@github/copilot-sdk 1.0.12-unstable.0 → 1.0.13-preview.0

package/dist/cjs/generated/rpc.js

@@ -1991,7 +1991,7 @@ function createSessionRpc(connection, sessionId) {
          */
         list: async () => connection.sendRequest("session.permissions.paths.list", { sessionId }),
         /**
-         * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
+         * Adds a directory to the session's allow-list.
          *
          * @param params Directory path to add to the session's allowed directories.
          *

package/dist/generated/rpc.d.ts

@@ -796,6 +796,8 @@ export type DebugCollectLogsResultKind =
 "archive"
 /** A directory containing redacted files was written. */
  | "directory";
+/** @experimental */
+export type DisableBypassPermissionsMode = "disable";
 /**
  * Persisted extension discovery source
  *
@@ -8366,10 +8368,6 @@ export interface InstalledPlugin {
      * Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
      */
     source_sha?: string;
-    /**
-     * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — those synthesized at session start for a directory/local marketplace, whose cache_path points at the real plugin directory on disk rather than a copy under the installed-plugins cache. Its presence is what marks a record as live, and no record carrying it is ever written to the persisted installedPlugins key.
-     */
-    installed_from?: string;
 }
 /**
  * Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
@@ -8474,10 +8472,6 @@ export interface InstalledPluginInfo {
      * Whether the plugin is currently enabled for new sessions
      */
     enabled: boolean;
-    /**
-     * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — a plugin belonging to a directory/local marketplace, which is loaded from its real directory on every pass instead of a copy under the installed-plugins cache. Its presence is what marks a listed plugin as live: such a plugin is always present on disk, so `enabled` is its only meaningful state and it is never "not installed".
-     */
-    installedFrom?: string;
 }
 /**
  * Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.
@@ -11321,15 +11315,6 @@ export interface Model {
     supportedContextTiers?: string[];
     modelPickerCategory?: ModelPickerCategory;
     modelPickerPriceCategory?: ModelPickerPriceCategory;
-    warningText?: ModelWarningText;
-    /**
-     * Informational notices the service published for this model, such as an upcoming change or a recommended alternative. Present only when the service published at least one notice. Hosts should surface these without implying anything is wrong with the model.
-     */
-    infoMessages?: ModelMessage[];
-    /**
-     * Warnings the service published for this model, such as a deprecated client version. Present only when the service published at least one warning. The model remains usable; hosts should surface these as advisory rather than blocking.
-     */
-    warningMessages?: ModelMessage[];
 }
 /**
  * Model capabilities and limits
@@ -11552,36 +11537,6 @@ export interface ModelBillingPromo {
      */
     message?: string;
 }
-/**
- * Service-published warning text that hosts should display when presenting a model.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "ModelWarningText".
- */
-/** @experimental */
-export interface ModelWarningText {
-    /**
-     * Data-retention warning for the model. The text may contain Markdown links and should be rendered as Markdown when supported.
-     */
-    dataRetention?: string;
-}
-/**
- * A service-published message about a model, carrying a stable machine-readable code alongside human-readable text.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "ModelMessage".
- */
-/** @experimental */
-export interface ModelMessage {
-    /**
-     * Stable machine-readable identifier for the message, such as `client_version_deprecated`. Hosts can key custom presentation off this; unrecognized codes should fall back to displaying `message`.
-     */
-    code: string;
-    /**
-     * Human-readable message text intended for display to the user.
-     */
-    message: string;
-}
 /**
  * Managed, repository, and CLI model overrides to overlay onto the session at startup.
  *
@@ -13090,7 +13045,7 @@ export interface PermissionLocationResolveResult {
 /** @experimental */
 export interface PermissionPathsAddParams {
     /**
-     * Directory to add to the allow-list. The runtime resolves and validates the path before adding, then loads conventional `.github/skills/` and `.github/agents/` definitions under it when their subsystem gates are enabled. Adding the directory is therefore also a trust decision for configuration stored there.
+     * Directory to add to the allow-list. The runtime resolves and validates the path before adding.
      */
     path: string;
 }
@@ -13133,7 +13088,7 @@ export interface PermissionPathsConfig {
      */
     unrestricted?: boolean;
     /**
-     * Additional directories to allow tool access to (in addition to the session's working directory). Conventional `.github/skills/` and `.github/agents/` definitions under them also join the session catalogs when their subsystem gates are enabled, so supplying a directory is a trust decision for configuration stored there. When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).
