@github/copilot-sdk 1.0.15 → 1.0.16

package/dist/generated/rpc.js

@@ -1,5 +1,59 @@
 function createServerRpc(connection) {
   return {
+    /** @experimental */
+    environments: {
+      /**
+       * Lists GitHub Mission Control environments visible to the authenticated identity. Does not require a running host and excludes host relay credentials.
+       *
+       * @param params Optional discovery filters supported by GitHub Mission Control.
+       *
+       * @returns Environments visible to the authenticated caller and matching the supplied filters.
+       */
+      list: async (params) => connection.sendRequest("environments.list", params),
+      /**
+       * Gets safe discovery information for a GitHub Mission Control environment without requiring a running host.
+       *
+       * @param params Identify a Mission Control environment to retrieve.
+       *
+       * @returns Safe discovery information for the requested environment.
+       */
+      get: async (params) => connection.sendRequest("environments.get", params),
+      /**
+       * Deletes a user-managed GitHub Mission Control environment. GitHub-managed environments cannot be deleted. Does not stop a running host, which may register again.
+       *
+       * @param params Identify a user-managed Mission Control environment to delete.
+       *
+       * @returns Acknowledgement that the requested environment was deleted.
+       */
+      delete: async (params) => connection.sendRequest("environments.delete", params)
+    },
+    /** @experimental */
+    host: {
+      /**
+       * Publishes an attached resident session for this listener's lifetime without copying it.
+       *
+       * @param params Publishes a resident session attached to the listener's owning connection.
+       *
+       * @returns The existing runtime identity and its resource on the listener.
+       */
+      publishSession: async (params) => connection.sendRequest("host.publishSession", params),
+      /**
+       * Starts a connection-owned AHP host with explicit localServer and/or githubEnvironment transports as a supervised SDK participant.
+       *
+       * @param params Starts a supervised AHP host with at least one explicitly selected transport.
+       *
+       * @returns Listener readiness, returned only after binding and the supervised participant's SDK handshake.
+       */
+      start: async (params) => connection.sendRequest("host.start", params),
+      /**
+       * Stops a listener owned by this SDK connection and joins its cleanup without deleting sessions.
+       *
+       * @param params Stops a connection-owned listener and joins its teardown.
+       *
+       * @returns Empty acknowledgement for a completed host lifecycle operation.
+       */
+      dispose: async (params) => connection.sendRequest("host.dispose", params)
+    },
     /**
      * Checks server responsiveness and returns protocol information.
      *
@@ -832,6 +886,45 @@ function createServerRpc(connection) {
 }
 function createInternalServerRpc(connection) {
   return {
+    /** @experimental */
+    host: {
+      /**
+       * Requests app-owned materialization over the owning SDK participant.
+       *
+       * @param params One application-owned session handoff, requested by the supervised hosting participant.
+       *
+       * @returns The resident session the application has materialized on its own connection.
+       */
+      createSession: async (params) => connection.sendRequest("host.createSession", params),
+      /**
+       * Releases app ownership retention after AHP detaches.
+       *
+       * @param params Ends one participation, not the application's session lifetime.
+       *
+       * @returns Empty acknowledgement for a completed host lifecycle operation.
+       */
+      releaseSession: async (params) => connection.sendRequest("host.releaseSession", params),
+      /**
+       * Resolves current authenticated credentials and remote-control policy only for the runtime-owned Mission Control hosting participant.
+       *
+       * @returns Private credentials delivered only to a runtime-owned Mission Control hosting participant.
+       */
+      getEnvironmentCredentials: async () => connection.sendRequest("host.getEnvironmentCredentials", {}),
+      /**
+       * Returns listener settings only to the supervised hosting participant over its SDK connection.
+       *
