@github/copilot-sdk 1.0.13-preview.0 → 1.0.13-preview.2

package/README.md

@@ -137,12 +137,25 @@ Create a new conversation session.
 - `infiniteSessions?: InfiniteSessionConfig` - Configure automatic context compaction (see below)
 - `workingDirectory?: string` - Working directory for the session (default: runtime process cwd).
 - `enableSessionStore?: boolean` - Enables the cross-session store for search and retrieval across sessions. When unset in `"copilot-cli"` mode, the runtime default applies (enabled). In `"empty"` mode, defaults to disabled.
+- `gitHubTokenProvider?: GitHubTokenProvider` - Acquires rotating, session-scoped GitHub tokens. Token results require a positive `expiresIn` value in seconds remaining when the callback completes; production tokens typically last eight hours. Cannot be combined with `gitHubToken`.
 - `provider?: ProviderConfig` - Custom API provider configuration (BYOK - Bring Your Own Key). See [Custom Providers](#custom-providers) section.
 - `onPermissionRequest?: PermissionHandler` - Optional handler called before each tool execution to approve or deny it. When omitted, permission requests are emitted as events and left pending for manual resolution. `approveAll` approves requests when managed settings are disabled and throws when `enableManagedSettings` is true. Custom handlers can inspect `managedApprovalRequired` for human-facing confirmation logic. See [Permission Handling](#permission-handling) section.
 - `onUserInputRequest?: UserInputHandler` - Handler for user input requests from the agent. Enables the `ask_user` tool. See [User Input Requests](#user-input-requests) section.
 - `onElicitationRequest?: ElicitationHandler` - Handler for elicitation requests dispatched by the server. Enables this client to present form-based UI dialogs on behalf of the agent or other session participants. See [Elicitation Requests](#elicitation-requests) section.
 - `hooks?: SessionHooks` - Hook handlers for session lifecycle events. See [Session Hooks](#session-hooks) section.
 
+```typescript
+const session = await client.createSession({
+    gitHubTokenProvider: async ({ host }) => ({
+        kind: "token",
+        accessToken: await acquireTokenForHost(host),
+        expiresIn: 8 * 60 * 60,
+    }),
+});
+```
+
+Initial acquisition runs during session creation or resume. Cancellation, provider errors, and invalid token responses reject that operation instead of falling back to ambient authentication. Idle sessions refresh only before their next credential-consuming operation; there is no background refresh timer.
+
 ##### `resumeSession(sessionId: string, config?: ResumeSessionConfig): Promise<CopilotSession>`
 
 Resume an existing session. Returns the session with `workspacePath` populated if infinite sessions were enabled.

