@github/copilot-sdk 1.0.12-preview.0 → 1.0.12-unstable.0

package/dist/cjs/client.js

@@ -1412,12 +1412,6 @@ class CopilotClient {
       session["_workspacePath"] = workspacePath;
       session.setCapabilities(capabilities);
       session.setOpenCanvases(openCanvases ?? []);
-      if (config.mcpServers) {
-        await this.connection.sendRequest("session.mcp.reloadWithConfig", {
-          sessionId,
-          config: { mcpServers: toWireMcpServers(config.mcpServers) }
-        });
-      }
       if (config.onMcpAuthRequest) {
         await this.connection.sendRequest("session.eventLog.registerInterest", {
           sessionId,

package/dist/cjs/generated/rpc.js

@@ -89,9 +89,9 @@ function createServerRpc(connection) {
        */
       getAllUsers: async () => connection.sendRequest("account.getAllUsers", {}),
       /**
-       * Stores authentication credentials after successful login (e.g., device code flow).
+       * Validates and stores authentication credentials. When login is omitted, resolves the authenticated user from the token before persistence.
        *
-       * @param params Credentials to store after successful authentication
+       * @param params Credentials to validate and store. Omit login to resolve the authenticated user from the token.
        *
        * @returns Result of a successful login; throws on failure
        */
@@ -1991,7 +1991,7 @@ function createSessionRpc(connection, sessionId) {
          */
         list: async () => connection.sendRequest("session.permissions.paths.list", { sessionId }),
         /**
-         * Adds a directory to the session's allow-list.
+         * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
          *
          * @param params Directory path to add to the session's allowed directories.
          *

package/dist/client.js

@@ -1389,12 +1389,6 @@ class CopilotClient {
       session["_workspacePath"] = workspacePath;
       session.setCapabilities(capabilities);
       session.setOpenCanvases(openCanvases ?? []);
-      if (config.mcpServers) {
-        await this.connection.sendRequest("session.mcp.reloadWithConfig", {
-          sessionId,
-          config: { mcpServers: toWireMcpServers(config.mcpServers) }
-        });
-      }
       if (config.onMcpAuthRequest) {
         await this.connection.sendRequest("session.eventLog.registerInterest", {
           sessionId,

