@github/copilot-sdk 1.0.14-preview.1 → 1.0.14

package/README.md

@@ -21,6 +21,10 @@ release's `SHA256SUMS.txt`.
 
 `npm run pack:release` builds the main package and all platform packages. Set
 `COPILOT_CLI_DOWNLOAD_BASE_URL` to use a release mirror while packaging.
+Release workflows instead set `COPILOT_SDK_RUNTIME_PACKAGE_DIR` to a directory
+containing validated runtime npm package roots named for all eight platforms.
+This keeps `COPILOT_CLI_USE_NPM_PACKAGE` false and embeds those runtime files in
+the self-contained SDK platform packages.
 
 ## Installation
 
@@ -147,7 +151,7 @@ Create a new conversation session.
 
 - `sessionId?: string` - Custom session ID.
 - `model?: string` - Model to use ("gpt-5", "claude-sonnet-4.5", etc.). **Required when using custom provider.**
-- `capi?: CapiSessionOptions` - Copilot API options. With `model: "auto"`, set `autoTier` to `"efficiency"`, `"balance"`, or `"intelligence"` to choose a routing preference. Requires a runtime with Auto tier support and V2 Auto routing. Omission preserves default behavior. See [Auto tier persistence](../docs/features/session-persistence.md#auto-tier-persistence) for resume semantics.
+- `capi?: CapiSessionOptions` - Copilot API options. With `model: "auto"`, set `autoTier` to `"efficiency"`, `"balance"`, `"intelligence"`, or `"fast"` to choose a routing preference. `"fast"` is an integrator-only latency preset, not a first-party GitHub Copilot product preference. Requires a runtime with Auto tier support and V2 Auto routing. Omission preserves default behavior. See [Auto tier persistence](../docs/features/session-persistence.md#auto-tier-persistence) for resume semantics.
 - `reasoningEffort?: "low" | "medium" | "high" | "xhigh" | "max"` - Reasoning effort level for models that support it. Use `listModels()` to check which models support this option.
 - `tools?: Tool[]` - Custom tools exposed to the CLI. Tools without `handler` are declaration-only and must be resolved via pending tool-call RPCs.
 - `systemMessage?: SystemMessageConfig` - System message customization (see below)
@@ -350,7 +354,7 @@ Change the Auto routing preference without changing the selected model. Pass `nu
 
 The runtime does not apply the preference immediately. It records the request and commits it only when a later user turn using the `auto` model successfully obtains a usable model from the provider, so a `pending` status confirms acceptance rather than effect. Only the most recent request survives.
 
-Watch for the outcome through the `session.model_change` event on success or the ephemeral `session.auto_tier_switch_failed` event on failure, and read the authoritative state at any time with `session.rpc.model.getCurrent()`.
+Watch for the outcome through the `session.model_change` event on success or the ephemeral `session.auto_tier_switch_failed` event on failure. A failed activation leaves the incumbent effective tier unchanged. Read the authoritative state at any time with `session.rpc.model.getCurrent()`.
 
 ```typescript
 const result = await session.setAutoTier("intelligence");

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.84-5";
+const COPILOT_CLI_VERSION = "1.0.85";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/generated/rpc.js

@@ -760,15 +760,7 @@ function createInternalServerRpc(connection) {
        */
       getBoardEntryCount: async (params) => connection.sendRequest("sessions.getBoardEntryCount", params),
       /**
-       * Registers extension-provided tools on the given session, gated by an optional `enabled` callback. Returns an opaque unsubscribe function the caller must invoke to deregister the tools when the extension is torn down. Marked internal because `loader`, `enabled`, and the returned `unsubscribe` are in-process handles that cannot cross the JSON-RPC boundary. Disappears once extension discovery / launch / tool registration are owned by the runtime: SDK consumers will pass pure config (search paths, disabled ids) via `SessionOptions` and the runtime will resolve, launch, register, and tear down extensions itself.
-       *
-       * @param params Params to attach an extension loader's tools to a session.
-       *
-       * @returns Handle for releasing the extension tool registration.
-       */
-      registerExtensionToolsOnSession: async (params) => connection.sendRequest("sessions.registerExtensionToolsOnSession", params),
-      /**
-       * Attaches (or detaches) an in-process ExtensionController delegate for the given session, used by shared-API surfaces that need to query or modify the session's extension state. Pass `controller: undefined` to detach. Marked internal because the controller is an in-process object that cannot cross the JSON-RPC boundary. Disappears alongside `registerExtensionToolsOnSession`: once the runtime owns extension management, the public surface exposes list/enable/disable/reload as dedicated RPCs served by the runtime.
+       * Attaches (or detaches) an in-process ExtensionController delegate for the given session in a local host adapter. Pass `controller: undefined` to detach. Internal because the controller cannot cross the JSON-RPC boundary; the runtime manages its own session extension service.
        *
        * @param params Params to attach or detach an in-process ExtensionController delegate.
        */
@@ -877,11 +869,11 @@ function createSessionRpc(connection, sessionId) {
     /** @experimental */
     debug: {
       /**
-       * Collects a redacted session debug log bundle into a local archive or staging directory. The runtime includes session-owned logs by default and accepts caller-provided diagnostic entries so host applications can add their own files without changing this API shape.
+       * Collects a session debug log bundle into a local archive or staging directory. Logs are redacted by default; redaction can be configured per caller-provided diagnostic entry. The runtime includes session-owned logs by default and accepts caller-provided diagnostic entries so host applications can add their own files without changing this API shape.
        *
-       * @param params Options for collecting a redacted session debug bundle.
+       * @param params Options for collecting a session debug bundle with configurable redaction.
        *
-       * @returns Result of collecting a redacted debug bundle.
+       * @returns Result of collecting a session debug bundle.
        */
       collectLogs: async (params) => connection.sendRequest("session.debug.collectLogs", { sessionId, ...params })
     },
@@ -1191,6 +1183,32 @@ function createSessionRpc(connection, sessionId) {
        * @param params Relative path and UTF-8 content for the workspace file to create or overwrite.
        */
       createFile: async (params) => connection.sendRequest("session.workspaces.createFile", { sessionId, ...params }),
+      /**
+       * Returns metadata for a file or directory in the session workspace files directory.
+       *
+       * @param params Relative path of the workspace file or directory to inspect.
+       *
+       * @returns Filesystem metadata for a path in the session workspace files directory.
+       */
+      statFile: async (params) => connection.sendRequest("session.workspaces.statFile", { sessionId, ...params }),
+      /**
+       * Creates a directory in the session workspace files directory.
+       *
+       * @param params Directory to create within the session workspace files directory.
+       */
+      createDirectory: async (params) => connection.sendRequest("session.workspaces.createDirectory", { sessionId, ...params }),
+      /**
+       * Removes a file or directory from the session workspace files directory.
+       *
+       * @param params File or directory to remove from the session workspace files directory.
+       */
+      removePath: async (params) => connection.sendRequest("session.workspaces.removePath", { sessionId, ...params }),
+      /**
+       * Renames a file or directory within the session workspace files directory.
+       *
+       * @param params Source and destination paths for a rename within the session workspace files directory.
+       */
+      renamePath: async (params) => connection.sendRequest("session.workspaces.renamePath", { sessionId, ...params }),
       /**
        * Lists workspace checkpoints in chronological order.
