@github/copilot-sdk 1.0.15-unstable.35663726336.gcb2a8cc → 1.0.15

package/README.md

@@ -14,10 +14,9 @@ verified `github/copilot-cli` release assets when the SDK is published, so
 starting the SDK performs no runtime download. Set `COPILOT_CLI_PATH` to use an
 existing installation instead.
 
-The checked-in release pin is `copilotCliVersion` in `package.json`. Run
-`npm run set:cli-version -- <version>` to update it and regenerate the compiled
-metadata in `src/cliVersion.ts`. Packaging verifies release assets against the
-release's `SHA256SUMS.txt`.
+The checked-in `copilotCliVersion` in `package.json` and compiled metadata in
+`src/cliVersion.ts` use a development placeholder. The public SDK snapshot
+replaces both with the CLI version published for that snapshot.
 
 `npm run pack:release` builds the main package and all platform packages. Set
 `COPILOT_CLI_DOWNLOAD_BASE_URL` to use a release mirror while packaging.
@@ -26,6 +25,12 @@ containing validated runtime npm package roots named for all eight platforms.
 This keeps `COPILOT_CLI_USE_NPM_PACKAGE` false and embeds those runtime files in
 the self-contained SDK platform packages.
 
+In the runtime repository, packaging uses the prepared same-checkout runtime.
+Set `COPILOT_SDK_RUNTIME_PLATFORMS` to the available target (for example,
+`linux-x64`) for both `pack:release` and `verify:release-packages`. SDK CI checks
+that target only; public release workflows leave this unset to package and
+verify all eight platforms.
+
 ## Installation
 
 ```bash
@@ -119,6 +124,7 @@ new CopilotClient(options?: CopilotClientOptions)
 - `workingDirectory?: string` - Working directory for the runtime process (default: current process cwd).
 - `baseDirectory?: string` - Base directory for Copilot data (session state, config, etc.). Sets `COPILOT_HOME` on the spawned runtime. When not set, the runtime defaults to `~/.copilot`. Ignored when connecting via `RuntimeConnection.forUri`.
 - `extensionLaunchProvider?: ExtensionLaunchProvider` - Experimental connection-level resolver for extension launch profiles. The client installs the reverse-RPC handler and registers the provider during startup before sessions can be created.
+- `installationConfirmationHandler?: InstallationConfirmationHandler` - Experimental connection-global human review for `installations.confirm`. Receives the typed request and independent request/connection cancellation signals, and returns an explicit decision. Does not enable installation capabilities.
 - `logLevel?: "none" | "error" | "warning" | "info" | "debug" | "all"` - Log level. When omitted, the runtime uses its own default (currently `"info"`).
 - `env?: Record<string, string | undefined>` - Environment variables for the runtime process. When omitted, inherits `process.env`.
 - `gitHubToken?: string` - GitHub token for authentication. When provided, takes priority over other auth methods.
@@ -130,6 +136,49 @@ new CopilotClient(options?: CopilotClientOptions)
 - `sessionIdleTimeoutSeconds?: number` - Server-wide idle timeout for sessions in seconds. Ignored when connecting via `RuntimeConnection.forUri`.
 - `enableRemoteSessions?: boolean` - Enable Mission Control remote session support. Ignored when connecting via `RuntimeConnection.forUri`.
 
+#### Installation confirmation (experimental)
+
+All six SDKs (Node.js, Python, Go, .NET, Java and Rust) provide this receiver with the
+same semantics: each review gets one cancellation token, concurrent reviews are
+independent, and a decision returned after cancellation is never sent. Without a
+configured handler, an `installations.confirm` request is refused, which the
+runtime treats as no consent.
+
+The installation confirmation handler receives the generated
+`InstallationConfirmationRequest` and a `CancellationToken`. Match `operationId`
+and `policySessionId` against the exact original action on this connection
+before presenting the complete review. Refuse unknown operations or incomplete
+reviews; missing legacy session metadata is not permission to use the current
+session. Return `"confirm"`, `"decline"` or `"cancel"` only after an explicit
+human decision. The SDK echoes the original challenge and fingerprint.
+
+Concurrent reviews remain independent. The token is cancelled when the runtime
+retires the request, including runtime-enforced expiry, or when the original
+connection closes. Observe it to close pending UI. Late handler results cannot
+approve a retired request. This incoming signal does not cancel outbound
+installation or OAuth RPCs, and dropping those promises is not cancellation.
+
+Use `client.rpc.mcp.prepareInstall` before `applyInstall`: preparation returns an
+inert runtime-issued `operationId` and original expiry. Register that ID with its
+captured session on this exact client before applying. Removal uses
+`planUninstall` then `applyUninstall`; the returned `operationId` identifies the
+operation, while `planHandle` is the one-use removal input. Never interchange them.
+Use `client.rpc.mcp.installations.list` and `recover` for owned inventory.
