@github/copilot-sdk 1.0.15-preview.2 → 1.0.15-preview.4

package/README.md

@@ -18,11 +18,6 @@ The checked-in `copilotCliVersion` in `package.json` and compiled metadata in
 `src/cliVersion.ts` use a development placeholder. The public SDK snapshot
 replaces both with the CLI version published for that snapshot.
 
-Do not change these pins for runtime-repository development. If they contain
-`0.0.0-dev`, use the same-checkout runtime; release snapshot export owns replacing
-development placeholders with a published CLI version. See
-[checkout preparation](../CONTRIBUTING.md#testing-an-unreleased-runtime-api).
-
 `npm run pack:release` builds the main package and all platform packages. Set
 `COPILOT_CLI_DOWNLOAD_BASE_URL` to use a release mirror while packaging.
 Release workflows instead set `COPILOT_SDK_RUNTIME_PACKAGE_DIR` to a directory
@@ -44,11 +39,7 @@ npm install @github/copilot-sdk
 
 ## Run the Sample
 
-Try the interactive chat sample from the SDK root (`src/sdk` when nested).
-In the runtime repository, first run `pnpm run build:cli` from the runtime root
-to prepare the same-checkout executable, then return to `src/sdk`.
-Building the Node SDK alone does not build the runtime. For dependency
-prerequisites, see [development setup](#development).
+Try the interactive chat sample (from the repo root):
 
 ```bash
 cd nodejs
@@ -133,6 +124,7 @@ new CopilotClient(options?: CopilotClientOptions)
 - `workingDirectory?: string` - Working directory for the runtime process (default: current process cwd).
 - `baseDirectory?: string` - Base directory for Copilot data (session state, config, etc.). Sets `COPILOT_HOME` on the spawned runtime. When not set, the runtime defaults to `~/.copilot`. Ignored when connecting via `RuntimeConnection.forUri`.
 - `extensionLaunchProvider?: ExtensionLaunchProvider` - Experimental connection-level resolver for extension launch profiles. The client installs the reverse-RPC handler and registers the provider during startup before sessions can be created.
+- `installationConfirmationHandler?: InstallationConfirmationHandler` - Experimental connection-global human review for `installations.confirm`. Receives the typed request and independent request/connection cancellation signals, and returns an explicit decision. Does not enable installation capabilities.
 - `logLevel?: "none" | "error" | "warning" | "info" | "debug" | "all"` - Log level. When omitted, the runtime uses its own default (currently `"info"`).
 - `env?: Record<string, string | undefined>` - Environment variables for the runtime process. When omitted, inherits `process.env`.
 - `gitHubToken?: string` - GitHub token for authentication. When provided, takes priority over other auth methods.
@@ -144,6 +136,49 @@ new CopilotClient(options?: CopilotClientOptions)
 - `sessionIdleTimeoutSeconds?: number` - Server-wide idle timeout for sessions in seconds. Ignored when connecting via `RuntimeConnection.forUri`.
 - `enableRemoteSessions?: boolean` - Enable Mission Control remote session support. Ignored when connecting via `RuntimeConnection.forUri`.
 
+#### Installation confirmation (experimental)
+
+All six SDKs (Node.js, Python, Go, .NET, Java and Rust) provide this receiver with the
+same semantics: each review gets one cancellation token, concurrent reviews are
+independent, and a decision returned after cancellation is never sent. Without a
+configured handler, an `installations.confirm` request is refused, which the
+runtime treats as no consent.
+
+The installation confirmation handler receives the generated
+`InstallationConfirmationRequest` and a `CancellationToken`. Match `operationId`
+and `policySessionId` against the exact original action on this connection
+before presenting the complete review. Refuse unknown operations or incomplete
+reviews; missing legacy session metadata is not permission to use the current
+session. Return `"confirm"`, `"decline"` or `"cancel"` only after an explicit
+human decision. The SDK echoes the original challenge and fingerprint.
