@github/copilot-sdk 1.0.15-unstable.35395657398.gad69ee1 → 1.0.15

package/README.md

@@ -14,10 +14,9 @@ verified `github/copilot-cli` release assets when the SDK is published, so
 starting the SDK performs no runtime download. Set `COPILOT_CLI_PATH` to use an
 existing installation instead.
 
-The checked-in release pin is `copilotCliVersion` in `package.json`. Run
-`npm run set:cli-version -- <version>` to update it and regenerate the compiled
-metadata in `src/cliVersion.ts`. Packaging verifies release assets against the
-release's `SHA256SUMS.txt`.
+The checked-in `copilotCliVersion` in `package.json` and compiled metadata in
+`src/cliVersion.ts` use a development placeholder. The public SDK snapshot
+replaces both with the CLI version published for that snapshot.
 
 `npm run pack:release` builds the main package and all platform packages. Set
 `COPILOT_CLI_DOWNLOAD_BASE_URL` to use a release mirror while packaging.
@@ -26,6 +25,12 @@ containing validated runtime npm package roots named for all eight platforms.
 This keeps `COPILOT_CLI_USE_NPM_PACKAGE` false and embeds those runtime files in
 the self-contained SDK platform packages.
 
+In the runtime repository, packaging uses the prepared same-checkout runtime.
+Set `COPILOT_SDK_RUNTIME_PLATFORMS` to the available target (for example,
+`linux-x64`) for both `pack:release` and `verify:release-packages`. SDK CI checks
+that target only; public release workflows leave this unset to package and
+verify all eight platforms.
+
 ## Installation
 
 ```bash
@@ -118,6 +123,8 @@ new CopilotClient(options?: CopilotClientOptions)
 - `mode?: "empty" | "copilot-cli"` - Defaulting strategy. Use `"empty"` for multi-user server mode; defaults to `"copilot-cli"`.
 - `workingDirectory?: string` - Working directory for the runtime process (default: current process cwd).
 - `baseDirectory?: string` - Base directory for Copilot data (session state, config, etc.). Sets `COPILOT_HOME` on the spawned runtime. When not set, the runtime defaults to `~/.copilot`. Ignored when connecting via `RuntimeConnection.forUri`.
+- `extensionLaunchProvider?: ExtensionLaunchProvider` - Experimental connection-level resolver for extension launch profiles. The client installs the reverse-RPC handler and registers the provider during startup before sessions can be created.
+- `installationConfirmationHandler?: InstallationConfirmationHandler` - Experimental connection-global human review for `installations.confirm`. Receives the typed request and independent request/connection cancellation signals, and returns an explicit decision. Does not enable installation capabilities.
 - `logLevel?: "none" | "error" | "warning" | "info" | "debug" | "all"` - Log level. When omitted, the runtime uses its own default (currently `"info"`).
 - `env?: Record<string, string | undefined>` - Environment variables for the runtime process. When omitted, inherits `process.env`.
 - `gitHubToken?: string` - GitHub token for authentication. When provided, takes priority over other auth methods.
@@ -129,6 +136,49 @@ new CopilotClient(options?: CopilotClientOptions)
 - `sessionIdleTimeoutSeconds?: number` - Server-wide idle timeout for sessions in seconds. Ignored when connecting via `RuntimeConnection.forUri`.
 - `enableRemoteSessions?: boolean` - Enable Mission Control remote session support. Ignored when connecting via `RuntimeConnection.forUri`.
 
+#### Installation confirmation (experimental)
+
+All six SDKs (Node.js, Python, Go, .NET, Java and Rust) provide this receiver with the
+same semantics: each review gets one cancellation token, concurrent reviews are
+independent, and a decision returned after cancellation is never sent. Without a
+configured handler, an `installations.confirm` request is refused, which the
+runtime treats as no consent.
+
+The installation confirmation handler receives the generated
+`InstallationConfirmationRequest` and a `CancellationToken`. Match `operationId`
+and `policySessionId` against the exact original action on this connection
+before presenting the complete review. Refuse unknown operations or incomplete
+reviews; missing legacy session metadata is not permission to use the current
+session. Return `"confirm"`, `"decline"` or `"cancel"` only after an explicit
+human decision. The SDK echoes the original challenge and fingerprint.