+Inspect or cancel uncertain work through `status` and `cancel` on the original
+connection and operation ID, without selecting a replacement session or replaying apply.
+
+Owned OAuth similarly uses `session.rpc.mcp.oauth.prepareLogin` to obtain
+`loginId` before browser, network or cached-reconnect work. Retain that ID with
+the original session and `expectedInstallationId` for `login` and `cancelLogin`.
+Prepare freezes reauthentication and display options. Cancelling an incoming
+confirmation or abandoning a login promise is not a substitute for `cancelLogin`.
+Manual MCP OAuth retains its direct `login` path.
+
+A matching runtime contract and available owned-lifecycle support are required.
+Capability negotiation does not promise availability; preserve typed refusals
+instead of falling back to raw configuration writes. Generated presence and
+transport tests do not establish a working installer, live OAuth or restart safety.
+
 #### Methods
 
 ##### `start(): Promise<void>`
@@ -158,6 +207,7 @@ Create a new conversation session.
 - `systemMessage?: SystemMessageConfig` - System message customization (see below)
 - `infiniteSessions?: InfiniteSessionConfig` - Configure automatic context compaction (see below)
 - `workingDirectory?: string` - Working directory for the session (default: runtime process cwd).
+- `refreshCustomInstructions?: boolean` - Invalidates the process-wide custom-instruction discovery cache before creating this session, so instruction-file edits made in the same runtime are read again. Defaults to `false` (cache reuse). Other sessions in this runtime may observe updated instructions on later turns or discovery. This does not watch files or enable disabled instruction loading. Available on `SessionConfig`, not `ResumeSessionConfig`.
 - `enableSessionStore?: boolean` - Enables the cross-session store for search and retrieval across sessions. When unset in `"copilot-cli"` mode, the runtime default applies (enabled). In `"empty"` mode, defaults to disabled.
 - `gitHubTokenProvider?: GitHubTokenProvider` - Acquires rotating, session-scoped GitHub tokens. Token results require a positive `expiresIn` value in seconds remaining when the callback completes; production tokens typically last eight hours. Cannot be combined with `gitHubToken`.
 - `provider?: ProviderConfig` - Custom API provider configuration (BYOK - Bring Your Own Key). See [Custom Providers](#custom-providers) section.
@@ -295,6 +345,7 @@ Source is independent of delivery mode. Leaving it unset preserves the existing
 ##### `sendAndWait(options: MessageOptions, timeout?: number): Promise<AssistantMessageEvent | undefined>`
 
 Send a message and wait until the session becomes idle.
+Sub-agent events are still delivered to listeners, but do not complete the wait or supply its reply.
 
 **Options:**
 

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.87-unstable.r35651157977.g1aacd25";
+const COPILOT_CLI_VERSION = "1.0.89";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/client.js

@@ -44,6 +44,7 @@ var import_runtimeArtifacts = require("./runtimeArtifacts.js");
 var import_cliVersion = require("./cliVersion.js");
 var import_sessionFsProvider = require("./sessionFsProvider.js");
 var import_copilotRequestHandler = require("./copilotRequestHandler.js");
+var import_installationConfirmation = require("./installationConfirmation.js");
 var import_telemetry = require("./telemetry.js");
 var import_schema = require("./schema.js");
 var import_toolSet = require("./toolSet.js");
@@ -265,6 +266,7 @@ class CopilotClient {
   sessionFsConfig = null;
   requestHandler = null;
   extensionLaunchProvider;
+  installationConfirmationHandler;
   builtinPluginDirectories = [];
   onGitHubTelemetry;
   clientGlobalHandlers = {};
@@ -423,6 +425,7 @@ class CopilotClient {
     this.sessionFsConfig = options.sessionFs ?? null;
     this.requestHandler = options.requestHandler ?? null;
     this.extensionLaunchProvider = options.extensionLaunchProvider;
+    this.installationConfirmationHandler = options.installationConfirmationHandler;
     this.onGitHubTelemetry = options.onGitHubTelemetry;
     this.setupClientGlobalHandlers();
     const connEnv = conn.kind === "stdio" || conn.kind === "tcp" ? conn.env : void 0;
@@ -1237,6 +1240,7 @@ class CopilotClient {
         includeSubAgentStreamingEvents: config.includeSubAgentStreamingEvents ?? true,
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
+        ...config.diagnostics !== void 0 ? { diagnostics: config.diagnostics } : {},
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
         authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
@@ -1246,6 +1250,7 @@ class CopilotClient {
         agent: config.agent,
         configDir: config.configDirectory,
         enableConfigDiscovery: config.enableConfigDiscovery,
+        refreshCustomInstructions: config.refreshCustomInstructions,
         skipEmbeddingRetrieval: config.skipEmbeddingRetrieval,
         embeddingCacheStorage: config.embeddingCacheStorage,
         organizationCustomInstructions: config.organizationCustomInstructions,
@@ -1338,10 +1343,11 @@ class CopilotClient {
