@github/copilot-sdk 1.0.13 → 1.0.14-preview.1

package/dist/generated/rpc.d.ts

@@ -3,7 +3,7 @@
  * Generated from: api.schema.json
  */
 import type { MessageConnection } from "vscode-jsonrpc/node.js";
-import type { AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus, ModelChangeSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, RemediationAction, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UserToolSessionApproval, Verbosity } from "./session-events.js";
+import type { AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus, ModelChangeSource, PermissionDecisionSource, PermissionMode, PermissionPromptRequest, PermissionRule, ReasoningSummary, RemediationAction, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UserToolSessionApproval, Verbosity } from "./session-events.js";
 /** A value that can be represented losslessly on the SDK JSON wire. */
 export type JsonValue = null | boolean | number | string | JsonValue[] | {
     [key: string]: JsonValue;
@@ -331,6 +331,124 @@ export type CardDigestValue = string;
  */
 /** @experimental */
 export type CatalogCandidateSource = CatalogCandidateSourceUrl | CatalogCandidateSourceEmbedded;
+/**
+ * A versioned, bounded trust observation carried unchanged with a catalog candidate and its private handle context. Current observations require a recognised T1/T2 tier; every non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent Finder supplies no exposure decision, and states absent from its current wire are never inferred from age, relevance, popularity, or a tier transition.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshot".
+ */
+/** @experimental */
+export type CatalogTrustSnapshot = CatalogTrustSnapshotCurrent | CatalogTrustSnapshotAbsent | CatalogTrustSnapshotStale | CatalogTrustSnapshotDowngraded | CatalogTrustSnapshotRevoked | CatalogTrustSnapshotUnsupported | CatalogTrustSnapshotMalformed;
+/**
+ * Schema version of the catalogue trust snapshot envelope
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotSchemaVersion".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotSchemaVersion = 
+/** Initial envelope carrying one bounded service tier or one explicit unavailable state. */
+"v1";
+/**
+ * A recognised T1 or T2 service tier was observed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotCurrentStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotCurrentStatus = "current";
+/**
+ * Service-computed trust tier currently emitted by Agent Finder. It is independent of search score, popularity, and client-side ranking.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustTier".
+ */
+/** @experimental */
+export type CatalogTrustTier = 
+/** Tier one as assigned by the catalogue authority. */
+"T1"
+/** Tier two as assigned by the catalogue authority. */
+ | "T2";
+/**
+ * Authority-computed exposure eligibility, kept separate from tier. The current tier-only Agent Finder response maps to `unknown`, never to a locally inferred eligibility.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustEligibility".
+ */
+/** @experimental */
+export type CatalogTrustEligibility = 
+/** Eligible for default catalogue exposure. */
+"default"
+/** Eligible only when expanded or community results are requested. */
+ | "expanded"
+/** Not eligible for normal catalogue exposure. */
+ | "hidden"
+/** The authority did not supply an eligibility decision. */
+ | "unknown";
+/**
+ * Bounded authority that supplied a catalogue trust observation
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSource".
+ */
+/** @experimental */
+export type CatalogTrustSource = 
+/** GitHub Agent Finder supplied the trust field on its search result. */
+"agent-finder";
+/**
+ * The authority omitted trust metadata.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotAbsentStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotAbsentStatus = "absent";
+/**
+ * The authority explicitly marked its assessment stale.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotStaleStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotStaleStatus = "stale";
+/**
+ * The authority explicitly reported a downgraded assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotDowngradedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotDowngradedStatus = 
+/** The authority explicitly reported a downgraded assessment. */
+"downgraded";
+/**
+ * The authority explicitly revoked its assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotRevokedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotRevokedStatus = "revoked";
+/**
+ * The authority supplied a bounded trust value this runtime does not understand.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotUnsupportedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotUnsupportedStatus = 
+/** The authority supplied a bounded trust value this runtime does not understand. */
+"unsupported";
+/**
+ * The trust field was empty, unbounded, or had the wrong JSON type.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotMalformedStatus".
+ */
+/** @experimental */
+export type CatalogTrustSnapshotMalformedStatus = 
+/** The trust field was empty, unbounded, or had the wrong JSON type. */
+"malformed";
 /**
  * Why the catalog authority did not accept the caller's identity
  *
@@ -406,7 +524,9 @@ export type CatalogCapability =
 /** Understands side-effect-free MCP install-plan requests, results, and plan handles; `planning-unavailable` separately reports that planning is not enabled. */
  | "mcp-install-planning"
 /** Understands plans that enumerate every eligible transport rather than a single preferred one. */
- | "multiple-transport-choice";
+ | "multiple-transport-choice"
+/** Understands versioned candidate trust snapshots. Protocol-3 callers must require this capability before the runtime adds the optional snapshot field. */
+ | "trust-snapshot";
 /**
  * Bounded extensible wire-feature identifier. Known values are described by `CatalogCapability`; newer callers may send future identifiers so an older runtime can return a typed negotiation refusal instead of failing schema validation. Capability negotiation establishes contract understanding, while each operation's result separately reports runtime availability.
