@github/copilot-sdk 1.0.17 → 1.0.18-preview.1

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.93";
+const COPILOT_CLI_VERSION = "1.0.94-1";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/client.js

@@ -1389,6 +1389,7 @@ class CopilotClient {
         featureFlags: config.featureFlags,
         expAssignments: config.expAssignments,
         enableManagedSettings: config.enableManagedSettings,
+        enforceManagedModelDefaults: config.enforceManagedModelDefaults,
         managedSettings: config.managedSettings
       });
       const {
@@ -1657,6 +1658,7 @@ class CopilotClient {
         featureFlags: config.featureFlags,
         expAssignments: config.expAssignments,
         enableManagedSettings: config.enableManagedSettings,
+        enforceManagedModelDefaults: config.enforceManagedModelDefaults,
         managedSettings: config.managedSettings,
         ...extensionOptions?.requestedEnvironmentVariables ? {
           requestedEnvironmentVariables: extensionOptions.requestedEnvironmentVariables

package/dist/cjs/generated/rpc.js

@@ -2648,13 +2648,13 @@ function createSessionRpc(connection, sessionId) {
        */
       list: async () => connection.sendRequest("session.extensions.list", { sessionId }),
       /**
-       * Enables an extension for the session.
+       * Enables an extension for the session and persists the preference when the session has a settings store. Hosts synchronizing effective membership should use extensions.reconcile instead.
        *
        * @param params Source-qualified extension identifier to enable for the session.
        */
       enable: async (params) => connection.sendRequest("session.extensions.enable", { ...params, sessionId }),
       /**
-       * Disables an extension for the session.
+       * Disables an extension for the session and persists the preference when the session has a settings store. Hosts synchronizing effective membership should use extensions.reconcile instead.
        *
        * @param params Source-qualified extension identifier to disable for the session.
        */
@@ -2663,6 +2663,12 @@ function createSessionRpc(connection, sessionId) {
        * Reloads extension definitions and processes for the session.
        */
       reload: async () => connection.sendRequest("session.extensions.reload", { sessionId }),
+      /**
+       * Host-only reconciliation of authoritative session-effective extension membership and enablement. Refreshes runtime-owned discovery and preferences without persisting settings, installing plugins, or restarting unchanged activations. Returns ExtensionList only after required starts and process/contribution cleanup settle. Takes no caller inventory or overrides. Missing controllers, unready/incomplete discovery, unavailable workspaces, superseded inputs, and lifecycle failures are errors, not empty membership. Independently proven revocations may be applied before an error; retry converges without restarting healthy activations. Error data contains lifecycleChangesApplied and code: extension_reconciliation_host_required, extension_reconciliation_unavailable, extension_reconciliation_not_ready, extension_reconciliation_discovery_failed, extension_reconciliation_workspace_unavailable, extension_reconciliation_superseded, or extension_reconciliation_lifecycle_failed. Mark host reconciliation state applied only on success. On older runtimes, method-not-found must not fall back to global discovery and persistent extension disables.
+       *
+       * @returns Extensions discovered for the session, with their current status.
+       */
+      reconcile: async () => connection.sendRequest("session.extensions.reconcile", { sessionId }),
       /**
        * Push attachments into the next user-message turn from an extension. The host should surface them as composer pills and forward them via the next session.send call. Callable only by extension-owned connections.
        *

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.93";
+export declare const COPILOT_CLI_VERSION = "1.0.94-1";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.93";
+const COPILOT_CLI_VERSION = "1.0.94-1";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/client.js

@@ -1369,6 +1369,7 @@ class CopilotClient {
         featureFlags: config.featureFlags,
         expAssignments: config.expAssignments,
         enableManagedSettings: config.enableManagedSettings,
+        enforceManagedModelDefaults: config.enforceManagedModelDefaults,
         managedSettings: config.managedSettings
       });
       const {
@@ -1637,6 +1638,7 @@ class CopilotClient {
         featureFlags: config.featureFlags,
         expAssignments: config.expAssignments,
         enableManagedSettings: config.enableManagedSettings,
+        enforceManagedModelDefaults: config.enforceManagedModelDefaults,
         managedSettings: config.managedSettings,
         ...extensionOptions?.requestedEnvironmentVariables ? {
           requestedEnvironmentVariables: extensionOptions.requestedEnvironmentVariables

