@github/copilot-sdk 1.0.13-preview.0 → 1.0.13-preview.1

package/dist/cjs/client.js

@@ -988,7 +988,8 @@ class CopilotClient {
    *
    * In empty mode, defaults the four overridable feature flags to safe values
    * (caller values from `config` win). `installedPlugins=[]` is unconditional
-   * in empty mode — apps that need custom plugins should switch modes.
+   * in empty mode. `includedBuiltinSkills` defaults to `[]`, but callers can
+   * explicitly allow selected runtime-bundled skills.
    */
   async updateSessionOptionsForMode(session, config) {
     const patch = {};
@@ -998,6 +999,7 @@ class CopilotClient {
       patch.coauthorEnabled = config.coauthorEnabled ?? false;
       patch.manageScheduleEnabled = config.manageScheduleEnabled ?? false;
       patch.installedPlugins = [];
+      patch.includedBuiltinSkills = config.includedBuiltinSkills ?? [];
     } else {
       if (config.skipCustomInstructions !== void 0)
         patch.skipCustomInstructions = config.skipCustomInstructions;
@@ -1007,6 +1009,8 @@ class CopilotClient {
         patch.coauthorEnabled = config.coauthorEnabled;
       if (config.manageScheduleEnabled !== void 0)
         patch.manageScheduleEnabled = config.manageScheduleEnabled;
+      if (config.includedBuiltinSkills !== void 0)
+        patch.includedBuiltinSkills = config.includedBuiltinSkills;
     }
     if (Object.keys(patch).length === 0) {
       return;

package/dist/cjs/generated/rpc.js

@@ -1991,7 +1991,7 @@ function createSessionRpc(connection, sessionId) {
          */
         list: async () => connection.sendRequest("session.permissions.paths.list", { sessionId }),
         /**
-         * Adds a directory to the session's allow-list.
+         * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
          *
          * @param params Directory path to add to the session's allowed directories.
          *
@@ -2837,6 +2837,11 @@ function registerClientGlobalApiHandlers(connection, handlers) {
     if (!handler) return;
     await handler.event(params);
   });
+  connection.onRequest("gitHubToken.getToken", async (params) => {
+    const handler = handlers.gitHubToken;
+    if (!handler) throw new Error("No gitHubToken client-global handler registered");
+    return handler.getToken(params);
+  });
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/index.js

@@ -27,6 +27,7 @@ __export(index_exports, {
   CopilotWebSocketCloseStatus: () => import_types2.CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder: () => import_types2.CopilotWebSocketForwarder,
   CopilotWebSocketHandler: () => import_types2.CopilotWebSocketHandler,
+  DisableBypassPermissionsModes: () => import_types.DisableBypassPermissionsModes,
   FactoryResumeError: () => import_factory.FactoryResumeError,
   RuntimeConnection: () => import_types.RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS: () => import_types2.SYSTEM_MESSAGE_SECTIONS,
@@ -60,6 +61,7 @@ var import_types2 = require("./types.js");
   CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder,
   CopilotWebSocketHandler,
+  DisableBypassPermissionsModes,
   FactoryResumeError,
   RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS,

package/dist/cjs/types.js

@@ -22,6 +22,7 @@ __export(types_exports, {
   CopilotWebSocketCloseStatus: () => import_copilotRequestHandler.CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder: () => import_copilotRequestHandler.CopilotWebSocketForwarder,
   CopilotWebSocketHandler: () => import_copilotRequestHandler.CopilotWebSocketHandler,
+  DisableBypassPermissionsModes: () => DisableBypassPermissionsModes,
   RuntimeConnection: () => RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS: () => SYSTEM_MESSAGE_SECTIONS,
   SessionFsSqliteTransactionFailure: () => import_sessionFsProvider2.SessionFsSqliteTransactionFailure,
@@ -165,12 +166,19 @@ const approveAll = (request, invocation) => {
 const defaultJoinSessionPermissionHandler = () => ({
   kind: "no-result"
 });
+const DisableBypassPermissionsModes = {
+  /** Turn off bypass-permissions mode entirely. */
+  Disable: "disable",
+  /** Permit automatic bypass but block full allow-all. */
+  AllowAutoOnly: "allow-auto-only"
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CopilotRequestHandler,
   CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder,
   CopilotWebSocketHandler,
+  DisableBypassPermissionsModes,
   RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS,
   SessionFsSqliteTransactionFailure,

package/dist/client.d.ts

@@ -198,7 +198,8 @@ export declare class CopilotClient {
      *
      * In empty mode, defaults the four overridable feature flags to safe values
      * (caller values from `config` win). `installedPlugins=[]` is unconditional
-     * in empty mode — apps that need custom plugins should switch modes.
+     * in empty mode. `includedBuiltinSkills` defaults to `[]`, but callers can
+     * explicitly allow selected runtime-bundled skills.
      */
     private updateSessionOptionsForMode;
     createSession(config: SessionConfig): Promise<CopilotSession>;

package/dist/client.js

@@ -965,7 +965,8 @@ class CopilotClient {
    *
    * In empty mode, defaults the four overridable feature flags to safe values
    * (caller values from `config` win). `installedPlugins=[]` is unconditional
-   * in empty mode — apps that need custom plugins should switch modes.
+   * in empty mode. `includedBuiltinSkills` defaults to `[]`, but callers can
+   * explicitly allow selected runtime-bundled skills.
    */
   async updateSessionOptionsForMode(session, config) {
     const patch = {};
@@ -975,6 +976,7 @@ class CopilotClient {
       patch.coauthorEnabled = config.coauthorEnabled ?? false;
       patch.manageScheduleEnabled = config.manageScheduleEnabled ?? false;
       patch.installedPlugins = [];
+      patch.includedBuiltinSkills = config.includedBuiltinSkills ?? [];
     } else {
       if (config.skipCustomInstructions !== void 0)
         patch.skipCustomInstructions = config.skipCustomInstructions;
@@ -984,6 +986,8 @@ class CopilotClient {
         patch.coauthorEnabled = config.coauthorEnabled;
       if (config.manageScheduleEnabled !== void 0)
         patch.manageScheduleEnabled = config.manageScheduleEnabled;
+      if (config.includedBuiltinSkills !== void 0)
+        patch.includedBuiltinSkills = config.includedBuiltinSkills;
     }
     if (Object.keys(patch).length === 0) {
       return;