  *
@@ -977,16 +1097,16 @@ export type EventsReadDirection =
 /** Tail-first: return the newest events and page toward older events. */
  | "backward";
 /**
- * Cursor status: 'ok' means the cursor was applied successfully; 'expired' means the cursor referred to an event that no longer exists in history (e.g. truncated or compacted away) and the read fell back to a boundary of the remaining history (the beginning for a forward read, the tail for a backward read). The fallback page is a fresh boundary snapshot, not a continuation of the requested cursor, so it may overlap already-rendered events; on 'expired' a consumer should reset/rebase its pagination state (or deduplicate by event id) before continuing from the returned cursor.
+ * Cursor status: 'ok' means the read succeeded against the requested history; 'expired' means the requested continuation is unavailable. Recovery is endpoint-specific: session.eventLog.read returns a boundary window of remaining active history that may overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page and never switches journal generations. An expired persisted read is not successful completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "EventsCursorStatus".
  */
 /** @experimental */
 export type EventsCursorStatus = 
-/** The cursor was applied successfully. */
+/** The read succeeded against the requested history. */
 "ok"
-/** The cursor referred to history that is no longer available. */
+/** The requested continuation is unavailable; see the endpoint's recovery semantics. */
  | "expired";
 /**
  * Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/<id>/extensions/)
@@ -1114,6 +1234,8 @@ export type FactoryRunStatus =
  | "completed"
 /** The run was interrupted while resource budget remained. */
  | "halted"
+/** The current attempt stopped intentionally and the run may be resumed. */
+ | "paused"
 /** The run was cancelled before completion. */
  | "cancelled"
 /** The factory body failed or reached a cumulative resource ceiling. */
@@ -1131,6 +1253,10 @@ export type FactoryRunFailure = {
      * Approved effective ceiling that was reached.
      */
     value: number;
+    /**
+     * Suggested larger ceiling when the runtime can derive one safely.
+     */
+    suggestedValue?: number;
     /**
      * Factory run identifier.
      */
@@ -1203,6 +1329,28 @@ export type FactoryRunFailureKind =
  | "timeoutSeconds"
 /** The run's settled subagent model usage exceeded the approved AI-credit ceiling, or no headroom remained for another subagent. */
  | "maxAiCredits";
+/**
+ * Durable metadata describing who initiated a factory pause.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "FactoryPauseInfo".
+ */
+/** @experimental */
+export type FactoryPauseInfo = {
+    /**
+     * Factory pause initiator discriminator.
+     */
+    type: "user";
+} | {
+    /**
+     * Stable author-defined checkpoint key that initiated the pause.
+     */
+    key: string;
+    /**
+     * Factory pause initiator discriminator.
+     */
+    type: "checkpoint";
+};
 /**
  * Kind of factory progress line.
  *
@@ -1215,6 +1363,18 @@ export type FactoryLogLineKind =
 "log"
 /** A named factory phase marker. */
  | "phase";
+/**
+ * Action the runtime selected for a durable factory pause checkpoint.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "FactoryPauseCheckpointAction".
+ */
+/** @experimental */
+export type FactoryPauseCheckpointAction = 
+/** The checkpoint was committed by a prior paused attempt, so execution may continue. */
+"continue"
+/** This attempt claimed the checkpoint and must cooperatively stop. */
+ | "pause";
 /**
  * Derived lifecycle state of a factory phase.
  *
@@ -2468,22 +2628,6 @@ export type PermissionDecisionOutcome =
  | "autopilot_denied"
 /** The response came from an interactive user prompt. */
  | "prompted_user";
-/**
- * Controlled reason or actor responsible for a permission response.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "PermissionDecisionSource".
- */
-/** @experimental */
-export type PermissionDecisionSource = 
-/** The response followed the assisted-approval judge recommendation. */
-"assisted_approval"
-/** A human supplied the response through an interactive prompt. */
- | "human_response"
-/** The host applied a standing policy or override rather than a judge recommendation or human decision. */
- | "host_policy"
-/** The host denied the request because no interactive user response was available. */
- | "unattended_fallback";
 /**
  * Client surface that submitted a permission response.
  *
@@ -3214,6 +3358,68 @@ export type SessionsOpenProgressStatus =
 "in-progress"
 /** The step has completed successfully. */
  | "complete";
+/**
+ * Client metadata outcome for one requested local session.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SessionsClientMetadataEntry".
+ */
+/** @experimental */
+export type SessionsClientMetadataEntry = {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    metadata: ClientMetadata;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "ok";
+} | {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "notFound";
+} | {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "corrupt";
+} | {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "unsupportedVersion";
+} | {
+    /**
+     * Requested session ID.
+     */
+    sessionId: string;
+    /**
+     * Filesystem or provider error code. Clients should not assume every provider uses operating-system error codes.
