@github/copilot-sdk 1.0.13-preview.6 → 1.0.14-preview.0

package/dist/cjs/generated/rpc.js

@@ -266,13 +266,13 @@ function createServerRpc(connection) {
       /**
        * Enables installed plugins for new sessions.
        *
-       * @param params Plugin names (or specs) to enable.
+       * @param params Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against.
        */
       enable: async (params) => connection.sendRequest("plugins.enable", params),
       /**
        * Disables installed plugins for new sessions.
        *
-       * @param params Plugin names (or specs) to disable.
+       * @param params Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against.
        */
       disable: async (params) => connection.sendRequest("plugins.disable", params),
       /** @experimental */
@@ -438,7 +438,11 @@ function createServerRpc(connection) {
        *
        * @returns Validated device-managed settings discovered before a session exists.
        */
-      read: async () => connection.sendRequest("managedSettings.read", {})
+      read: async () => connection.sendRequest("managedSettings.read", {}),
+      /**
+       * Force-refreshes enterprise managed settings for every account: wipes the persistent server-policy cache (the whole `<cacheHome>/managed-settings` directory) and drops this runtime process's in-memory retained server policy. It does not itself fetch policy — the effect is that the next time a session resolves managed settings for an account, that resolution re-fetches the account's org policy from the network instead of serving a cached response. Note that `managedSettings.read` returns only device/MDM settings and never triggers the account server-policy fetch, so a host implementing "sync account policy" should start a fresh session resolution rather than treat a subsequent `managedSettings.read` as the refreshed org policy. Mirrors the invalidation a sign-out performs, broadened from the one signing-out account to all of them; device/MDM layers describe the machine, not the account, and are left untouched. Rejects if the on-disk cache cannot be removed.
+       */
+      clearCache: async () => connection.sendRequest("managedSettings.clearCache", {})
     },
     /** @experimental */
     runtime: {
@@ -518,7 +522,15 @@ function createServerRpc(connection) {
        */
       list: async (params) => connection.sendRequest("sessions.list", params),
       /**
-       * Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The initial backward read uses a bounded tail scan for fast first paint; cursor continuations preserve the session event-log paging semantics. Persisted events may omit payloads that are reconstructed only for an active session.
+       * Reads client-owned metadata for multiple persisted local sessions without opening them. Results preserve request order and report missing, corrupt, unsupported, or temporarily unavailable sessions independently.
+       *
+       * @param params Bounded batch request for client-owned metadata from persisted local sessions.
+       *
+       * @returns Ordered client metadata outcomes for the requested local sessions.
+       */
+      getClientMetadata: async (params) => connection.sendRequest("sessions.getClientMetadata", params),
+      /**
+       * Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The first read pins the currently opened journal generation and its byte-length boundary; opaque cursor continuations remain on that generation across runtime-owned compaction, truncation, and rewrite operations, which replace the live path atomically, and events appended after the boundary are excluded. For cold hydration, await the first successful page before activation and establish lossless live-event buffering before resume; merge subsequent live events by ID, preserving persisted order and letting live payloads win. Continuations are process-local, single-use capabilities bound to the originating session and storage context and must be paged sequentially; concurrent or repeated use of the same cursor expires that duplicate read rather than reading the generation twice. A complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five idle minutes, with at most eight retained per process and idle-only eviction under pressure; completion and cancelled-worker exit release their handles. No transcript copy is created, but retained handles may keep replaced files' disk blocks alive until release. Pages have a soft 1 MiB serialized event-array budget including resolved binary assets; one oversized event is returned alone to guarantee progress. Working memory also includes a record/lookahead and asset resolution; resolving the first binary reference may scan the full pinned generation to build a bounded offset index. If the snapshot expires, is evicted, is cancelled before a continuation is established, or becomes unreadable after an observable unsupported in-place shortening, the continuation returns cursorStatus 'expired' with an empty terminal page and never falls back to a different generation. A missing or initially unreadable journal is an RPC error. Persisted history excludes ephemeral events and may omit payloads that are reconstructed only for an active session; use the active session event stream for post-resume live events.
        *
        * @param params Pagination options for reading an inactive or active local session's persisted event journal.
        *
@@ -799,7 +811,15 @@ function createSessionRpc(connection, sessionId) {
        *
        * @returns Managed sandbox enforcement state for a session.
        */
-      getEnforcementStatus: async () => connection.sendRequest("session.sandbox.getEnforcementStatus", { sessionId })
+      getEnforcementStatus: async () => connection.sendRequest("session.sandbox.getEnforcementStatus", { sessionId }),
+      /**
+       * Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.