+
+Concurrent reviews remain independent. The token is cancelled when the runtime
+retires the request, including runtime-enforced expiry, or when the original
+connection closes. Observe it to close pending UI. Late handler results cannot
+approve a retired request. This incoming signal does not cancel outbound
+installation or OAuth RPCs, and dropping those promises is not cancellation.
+
+Use `client.rpc.mcp.prepareInstall` before `applyInstall`: preparation returns an
+inert runtime-issued `operationId` and original expiry. Register that ID with its
+captured session on this exact client before applying. Removal uses
+`planUninstall` then `applyUninstall`; the returned `operationId` identifies the
+operation, while `planHandle` is the one-use removal input. Never interchange them.
+Use `client.rpc.mcp.installations.list` and `recover` for owned inventory.
+Inspect or cancel uncertain work through `status` and `cancel` on the original
+connection and operation ID, without selecting a replacement session or replaying apply.
+
+Owned OAuth similarly uses `session.rpc.mcp.oauth.prepareLogin` to obtain
+`loginId` before browser, network or cached-reconnect work. Retain that ID with
+the original session and `expectedInstallationId` for `login` and `cancelLogin`.
+Prepare freezes reauthentication and display options. Cancelling an incoming
+confirmation or abandoning a login promise is not a substitute for `cancelLogin`.
+Manual MCP OAuth retains its direct `login` path.
+
+A matching runtime contract and available owned-lifecycle support are required.
+Capability negotiation does not promise availability; preserve typed refusals
+instead of falling back to raw configuration writes. Generated presence and
+transport tests do not establish a working installer, live OAuth or restart safety.
+
 #### Methods
 
 ##### `start(): Promise<void>`
@@ -157,6 +207,7 @@ Create a new conversation session.
 - `systemMessage?: SystemMessageConfig` - System message customization (see below)
 - `infiniteSessions?: InfiniteSessionConfig` - Configure automatic context compaction (see below)
 - `workingDirectory?: string` - Working directory for the session (default: runtime process cwd).
+- `refreshCustomInstructions?: boolean` - Invalidates the process-wide custom-instruction discovery cache before creating this session, so instruction-file edits made in the same runtime are read again. Defaults to `false` (cache reuse). Other sessions in this runtime may observe updated instructions on later turns or discovery. This does not watch files or enable disabled instruction loading. Available on `SessionConfig`, not `ResumeSessionConfig`.
 - `enableSessionStore?: boolean` - Enables the cross-session store for search and retrieval across sessions. When unset in `"copilot-cli"` mode, the runtime default applies (enabled). In `"empty"` mode, defaults to disabled.
 - `gitHubTokenProvider?: GitHubTokenProvider` - Acquires rotating, session-scoped GitHub tokens. Token results require a positive `expiresIn` value in seconds remaining when the callback completes; production tokens typically last eight hours. Cannot be combined with `gitHubToken`.
 - `provider?: ProviderConfig` - Custom API provider configuration (BYOK - Bring Your Own Key). See [Custom Providers](#custom-providers) section.
@@ -294,6 +345,7 @@ Source is independent of delivery mode. Leaving it unset preserves the existing
 ##### `sendAndWait(options: MessageOptions, timeout?: number): Promise<AssistantMessageEvent | undefined>`
 
 Send a message and wait until the session becomes idle.
+Sub-agent events are still delivered to listeners, but do not complete the wait or supply its reply.