+     */
+    code: string;
+    /**
+     * Human-readable diagnostic message. Not stable for programmatic matching.
+     */
+    message: string;
+    /**
+     * Client metadata outcome discriminator.
+     */
+    status: "unavailable";
+};
 /**
  * Authentication credentials accepted by session.gitHubAuth.setCredentials. Session-owned token-provider identities cannot be installed through this method.
  *
@@ -3268,6 +3474,14 @@ export type SessionSettingsPredicateName =
  | "trivialChangeEnabledForTool"
 /** Whether trivial-change skip behavior is enabled for a specific tool. */
  | "trivialChangeSkipEnabledForTool";
+/**
+ * Ordered client metadata outcomes for the requested local sessions.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SessionsGetClientMetadataResult".
+ */
+/** @experimental */
+export type SessionsGetClientMetadataResult = SessionsClientMetadataEntry[];
 /**
  * Which session sources to include. Defaults to `local` for backward compatibility.
  *
@@ -3899,11 +4113,15 @@ export interface CopilotUserResponse {
      */
     organization_login_list?: string[];
     /**
-     * Organizations the user belongs to, each with an optional login and display name.
+     * Organizations the user belongs to, each with an optional ID, login, and display name.
      */
     organization_list?: ({
         [k: string]: unknown | undefined;
     } | ({
+        /**
+         * Numeric database ID of the organization.
+         */
+        id?: number;
         /**
          * GitHub login of the organization.
          */
@@ -4582,6 +4800,10 @@ export interface AgentInfo {
      * Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only.
      */
     userInvocable?: boolean;
+    /**
+     * Whether model-driven invocation is disabled for this agent.
+     */
+    disableModelInvocation?: boolean;
     /**
      * Allowed tool names for this agent. Empty array means none; omitted means inherit defaults.
      */
@@ -5591,6 +5813,7 @@ export interface CatalogAiSkillCandidate {
     publisher?: string;
     source: CatalogCandidateSource;
     provenance: CatalogAiSkillCandidateProvenance;
+    trust?: CatalogTrustSnapshot;
 }
 /**
  * Candidate whose card is retrieved from a URL through the runtime's hardened fetch boundary.
@@ -5643,6 +5866,112 @@ export interface CatalogAiSkillCandidateProvenance {
      */
     mediaType: "application/ai-skill";
 }
+/**
+ * A recognised current Agent Finder T1 or T2 trust tier.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotCurrent".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotCurrent {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotCurrentStatus;
+    tier: CatalogTrustTier;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Where and when the runtime observed the trust metadata. Observation time is not the authority's evaluation time and must not be used to infer staleness.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustProvenance".
+ */
+/** @experimental */
+export interface CatalogTrustProvenance {
+    source: CatalogTrustSource;
+    /**
+     * ISO 8601 timestamp with a timezone offset at which the runtime observed the search result carrying this trust field.
+     */
+    observedAt: string;
+}
+/**
+ * Discriminator: the authority omitted trust metadata.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotAbsent".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotAbsent {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotAbsentStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority explicitly marked the assessment stale.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotStale".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotStale {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotStaleStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority explicitly reported a downgraded assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotDowngraded".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotDowngraded {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotDowngradedStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority explicitly revoked the assessment.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotRevoked".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotRevoked {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotRevokedStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the authority supplied a bounded trust value this runtime does not understand.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotUnsupported".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotUnsupported {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotUnsupportedStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
+/**
+ * Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogTrustSnapshotMalformed".
+ */
+/** @experimental */
+export interface CatalogTrustSnapshotMalformed {
+    schemaVersion: CatalogTrustSnapshotSchemaVersion;
+    status: CatalogTrustSnapshotMalformedStatus;
+    eligibility: CatalogTrustEligibility;
+    provenance: CatalogTrustProvenance;
+}
 /**
  * An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.
  *
@@ -5697,6 +6026,7 @@ export interface CatalogMcpServerCandidate {
     publisher?: string;
     source: CatalogCandidateSource;
     provenance: CatalogMcpServerCandidateProvenance;
+    trust?: CatalogTrustSnapshot;
 }
 /**
  * Where and when an MCP server catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.
@@ -5848,9 +6178,11 @@ export interface CatalogNegotiationRefusedError {
      */
     minimumSupportedProtocolVersion: number;
     /**
-     * Every wire feature this runtime understands, so the caller can retry within that contract. This list does not imply that every deployment has enabled every operation.
+     * Capabilities this runtime can safely advertise to this caller. The complete five-capability protocol-3 legacy set is always present; every capability added after that baseline appears only when the caller required it, so an older closed-enum decoder can still consume a refusal. This list does not imply that every deployment has enabled every operation.
+     *
+     * @maxItems 32
      */
-    supportedCapabilities: CatalogCapability[];
+    supportedCapabilities: CatalogCapabilityId[];
     /**
      * The subset of the caller's bounded extensible capability identifiers this runtime cannot honour.