package/dist/generated/rpc.d.ts

@@ -13548,6 +13548,10 @@ export interface ManagedSettingMeta {
      * Channel that supplied this scalar value, matching a `layers[].source`: `device`, `server`, or `policyHelper`. These scalar defaults select one winning channel, not a mixed source. Treat unknown values as additional channels; more may be added.
      */
     source: string;
+    /**
+     * Original managed value when the runtime adjusted it to a supported effective value. Omitted when no adjustment was needed.
+     */
+    requested?: string;
 }
 /**
  * One candidate channel; absent settings represents a channel that delivered no document.
@@ -13605,10 +13609,15 @@ export interface ManagedSettingsComposeResult {
 /** @experimental */
 export interface ManagedSettingsValues {
     /**
-     * Managed default model identifier, as configured. New sessions start with it; it can name a model the account cannot use, so hosts match it against the listed models.
+     * Managed default model identifier. When model availability was resolved, aliases and family names are projected to a concrete available model ID; otherwise the configured value is returned.
      */
     model?: string;
     autoTier?: AutoTier;
+    /**
+     * Managed reasoning-effort default for the managed concrete model. The runtime clamps it to an entitled effort when model availability is known.
+     */
+    effortLevel?: string;
+    contextTier?: ContextTier;
 }
 /**
  * Per-key lock state and provenance for `ManagedSettingsValues`, with the same field names. Producers emit each typed key in values and meta together; both outer objects are omitted when no typed key is set.
@@ -13620,6 +13629,8 @@ export interface ManagedSettingsValues {
 export interface ManagedSettingsMeta {
     model?: ManagedSettingMeta;
     autoTier?: ManagedSettingMeta;
+    effortLevel?: ManagedSettingMeta;
+    contextTier?: ManagedSettingMeta;
 }
 /**
  * One managed-settings channel and the document it delivered.
@@ -13687,6 +13698,10 @@ export interface ManagedSettingsResolveRequest {
      * Embedding client identity for server policy requests, as in session creation. Omit for the CLI identity.
      */
     clientName?: string;
+    /**
+     * Working directory used to run an organization policy helper. When omitted, sessionless resolution does not run the helper.
+     */
+    workingDirectory?: string;
 }
 /**
  * Effective enterprise managed settings for an account, resolved without a session.
@@ -23242,6 +23257,10 @@ export interface SessionManagedPermissions {
      * When set to `disable`, prevents bypass/allow-all permission modes. Advisory auto-approval remains available because normal prompt paths stay active. Any other value is accepted rather than failing the session, but is enforced as `disable`: the key is only present to restrict something, so a mode this runtime cannot interpret fails closed to the most restrictive one it knows. Omit the key entirely to impose no restriction.
      */
     disableBypassPermissionsMode?: string;
+    /**
+     * When true, prevents Assisted Permissions from being activated. An actively Assisted session falls back to Manual Approval while the policy is in force. Omit the key or set it to false to impose no restriction.
+     */
+    disableAssistedPermissionsMode?: boolean;
     /**
      * Permission rules that block matching operations. Deny has highest precedence.
      */
@@ -23438,6 +23457,10 @@ export interface SessionOpenOptions {
      * Opt-in: self-fetch and enforce enterprise managed settings, including managed hook policies, at session bootstrap.
      */
     enableManagedSettings?: boolean;
+    /**
+     * Opt in to enforcing non-overridable managed model controls on session model, Auto-tier, reasoning-effort, and context-tier changes. Managed defaults still apply when omitted; this option only turns conflicting changes into errors.
+     */
+    enforceManagedModelDefaults?: boolean;
     managedSettings?: SessionManagedSettings;
     /**
      * Opt in to capturing file changes for session rewind and session diff. Capture cannot reconstruct changes made before it was enabled. On create it starts capture from the first turn. It is also honored on resume: for a session that already has tracked prior turns, tracking continues automatically even if this is omitted; passing it on resume additionally enables tracking for an eligible session that has no prior root turn yet. Resuming a session whose prior root turns were never tracked has no restorable baseline, so tracking stays disabled for it and rewind reports file change tracking as unavailable; the resume itself still succeeds, so sessions that predate tracking remain loadable. The opt-in is only rejected when the session can never track (a subagent session, or one without local session storage). It is intentionally absent from the mutable options update because enabling it after edits have occurred would create an incomplete, misleading baseline. Subagents share the parent session's capture store and are not tracked as separate rewind points: a file a subagent writes is attributed to whichever root user turn was open when the capture was staged, just before the tool body ran. A turn cannot open while a staged capture is still in flight, so a subagent tool that staged under the spawning turn stays attributed to it however late the write lands, while a capture it stages after the user's next message belongs to that later turn. Attribution decides which turn's rewind point counts and file preview include that write; it does not narrow which rewinds revert it, because a rewind restores every capture from the selected turn onward, so the earlier spawning turn reverts it as well.
@@ -32504,13 +32527,13 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          */
         list: () => Promise<ExtensionList>;
         /**
-         * Enables an extension for the session.
+         * Enables an extension for the session and persists the preference when the session has a settings store. Hosts synchronizing effective membership should use extensions.reconcile instead.
          *
          * @param params Source-qualified extension identifier to enable for the session.
          */
         enable: (params: ExtensionsEnableRequest) => Promise<void>;
         /**
-         * Disables an extension for the session.
+         * Disables an extension for the session and persists the preference when the session has a settings store. Hosts synchronizing effective membership should use extensions.reconcile instead.
          *
          * @param params Source-qualified extension identifier to disable for the session.
          */
@@ -32519,6 +32542,12 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * Reloads extension definitions and processes for the session.
          */
         reload: () => Promise<void>;
+        /**
+         * Host-only reconciliation of authoritative session-effective extension membership and enablement. Refreshes runtime-owned discovery and preferences without persisting settings, installing plugins, or restarting unchanged activations. Returns ExtensionList only after required starts and process/contribution cleanup settle. Takes no caller inventory or overrides. Missing controllers, unready/incomplete discovery, unavailable workspaces, superseded inputs, and lifecycle failures are errors, not empty membership. Independently proven revocations may be applied before an error; retry converges without restarting healthy activations. Error data contains lifecycleChangesApplied and code: extension_reconciliation_host_required, extension_reconciliation_unavailable, extension_reconciliation_not_ready, extension_reconciliation_discovery_failed, extension_reconciliation_workspace_unavailable, extension_reconciliation_superseded, or extension_reconciliation_lifecycle_failed. Mark host reconciliation state applied only on success. On older runtimes, method-not-found must not fall back to global discovery and persistent extension disables.
+         *
+         * @returns Extensions discovered for the session, with their current status.
+         */
+        reconcile: () => Promise<ExtensionList>;
         /**
          * Push attachments into the next user-message turn from an extension. The host should surface them as composer pills and forward them via the next session.send call. Callable only by extension-owned connections.
          *