package/dist/generated/rpc.d.ts

@@ -796,8 +796,6 @@ export type DebugCollectLogsResultKind =
 "archive"
 /** A directory containing redacted files was written. */
  | "directory";
-/** @experimental */
-export type DisableBypassPermissionsMode = "disable";
 /**
  * Persisted extension discovery source
  *
@@ -2367,6 +2365,8 @@ export type PermissionModeSource =
  | "slash_command"
 /** The mode was set by confirming autopilot behavior. */
  | "autopilot_confirmation"
+/** The mode was set at startup by the `defaultPermissionMode` user setting. */
+ | "user_setting"
 /** The mode was set through an RPC caller. */
  | "rpc";
 /**
@@ -2407,6 +2407,8 @@ export type PermissionsSetApproveAllSource =
  | "slash_command"
 /** Allow-all was enabled by confirming autopilot behavior. */
  | "autopilot_confirmation"
+/** Allow-all was enabled at startup by the `defaultPermissionMode` user setting. */
+ | "user_setting"
 /** Allow-all was enabled through an RPC caller. */
  | "rpc";
 /**
@@ -4081,7 +4083,7 @@ export interface AccountQuotaSnapshot {
     resetDate?: string;
 }
 /**
- * Credentials to store after successful authentication
+ * Credentials to validate and store. Omit login to resolve the authenticated user from the token.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "AccountLoginRequest".
@@ -4093,9 +4095,9 @@ export interface AccountLoginRequest {
      */
     host: string;
     /**
-     * User login/username
+     * User login/username. When omitted, the runtime validates the token and resolves the login from GitHub.
      */
-    login: string;
+    login?: string;
     /**
      * GitHub authentication token
      */
@@ -8364,6 +8366,10 @@ export interface InstalledPlugin {
      * Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
      */
     source_sha?: string;
+    /**
+     * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — those synthesized at session start for a directory/local marketplace, whose cache_path points at the real plugin directory on disk rather than a copy under the installed-plugins cache. Its presence is what marks a record as live, and no record carrying it is ever written to the persisted installedPlugins key.
+     */
+    installed_from?: string;
 }
 /**
  * Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
@@ -8468,6 +8474,10 @@ export interface InstalledPluginInfo {
      * Whether the plugin is currently enabled for new sessions
      */
     enabled: boolean;
+    /**
+     * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — a plugin belonging to a directory/local marketplace, which is loaded from its real directory on every pass instead of a copy under the installed-plugins cache. Its presence is what marks a listed plugin as live: such a plugin is always present on disk, so `enabled` is its only meaningful state and it is never "not installed".
+     */
+    installedFrom?: string;
 }
 /**
  * Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.
@@ -11311,6 +11321,15 @@ export interface Model {
     supportedContextTiers?: string[];
     modelPickerCategory?: ModelPickerCategory;
     modelPickerPriceCategory?: ModelPickerPriceCategory;
+    warningText?: ModelWarningText;
+    /**
+     * Informational notices the service published for this model, such as an upcoming change or a recommended alternative. Present only when the service published at least one notice. Hosts should surface these without implying anything is wrong with the model.
+     */
+    infoMessages?: ModelMessage[];
+    /**
+     * Warnings the service published for this model, such as a deprecated client version. Present only when the service published at least one warning. The model remains usable; hosts should surface these as advisory rather than blocking.
+     */
+    warningMessages?: ModelMessage[];
 }
 /**
  * Model capabilities and limits
@@ -11533,6 +11552,36 @@ export interface ModelBillingPromo {
      */
     message?: string;
 }
+/**
+ * Service-published warning text that hosts should display when presenting a model.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelWarningText".
+ */
+/** @experimental */
+export interface ModelWarningText {
+    /**
+     * Data-retention warning for the model. The text may contain Markdown links and should be rendered as Markdown when supported.
+     */
+    dataRetention?: string;
+}
+/**
+ * A service-published message about a model, carrying a stable machine-readable code alongside human-readable text.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelMessage".
+ */
+/** @experimental */
+export interface ModelMessage {
+    /**
+     * Stable machine-readable identifier for the message, such as `client_version_deprecated`. Hosts can key custom presentation off this; unrecognized codes should fall back to displaying `message`.
+     */
+    code: string;
+    /**
+     * Human-readable message text intended for display to the user.
+     */
+    message: string;
+}
 /**
  * Managed, repository, and CLI model overrides to overlay onto the session at startup.
  *
@@ -13041,7 +13090,7 @@ export interface PermissionLocationResolveResult {
 /** @experimental */
 export interface PermissionPathsAddParams {
     /**
-     * Directory to add to the allow-list. The runtime resolves and validates the path before adding.
+     * Directory to add to the allow-list. The runtime resolves and validates the path before adding, then loads conventional `.github/skills/` and `.github/agents/` definitions under it when their subsystem gates are enabled. Adding the directory is therefore also a trust decision for configuration stored there.
      */
     path: string;
 }
@@ -13084,7 +13133,7 @@ export interface PermissionPathsConfig {
      */
     unrestricted?: boolean;
     /**
-     * Additional directories to allow tool access to (in addition to the session's working directory). When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).