     return this.resumeSessionInternal(sessionId, config);
   }
   /** @internal */
-  async resumeSessionForExtension(sessionId, config, factories, extensionOptions) {
-    return this.resumeSessionInternal(sessionId, config, factories, extensionOptions);
+  async resumeSessionForExtension(sessionId, config, contributions = {}, extensionOptions) {
+    return this.resumeSessionInternal(sessionId, config, contributions, extensionOptions);
   }
-  async resumeSessionInternal(sessionId, config, factories, extensionOptions) {
+  async resumeSessionInternal(sessionId, config, contributions = {}, extensionOptions) {
+    const { workflows } = contributions;
     if (config.gitHubToken !== void 0 && config.gitHubTokenProvider !== void 0) {
       throw new Error("gitHubToken and gitHubTokenProvider are mutually exclusive");
     }
@@ -1361,7 +1367,7 @@ class CopilotClient {
     session.registerTools(config.tools);
     session.registerCanvases(config.canvases);
     session.registerCommands(config.commands);
-    session.registerFactories(factories);
+    session.registerWorkflows(workflows);
     const {
       wireProvider: bearerWireProvider,
       wireProviders: bearerWireProviders,
@@ -1442,7 +1448,7 @@ class CopilotClient {
         })),
         toolSearch: config.toolSearch,
         canvases: config.canvases?.map((canvas) => canvas.declaration),
-        factories: factories?.map((factory) => factory.meta),
+        workflows: workflows?.map((workflow) => workflow.meta),
         requestCanvasRenderer: config.requestCanvasRenderer,
         requestExtensions: config.requestExtensions,
         extensionSdkPath: config.extensionSdkPath,
@@ -1483,6 +1489,7 @@ class CopilotClient {
         includeSubAgentStreamingEvents: config.includeSubAgentStreamingEvents ?? true,
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
+        ...config.diagnostics !== void 0 ? { diagnostics: config.diagnostics } : {},
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
         authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
@@ -1903,6 +1910,9 @@ class CopilotClient {
     if (this.options.mode === "empty") {
       env.COPILOT_DISABLE_KEYTAR = "1";
     }
+    if (this.options.mode !== "empty") {
+      env.COPILOT_RUNTIME_PROCESS_FILE_LOGGING = "1";
+    }
     if (this.options.telemetry) {
       const t = this.options.telemetry;
       env.COPILOT_OTEL_ENABLED = "true";
@@ -2277,6 +2287,16 @@ stderr: ${stderrOutput}` : ""}`
       return session.clientSessionApis;
     });
     (0, import_rpc.registerClientGlobalApiHandlers)(this.connection, this.clientGlobalHandlers);
+    if (this.installationConfirmationHandler) {
+      const confirmation = (0, import_installationConfirmation.createInstallationConfirmationAdapter)(
+        this.connection,
+        this.installationConfirmationHandler
+      );
+      this.connection.onRequest(
+        "installations.confirm",
+        (params, token) => confirmation.confirm(params, token)
+      );
+    }
     this.connection.onRequest(
       "hooks.invoke",
       async (params) => {

package/dist/cjs/extension.js

@@ -20,17 +20,17 @@ var extension_exports = {};
 __export(extension_exports, {
   Canvas: () => import_canvas.Canvas,
   CanvasError: () => import_canvas.CanvasError,
-  FactoryResumeError: () => import_factory.FactoryResumeError,
+  WorkflowResumeError: () => import_workflow.WorkflowResumeError,
   createCanvas: () => import_canvas.createCanvas,
-  defineFactory: () => import_factory.defineFactory,
-  isFactoryRunTerminal: () => import_factory.isFactoryRunTerminal,
+  defineWorkflow: () => import_workflow.defineWorkflow,
+  isWorkflowRunTerminal: () => import_workflow.isWorkflowRunTerminal,
   joinSession: () => joinSession
 });
 module.exports = __toCommonJS(extension_exports);
 var import_client = require("./client.js");
 var import_types = require("./types.js");
 var import_canvas = require("./canvas.js");
-var import_factory = require("./factory.js");
+var import_workflow = require("./workflow.js");
 async function joinSession(config = {}) {
   const sessionId = process.env.SESSION_ID;
   if (!sessionId) {
@@ -41,7 +41,7 @@ async function joinSession(config = {}) {
   const client = new import_client.CopilotClient({ _internalConnection: { kind: "parent-process" } });
   const {
     extensionSdkPath: _stripped,
-    factories,
+    workflows,
     requestedEnvironmentVariables,
     ...rest
   } = config;
@@ -53,7 +53,7 @@ async function joinSession(config = {}) {
       onPermissionRequest: config.onPermissionRequest ?? import_types.defaultJoinSessionPermissionHandler,
       suppressResumeEvent: config.suppressResumeEvent ?? true
     },
-    factories,
+    { workflows },
     requestedEnvironmentVariables?.length ? { requestedEnvironmentVariables } : void 0
   );
 }
@@ -61,9 +61,9 @@ async function joinSession(config = {}) {
 0 && (module.exports = {
   Canvas,
   CanvasError,
-  FactoryResumeError,
+  WorkflowResumeError,
   createCanvas,
-  defineFactory,
-  isFactoryRunTerminal,
+  defineWorkflow,
+  isWorkflowRunTerminal,
   joinSession
 });