+       * @returns Normalized listener settings delivered only to the supervised hosting participant.
+       */
+      getConfiguration: async () => connection.sendRequest("host.getConfiguration", {}),
+      /**
+       * Reports a supervised hosting participant's bound AHP endpoint after its SDK handshake.
+       *
+       * @param params Readiness reported by the supervised hosting participant on its own SDK connection.
+       *
+       * @returns Empty acknowledgement for a completed host lifecycle operation.
+       */
+      ready: async (params) => connection.sendRequest("host.ready", params)
+    },
     /**
      * Performs the SDK server connection handshake and validates the optional connection token. Marked internal because this is JSON-RPC transport plumbing invoked automatically by an SDK client's own `connect()` wrapper, not a user-facing method. Stays internal as long as the SDK client owns the handshake; would only become public if the SDK ever exposed the raw schema surface to consumers without a connection wrapper.
      *
@@ -953,7 +1046,15 @@ function createSessionRpc(connection, sessionId) {
        *
        * @returns Result of attempting to disable sandboxing for the current session.
        */
-      disableForSession: async (params) => connection.sendRequest("session.sandbox.disableForSession", { sessionId, ...params })
+      disableForSession: async (params) => connection.sendRequest("session.sandbox.disableForSession", { sessionId, ...params }),
+      /**
+       * Adds the path offered by a pending sandbox escalation permission request's sandboxPathGrant to the session's sandbox policy and approves the request, so the blocked operation re-runs inside the sandbox rather than outside it. The request is rejected unless the exact request is still pending, carries a sandboxPathGrant, and the grant still takes effect under the current managed policy. Does not persist the path; hosts that store sandbox settings save it themselves.
+       *
+       * @param params Request to accept the sandbox path grant offered on an active sandbox escalation permission prompt.
+       *
+       * @returns Result of accepting a sandbox path grant.
+       */
+      grantPathForRequest: async (params) => connection.sendRequest("session.sandbox.grantPathForRequest", { sessionId, ...params })
     },
     /**
      * Aborts the current agent turn.
@@ -2161,7 +2262,15 @@ function createSessionRpc(connection, sessionId) {
        *
        * @returns The selectable model entries and selection ids synthesized for the synchronized BYOK models.
        */
-      sync: async (params) => connection.sendRequest("session.provider.sync", { sessionId, ...params })
+      sync: async (params) => connection.sendRequest("session.provider.sync", { sessionId, ...params }),
+      /**
+       * Withdraws named host-managed models from the session's BYOK registry, leaving every other entry untouched. The scoped counterpart to `provider.sync`: a snapshot can only describe entries the caller knows about, so using it to remove one model silently withdraws rows registered by another source, such as a plugin calling `provider.add` at runtime. Naming what to remove leaves unrelated entries alone. Selection ids that are not registered are ignored, so withdrawal is idempotent. A provider is removed only when one of the withdrawn models was the last entry referencing it; a provider that simply has no models, which is the normal state while its rows are supplied by catalog discovery, is left in place.
+       *
+       * @param params Host-managed model selection ids to withdraw from the session's BYOK registry.
+       *
+       * @returns What the withdrawal actually removed from the registry.
+       */
+      withdraw: async (params) => connection.sendRequest("session.provider.withdraw", { sessionId, ...params })
     },
     /** @experimental */
     options: {
@@ -3414,6 +3523,11 @@ function registerClientSessionApiHandlers(connection, getHandlers) {
   });
 }
 function registerClientGlobalApiHandlers(connection, handlers) {
+  connection.onNotification("host.exited", async (params) => {
+    const handler = handlers.host;
+    if (!handler) return;
+    await handler.exited(params);
+  });
   connection.onRequest("extensionLaunchProvider.resolve", async (params) => {
     const handler = handlers.extensionLaunchProvider;
     if (!handler) throw new Error("No extensionLaunchProvider client-global handler registered");