package/dist/generated/rpc.d.ts

@@ -15,7 +15,7 @@ export type JsonValue = null | boolean | number | string | JsonValue[] | {
  * via the `definition` "AuthInfo".
  */
 /** @experimental */
-export type AuthInfo = HMACAuthInfo | EnvAuthInfo | TokenAuthInfo | CopilotApiTokenAuthInfo | UserAuthInfo | GhCliAuthInfo | ApiKeyAuthInfo;
+export type AuthInfo = HMACAuthInfo | EnvAuthInfo | TokenAuthInfo | TokenProviderAuthInfo | CopilotApiTokenAuthInfo | UserAuthInfo | GhCliAuthInfo | ApiKeyAuthInfo;
 /**
  * User to log out
  *
@@ -241,6 +241,8 @@ export type AuthInfoType =
  | "api-key"
 /** Authentication from a GitHub token. */
  | "token"
+/** Authentication from an SDK GitHub token callback. */
+ | "token-provider"
 /** Authentication from a Copilot API token. */
  | "copilot-api-token";
 /**
@@ -796,8 +798,6 @@ export type DebugCollectLogsResultKind =
 "archive"
 /** A directory containing redacted files was written. */
  | "directory";
-/** @experimental */
-export type DisableBypassPermissionsMode = "disable";
 /**
  * Persisted extension discovery source
  *
@@ -1128,6 +1128,48 @@ export type FactoryPhaseStatus =
 export type FilterMapping = {
     [k: string]: ContentFilterMode;
 } | ContentFilterMode;
+/**
+ * Why the runtime is requesting a GitHub credential.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "GitHubTokenAcquireReason".
+ */
+/** @experimental */
+export type GitHubTokenAcquireReason = 
+/** The runtime is acquiring the registration's first credential. */
+"initial"
+/** The runtime is replacing a credential that is approaching expiry. */
+ | "refresh";
+/**
+ * SDK host response to a GitHub credential request.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "GitHubTokenAcquireResult".
+ */
+/** @experimental */
+export type GitHubTokenAcquireResult = {
+    /**
+     * GitHub access token acquired by the SDK host.
+     */
+    accessToken: string;
+    /**
+     * OAuth token type. Defaults to bearer when omitted.
+     */
+    tokenType?: string;
+    /**
+     * Remaining token lifetime in seconds when callback execution completes. It must exceed the one-hour preflight refresh threshold.
+     */
+    expiresIn: number;
+    /**
+     * GitHub credential response variant discriminator.
+     */
+    kind: "token";
+} | {
+    /**
+     * GitHub credential response variant discriminator.
+     */
+    kind: "cancelled";
+};
 /**
  * Optional compaction parameters.
  *
@@ -1736,7 +1778,7 @@ export type McpOauthPendingRequestResponse = {
      */
     accessToken: string;
     /**
-     * OAuth token type. Defaults to Bearer when omitted.
+     * OAuth token type. Defaults to bearer when omitted.
      */
     tokenType?: string;
     /**
@@ -3019,6 +3061,14 @@ export type SessionsOpenProgressStatus =
 "in-progress"
 /** The step has completed successfully. */
  | "complete";
+/**
+ * Authentication credentials accepted by session.gitHubAuth.setCredentials. Session-owned token-provider identities cannot be installed through this method.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SettableAuthInfo".
+ */
+/** @experimental */
+export type SettableAuthInfo = HMACAuthInfo | EnvAuthInfo | SettableTokenAuthInfo | CopilotApiTokenAuthInfo | UserAuthInfo | GhCliAuthInfo | ApiKeyAuthInfo;
 /**
  * Rust-owned settings predicates exposed across the SDK boundary. Raw feature-flag names are intentionally not part of the contract.
  *
@@ -3913,6 +3963,32 @@ export interface TokenAuthInfo {
      * The token value itself. Treat as a secret.
      */
     token: string;
+    /**
+     * Opaque native GitHub credential registration backing this token identity, when applicable.
+     */
+    registrationId?: string;
+    copilotUser?: CopilotUserResponse;
+}
+/**
+ * Authentication-info variant backed by an SDK GitHub token callback. It carries routing metadata but never a plaintext token.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TokenProviderAuthInfo".
+ */
+/** @experimental */
+export interface TokenProviderAuthInfo {
+    /**
+     * SDK callback-backed GitHub token authentication.
+     */
+    type: "token-provider";
+    /**
+     * Authentication host.
+     */
+    host: string;
+    /**
+     * Opaque SDK callback registration identifier.
+     */
+    registrationId: string;
     copilotUser?: CopilotUserResponse;
 }
 /**
@@ -4556,6 +4632,10 @@ export interface AuthIdentity {
      * Name of the environment variable that supplied the credential, when applicable
      */
     envVar?: string;
+    /**
+     * Opaque SDK GitHub credential registration backing this identity. Routing metadata only; never a credential.
+     */
+    registrationId?: string;
     copilotUser?: CopilotUserResponse;
 }
 /**
@@ -7968,6 +8048,28 @@ export interface GitHubTelemetryNotification {
     restricted: boolean;
     event: GitHubTelemetryEvent;
 }
+/**
+ * Asks the SDK client to acquire a GitHub access token from an opaque callback registration.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "GitHubTokenAcquireRequest".
+ */
+/** @experimental */
+export interface GitHubTokenAcquireRequest {
+    /**
+     * Opaque identifier generated by the SDK for this callback registration.
+     */
+    registrationId: string;
+    /**
+     * Effective GitHub host for which the callback must return a token.
+     */
+    host: string;
+    /**
+     * Session receiving the token. Absent only before a cloud session has been assigned its id.
+     */
+    sessionId?: string;
+    reason: GitHubTokenAcquireReason;
+}
 /**
  * Pending external tool call request ID, with the tool result or an error describing why it failed.
  *
@@ -8368,6 +8470,10 @@ export interface InstalledPlugin {
      * Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
      */
     source_sha?: string;
+    /**
+     * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — those synthesized at session start for a directory/local marketplace, whose cache_path points at the real plugin directory on disk rather than a copy under the installed-plugins cache. Its presence is what marks a record as live, and no record carrying it is ever written to the persisted installedPlugins key.
+     */
+    installed_from?: string;
 }
 /**
  * Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
@@ -8472,6 +8578,10 @@ export interface InstalledPluginInfo {
