@github/copilot-sdk 1.0.15 → 1.0.16

package/dist/cjs/generated/rpc.js

@@ -28,6 +28,60 @@ __export(rpc_exports, {
 module.exports = __toCommonJS(rpc_exports);
 function createServerRpc(connection) {
   return {
+    /** @experimental */
+    environments: {
+      /**
+       * Lists GitHub Mission Control environments visible to the authenticated identity. Does not require a running host and excludes host relay credentials.
+       *
+       * @param params Optional discovery filters supported by GitHub Mission Control.
+       *
+       * @returns Environments visible to the authenticated caller and matching the supplied filters.
+       */
+      list: async (params) => connection.sendRequest("environments.list", params),
+      /**
+       * Gets safe discovery information for a GitHub Mission Control environment without requiring a running host.
+       *
+       * @param params Identify a Mission Control environment to retrieve.
+       *
+       * @returns Safe discovery information for the requested environment.
+       */
+      get: async (params) => connection.sendRequest("environments.get", params),
+      /**
+       * Deletes a user-managed GitHub Mission Control environment. GitHub-managed environments cannot be deleted. Does not stop a running host, which may register again.
+       *
+       * @param params Identify a user-managed Mission Control environment to delete.
+       *
+       * @returns Acknowledgement that the requested environment was deleted.
+       */
+      delete: async (params) => connection.sendRequest("environments.delete", params)
+    },
+    /** @experimental */
+    host: {
+      /**
+       * Publishes an attached resident session for this listener's lifetime without copying it.
+       *
+       * @param params Publishes a resident session attached to the listener's owning connection.
+       *
+       * @returns The existing runtime identity and its resource on the listener.
+       */
+      publishSession: async (params) => connection.sendRequest("host.publishSession", params),
+      /**
+       * Starts a connection-owned AHP host with explicit localServer and/or githubEnvironment transports as a supervised SDK participant.
+       *
+       * @param params Starts a supervised AHP host with at least one explicitly selected transport.
+       *
+       * @returns Listener readiness, returned only after binding and the supervised participant's SDK handshake.
+       */
+      start: async (params) => connection.sendRequest("host.start", params),
+      /**
+       * Stops a listener owned by this SDK connection and joins its cleanup without deleting sessions.
+       *
+       * @param params Stops a connection-owned listener and joins its teardown.
+       *
+       * @returns Empty acknowledgement for a completed host lifecycle operation.
+       */
+      dispose: async (params) => connection.sendRequest("host.dispose", params)
+    },
     /**
      * Checks server responsiveness and returns protocol information.
      *
@@ -860,6 +914,45 @@ function createServerRpc(connection) {
 }
 function createInternalServerRpc(connection) {
   return {
+    /** @experimental */
+    host: {
+      /**
+       * Requests app-owned materialization over the owning SDK participant.
+       *
+       * @param params One application-owned session handoff, requested by the supervised hosting participant.
+       *
+       * @returns The resident session the application has materialized on its own connection.
+       */
+      createSession: async (params) => connection.sendRequest("host.createSession", params),
+      /**
+       * Releases app ownership retention after AHP detaches.
+       *
+       * @param params Ends one participation, not the application's session lifetime.
+       *
+       * @returns Empty acknowledgement for a completed host lifecycle operation.
+       */
+      releaseSession: async (params) => connection.sendRequest("host.releaseSession", params),
+      /**
+       * Resolves current authenticated credentials and remote-control policy only for the runtime-owned Mission Control hosting participant.
+       *
+       * @returns Private credentials delivered only to a runtime-owned Mission Control hosting participant.
+       */
+      getEnvironmentCredentials: async () => connection.sendRequest("host.getEnvironmentCredentials", {}),
+      /**
+       * Returns listener settings only to the supervised hosting participant over its SDK connection.
+       *
+       * @returns Normalized listener settings delivered only to the supervised hosting participant.
+       */
+      getConfiguration: async () => connection.sendRequest("host.getConfiguration", {}),
+      /**
+       * Reports a supervised hosting participant's bound AHP endpoint after its SDK handshake.
+       *
+       * @param params Readiness reported by the supervised hosting participant on its own SDK connection.
+       *
+       * @returns Empty acknowledgement for a completed host lifecycle operation.
+       */
+      ready: async (params) => connection.sendRequest("host.ready", params)
+    },
     /**
      * Performs the SDK server connection handshake and validates the optional connection token. Marked internal because this is JSON-RPC transport plumbing invoked automatically by an SDK client's own `connect()` wrapper, not a user-facing method. Stays internal as long as the SDK client owns the handshake; would only become public if the SDK ever exposed the raw schema surface to consumers without a connection wrapper.
      *
@@ -981,7 +1074,15 @@ function createSessionRpc(connection, sessionId) {
        *
        * @returns Result of attempting to disable sandboxing for the current session.
        */
-      disableForSession: async (params) => connection.sendRequest("session.sandbox.disableForSession", { sessionId, ...params })
+      disableForSession: async (params) => connection.sendRequest("session.sandbox.disableForSession", { sessionId, ...params }),
+      /**
+       * Adds the path offered by a pending sandbox escalation permission request's sandboxPathGrant to the session's sandbox policy and approves the request, so the blocked operation re-runs inside the sandbox rather than outside it. The request is rejected unless the exact request is still pending, carries a sandboxPathGrant, and the grant still takes effect under the current managed policy. Does not persist the path; hosts that store sandbox settings save it themselves.
+       *
+       * @param params Request to accept the sandbox path grant offered on an active sandbox escalation permission prompt.
+       *
+       * @returns Result of accepting a sandbox path grant.
+       */
+      grantPathForRequest: async (params) => connection.sendRequest("session.sandbox.grantPathForRequest", { sessionId, ...params })
     },
     /**
      * Aborts the current agent turn.
@@ -2189,7 +2290,15 @@ function createSessionRpc(connection, sessionId) {
        *
        * @returns The selectable model entries and selection ids synthesized for the synchronized BYOK models.
        */
-      sync: async (params) => connection.sendRequest("session.provider.sync", { sessionId, ...params })
+      sync: async (params) => connection.sendRequest("session.provider.sync", { sessionId, ...params }),
+      /**
+       * Withdraws named host-managed models from the session's BYOK registry, leaving every other entry untouched. The scoped counterpart to `provider.sync`: a snapshot can only describe entries the caller knows about, so using it to remove one model silently withdraws rows registered by another source, such as a plugin calling `provider.add` at runtime. Naming what to remove leaves unrelated entries alone. Selection ids that are not registered are ignored, so withdrawal is idempotent. A provider is removed only when one of the withdrawn models was the last entry referencing it; a provider that simply has no models, which is the normal state while its rows are supplied by catalog discovery, is left in place.
+       *
+       * @param params Host-managed model selection ids to withdraw from the session's BYOK registry.
+       *
+       * @returns What the withdrawal actually removed from the registry.
+       */
+      withdraw: async (params) => connection.sendRequest("session.provider.withdraw", { sessionId, ...params })
     },
     /** @experimental */
     options: {
@@ -3442,6 +3551,11 @@ function registerClientSessionApiHandlers(connection, getHandlers) {
   });
 }
 function registerClientGlobalApiHandlers(connection, handlers) {
+  connection.onNotification("host.exited", async (params) => {
+    const handler = handlers.host;
+    if (!handler) return;
+    await handler.exited(params);
+  });
   connection.onRequest("extensionLaunchProvider.resolve", async (params) => {
     const handler = handlers.extensionLaunchProvider;
     if (!handler) throw new Error("No extensionLaunchProvider client-global handler registered");