package/dist/cjs/client.js

@@ -294,6 +294,7 @@ class CopilotClient {
   builtinPluginDirectories = [];
   onGitHubTelemetry;
   clientGlobalHandlers = {};
+  githubTokenProviders = /* @__PURE__ */ new Map();
   /**
    * Typed server-scoped RPC methods.
    * @throws Error if the client is not connected
@@ -551,8 +552,53 @@ class CopilotClient {
         }
       };
     }
+    handlers.gitHubToken = {
+      getToken: (params) => this.acquireGitHubToken(params)
+    };
     this.clientGlobalHandlers = handlers;
   }
+  async acquireGitHubToken(params) {
+    const registration = this.githubTokenProviders.get(params.registrationId);
+    if (!registration) {
+      throw new Error(
+        `No GitHub token provider registered for registration ID "${params.registrationId}"`
+      );
+    }
+    return await registration.provider({
+      host: params.host,
+      sessionId: params.sessionId ?? registration.sessionId,
+      reason: params.reason
+    });
+  }
+  registerGitHubTokenProvider(provider, sessionId) {
+    if (!provider) {
+      return void 0;
+    }
+    const registrationId = (0, import_node_crypto.randomUUID)();
+    this.githubTokenProviders.set(registrationId, { provider, sessionId, committed: false });
+    return registrationId;
+  }
+  assignGitHubTokenProvider(registrationId, sessionId) {
+    if (!registrationId) {
+      return;
+    }
+    const registration = this.githubTokenProviders.get(registrationId);
+    if (registration) {
+      registration.sessionId = sessionId;
+    }
+  }
+  commitGitHubTokenProvider(sessionId, registrationId) {
+    for (const [candidateId, registration2] of this.githubTokenProviders) {
+      if (registration2.sessionId === sessionId && registration2.committed) {
+        this.githubTokenProviders.delete(candidateId);
+      }
+    }
+    const registration = registrationId ? this.githubTokenProviders.get(registrationId) : void 0;
+    if (registration) {
+      registration.sessionId = sessionId;
+      registration.committed = true;
+    }
+  }
   /**
    * Starts the CLI server and establishes a connection.
    *
@@ -669,6 +715,7 @@ class CopilotClient {
       session._markDisconnected();
     }
     this.sessions.clear();
+    this.githubTokenProviders.clear();
     if (this.connection && (this.cliProcess || this.ffiHost) && !this.isExternalServer) {
       const runtimeShutdownStart = Date.now();
       const shutdownPromise = this.rpc.runtime.shutdown();
@@ -823,6 +870,7 @@ class CopilotClient {
       session._markDisconnected();
     }
     this.sessions.clear();
+    this.githubTokenProviders.clear();
     if (this.messageWriter) {
       this.messageWriter.suppressWriteErrors = true;
     }
@@ -988,7 +1036,8 @@ class CopilotClient {
    *
    * In empty mode, defaults the four overridable feature flags to safe values
    * (caller values from `config` win). `installedPlugins=[]` is unconditional
-   * in empty mode — apps that need custom plugins should switch modes.
+   * in empty mode. `includedBuiltinSkills` defaults to `[]`, but callers can
+   * explicitly allow selected runtime-bundled skills.
    */
   async updateSessionOptionsForMode(session, config) {
     const patch = {};
@@ -998,6 +1047,7 @@ class CopilotClient {
       patch.coauthorEnabled = config.coauthorEnabled ?? false;
       patch.manageScheduleEnabled = config.manageScheduleEnabled ?? false;
       patch.installedPlugins = [];
+      patch.includedBuiltinSkills = config.includedBuiltinSkills ?? [];
     } else {
       if (config.skipCustomInstructions !== void 0)
         patch.skipCustomInstructions = config.skipCustomInstructions;
@@ -1007,6 +1057,8 @@ class CopilotClient {
         patch.coauthorEnabled = config.coauthorEnabled;
       if (config.manageScheduleEnabled !== void 0)
         patch.manageScheduleEnabled = config.manageScheduleEnabled;
+      if (config.includedBuiltinSkills !== void 0)
+        patch.includedBuiltinSkills = config.includedBuiltinSkills;
     }
     if (Object.keys(patch).length === 0) {
       return;
@@ -1022,6 +1074,9 @@ class CopilotClient {
     }
   }
   async createSession(config) {
+    if (config.gitHubToken !== void 0 && config.gitHubTokenProvider !== void 0) {
+      throw new Error("gitHubToken and gitHubTokenProvider are mutually exclusive");
+    }
     if (!this.connection) {
       await this.start();
     }
@@ -1032,6 +1087,11 @@ class CopilotClient {
     const callerSessionId = config.sessionId;
     const useServerGeneratedId = config.cloud != null && callerSessionId == null;
     const localSessionId = useServerGeneratedId ? void 0 : callerSessionId ?? (0, import_node_crypto.randomUUID)();
+    const toolFilterOptions = this.resolveToolFilterOptions(config);
+    const gitHubTokenProviderRegistrationId = this.registerGitHubTokenProvider(
+      config.gitHubTokenProvider,
+      localSessionId
+    );
     const {
       wireProvider: bearerWireProvider,
       wireProviders: bearerWireProviders,
@@ -1048,7 +1108,10 @@ class CopilotClient {
         this.onGetTraceContext,
         {
           mcpAuthHandler: config.onMcpAuthRequest,