      * Whether the plugin is currently enabled for new sessions
      */
     enabled: boolean;
+    /**
+     * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — a plugin belonging to a directory/local marketplace, which is loaded from its real directory on every pass instead of a copy under the installed-plugins cache. Its presence is what marks a listed plugin as live: such a plugin is always present on disk, so `enabled` is its only meaningful state and it is never "not installed".
+     */
+    installedFrom?: string;
 }
 /**
  * Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.
@@ -11315,6 +11425,15 @@ export interface Model {
     supportedContextTiers?: string[];
     modelPickerCategory?: ModelPickerCategory;
     modelPickerPriceCategory?: ModelPickerPriceCategory;
+    warningText?: ModelWarningText;
+    /**
+     * Informational notices the service published for this model, such as an upcoming change or a recommended alternative. Present only when the service published at least one notice. Hosts should surface these without implying anything is wrong with the model.
+     */
+    infoMessages?: ModelMessage[];
+    /**
+     * Warnings the service published for this model, such as a deprecated client version. Present only when the service published at least one warning. The model remains usable; hosts should surface these as advisory rather than blocking.
+     */
+    warningMessages?: ModelMessage[];
 }
 /**
  * Model capabilities and limits
@@ -11537,6 +11656,36 @@ export interface ModelBillingPromo {
      */
     message?: string;
 }
+/**
+ * Service-published warning text that hosts should display when presenting a model.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelWarningText".
+ */
+/** @experimental */
+export interface ModelWarningText {
+    /**
+     * Data-retention warning for the model. The text may contain Markdown links and should be rendered as Markdown when supported.
+     */
+    dataRetention?: string;
+}
+/**
+ * A service-published message about a model, carrying a stable machine-readable code alongside human-readable text.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelMessage".
+ */
+/** @experimental */
+export interface ModelMessage {
+    /**
+     * Stable machine-readable identifier for the message, such as `client_version_deprecated`. Hosts can key custom presentation off this; unrecognized codes should fall back to displaying `message`.
+     */
+    code: string;
+    /**
+     * Human-readable message text intended for display to the user.
+     */
+    message: string;
+}
 /**
  * Managed, repository, and CLI model overrides to overlay onto the session at startup.
  *
@@ -13045,7 +13194,7 @@ export interface PermissionLocationResolveResult {
 /** @experimental */
 export interface PermissionPathsAddParams {
     /**
-     * Directory to add to the allow-list. The runtime resolves and validates the path before adding.
+     * Directory to add to the allow-list. The runtime resolves and validates the path before adding, then loads conventional `.github/skills/` and `.github/agents/` definitions under it when their subsystem gates are enabled. Adding the directory is therefore also a trust decision for configuration stored there.
      */
     path: string;
 }
@@ -13088,7 +13237,7 @@ export interface PermissionPathsConfig {
      */
     unrestricted?: boolean;
     /**
-     * Additional directories to allow tool access to (in addition to the session's working directory). When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).
+     * Additional directories to allow tool access to (in addition to the session's working directory). Conventional `.github/skills/` and `.github/agents/` definitions under them also join the session catalogs when their subsystem gates are enabled, so supplying a directory is a trust decision for configuration stored there. When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).
      */
     additionalDirectories?: string[];
     /**
@@ -15013,6 +15162,10 @@ export interface QueuePendingItemsResult {
      * Display text for messages currently in the immediate steering queue (interjections sent during a running turn).
      */
     steeringMessages: string[];
+    /**
+     * How many leading entries of `steeringMessages` have already been folded into the running turn (and so have an emitted `user.message`), as opposed to still waiting for one. Absent for hosts that do not distinguish the two.
+     */
+    inFlightSteeringCount?: number;
 }
 /**
  * Parameters for removing a queued item by stable id.
@@ -15545,7 +15698,7 @@ export interface SandboxConfig {
     addCurrentWorkingDirectory?: boolean;
     auth?: SandboxConfigAuth;
     /**
-     * Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and, on Unix, up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).
+     * Whether to auto-grant read access to the tool directories discovered on PATH and in toolchain environment variables (GOROOT, CARGO_HOME, JAVA_HOME, VIRTUAL_ENV, and similar), and to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Set to false to disable every grant listed above: user-installed toolchains (rustup, nvm, pyenv, conda, pipx) then need explicit userPolicy.filesystem entries — readonlyPaths to read them, plus readwriteFiles for a relocated CARGO_HOME's .package-cache and .global-cache, which Cargo locks on every build. Only these developer-tool grants are affected: the working directory (see addCurrentWorkingDirectory), temporary storage, session log paths, and system locations follow their own rules and stay granted, so commands still run. Default: true (enabled by default; set to false to opt out).
      */
     allowDevToolAccess?: boolean;
 }
@@ -16849,6 +17002,10 @@ export interface SessionInstalledPlugin {
      * Per-plugin source fingerprint (a SHA-256 hash of the plugin's catalog source spec plus its resolved source subtree — NOT a Git commit SHA) captured at marketplace install/update time. Auto-update compares it against the freshly recomputed fingerprint to detect a content change that does not bump the version. Absent for pre-existing installs and for direct (non-marketplace) installs.
      */
     source_sha?: string;
+    /**
