLs) for the session. Used by attach-mode clients (e.g. LocalRpcSession's `/allow-all` forwarder) to flip the target session's permission state. Unlike `setApproveAll`, this swaps in the unrestricted path and URL managers and emits `session.permissions_changed` on transition. The result returns the authoritative post-mutation state so callers can update their local mirrors without racing the `session.permissions_changed` notification on the same wire.
+         *
+         * @param params Whether to enable full allow-all permissions for the session.
+         *
+         * @returns Indicates whether the operation succeeded and reports the post-mutation state.
+         */
+        setAllowAll: (params: PermissionsSetAllowAllRequest) => Promise<AllowAllPermissionSetResult>;
+        /**
+         * Returns whether full allow-all permissions are currently active for the session.
+         *
+         * @returns Current full allow-all permission state.
+         */
+        getAllowAll: () => Promise<AllowAllPermissionState>;
         /**
          * Adds or removes session-scoped or location-scoped permission rules.
          *