 
 **Options:**
 

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.86-unstable.r35389812552.g657d1e5";
+const COPILOT_CLI_VERSION = "1.0.89";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/client.js

@@ -44,6 +44,7 @@ var import_runtimeArtifacts = require("./runtimeArtifacts.js");
 var import_cliVersion = require("./cliVersion.js");
 var import_sessionFsProvider = require("./sessionFsProvider.js");
 var import_copilotRequestHandler = require("./copilotRequestHandler.js");
+var import_installationConfirmation = require("./installationConfirmation.js");
 var import_telemetry = require("./telemetry.js");
 var import_schema = require("./schema.js");
 var import_toolSet = require("./toolSet.js");
@@ -226,6 +227,7 @@ class CopilotClient {
   cliProcess = null;
   ffiHost = null;
   connection = null;
+  requestAdapter = null;
   messageWriter = null;
   connectionClosed = false;
   socket = null;
@@ -263,6 +265,8 @@ class CopilotClient {
   /** Connection-level session filesystem config, set via constructor option. */
   sessionFsConfig = null;
   requestHandler = null;
+  extensionLaunchProvider;
+  installationConfirmationHandler;
   builtinPluginDirectories = [];
   onGitHubTelemetry;
   clientGlobalHandlers = {};
@@ -420,6 +424,8 @@ class CopilotClient {
     this.onGetTraceContext = options.onGetTraceContext;
     this.sessionFsConfig = options.sessionFs ?? null;
     this.requestHandler = options.requestHandler ?? null;
+    this.extensionLaunchProvider = options.extensionLaunchProvider;
+    this.installationConfirmationHandler = options.installationConfirmationHandler;
     this.onGitHubTelemetry = options.onGitHubTelemetry;
     this.setupClientGlobalHandlers();
     const connEnv = conn.kind === "stdio" || conn.kind === "tcp" ? conn.env : void 0;
@@ -522,14 +528,16 @@ class CopilotClient {
   }
   setupClientGlobalHandlers() {
     const handlers = {};
+    handlers.extensionLaunchProvider = this.extensionLaunchProvider;
     if (this.requestHandler) {
-      handlers.llmInference = (0, import_copilotRequestHandler.createCopilotRequestAdapter)(this.requestHandler, () => {
+      this.requestAdapter = (0, import_copilotRequestHandler.createCopilotRequestAdapter)(this.requestHandler, () => {
         if (!this.connection) {
           return void 0;
         }
         this._rpc ??= (0, import_rpc.createServerRpc)(this.connection);
         return this._rpc;
       });
+      handlers.llmInference = this.requestAdapter;
     }
     if (this.onGitHubTelemetry) {
       const onGitHubTelemetry = this.onGitHubTelemetry;
@@ -634,6 +642,9 @@ class CopilotClient {
       }
       await this.connectToServer();
       await this.verifyProtocolVersion();
+      if (this.extensionLaunchProvider) {
+        await this.rpc.registerExtensionLaunchProvider();
+      }
       if (this.builtinPluginDirectories.length > 0) {
         try {
           await this.connection.sendRequest("plugins.builtin.set", {
@@ -722,6 +733,7 @@ class CopilotClient {
     }
     this.sessions.clear();
     this.githubTokenProviders.clear();
+    this.requestAdapter?.cancelPending();
     if (this.connection && !this.connectionClosed && (this.cliProcess || this.ffiHost) && !this.isExternalServer) {
       const runtimeShutdownStart = Date.now();
       const shutdownPromise = this.rpc.runtime.shutdown();
@@ -877,6 +889,7 @@ class CopilotClient {
     }
     this.sessions.clear();
     this.githubTokenProviders.clear();
+    this.requestAdapter?.cancelPending();
     if (this.messageWriter) {
       this.messageWriter.suppressWriteErrors = true;
     }
@@ -1227,6 +1240,7 @@ class CopilotClient {
         includeSubAgentStreamingEvents: config.includeSubAgentStreamingEvents ?? true,
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
+        ...config.diagnostics !== void 0 ? { diagnostics: config.diagnostics } : {},
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
         authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