        *

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.84-5";
+export declare const COPILOT_CLI_VERSION = "1.0.85";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.84-5";
+const COPILOT_CLI_VERSION = "1.0.85";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/generated/rpc.d.ts

@@ -38,8 +38,10 @@ export type AdaptiveThinkingSupport =
 "unsupported"
 /** The model accepts adaptive thinking but also accepts thinking.type='enabled' */
  | "optional"
-/** The model only accepts adaptive thinking and rejects thinking.type='enabled' with HTTP 400 (e.g. opus-4.7/4.8) */
- | "required";
+/** The model defaults to adaptive thinking and rejects thinking.type='enabled' with HTTP 400, but still accepts thinking.type='disabled' (e.g. opus-4.7/4.8/5, sonnet-5) */
+ | "required"
+/** The model accepts only thinking.type='adaptive'; 'enabled', 'disabled', and an omitted thinking block all fail with HTTP 400 (e.g. fable, mythos) */
+ | "adaptive_only";
 /**
  * Which tier this directory belongs to
  *
@@ -899,7 +901,7 @@ export type DebugCollectLogsSource =
 /** Caller-provided diagnostic entry. */
  | "additional";
 /**
- * Destination for the redacted debug bundle.
+ * Destination for the session debug bundle.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "DebugCollectLogsDestination".
@@ -920,7 +922,7 @@ export type DebugCollectLogsDestination = {
     kind: "archive";
 } | {
     /**
-     * Directory where redacted files should be staged. The directory is created if needed.
+     * Directory where files should be staged. The directory is created if needed.
      */
     outputDirectory: string;
     /**
@@ -951,7 +953,9 @@ export type DebugCollectLogsRedaction =
 /** Redact the file as plain UTF-8 log text. */
 "plain-text"
 /** Redact each non-empty line as a session event JSON object, falling back to plain-text redaction for malformed lines. */
- | "events-jsonl";
+ | "events-jsonl"
+/** No redaction is applied. The caller must ensure any necessary redaction is performed before this call. */
+ | "none";
 /**
  * Destination kind that was written.
  *
@@ -962,7 +966,7 @@ export type DebugCollectLogsRedaction =
 export type DebugCollectLogsResultKind = 
 /** A .tgz archive was written. */
 "archive"
-/** A directory containing redacted files was written. */
+/** A directory containing the collected files was written. */
  | "directory";
 /**
  * Persisted extension discovery source
@@ -1860,6 +1864,10 @@ export type McpHeadersHandlePendingHeadersRefreshRequest = {
     headers: {
         [k: string]: string | undefined;
     };
+    /**
+     * Optional lifetime in milliseconds for these returned headers. The runtime clamps its configured cache lifetime to this value.
+     */
+    ttlMs?: number;
     /**
      * Headers-refresh response variant discriminator.
      */
@@ -1869,6 +1877,15 @@ export type McpHeadersHandlePendingHeadersRefreshRequest = {
      * Headers-refresh response variant discriminator.
      */
     kind: "none";
+} | {
+    /**
+     * Host credential broker failure, denial, or revocation reason.
+     */
+    message: string;
+    /**
+     * Headers-refresh response variant discriminator.
+     */
+    kind: "error";
 };
 /**
  * One eligible way to run the server, represented as a tagged package or remote variant so package identity and endpoint states cannot contradict the install method.
@@ -2696,6 +2713,8 @@ export type PermissionModeSource =
  | "autopilot_confirmation"
 /** The mode was set at startup by the `defaultPermissionMode` user setting. */
  | "user_setting"
+/** The mode was set at startup by authenticated organization targeting. */
+ | "organization_targeting"
 /** The mode was set through an RPC caller. */
  | "rpc";
 /**
@@ -2783,6 +2802,10 @@ export type PluginsReloadRequest = {
      */
     deferRepoHooks?: boolean;
 };
+/** @experimental */
+export type ProtocolAppendMode = "append";
+/** @experimental */
+export type ProtocolCustomizeMode = "customize";
 /**
  * Controls whether the runtime may defer loading an external tool definition.
  *
@@ -2795,6 +2818,34 @@ export type ProtocolExternalToolDefer =
 "auto"
 /** The runtime must include the tool without deferring it. */
  | "never";
+/** @experimental */
+export type ProtocolMarkerSectionOverride = {
+    /**
+     * Section override action discriminator.
+     */
+    action: "transform";
+} | {
+    /**
+     * Section override action discriminator.
+     */
+    action: "preserve";
+};
+/** @experimental */
+export type ProtocolReplaceMode = "replace";
+/** @experimental */
+export type ProtocolSectionOverride = ProtocolStaticSectionOverride | ProtocolMarkerSectionOverride;
+/** @experimental */
+export type ProtocolStaticSectionAction = 
+/** Replace the section content. */
+"replace"
+/** Remove the section content. */
+ | "remove"
+/** Append content to the section. */
+ | "append"
+/** Prepend content to the section. */
+ | "prepend";
+/** @experimental */
+export type ProtocolSystemMessageConfig = ProtocolSystemMessageAppendConfig | ProtocolSystemMessageReplaceConfig | ProtocolSystemMessageCustomizeConfig;
 /**
  * Provider family. Matches the `type` field of a BYOK provider config.
  *
@@ -2960,6 +3011,32 @@ export type RemoteSessionMetadataTaskType =
 "cca"
 /** CLI remote task. */
  | "cli";
+/**
+ * Provider-native structured output format. JSON Schema is forwarded without rewriting or validating the schema or the generated output.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ResponseFormat".
+ */
+/** @experimental */
+export type ResponseFormat = {
+    jsonSchema: JsonSchemaResponseFormat;
+    /**
+     * Output format discriminator. Currently only json_schema is supported.
+     */
+    type: "json_schema";
+};
+/**
+ * A session-scoped sandbox transition applied while handling a slash command
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxSessionChange".
+ */
+/** @experimental */
+export type SandboxSessionChange = 
+/** The sandbox is off for the rest of this session; nothing was persisted and a new session starts from managed policy. */
+"disabled"
+/** A previous session-scoped opt-out was cleared and the sandbox is enforced again. */
+ | "restored";
 /**
  * Current authentication information, or null when no authentication is active.
  *
@@ -6956,7 +7033,7 @@ export interface CurrentToolMetadata {
     deferLoading?: boolean;
 }
 /**
- * A file included in the redacted debug bundle.
+ * A file included in the session debug bundle.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "DebugCollectLogsCollectedEntry".
@@ -7034,7 +7111,7 @@ export interface DebugCollectLogsInclude {
     previousProcessLogLimit?: number;
 }
 /**
- * Options for collecting a redacted session debug bundle.
+ * Options for collecting a session debug bundle with configurable redaction.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "DebugCollectLogsRequest".
@@ -7049,7 +7126,7 @@ export interface DebugCollectLogsRequest {
     additionalEntries?: DebugCollectLogsEntry[];
 }
 /**
- * Result of collecting a redacted debug bundle.
+ * Result of collecting a session debug bundle.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "DebugCollectLogsResult".
@@ -7062,7 +7139,7 @@ export interface DebugCollectLogsResult {
      */
     path: string;
     /**
-     * Files included in the redacted bundle.
+     * Files included in the bundle.
      */
     entries: DebugCollectLogsCollectedEntry[];
     /**
@@ -9575,6 +9652,10 @@ export interface InstalledPluginInfo {
      * Absolute path of the marketplace directory a live plugin was resolved from. Present only on live, never-persisted records — a plugin belonging to a directory/local marketplace, which is loaded from its real directory on every pass instead of a copy under the installed-plugins cache. Its presence is what marks a listed plugin as live: such a plugin is always present on disk, so `enabled` is its only meaningful state and it is never "not installed".