+       *
+       * @param params Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.
+       *
+       * @returns Result of attempting to disable sandboxing for the current session.
+       */
+      disableForSession: async (params) => connection.sendRequest("session.sandbox.disableForSession", { sessionId, ...params })
     },
     /**
      * Aborts the current agent turn.
@@ -963,6 +983,14 @@ function createSessionRpc(connection, sessionId) {
        * @returns Complete current or terminal factory run envelope.
        */
       cancel: async (params) => connection.sendRequest("session.factory.cancel", { sessionId, ...params }),
+      /**
+       * Pauses a running factory and returns its settled run envelope.
+       *
+       * @param params Parameters for pausing a running factory.
+       *
+       * @returns Complete current or terminal factory run envelope.
+       */
+      pause: async (params) => connection.sendRequest("session.factory.pause", { sessionId, ...params }),
       /**
        * Records a batch of ordered factory progress lines.
        *
@@ -1002,9 +1030,9 @@ function createSessionRpc(connection, sessionId) {
     /** @experimental */
     model: {
       /**
-       * Gets the currently selected model for the session.
+       * Gets the session's authoritative model snapshot, including the committed Auto preference and any newer unclaimed Auto preference waiting for a future user turn.
        *
-       * @returns The currently selected model, reasoning effort, and context tier for the session. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
+       * @returns The session's authoritative model snapshot. Auto preference fields are configuration for the virtual `auto` model and do not change the selected model identifier. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.
        */
       getCurrent: async () => connection.sendRequest("session.model.getCurrent", { sessionId }),
       /**
@@ -1015,6 +1043,22 @@ function createSessionRpc(connection, sessionId) {
        * @returns The model identifier active on the session after the switch.
        */
       switchTo: async (params) => connection.sendRequest("session.model.switchTo", { sessionId, ...params }),
+      /**
+       * Requests an Auto preference change without changing the session's selected model. The latest unclaimed request wins; the runtime commits it only after a later prompt using the `auto` model mints a usable model and token pair. A `pending` response confirms that the request was accepted, not that it committed. Observe eventual success through `session.model_change`, failure through the ephemeral `session.auto_tier_switch_failed` event, or current unclaimed state through `session.model.getCurrent`.
+       *
+       * @param params An Auto preference request for the session. This updates Auto configuration only; it does not change the selected model to `auto`.
+       *
+       * @returns Immediate acknowledgement and Auto preference snapshot after a switch request. This result never implies that a pending preference committed.
+       */
+      switchAutoTier: async (params) => connection.sendRequest("session.model.switchAutoTier", { sessionId, ...params }),
+      /**
+       * Replaces or clears the host-supplied model allowlist for a running session.
+       *
+       * @param params Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.
+       *
+       * @returns The applied host allowlist and effective session model policy after intersection.
+       */
+      setAllowedModels: async (params) => connection.sendRequest("session.model.setAllowedModels", { sessionId, ...params }),
       /**
        * Updates the session's reasoning effort without changing the selected model.
        *
@@ -1221,6 +1265,15 @@ function createSessionRpc(connection, sessionId) {
       diff: async (params) => connection.sendRequest("session.workspaces.diff", { sessionId, ...params })
     },
     /** @experimental */
+    autopilotObjective: {
+      /**
+       * Reads the current canonical autopilot objective state for this session.
+       *
+       * @returns Canonical runtime state for the session's current autopilot objective.
+       */
+      getState: async () => connection.sendRequest("session.autopilotObjective.getState", { sessionId })
+    },
+    /** @experimental */
     completions: {
       /**
        * Gets the characters that should trigger host-driven completions for the session. Empty disables host-driven completions (e.g. local sessions, or a relay host that does not advertise them).
@@ -1251,7 +1304,7 @@ function createSessionRpc(connection, sessionId) {
       /**
        * Starts fleet mode by submitting the fleet orchestration prompt to the session.
        *
-       * @param params Optional user prompt to combine with the fleet orchestration instructions.
+       * @param params Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
        *
        * @returns Indicates whether fleet mode was successfully activated.
        */
@@ -1314,6 +1367,22 @@ function createSessionRpc(connection, sessionId) {
        * @returns Background tasks currently tracked by the session.
        */
       list: async () => connection.sendRequest("session.tasks.list", { sessionId }),
+      /**
+       * Registers a client-owned task, or reclaims an orphaned task belonging to the same extension principal.