      *
@@ -6056,6 +6388,16 @@ export interface CatalogUnavailableTransportError {
      */
     message: string;
 }
+/**
+ * Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ClientMetadata".
+ */
+/** @experimental */
+export interface ClientMetadata {
+    [k: string]: string | undefined;
+}
 /**
  * Runtime-to-owner cancellation request for a client-owned task.
  *
@@ -6882,11 +7224,73 @@ export interface DiscoveredMcpServer {
      * Plugin version that provided this server, when source is plugin.
      */
     sourcePluginVersion?: string;
+    effectiveSource?: McpSourceRef;
     /**
      * Whether the server is enabled (not in the disabled list)
      */
     enabled: boolean;
 }
+/**
+ * Canonical identity and location of the effective MCP server declaration. The declaration is uniquely addressed by this source id together with the discovered server name.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpSourceRef".
+ */
+/** @experimental */
+export interface McpSourceRef {
+    /**
+     * Open source-kind identifier. Known values include user, workspace, invocation, plugin, builtin, and device-registry.
+     */
+    kind: string;
+    /**
+     * Opaque stable identity for the configuration source. Clients must not parse this value.
+     */
+    id: string;
+    /**
+     * Open semantic editability identifier. Known values are editable and read-only.
+     */
+    editability: string;
+    file?: McpSourceFile;
+    plugin?: McpSourcePlugin;
+}
+/**
+ * Concrete configuration file containing an MCP server declaration.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpSourceFile".
+ */
+/** @experimental */
+export interface McpSourceFile {
+    /**
+     * Canonical file URI for the configuration document
+     */
+    uri: string;
+    /**
+     * RFC 6901 JSON Pointer to the server declaration, when known
+     */
+    jsonPointer?: string;
+}
+/**
+ * Plugin identity associated with an MCP server declaration.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpSourcePlugin".
+ */
+/** @experimental */
+export interface McpSourcePlugin {
+    /**
+     * Canonical plugin identity
+     */
+    id: string;
+    /**
+     * Human-readable plugin name, when available
+     */
+    name?: string;
+    /**
+     * Plugin version, when available
+     */
+    version?: string;
+}
 /**
  * Slash-prefixed command string to enqueue for FIFO processing.
  *
@@ -6994,7 +7398,7 @@ export interface EventsReadResult {
      */
     cursor: string;
     /**
-     * True when more events are available in the read's direction. For a forward read, true means the batch returned `max` events and more are available immediately. For a backward read, true means older persisted events remain before the returned window.
+     * True when more events are available in the read's direction. For a backward read, true means older persisted events remain before the returned window. A persisted-event page may contain fewer than `max` events because of its byte budget while still reporting hasMore true; continue according to this flag rather than the event count.
      */
     hasMore: boolean;
     cursorStatus: EventsCursorStatus;
@@ -7452,6 +7856,10 @@ export interface FactoryAbortRequest {
      * Factory run identifier.
      */
     runId: string;
+    /**
+     * Opaque token identifying the execution attempt to abort.
+     */
+    executionToken: string;
 }
 /**
  * Acknowledgement that a factory request was accepted.
@@ -7483,12 +7891,12 @@ export interface FactoryAgentOptions {
      */
     model?: string;
     /**
-     * Optional reasoning effort for the subagent. This field is accepted but not yet honored.
+     * Optional reasoning effort override for the subagent.
      */
     reasoningEffort?: string;
     contextTier?: ContextTier;
     /**
-     * Optional custom agent name for the subagent. This field is accepted but not yet honored.
+     * Optional built-in or custom agent name whose definition configures the subagent.
      */
     agent?: string;
 }
@@ -7919,6 +8327,10 @@ export interface FactoryRunSummary {
      * Terminal run outcome, or null while nonterminal.
      */
     terminal: FactoryRunTerminal | null;
+    /**
+     * Whether the durable run state currently passes runtime resume eligibility checks.
+     */
+    canResume: boolean;
 }
 /**
  * Durable factory resource consumption.
@@ -7962,6 +8374,10 @@ export interface FactoryRunTerminal {
      * Prompt-safe preview of the completed result.
      */
     resultPreview?: string;
+    /**
+     * Pause initiator metadata, or null when the run did not pause.
+     */
+    pauseInfo: FactoryPauseInfo | null;
 }
 /**
  * One ordered factory progress line.
@@ -8002,6 +8418,44 @@ export interface FactoryLogRequest {
      */
     lines: FactoryLogLine[];
 }
+/**
+ * Parameters for an owned durable pause checkpoint.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "FactoryPauseCheckpointRequest".
+ */
+/** @experimental */
+export interface FactoryPauseCheckpointRequest {
+    /**
+     * Factory run identifier.
+     */
+    runId: string;
+    /**
+     * Opaque token identifying the execution attempt that reached the checkpoint.