+     * Additional directories to allow tool access to (in addition to the session's working directory). Conventional `.github/skills/` and `.github/agents/` definitions under them also join the session catalogs when their subsystem gates are enabled, so supplying a directory is a trust decision for configuration stored there. When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).
      */
     additionalDirectories?: string[];
     /**
@@ -15009,6 +15058,10 @@ export interface QueuePendingItemsResult {
      * Display text for messages currently in the immediate steering queue (interjections sent during a running turn).
      */
     steeringMessages: string[];
+    /**
+     * How many leading entries of `steeringMessages` have already been folded into the running turn (and so have an emitted `user.message`), as opposed to still waiting for one. Absent for hosts that do not distinguish the two.
+     */
+    inFlightSteeringCount?: number;
 }
 /**
  * Parameters for removing a queued item by stable id.
@@ -15541,7 +15594,7 @@ export interface SandboxConfig {
     addCurrentWorkingDirectory?: boolean;
     auth?: SandboxConfigAuth;
     /**
-     * Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and, on Unix, up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).
+     * Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).
      */
     allowDevToolAccess?: boolean;
 }
@@ -16845,6 +16898,10 @@ export interface SessionInstalledPlugin {
      * Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
      */
     source_sha?: string;
+    /**
+     * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — those synthesized at session start for a directory/local marketplace, whose cache_path points at the real plugin directory on disk rather than a copy under the installed-plugins cache. Its presence is what marks a record as live, and no record carrying it is ever written to the persisted installedPlugins key.
+     */
+    installed_from?: string;
 }
 /**
  * Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
@@ -17048,7 +17105,10 @@ export interface SessionLoadDeferredRepoHooksResult {
  */
 /** @experimental */
 export interface SessionManagedPermissions {
-    disableBypassPermissionsMode?: DisableBypassPermissionsMode;
+    /**
+     * When set to `disable`, prevents bypass/allow-all permission modes. `allow-auto-only` blocks full allow-all but permits advisory auto-approval. Any other value is accepted rather than failing the session, but is enforced as `disable`: the key is only present to restrict something, so a mode this runtime cannot interpret fails closed to the most restrictive one it knows. Omit the key entirely to impose no restriction.
+     */
+    disableBypassPermissionsMode?: string;
     /**
      * Permission rules that block matching operations. Deny has highest precedence.
      */
@@ -17253,7 +17313,7 @@ export interface SessionOpenOptions {
      */
     workingDirectory?: string;
     /**
-     * Additional directories the agent may access beyond the working directory. Each entry is granted to the session's file-access allow-list and surfaced to the model (system prompt context and `@`-mention completion). Absolute paths are recommended; a relative path is resolved against the session's working directory. Nonexistent or unresolvable entries are skipped with a warning. This is applied on both session creation and resume, and is not persisted: a resumed session that omits this option does not retain previously supplied directories (re-supply them, exactly as the CLI re-passes `--add-dir`).
+     * Additional directories the agent may access beyond the working directory. Each entry is granted to the session's file-access allow-list and surfaced to the model (system prompt context and `@`-mention completion). Conventional `.github/skills/` and `.github/agents/` definitions under each directory also join the session's project catalogs when their existing subsystem gates are enabled: added-root skills require both `enableConfigDiscovery` and effective `enableSkills`; added-root agents require `enableConfigDiscovery`. Supplying a directory therefore activates configuration from it and should be treated as a trust decision. Absolute paths are recommended; a relative path is resolved against the session's working directory. Nonexistent or unresolvable entries are skipped with a warning. This is applied during session creation and cold resume and is not persisted, so a cold resume must re-supply the directories.
      */
     additionalDirectories?: string[];
     workingDirectoryContext?: SessionContext;
@@ -21818,9 +21878,9 @@ export declare function createServerRpc(connection: MessageConnection): {
          */
         getAllUsers: () => Promise<AccountGetAllUsersResult>;
         /**
-         * Stores authentication credentials after successful login (e.g., device code flow).
+         * Validates and stores authentication credentials. When login is omitted, resolves the authenticated user from the token before persistence.
          *
-         * @param params Credentials to store after successful authentication
+         * @param params Credentials to validate and store. Omit login to resolve the authenticated user from the token.
          *
          * @returns Result of a successful login; throws on failure
          */
@@ -23642,7 +23702,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
              */
             list: () => Promise<PermissionPathsList>;
             /**
-             * Adds a directory to the session's allow-list.
+             * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
              *
              * @param params Directory path to add to the session's allowed directories.
              *