+       *
+       * @param params Registers or reclaims a client-owned task.
+       *
+       * @returns Result of registering or reclaiming a client-owned task.
+       */
+      register: async (params) => connection.sendRequest("session.tasks.register", { sessionId, ...params }),
+      /**
+       * Publishes generic progress or a terminal outcome for a client-owned task.
+       *
+       * @param params Updates a client-owned task.
+       *
+       * @returns Result of publishing a client-owned task update.
+       */
+      update: async (params) => connection.sendRequest("session.tasks.update", { sessionId, ...params }),
       /**
        * Refreshes metadata for any detached background shells the runtime knows about.
        *
@@ -1777,7 +1846,7 @@ function createSessionRpc(connection, sessionId) {
        */
       set: async (params) => connection.sendRequest("session.tools.set", { sessionId, ...params }),
       /**
-       * Updates the current session's live subagent settings after user settings change. The persisted user settings remain the source of truth for future sessions.
+       * Sets the current session's live subagent settings override, which takes precedence over persisted user settings until cleared. Persisted user settings remain the source of truth for future sessions.
        *
        * @param params Subagent settings to apply to the current session
        *
@@ -2127,6 +2196,20 @@ function createSessionRpc(connection, sessionId) {
        * @returns Point-in-time snapshot of slow-changing session identifier and state fields
        */
       snapshot: async () => connection.sendRequest("session.metadata.snapshot", { sessionId }),
+      /**
+       * Returns the client-owned string metadata persisted with this local session. The metadata is not included in model context, events, telemetry, snapshots, or remote exports.
+       *
+       * @returns Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.
+       */
+      getClientMetadata: async () => connection.sendRequest("session.metadata.getClientMetadata", { sessionId }),
+      /**
+       * Atomically patches the client-owned string metadata persisted with this local session and returns the committed bag.
+       *
+       * @param params Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.
+       *
+       * @returns Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.
+       */
+      updateClientMetadata: async (params) => connection.sendRequest("session.metadata.updateClientMetadata", { sessionId, ...params }),
       /**
        * Reports whether the local session is currently processing user/agent messages.
        *
@@ -2584,7 +2667,13 @@ function createInternalSessionRpc(connection, sessionId) {
        *
        * @returns Resolved persisted factory identity and resumed run envelope.
        */
-      resumeFromTool: async (params) => connection.sendRequest("session.factory.resumeFromTool", { sessionId, ...params })
+      resumeFromTool: async (params) => connection.sendRequest("session.factory.resumeFromTool", { sessionId, ...params }),
+      /**
+       * Atomically pauses an owned factory attempt at a durable checkpoint.
+       *
+       * @param params Parameters for an owned durable pause checkpoint.
+       */
+      pauseAtCheckpoint: async (params) => connection.sendRequest("session.factory.pauseAtCheckpoint", { sessionId, ...params })
     },
     /** @experimental */
     model: {
@@ -2782,6 +2871,11 @@ function registerClientSessionApiHandlers(connection, getHandlers) {
     if (!handler) throw new Error(`No factory handler registered for session: ${params.sessionId}`);
     return handler.abort(params);
   });
+  connection.onRequest("tasks.cancel", async (params) => {
+    const handler = getHandlers(params.sessionId).tasks;
+    if (!handler) throw new Error(`No tasks handler registered for session: ${params.sessionId}`);
+    return handler.cancel(params);
+  });
   connection.onRequest("sessionFs.readFile", async (params) => {
     const handler = getHandlers(params.sessionId).sessionFs;
     if (!handler) throw new Error(`No sessionFs handler registered for session: ${params.sessionId}`);

package/dist/cjs/session.js

@@ -249,6 +249,7 @@ class CopilotSession {
   eventHandlers = /* @__PURE__ */ new Set();
   typedEventHandlers = /* @__PURE__ */ new Map();
   toolHandlers = /* @__PURE__ */ new Map();
+  pendingExternalTools = /* @__PURE__ */ new Map();
   canvases = /* @__PURE__ */ new Map();
   bearerTokenProviders = /* @__PURE__ */ new Map();
   commandHandlers = /* @__PURE__ */ new Map();
@@ -268,6 +269,7 @@ class CopilotSession {
   _capabilities = {};
   openCanvasInstances = [];
   disconnected = false;
+  disconnecting = false;
   onDisconnected;
   /** @internal Client session API handlers, populated by CopilotClient during create/resume. */
   clientSessionApis = {};
@@ -467,6 +469,7 @@ class CopilotSession {
       ...await (0, import_telemetry.getTraceContext)(this.traceContextProvider),
       sessionId: this.sessionId,