-          managedSettingsEnabled: config.enableManagedSettings === true || config.managedSettings !== void 0
+          managedSettingsEnabled: config.enableManagedSettings === true || config.managedSettings !== void 0,
+          onDisconnected: gitHubTokenProviderRegistrationId === void 0 ? void 0 : () => this.githubTokenProviders.delete(
+            gitHubTokenProviderRegistrationId
+          )
         }
       );
       s.registerTools(config.tools);
@@ -1086,10 +1149,16 @@ class CopilotClient {
     let session;
     let registeredId;
     if (localSessionId !== void 0) {
-      session = initializeSession(localSessionId);
-      registeredId = localSessionId;
+      try {
+        session = initializeSession(localSessionId);
+        registeredId = localSessionId;
+      } catch (error) {
+        if (gitHubTokenProviderRegistrationId !== void 0) {
+          this.githubTokenProviders.delete(gitHubTokenProviderRegistrationId);
+        }
+        throw error;
+      }
     }
-    const toolFilterOptions = this.resolveToolFilterOptions(config);
     try {
       const response = await this.connection.sendRequest("session.create", {
         ...await (0, import_telemetry.getTraceContext)(this.onGetTraceContext),
@@ -1174,6 +1243,7 @@ class CopilotClient {
         infiniteSessions: config.infiniteSessions,
         memory: config.memory,
         gitHubToken: config.gitHubToken,
+        gitHubTokenProviderRegistrationId,
         remoteSession: config.remoteSession,
         cloud: config.cloud,
         expAssignments: config.expAssignments,
@@ -1197,6 +1267,7 @@ class CopilotClient {
         session = initializeSession(returnedSessionId);
         registeredId = returnedSessionId;
       }
+      this.assignGitHubTokenProvider(gitHubTokenProviderRegistrationId, returnedSessionId);
       if (config.onMcpAuthRequest) {
         await this.connection.sendRequest("session.eventLog.registerInterest", {
           sessionId: returnedSessionId,
@@ -1206,10 +1277,14 @@ class CopilotClient {
       session["_workspacePath"] = workspacePath;
       session.setCapabilities(capabilities);
       await this.updateSessionOptionsForMode(session, config);
+      this.commitGitHubTokenProvider(returnedSessionId, gitHubTokenProviderRegistrationId);
     } catch (e) {
       if (registeredId !== void 0) {
         this.sessions.delete(registeredId);
       }
+      if (gitHubTokenProviderRegistrationId !== void 0) {
+        this.githubTokenProviders.delete(gitHubTokenProviderRegistrationId);
+      }
       throw e;
     }
     return session;
@@ -1246,6 +1321,9 @@ class CopilotClient {
     return this.resumeSessionInternal(sessionId, config, factories, extensionOptions);
   }
   async resumeSessionInternal(sessionId, config, factories, extensionOptions) {
+    if (config.gitHubToken !== void 0 && config.gitHubTokenProvider !== void 0) {
+      throw new Error("gitHubToken and gitHubTokenProvider are mutually exclusive");
+    }
     if (!this.connection) {
       await this.start();
     }
@@ -1303,6 +1381,15 @@ class CopilotClient {
     this.sessions.set(sessionId, session);
     this.setupSessionFs(session, config);
     const toolFilterOptions = this.resolveToolFilterOptions(config);
+    const gitHubTokenProviderRegistrationId = this.registerGitHubTokenProvider(
+      config.gitHubTokenProvider,
+      sessionId
+    );
+    if (gitHubTokenProviderRegistrationId !== void 0) {
+      session._setOnDisconnected(
+        () => this.githubTokenProviders.delete(gitHubTokenProviderRegistrationId)
+      );
+    }
     try {
       const response = await this.connection.sendRequest("session.resume", {
         ...await (0, import_telemetry.getTraceContext)(this.onGetTraceContext),
@@ -1390,6 +1477,7 @@ class CopilotClient {
         disableResume: config.suppressResumeEvent,
         continuePendingWork: config.continuePendingWork,
         gitHubToken: config.gitHubToken,
+        gitHubTokenProviderRegistrationId,
         remoteSession: config.remoteSession,
         openCanvases: config.openCanvases,
         expAssignments: config.expAssignments,
@@ -1419,8 +1507,12 @@ class CopilotClient {
         });
       }
       await this.updateSessionOptionsForMode(session, config);
+      this.commitGitHubTokenProvider(sessionId, gitHubTokenProviderRegistrationId);
     } catch (e) {
       this.sessions.delete(sessionId);
+      if (gitHubTokenProviderRegistrationId !== void 0) {
+        this.githubTokenProviders.delete(gitHubTokenProviderRegistrationId);
+      }
       throw e;
     }
     return session;
@@ -1609,7 +1701,9 @@ class CopilotClient {
     if (!success) {
       throw new Error(`Failed to delete session ${sessionId}: ${error || "Unknown error"}`);
     }
+    const session = this.sessions.get(sessionId);
     this.sessions.delete(sessionId);
+    session?._runOnDisconnected();
   }
   /**
    * List all available sessions.
@@ -2157,6 +2251,7 @@ stderr: ${stderrOutput}`
     );
     this.connection.onClose(() => {
       this.state = "disconnected";
+      this.githubTokenProviders.clear();
     });
     this.connection.onError((_error) => {
       this.state = "disconnected";