package/dist/generated/rpc.js

@@ -2620,13 +2620,13 @@ function createSessionRpc(connection, sessionId) {
        */
       list: async () => connection.sendRequest("session.extensions.list", { sessionId }),
       /**
-       * Enables an extension for the session.
+       * Enables an extension for the session and persists the preference when the session has a settings store. Hosts synchronizing effective membership should use extensions.reconcile instead.
        *
        * @param params Source-qualified extension identifier to enable for the session.
        */
       enable: async (params) => connection.sendRequest("session.extensions.enable", { ...params, sessionId }),
       /**
-       * Disables an extension for the session.
+       * Disables an extension for the session and persists the preference when the session has a settings store. Hosts synchronizing effective membership should use extensions.reconcile instead.
        *
        * @param params Source-qualified extension identifier to disable for the session.
        */
@@ -2635,6 +2635,12 @@ function createSessionRpc(connection, sessionId) {
        * Reloads extension definitions and processes for the session.
        */
       reload: async () => connection.sendRequest("session.extensions.reload", { sessionId }),
+      /**
+       * Host-only reconciliation of authoritative session-effective extension membership and enablement. Refreshes runtime-owned discovery and preferences without persisting settings, installing plugins, or restarting unchanged activations. Returns ExtensionList only after required starts and process/contribution cleanup settle. Takes no caller inventory or overrides. Missing controllers, unready/incomplete discovery, unavailable workspaces, superseded inputs, and lifecycle failures are errors, not empty membership. Independently proven revocations may be applied before an error; retry converges without restarting healthy activations. Error data contains lifecycleChangesApplied and code: extension_reconciliation_host_required, extension_reconciliation_unavailable, extension_reconciliation_not_ready, extension_reconciliation_discovery_failed, extension_reconciliation_workspace_unavailable, extension_reconciliation_superseded, or extension_reconciliation_lifecycle_failed. Mark host reconciliation state applied only on success. On older runtimes, method-not-found must not fall back to global discovery and persistent extension disables.
+       *
+       * @returns Extensions discovered for the session, with their current status.
+       */
+      reconcile: async () => connection.sendRequest("session.extensions.reconcile", { sessionId }),
       /**
        * Push attachments into the next user-message turn from an extension. The host should surface them as composer pills and forward them via the next session.send call. Callable only by extension-owned connections.
        *