+     * Additional directories to allow tool access to (in addition to the session's working directory). When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).
      */
     additionalDirectories?: string[];
     /**
@@ -15058,10 +15013,6 @@ export interface QueuePendingItemsResult {
      * Display text for messages currently in the immediate steering queue (interjections sent during a running turn).
      */
     steeringMessages: string[];
-    /**
-     * How many leading entries of `steeringMessages` have already been folded into the running turn (and so have an emitted `user.message`), as opposed to still waiting for one. Absent for hosts that do not distinguish the two.
-     */
-    inFlightSteeringCount?: number;
 }
 /**
  * Parameters for removing a queued item by stable id.
@@ -15594,7 +15545,7 @@ export interface SandboxConfig {
     addCurrentWorkingDirectory?: boolean;
     auth?: SandboxConfigAuth;
     /**
-     * Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).
+     * Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and, on Unix, up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).
      */
     allowDevToolAccess?: boolean;
 }
@@ -16898,10 +16849,6 @@ export interface SessionInstalledPlugin {
      * Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
      */
     source_sha?: string;
-    /**
-     * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — those synthesized at session start for a directory/local marketplace, whose cache_path points at the real plugin directory on disk rather than a copy under the installed-plugins cache. Its presence is what marks a record as live, and no record carrying it is ever written to the persisted installedPlugins key.
-     */
-    installed_from?: string;
 }
 /**
  * Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
@@ -17105,10 +17052,7 @@ export interface SessionLoadDeferredRepoHooksResult {
  */
 /** @experimental */
 export interface SessionManagedPermissions {
-    /**
-     * When set to `disable`, prevents bypass/allow-all permission modes. `allow-auto-only` blocks full allow-all but permits advisory auto-approval. Any other value is accepted rather than failing the session, but is enforced as `disable`: the key is only present to restrict something, so a mode this runtime cannot interpret fails closed to the most restrictive one it knows. Omit the key entirely to impose no restriction.
-     */
-    disableBypassPermissionsMode?: string;
+    disableBypassPermissionsMode?: DisableBypassPermissionsMode;
     /**
      * Permission rules that block matching operations. Deny has highest precedence.
      */
@@ -17313,7 +17257,7 @@ export interface SessionOpenOptions {
      */
     workingDirectory?: string;
     /**
-     * Additional directories the agent may access beyond the working directory. Each entry is granted to the session's file-access allow-list and surfaced to the model (system prompt context and `@`-mention completion). Conventional `.github/skills/` and `.github/agents/` definitions under each directory also join the session's project catalogs when their existing subsystem gates are enabled: added-root skills require both `enableConfigDiscovery` and effective `enableSkills`; added-root agents require `enableConfigDiscovery`. Supplying a directory therefore activates configuration from it and should be treated as a trust decision. Absolute paths are recommended; a relative path is resolved against the session's working directory. Nonexistent or unresolvable entries are skipped with a warning. This is applied during session creation and cold resume and is not persisted, so a cold resume must re-supply the directories.
+     * Additional directories the agent may access beyond the working directory. Each entry is granted to the session's file-access allow-list and surfaced to the model (system prompt context and `@`-mention completion). Absolute paths are recommended; a relative path is resolved against the session's working directory. Nonexistent or unresolvable entries are skipped with a warning. This is applied on both session creation and resume, and is not persisted: a resumed session that omits this option does not retain previously supplied directories (re-supply them, exactly as the CLI re-passes `--add-dir`).
      */
     additionalDirectories?: string[];
     workingDirectoryContext?: SessionContext;
@@ -23702,7 +23646,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
              */
             list: () => Promise<PermissionPathsList>;
             /**
-             * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
+             * Adds a directory to the session's allow-list.
              *
              * @param params Directory path to add to the session's allowed directories.
              *

package/dist/generated/rpc.js

@@ -1963,7 +1963,7 @@ function createSessionRpc(connection, sessionId) {
          */
         list: async () => connection.sendRequest("session.permissions.paths.list", { sessionId }),
         /**
-         * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
+         * Adds a directory to the session's allow-list.
          *
          * @param params Directory path to add to the session's allowed directories.
          *