package/dist/generated/session-events.d.ts

@@ -930,6 +930,14 @@ export type SystemNotificationWorkflowCompletedStatus =
  * Details of the permission being requested
  */
 export type PermissionRequest = PermissionRequestShell | PermissionRequestWrite | PermissionRequestRead | PermissionRequestMcp | PermissionRequestUrl | PermissionRequestMemory | PermissionRequestCustomTool | PermissionRequestHook | PermissionRequestExtensionManagement | PermissionRequestWorkflow | PermissionRequestExtensionPermissionAccess | PermissionRequestExtensionEnvAccess;
+/**
+ * Access a sandbox path grant confers
+ */
+export type PermissionSandboxPathGrantAccess = 
+/** Read access: the path is added to readonlyPaths. */
+"read"
+/** Read and write access: the path is added to readwritePaths. */
+ | "readWrite";
 /**
  * Advisory recommendation the runtime attaches to a permission request whose origin it can vouch for by construction. Unlike the auto-approval judge this does not depend on auto mode and does not evaluate what the tool call does; its absence simply means the runtime has no opinion and the request follows the host's normal approval flow.
  */
@@ -1028,7 +1036,7 @@ export type PermissionDecisionSource =
 /**
  * The result of the permission request
  */
-export type PermissionResult = PermissionApproved | PermissionApprovedForSession | PermissionApprovedForLocation | PermissionCancelled | PermissionDeniedByRules | PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser | PermissionDeniedInteractivelyByUser | PermissionDeniedByContentExclusionPolicy | PermissionDeniedByPermissionRequestHook;
+export type PermissionResult = PermissionApproved | PermissionApprovedReadOnlyForSession | PermissionApprovedForSession | PermissionApprovedForLocation | PermissionCancelled | PermissionDeniedByRules | PermissionDeniedNoApprovalRuleAndCouldNotRequestFromUser | PermissionDeniedInteractivelyByUser | PermissionDeniedByContentExclusionPolicy | PermissionDeniedByPermissionRequestHook;
 /**
  * The approval to add as a session-scoped rule
  */
@@ -8274,6 +8282,12 @@ export interface PermissionRequestShell {
      * @experimental
      */
     resolvedWorkingDirectory?: string;
+    /**
+     * Sandbox policy edit that would let the command run inside the sandbox. Only present when requestSandboxBypass is true.
+     *
+     * @experimental
+     */
+    sandboxPathGrant?: PermissionSandboxPathGrant;
     /**
      * Tool call ID that triggered this permission request
      */
@@ -8318,6 +8332,25 @@ export interface PermissionRequestShellPossibleUrl {
      */
     url: string;
 }
+/**
+ * A sandbox filesystem policy edit that would let a blocked operation run inside the sandbox instead of outside it. Offered only on a sandbox escalation request whose denial adding this path lifts, and only when managed policy permits the grant. A host accepts it with session.sandbox.grantPathForRequest, which adds the path to the session's sandbox policy and re-runs the operation sandboxed; a host that persists sandbox settings may also save the path there.
+ */
+/** @experimental */
+export interface PermissionSandboxPathGrant {
+    access: PermissionSandboxPathGrantAccess;
+    /**
+     * The path the sandbox refused, present only when it differs from path. That happens when a write under a read-only folder moves the folder to the read-write paths, when a path that does not exist yet is granted through its nearest existing folder, because the OS sandbox cannot grant a path before it exists, and when either is spelled through a symlink, because a grant covers its path as written, so path is then the resolved location. Hosts should then name path in the offer, since the denial names this one.
+     */
+    deniedPath?: string;
+    /**
+     * Absolute path to add to the sandbox filesystem policy
+     */
+    path: string;
+    /**
+     * readonlyPaths entries the grant removes, exactly as written in the policy, because a read-only entry for the same location would otherwise keep the path read-only. A host that persists the path must remove these entries from its stored readonlyPaths too.
+     */
+    removedReadonlyPaths?: string[];
+}
 /**
  * File write permission request
  */
@@ -8364,6 +8397,12 @@ export interface PermissionRequestWrite {
      * @experimental
      */
     resolvedPath?: string;
+    /**
+     * Sandbox policy edit that would let the write run inside the sandbox. Only present when requestSandboxBypass is true.
+     *
+     * @experimental
+     */
+    sandboxPathGrant?: PermissionSandboxPathGrant;
     /**
      * Tool call ID that triggered this permission request
      */
@@ -8403,6 +8442,12 @@ export interface PermissionRequestRead {
      * @experimental
      */
     resolvedPath?: string;
+    /**
+     * Sandbox policy edit that would let the read run inside the sandbox. Only present when requestSandboxBypass is true.
+     *
+     * @experimental
+     */
+    sandboxPathGrant?: PermissionSandboxPathGrant;
     /**
      * Tool call ID that triggered this permission request
      */
@@ -8880,6 +8925,12 @@ export interface PermissionPromptRequestCommands {
      * True when the escalation is a permissive retry that keeps the sandbox and network policy attached while recording file and process accesses instead of blocking them.
      */
     requestSandboxPermissive?: boolean;
+    /**
+     * Sandbox policy edit that would let the command run inside the sandbox. Only present when requestSandboxBypass is true.
+     *
+     * @experimental
+     */
+    sandboxPathGrant?: PermissionSandboxPathGrant;
     /**
      * Tool call ID that triggered this permission request
      */
@@ -9150,6 +9201,12 @@ export interface PermissionPromptRequestPath {
      * File paths that require explicit approval
      */
     paths: string[];
+    /**
+     * Canonical directory candidates that can be granted for file-tool read access in this logical session. Present only for read path prompts.
+     *
+     * @experimental
+     */
+    readOnlyDirectories?: string[];
     /**
      * Tool call ID that triggered this permission request
      */
@@ -9413,6 +9470,21 @@ export interface PermissionApproved {
      */
     managedApprovalHandled?: boolean;
 }
+/**
+ * Permission response variant that approves a request and records file-tool read authority for specific directories in this logical session.
+ */
+export interface PermissionApprovedReadOnlyForSession {
+    /**
+     * Canonical directories covered by the session read-only grant
+     *
+     * @minItems 1
+     */
+    directories: [string, ...string[]];
+    /**
+     * Approved with read-only directory authority for this session
+     */
+    kind: "approved-read-only-for-session";
+}
 /**
  * Permission response variant that approves a request and remembers the provided approval for the rest of the session.
  */
@@ -12084,10 +12156,18 @@ export interface McpServerStatusChangedEvent {
  * Payload of `session.mcp_server_status_changed` for one MCP server's status and optional failure error.
  */
 export interface McpServerStatusChangedData {
+    /**
+     * Runtime configuration provenance for a failed connection, or unknown when unavailable. Additional string values may be introduced.
+     */
+    configSource?: string;
     /**
      * Error message if the server entered a failed state
      */
     error?: string;
+    /**
+     * Runtime-produced classification for the final failed connection; unclassified means no classification was supplied. Additional string values may be introduced.
+     */
+    errorClassification?: string;
     /**
      * Name of the MCP server whose status changed
      */