       prompt: options.prompt,
+      source: options.source,
       displayPrompt: options.displayPrompt,
       attachments: options.attachments,
       mode: options.mode,
@@ -525,6 +528,10 @@ class CopilotSession {
       return;
     }
     this.disconnected = true;
+    for (const controller of this.pendingExternalTools.values()) {
+      controller.abort();
+    }
+    this.pendingExternalTools.clear();
     this._runOnDisconnected();
     this.eventHandlers.clear();
     this.typedEventHandlers.clear();
@@ -628,6 +635,15 @@ class CopilotSession {
           tracestate
         );
       }
+    } else if (event.type === "external_tool.completed") {
+      const { requestId } = event.data;
+      if (requestId) {
+        const controller = this.pendingExternalTools.get(requestId);
+        if (controller) {
+          this.pendingExternalTools.delete(requestId);
+          controller.abort();
+        }
+      }
     } else if (event.type === "permission.requested") {
       const { requestId, permissionRequest, resolvedByHook } = event.data;
       if (resolvedByHook) {
@@ -708,16 +724,35 @@ class CopilotSession {
    * @internal
    */
   async _executeToolAndRespond(requestId, toolName, toolCallId, args, handler, traceparent, tracestate) {
+    const controller = new AbortController();
+    if (this.disconnected || this.pendingExternalTools.has(requestId)) {
+      return;
+    }
+    this.pendingExternalTools.set(requestId, controller);
     try {
       let availableTools;
       if (toolName === TOOL_SEARCH_TOOL_NAME) {
+        if (controller.signal.aborted) {
+          return;
+        }
+        const aborted = new Promise((resolve) => {
+          controller.signal.addEventListener("abort", () => resolve(void 0), {
+            once: true
+          });
+        });
         try {
-          const metadata = await this.rpc.tools.getCurrentMetadata();
-          availableTools = metadata.tools ?? void 0;
+          const metadata = await Promise.race([
+            this.rpc.tools.getCurrentMetadata(),
+            aborted
+          ]);
+          availableTools = metadata?.tools ?? void 0;
         } catch {
           availableTools = void 0;
         }
       }
+      if (controller.signal.aborted) {
+        return;
+      }
       const rawResult = await handler(args, {
         sessionId: this.sessionId,
         toolCallId,
@@ -725,7 +760,8 @@ class CopilotSession {
         arguments: args,
         availableTools,
         traceparent,
-        tracestate
+        tracestate,
+        signal: controller.signal
       });
       let result;
       if (rawResult == null) {
@@ -737,12 +773,12 @@ class CopilotSession {
       } else {
         result = JSON.stringify(rawResult);
       }
-      if (this.disconnected) {
+      if (!this._claimExternalTool(requestId, controller)) {
         return;
       }
       await this.rpc.tools.handlePendingToolCall({ requestId, result });
     } catch (error) {
-      if (this.disconnected) {
+      if (!this._claimExternalTool(requestId, controller)) {
         return;
       }
       const message = error instanceof Error ? error.message : String(error);
@@ -753,7 +789,19 @@ class CopilotSession {
           throw rpcError;
         }
       }
+    } finally {
+      if (this.pendingExternalTools.get(requestId) === controller) {
+        this.pendingExternalTools.delete(requestId);
+      }
+      controller.abort();
+    }
+  }
+  _claimExternalTool(requestId, controller) {
+    if (this.disconnected || this.pendingExternalTools.get(requestId) !== controller) {
+      return false;
     }
+    this.pendingExternalTools.delete(requestId);
+    return true;
   }
   /**
    * Executes a permission handler and sends the result back via RPC.
@@ -1507,13 +1555,27 @@ class CopilotSession {
    * ```
    */
   async disconnect() {
-    if (this.disconnected) {
+    if (this.disconnected || this.disconnecting) {
       return;
     }
-    await this.connection.sendRequest("session.destroy", {
-      sessionId: this.sessionId
-    });
-    this._markDisconnected();
+    this.disconnecting = true;
+    try {
+      let response = { success: false };
+      for (let attempt = 0; attempt < 2 && !response.success; attempt++) {
+        response = await this.connection.sendRequest("session.detach", {
+          sessionId: this.sessionId
+        });
+      }
+      if (!response.success) {
+        throw new Error(
+          `Failed to disconnect session ${this.sessionId}: ${response.error || "Unknown error"}`
+        );
+      }
+      this._markDisconnected();
+    } catch (error) {
+      this.disconnecting = false;
+      throw error;
+    }
   }
   /** Enables `await using session = ...` syntax for automatic cleanup. */
   async [Symbol.asyncDispose]() {
@@ -1555,11 +1617,48 @@ class CopilotSession {
    * ```typescript
    * await session.setModel("gpt-5.4");
    * await session.setModel("claude-sonnet-4.6", { reasoningEffort: "high" });
+   *
+   * // Select the Auto model and its routing preference in one call.