package/dist/cjs/generated/rpc.js

@@ -1991,7 +1991,7 @@ function createSessionRpc(connection, sessionId) {
          */
         list: async () => connection.sendRequest("session.permissions.paths.list", { sessionId }),
         /**
-         * Adds a directory to the session's allow-list.
+         * Adds a directory to the session's allow-list and activates conventional skill and agent definitions under it.
          *
          * @param params Directory path to add to the session's allowed directories.
          *
@@ -2540,6 +2540,25 @@ function createInternalSessionRpc(connection, sessionId) {
       }
     },
     /** @experimental */
+    factory: {
+      /**
+       * Internal tool-originated factory invocation.
+       *
+       * @param params Internal parameters for invoking a registered factory from a tool.
+       *
+       * @returns Complete current or terminal factory run envelope.
+       */
+      runFromTool: async (params) => connection.sendRequest("session.factory.runFromTool", { sessionId, ...params }),
+      /**
+       * Internal tool-originated factory resume.
+       *
+       * @param params Internal parameters for resuming a factory run from a tool.
+       *
+       * @returns Resolved persisted factory identity and resumed run envelope.
+       */
+      resumeFromTool: async (params) => connection.sendRequest("session.factory.resumeFromTool", { sessionId, ...params })
+    },
+    /** @experimental */
     model: {
       /**
        * Resolves and applies organization-managed and repository model overlays.
@@ -2837,6 +2856,11 @@ function registerClientGlobalApiHandlers(connection, handlers) {
     if (!handler) return;
     await handler.event(params);
   });
+  connection.onRequest("gitHubToken.getToken", async (params) => {
+    const handler = handlers.gitHubToken;
+    if (!handler) throw new Error("No gitHubToken client-global handler registered");
+    return handler.getToken(params);
+  });
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/index.js

@@ -27,6 +27,7 @@ __export(index_exports, {
   CopilotWebSocketCloseStatus: () => import_types2.CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder: () => import_types2.CopilotWebSocketForwarder,
   CopilotWebSocketHandler: () => import_types2.CopilotWebSocketHandler,
+  DisableBypassPermissionsModes: () => import_types.DisableBypassPermissionsModes,
   FactoryResumeError: () => import_factory.FactoryResumeError,
   RuntimeConnection: () => import_types.RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS: () => import_types2.SYSTEM_MESSAGE_SECTIONS,
@@ -60,6 +61,7 @@ var import_types2 = require("./types.js");
   CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder,
   CopilotWebSocketHandler,
+  DisableBypassPermissionsModes,
   FactoryResumeError,
   RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS,