package/dist/generated/rpc.js

@@ -61,9 +61,9 @@ function createServerRpc(connection) {
        */
       getAllUsers: async () => connection.sendRequest("account.getAllUsers", {}),
       /**
-       * Stores authentication credentials after successful login (e.g., device code flow).
+       * Validates and stores authentication credentials. When login is omitted, resolves the authenticated user from the token before persistence.
        *
-       * @param params Credentials to store after successful authentication
+       * @param params Credentials to validate and store. Omit login to resolve the authenticated user from the token.
        *
        * @returns Result of a successful login; throws on failure
        */
@@ -1963,7 +1963,7 @@ function createSessionRpc(connection, sessionId) {
          */
         list: async () => connection.sendRequest("session.permissions.paths.list", { sessionId }),
         /**
-         * Adds a directory to the session's allow-list.
+         * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
          *
          * @param params Directory path to add to the session's allowed directories.
          *

package/dist/generated/session-events.d.ts

@@ -9,7 +9,7 @@ export type JsonValue = null | boolean | number | string | JsonValue[] | {
 /**
  * Union of all session event variants emitted by the Copilot CLI runtime.
  */
-export type SessionEvent = StartEvent | ResumeEvent | RemoteSteerableChangedEvent | ErrorEvent | IdleEvent | TitleChangedEvent | ScheduleCreatedEvent | ScheduleCancelledEvent | ScheduleRearmedEvent | AutopilotObjectiveChangedEvent | InfoEvent | WarningEvent | ModelChangeEvent | ModeChangedEvent | SessionLimitsChangedEvent | PermissionsChangedEvent | PlanChangedEvent | TodosChangedEvent | WorkspaceFileChangedEvent | HandoffEvent | TruncationEvent | SnapshotRewindEvent | ShutdownEvent | UsageCheckpointEvent | ContextChangedEvent | UsageInfoEvent | ContextClearedEvent | CompactionStartEvent | CompactionCompleteEvent | TaskCompleteEvent | UserMessageEvent | PendingMessagesModifiedEvent | AssistantTurnStartEvent | AssistantIntentEvent | AssistantServerToolProgressEvent | AssistantReasoningEvent | AssistantReasoningDeltaEvent | AssistantToolCallDeltaEvent | AssistantStreamingDeltaEvent | AssistantMessageEvent | AssistantMessageStartEvent | AssistantMessageDeltaEvent | AssistantTurnEndEvent | AssistantIdleEvent | AssistantUsageEvent | ModelCallFailureEvent | AbortEvent | ToolUserRequestedEvent | ToolExecutionStartEvent | ToolExecutionPartialResultEvent | ToolExecutionProgressEvent | ToolExecutionCompleteEvent | ToolSearchActivatedEvent | SkillInvokedEvent | SubagentStartedEvent | SubagentCompletedEvent | SubagentFailedEvent | SubagentSelectedEvent | SubagentDeselectedEvent | HookStartEvent | HookEndEvent | HookProgressEvent | BinaryAssetEvent | SystemMessageEvent | SystemNotificationEvent | PermissionRequestedEvent | PermissionCompletedEvent | UserInputRequestedEvent | UserInputCompletedEvent | ElicitationRequestedEvent | ElicitationCompletedEvent | SamplingRequestedEvent | SamplingCompletedEvent | McpOauthRequiredEvent | McpOauthCompletedEvent | McpHeadersRefreshRequiredEvent | McpHeadersRefreshCompletedEvent | CustomNotificationEvent | UIEphemeralQueryEvent | ExternalToolRequestedEvent | ExternalToolCompletedEvent | CommandQueuedEvent | CommandExecuteEvent | CommandCompletedEvent | AutoModeSwitchRequestedEvent | AutoModeSwitchCompletedEvent | SessionLimitsExhaustedRequestedEvent | SessionLimitsExhaustedCompletedEvent | AutoModeResolvedEvent | ManagedSettingsResolvedEvent | ManagedSettingsEnforcedEvent | CommandsChangedEvent | CapabilitiesChangedEvent | ExitPlanModeRequestedEvent | ExitPlanModeCompletedEvent | ToolsUpdatedEvent | BackgroundTasksChangedEvent | FactoryRunUpdatedEvent | FactoryRunStartedEvent | FactoryRunSettledEvent | SkillsLoadedEvent | CustomAgentsUpdatedEvent | McpServersLoadedEvent | McpServerStatusChangedEvent | McpToolsListChangedEvent | McpResourcesListChangedEvent | McpPromptsListChangedEvent | ExtensionsLoadedEvent | CanvasOpenedEvent | CanvasRegistryChangedEvent | CanvasClosedEvent | CanvasUnavailableEvent | CanvasRecordedEvent | CanvasRemovedEvent | ExtensionsAttachmentsPushedEvent | McpAppToolCallCompleteEvent;