+
+Concurrent reviews remain independent. The token is cancelled when the runtime
+retires the request, including runtime-enforced expiry, or when the original
+connection closes. Observe it to close pending UI. Late handler results cannot
+approve a retired request. This incoming signal does not cancel outbound
+installation or OAuth RPCs, and dropping those promises is not cancellation.
+
+Use `client.rpc.mcp.prepareInstall` before `applyInstall`: preparation returns an
+inert runtime-issued `operationId` and original expiry. Register that ID with its
+captured session on this exact client before applying. Removal uses
+`planUninstall` then `applyUninstall`; the returned `operationId` identifies the
+operation, while `planHandle` is the one-use removal input. Never interchange them.
+Use `client.rpc.mcp.installations.list` and `recover` for owned inventory.
+Inspect or cancel uncertain work through `status` and `cancel` on the original
+connection and operation ID, without selecting a replacement session or replaying apply.
+
+Owned OAuth similarly uses `session.rpc.mcp.oauth.prepareLogin` to obtain
+`loginId` before browser, network or cached-reconnect work. Retain that ID with
+the original session and `expectedInstallationId` for `login` and `cancelLogin`.
+Prepare freezes reauthentication and display options. Cancelling an incoming
+confirmation or abandoning a login promise is not a substitute for `cancelLogin`.
+Manual MCP OAuth retains its direct `login` path.
+
+A matching runtime contract and available owned-lifecycle support are required.
+Capability negotiation does not promise availability; preserve typed refusals
+instead of falling back to raw configuration writes. Generated presence and
+transport tests do not establish a working installer, live OAuth or restart safety.
+
 #### Methods
 
 ##### `start(): Promise<void>`
@@ -172,6 +207,7 @@ Create a new conversation session.
 - `systemMessage?: SystemMessageConfig` - System message customization (see below)
 - `infiniteSessions?: InfiniteSessionConfig` - Configure automatic context compaction (see below)
 - `workingDirectory?: string` - Working directory for the session (default: runtime process cwd).
+- `refreshCustomInstructions?: boolean` - Invalidates the process-wide custom-instruction discovery cache before creating this session, so instruction-file edits made in the same runtime are read again. Defaults to `false` (cache reuse). Other sessions in this runtime may observe updated instructions on later turns or discovery. This does not watch files or enable disabled instruction loading. Available on `SessionConfig`, not `ResumeSessionConfig`.
 - `enableSessionStore?: boolean` - Enables the cross-session store for search and retrieval across sessions. When unset in `"copilot-cli"` mode, the runtime default applies (enabled). In `"empty"` mode, defaults to disabled.
 - `gitHubTokenProvider?: GitHubTokenProvider` - Acquires rotating, session-scoped GitHub tokens. Token results require a positive `expiresIn` value in seconds remaining when the callback completes; production tokens typically last eight hours. Cannot be combined with `gitHubToken`.
 - `provider?: ProviderConfig` - Custom API provider configuration (BYOK - Bring Your Own Key). See [Custom Providers](#custom-providers) section.
@@ -309,6 +345,7 @@ Source is independent of delivery mode. Leaving it unset preserves the existing
 ##### `sendAndWait(options: MessageOptions, timeout?: number): Promise<AssistantMessageEvent | undefined>`
 
 Send a message and wait until the session becomes idle.
+Sub-agent events are still delivered to listeners, but do not complete the wait or supply its reply.
 
 **Options:**
 
@@ -1288,28 +1325,19 @@ try {
 
 ## Development
 
-Follow [SDK development setup](../CONTRIBUTING.md#developing-an-sdk) first,
-including the harness and corrections-script dependencies. From the SDK root
-(`src/sdk` in the runtime repository, or the standalone repository root):
+From the repository root:
 
 ```bash
-npm run build:nodejs
-npm run test:nodejs
-npm run check:nodejs
+cd test/harness
+npm ci
 ```
 
-In the runtime layout, these build/test commands refresh the projection and
-prepare the checked-out runtime for tests. For focused unit tests after
-installing Node dependencies:
-
 ```bash
-npm --prefix nodejs run test:unit
+cd nodejs
+npm ci
+npm test
 ```
 
-For native Vitest selectors on E2Es, use the
-[prepared-runtime instructions](../CONTRIBUTING.md#testing-an-unreleased-runtime-api);
-the SDK facade does not forward selectors.