      */
     installedFrom?: string;
+    /**
+     * Runtime-reported plugin provenance. Currently set to "builtin" only for plugins registered through the trusted host built-in boundary; absent for installed, marketplace, direct, and live plugins.
+     */
+    source?: string;
 }
 /**
  * Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.
@@ -9728,6 +9809,31 @@ export interface InterruptMainTurnResult {
      */
     interrupted: boolean;
 }
+/**
+ * A JSON Schema output contract. OpenAI receives the name, description, schema and strict setting; Anthropic receives the schema in output_config.format and always uses its native strict enforcement.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "JsonSchemaResponseFormat".
+ */
+/** @experimental */
+export interface JsonSchemaResponseFormat {
+    /**
+     * Name of the output schema, subject to the provider's naming restrictions.
+     */
+    name: string;
+    /**
+     * JSON Schema passed unchanged to the inference provider. Schemas larger than 32 MiB when JSON-encoded are rejected before admission, using the runtime's existing request-size ceiling. This is not a guarantee that the entire model request fits. Supported keywords and schema restrictions are determined by the provider.
+     */
+    schema: JsonValue;
+    /**
+     * Optional description passed to OpenAI providers.
+     */
+    description?: string;
+    /**
+     * Optional strict enforcement setting for OpenAI providers. Omitted uses the provider default. Anthropic always enforces its supported schema subset.
+     */
+    strict?: boolean;
+}
 /**
  * HTTP headers as a map from lowercased header name to a list of values. Multi-valued headers (e.g. Set-Cookie) preserve all values.
  *
@@ -10076,6 +10182,35 @@ export interface LspInitializeRequest {
      */
     force?: boolean;
 }
+/**
+ * Non-secret host-managed HTTP MCP server configuration. The containing map key is the stable managed identity; credentials are supplied dynamically by the host.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ManagedMcpServerConfig".
+ */
+/** @experimental */
+export interface ManagedMcpServerConfig {
+    /**
+     * Human-readable catalog display name.
+     */
+    displayName: string;
+    /**
+     * Hosted MCP streamable HTTP endpoint.
+     */
+    url: string;
+    /**
+     * Tools to include. Defaults to all tools when omitted.
+     */
+    tools?: string[];
+    /**
+     * Timeout in milliseconds for tool discovery and tool calls.
+     */
+    timeout?: number;
+    /**
+     * Maximum dynamic-header cache lifetime in milliseconds.
+     */
+    headersRefreshTtlMs?: number;
+}
 /**
  * Validated device-managed settings discovered before a session exists.
  *
@@ -12033,6 +12168,10 @@ export interface McpServer {
      * Plugin version that provided this server, when source is plugin.
      */
     sourcePluginVersion?: string;
+    /**
+     * Human-readable display name supplied by a managed server catalog.
+     */
+    displayName?: string;
     /**
      * Error message if the server failed to connect
      */
@@ -15346,6 +15485,59 @@ export interface ProtocolExternalToolDefinition {
         [k: string]: JsonValue | undefined;
     };
 }
+/** @experimental */
+export interface ProtocolStaticSectionOverride {
+    action: ProtocolStaticSectionAction;
+    /**
+     * Optional content used by replace, append, and prepend operations.
+     */
+    content?: string;
+}
+/** @experimental */
+export interface ProtocolSystemMessageAppendConfig {
+    mode?: ProtocolAppendMode;
+    /**
+     * Text appended to the standard system prompt.
+     */
+    content?: string;
+}
+/** @experimental */
+export interface ProtocolSystemMessageReplaceConfig {
+    mode: ProtocolReplaceMode;
+    /**
+     * Complete replacement system-message text.
+     */
+    content: string;
+    /**
+     * Optional structured blocks corresponding to the replacement content.
+     */
+    contentBlocks?: SystemMessageBlock[];
+}
+/** @experimental */
+export interface SystemMessageBlock {
+    /**
+     * Text content for this system-message block.
+     */
+    content: string;
+    /**
+     * Whether the block is static and may be cached independently of dynamic prompt content.
+     */
+    isStatic?: boolean;
+}
+/** @experimental */
+export interface ProtocolSystemMessageCustomizeConfig {
+    mode: ProtocolCustomizeMode;
+    /**
+     * Named standard-prompt section overrides.
+     */
+    sections?: {
+        [k: string]: ProtocolSectionOverride;
+    };
+    /**
+     * Text appended after the customized sections.
+     */
+    content?: string;
+}
 /**
  * BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.
  *
@@ -15404,6 +15596,7 @@ export interface ProviderModelConfig {
      */
     maxOutputTokens?: number;
     capabilities?: ModelCapabilitiesOverride;
+    systemMessage?: ProtocolSystemMessageConfig;
 }
 /**
  * The selectable model entries synthesized for the models added by this call.
@@ -16474,15 +16667,6 @@ export interface RegisterEventInterestResult {
      */
     handle: string;
 }
-/**
- * Optional registration options.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "SessionsRegisterExtensionToolsOnSessionOptions".
- */
-/** @experimental */
-export interface SessionsRegisterExtensionToolsOnSessionOptions {
-}
 /**
  * Opaque handle previously returned by `registerInterest` to release.
  *
@@ -16904,6 +17088,14 @@ export interface SandboxConfigUserPolicyFilesystem {
  */
 /** @experimental */
 export interface SandboxConfigUserPolicyNetwork {
+    /**
+     * Hosts allowed through the built-in sandbox proxy. A non-empty list denies unmatched hosts; an absent or empty list allows all hosts not blocked. Supports exact hostnames, IP addresses, and *.example.com for strict subdomains. Host rules do not override the outbound or local-network toggles.
+     */
+    allowedHosts?: string[];
+    /**
+     * Hosts denied by the built-in sandbox proxy. Deny rules take precedence over allowedHosts. A domain also denies all its subdomains. IP addresses match exactly; *.example.com matches strict subdomains, and * denies every host.
+     */
+    blockedHosts?: string[];
     /**
      * Whether outbound network traffic is allowed at all.
      */
@@ -17342,7 +17534,7 @@ export interface SendMessageItem {
 /** @experimental */
 export interface SendMessagesRequest {
     /**
-     * The user messages to append to the conversation, in order. May be empty, in which case a single turn runs over the existing history with no new user message.
+     * The user messages to append to the conversation, in order, before running one agent loop. When the batch starts a run, its final message is the primary initiating message; earlier messages provide context, not separate runs or replies. May be empty, in which case a single turn runs over the existing history with no new user message or originatingMessageId.
      */
     messages: SendMessageItem[];
     mode?: SendMode;
@@ -17357,6 +17549,7 @@ export interface SendMessagesRequest {
     requestHeaders?: {
         [k: string]: string | undefined;
     };
+    responseFormat?: ResponseFormat;
     /**
      * W3C Trace Context traceparent header for distributed tracing of this agent turn
      */
@@ -17379,7 +17572,7 @@ export interface SendMessagesRequest {
 /** @experimental */
 export interface SendMessagesResult {
     /**
-     * Unique identifiers assigned to the messages, one per provided message in order. Empty when no messages were provided.
+     * Unique identifiers assigned to the messages, one per provided message in order. For a batch that starts a run, assistant messages use the final ID as originatingMessageId throughout that run, including tool iterations and stop-hook corrections. Immediate steering does not replace the active run's origin. Empty when no messages were provided; that run has no originatingMessageId.