+export type SessionEvent = StartEvent | ResumeEvent | RemoteSteerableChangedEvent | ErrorEvent | IdleEvent | TitleChangedEvent | ScheduleCreatedEvent | ScheduleCancelledEvent | ScheduleRearmedEvent | AutopilotObjectiveChangedEvent | InfoEvent | WarningEvent | ModelChangeEvent | ModeChangedEvent | SessionLimitsChangedEvent | PermissionsChangedEvent | PlanChangedEvent | TodosChangedEvent | WorkspaceFileChangedEvent | HandoffEvent | TruncationEvent | SnapshotRewindEvent | ShutdownEvent | UsageCheckpointEvent | ContextChangedEvent | UsageInfoEvent | ContextClearedEvent | CompactionStartEvent | CompactionCompleteEvent | TaskCompleteEvent | UserMessageEvent | PendingMessagesModifiedEvent | AssistantTurnStartEvent | AssistantIntentEvent | AssistantServerToolProgressEvent | AssistantReasoningEvent | AssistantReasoningDeltaEvent | AssistantToolCallDeltaEvent | AssistantStreamingDeltaEvent | AssistantMessageEvent | AssistantMessageStartEvent | AssistantMessageDeltaEvent | AssistantTurnEndEvent | AssistantIdleEvent | AssistantUsageEvent | ModelCallFailureEvent | ModelCallFinishedEvent | AbortEvent | ToolUserRequestedEvent | ToolExecutionStartEvent | ToolExecutionPartialResultEvent | ToolExecutionProgressEvent | ToolExecutionCompleteEvent | ToolSearchActivatedEvent | SkillInvokedEvent | SubagentStartedEvent | SubagentCompletedEvent | SubagentFailedEvent | SubagentSelectedEvent | SubagentDeselectedEvent | HookStartEvent | HookEndEvent | HookProgressEvent | BinaryAssetEvent | SystemMessageEvent | SystemNotificationEvent | PermissionRequestedEvent | PermissionCompletedEvent | UserInputRequestedEvent | UserInputCompletedEvent | ElicitationRequestedEvent | ElicitationCompletedEvent | SamplingRequestedEvent | SamplingCompletedEvent | McpOauthRequiredEvent | McpOauthCompletedEvent | McpHeadersRefreshRequiredEvent | McpHeadersRefreshCompletedEvent | CustomNotificationEvent | UIEphemeralQueryEvent | ExternalToolRequestedEvent | ExternalToolCompletedEvent | CommandQueuedEvent | CommandExecuteEvent | CommandCompletedEvent | AutoModeSwitchRequestedEvent | AutoModeSwitchCompletedEvent | SessionLimitsExhaustedRequestedEvent | SessionLimitsExhaustedCompletedEvent | AutoModeResolvedEvent | ManagedSettingsResolvedEvent | ManagedSettingsEnforcedEvent | CommandsChangedEvent | CapabilitiesChangedEvent | ExitPlanModeRequestedEvent | ExitPlanModeCompletedEvent | ToolsUpdatedEvent | BackgroundTasksChangedEvent | FactoryRunUpdatedEvent | FactoryRunStartedEvent | FactoryRunSettledEvent | SkillsLoadedEvent | CustomAgentsUpdatedEvent | McpServersLoadedEvent | McpServerStatusChangedEvent | McpToolsListChangedEvent | McpResourcesListChangedEvent | McpPromptsListChangedEvent | ExtensionsLoadedEvent | CanvasOpenedEvent | CanvasRegistryChangedEvent | CanvasClosedEvent | CanvasUnavailableEvent | CanvasRecordedEvent | CanvasRemovedEvent | ExtensionsAttachmentsPushedEvent | McpAppToolCallCompleteEvent;
 /**
  * Hosting platform type of the repository (github or ado)
  */
@@ -303,6 +303,18 @@ export type ModelCallFailureTransport =
 "http"
 /** WebSocket transport. */
  | "websocket";
+/**
+ * Final outcome of one logical model dispatch after response acceptance processing
+ */
+export type ModelCallFinishedOutcome = 
+/** The provider response was accepted for continued agent processing. */
+"success"
+/** The dispatch ended with a provider or transport error. */
+ | "error"
+/** The dispatch was cancelled before an accepted response was produced. */
+ | "cancelled"
+/** The provider response was rejected during post-response acceptance processing. */
+ | "rejected";
 /**
  * Finite reason code describing why the current turn was aborted
  */
@@ -665,7 +677,9 @@ export type ManagedSettingsEnforcedEscalation =
 /** Unrestricted filesystem access outside the session's allowed directories. */
  | "unrestricted_paths"
 /** Unrestricted URL fetch access. */
- | "unrestricted_urls";
+ | "unrestricted_urls"
+/** A server-wide MCP "Always Allow" (or `--allow-tool <server>`) blanket that would auto-approve every tool from an MCP server. Capped to per-tool approval; each tool still prompts. */