+     */
+    executionToken: string;
+    /**
+     * Stable author-defined checkpoint key.
+     */
+    key: string;
+}
+/** @experimental */
+export interface FactoryPauseCheckpointResult {
+    action: FactoryPauseCheckpointAction;
+}
+/**
+ * Parameters for pausing a running factory.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "FactoryPauseRequest".
+ */
+/** @experimental */
+export interface FactoryPauseRequest {
+    /**
+     * Factory run identifier.
+     */
+    runId: string;
+}
 /**
  * Durable lifecycle and timing for one factory phase.
  *
@@ -8156,19 +8610,19 @@ export interface FactoryRunLimits {
     /**
      * Maximum number of factory subagents that may run concurrently.
      */
-    maxConcurrentSubagents?: number;
+    maxConcurrentSubagents?: number | null;
     /**
      * Maximum total number of factory subagents that may be admitted.
      */
-    maxTotalSubagents?: number;
+    maxTotalSubagents?: number | null;
     /**
      * Maximum accumulated active-execution time in seconds. Active execution includes the entire extension body, subprocess waits, queued-agent waits, and sleeps; time between resumed attempts is not counted.
      */
-    timeoutSeconds?: number;
+    timeoutSeconds?: number | null;
     /**
      * Maximum AI credits consumed by factory subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops.
      */
-    maxAiCredits?: number;
+    maxAiCredits?: number | null;
 }
 /**
  * Resolved persisted factory identity and resumed run envelope.
@@ -8218,6 +8672,7 @@ export interface FactoryRunResult {
      * Partial journal and progress snapshot for a halted, cancelled, or errored run.
      */
     snapshot?: JsonValue;
+    pauseInfo?: FactoryPauseInfo;
 }
 /**
  * Full factory run observability detail.
@@ -8294,6 +8749,10 @@ export interface FactoryRunDetail {
      * Terminal run outcome, or null while nonterminal.
      */
     terminal: FactoryRunTerminal | null;
+    /**
+     * Whether the durable run state currently passes runtime resume eligibility checks.
+     */
+    canResume: boolean;
     /**
      * Lifecycle and timing observations for each factory phase.
      */
@@ -8345,7 +8804,7 @@ export interface RunOptions {
     resumeFromRunId?: string;
 }
 /**
- * Optional user prompt to combine with the fleet orchestration instructions.
+ * Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "FleetStartRequest".
@@ -8356,6 +8815,14 @@ export interface FleetStartRequest {
      * Optional user prompt to combine with fleet instructions
      */
     prompt?: string;
+    /**
+     * Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request
+     */
+    attachments?: Attachment[];
+    /**
+     * If true, await completion of the agentic loop for this fleet request before returning. Defaults to false.
+     */
+    wait?: boolean;
 }
 /**
  * Indicates whether fleet mode was successfully activated.
@@ -10404,6 +10871,10 @@ export interface McpDiscoverRequest {
      * Working directory used as context for discovery (e.g., plugin resolution)
      */
     workingDirectory?: string;
+    /**
+     * Whether to include canonical effectiveSource metadata for each discovered server. Callers must opt in so protocol-3 clients retain the legacy closed response shape.
+     */
+    includeEffectiveSource?: boolean;
 }
 /**
  * MCP servers discovered from user, workspace, plugin, and built-in sources.
@@ -11923,6 +12394,31 @@ export interface MetadataSnapshotRemoteMetadataRepository {
      */
     branch: string;
 }
+/**
+ * Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "MetadataUpdateClientMetadataRequest".
+ */
+/** @experimental */
+export interface MetadataUpdateClientMetadataRequest {
+    /**
+     * Remove every existing client metadata entry before applying remove and set. Defaults to false.
+     */
+    clear?: boolean;
+    /**
+     * Case-sensitive keys to remove. Missing keys are ignored. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces.
+     *
+     * @maxItems 128
+     */
+    remove?: string[];
+    /**
+     * String entries to add or replace. Set wins when a key also appears in remove. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Each value may contain at most 16 KiB of UTF-8 data.
+     */
+    set?: {
+        [k: string]: string | undefined;
+    };
+}
 /**
  * Copilot model metadata, including identifier, display name, capabilities, policy, billing, reasoning efforts, and picker categories.
  *
@@ -12259,6 +12755,10 @@ export interface ModelApplyStartupOverlayRequest {
      * Context tier selected by repository settings, when configured.
      */
     repoContextTier?: string;
+    /**
+     * Auto routing preference selected by repository settings, when configured. Applied only when the overlay selects the Auto model; beside a concrete model it stays dormant.
+     */
+    repoAutoTier?: string;
     /**
      * Model explicitly selected by the CLI, when provided.
      */
@@ -12386,6 +12886,44 @@ export interface ModelPickerSettingsContext {
      */
     environment: {};
 }
+/**
+ * Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelSetAllowedModelsRequest".
+ */
+/** @experimental */
+export interface ModelSetAllowedModelsRequest {
+    /**
+     * Exact model IDs to permit, or null to clear the host restriction.
+     */
+    allowedModels?: string[] | null;
+}
+/**
+ * The applied host allowlist and effective session model policy after intersection.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ModelSetAllowedModelsResult".
+ */
+/** @experimental */
+export interface ModelSetAllowedModelsResult {
+    /**
+     * Normalized host allowlist. Omitted when the host restriction was cleared, or when a relay client does not return the host policy.
+     */
+    allowedModels?: string[];
+    /**
+     * Effective exact IDs or repository policy patterns after applying the host restriction. Omitted by relay clients that do not return the host policy.
+     */
+    effectiveAllowedModels?: string[];
+    /**
+     * Effective deterministic fallback model, when the policy defines one.
+     */
+    fallbackModel?: string;
+    /**
+     * Selected session model after reconciling a now-disallowed concrete selection.
+     */
+    modelId?: string;
+}
 /**
  * Reasoning effort level to apply to the currently selected model.
  *
@@ -12574,6 +13112,7 @@ export interface ModelSwitchToResult {
 /** @experimental */
 export interface ModeSetRequest {
     mode: SessionMode;
+    expectedMode?: SessionMode;
     /**
      * Session whose plan-mode base state should be inherited.
      */
@@ -12628,6 +13167,10 @@ export interface ModeSetResult {
      * Whether applying the mode changed the active model.
      */
     modelChanged: boolean;
+    /**
+     * Whether the requested mode was applied to the session. False only when an 'expectedMode' precondition did not hold, in which case any model change reported alongside it was still applied.
+     */
+    modeApplied?: boolean;
     confirmation?: ModelSwitchConfirmation;
     /**
      * User-facing warning produced while applying the mode change.
@@ -14552,7 +15095,7 @@ export interface PluginsBuiltinSetRequest {
     paths: string[];
 }
 /**
- * Plugin names (or specs) to disable.
+ * Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "PluginsDisableRequest".
@@ -14563,9 +15106,13 @@ export interface PluginsDisableRequest {
      * Plugin names or "plugin@marketplace" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins.
      */
     names: string[];
+    /**
+     * Working directory whose repository `enabledPlugins` overlay decides whether this mutation is repository-controlled. Hosts that serve sessions across several repositories (the SDK server) should pass the session's directory; otherwise the guard is evaluated against the server process's own working directory, which may belong to a different repository. Defaults to the server's current working directory.
+     */
+    workingDirectory?: string;
 }
 /**
- * Plugin names (or specs) to enable.
+ * Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "PluginsEnableRequest".
@@ -14576,6 +15123,10 @@ export interface PluginsEnableRequest {
      * Plugin names or "plugin@marketplace" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API.
      */
     names: string[];
+    /**
+     * Working directory whose repository `enabledPlugins` overlay decides whether this mutation is repository-controlled. Hosts that serve sessions across several repositories (the SDK server) should pass the session's directory; otherwise the guard is evaluated against the server process's own working directory, which may belong to a different repository. Defaults to the server's current working directory.
+     */
+    workingDirectory?: string;
 }
 /**
  * Plugin source and optional working directory for relative-path resolution.
@@ -16437,6 +16988,37 @@ export interface SandboxConfigAuth {
      */
     gh?: boolean;
 }
+/**
+ * Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxDisableForSessionRequest".
+ */
+/** @experimental */
+export interface SandboxDisableForSessionRequest {
+    /**
+     * Identifier of the exact pending sandbox-bypass permission request that authorized the session opt-out.
+     */
+    requestId: string;
+    decisionContext?: PermissionDecisionContext;
+}
+/**
+ * Result of attempting to disable sandboxing for the current session.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxDisableForSessionResult".
+ */
+/** @experimental */
+export interface SandboxDisableForSessionResult {
+    /**
+     * Whether this call resolved the pending request and applied the session opt-out.
+     */
+    success: boolean;
+    /**
+     * The authoritative sandbox enabled state after the operation.
+     */
+    enabled: boolean;
+}
 /**
  * Managed sandbox enforcement state for a session.
  *
@@ -17098,7 +17680,7 @@ export interface SessionEnrichMetadataResult {
     sessions: LocalSessionMetadataValue[];
 }
 /**
- * File path, content to append, and optional mode for the client-provided session filesystem.
+ * File path, content to append, and optional mode for the client-provided session filesystem. Implementations create parent directories as needed.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SessionFsAppendFileRequest".
@@ -18143,6 +18725,10 @@ export interface SessionOpenOptions {
      * Whether to skip custom instruction sources.
      */
     skipCustomInstructions?: boolean;
+    /**
+     * Whether to invalidate cached custom-instruction discovery before constructing the session. Use when instruction files may have changed earlier in the same runtime process.
+     */
+    refreshCustomInstructions?: boolean;
     /**
      * Instruction source IDs disabled for this session.