package/dist/generated/session-events.d.ts

@@ -9,7 +9,7 @@ export type JsonValue = null | boolean | number | string | JsonValue[] | {
 /**
  * Union of all session event variants emitted by the Copilot CLI runtime.
  */
-export type SessionEvent = StartEvent | ResumeEvent | RemoteSteerableChangedEvent | ErrorEvent | IdleEvent | TitleChangedEvent | ScheduleCreatedEvent | ScheduleCancelledEvent | ScheduleRearmedEvent | AutopilotObjectiveChangedEvent | InfoEvent | WarningEvent | ModelChangeEvent | ModeChangedEvent | SessionLimitsChangedEvent | PermissionsChangedEvent | PlanChangedEvent | TodosChangedEvent | WorkspaceFileChangedEvent | HandoffEvent | TruncationEvent | SnapshotRewindEvent | ShutdownEvent | UsageCheckpointEvent | ContextChangedEvent | UsageInfoEvent | ContextClearedEvent | CompactionStartEvent | CompactionCompleteEvent | TaskCompleteEvent | UserMessageEvent | PendingMessagesModifiedEvent | AssistantTurnStartEvent | AssistantIntentEvent | AssistantServerToolProgressEvent | AssistantReasoningEvent | AssistantReasoningDeltaEvent | AssistantToolCallDeltaEvent | AssistantStreamingDeltaEvent | AssistantMessageEvent | AssistantMessageStartEvent | AssistantMessageDeltaEvent | AssistantTurnEndEvent | AssistantIdleEvent | AssistantUsageEvent | ModelCallFailureEvent | ModelCallFinishedEvent | AbortEvent | ToolUserRequestedEvent | ToolExecutionStartEvent | ToolExecutionPartialResultEvent | ToolExecutionProgressEvent | ToolExecutionCompleteEvent | ToolSearchActivatedEvent | SkillInvokedEvent | SubagentStartedEvent | SubagentCompletedEvent | SubagentFailedEvent | SubagentSelectedEvent | SubagentDeselectedEvent | HookStartEvent | HookEndEvent | HookProgressEvent | BinaryAssetEvent | SystemMessageEvent | SystemNotificationEvent | PermissionRequestedEvent | PermissionCompletedEvent | UserInputRequestedEvent | UserInputCompletedEvent | ElicitationRequestedEvent | ElicitationCompletedEvent | SamplingRequestedEvent | SamplingCompletedEvent | McpOauthRequiredEvent | McpOauthCompletedEvent | McpHeadersRefreshRequiredEvent | McpHeadersRefreshCompletedEvent | CustomNotificationEvent | UIEphemeralQueryEvent | ExternalToolRequestedEvent | ExternalToolCompletedEvent | CommandQueuedEvent | CommandExecuteEvent | CommandCompletedEvent | AutoModeSwitchRequestedEvent | AutoModeSwitchCompletedEvent | SessionLimitsExhaustedRequestedEvent | SessionLimitsExhaustedCompletedEvent | AutoModeResolvedEvent | ManagedSettingsResolvedEvent | ManagedSettingsEnforcedEvent | CommandsChangedEvent | CapabilitiesChangedEvent | ExitPlanModeRequestedEvent | ExitPlanModeCompletedEvent | ToolsUpdatedEvent | BackgroundTasksChangedEvent | FactoryRunUpdatedEvent | FactoryRunStartedEvent | FactoryRunSettledEvent | SkillsLoadedEvent | CustomAgentsUpdatedEvent | McpServersLoadedEvent | McpServerStatusChangedEvent | McpToolsListChangedEvent | McpResourcesListChangedEvent | McpPromptsListChangedEvent | ExtensionsLoadedEvent | CanvasOpenedEvent | CanvasRegistryChangedEvent | CanvasClosedEvent | CanvasUnavailableEvent | CanvasRecordedEvent | CanvasRemovedEvent | ExtensionsAttachmentsPushedEvent | McpAppToolCallCompleteEvent;
+export type SessionEvent = StartEvent | ResumeEvent | RemoteSteerableChangedEvent | ErrorEvent | IdleEvent | TitleChangedEvent | ScheduleCreatedEvent | ScheduleCancelledEvent | ScheduleRearmedEvent | AutopilotObjectiveChangedEvent | InfoEvent | WarningEvent | ModelChangeEvent | ModeChangedEvent | SessionLimitsChangedEvent | PermissionsChangedEvent | PlanChangedEvent | TodosChangedEvent | WorkspaceFileChangedEvent | HandoffEvent | TruncationEvent | SnapshotRewindEvent | ShutdownEvent | UsageCheckpointEvent | ContextChangedEvent | UsageInfoEvent | ContextClearedEvent | CompactionStartEvent | CompactionCompleteEvent | TaskCompleteEvent | UserMessageEvent | PendingMessagesModifiedEvent | AssistantTurnStartEvent | AssistantIntentEvent | AssistantServerToolProgressEvent | AssistantReasoningEvent | AssistantReasoningDeltaEvent | AssistantToolCallDeltaEvent | AssistantStreamingDeltaEvent | AssistantMessageEvent | AssistantMessageStartEvent | AssistantMessageDeltaEvent | AssistantTurnEndEvent | AssistantIdleEvent | AssistantUsageEvent | ModelCallFailureEvent | AbortEvent | ToolUserRequestedEvent | ToolExecutionStartEvent | ToolExecutionPartialResultEvent | ToolExecutionProgressEvent | ToolExecutionCompleteEvent | ToolSearchActivatedEvent | SkillInvokedEvent | SubagentStartedEvent | SubagentCompletedEvent | SubagentFailedEvent | SubagentSelectedEvent | SubagentDeselectedEvent | HookStartEvent | HookEndEvent | HookProgressEvent | BinaryAssetEvent | SystemMessageEvent | SystemNotificationEvent | PermissionRequestedEvent | PermissionCompletedEvent | UserInputRequestedEvent | UserInputCompletedEvent | ElicitationRequestedEvent | ElicitationCompletedEvent | SamplingRequestedEvent | SamplingCompletedEvent | McpOauthRequiredEvent | McpOauthCompletedEvent | McpHeadersRefreshRequiredEvent | McpHeadersRefreshCompletedEvent | CustomNotificationEvent | UIEphemeralQueryEvent | ExternalToolRequestedEvent | ExternalToolCompletedEvent | CommandQueuedEvent | CommandExecuteEvent | CommandCompletedEvent | AutoModeSwitchRequestedEvent | AutoModeSwitchCompletedEvent | SessionLimitsExhaustedRequestedEvent | SessionLimitsExhaustedCompletedEvent | AutoModeResolvedEvent | ManagedSettingsResolvedEvent | ManagedSettingsEnforcedEvent | CommandsChangedEvent | CapabilitiesChangedEvent | ExitPlanModeRequestedEvent | ExitPlanModeCompletedEvent | ToolsUpdatedEvent | BackgroundTasksChangedEvent | FactoryRunUpdatedEvent | FactoryRunStartedEvent | FactoryRunSettledEvent | SkillsLoadedEvent | CustomAgentsUpdatedEvent | McpServersLoadedEvent | McpServerStatusChangedEvent | McpToolsListChangedEvent | McpResourcesListChangedEvent | McpPromptsListChangedEvent | ExtensionsLoadedEvent | CanvasOpenedEvent | CanvasRegistryChangedEvent | CanvasClosedEvent | CanvasUnavailableEvent | CanvasRecordedEvent | CanvasRemovedEvent | ExtensionsAttachmentsPushedEvent | McpAppToolCallCompleteEvent;
 /**
  * Hosting platform type of the repository (github or ado)
  */
@@ -303,18 +303,6 @@ export type ModelCallFailureTransport =
 "http"
 /** WebSocket transport. */
  | "websocket";
-/**
- * Final outcome of one logical model dispatch after response acceptance processing
- */
-export type ModelCallFinishedOutcome = 
-/** The provider response was accepted for continued agent processing. */
-"success"
-/** The dispatch ended with a provider or transport error. */
- | "error"
-/** The dispatch was cancelled before an accepted response was produced. */
- | "cancelled"
-/** The provider response was rejected during post-response acceptance processing. */
- | "rejected";
 /**
  * Finite reason code describing why the current turn was aborted
  */
@@ -677,9 +665,7 @@ export type ManagedSettingsEnforcedEscalation =
 /** Unrestricted filesystem access outside the session's allowed directories. */
  | "unrestricted_paths"
 /** Unrestricted URL fetch access. */
- | "unrestricted_urls"
-/** A server-wide MCP "Always Allow" (or `--allow-tool <server>`) blanket that would auto-approve every tool from an MCP server. Capped to per-tool approval; each tool still prompts. */
- | "server_wide_mcp_approval";
+ | "unrestricted_urls";
 /**
  * Exit plan mode action
  */
@@ -4119,10 +4105,6 @@ export interface AssistantUsageData {
      * Number of output tokens produced
      */
     outputTokens?: number;
-    /**
-     * Time to first observable model output in milliseconds. Includes text, reasoning, and tool-call output; only available for streaming requests that produce observable output.