      */
     messageIds: string[];
 }
@@ -17423,6 +17616,7 @@ export interface SendRequest {
     requestHeaders?: {
         [k: string]: string | undefined;
     };
+    responseFormat?: ResponseFormat;
     /**
      * W3C Trace Context traceparent header for distributed tracing of this agent turn
      */
@@ -18591,7 +18785,7 @@ export interface SessionOpenOptions {
      */
     integrationId?: string;
     /**
-     * Opt-in: self-fetch and enforce enterprise managed settings at session bootstrap.
+     * Opt-in: self-fetch and enforce enterprise managed settings, including managed hook policies, at session bootstrap.
      */
     enableManagedSettings?: boolean;
     managedSettings?: SessionManagedSettings;
@@ -18693,6 +18887,14 @@ export interface SessionOpenOptions {
      * MCP server names disabled for this session. Disabled servers are not started or authenticated on create or cold resume.
      */
     disabledMcpServers?: string[];
+    /**
+     * Non-secret host-managed HTTP MCP servers keyed by stable managed identity. Managed provenance is runtime-established from this separate field and credentials are supplied through dynamic-header refresh.
+     *
+     * @experimental
+     */
+    managedMcpServers?: {
+        [k: string]: ManagedMcpServerConfig;
+    };
     /**
      * Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.
      */
@@ -20387,6 +20589,10 @@ export interface ShutdownRequest {
      * Optional human-readable reason. Typically the message of the error that triggered shutdown when type is 'error'.
      */
     reason?: string;
+    /**
+     * Dispatch deferred sessionEnd hooks in the background with their full per-hook timeoutSec instead of awaiting them under the short shared shutdown budget. Set this when the host process keeps running after the session closes (for example the CLI's /clear), so a slow hook neither blocks the close nor is aborted. Hooks still detached when the process later exits are terminated with it. Defaults to false.
+     */
+    detachSessionEndHooks?: boolean;
 }
 /**
  * Skill metadata available to a session, with name, description, source, enabled/invocable state, path, plugin, and argument hint.
@@ -20776,6 +20982,7 @@ export interface SlashCommandTextResult {
      * True when the invocation mutated user runtime settings; consumers caching settings should refresh
      */
     runtimeSettingsChanged?: boolean;
+    sandboxSessionChange?: SandboxSessionChange;
 }
 /**
  * Slash-command invocation result asking the client to present subcommand options for a parent command.
@@ -23042,6 +23249,23 @@ export interface WorkspacesCheckpoints {
      */
     filename: string;
 }
+/**
+ * Directory to create within the session workspace files directory.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspacesCreateDirectoryRequest".
+ */
+/** @experimental */
+export interface WorkspacesCreateDirectoryRequest {
+    /**
+     * Slash-separated relative path within the workspace files directory
+     */
+    path: string;
+    /**
+     * Whether to create missing parent directories. Defaults to false.
+     */
+    recursive?: boolean;
+}
 /**
  * Relative path and UTF-8 content for the workspace file to create or overwrite.
  *
@@ -23051,7 +23275,7 @@ export interface WorkspacesCheckpoints {
 /** @experimental */
 export interface WorkspacesCreateFileRequest {
     /**
-     * Relative path within the workspace files directory
+     * Slash-separated relative path within the workspace files directory
      */
     path: string;
     /**
@@ -23204,7 +23428,7 @@ export interface WorkspacesListCheckpointsResult {
 /** @experimental */
 export interface WorkspacesListFilesResult {
     /**
-     * Relative file paths in the workspace files directory
+     * Slash-separated relative file paths in the workspace files directory
      */
     files: string[];
 }
@@ -23256,7 +23480,7 @@ export interface WorkspacesReadCheckpointResult {
 /** @experimental */
 export interface WorkspacesReadFileRequest {
     /**
-     * Relative path within the workspace files directory
+     * Slash-separated relative path within the workspace files directory
      */
     path: string;
 }
@@ -23273,6 +23497,44 @@ export interface WorkspacesReadFileResult {
      */
     content: string;
 }
+/**
+ * File or directory to remove from the session workspace files directory.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspacesRemovePathRequest".
+ */
+/** @experimental */
+export interface WorkspacesRemovePathRequest {
+    /**
+     * Slash-separated relative path within the workspace files directory
+     */
+    path: string;
+    /**
+     * Whether to remove directory contents recursively. Defaults to false.
+     */
+    recursive?: boolean;
+    /**
+     * Whether a missing path should be treated as success. Defaults to false.
+     */
+    force?: boolean;
+}
+/**
+ * Source and destination paths for a rename within the session workspace files directory.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspacesRenamePathRequest".
+ */
+/** @experimental */
+export interface WorkspacesRenamePathRequest {
+    /**
+     * Slash-separated source path relative to the workspace files directory
+     */
+    source: string;
+    /**
+     * Slash-separated destination path relative to the workspace files directory
+     */
+    destination: string;
+}
 /**
  * Pasted content to save as a UTF-8 file in the session workspace.
  *
@@ -23312,6 +23574,48 @@ export interface WorkspacesSaveLargePasteResult {
         sizeBytes: number;
     } | null;
 }
+/**
+ * Relative path of the workspace file or directory to inspect.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspacesStatFileRequest".
+ */
+/** @experimental */
+export interface WorkspacesStatFileRequest {
+    /**
+     * Slash-separated relative path within the workspace files directory
+     */
+    path: string;
+}
+/**
+ * Filesystem metadata for a path in the session workspace files directory.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "WorkspacesStatFileResult".
+ */
+/** @experimental */
+export interface WorkspacesStatFileResult {
+    /**
+     * Whether the path identifies a regular file
+     */
+    isFile: boolean;
+    /**
+     * Whether the path identifies a directory
+     */
+    isDirectory: boolean;
+    /**
+     * Size in bytes
+     */
+    size: number;
+    /**
+     * Last modification time in Unix epoch milliseconds
+     */
+    mtimeMs: number;
+    /**
+     * Creation time in Unix epoch milliseconds
+     */
+    birthtimeMs: number;
+}
 /**
  * Rollback point for local workspace summaries.
  *
@@ -24269,11 +24573,11 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
     /** @experimental */
     debug: {
         /**
-         * Collects a redacted session debug log bundle into a local archive or staging directory. The runtime includes session-owned logs by default and accepts caller-provided diagnostic entries so host applications can add their own files without changing this API shape.
+         * Collects a session debug log bundle into a local archive or staging directory. Logs are redacted by default; redaction can be configured per caller-provided diagnostic entry. The runtime includes session-owned logs by default and accepts caller-provided diagnostic entries so host applications can add their own files without changing this API shape.
          *
-         * @param params Options for collecting a redacted session debug bundle.
+         * @param params Options for collecting a session debug bundle with configurable redaction.
          *
-         * @returns Result of collecting a redacted debug bundle.
+         * @returns Result of collecting a session debug bundle.
          */
         collectLogs: (params: DebugCollectLogsRequest) => Promise<DebugCollectLogsResult>;
     };
@@ -24583,6 +24887,32 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @param params Relative path and UTF-8 content for the workspace file to create or overwrite.
          */
         createFile: (params: WorkspacesCreateFileRequest) => Promise<void>;
+        /**
+         * Returns metadata for a file or directory in the session workspace files directory.
+         *
+         * @param params Relative path of the workspace file or directory to inspect.
+         *
+         * @returns Filesystem metadata for a path in the session workspace files directory.
+         */
+        statFile: (params: WorkspacesStatFileRequest) => Promise<WorkspacesStatFileResult>;
+        /**
+         * Creates a directory in the session workspace files directory.
+         *
+         * @param params Directory to create within the session workspace files directory.