+     * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — those synthesized at session start for a directory/local marketplace, whose cache_path points at the real plugin directory on disk rather than a copy under the installed-plugins cache. Its presence is what marks a record as live, and no record carrying it is ever written to the persisted installedPlugins key.
+     */
+    installed_from?: string;
 }
 /**
  * Source descriptor for a direct GitHub plugin install, with `owner/repo`, optional ref or full commit SHA, and optional subpath.
@@ -17052,7 +17209,10 @@ export interface SessionLoadDeferredRepoHooksResult {
  */
 /** @experimental */
 export interface SessionManagedPermissions {
-    disableBypassPermissionsMode?: DisableBypassPermissionsMode;
+    /**
+     * When set to `disable`, prevents bypass/allow-all permission modes. `allow-auto-only` blocks full allow-all but permits advisory auto-approval. Any other value is accepted rather than failing the session, but is enforced as `disable`: the key is only present to restrict something, so a mode this runtime cannot interpret fails closed to the most restrictive one it knows. Omit the key entirely to impose no restriction.
+     */
+    disableBypassPermissionsMode?: string;
     /**
      * Permission rules that block matching operations. Deny has highest precedence.
      */
@@ -17257,7 +17417,7 @@ export interface SessionOpenOptions {
      */
     workingDirectory?: string;
     /**
-     * Additional directories the agent may access beyond the working directory. Each entry is granted to the session's file-access allow-list and surfaced to the model (system prompt context and `@`-mention completion). Absolute paths are recommended; a relative path is resolved against the session's working directory. Nonexistent or unresolvable entries are skipped with a warning. This is applied on both session creation and resume, and is not persisted: a resumed session that omits this option does not retain previously supplied directories (re-supply them, exactly as the CLI re-passes `--add-dir`).
+     * Additional directories the agent may access beyond the working directory. Each entry is granted to the session's file-access allow-list and surfaced to the model (system prompt context and `@`-mention completion). Conventional `.github/skills/` and `.github/agents/` definitions under each directory also join the session's project catalogs when their existing subsystem gates are enabled: added-root skills require both `enableConfigDiscovery` and effective `enableSkills`; added-root agents require `enableConfigDiscovery`. Supplying a directory therefore activates configuration from it and should be treated as a trust decision. Absolute paths are recommended; a relative path is resolved against the session's working directory. Nonexistent or unresolvable entries are skipped with a warning. This is applied during session creation and cold resume and is not persisted, so a cold resume must re-supply the directories.
      */
     additionalDirectories?: string[];
     workingDirectoryContext?: SessionContext;
@@ -17329,6 +17489,10 @@ export interface SessionOpenOptions {
      * Additional directories to search for skills.
      */
     skillDirectories?: string[];
+    /**
+     * Built-in skill names to include in this session. When specified, only these runtime-bundled skills are available. Skills from other sources with the same name remain available.
+     */
+    includedBuiltinSkills?: string[];
     /**
      * Skill IDs disabled for this session.
      */
@@ -17870,7 +18034,29 @@ export interface SessionsEnrichMetadataRequest {
  */
 /** @experimental */
 export interface SessionSetCredentialsParams {
-    credentials?: AuthInfo;
+    credentials?: SettableAuthInfo;
+}
+/**
+ * Token authentication accepted by session.gitHubAuth.setCredentials.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SettableTokenAuthInfo".
+ */
+/** @experimental */
+export interface SettableTokenAuthInfo {
+    /**
+     * SDK-side token authentication; the host configured the token directly via the SDK.
+     */
+    type: "token";
+    /**
+     * Authentication host.
+     */
+    host: string;
+    /**
+     * The token value itself. Treat as a secret.
+     */
+    token: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
  * Indicates whether the credential update succeeded.
@@ -18693,6 +18879,10 @@ export interface SessionUpdateOptionsParams {
      * Additional directories to search for skills.
      */
     skillDirectories?: string[];
+    /**
+     * Built-in skill names to include in this session. When specified, only these runtime-bundled skills are available. Skills from other sources with the same name remain available. Set to null to remove the allowlist restriction.
+     */
+    includedBuiltinSkills?: string[] | null;
     /**
      * Skill IDs that should be excluded from this session.
      */
@@ -23646,7 +23836,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
              */
             list: () => Promise<PermissionPathsList>;
             /**
-             * Adds a directory to the session's allow-list.
+             * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
              *
              * @param params Directory path to add to the session's allowed directories.
              *
@@ -24332,11 +24522,24 @@ export interface GitHubTelemetryHandler {
      */
     event(params: GitHubTelemetryNotification): Promise<void>;
 }
+/** Handler for `gitHubToken` client global API methods. */
+/** @experimental */
+export interface GitHubTokenHandler {
+    /**
+     * Asks the SDK client to mint a GitHub access token for a session whose configuration supplied a GitHub token provider. The runtime acquires the initial token during bootstrap and refreshes it during expiry preflight when one hour or less remains.
+     *
+     * @param params Asks the SDK client to acquire a GitHub access token from an opaque callback registration.
+     *
+     * @returns SDK host response to a GitHub credential request.
+     */
+    getToken(params: GitHubTokenAcquireRequest): Promise<GitHubTokenAcquireResult>;
+}
 /** All client global API handler groups. */
 export interface ClientGlobalApiHandlers {
     extensionLaunchProvider?: ExtensionLaunchProviderHandler;
     llmInference?: LlmInferenceHandler;
     gitHubTelemetry?: GitHubTelemetryHandler;
+    gitHubToken?: GitHubTokenHandler;
 }
 /**
  * Register client global API handlers on a JSON-RPC connection.