-     */
-    outputTtftMs?: number;
     /**
      * @deprecated
      * Parent tool call ID when this usage originates from a sub-agent
@@ -4331,62 +4313,6 @@ export interface ModelCallFailureRequestFingerprint {
      */
     toolResultMessageCount: number;
 }
-/**
- * Session event "model.call_finished". Final lifecycle outcome for one logical model dispatch. A logical dispatch may include internal reconnect or fallback work, so event count is not provider HTTP-request count.
- */
-export interface ModelCallFinishedEvent {
-    /**
-     * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
-     */
-    agentId?: string;
-    data: ModelCallFinishedData;
-    /**
-     * Always true for events that are transient and not persisted to the session event log on disk.
-     */
-    ephemeral: true;
-    /**
-     * Unique event identifier (UUID v4), generated when the event is emitted
-     */
-    id: string;
-    /**
-     * ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event.
-     */
-    parentId: string | null;
-    /**
-     * ISO 8601 timestamp when the event was created
-     */
-    timestamp: string;
-    /**
-     * Type discriminator. Always "model.call_finished".
-     */
-    type: "model.call_finished";
-}
-/**
- * Final lifecycle outcome for one logical model dispatch. A logical dispatch may include internal reconnect or fallback work, so event count is not provider HTTP-request count.
- */
-export interface ModelCallFinishedData {
-    /**
-     * Whether an accepted successful response requested the exact name and command semantics of a built-in file edit tool, including an external tool explicitly replacing that built-in name. Absent when the logical dispatch did not produce an accepted response.
-     */
-    containsBuiltInFileEditRequest?: boolean;
-    /**
-     * Monotonic elapsed time spent in the logical model dispatch, including any internal transport reconnect or fallback and excluding orchestrator retry backoff, tool execution, confirmations, and post-response processing
-     */
-    dispatchDurationMs: number;
-    /**
-     * Version of the built-in file-edit semantic classifier used for this event
-     */
-    editClassifierVersion: number;
-    /**
-     * Identifier of the user interaction that owns the model dispatch, matching assistant.turn_start.interactionId when available
-     */
-    interactionId?: string;
-    outcome: ModelCallFinishedOutcome;
-    /**
-     * Agent-loop iteration within the interaction that initiated the model dispatch
-     */
-    turnId: string;
-}
 /**
  * Session event "abort". Turn abort information including the reason for termination
  */
@@ -6858,10 +6784,6 @@ export interface PermissionPromptRequestMcp {
      * @experimental
      */
     assistedApproval?: PermissionAssistedApproval;
-    /**
-     * Whether the host may offer a server-wide "approve all tools from this server" blanket. Absent is treated as true; the runtime sends false when managed policy disables bypass-permissions mode, which forbids the server-wide escalation while still allowing per-tool approval.
-     */
-    canOfferServerWideApproval?: boolean;
     /**
      * Prompt kind discriminator
      */

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/github/copilot-sdk.git"
   },
-  "version": "1.0.12-unstable.0",
+  "version": "1.0.13-preview.0",
   "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
   "main": "./dist/cjs/index.js",
   "types": "./dist/index.d.ts",
@@ -56,7 +56,7 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@github/copilot": "^1.0.81-9",
+    "@github/copilot": "^1.0.81-6",
     "koffi": "^3.1.0",
     "vscode-jsonrpc": "^8.2.1",
     "zod": "^4.3.6"