@@ -1236,6 +1250,7 @@ class CopilotClient {
         agent: config.agent,
         configDir: config.configDirectory,
         enableConfigDiscovery: config.enableConfigDiscovery,
+        refreshCustomInstructions: config.refreshCustomInstructions,
         skipEmbeddingRetrieval: config.skipEmbeddingRetrieval,
         embeddingCacheStorage: config.embeddingCacheStorage,
         organizationCustomInstructions: config.organizationCustomInstructions,
@@ -1328,10 +1343,11 @@ class CopilotClient {
     return this.resumeSessionInternal(sessionId, config);
   }
   /** @internal */
-  async resumeSessionForExtension(sessionId, config, factories, extensionOptions) {
-    return this.resumeSessionInternal(sessionId, config, factories, extensionOptions);
+  async resumeSessionForExtension(sessionId, config, contributions = {}, extensionOptions) {
+    return this.resumeSessionInternal(sessionId, config, contributions, extensionOptions);
   }
-  async resumeSessionInternal(sessionId, config, factories, extensionOptions) {
+  async resumeSessionInternal(sessionId, config, contributions = {}, extensionOptions) {
+    const { workflows } = contributions;
     if (config.gitHubToken !== void 0 && config.gitHubTokenProvider !== void 0) {
       throw new Error("gitHubToken and gitHubTokenProvider are mutually exclusive");
     }
@@ -1351,7 +1367,7 @@ class CopilotClient {
     session.registerTools(config.tools);
     session.registerCanvases(config.canvases);
     session.registerCommands(config.commands);
-    session.registerFactories(factories);
+    session.registerWorkflows(workflows);
     const {
       wireProvider: bearerWireProvider,
       wireProviders: bearerWireProviders,
@@ -1432,7 +1448,7 @@ class CopilotClient {
         })),
         toolSearch: config.toolSearch,
         canvases: config.canvases?.map((canvas) => canvas.declaration),
-        factories: factories?.map((factory) => factory.meta),
+        workflows: workflows?.map((workflow) => workflow.meta),
         requestCanvasRenderer: config.requestCanvasRenderer,
         requestExtensions: config.requestExtensions,
         extensionSdkPath: config.extensionSdkPath,
@@ -1473,6 +1489,7 @@ class CopilotClient {
         includeSubAgentStreamingEvents: config.includeSubAgentStreamingEvents ?? true,
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
+        ...config.diagnostics !== void 0 ? { diagnostics: config.diagnostics } : {},
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
         authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
@@ -1893,6 +1910,9 @@ class CopilotClient {
     if (this.options.mode === "empty") {
       env.COPILOT_DISABLE_KEYTAR = "1";
     }
+    if (this.options.mode !== "empty") {
+      env.COPILOT_RUNTIME_PROCESS_FILE_LOGGING = "1";
+    }
     if (this.options.telemetry) {
       const t = this.options.telemetry;
       env.COPILOT_OTEL_ENABLED = "true";
@@ -2267,6 +2287,16 @@ stderr: ${stderrOutput}` : ""}`
       return session.clientSessionApis;
     });
     (0, import_rpc.registerClientGlobalApiHandlers)(this.connection, this.clientGlobalHandlers);
+    if (this.installationConfirmationHandler) {
+      const confirmation = (0, import_installationConfirmation.createInstallationConfirmationAdapter)(
+        this.connection,
+        this.installationConfirmationHandler
+      );
+      this.connection.onRequest(
+        "installations.confirm",
+        (params, token) => confirmation.confirm(params, token)
+      );
+    }
     this.connection.onRequest(
       "hooks.invoke",
       async (params) => {
@@ -2285,6 +2315,7 @@ stderr: ${stderrOutput}` : ""}`
       }
       this.sessions.clear();
       this.githubTokenProviders.clear();
+      this.requestAdapter?.cancelPending();
     };
     this.connection.onClose(markDisconnected);
     this.connection.onError(() => {

package/dist/cjs/copilotRequestHandler.js

@@ -27,6 +27,7 @@ __export(copilotRequestHandler_exports, {