package/dist/generated/rpc.js

@@ -1963,7 +1963,7 @@ function createSessionRpc(connection, sessionId) {
          */
         list: async () => connection.sendRequest("session.permissions.paths.list", { sessionId }),
         /**
-         * Adds a directory to the session's allow-list.
+         * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
          *
          * @param params Directory path to add to the session's allowed directories.
          *
@@ -2809,6 +2809,11 @@ function registerClientGlobalApiHandlers(connection, handlers) {
     if (!handler) return;
     await handler.event(params);
   });
+  connection.onRequest("gitHubToken.getToken", async (params) => {
+    const handler = handlers.gitHubToken;
+    if (!handler) throw new Error("No gitHubToken client-global handler registered");
+    return handler.getToken(params);
+  });
 }
 export {
   createInternalServerRpc,

package/dist/generated/session-events.d.ts

@@ -9,7 +9,7 @@ export type JsonValue = null | boolean | number | string | JsonValue[] | {
 /**
  * Union of all session event variants emitted by the Copilot CLI runtime.
  */
-export type SessionEvent = StartEvent | ResumeEvent | RemoteSteerableChangedEvent | ErrorEvent | IdleEvent | TitleChangedEvent | ScheduleCreatedEvent | ScheduleCancelledEvent | ScheduleRearmedEvent | AutopilotObjectiveChangedEvent | InfoEvent | WarningEvent | ModelChangeEvent | ModeChangedEvent | SessionLimitsChangedEvent | PermissionsChangedEvent | PlanChangedEvent | TodosChangedEvent | WorkspaceFileChangedEvent | HandoffEvent | TruncationEvent | SnapshotRewindEvent | ShutdownEvent | UsageCheckpointEvent | ContextChangedEvent | UsageInfoEvent | ContextClearedEvent | CompactionStartEvent | CompactionCompleteEvent | TaskCompleteEvent | UserMessageEvent | PendingMessagesModifiedEvent | AssistantTurnStartEvent | AssistantIntentEvent | AssistantServerToolProgressEvent | AssistantReasoningEvent | AssistantReasoningDeltaEvent | AssistantToolCallDeltaEvent | AssistantStreamingDeltaEvent | AssistantMessageEvent | AssistantMessageStartEvent | AssistantMessageDeltaEvent | AssistantTurnEndEvent | AssistantIdleEvent | AssistantUsageEvent | ModelCallFailureEvent | AbortEvent | ToolUserRequestedEvent | ToolExecutionStartEvent | ToolExecutionPartialResultEvent | ToolExecutionProgressEvent | ToolExecutionCompleteEvent | ToolSearchActivatedEvent | SkillInvokedEvent | SubagentStartedEvent | SubagentCompletedEvent | SubagentFailedEvent | SubagentSelectedEvent | SubagentDeselectedEvent | HookStartEvent | HookEndEvent | HookProgressEvent | BinaryAssetEvent | SystemMessageEvent | SystemNotificationEvent | PermissionRequestedEvent | PermissionCompletedEvent | UserInputRequestedEvent | UserInputCompletedEvent | ElicitationRequestedEvent | ElicitationCompletedEvent | SamplingRequestedEvent | SamplingCompletedEvent | McpOauthRequiredEvent | McpOauthCompletedEvent | McpHeadersRefreshRequiredEvent | McpHeadersRefreshCompletedEvent | CustomNotificationEvent | UIEphemeralQueryEvent | ExternalToolRequestedEvent | ExternalToolCompletedEvent | CommandQueuedEvent | CommandExecuteEvent | CommandCompletedEvent | AutoModeSwitchRequestedEvent | AutoModeSwitchCompletedEvent | SessionLimitsExhaustedRequestedEvent | SessionLimitsExhaustedCompletedEvent | AutoModeResolvedEvent | ManagedSettingsResolvedEvent | ManagedSettingsEnforcedEvent | CommandsChangedEvent | CapabilitiesChangedEvent | ExitPlanModeRequestedEvent | ExitPlanModeCompletedEvent | ToolsUpdatedEvent | BackgroundTasksChangedEvent | FactoryRunUpdatedEvent | FactoryRunStartedEvent | FactoryRunSettledEvent | SkillsLoadedEvent | CustomAgentsUpdatedEvent | McpServersLoadedEvent | McpServerStatusChangedEvent | McpToolsListChangedEvent | McpResourcesListChangedEvent | McpPromptsListChangedEvent | ExtensionsLoadedEvent | CanvasOpenedEvent | CanvasRegistryChangedEvent | CanvasClosedEvent | CanvasUnavailableEvent | CanvasRecordedEvent | CanvasRemovedEvent | ExtensionsAttachmentsPushedEvent | McpAppToolCallCompleteEvent;
+export type SessionEvent = StartEvent | ResumeEvent | RemoteSteerableChangedEvent | ErrorEvent | IdleEvent | TitleChangedEvent | ScheduleCreatedEvent | ScheduleCancelledEvent | ScheduleRearmedEvent | AutopilotObjectiveChangedEvent | InfoEvent | WarningEvent | ModelChangeEvent | ModeChangedEvent | SessionLimitsChangedEvent | PermissionsChangedEvent | PlanChangedEvent | TodosChangedEvent | WorkspaceFileChangedEvent | HandoffEvent | TruncationEvent | SnapshotRewindEvent | ShutdownEvent | UsageCheckpointEvent | ContextChangedEvent | UsageInfoEvent | ContextClearedEvent | CompactionStartEvent | CompactionCompleteEvent | TaskCompleteEvent | UserMessageEvent | PendingMessagesModifiedEvent | AssistantTurnStartEvent | AssistantIntentEvent | AssistantServerToolProgressEvent | AssistantReasoningEvent | AssistantReasoningDeltaEvent | AssistantToolCallDeltaEvent | AssistantStreamingDeltaEvent | AssistantMessageEvent | AssistantMessageStartEvent | AssistantMessageDeltaEvent | AssistantTurnEndEvent | AssistantIdleEvent | AssistantUsageEvent | ModelCallFailureEvent | ModelCallFinishedEvent | AbortEvent | ToolUserRequestedEvent | ToolExecutionStartEvent | ToolExecutionPartialResultEvent | ToolExecutionProgressEvent | ToolExecutionCompleteEvent | ToolSearchActivatedEvent | SkillInvokedEvent | SubagentStartedEvent | SubagentCompletedEvent | SubagentFailedEvent | SubagentSelectedEvent | SubagentDeselectedEvent | HookStartEvent | HookEndEvent | HookProgressEvent | BinaryAssetEvent | SystemMessageEvent | SystemNotificationEvent | PermissionRequestedEvent | PermissionCompletedEvent | UserInputRequestedEvent | UserInputCompletedEvent | ElicitationRequestedEvent | ElicitationCompletedEvent | SamplingRequestedEvent | SamplingCompletedEvent | McpOauthRequiredEvent | McpOauthCompletedEvent | McpHeadersRefreshRequiredEvent | McpHeadersRefreshCompletedEvent | CustomNotificationEvent | UIEphemeralQueryEvent | ExternalToolRequestedEvent | ExternalToolCompletedEvent | CommandQueuedEvent | CommandExecuteEvent | CommandCompletedEvent | AutoModeSwitchRequestedEvent | AutoModeSwitchCompletedEvent | SessionLimitsExhaustedRequestedEvent | SessionLimitsExhaustedCompletedEvent | AutoModeResolvedEvent | ManagedSettingsResolvedEvent | ManagedSettingsEnforcedEvent | CommandsChangedEvent | CapabilitiesChangedEvent | ExitPlanModeRequestedEvent | ExitPlanModeCompletedEvent | ToolsUpdatedEvent | BackgroundTasksChangedEvent | FactoryRunUpdatedEvent | FactoryRunStartedEvent | FactoryRunSettledEvent | SkillsLoadedEvent | CustomAgentsUpdatedEvent | McpServersLoadedEvent | McpServerStatusChangedEvent | McpToolsListChangedEvent | McpResourcesListChangedEvent | McpPromptsListChangedEvent | ExtensionsLoadedEvent | CanvasOpenedEvent | CanvasRegistryChangedEvent | CanvasClosedEvent | CanvasUnavailableEvent | CanvasRecordedEvent | CanvasRemovedEvent | ExtensionsAttachmentsPushedEvent | McpAppToolCallCompleteEvent;
 /**
  * Hosting platform type of the repository (github or ado)
  */
@@ -303,6 +303,18 @@ export type ModelCallFailureTransport =
 "http"
 /** WebSocket transport. */
  | "websocket";
+/**
+ * Final outcome of one logical model dispatch after response acceptance processing
+ */
+export type ModelCallFinishedOutcome = 
+/** The provider response was accepted for continued agent processing. */
+"success"
+/** The dispatch ended with a provider or transport error. */
+ | "error"
+/** The dispatch was cancelled before an accepted response was produced. */
+ | "cancelled"
+/** The provider response was rejected during post-response acceptance processing. */
+ | "rejected";
 /**
  * Finite reason code describing why the current turn was aborted
  */
@@ -665,7 +677,9 @@ export type ManagedSettingsEnforcedEscalation =
 /** Unrestricted filesystem access outside the session's allowed directories. */
  | "unrestricted_paths"
 /** Unrestricted URL fetch access. */
- | "unrestricted_urls";
+ | "unrestricted_urls"
+/** A server-wide MCP "Always Allow" (or `--allow-tool <server>`) blanket that would auto-approve every tool from an MCP server. Capped to per-tool approval; each tool still prompts. */
+ | "server_wide_mcp_approval";
 /**
  * Exit plan mode action
  */
@@ -3594,6 +3608,7 @@ export interface AssistantMessageData {
      * Generation phase for phased-output models (e.g., thinking vs. response phases)
      */
     phase?: string;
+    reasoningBlocks?: AssistantMessageReasoningBlocks;
     /**
      * Opaque/encrypted extended thinking data from Anthropic models. Session-bound and stripped on resume.
      */
@@ -3756,6 +3771,20 @@ export interface CitationLocationBlock {
      */
     type: "block";
 }
+/**
+ * Neutral provider-tagged reasoning content blocks preserved verbatim for round-tripping
+ */
+/** @experimental */
+export interface AssistantMessageReasoningBlocks {
+    /**
+     * Provider-native reasoning content blocks (e.g. Anthropic `thinking` / `redacted_thinking`) preserved verbatim, in order. A single response can carry several, each signed over the content preceding it, so dropping or reordering any of them invalidates the rest.
+     */
+    blocks?: JsonValue[];
+    /**
+     * Model provider that produced these reasoning blocks.
+     */
+    provider: string;
+}
 /**
  * Neutral provider-tagged server-side tool-use payload (tool search, advisor) for verbatim round-tripping
  */
@@ -4105,6 +4134,10 @@ export interface AssistantUsageData {
      * Number of output tokens produced
      */
     outputTokens?: number;
+    /**
+     * Time to first observable model output in milliseconds. Includes text, reasoning, and tool-call output; only available for streaming requests that produce observable output.
+     */
+    outputTtftMs?: number;
     /**
      * @deprecated
      * Parent tool call ID when this usage originates from a sub-agent
@@ -4313,6 +4346,62 @@ export interface ModelCallFailureRequestFingerprint {
      */
     toolResultMessageCount: number;
 }
+/**
+ * Session event "model.call_finished". Final lifecycle outcome for one logical model dispatch. A logical dispatch may include internal reconnect or fallback work, so event count is not provider HTTP-request count.
+ */
+export interface ModelCallFinishedEvent {
+    /**
+     * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
+     */
+    agentId?: string;
+    data: ModelCallFinishedData;
+    /**
+     * Always true for events that are transient and not persisted to the session event log on disk.
+     */
+    ephemeral: true;
+    /**
+     * Unique event identifier (UUID v4), generated when the event is emitted
+     */
+    id: string;
+    /**
+     * ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event.
+     */
+    parentId: string | null;
+    /**
+     * ISO 8601 timestamp when the event was created