+         */
+        createDirectory: (params: WorkspacesCreateDirectoryRequest) => Promise<void>;
+        /**
+         * Removes a file or directory from the session workspace files directory.
+         *
+         * @param params File or directory to remove from the session workspace files directory.
+         */
+        removePath: (params: WorkspacesRemovePathRequest) => Promise<void>;
+        /**
+         * Renames a file or directory within the session workspace files directory.
+         *
+         * @param params Source and destination paths for a rename within the session workspace files directory.
+         */
+        renamePath: (params: WorkspacesRenamePathRequest) => Promise<void>;
         /**
          * Lists workspace checkpoints in chronological order.
          *

package/dist/generated/rpc.js

@@ -732,15 +732,7 @@ function createInternalServerRpc(connection) {
        */
       getBoardEntryCount: async (params) => connection.sendRequest("sessions.getBoardEntryCount", params),
       /**
-       * Registers extension-provided tools on the given session, gated by an optional `enabled` callback. Returns an opaque unsubscribe function the caller must invoke to deregister the tools when the extension is torn down. Marked internal because `loader`, `enabled`, and the returned `unsubscribe` are in-process handles that cannot cross the JSON-RPC boundary. Disappears once extension discovery / launch / tool registration are owned by the runtime: SDK consumers will pass pure config (search paths, disabled ids) via `SessionOptions` and the runtime will resolve, launch, register, and tear down extensions itself.
-       *
-       * @param params Params to attach an extension loader's tools to a session.
-       *
-       * @returns Handle for releasing the extension tool registration.
-       */
-      registerExtensionToolsOnSession: async (params) => connection.sendRequest("sessions.registerExtensionToolsOnSession", params),
-      /**
-       * Attaches (or detaches) an in-process ExtensionController delegate for the given session, used by shared-API surfaces that need to query or modify the session's extension state. Pass `controller: undefined` to detach. Marked internal because the controller is an in-process object that cannot cross the JSON-RPC boundary. Disappears alongside `registerExtensionToolsOnSession`: once the runtime owns extension management, the public surface exposes list/enable/disable/reload as dedicated RPCs served by the runtime.
+       * Attaches (or detaches) an in-process ExtensionController delegate for the given session in a local host adapter. Pass `controller: undefined` to detach. Internal because the controller cannot cross the JSON-RPC boundary; the runtime manages its own session extension service.
        *
        * @param params Params to attach or detach an in-process ExtensionController delegate.
        */
@@ -849,11 +841,11 @@ function createSessionRpc(connection, sessionId) {
     /** @experimental */
     debug: {
       /**
-       * Collects a redacted session debug log bundle into a local archive or staging directory. The runtime includes session-owned logs by default and accepts caller-provided diagnostic entries so host applications can add their own files without changing this API shape.
+       * Collects a session debug log bundle into a local archive or staging directory. Logs are redacted by default; redaction can be configured per caller-provided diagnostic entry. The runtime includes session-owned logs by default and accepts caller-provided diagnostic entries so host applications can add their own files without changing this API shape.
        *
-       * @param params Options for collecting a redacted session debug bundle.
+       * @param params Options for collecting a session debug bundle with configurable redaction.
        *
-       * @returns Result of collecting a redacted debug bundle.
+       * @returns Result of collecting a session debug bundle.
        */
       collectLogs: async (params) => connection.sendRequest("session.debug.collectLogs", { sessionId, ...params })
     },
@@ -1163,6 +1155,32 @@ function createSessionRpc(connection, sessionId) {
        * @param params Relative path and UTF-8 content for the workspace file to create or overwrite.
        */
       createFile: async (params) => connection.sendRequest("session.workspaces.createFile", { sessionId, ...params }),
+      /**
+       * Returns metadata for a file or directory in the session workspace files directory.
+       *
+       * @param params Relative path of the workspace file or directory to inspect.
+       *
+       * @returns Filesystem metadata for a path in the session workspace files directory.
+       */
+      statFile: async (params) => connection.sendRequest("session.workspaces.statFile", { sessionId, ...params }),
+      /**
+       * Creates a directory in the session workspace files directory.
+       *
+       * @param params Directory to create within the session workspace files directory.
+       */
+      createDirectory: async (params) => connection.sendRequest("session.workspaces.createDirectory", { sessionId, ...params }),
+      /**
+       * Removes a file or directory from the session workspace files directory.
+       *
+       * @param params File or directory to remove from the session workspace files directory.
+       */
+      removePath: async (params) => connection.sendRequest("session.workspaces.removePath", { sessionId, ...params }),
+      /**
+       * Renames a file or directory within the session workspace files directory.
+       *
+       * @param params Source and destination paths for a rename within the session workspace files directory.
+       */
+      renamePath: async (params) => connection.sendRequest("session.workspaces.renamePath", { sessionId, ...params }),
       /**
        * Lists workspace checkpoints in chronological order.
        *

package/dist/generated/session-events.d.ts

@@ -9,7 +9,7 @@ export type JsonValue = null | boolean | number | string | JsonValue[] | {
 /**
  * Union of all session event variants emitted by the Copilot CLI runtime.
  */