 module.exports = __toCommonJS(copilotRequestHandler_exports);
 const sharedTextDecoder = new TextDecoder("utf-8", { fatal: false });
 const sharedTextEncoder = new TextEncoder();
+const HTTP_RESPONSE_READ_AHEAD_BYTES = 32 * 1024;
 const kBridge = /* @__PURE__ */ Symbol("copilotWebSocketResponseBridge");
 const kCompletion = /* @__PURE__ */ Symbol("copilotWebSocketCompletion");
 const kOpen = /* @__PURE__ */ Symbol("copilotWebSocketOpen");
@@ -265,7 +266,9 @@ function createCopilotRequestAdapter(handler, getServerRpc) {
       const message = err instanceof Error ? err.message : String(err);
       await finalize(exchange, 502, message);
     } finally {
-      pending.delete(exchange.requestId);
+      if (pending.get(exchange.requestId) === exchange) {
+        pending.delete(exchange.requestId);
+      }
     }
   }
   return {
@@ -278,6 +281,13 @@ function createCopilotRequestAdapter(handler, getServerRpc) {
     async httpRequestChunk(params) {
       routeChunk(getOrCreate(params.requestId), params);
       return {};
+    },
+    cancelPending() {
+      const exchanges = [...pending.values()];
+      pending.clear();
+      for (const exchange of exchanges) {
+        exchange.pushCancel("RPC connection closed");
+      }
     }
   };
 }
@@ -526,30 +536,156 @@ async function drainAsync(stream) {
   return out;
 }
 async function streamResponse(response, exchange) {
-  await exchange.startResponse({
-    status: response.status,
-    statusText: response.statusText || void 0,
-    headers: headersToMultiMap(response.headers)
-  });
-  const body = response.body;
-  if (!body) {
-    await exchange.endResponse();
-    return;
-  }
-  const reader = body.getReader();
+  const reader = response.body ? new HttpResponseReader(response.body, exchange.signal) : void 0;
   try {
-    for (; ; ) {
-      const { value, done } = await reader.read();
-      if (done) {
-        break;
-      }
-      if (value && value.byteLength > 0) {
-        await exchange.writeResponse(value);
+    await exchange.startResponse({
+      status: response.status,
+      statusText: response.statusText || void 0,
+      headers: headersToMultiMap(response.headers)
+    });
+    if (reader) {
+      for (; ; ) {
+        const chunk = await reader.nextChunk();
+        if (!chunk) {
+          break;
+        }
+        await exchange.writeResponse(chunk);
       }
     }
     await exchange.endResponse();
   } finally {
-    reader.releaseLock();
+    await reader?.dispose();
+  }
+}
+class HttpResponseReader {
+  #reader;
+  #signal;
+  #frames = [];
+  #pump;
+  #onAbort;
+  #queued = 0;
+  #done = false;
+  #cancelled = false;
+  #hasError = false;
+  #error;
+  #dataWaker;
+  #spaceWaker;
+  #cancelPromise;
+  constructor(body, signal) {
+    this.#reader = body.getReader();
+    this.#signal = signal;
+    this.#onAbort = () => {
+      void this.cancel(signal.reason);
+    };
+    signal.addEventListener("abort", this.#onAbort, { once: true });
+    this.#pump = this.#pumpSource();
+    if (signal.aborted) {
+      this.#onAbort();
+    }
+  }
+  async nextChunk() {
+    while (this.#frames.length === 0 && !this.#done && !this.#hasError) {
+      await new Promise((resolve) => {
+        this.#dataWaker = resolve;
+      });
+    }
+    if (this.#frames.length > 0) {
+      const chunk = this.#takeQueued();
+      this.#wakeSpace();
+      return chunk;
+    }
+    if (this.#hasError) {
+      this.#hasError = false;
+      throw this.#error;
+    }
+    return void 0;
+  }
+  #takeQueued() {
+    const frames = this.#frames;
+    const total = this.#queued;
+    this.#queued = 0;
+    if (frames.length === 1) {
+      return frames.pop();
+    }
+    const chunk = new Uint8Array(total);
+    let offset = 0;
+    for (const frame of frames) {
+      chunk.set(frame, offset);
+      offset += frame.byteLength;
+    }
+    frames.length = 0;
+    return chunk;
+  }
+  async dispose() {