+     */
+    timestamp: string;
+    /**
+     * Type discriminator. Always "model.call_finished".
+     */
+    type: "model.call_finished";
+}
+/**
+ * Final lifecycle outcome for one logical model dispatch. A logical dispatch may include internal reconnect or fallback work, so event count is not provider HTTP-request count.
+ */
+export interface ModelCallFinishedData {
+    /**
+     * Whether an accepted successful response requested the exact name and command semantics of a built-in file edit tool, including an external tool explicitly replacing that built-in name. Absent when the logical dispatch did not produce an accepted response.
+     */
+    containsBuiltInFileEditRequest?: boolean;
+    /**
+     * Monotonic elapsed time spent in the logical model dispatch, including any internal transport reconnect or fallback and excluding orchestrator retry backoff, tool execution, confirmations, and post-response processing
+     */
+    dispatchDurationMs: number;
+    /**
+     * Version of the built-in file-edit semantic classifier used for this event
+     */
+    editClassifierVersion: number;
+    /**
+     * Identifier of the user interaction that owns the model dispatch, matching assistant.turn_start.interactionId when available
+     */
+    interactionId?: string;
+    outcome: ModelCallFinishedOutcome;
+    /**
+     * Agent-loop iteration within the interaction that initiated the model dispatch
+     */
+    turnId: string;
+}
 /**
  * Session event "abort". Turn abort information including the reason for termination
  */
@@ -5400,10 +5489,30 @@ export interface SubagentCompletedData {
      * Whether the sub-agent was torn down by cancellation - its own abort, or an ancestor being killed - instead of finishing its work. Cancellation is not a failure, so the run still reports completion; this distinguishes a torn-down sub-agent from one that ran to the end.
      */
     cancelled?: boolean;
+    /**
+     * Whether the first model actually dispatched matched the user's configured preference
+     */
+    configuredModelMatchesActual?: boolean;
+    /**
+     * Concrete model the user configured for this sub-agent via `/subagents`, when present
+     */
+    configuredModelPreference?: string;
     /**
      * Wall-clock duration of the sub-agent execution in milliseconds
      */
     durationMs?: number;
+    /**
+     * Whether the explicit task-call model matched the user's configured preference
+     */
+    explicitModelMatchesPreference?: boolean;
+    /**
+     * Explicit model supplied by the parent agent on the task call, when present
+     */
+    explicitModelOverride?: string;
+    /**
+     * First model for which the sub-agent started an inference request, when one was dispatched
+     */
+    firstDispatchedModel?: string;
     /**
      * Model used by the sub-agent
      */
@@ -5463,6 +5572,14 @@ export interface SubagentFailedData {
      * Internal name of the sub-agent
      */
     agentName: string;
+    /**
+     * Whether the first model actually dispatched matched the user's configured preference
+     */
+    configuredModelMatchesActual?: boolean;
+    /**
+     * Concrete model the user configured for this sub-agent via `/subagents`, when present
+     */
+    configuredModelPreference?: string;
     /**
      * Wall-clock duration of the sub-agent execution in milliseconds
      */
@@ -5471,6 +5588,18 @@ export interface SubagentFailedData {
      * Error message describing why the sub-agent failed
      */
     error: string;
+    /**
+     * Whether the explicit task-call model matched the user's configured preference
+     */
+    explicitModelMatchesPreference?: boolean;
+    /**
+     * Explicit model supplied by the parent agent on the task call, when present
+     */
+    explicitModelOverride?: string;
+    /**
+     * First model for which the sub-agent started an inference request, when one was dispatched
+     */
+    firstDispatchedModel?: string;
     /**
      * Model selected for the sub-agent, when known
      */
@@ -6784,6 +6913,10 @@ export interface PermissionPromptRequestMcp {
      * @experimental
      */
     assistedApproval?: PermissionAssistedApproval;
+    /**
+     * Whether the host may offer a server-wide "approve all tools from this server" blanket. Absent is treated as true; the runtime sends false when managed policy disables bypass-permissions mode, which forbids the server-wide escalation while still allowing per-tool approval.
+     */
+    canOfferServerWideApproval?: boolean;
     /**
      * Prompt kind discriminator
      */
@@ -8709,6 +8842,10 @@ export interface ManagedSettingsResolvedData {
      * Whether at least two managed sources supplied permission allowlists, so enforcement intersects them and the flattened settings payload omits `permissions.allow`.
      */
     permissionsAllowIntersected?: boolean;
+    /**
+     * Whether the effective sandbox policy forces the sandbox on *only* because managed policy could not be determined, rather than because the policy requires it. Lets clients tell a user whose `--no-sandbox` was overridden that the sandbox stayed on as a fail-closed fallback, instead of attributing it to an administrator who set no such policy.
+     */
+    sandboxEnabledByUndeterminedPolicy?: boolean;
     /**
      * Whether the server (account/org) managed-settings layer was present
      */