+ | "server_wide_mcp_approval";
 /**
  * Exit plan mode action
  */
@@ -4105,6 +4119,10 @@ export interface AssistantUsageData {
      * Number of output tokens produced
      */
     outputTokens?: number;
+    /**
+     * Time to first observable model output in milliseconds. Includes text, reasoning, and tool-call output; only available for streaming requests that produce observable output.
+     */
+    outputTtftMs?: number;
     /**
      * @deprecated
      * Parent tool call ID when this usage originates from a sub-agent
@@ -4313,6 +4331,62 @@ export interface ModelCallFailureRequestFingerprint {
      */
     toolResultMessageCount: number;
 }
+/**
+ * Session event "model.call_finished". Final lifecycle outcome for one logical model dispatch. A logical dispatch may include internal reconnect or fallback work, so event count is not provider HTTP-request count.
+ */
+export interface ModelCallFinishedEvent {
+    /**
+     * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
+     */
+    agentId?: string;
+    data: ModelCallFinishedData;
+    /**
+     * Always true for events that are transient and not persisted to the session event log on disk.
+     */
+    ephemeral: true;
+    /**
+     * Unique event identifier (UUID v4), generated when the event is emitted
+     */
+    id: string;
+    /**
+     * ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event.
+     */
+    parentId: string | null;
+    /**
+     * ISO 8601 timestamp when the event was created
+     */
+    timestamp: string;
+    /**
+     * Type discriminator. Always "model.call_finished".
+     */
+    type: "model.call_finished";
+}
+/**
+ * Final lifecycle outcome for one logical model dispatch. A logical dispatch may include internal reconnect or fallback work, so event count is not provider HTTP-request count.
+ */
+export interface ModelCallFinishedData {
+    /**
+     * Whether an accepted successful response requested the exact name and command semantics of a built-in file edit tool, including an external tool explicitly replacing that built-in name. Absent when the logical dispatch did not produce an accepted response.
+     */
+    containsBuiltInFileEditRequest?: boolean;
+    /**
+     * Monotonic elapsed time spent in the logical model dispatch, including any internal transport reconnect or fallback and excluding orchestrator retry backoff, tool execution, confirmations, and post-response processing
+     */
+    dispatchDurationMs: number;
+    /**
+     * Version of the built-in file-edit semantic classifier used for this event
+     */
+    editClassifierVersion: number;
+    /**
+     * Identifier of the user interaction that owns the model dispatch, matching assistant.turn_start.interactionId when available
+     */
+    interactionId?: string;
+    outcome: ModelCallFinishedOutcome;
+    /**
+     * Agent-loop iteration within the interaction that initiated the model dispatch
+     */
+    turnId: string;
+}
 /**
  * Session event "abort". Turn abort information including the reason for termination
  */
@@ -6784,6 +6858,10 @@ export interface PermissionPromptRequestMcp {
      * @experimental
      */
     assistedApproval?: PermissionAssistedApproval;
+    /**
+     * Whether the host may offer a server-wide "approve all tools from this server" blanket. Absent is treated as true; the runtime sends false when managed policy disables bypass-permissions mode, which forbids the server-wide escalation while still allowing per-tool approval.
+     */
+    canOfferServerWideApproval?: boolean;
     /**
      * Prompt kind discriminator
      */

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/github/copilot-sdk.git"
   },
-  "version": "1.0.12-preview.0",
+  "version": "1.0.12-unstable.0",
   "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
   "main": "./dist/cjs/index.js",
   "types": "./dist/index.d.ts",
@@ -56,7 +56,7 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@github/copilot": "^1.0.81-5",
+    "@github/copilot": "^1.0.81-9",
     "koffi": "^3.1.0",
     "vscode-jsonrpc": "^8.2.1",
     "zod": "^4.3.6"