+    this.#signal.removeEventListener("abort", this.#onAbort);
+    if (!this.#done) {
+      await this.cancel();
+    } else if (this.#cancelPromise) {
+      await this.#cancelPromise;
+    }
+    await this.#pump;
+  }
+  cancel(reason) {
+    if (this.#done) {
+      return Promise.resolve();
+    }
+    if (!this.#cancelPromise) {
+      this.#cancelled = true;
+      this.#done = true;
+      this.#hasError = true;
+      this.#error = reason instanceof Error ? reason : new Error("HTTP response body cancelled.");
+      this.#frames.length = 0;
+      this.#queued = 0;
+      this.#wakeData();
+      this.#wakeSpace();
+      this.#cancelPromise = this.#reader.cancel(reason).catch(() => void 0);
+    }
+    return this.#cancelPromise;
+  }
+  async #pumpSource() {
+    try {
+      while (!this.#cancelled) {
+        while (this.#queued >= HTTP_RESPONSE_READ_AHEAD_BYTES && !this.#cancelled) {
+          await new Promise((resolve) => {
+            this.#spaceWaker = resolve;
+          });
+        }
+        if (this.#cancelled) {
+          return;
+        }
+        const { value, done } = await this.#reader.read();
+        if (done) {
+          return;
+        }
+        if (value.byteLength > 0) {
+          this.#frames.push(value);
+          this.#queued += value.byteLength;
+          this.#wakeData();
+          continue;
+        }
+        await new Promise((resolve) => setImmediate(resolve));
+      }
+    } catch (error) {
+      if (!this.#cancelled) {
+        this.#hasError = true;
+        this.#error = error;
+      }
+    } finally {
+      this.#done = true;
+      this.#wakeData();
+      this.#wakeSpace();
+      this.#reader.releaseLock();
+    }
+  }
+  #wakeData() {
+    const waker = this.#dataWaker;
+    this.#dataWaker = void 0;
+    waker?.();
+  }
+  #wakeSpace() {
+    const waker = this.#spaceWaker;
+    this.#spaceWaker = void 0;
+    waker?.();
   }
 }
 function headersToMultiMap(headers) {

package/dist/cjs/extension.js

@@ -20,17 +20,17 @@ var extension_exports = {};
 __export(extension_exports, {
   Canvas: () => import_canvas.Canvas,
   CanvasError: () => import_canvas.CanvasError,
-  FactoryResumeError: () => import_factory.FactoryResumeError,
+  WorkflowResumeError: () => import_workflow.WorkflowResumeError,
   createCanvas: () => import_canvas.createCanvas,
-  defineFactory: () => import_factory.defineFactory,
-  isFactoryRunTerminal: () => import_factory.isFactoryRunTerminal,
+  defineWorkflow: () => import_workflow.defineWorkflow,
+  isWorkflowRunTerminal: () => import_workflow.isWorkflowRunTerminal,
   joinSession: () => joinSession
 });
 module.exports = __toCommonJS(extension_exports);
 var import_client = require("./client.js");
 var import_types = require("./types.js");
 var import_canvas = require("./canvas.js");
-var import_factory = require("./factory.js");
+var import_workflow = require("./workflow.js");
 async function joinSession(config = {}) {
   const sessionId = process.env.SESSION_ID;
   if (!sessionId) {
@@ -41,7 +41,7 @@ async function joinSession(config = {}) {
   const client = new import_client.CopilotClient({ _internalConnection: { kind: "parent-process" } });
   const {
     extensionSdkPath: _stripped,
-    factories,
+    workflows,
     requestedEnvironmentVariables,
     ...rest
   } = config;
@@ -53,7 +53,7 @@ async function joinSession(config = {}) {
       onPermissionRequest: config.onPermissionRequest ?? import_types.defaultJoinSessionPermissionHandler,
       suppressResumeEvent: config.suppressResumeEvent ?? true
     },
-    factories,
+    { workflows },
     requestedEnvironmentVariables?.length ? { requestedEnvironmentVariables } : void 0
   );
 }
@@ -61,9 +61,9 @@ async function joinSession(config = {}) {
 0 && (module.exports = {
   Canvas,
   CanvasError,
-  FactoryResumeError,
+  WorkflowResumeError,
   createCanvas,
-  defineFactory,
-  isFactoryRunTerminal,
+  defineWorkflow,
+  isWorkflowRunTerminal,
   joinSession
 });