package/dist/index.d.ts

@@ -4,7 +4,7 @@
  * JSON-RPC based SDK for programmatic control of GitHub Copilot CLI
  */
 export { CopilotClient } from "./client.js";
-export { RuntimeConnection } from "./types.js";
+export { DisableBypassPermissionsModes, RuntimeConnection } from "./types.js";
 export { BuiltInTools, ToolSet } from "./toolSet.js";
 export { CopilotSession, type AssistantMessageEvent } from "./session.js";
 export { defineFactory, FactoryResumeError, isFactoryRunTerminal } from "./factory.js";

package/dist/index.js

@@ -1,5 +1,5 @@
 import { CopilotClient } from "./client.js";
-import { RuntimeConnection } from "./types.js";
+import { DisableBypassPermissionsModes, RuntimeConnection } from "./types.js";
 import { BuiltInTools, ToolSet } from "./toolSet.js";
 import { CopilotSession } from "./session.js";
 import { defineFactory, FactoryResumeError, isFactoryRunTerminal } from "./factory.js";
@@ -31,6 +31,7 @@ export {
   CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder,
   CopilotWebSocketHandler,
+  DisableBypassPermissionsModes,
   FactoryResumeError,
   RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS,

package/dist/types.d.ts

@@ -1751,6 +1751,13 @@ export interface GitHubMcpToolConfig {
     enableInsidersMode?: boolean;
     disableFormDeferral?: boolean;
 }
+/** Well-known managed bypass-permissions policies. */
+export declare const DisableBypassPermissionsModes: {
+    /** Turn off bypass-permissions mode entirely. */
+    readonly Disable: "disable";
+    /** Permit automatic bypass but block full allow-all. */
+    readonly AllowAutoOnly: "allow-auto-only";
+};
 /**
  * Permissions-only managed policy injected by the host via
  * {@link SessionConfigBase.managedSettings}.
@@ -1761,11 +1768,11 @@ export interface GitHubMcpToolConfig {
  */
 export interface ManagedSettingsPermissions {
     /**
-     * When set to `"disable"`, bypass-permissions ("yolo") mode is turned off
-     * for the session. This is deny-wins: it cannot be re-enabled by any other
-     * layer.
+     * Restricts bypass-permissions mode for the session. See
+     * {@link DisableBypassPermissionsModes} for well-known values. Unknown
+     * values are forwarded so newer runtime policies fail closed.
      */
-    disableBypassPermissionsMode?: "disable";
+    disableBypassPermissionsMode?: string;
     /** Operations that must always be denied. Unioned across managed layers. */
     deny?: string[];
     /**
@@ -1944,6 +1951,12 @@ export interface SessionConfigBase {
      * a custom agent with the same name is configured.
      */
     excludedBuiltinAgents?: string[];
+    /**
+     * Built-in skill names to include in the session. In `mode: "empty"`,
+     * omitting this option excludes all runtime-bundled skills; specifying names
+     * opts those built-ins back in. Skills from other sources remain eligible.
+     */
+    includedBuiltinSkills?: string[];
     /**
      * Custom provider configuration (BYOK - Bring Your Own Key).
      * When specified, uses the provided API endpoint instead of the Copilot API.
@@ -2240,8 +2253,8 @@ export interface SessionConfigBase {
      * with the same managed-permission parser it uses for fetched policy and
      * composes it restrictively with any self-fetched (server) and
      * device-managed (MDM) layers: `deny`/`ask` rules are unioned, every
-     * declared `allow` list must admit an operation, and
-     * `disableBypassPermissionsMode: "disable"` is deny-wins.
+     * declared `allow` list must admit an operation, and bypass-mode
+     * restrictions are composed fail-closed.
      *
      * This is startup-only. It is **not** persisted: it must be re-supplied on
      * {@link CopilotClient.resumeSession | resume}, where it replaces the prior

package/dist/types.js

@@ -134,11 +134,18 @@ const approveAll = (request, invocation) => {
 const defaultJoinSessionPermissionHandler = () => ({
   kind: "no-result"
 });
+const DisableBypassPermissionsModes = {
+  /** Turn off bypass-permissions mode entirely. */
+  Disable: "disable",
+  /** Permit automatic bypass but block full allow-all. */
+  AllowAutoOnly: "allow-auto-only"
+};
 export {
   CopilotRequestHandler,
   CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder,
   CopilotWebSocketHandler,
+  DisableBypassPermissionsModes,
   RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS,
   SessionFsSqliteTransactionFailure,

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/github/copilot-sdk.git"
   },
-  "version": "1.0.13-preview.0",
+  "version": "1.0.13-preview.1",
   "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
   "main": "./dist/cjs/index.js",
   "types": "./dist/index.d.ts",
@@ -56,7 +56,7 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@github/copilot": "^1.0.81-6",
+    "@github/copilot": "^1.0.81-10",
     "koffi": "^3.1.0",
     "vscode-jsonrpc": "^8.2.1",
     "zod": "^4.3.6"