package/dist/cjs/host.js

@@ -0,0 +1,61 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var host_exports = {};
+__export(host_exports, {
+  AhpHost: () => AhpHost
+});
+module.exports = __toCommonJS(host_exports);
+class AhpHost {
+  /** @internal */
+  constructor(info, disposeHost, publishHostSession) {
+    this.disposeHost = disposeHost;
+    this.publishHostSession = publishHostSession;
+    this.hostId = info.hostId;
+    this.url = info.url;
+    this.environmentId = info.environmentId;
+    this.token = info.token;
+    this.pid = info.pid;
+  }
+  disposeHost;
+  publishHostSession;
+  hostId;
+  /** Local WebSocket URL. Absent when only the GitHub environment is enabled. */
+  url;
+  /** Mission Control environment ID, when GitHub hosting is enabled. */
+  environmentId;
+  /** Connection token, when required by the listener. Treat this value as a secret. */
+  token;
+  /** Legacy separate host process ID. Absent for in-process listeners; use dispose() to stop. */
+  pid;
+  /** Ask the runtime to stop the listener and await its cleanup, on every call. */
+  dispose() {
+    return this.disposeHost();
+  }
+  /** Publish an existing session attached to this client, until this listener stops. */
+  publishSession(sessionId) {
+    return this.publishHostSession(sessionId);
+  }
+  async [Symbol.asyncDispose]() {
+    await this.dispose();
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AhpHost
+});