package/dist/host.d.ts

@@ -0,0 +1,86 @@
+import type { HostExitedNotification, HostPublishSessionResult, HostLocalServerOptions, HostGitHubEnvironmentOptions } from "./generated/rpc.js";
+import type { CopilotSession } from "./session.js";
+import type { SessionConfig, ResumeSessionConfig } from "./types.js";
+/** Host-selected defaults for a fresh application-owned session. @experimental */
+export interface AhpSessionCreateRequest {
+    /** Pass these settings to createSession, adding your prompt, tools and callbacks. */
+    config: Omit<SessionConfig, "onPermissionRequest">;
+    /** Aborted when participation ends, including timeout or owner disconnection. */
+    signal: AbortSignal;
+}
+/** Host-selected settings for resuming a durable application-owned AHP session. @experimental */
+export interface AhpSessionResumeRequest {
+    sessionId: string;
+    /** Pass to resumeSession, adding application tools, hooks and callbacks. */
+    config: Omit<ResumeSessionConfig, "onPermissionRequest">;
+    /** Aborted when participation ends; late results are still released exactly once. */
+    signal: AbortSignal;
+}
+/**
+ * A listener-task exit report, or an owner disconnect that cannot acknowledge cleanup.
+ * `reason: "exited"` means the hosting task failed, not that the runtime process died.
+ * In-process hosts have no process exit code (`exitCode` is absent).
+ * @experimental
+ */
+export type AhpHostExit = HostExitedNotification;
+/**
+ * Options for runtime-supervised AHP hosting. Select at least one transport.
+ * Callbacks are captured at startup;
+ * later changes to this options object do not reconfigure an existing host.
+ * @experimental
+ */
+export interface AhpHostOptions {
+    /** Enable a local WebSocket listener; an empty object selects loopback defaults. */
+    localServer?: HostLocalServerOptions;
+    /** Register a Mission Control environment and enable remote WPS connections. */
+    githubEnvironment?: HostGitHubEnvironmentOptions;
+    /** Called at most once when hosting ends, not on runtime process death. Local, never serialized. */
+    onExit?: (exit: AhpHostExit) => void;
+    /**
+     * Materialize a fresh session on this client. Preserve the supplied config
+     * (including its sessionId and workingDirectory); add your own prompt and tools.
+     * The callback and all tool/hook functions stay in the application.
+     */
+    createSession?: (request: AhpSessionCreateRequest) => Promise<CopilotSession>;
+    /**
+     * Resume a durable session previously created by an application factory.
+     * Return the original object from this client's resumeSession, or an existing
+     * attached original without reconfiguring it. Published resident sessions
+     * attach directly and never invoke this callback.
+     */
+    resumeSession?: (request: AhpSessionResumeRequest) => Promise<CopilotSession>;
+    /**
+     * Called once per handoff with the original returned object after AHP detaches
+     * or the handoff fails. The SDK never disconnects or destroys this object.
+     */
+    onSessionReleased?: (session: CopilotSession) => void | Promise<void>;
+}
+/**
+ * A connection-owned AHP listener supervised by the runtime.
+ *
+ * The runtime hosts the listener in-process, without a companion executable. Disconnecting
+ * the owning client also stops the host; reconnecting does not reclaim it.
+ * Stopping a host does not delete its underlying sessions.
+ * Its durable AHP catalog is shared by successive hosts in the runtime's
+ * effective Copilot home; a concurrent host for that catalog is rejected.
+ *
+ * @experimental
+ */
+export declare class AhpHost {
+    private readonly disposeHost;
+    private readonly publishHostSession;
+    readonly hostId: string;
+    /** Local WebSocket URL. Absent when only the GitHub environment is enabled. */
+    readonly url: string | undefined;
+    /** Mission Control environment ID, when GitHub hosting is enabled. */
+    readonly environmentId: string | undefined;
+    /** Connection token, when required by the listener. Treat this value as a secret. */
+    readonly token: string | undefined;
+    /** Legacy separate host process ID. Absent for in-process listeners; use dispose() to stop. */
+    readonly pid: number | undefined;
+    /** Ask the runtime to stop the listener and await its cleanup, on every call. */
+    dispose(): Promise<void>;
+    /** Publish an existing session attached to this client, until this listener stops. */
+    publishSession(sessionId: string): Promise<HostPublishSessionResult>;
+    [Symbol.asyncDispose](): Promise<void>;
+}