+   * await session.setModel("auto", { autoTier: "intelligence" });
    * ```
    */
   async setModel(model, options) {
     await this.rpc.model.switchTo({ modelId: model, ...options });
   }
+  /**
+   * Change the Auto routing preference without changing the selected model.
+   *
+   * The runtime does not apply the preference immediately. It records the
+   * request and commits it only when a later user turn using the `auto` model
+   * successfully obtains a usable model from the provider. A `pending` status
+   * therefore confirms that the request was accepted, not that it took effect.
+   *
+   * Watch for the outcome through the `session.model_change` event on success,
+   * or the ephemeral `session.auto_tier_switch_failed` event on failure. You
+   * can also read the current committed and in-flight state at any time with
+   * `session.rpc.model.getCurrent()`.
+   *
+   * Only the most recent request survives: issuing a new request replaces any
+   * earlier one that has not yet been claimed by a turn.
+   *
+   * @param autoTier - Routing preference to activate, or `null` to return to
+   *   the provider's default Auto routing
+   * @returns The runtime's immediate acknowledgement and Auto preference snapshot
+   *
+   * @experimental Part of an experimental Auto routing surface and may change
+   * or be removed in a future release.
+   *
+   * @example
+   * ```typescript
+   * const result = await session.setAutoTier("intelligence");
+   * if (result.status === "pending") {
+   *     // Takes effect on a later turn that uses the `auto` model.
+   * }
+   * ```
+   */
+  async setAutoTier(autoTier) {
+    return await this.rpc.model.switchAutoTier({ autoTier });
+  }
   /**
    * Log a message to the session timeline.
    * The message appears in the session event stream and is visible to SDK consumers

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.83-3";
+export declare const COPILOT_CLI_VERSION = "1.0.84-5";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.83-3";
+const COPILOT_CLI_VERSION = "1.0.84-5";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/client.d.ts

@@ -7,10 +7,13 @@ export declare class CopilotClient {
     private ffiHost;
     private connection;
     private messageWriter;
+    private connectionClosed;
     private socket;
     private runtimePort;
     private actualHost;
     private state;
+    /** Shared in-flight start; concurrent callers await it instead of spawning another CLI. */
+    private startPromise;
     private sessions;
     private stderrBuffer;
     /** Resolved connection mode chosen in the constructor. */
@@ -121,6 +124,7 @@ export declare class CopilotClient {
      * ```
      */
     start(): Promise<void>;
+    private doStart;
     /**
      * Stops the CLI server and closes all active sessions.
      *

package/dist/client.js

@@ -214,10 +214,13 @@ class CopilotClient {
   ffiHost = null;
   connection = null;
   messageWriter = null;
+  connectionClosed = false;
   socket = null;
   runtimePort = null;
   actualHost = "localhost";
   state = "disconnected";
+  /** Shared in-flight start; concurrent callers await it instead of spawning another CLI. */
+  startPromise = null;
   sessions = /* @__PURE__ */ new Map();
   stderrBuffer = "";
   // Captures CLI stderr for error messages
@@ -595,7 +598,19 @@ class CopilotClient {
     if (this.state === "connected") {
       return;
     }
+    if (this.startPromise) {
+      return this.startPromise;
+    }
+    this.startPromise = this.doStart();
+    try {
+      await this.startPromise;
+    } finally {
+      this.startPromise = null;
+    }
+  }
+  async doStart() {
     this.forceStopping = false;
+    this.connectionClosed = false;
     this.processTransportError = null;
     this.state = "connecting";
     try {
@@ -694,7 +709,7 @@ class CopilotClient {
     }
     this.sessions.clear();
     this.githubTokenProviders.clear();
-    if (this.connection && (this.cliProcess || this.ffiHost) && !this.isExternalServer) {
+    if (this.connection && !this.connectionClosed && (this.cliProcess || this.ffiHost) && !this.isExternalServer) {
       const runtimeShutdownStart = Date.now();
       const shutdownPromise = this.rpc.runtime.shutdown();
       void shutdownPromise.catch(() => void 0);
@@ -783,7 +798,7 @@ class CopilotClient {
       const host = this.ffiHost;
       this.ffiHost = null;
