@github/copilot-sdk 1.0.15-preview.3 → 1.0.15-preview.4

package/README.md

@@ -124,6 +124,7 @@ new CopilotClient(options?: CopilotClientOptions)
 - `workingDirectory?: string` - Working directory for the runtime process (default: current process cwd).
 - `baseDirectory?: string` - Base directory for Copilot data (session state, config, etc.). Sets `COPILOT_HOME` on the spawned runtime. When not set, the runtime defaults to `~/.copilot`. Ignored when connecting via `RuntimeConnection.forUri`.
 - `extensionLaunchProvider?: ExtensionLaunchProvider` - Experimental connection-level resolver for extension launch profiles. The client installs the reverse-RPC handler and registers the provider during startup before sessions can be created.
+- `installationConfirmationHandler?: InstallationConfirmationHandler` - Experimental connection-global human review for `installations.confirm`. Receives the typed request and independent request/connection cancellation signals, and returns an explicit decision. Does not enable installation capabilities.
 - `logLevel?: "none" | "error" | "warning" | "info" | "debug" | "all"` - Log level. When omitted, the runtime uses its own default (currently `"info"`).
 - `env?: Record<string, string | undefined>` - Environment variables for the runtime process. When omitted, inherits `process.env`.
 - `gitHubToken?: string` - GitHub token for authentication. When provided, takes priority over other auth methods.
@@ -135,6 +136,49 @@ new CopilotClient(options?: CopilotClientOptions)
 - `sessionIdleTimeoutSeconds?: number` - Server-wide idle timeout for sessions in seconds. Ignored when connecting via `RuntimeConnection.forUri`.
 - `enableRemoteSessions?: boolean` - Enable Mission Control remote session support. Ignored when connecting via `RuntimeConnection.forUri`.
 
+#### Installation confirmation (experimental)
+
+All six SDKs (Node.js, Python, Go, .NET, Java and Rust) provide this receiver with the
+same semantics: each review gets one cancellation token, concurrent reviews are
+independent, and a decision returned after cancellation is never sent. Without a
+configured handler, an `installations.confirm` request is refused, which the
+runtime treats as no consent.
+
+The installation confirmation handler receives the generated
+`InstallationConfirmationRequest` and a `CancellationToken`. Match `operationId`
+and `policySessionId` against the exact original action on this connection
+before presenting the complete review. Refuse unknown operations or incomplete
+reviews; missing legacy session metadata is not permission to use the current
+session. Return `"confirm"`, `"decline"` or `"cancel"` only after an explicit
+human decision. The SDK echoes the original challenge and fingerprint.
+
+Concurrent reviews remain independent. The token is cancelled when the runtime
+retires the request, including runtime-enforced expiry, or when the original
+connection closes. Observe it to close pending UI. Late handler results cannot
+approve a retired request. This incoming signal does not cancel outbound
+installation or OAuth RPCs, and dropping those promises is not cancellation.
+
+Use `client.rpc.mcp.prepareInstall` before `applyInstall`: preparation returns an
+inert runtime-issued `operationId` and original expiry. Register that ID with its
+captured session on this exact client before applying. Removal uses
+`planUninstall` then `applyUninstall`; the returned `operationId` identifies the
+operation, while `planHandle` is the one-use removal input. Never interchange them.
+Use `client.rpc.mcp.installations.list` and `recover` for owned inventory.
+Inspect or cancel uncertain work through `status` and `cancel` on the original
+connection and operation ID, without selecting a replacement session or replaying apply.
+
+Owned OAuth similarly uses `session.rpc.mcp.oauth.prepareLogin` to obtain
+`loginId` before browser, network or cached-reconnect work. Retain that ID with
+the original session and `expectedInstallationId` for `login` and `cancelLogin`.
+Prepare freezes reauthentication and display options. Cancelling an incoming
+confirmation or abandoning a login promise is not a substitute for `cancelLogin`.
+Manual MCP OAuth retains its direct `login` path.
+
+A matching runtime contract and available owned-lifecycle support are required.
+Capability negotiation does not promise availability; preserve typed refusals
+instead of falling back to raw configuration writes. Generated presence and
+transport tests do not establish a working installer, live OAuth or restart safety.
+
 #### Methods
 
 ##### `start(): Promise<void>`

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.89-3";
+const COPILOT_CLI_VERSION = "1.0.89-7";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/client.js