package/dist/host.js

@@ -0,0 +1,37 @@
+class AhpHost {
+  /** @internal */
+  constructor(info, disposeHost, publishHostSession) {
+    this.disposeHost = disposeHost;
+    this.publishHostSession = publishHostSession;
+    this.hostId = info.hostId;
+    this.url = info.url;
+    this.environmentId = info.environmentId;
+    this.token = info.token;
+    this.pid = info.pid;
+  }
+  disposeHost;
+  publishHostSession;
+  hostId;
+  /** Local WebSocket URL. Absent when only the GitHub environment is enabled. */
+  url;
+  /** Mission Control environment ID, when GitHub hosting is enabled. */
+  environmentId;
+  /** Connection token, when required by the listener. Treat this value as a secret. */
+  token;
+  /** Legacy separate host process ID. Absent for in-process listeners; use dispose() to stop. */
+  pid;
+  /** Ask the runtime to stop the listener and await its cleanup, on every call. */
+  dispose() {
+    return this.disposeHost();
+  }
+  /** Publish an existing session attached to this client, until this listener stops. */
+  publishSession(sessionId) {
+    return this.publishHostSession(sessionId);
+  }
+  async [Symbol.asyncDispose]() {
+    await this.dispose();
+  }
+}
+export {
+  AhpHost
+};