      */
@@ -19061,6 +19647,27 @@ export interface SessionsGetBoardEntryCountResult {
      */
     count?: number;
 }
+/**
+ * Bounded batch request for client-owned metadata from persisted local sessions.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SessionsGetClientMetadataRequest".
+ */
+/** @experimental */
+export interface SessionsGetClientMetadataRequest {
+    /**
+     * Session IDs to inspect. Results preserve this order.
+     *
+     * @maxItems 1000
+     */
+    sessionIds: string[];
+    /**
+     * Case-sensitive keys to project from each valid bag. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Omit to return every entry.
+     *
+     * @maxItems 128
+     */
+    keys?: string[];
+}
 /**
  * Session ID whose event-log file path to compute.
  *
@@ -19274,11 +19881,11 @@ export interface SessionsReadPersistedEventsRequest {
      */
     sessionId: string;
     /**
-     * Opaque cursor returned by a previous persisted-event read. Omit on the first call.
+     * Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page.
      */
     cursor?: string;
     /**
-     * Maximum number of events to return in this batch (1–1000, default 200).
+     * Maximum number of events to return in this batch (1–1000, default 200). Pages may contain fewer events to keep the serialized event array within a soft 1 MiB budget including resolved binary assets; one oversized event is returned alone to guarantee progress.
      */
     max?: number;
     direction?: EventsReadDirection;
@@ -20306,7 +20913,7 @@ export interface SlashCommandSetPlanModelResult {
     runtimeSettingsChanged?: boolean;
 }
 /**
- * Subagent model, reasoning effort, and context tier settings
+ * Subagent model, reasoning effort, context tier, and auto-invocation settings
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SubagentSettingsEntry".
@@ -20323,6 +20930,10 @@ export interface SubagentSettingsEntry {
      */
     effortLevel?: string;
     contextTier?: SubagentSettingsEntryContextTier;
+    /**
+     * Whether this agent's runtime-defined proactive invocation prompting is enabled, if supported. Currently consumed by the built-in rubber-duck agent.
+     */
+    autoInvoke?: boolean;
 }
 /**
  * Tracked background agent task metadata, including IDs, status, timing, agent type, prompt, model, result, and latest response.
@@ -22758,6 +23369,10 @@ export interface WorkspacesWriteAutopilotObjectiveResult {
     operation: string;
 }
 /** @experimental */
+export interface SessionFactoryPauseAtCheckpointResult {
+    action: FactoryPauseCheckpointAction;
+}
+/** @experimental */
 export interface SessionModelListRequest {
     /**
      * If true, bypasses the per-session model list cache and re-fetches from CAPI.
@@ -23121,13 +23736,13 @@ export declare function createServerRpc(connection: MessageConnection): {
         /**
          * Enables installed plugins for new sessions.
          *
-         * @param params Plugin names (or specs) to enable.
+         * @param params Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against.
          */
         enable: (params: PluginsEnableRequest) => Promise<void>;
         /**
          * Disables installed plugins for new sessions.
          *
-         * @param params Plugin names (or specs) to disable.
+         * @param params Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against.
          */
         disable: (params: PluginsDisableRequest) => Promise<void>;
         /** @experimental */
@@ -23377,7 +23992,15 @@ export declare function createServerRpc(connection: MessageConnection): {
          */
         list: (params: SessionsListRequest) => Promise<SessionList>;
         /**
-         * Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The initial backward read uses a bounded tail scan for fast first paint; cursor continuations preserve the session event-log paging semantics. Persisted events may omit payloads that are reconstructed only for an active session.
+         * Reads client-owned metadata for multiple persisted local sessions without opening them. Results preserve request order and report missing, corrupt, unsupported, or temporarily unavailable sessions independently.
+         *
+         * @param params Bounded batch request for client-owned metadata from persisted local sessions.
+         *
+         * @returns Ordered client metadata outcomes for the requested local sessions.
+         */
+        getClientMetadata: (params: SessionsGetClientMetadataRequest) => Promise<SessionsGetClientMetadataResult>;
+        /**
+         * Reads a page of durable events directly from a local session's persisted journal without creating, resuming, or activating the session. The first read pins the currently opened journal generation and its byte-length boundary; opaque cursor continuations remain on that generation across runtime-owned compaction, truncation, and rewrite operations, which replace the live path atomically, and events appended after the boundary are excluded. For cold hydration, await the first successful page before activation and establish lossless live-event buffering before resume; merge subsequent live events by ID, preserving persisted order and letting live payloads win. Continuations are process-local, single-use capabilities bound to the originating session and storage context and must be paged sequentially; concurrent or repeated use of the same cursor expires that duplicate read rather than reading the generation twice. A complete snapshot has cursorStatus 'ok' and hasMore false. Snapshots expire after five idle minutes, with at most eight retained per process and idle-only eviction under pressure; completion and cancelled-worker exit release their handles. No transcript copy is created, but retained handles may keep replaced files' disk blocks alive until release. Pages have a soft 1 MiB serialized event-array budget including resolved binary assets; one oversized event is returned alone to guarantee progress. Working memory also includes a record/lookahead and asset resolution; resolving the first binary reference may scan the full pinned generation to build a bounded offset index. If the snapshot expires, is evicted, is cancelled before a continuation is established, or becomes unreadable after an observable unsupported in-place shortening, the continuation returns cursorStatus 'expired' with an empty terminal page and never falls back to a different generation. A missing or initially unreadable journal is an RPC error. Persisted history excludes ephemeral events and may omit payloads that are reconstructed only for an active session; use the active session event stream for post-resume live events.