@@ -44,6 +44,7 @@ var import_runtimeArtifacts = require("./runtimeArtifacts.js");
 var import_cliVersion = require("./cliVersion.js");
 var import_sessionFsProvider = require("./sessionFsProvider.js");
 var import_copilotRequestHandler = require("./copilotRequestHandler.js");
+var import_installationConfirmation = require("./installationConfirmation.js");
 var import_telemetry = require("./telemetry.js");
 var import_schema = require("./schema.js");
 var import_toolSet = require("./toolSet.js");
@@ -265,6 +266,7 @@ class CopilotClient {
   sessionFsConfig = null;
   requestHandler = null;
   extensionLaunchProvider;
+  installationConfirmationHandler;
   builtinPluginDirectories = [];
   onGitHubTelemetry;
   clientGlobalHandlers = {};
@@ -423,6 +425,7 @@ class CopilotClient {
     this.sessionFsConfig = options.sessionFs ?? null;
     this.requestHandler = options.requestHandler ?? null;
     this.extensionLaunchProvider = options.extensionLaunchProvider;
+    this.installationConfirmationHandler = options.installationConfirmationHandler;
     this.onGitHubTelemetry = options.onGitHubTelemetry;
     this.setupClientGlobalHandlers();
     const connEnv = conn.kind === "stdio" || conn.kind === "tcp" ? conn.env : void 0;
@@ -1339,14 +1342,12 @@ class CopilotClient {
   async resumeSession(sessionId, config) {
     return this.resumeSessionInternal(sessionId, config);
   }
+  /** @internal */
   async resumeSessionForExtension(sessionId, config, contributions = {}, extensionOptions) {
     return this.resumeSessionInternal(sessionId, config, contributions, extensionOptions);
   }
   async resumeSessionInternal(sessionId, config, contributions = {}, extensionOptions) {
-    const { factories, workflows } = Array.isArray(contributions) ? { factories: contributions, workflows: void 0 } : contributions;
-    if (factories !== void 0 && workflows !== void 0) {
-      throw new Error("Session configuration cannot include both factories and workflows");
-    }
+    const { workflows } = contributions;
     if (config.gitHubToken !== void 0 && config.gitHubTokenProvider !== void 0) {
       throw new Error("gitHubToken and gitHubTokenProvider are mutually exclusive");
     }
@@ -1366,7 +1367,6 @@ class CopilotClient {
     session.registerTools(config.tools);
     session.registerCanvases(config.canvases);
     session.registerCommands(config.commands);
-    session.registerFactories(factories);
     session.registerWorkflows(workflows);
     const {
       wireProvider: bearerWireProvider,
@@ -1448,7 +1448,6 @@ class CopilotClient {
         })),
         toolSearch: config.toolSearch,
         canvases: config.canvases?.map((canvas) => canvas.declaration),
-        factories: factories?.map((factory) => factory.meta),
         workflows: workflows?.map((workflow) => workflow.meta),
         requestCanvasRenderer: config.requestCanvasRenderer,
         requestExtensions: config.requestExtensions,
@@ -1911,6 +1910,9 @@ class CopilotClient {
     if (this.options.mode === "empty") {
       env.COPILOT_DISABLE_KEYTAR = "1";
     }
+    if (this.options.mode !== "empty") {
+      env.COPILOT_RUNTIME_PROCESS_FILE_LOGGING = "1";
+    }
     if (this.options.telemetry) {
       const t = this.options.telemetry;
       env.COPILOT_OTEL_ENABLED = "true";
@@ -2285,6 +2287,16 @@ stderr: ${stderrOutput}` : ""}`
       return session.clientSessionApis;
     });
     (0, import_rpc.registerClientGlobalApiHandlers)(this.connection, this.clientGlobalHandlers);
+    if (this.installationConfirmationHandler) {
+      const confirmation = (0, import_installationConfirmation.createInstallationConfirmationAdapter)(
+        this.connection,
+        this.installationConfirmationHandler
+      );
+      this.connection.onRequest(
+        "installations.confirm",
+        (params, token) => confirmation.confirm(params, token)
+      );
+    }
     this.connection.onRequest(
       "hooks.invoke",
       async (params) => {

package/dist/cjs/extension.js

@@ -20,12 +20,9 @@ var extension_exports = {};
 __export(extension_exports, {
   Canvas: () => import_canvas.Canvas,
   CanvasError: () => import_canvas.CanvasError,
-  FactoryResumeError: () => import_factory.FactoryResumeError,
   WorkflowResumeError: () => import_workflow.WorkflowResumeError,
   createCanvas: () => import_canvas.createCanvas,
-  defineFactory: () => import_factory.defineFactory,
   defineWorkflow: () => import_workflow.defineWorkflow,
-  isFactoryRunTerminal: () => import_factory.isFactoryRunTerminal,
   isWorkflowRunTerminal: () => import_workflow.isWorkflowRunTerminal,
   joinSession: () => joinSession
 });
@@ -33,7 +30,6 @@ module.exports = __toCommonJS(extension_exports);
 var import_client = require("./client.js");
 var import_types = require("./types.js");
 var import_canvas = require("./canvas.js");
-var import_factory = require("./factory.js");
 var import_workflow = require("./workflow.js");
 async function joinSession(config = {}) {
   const sessionId = process.env.SESSION_ID;
@@ -45,15 +41,11 @@ async function joinSession(config = {}) {
   const client = new import_client.CopilotClient({ _internalConnection: { kind: "parent-process" } });
   const {
     extensionSdkPath: _stripped,
-    factories,
     workflows,
     requestedEnvironmentVariables,
     ...rest
   } = config;
   void _stripped;
-  if (factories !== void 0 && workflows !== void 0) {
-    throw new Error("joinSession cannot register both factories and workflows");
-  }
   return client.resumeSessionForExtension(
     sessionId,
     {
@@ -61,7 +53,7 @@ async function joinSession(config = {}) {
       onPermissionRequest: config.onPermissionRequest ?? import_types.defaultJoinSessionPermissionHandler,
       suppressResumeEvent: config.suppressResumeEvent ?? true
     },
-    { factories, workflows },
+    { workflows },
     requestedEnvironmentVariables?.length ? { requestedEnvironmentVariables } : void 0
   );
 }
@@ -69,12 +61,9 @@ async function joinSession(config = {}) {
 0 && (module.exports = {
   Canvas,
   CanvasError,
-  FactoryResumeError,
   WorkflowResumeError,
   createCanvas,
-  defineFactory,
   defineWorkflow,
-  isFactoryRunTerminal,
   isWorkflowRunTerminal,
   joinSession
 });