package/dist/index.d.ts

@@ -4,6 +4,8 @@
  * JSON-RPC based SDK for programmatic control of GitHub Copilot CLI
  */
 export { CopilotClient } from "./client.js";
+export type { HostLocalServerOptions, HostGitHubEnvironmentOptions } from "./generated/rpc.js";
+export { AhpHost, type AhpHostExit, type AhpHostOptions, type AhpSessionCreateRequest, type AhpSessionResumeRequest, } from "./host.js";
 export { DisableBypassPermissionsModes, RuntimeConnection } from "./types.js";
 export { BuiltInTools, ToolSet } from "./toolSet.js";
 export { CopilotSession, type AssistantMessageEvent } from "./session.js";
@@ -11,5 +13,5 @@ export { defineWorkflow, WorkflowResumeError, isWorkflowRunTerminal } from "./wo
 export { Canvas, CanvasError, createCanvas, type CanvasAction, type CanvasDeclaration, type CanvasHostContext, type CanvasHostContextCapabilities, type CanvasJsonSchema, type CanvasOptions, } from "./canvas.js";
 export { defineTool, approveAll, createAttributedPermissionResult, convertMcpCallToolResult, createSessionFsAdapter, CopilotRequestHandler, CopilotWebSocketHandler, CopilotWebSocketCloseStatus, CopilotWebSocketForwarder, SessionFsSqliteTransactionFailure, SYSTEM_MESSAGE_SECTIONS, } from "./types.js";
 export type * from "./generated/session-events.js";
-export type { AskUserVariant, CommandContext, CommandDefinition, CommandHandler, CanvasProviderIdentity, CloudSessionOptions, CloudSessionRepository, ConnectorAccountRequest, ConnectorAvailability, ConnectorCapabilities, ConnectorCatalogEntry, ConnectorCatalogResult, ConnectorCatalogStatus, ConnectorConnectRequest, ConnectorConnectResult, ConnectorContinueRequest, ConnectorDisconnectResult, ConnectorMcpStatus, ConnectorReconcileRequest, ConnectorRuntimeStatus, ConnectorStatus, AutoModeSwitchHandler, AutoModeSwitchRequest, AutoModeSwitchResponse, AgentStopHandler, AgentStopHookInput, AgentStopHookOutput, UserPromptTransformedHandler, UserPromptTransformedHookInput, UserPromptTransformedHookOutput, CopilotClientInfo, CopilotClientMode, CopilotClientOptions, InstallationConfirmationHandler, InstallationConfirmationRequest, InstallationConfirmationResponse, InstallationDecision, InstallationReview, McpInstallationReview, CopilotExpAssignmentResponse, StdioRuntimeConnection, InProcessRuntimeConnection, TcpRuntimeConnection, UriRuntimeConnection, ChildProcessRuntimeConnection, CustomAgentConfig, ElicitationFieldValue, ElicitationHandler, ElicitationParams, ElicitationContext, ElicitationResult, ElicitationSchema, ElicitationSchemaField, ExpConfigEntry, ExpFlagValue, ExitPlanModeHandler, ExitPlanModeRequest, ExitPlanModeResult, ExtensionLaunchProfile, ExtensionLaunchProvider, ExtensionLaunchProviderResolveRequest, ExtensionLaunchProviderResolveResult, ExtensionInfo, ForegroundSessionInfo, GetAuthStatusResponse, GetStatusResponse, GitHubMcpToolConfig, GitHubTelemetryNotification, GitHubTelemetryEvent, GitHubTelemetryClientInfo, GitHubTokenAcquireReason, GitHubTokenAcquireResult, GitHubTokenProvider, GitHubTokenProviderArgs, GitHubTokenProviderResult, InfiniteSessionConfig, LargeToolOutputConfig, MemoryConfiguration, UiInputOptions, MCPStdioServerConfig, MCPHTTPServerConfig, MCPServerConfig, DefaultAgentConfig, BearerTokenProvider, ExtensionContextAttachment, MessageOptions, ResponseSchema, MessageSource, ManagedSettings, ManagedSettingsPermissions, ModelBilling, ModelBillingTokenPrices, ModelBillingTokenPricesLongContext, AutoTier, CapiSessionOptions, CurrentModel, ModelSwitchAutoTierResult, ModelSwitchAutoTierStatus, ModelCapabilities, ModelCapabilitiesOverride, ModelInfo, ModelPolicy, NamedProviderConfig, PermissionHandler, PermissionRequest, PermissionRequestedData, PermissionRequestedEvent, PermissionRequestResult, AttributedPermissionResult, PermissionDecisionContext, PermissionDecisionOutcome, PermissionDecisionSource, PermissionDecisionSurface, PermissionResponseCapability, ProviderConfig, ProviderModelConfig, ProviderTokenArgs, RemoteSessionMode, ResumeSessionConfig, SectionOverride, SectionOverrideAction, SectionTransformFn, SessionCapabilities, SessionConfig, SessionConfigBase, SessionEvent, SessionEventHandler, SessionEventPayload, SessionEventType, SessionLifecycleEvent, SessionLifecycleEventMetadata, SessionLifecycleEventType, SessionLifecycleHandler, SessionHooks, SessionCreatedEvent, SessionDeletedEvent, SessionUpdatedEvent, SessionForegroundEvent, SessionBackgroundEvent, SessionContext, SessionListFilter, SessionMetadata, SessionUiApi, SessionFsConfig, SessionFsProvider, SessionFsFileInfo, SessionFsSqliteQueryResult, SessionFsSqliteQueryType, SessionFsSqliteProvider, SessionFsSqliteStatement, SessionFsSqliteTransactionErrorClass, CopilotRequestContext, SystemMessageAppendConfig, SystemMessageConfig, SystemMessageCustomizeConfig, SystemMessageReplaceConfig, SystemMessageSection, TelemetryConfig, TraceContext, TraceContextProvider, Tool, ToolHandler, ToolInvocation, CurrentToolMetadata, ToolTelemetry, ToolResultObject, ToolSearchConfig, TypedSessionEventHandler, TypedSessionLifecycleHandler, ZodSchema, } from "./types.js";