-export type SessionEvent = StartEvent | ResumeEvent | RemoteSteerableChangedEvent | ErrorEvent | IdleEvent | TitleChangedEvent | ScheduleCreatedEvent | ScheduleCancelledEvent | ScheduleRearmedEvent | AutopilotObjectiveChangedEvent | InfoEvent | WarningEvent | ModelChangeEvent | AutoTierRecommendationEvent | AutoTierSwitchFailedEvent | ModeChangedEvent | ModeNoticeDeliveredEvent | SessionLimitsChangedEvent | PermissionsChangedEvent | PlanChangedEvent | TodosChangedEvent | WorkspaceFileChangedEvent | HandoffEvent | TruncationEvent | SnapshotRewindEvent | ShutdownEvent | UsageCheckpointEvent | ContextChangedEvent | UsageInfoEvent | ContextClearedEvent | CompactionStartEvent | CompactionCompleteEvent | TaskCompleteEvent | CompletionReceiptEvent | FusionRouteStartedEvent | FusionRouteFailedEvent | FusionResolvedEvent | FusionCompletedEvent | UserMessageEvent | PendingMessagesModifiedEvent | AssistantTurnStartEvent | AssistantIntentEvent | AssistantFusionPhaseStartedEvent | AssistantFusionPhaseActivityEvent | AssistantFusionPhaseCompletedEvent | AssistantFusionPhaseFailedEvent | AssistantServerToolProgressEvent | AssistantReasoningEvent | AssistantReasoningDeltaEvent | AssistantToolCallDeltaEvent | AssistantStreamingDeltaEvent | AssistantMessageEvent | AssistantMessageStartEvent | AssistantMessageDeltaEvent | AssistantTurnEndEvent | AssistantIdleEvent | AssistantUsageEvent | ModelCallFailureEvent | ModelCallFinishedEvent | AbortEvent | ToolUserRequestedEvent | ToolExecutionStartEvent | ToolExecutionPartialResultEvent | ToolExecutionProgressEvent | ToolExecutionCompleteEvent | ToolSearchActivatedEvent | SkillInvokedEvent | SubagentStartedEvent | SubagentConfiguredEvent | SubagentCompletedEvent | SubagentFailedEvent | SubagentSelectedEvent | SubagentDeselectedEvent | HookStartEvent | HookEndEvent | HookProgressEvent | BinaryAssetEvent | SystemMessageEvent | SystemNotificationEvent | PermissionRequestedEvent | PermissionCompletedEvent | PermissionCarriedForwardEvent | PermissionMessageAuthorizationEvent | PermissionMessageAuthorizationReadEvent | PermissionMessageAuthorizationDegradedEvent | UserInputRequestedEvent | UserInputCompletedEvent | ElicitationRequestedEvent | ElicitationCompletedEvent | SamplingRequestedEvent | SamplingCompletedEvent | McpOauthRequiredEvent | McpOauthCompletedEvent | McpHeadersRefreshRequiredEvent | McpHeadersRefreshCompletedEvent | CustomNotificationEvent | UIEphemeralQueryEvent | ExternalToolRequestedEvent | ExternalToolCompletedEvent | CommandQueuedEvent | CommandExecuteEvent | CommandCompletedEvent | AutoModeSwitchRequestedEvent | AutoModeSwitchCompletedEvent | SessionLimitsExhaustedRequestedEvent | SessionLimitsExhaustedCompletedEvent | AutoModeResolvedEvent | ManagedSettingsResolvedEvent | ManagedSettingsEnforcedEvent | CommandsChangedEvent | CapabilitiesChangedEvent | ExitPlanModeRequestedEvent | ExitPlanModeCompletedEvent | ToolsUpdatedEvent | BackgroundTasksChangedEvent | FactoryRunUpdatedEvent | FactoryRunStartedEvent | FactoryRunSettledEvent | SkillsLoadedEvent | CustomAgentsUpdatedEvent | McpServersLoadedEvent | McpServerStatusChangedEvent | McpServerRemovedEvent | McpServerNeedsReconnectEvent | McpToolsListChangedEvent | McpResourcesListChangedEvent | McpPromptsListChangedEvent | ExtensionsLoadedEvent | CanvasOpenedEvent | CanvasRegistryChangedEvent | CanvasClosedEvent | CanvasUnavailableEvent | CanvasRecordedEvent | CanvasRemovedEvent | ExtensionsAttachmentsPushedEvent | McpAppToolCallCompleteEvent;
+export type SessionEvent = StartEvent | ResumeEvent | RemoteSteerableChangedEvent | ErrorEvent | IdleEvent | TitleChangedEvent | ScheduleCreatedEvent | ScheduleCancelledEvent | ScheduleRearmedEvent | AutopilotObjectiveChangedEvent | InfoEvent | WarningEvent | ModelChangeEvent | AutoTierRecommendationEvent | AutoTierSwitchFailedEvent | ModeChangedEvent | ModeNoticeDeliveredEvent | SessionLimitsChangedEvent | PermissionsChangedEvent | PlanChangedEvent | TodosChangedEvent | WorkspaceFileChangedEvent | HandoffEvent | TruncationEvent | SnapshotRewindEvent | ShutdownEvent | UsageCheckpointEvent | ContextChangedEvent | UsageInfoEvent | ContextClearedEvent | CompactionStartEvent | CompactionCompleteEvent | TaskCompleteEvent | CompletionReceiptEvent | FusionRouteStartedEvent | FusionRouteFailedEvent | FusionResolvedEvent | FusionCompletedEvent | UserMessageEvent | PendingMessagesModifiedEvent | AssistantTurnStartEvent | AssistantIntentEvent | AssistantFusionPhaseStartedEvent | AssistantFusionPhaseActivityEvent | AssistantFusionPhaseCompletedEvent | AssistantFusionPhaseFailedEvent | AssistantServerToolProgressEvent | AssistantReasoningEvent | AssistantReasoningDeltaEvent | AssistantToolCallDeltaEvent | AssistantStreamingDeltaEvent | AssistantMessageEvent | AssistantMessageStartEvent | AssistantMessageDeltaEvent | AssistantTurnEndEvent | AssistantIdleEvent | AssistantUsageEvent | ModelCallFailureEvent | ModelCallFinishedEvent | AbortEvent | ToolUserRequestedEvent | ToolExecutionStartEvent | ToolExecutionPartialResultEvent | ToolExecutionProgressEvent | ToolExecutionCompleteEvent | ToolSearchActivatedEvent | SkillInvokedEvent | SubagentStartedEvent | SubagentConfiguredEvent | SubagentCompletedEvent | SubagentFailedEvent | SubagentSelectedEvent | SubagentDeselectedEvent | HookStartEvent | HookEndEvent | HookProgressEvent | BinaryAssetEvent | SystemMessageEvent | SystemNotificationEvent | PermissionRequestedEvent | PermissionCompletedEvent | PermissionCarriedForwardEvent | PermissionMessageAuthorizationEvent | PermissionMessageAuthorizationReadEvent | PermissionMessageAuthorizationDegradedEvent | PermissionAssentDetectedEvent | PermissionContextualAuthorizationEvent | UserInputRequestedEvent | UserInputCompletedEvent | ElicitationRequestedEvent | ElicitationCompletedEvent | SamplingRequestedEvent | SamplingCompletedEvent | McpOauthRequiredEvent | McpOauthCompletedEvent | McpHeadersRefreshRequiredEvent | McpHeadersRefreshCompletedEvent | CustomNotificationEvent | UIEphemeralQueryEvent | ExternalToolRequestedEvent | ExternalToolCompletedEvent | CommandQueuedEvent | CommandExecuteEvent | CommandCompletedEvent | AutoModeSwitchRequestedEvent | AutoModeSwitchCompletedEvent | SessionLimitsExhaustedRequestedEvent | SessionLimitsExhaustedCompletedEvent | AutoModeResolvedEvent | ManagedSettingsResolvedEvent | ManagedSettingsEnforcedEvent | CommandsChangedEvent | CapabilitiesChangedEvent | ExitPlanModeRequestedEvent | ExitPlanModeCompletedEvent | ToolsUpdatedEvent | BackgroundTasksChangedEvent | FactoryRunUpdatedEvent | FactoryRunStartedEvent | FactoryRunSettledEvent | SkillsLoadedEvent | CustomAgentsUpdatedEvent | McpServersLoadedEvent | McpServerStatusChangedEvent | McpServerRemovedEvent | McpServerNeedsReconnectEvent | McpToolsListChangedEvent | McpResourcesListChangedEvent | McpPromptsListChangedEvent | ExtensionsLoadedEvent | CanvasOpenedEvent | CanvasRegistryChangedEvent | CanvasClosedEvent | CanvasUnavailableEvent | CanvasRecordedEvent | CanvasRemovedEvent | ExtensionsAttachmentsPushedEvent | McpAppToolCallCompleteEvent;
 /**
  * Routing preference used when the session model is `auto`. `fast` is an integrator-only latency preset and is not a first-party GitHub Copilot product preference.
  */
@@ -482,6 +482,20 @@ export type AbortReason =
  | "user_abort"
 /** Autopilot stopped the run because the active objective reached its user-set --max-ai-credits limit. */
  | "autopilot_credit_limit";
+/**
+ * Configuration source: user, workspace, plugin, builtin, or managed
+ */
+export type McpServerSource = 
+/** Server configured in the user's global MCP configuration. */
+"user"
+/** Server configured by the current workspace. */
+ | "workspace"
+/** Server contributed by an installed plugin. */
+ | "plugin"
+/** Server bundled with the runtime. */
+ | "builtin"
+/** Server supplied by a trusted host-managed catalog. */
+ | "managed";
 /**
  * Transport mechanism: stdio, http, sse (deprecated), or memory (in-process MCP server)
  */
@@ -565,18 +579,6 @@ export type SkillInvokedTrigger =
  | "agent-invoked"
 /** Skill content loaded as part of another context, such as a configured custom agent or subagent. */
  | "context-load";
-/**
- * Where the model input for a task-tool sub-agent came from.