package/dist/cjs/index.js

@@ -18,6 +18,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var index_exports = {};
 __export(index_exports, {
+  AhpHost: () => import_host.AhpHost,
   BuiltInTools: () => import_toolSet.BuiltInTools,
   Canvas: () => import_canvas.Canvas,
   CanvasError: () => import_canvas.CanvasError,
@@ -44,6 +45,7 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 var import_client = require("./client.js");
+var import_host = require("./host.js");
 var import_types = require("./types.js");
 var import_toolSet = require("./toolSet.js");
 var import_session = require("./session.js");
@@ -52,6 +54,7 @@ var import_canvas = require("./canvas.js");
 var import_types2 = require("./types.js");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AhpHost,
   BuiltInTools,
   Canvas,
   CanvasError,

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.89";
+export declare const COPILOT_CLI_VERSION = "1.0.90";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.89";
+const COPILOT_CLI_VERSION = "1.0.90";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/client.d.ts

@@ -1,5 +1,6 @@
 import { createServerRpc } from "./generated/rpc.js";
 import { CopilotSession } from "./session.js";
+import { AhpHost, type AhpHostOptions } from "./host.js";
 import type { CopilotClientOptions, GetAuthStatusResponse, GetStatusResponse, ModelInfo, ResumeSessionConfig, SessionConfig, SessionLifecycleEventType, SessionLifecycleHandler, SessionListFilter, SessionMetadata, TypedSessionLifecycleHandler } from "./types.js";
 export declare class CopilotClient {
     private cliStartTimeout;
@@ -16,6 +17,9 @@ export declare class CopilotClient {
     /** Shared in-flight start; concurrent callers await it instead of spawning another CLI. */
     private startPromise;
     private sessions;
+    private hostExitCallbacks;
+    private hostSessionFactories;
+    private hostHandoffs;
     private stderrBuffer;
     /** Resolved connection mode chosen in the constructor. */
     private connectionConfig;
@@ -135,7 +139,8 @@ export declare class CopilotClient {
      * 1. Closes all active sessions (releases in-memory resources)
      * 2. Requests runtime shutdown for SDK-owned CLI processes
      * 3. Closes the JSON-RPC connection
-     * 4. Terminates the CLI server process (if spawned by this client)
+     * 4. Signals EOF to an owned stdio process and waits for host cleanup, then
+     *    terminates the process if it does not exit within the shutdown timeout
      *
      * Note: session data on disk is preserved, so sessions can be resumed later.
      * To permanently remove session data before stopping, call
@@ -242,6 +247,27 @@ export declare class CopilotClient {
      */
     resumeSession(sessionId: string, config: ResumeSessionConfig): Promise<CopilotSession>;
     private resumeSessionInternal;
+    /**
+     * Start a complete AHP listener hosted in-process by this runtime.
+     *
+     * This connection owns the host. Disposing it or disconnecting the client
+     * stops the listener without deleting sessions. The host uses a separate
+     * SDK connection to the same runtime, not another runtime process.
+     * Only one AHP host may own the catalog in an effective Copilot home
+     * at a time. Other SDK clients and sessions remain usable in that home.
+     * Select localServer, githubEnvironment, or both. An empty localServer
+     * selects 127.0.0.1 on an available port. `onExit` runs at most once; owner disconnection cannot
+     * acknowledge listener cleanup over the disconnected transport.
+     *
+     * @experimental
+     */
+    startAhpHost(options: AhpHostOptions): Promise<AhpHost>;
+    private handleHostExit;
+    private disconnectHosts;
+    private releaseHostSessions;
+    private releaseHostSession;
+    private notifyHostSessionReleased;
+    private createHostSession;
     /**
      * Sends a ping request to the server to verify connectivity.
      *