-
 ## License
 
 MIT

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.89-1";
+const COPILOT_CLI_VERSION = "1.0.89-7";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/client.js

@@ -44,6 +44,7 @@ var import_runtimeArtifacts = require("./runtimeArtifacts.js");
 var import_cliVersion = require("./cliVersion.js");
 var import_sessionFsProvider = require("./sessionFsProvider.js");
 var import_copilotRequestHandler = require("./copilotRequestHandler.js");
+var import_installationConfirmation = require("./installationConfirmation.js");
 var import_telemetry = require("./telemetry.js");
 var import_schema = require("./schema.js");
 var import_toolSet = require("./toolSet.js");
@@ -265,6 +266,7 @@ class CopilotClient {
   sessionFsConfig = null;
   requestHandler = null;
   extensionLaunchProvider;
+  installationConfirmationHandler;
   builtinPluginDirectories = [];
   onGitHubTelemetry;
   clientGlobalHandlers = {};
@@ -423,6 +425,7 @@ class CopilotClient {
     this.sessionFsConfig = options.sessionFs ?? null;
     this.requestHandler = options.requestHandler ?? null;
     this.extensionLaunchProvider = options.extensionLaunchProvider;
+    this.installationConfirmationHandler = options.installationConfirmationHandler;
     this.onGitHubTelemetry = options.onGitHubTelemetry;
     this.setupClientGlobalHandlers();
     const connEnv = conn.kind === "stdio" || conn.kind === "tcp" ? conn.env : void 0;
@@ -1237,6 +1240,7 @@ class CopilotClient {
         includeSubAgentStreamingEvents: config.includeSubAgentStreamingEvents ?? true,
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
+        ...config.diagnostics !== void 0 ? { diagnostics: config.diagnostics } : {},
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
         authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
@@ -1246,6 +1250,7 @@ class CopilotClient {
         agent: config.agent,
         configDir: config.configDirectory,
         enableConfigDiscovery: config.enableConfigDiscovery,
+        refreshCustomInstructions: config.refreshCustomInstructions,
         skipEmbeddingRetrieval: config.skipEmbeddingRetrieval,
         embeddingCacheStorage: config.embeddingCacheStorage,
         organizationCustomInstructions: config.organizationCustomInstructions,
@@ -1337,14 +1342,12 @@ class CopilotClient {
   async resumeSession(sessionId, config) {
     return this.resumeSessionInternal(sessionId, config);
   }
+  /** @internal */
   async resumeSessionForExtension(sessionId, config, contributions = {}, extensionOptions) {
     return this.resumeSessionInternal(sessionId, config, contributions, extensionOptions);
   }
   async resumeSessionInternal(sessionId, config, contributions = {}, extensionOptions) {
-    const { factories, workflows } = Array.isArray(contributions) ? { factories: contributions, workflows: void 0 } : contributions;
-    if (factories !== void 0 && workflows !== void 0) {
-      throw new Error("Session configuration cannot include both factories and workflows");
-    }
+    const { workflows } = contributions;
     if (config.gitHubToken !== void 0 && config.gitHubTokenProvider !== void 0) {
       throw new Error("gitHubToken and gitHubTokenProvider are mutually exclusive");
     }
@@ -1364,7 +1367,6 @@ class CopilotClient {
     session.registerTools(config.tools);
     session.registerCanvases(config.canvases);
     session.registerCommands(config.commands);
-    session.registerFactories(factories);
     session.registerWorkflows(workflows);
     const {
       wireProvider: bearerWireProvider,
@@ -1446,7 +1448,6 @@ class CopilotClient {
         })),
         toolSearch: config.toolSearch,
         canvases: config.canvases?.map((canvas) => canvas.declaration),
-        factories: factories?.map((factory) => factory.meta),