- */
-export type SubagentTaskModelSource = 
-/** The spawning agent supplied the task tool's model argument. */
-"task_argument"
-/** The task omitted a model and the per-sub-agent settings entry supplied a concrete one. */
- | "subagent_configuration"
-/** The task omitted a model and the user-defined custom agent's definition supplied one. */
- | "custom_agent_definition"
-/** Neither the task call, the per-sub-agent settings entry, nor a custom agent definition supplied a model. */
- | "unset";
 /**
  * Authority or runtime mechanism responsible for sub-agent model selection.
  */
@@ -595,6 +597,18 @@ export type SubagentModelSelectionSource =
  | "agent_definition_default"
 /** Runtime policy, Auto mode, or an experiment selected the model. */
  | "runtime_policy";
+/**
+ * Where the model input for a task-tool sub-agent came from.
+ */
+export type SubagentTaskModelSource = 
+/** The spawning agent supplied the task tool's model argument. */
+"task_argument"
+/** The task omitted a model and the per-sub-agent settings entry supplied a concrete one. */
+ | "subagent_configuration"
+/** The task omitted a model and the user-defined custom agent's definition supplied one. */
+ | "custom_agent_definition"
+/** Neither the task call, the per-sub-agent settings entry, nor a custom agent definition supplied a model. */
+ | "unset";
 /**
  * Binary asset type discriminator. Use "image" for images and "resource" otherwise.
  */
@@ -831,6 +845,8 @@ export type McpHeadersRefreshCompletedOutcome =
 "headers"
 /** The host responded with no dynamic headers. */
  | "none"
+/** The host credential broker rejected or failed the refresh. */
+ | "error"
 /** No response arrived within the bounded window. */
  | "timeout";
 /**
@@ -976,18 +992,6 @@ export type AgentModelPolicy =
 "preferred"
 /** Require subagent execution to use one of the authored models. */
  | "required";
-/**
- * Configuration source: user, workspace, plugin, or builtin
- */
-export type McpServerSource = 
-/** Server configured in the user's global MCP configuration. */
-"user"
-/** Server configured by the current workspace. */
- | "workspace"
-/** Server contributed by an installed plugin. */
- | "plugin"
-/** Server bundled with the runtime. */
- | "builtin";
 /**
  * Connection status: connected, failed, needs-auth, pending, disabled, stopped, or not_configured
  */
@@ -4745,6 +4749,10 @@ export interface AssistantMessageData {
      * Model that produced this assistant message, if known
      */
     model?: string;
+    /**
+     * Logical ID of the primary user message that initiated this run, matching the messageId returned by session.send (or the last messageId of session.sendMessages). Stable across model/tool iterations, steering messages, and stop-hook corrections. Subagent runs use their own initiating message ID, not the parent's. Absent for runs without an associated initiating message, such as empty batches.
+     */
+    originatingMessageId?: string;
     /**
      * Actual output token count from the API response (completion_tokens), used for accurate token accounting
      */
@@ -5764,6 +5772,11 @@ export interface ToolExecutionStartData {
      * @experimental
      */
     fusion?: FusionAttribution;
+    /**
+     * Preferred lookup name for the MCP server hosting this tool: the configured (namespaced) config-map key when the tool carries one, otherwise the display name from `mcpServerName`. Present when the tool is an MCP tool; this is the name unrestricted provenance telemetry hashes so it joins with `mcp_server_setup`, which keys off the configured name too.
+     */
+    mcpConfigServerName?: string;
+    mcpConfigSource?: McpServerSource;
     /**
      * Name of the MCP server hosting this tool, when the tool is an MCP tool
      */
@@ -6012,6 +6025,12 @@ export interface ToolExecutionCompleteData {
      * Whether this tool execution ran inside a sandbox container
      */
     sandboxed?: boolean;
+    /**
+     * Experimental shell completion facts captured before the persisted result contents are stripped.
+     *
+     * @experimental
+     */
+    shellExecution?: ToolExecutionCompleteShellExecution;
     /**
      * Whether the tool execution completed successfully
      */
@@ -6071,7 +6090,7 @@ export interface ToolExecutionCompleteResult {
      */
     contents?: ToolExecutionCompleteContent[];
     /**
-     * Full detailed tool result for UI/timeline display, preserving complete content such as diffs. Falls back to content when absent.
+     * Detailed tool result for UI/timeline display, preserving complete content such as diffs for most tools. Successful skill invocations intentionally use the concise model-facing content here; the authoritative skill body is carried by the corresponding skill invocation event. Falls back to content when absent.
      */
     detailedContent?: string;
     /**
@@ -6485,6 +6504,16 @@ export interface ToolExecutionCompleteUIResourceMetaUIPermissionsGeolocation {
  */
 export interface ToolExecutionCompleteUIResourceMetaUIPermissionsMicrophone {
 }
+/**
+ * Experimental shell completion facts retained independently of the full tool result.
+ */
+/** @experimental */
+export interface ToolExecutionCompleteShellExecution {
+    /**
+     * Process exit code reported by the shell driver.
+     */
+    exitCode: number;
+}
 /**
  * Tool definition metadata, present for MCP tools with MCP Apps support
  */
@@ -6699,6 +6728,7 @@ export interface SubagentStartedData {
      * Model the sub-agent will run with, when known at start.
      */
     model?: string;
+    modelSelectionSource?: SubagentModelSelectionSource;
     /**
      * Task-registry ID of the spawning sub-agent. Absent when the root session spawned this child.
      */
@@ -7073,7 +7103,7 @@ export interface HookStartData {
      */
     hookType: string;
     /**
-     * Input data passed to the hook. For postToolUse hooks the retained copy served by session.eventLog.read (and by a resumed session) elides the tool result's inline `contents`/`uiResource` and replaces an over-long `textResultForLlm` with a `[copilot:elided ...]` marker, to keep a multi-megabyte payload out of the durable event log; the live subscription stream still delivers the full value. Read the adjacent tool.execution_complete event for the tool result itself.
+     * Input data passed to the hook. For postToolUse hooks the retained copy served by session.eventLog.read (and by a resumed session) drops the tool result's inline `contents`/`uiResource`/`skillInvocation` and replaces duplicated text result fields with a `[copilot:elided ...]` marker; the live subscription stream still delivers the full value. Canonical tool output remains in the adjacent tool.execution_complete event, while an invoked skill's authoritative body remains in its skill invocation event.
      */
     input?: JsonValue;
     /**
@@ -7125,7 +7155,7 @@ export interface HookEndData {
      */
     hookType: string;
     /**
-     * Output data produced by the hook
+     * Output data produced by the hook. Durable and resumed postToolUse receipts may omit messages owned by a successful skill invocation and replace an unchanged skill sessionLog copy with an elision marker; hook-modified or re-sourced values are preserved, and the authoritative body remains in the skill invocation event.
      */
     output?: JsonValue;
     /**
@@ -9139,7 +9169,7 @@ export interface PermissionMessageAuthorizationData {
     world?: JsonValue;
 }
 /**
- * Session event "permission.messageAuthorizationRead". Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.
+ * Session event "permission.messageAuthorizationRead". Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Also records whether that pass activates ongoing extraction; contextual-assent-only passes do not, so unrelated future messages remain outside extraction.
  */
 /** @experimental */
 export interface PermissionMessageAuthorizationReadEvent {
@@ -9170,10 +9200,16 @@ export interface PermissionMessageAuthorizationReadEvent {
     type: "permission.messageAuthorizationRead";
 }
 /**
- * Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Persisted purely to avoid wasted model calls across resume; it is never a correctness mechanism.
+ * Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Also records whether that pass activates ongoing extraction; contextual-assent-only passes do not, so unrelated future messages remain outside extraction.
  */
 /** @experimental */
 export interface PermissionMessageAuthorizationReadData {
+    /**
+     * Whether this read activates ongoing message-backed extraction. False for a contextual-assent-only pass while auto-approval is off, so unrelated future messages remain outside extraction.
+     *
+     * @experimental
+     */
+    activatesExtraction?: boolean;
     /**
      * The human turn that was read by the proposer.
      *
@@ -9224,6 +9260,128 @@ export interface PermissionMessageAuthorizationDegradedData {
      */
     turnIndex: number;
 }
+/**
+ * Session event "permission.assentDetected". Records that deterministic text recognition found likely assent in the human turn immediately following a root Autopilot permission request that was blocked because no interactive response was available. This event grants no authority; its model-facing projection only suggests retrying the unchanged operation.
+ */
+/** @experimental */
+export interface PermissionAssentDetectedEvent {
+    /**
+     * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
+     */
+    agentId?: string;
+    data: PermissionAssentDetectedData;
+    /**
+     * When true, the event is transient and not persisted to the session event log on disk
+     */
+    ephemeral?: boolean;
+    /**
+     * Unique event identifier (UUID v4), generated when the event is emitted
+     */
+    id: string;
+    /**
+     * ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event.
+     */
+    parentId: string | null;
+    /**
+     * ISO 8601 timestamp when the event was created
+     */
+    timestamp: string;
+    /**
+     * Type discriminator. Always "permission.assentDetected".
+     */
+    type: "permission.assentDetected";
+}
+/**
+ * Records that deterministic text recognition found likely assent in the human turn immediately following a root Autopilot permission request that was blocked because no interactive response was available. This event grants no authority; its model-facing projection only suggests retrying the unchanged operation.
+ */
+/** @experimental */
+export interface PermissionAssentDetectedData {
+    /**
+     * Permission request the likely assent may refer to. The runtime derives this from the preceding durable blocker; the human message and extraction model do not choose it.
+     *
+     * @experimental
+     */
+    requestId: string;
+    /**
+     * Human turn whose text triggered the deterministic assent recognizer.
+     *
+     * @experimental
+     */
+    turnIndex: number;
+}
+/**
+ * Session event "permission.contextualAuthorization". Freezes a blinded contextual authorization proposal whose verbatim human span was deterministically bound to the immediately preceding blocked permission request. The event carries no action fields; replay re-derives the exact action from the earlier permission request and mints a one-shot message grant only when the binding and span still verify.
+ */
+/** @experimental */
+export interface PermissionContextualAuthorizationEvent {
+    /**
+     * Sub-agent instance identifier. Absent for events from the root/main agent and session-level events.
+     */
+    agentId?: string;
+    data: PermissionContextualAuthorizationData;
+    /**
+     * When true, the event is transient and not persisted to the session event log on disk
+     */
+    ephemeral?: boolean;
+    /**
+     * Unique event identifier (UUID v4), generated when the event is emitted
+     */
+    id: string;
+    /**
+     * ID of the chronologically preceding event in the session, forming a linked chain. Null for the first event.
+     */
+    parentId: string | null;
+    /**
+     * ISO 8601 timestamp when the event was created
+     */
+    timestamp: string;
+    /**
+     * Type discriminator. Always "permission.contextualAuthorization".
+     */
+    type: "permission.contextualAuthorization";
+}
+/**
+ * Freezes a blinded contextual authorization proposal whose verbatim human span was deterministically bound to the immediately preceding blocked permission request. The event carries no action fields; replay re-derives the exact action from the earlier permission request and mints a one-shot message grant only when the binding and span still verify.
+ */
+/** @experimental */
+export interface PermissionContextualAuthorizationData {
+    /**
+     * Whether the contextual human span granted or denied authority.
+     *
+     * @experimental
+     */
+    polarity: PermissionMessageAuthorizationPolarity;
+    /**
+     * Deterministic identity of the contextual message grant.
+     *
+     * @experimental
+     */
+    recordId: string;
+    /**
+     * Original blocked permission request selected by deterministic event ordering, never by the extraction model.
+     *
+     * @experimental
+     */
+    requestId: string;
+    /**
+     * End byte offset of the contextual decision span within the turn.
+     *
+     * @experimental
+     */
+    spanEnd: number;
+    /**
+     * Start byte offset of the contextual decision span within the turn.
+     *
+     * @experimental
+     */
+    spanStart: number;
+    /**
+     * Human turn containing the contextual decision.
+     *
+     * @experimental
+     */
+    turnIndex: number;
+}
 /**
  * Session event "user_input.requested". User input request notification with question and optional predefined choices
  */
@@ -11198,6 +11356,10 @@ export interface McpServersLoadedData {
  * A single MCP server status summary in `session.mcp_servers_loaded`, including name, status, source, transport, and plugin metadata.
  */
 export interface McpServersLoadedServer {
+    /**
+     * Human-readable display name supplied by a managed server catalog.
+     */
+    displayName?: string;
     /**
      * Error message if the server failed to connect
      */

package/package.json

@@ -4,8 +4,8 @@
         "type": "git",
         "url": "https://github.com/github/copilot-sdk.git"
     },
-    "version": "1.0.14-preview.1",
-    "copilotCliVersion": "1.0.84-5",
+    "version": "1.0.14",
+    "copilotCliVersion": "1.0.85",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
@@ -36,8 +36,10 @@
         "auth:refresh": "node ../scripts/npm-auth-refresh.mjs --run",
         "clean": "rimraf --glob dist *.tgz",
         "build": "tsx esbuild-copilotsdk-nodejs.ts",
+        "acquire:runtime-packages": "tsx scripts/runtime-package-acquisition.ts",
         "pack:release": "tsx scripts/package-sdk.ts",
         "verify:release-packages": "tsx scripts/verify-release-packages.ts",
+        "release:manifest": "tsx scripts/release-manifest.ts",
         "prepare:runtime": "tsx scripts/prepare-runtime.ts",
         "test": "vitest run",
         "test:watch": "vitest",
@@ -96,13 +98,13 @@
         "README.md"
     ],
     "optionalDependencies": {
-        "@github/copilot-sdk-darwin-arm64": "1.0.14-preview.1",
-        "@github/copilot-sdk-darwin-x64": "1.0.14-preview.1",
-        "@github/copilot-sdk-linux-arm64": "1.0.14-preview.1",
-        "@github/copilot-sdk-linux-x64": "1.0.14-preview.1",
-        "@github/copilot-sdk-linuxmusl-arm64": "1.0.14-preview.1",
-        "@github/copilot-sdk-linuxmusl-x64": "1.0.14-preview.1",
-        "@github/copilot-sdk-win32-arm64": "1.0.14-preview.1",
-        "@github/copilot-sdk-win32-x64": "1.0.14-preview.1"
+        "@github/copilot-sdk-darwin-arm64": "1.0.14",
+        "@github/copilot-sdk-darwin-x64": "1.0.14",
+        "@github/copilot-sdk-linux-arm64": "1.0.14",
+        "@github/copilot-sdk-linux-x64": "1.0.14",
+        "@github/copilot-sdk-linuxmusl-arm64": "1.0.14",
+        "@github/copilot-sdk-linuxmusl-x64": "1.0.14",
+        "@github/copilot-sdk-win32-arm64": "1.0.14",
+        "@github/copilot-sdk-win32-x64": "1.0.14"
     }
 }