       try {
-        host.dispose();
+        await host.dispose();
       } catch (error) {
         errors.push(
           new Error(
@@ -878,11 +893,12 @@ class CopilotClient {
       this.cliProcess = null;
     }
     if (this.ffiHost) {
+      const host = this.ffiHost;
+      this.ffiHost = null;
       try {
-        this.ffiHost.dispose();
+        await host.dispose();
       } catch {
       }
-      this.ffiHost = null;
     }
     if (this.cliStartTimeout) {
       clearTimeout(this.cliStartTimeout);
@@ -1199,6 +1215,7 @@ class CopilotClient {
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
+        authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
         customAgents: toWireCustomAgents(config.customAgents),
         customAgentsLocalOnly: config.customAgentsLocalOnly,
@@ -1259,6 +1276,7 @@ class CopilotClient {
       await this.updateSessionOptionsForMode(session, config);
       this.commitGitHubTokenProvider(returnedSessionId, gitHubTokenProviderRegistrationId);
     } catch (e) {
+      session?._markDisconnected();
       if (registeredId !== void 0) {
         this.sessions.delete(registeredId);
       }
@@ -1443,6 +1461,7 @@ class CopilotClient {
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
+        authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
         customAgents: toWireCustomAgents(config.customAgents),
         customAgentsLocalOnly: config.customAgentsLocalOnly,
@@ -1491,6 +1510,7 @@ class CopilotClient {
       await this.updateSessionOptionsForMode(session, config);
       this.commitGitHubTokenProvider(sessionId, gitHubTokenProviderRegistrationId);
     } catch (e) {
+      session._markDisconnected();
       this.sessions.delete(sessionId);
       if (gitHubTokenProviderRegistrationId !== void 0) {
         this.githubTokenProviders.delete(gitHubTokenProviderRegistrationId);
@@ -1606,7 +1626,10 @@ class CopilotClient {
     const raceAgainstExit = (p) => this.processExitPromise ? Promise.race([p, this.processExitPromise]) : p;
     let serverVersion;
     try {
-      const connectParams = { token: this.effectiveConnectionToken };
+      const connectParams = {
+        token: this.effectiveConnectionToken,
+        supportedTaskKinds: ["agent", "client", "shell"]
+      };
       if (this.onGitHubTelemetry != null) {
         connectParams.enableGitHubTelemetryForwarding = true;
       }
@@ -2237,12 +2260,24 @@ stderr: ${stderrOutput}` : ""}`
         return await this.handleHooksInvoke(params);
       }
     );
-    this.connection.onClose(() => {
+    const connection = this.connection;
+    const markDisconnected = () => {
+      if (this.connection !== connection) {
+        return;
+      }
+      this.connectionClosed = true;
       this.state = "disconnected";
+      for (const session of this.sessions.values()) {
+        session._markDisconnected();
+      }
+      this.sessions.clear();
       this.githubTokenProviders.clear();
-    });
-    this.connection.onError((_error) => {
-      this.state = "disconnected";
+    };
+    this.connection.onClose(markDisconnected);
+    this.connection.onError(() => {
+      if (this.connection === connection) {
+        this.state = "disconnected";
+      }
     });
   }
   handleSessionEventNotification(notification) {

package/dist/ffiRuntimeHost.d.ts

@@ -4,12 +4,16 @@ export declare class FfiRuntimeHost {
     private readonly cliEntrypoint;
     private readonly environment;
     private readonly args;
+    private static readonly quarantinedHosts;
     private readonly lib;
     private serverId;
     private connectionId;
     private disposed;
+    private starting;
     private outboundCallback;
     private keepAliveTimer;
+    private cleanupRetryTimer;
+    private cleanupInProgress;
     /** The stream JSON-RPC reads server→client frames from. */
     readonly receiveStream: PassThrough;
     /** The stream JSON-RPC writes client→server frames to. */
@@ -30,6 +34,8 @@ export declare class FfiRuntimeHost {
      */
     private feedInbound;
     private unregisterCallback;
-    /** Closes the FFI connection, shuts down the native host, and releases resources. */
-    dispose(): void;
+    private scheduleCleanupRetry;
+    private tryFinalizeCleanup;
+    /** Awaits the initial cleanup attempt; a non-quiescent close is retried in the background. */
+    dispose(): Promise<void>;
 }