+export type { AskUserVariant, CommandContext, CommandDefinition, CommandHandler, CanvasProviderIdentity, CloudSessionOptions, CloudSessionRepository, ConnectorAccountRequest, ConnectorAvailability, ConnectorCapabilities, ConnectorCatalogEntry, ConnectorCatalogResult, ConnectorCatalogStatus, ConnectorConnectRequest, ConnectorConnectResult, ConnectorContinueRequest, ConnectorDisconnectResult, ConnectorMcpStatus, ConnectorReconcileRequest, ConnectorRuntimeStatus, ConnectorStatus, AutoModeSwitchHandler, AutoModeSwitchRequest, AutoModeSwitchResponse, AgentStopHandler, AgentStopHookInput, AgentStopHookOutput, UserPromptTransformedHandler, UserPromptTransformedHookInput, UserPromptTransformedHookOutput, CopilotClientInfo, CopilotClientMode, CopilotClientOptions, InstallationConfirmationHandler, InstallationConfirmationRequest, InstallationConfirmationResponse, InstallationDecision, InstallationReview, McpInstallationReview, CopilotExpAssignmentResponse, StdioRuntimeConnection, InProcessRuntimeConnection, TcpRuntimeConnection, UriRuntimeConnection, ChildProcessRuntimeConnection, CustomAgentConfig, ElicitationFieldValue, ElicitationHandler, ElicitationParams, ElicitationContext, ElicitationResult, ElicitationSchema, ElicitationSchemaField, ExpConfigEntry, ExpFlagValue, ExitPlanModeHandler, ExitPlanModeRequest, ExitPlanModeResult, ExtensionLaunchProfile, ExtensionLaunchProvider, ExtensionLaunchProviderResolveRequest, ExtensionLaunchProviderResolveResult, ExtensionInfo, ForegroundSessionInfo, GetAuthStatusResponse, GetStatusResponse, GitHubMcpToolConfig, GitHubTelemetryNotification, GitHubTelemetryEvent, GitHubTelemetryClientInfo, GitHubTokenAcquireReason, GitHubTokenAcquireResult, GitHubTokenProvider, GitHubTokenProviderArgs, GitHubTokenProviderResult, InfiniteSessionConfig, LargeToolOutputConfig, MemoryConfiguration, UiInputOptions, MCPStdioServerConfig, MCPHTTPServerConfig, MCPServerConfig, DefaultAgentConfig, BearerTokenProvider, ExtensionContextAttachment, MessageOptions, ResponseSchema, MessageSource, ManagedSettings, ManagedSettingsPermissions, ModelBilling, ModelBillingTokenPrices, ModelBillingTokenPricesLongContext, AutoTier, CapiSessionOptions, CurrentModel, ModelSwitchAutoTierResult, ModelSwitchAutoTierStatus, ModelCapabilities, ModelCapabilitiesOverride, ModelInfo, ModelPolicy, NamedProviderConfig, PermissionHandler, PermissionRequest, PermissionRequestedData, PermissionRequestedEvent, PermissionRequestResult, AttributedPermissionResult, PermissionDecisionContext, PermissionDecisionOutcome, PermissionDecisionSource, PermissionDecisionSurface, PermissionResponseCapability, ProviderConfig, ProviderModelConfig, ProviderTokenArgs, RemoteSessionMode, SandboxConfigSource, ResumeSessionConfig, SectionOverride, SectionOverrideAction, SectionTransformFn, SessionCapabilities, SessionConfig, SessionConfigBase, SessionEvent, SessionEventHandler, SessionEventPayload, SessionEventType, SessionLifecycleEvent, SessionLifecycleEventMetadata, SessionLifecycleEventType, SessionLifecycleHandler, SessionHooks, SessionCreatedEvent, SessionDeletedEvent, SessionUpdatedEvent, SessionForegroundEvent, SessionBackgroundEvent, SessionContext, SessionListFilter, SessionMetadata, SessionUiApi, SessionFsConfig, SessionFsProvider, SessionFsFileInfo, SessionFsSqliteQueryResult, SessionFsSqliteQueryType, SessionFsSqliteProvider, SessionFsSqliteStatement, SessionFsSqliteTransactionErrorClass, CopilotRequestContext, SystemMessageAppendConfig, SystemMessageConfig, SystemMessageCustomizeConfig, SystemMessageReplaceConfig, SystemMessageSection, TelemetryConfig, TraceContext, TraceContextProvider, Tool, ToolHandler, ToolInvocation, CurrentToolMetadata, ToolTelemetry, ToolResultObject, ToolSearchConfig, TypedSessionEventHandler, TypedSessionLifecycleHandler, ZodSchema, } from "./types.js";
 export type { JsonValue, WorkflowRunOptions, WorkflowResumeOptions, WorkflowLimitOverrides, WorkflowResumeErrorCode, SessionWorkflowApi, WorkflowAgentOptions, WorkflowContext, WorkflowDefinition, WorkflowHandle, WorkflowJsonSchema, WorkflowLimits, WorkflowMeta, WorkflowPipelineStage, WorkflowStepOptions, WorkflowRunResult, WorkflowRunStatus, WorkflowRunSummary, WorkflowListRunsOptions, WorkflowRunsPage, WorkflowRunDetail, WorkflowProgressPage, WorkflowProgressLine, WorkflowPhaseObservation, WorkflowPhaseStatus, WorkflowAgentSummary, } from "./workflow.js";