          *
          * @param params Pagination options for reading an inactive or active local session's persisted event journal.
          *
@@ -23581,6 +24204,14 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Managed sandbox enforcement state for a session.
          */
         getEnforcementStatus: () => Promise<SandboxEnforcementStatus>;
+        /**
+         * Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.
+         *
+         * @param params Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.
+         *
+         * @returns Result of attempting to disable sandboxing for the current session.
+         */
+        disableForSession: (params: SandboxDisableForSessionRequest) => Promise<SandboxDisableForSessionResult>;
     };
     /**
      * Aborts the current agent turn.
@@ -23744,6 +24375,14 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Complete current or terminal factory run envelope.
          */
         cancel: (params: FactoryCancelRequest) => Promise<FactoryRunResult>;
+        /**
+         * Pauses a running factory and returns its settled run envelope.
+         *
+         * @param params Parameters for pausing a running factory.
+         *
+         * @returns Complete current or terminal factory run envelope.
+         */
+        pause: (params: FactoryPauseRequest) => Promise<FactoryRunResult>;
         /**
          * Records a batch of ordered factory progress lines.
          *
@@ -23804,6 +24443,14 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Immediate acknowledgement and Auto preference snapshot after a switch request. This result never implies that a pending preference committed.
          */
         switchAutoTier: (params: ModelSwitchAutoTierRequest) => Promise<ModelSwitchAutoTierResult>;
+        /**
+         * Replaces or clears the host-supplied model allowlist for a running session.
+         *
+         * @param params Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.
+         *
+         * @returns The applied host allowlist and effective session model policy after intersection.
+         */
+        setAllowedModels: (params: ModelSetAllowedModelsRequest) => Promise<ModelSetAllowedModelsResult>;
         /**
          * Updates the session's reasoning effort without changing the selected model.
          *
@@ -24049,7 +24696,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
         /**
          * Starts fleet mode by submitting the fleet orchestration prompt to the session.
          *
-         * @param params Optional user prompt to combine with the fleet orchestration instructions.
+         * @param params Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.
          *
          * @returns Indicates whether fleet mode was successfully activated.
          */
@@ -24591,7 +25238,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          */
         set: (params: ToolsSetRequest) => Promise<ToolsSetResult>;
         /**
-         * Updates the current session's live subagent settings after user settings change. The persisted user settings remain the source of truth for future sessions.
+         * Sets the current session's live subagent settings override, which takes precedence over persisted user settings until cleared. Persisted user settings remain the source of truth for future sessions.
          *
          * @param params Subagent settings to apply to the current session
          *
@@ -24941,6 +25588,20 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Point-in-time snapshot of slow-changing session identifier and state fields
          */
         snapshot: () => Promise<SessionMetadataSnapshot>;
+        /**
+         * Returns the client-owned string metadata persisted with this local session. The metadata is not included in model context, events, telemetry, snapshots, or remote exports.
+         *
+         * @returns Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.
+         */
+        getClientMetadata: () => Promise<ClientMetadata>;
+        /**
+         * Atomically patches the client-owned string metadata persisted with this local session and returns the committed bag.
+         *
+         * @param params Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.
+         *
+         * @returns Client-owned, case-sensitive string metadata persisted with a local session. Clients should namespace keys by owner. Keys must be non-empty and at most 256 UTF-8 bytes; keys under `copilot/` and `github/` are reserved. Values may contain at most 16 KiB of UTF-8 data. A bag may contain at most 128 entries and its serialized sidecar may contain at most 64 KiB. The runtime stores but never interprets these values.
+         */
+        updateClientMetadata: (params: MetadataUpdateClientMetadataRequest) => Promise<ClientMetadata>;
         /**
          * Reports whether the local session is currently processing user/agent messages.
          *
@@ -25361,9 +26022,9 @@ export interface SessionFsHandler {
      */
     writeFile(params: SessionFsWriteFileRequest): Promise<SessionFsError | undefined>;
     /**
-     * Appends content to a file in the client-provided session filesystem.
+     * Appends content to a file in the client-provided session filesystem, creating parent directories as needed.
      *
-     * @param params File path, content to append, and optional mode for the client-provided session filesystem.
+     * @param params File path, content to append, and optional mode for the client-provided session filesystem. Implementations create parent directories as needed.
      *
      * @returns Describes a filesystem error.
      */