package/dist/cjs/session.js

@@ -241,6 +241,7 @@ class CopilotSession {
     this.traceContextProvider = traceContextProvider;
     this.mcpAuthHandler = options?.mcpAuthHandler;
     this.managedSettingsEnabled = options?.managedSettingsEnabled === true;
+    this.onDisconnected = options?.onDisconnected;
   }
   sessionId;
   connection;
@@ -267,6 +268,7 @@ class CopilotSession {
   _capabilities = {};
   openCanvasInstances = [];
   disconnected = false;
+  onDisconnected;
   /** @internal Client session API handlers, populated by CopilotClient during create/resume. */
   clientSessionApis = {};
   /**
@@ -475,7 +477,7 @@ class CopilotSession {
     const unsubscribe = this.on((event) => {
       if (event.type === "assistant.message") {
         lastAssistantMessage = event;
-      } else if (event.type === "session.idle") {
+      } else if (event.type === "session.idle" && event.data.mode !== "autopilot") {
         resolveOutcome({ kind: "idle" });
       } else if (event.type === "session.error") {
         const error = new Error(event.data.message);
@@ -510,7 +512,11 @@ class CopilotSession {
   }
   /** @internal */
   _markDisconnected() {
+    if (this.disconnected) {
+      return;
+    }
     this.disconnected = true;
+    this._runOnDisconnected();
     this.eventHandlers.clear();
     this.typedEventHandlers.clear();
     this.toolHandlers.clear();
@@ -530,6 +536,15 @@ class CopilotSession {
     this.factoryAbortControllers.clear();
     this.transformCallbacks?.clear();
   }
+  /** @internal */
+  _runOnDisconnected() {
+    this.onDisconnected?.();
+    this.onDisconnected = void 0;
+  }
+  /** @internal */
+  _setOnDisconnected(callback) {
+    this.onDisconnected = callback;
+  }
   on(eventTypeOrHandler, handler) {
     if (typeof eventTypeOrHandler === "string" && handler) {
       const eventType = eventTypeOrHandler;

package/dist/cjs/types.js

@@ -22,6 +22,7 @@ __export(types_exports, {
   CopilotWebSocketCloseStatus: () => import_copilotRequestHandler.CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder: () => import_copilotRequestHandler.CopilotWebSocketForwarder,
   CopilotWebSocketHandler: () => import_copilotRequestHandler.CopilotWebSocketHandler,
+  DisableBypassPermissionsModes: () => DisableBypassPermissionsModes,
   RuntimeConnection: () => RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS: () => SYSTEM_MESSAGE_SECTIONS,
   SessionFsSqliteTransactionFailure: () => import_sessionFsProvider2.SessionFsSqliteTransactionFailure,
@@ -165,12 +166,19 @@ const approveAll = (request, invocation) => {
 const defaultJoinSessionPermissionHandler = () => ({
   kind: "no-result"
 });
+const DisableBypassPermissionsModes = {
+  /** Turn off bypass-permissions mode entirely. */
+  Disable: "disable",
+  /** Permit automatic bypass but block full allow-all. */
+  AllowAutoOnly: "allow-auto-only"
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CopilotRequestHandler,
   CopilotWebSocketCloseStatus,
   CopilotWebSocketForwarder,
   CopilotWebSocketHandler,
+  DisableBypassPermissionsModes,
   RuntimeConnection,
   SYSTEM_MESSAGE_SECTIONS,
   SessionFsSqliteTransactionFailure,

package/dist/client.d.ts

@@ -40,6 +40,7 @@ export declare class CopilotClient {
     private builtinPluginDirectories;
     private onGitHubTelemetry?;
     private clientGlobalHandlers;
+    private githubTokenProviders;
     /**
      * Typed server-scoped RPC methods.
      * @throws Error if the client is not connected
@@ -96,6 +97,10 @@ export declare class CopilotClient {
     private validateSessionFsConfig;
     private setupSessionFs;
     private setupClientGlobalHandlers;
+    private acquireGitHubToken;
+    private registerGitHubTokenProvider;
+    private assignGitHubTokenProvider;
+    private commitGitHubTokenProvider;
     /**
      * Starts the CLI server and establishes a connection.
      *
@@ -198,7 +203,8 @@ export declare class CopilotClient {
      *
      * In empty mode, defaults the four overridable feature flags to safe values
      * (caller values from `config` win). `installedPlugins=[]` is unconditional
-     * in empty mode — apps that need custom plugins should switch modes.
+     * in empty mode. `includedBuiltinSkills` defaults to `[]`, but callers can
+     * explicitly allow selected runtime-bundled skills.
      */
     private updateSessionOptionsForMode;
     createSession(config: SessionConfig): Promise<CopilotSession>;