package/dist/index.js

@@ -1,4 +1,7 @@
 import { CopilotClient } from "./client.js";
+import {
+  AhpHost
+} from "./host.js";
 import { DisableBypassPermissionsModes, RuntimeConnection } from "./types.js";
 import { BuiltInTools, ToolSet } from "./toolSet.js";
 import { CopilotSession } from "./session.js";
@@ -22,6 +25,7 @@ import {
   SYSTEM_MESSAGE_SECTIONS
 } from "./types.js";
 export {
+  AhpHost,
   BuiltInTools,
   Canvas,
   CanvasError,

package/dist/types.d.ts

@@ -13,6 +13,7 @@ import type { ExtensionLaunchProviderHandler as GeneratedExtensionLaunchProvider
 import type { ToolSet } from "./toolSet.js";
 export type { RemoteSessionMode } from "./generated/rpc.js";
 export type { CurrentToolMetadata } from "./generated/rpc.js";
+export type { SandboxConfigSource } from "./generated/rpc.js";
 export type { ConnectorAccountRequest, ConnectorAvailability, ConnectorCapabilities, ConnectorCatalogEntry, ConnectorCatalogResult, ConnectorCatalogStatus, ConnectorConnectRequest, ConnectorConnectResult, ConnectorContinueRequest, ConnectorDisconnectResult, ConnectorMcpStatus, ConnectorReconcileRequest, ConnectorRuntimeStatus, ConnectorStatus, ExtensionLaunchProfile, ExtensionLaunchProviderResolveRequest, ExtensionLaunchProviderResolveResult, GitHubTokenAcquireReason, GitHubTokenAcquireResult, GitHubTelemetryNotification, GitHubTelemetryEvent, GitHubTelemetryClientInfo, InstallationConfirmationRequest, InstallationConfirmationResponse, InstallationDecision, InstallationReview, McpInstallationReview, } from "./generated/rpc.js";
 /**
  * Arguments passed to a session's {@link GitHubTokenProvider}.
@@ -1839,6 +1840,8 @@ export type AskUserVariant = "legacy" | "elicitation";
  * an existing one).
  */
 export interface SessionConfigBase {
+    /** Exact model IDs allowed by the host. Omission preserves runtime policy. */
+    allowedModels?: string[];
     /**
      * Client name to identify the application using the SDK.
      * Included in the User-Agent header for API requests.

package/package.json

@@ -4,8 +4,8 @@
         "type": "git",
         "url": "https://github.com/github/copilot-sdk.git"
     },
-    "version": "1.0.15",
-    "copilotCliVersion": "1.0.89",
+    "version": "1.0.16",
+    "copilotCliVersion": "1.0.90",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
@@ -71,6 +71,7 @@
         "zod": "4.3.6"
     },
     "devDependencies": {
+        "@microsoft/agent-host-protocol-v09": "npm:@microsoft/agent-host-protocol@0.9.0",
         "@platformatic/vfs": "^0.3.0",
         "@types/node": "^25.2.0",
         "@types/semver": "7.8.0",
@@ -101,13 +102,13 @@
         "README.md"
     ],
     "optionalDependencies": {
-        "@github/copilot-sdk-darwin-arm64": "1.0.15",
-        "@github/copilot-sdk-darwin-x64": "1.0.15",
-        "@github/copilot-sdk-linux-arm64": "1.0.15",
-        "@github/copilot-sdk-linux-x64": "1.0.15",
-        "@github/copilot-sdk-linuxmusl-arm64": "1.0.15",
-        "@github/copilot-sdk-linuxmusl-x64": "1.0.15",
-        "@github/copilot-sdk-win32-arm64": "1.0.15",
-        "@github/copilot-sdk-win32-x64": "1.0.15"
+        "@github/copilot-sdk-darwin-arm64": "1.0.16",
+        "@github/copilot-sdk-darwin-x64": "1.0.16",
+        "@github/copilot-sdk-linux-arm64": "1.0.16",
+        "@github/copilot-sdk-linux-x64": "1.0.16",
+        "@github/copilot-sdk-linuxmusl-arm64": "1.0.16",
+        "@github/copilot-sdk-linuxmusl-x64": "1.0.16",
+        "@github/copilot-sdk-win32-arm64": "1.0.16",
+        "@github/copilot-sdk-win32-x64": "1.0.16"
     }
 }