         workflows: workflows?.map((workflow) => workflow.meta),
         requestCanvasRenderer: config.requestCanvasRenderer,
         requestExtensions: config.requestExtensions,
@@ -1488,6 +1489,7 @@ class CopilotClient {
         includeSubAgentStreamingEvents: config.includeSubAgentStreamingEvents ?? true,
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
+        ...config.diagnostics !== void 0 ? { diagnostics: config.diagnostics } : {},
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
         authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
@@ -1908,6 +1910,9 @@ class CopilotClient {
     if (this.options.mode === "empty") {
       env.COPILOT_DISABLE_KEYTAR = "1";
     }
+    if (this.options.mode !== "empty") {
+      env.COPILOT_RUNTIME_PROCESS_FILE_LOGGING = "1";
+    }
     if (this.options.telemetry) {
       const t = this.options.telemetry;
       env.COPILOT_OTEL_ENABLED = "true";
@@ -2282,6 +2287,16 @@ stderr: ${stderrOutput}` : ""}`
       return session.clientSessionApis;
     });
     (0, import_rpc.registerClientGlobalApiHandlers)(this.connection, this.clientGlobalHandlers);
+    if (this.installationConfirmationHandler) {
+      const confirmation = (0, import_installationConfirmation.createInstallationConfirmationAdapter)(
+        this.connection,
+        this.installationConfirmationHandler
+      );
+      this.connection.onRequest(
+        "installations.confirm",
+        (params, token) => confirmation.confirm(params, token)
+      );
+    }
     this.connection.onRequest(
       "hooks.invoke",
       async (params) => {

package/dist/cjs/extension.js

@@ -20,12 +20,9 @@ var extension_exports = {};
 __export(extension_exports, {
   Canvas: () => import_canvas.Canvas,
   CanvasError: () => import_canvas.CanvasError,
-  FactoryResumeError: () => import_factory.FactoryResumeError,
   WorkflowResumeError: () => import_workflow.WorkflowResumeError,
   createCanvas: () => import_canvas.createCanvas,
-  defineFactory: () => import_factory.defineFactory,
   defineWorkflow: () => import_workflow.defineWorkflow,
-  isFactoryRunTerminal: () => import_factory.isFactoryRunTerminal,
   isWorkflowRunTerminal: () => import_workflow.isWorkflowRunTerminal,
   joinSession: () => joinSession
 });
@@ -33,7 +30,6 @@ module.exports = __toCommonJS(extension_exports);
 var import_client = require("./client.js");
 var import_types = require("./types.js");
 var import_canvas = require("./canvas.js");
-var import_factory = require("./factory.js");
 var import_workflow = require("./workflow.js");
 async function joinSession(config = {}) {
   const sessionId = process.env.SESSION_ID;
@@ -45,15 +41,11 @@ async function joinSession(config = {}) {
   const client = new import_client.CopilotClient({ _internalConnection: { kind: "parent-process" } });
   const {
     extensionSdkPath: _stripped,
-    factories,
     workflows,
     requestedEnvironmentVariables,
     ...rest
   } = config;
   void _stripped;
-  if (factories !== void 0 && workflows !== void 0) {
-    throw new Error("joinSession cannot register both factories and workflows");
-  }
   return client.resumeSessionForExtension(
     sessionId,
     {
@@ -61,7 +53,7 @@ async function joinSession(config = {}) {
       onPermissionRequest: config.onPermissionRequest ?? import_types.defaultJoinSessionPermissionHandler,
       suppressResumeEvent: config.suppressResumeEvent ?? true
     },
-    { factories, workflows },
+    { workflows },
     requestedEnvironmentVariables?.length ? { requestedEnvironmentVariables } : void 0
   );
 }
@@ -69,12 +61,9 @@ async function joinSession(config = {}) {
 0 && (module.exports = {
   Canvas,
   CanvasError,
-  FactoryResumeError,
   WorkflowResumeError,
   createCanvas,
-  defineFactory,
   defineWorkflow,
-  isFactoryRunTerminal,
   isWorkflowRunTerminal,
   joinSession
 });