package/dist/generated/session-events.d.ts

@@ -681,6 +681,20 @@ export type AssistantUsageTransport =
 "http"
 /** WebSocket transport. */
  | "websocket";
+/**
+ * Why a WebSocket-capable model call was carried by the HTTP fallback
+ */
+export type ModelCallWebSocketFallbackReason = 
+/** The WebSocket connection could not be established. */
+"connect_failed"
+/** No usable WebSocket connection was available for the request. */
+ | "connection_unavailable"
+/** Sending the request over the WebSocket failed. */
+ | "send_failed"
+/** The WebSocket returned a retryable API error. */
+ | "api_error"
+/** The WebSocket transport failed before any output reached the consumer. */
+ | "transport_failed";
 /**
  * For HTTP 400 failures only: whether the response carried a structured CAPI error envelope (structured_error, a deterministic validation failure) or no error body (bodyless, the transient gateway/proxy signature). Absent for non-400 failures.
  */
@@ -1208,17 +1222,17 @@ export type ManagedSettingsResolvedSource =
  * The category of runtime action that enterprise managed settings governed (blocked or capped)
  */
 export type ManagedSettingsEnforcedAction = 
-/** An attempt to turn on a bypass-permissions ("yolo") escalation was refused or capped because policy disables bypass-permissions mode. */
+/** An attempt to enter a permission mode governed by managed policy was refused or capped. The `setting` and `escalation` fields identify whether this was bypass permissions or Assisted Permissions. */
 "bypass_permissions_blocked";
 /**
- * For a `bypass_permissions_blocked` action, which permission-escalation primitive was refused
+ * For a `bypass_permissions_blocked` action, which permission-mode or escalation primitive was refused
  */
 export type ManagedSettingsEnforcedEscalation = 
 /** Full allow-all permissions — automatically approving tools, paths, and URLs. */
 "allow_all"
 /** Automatic approval of all tool permission requests. */
  | "approve_all"
-/** Assisted mode — keeps normal prompt paths and adds an LLM recommendation, distinct from allow-all. */
+/** Assisted Permissions — uses an LLM review to reduce prompts, distinct from allow-all and not a hard security boundary. */
  | "assisted_approval"
 /** Unrestricted filesystem access outside the session's allowed directories. */
  | "unrestricted_paths"
@@ -1447,11 +1461,19 @@ export interface StartData {
      */
     alreadyInUse?: boolean;
     autoTier?: AutoTier;
+    /**
+     * True when autoTier is a managed-policy default. Omitted for user-authored and legacy values.
+     */
+    autoTierManaged?: boolean;
     context?: WorkingDirectoryContext;
     /**
      * Context tier selected at session creation time for models with tiered context pricing; null when no tier is selected (e.g., non-tiered model)
      */
     contextTier?: ContextTier | null;
+    /**
+     * True when contextTier is a managed-policy default. Omitted for user-authored and legacy values.
+     */
+    contextTierManaged?: boolean;
     /**
      * Version string of the Copilot application
      */
@@ -1469,6 +1491,10 @@ export interface StartData {
      * Reasoning effort level used for model calls, if applicable (e.g. "none", "low", "medium", "high", "xhigh", "max")
      */
     reasoningEffort?: string;
+    /**
+     * True when the reasoning effort is a managed-policy default bound to reasoningEffortModel. Omitted for agent-authored, user-authored, independent, and legacy effort.
+     */
+    reasoningEffortManaged?: boolean;
     /**
      * Model that owns effort embedded in an authored model selection. Omitted for independent reasoning-effort overrides and legacy events.
      */
@@ -1604,11 +1630,19 @@ export interface ResumeData {
      */
     alreadyInUse?: boolean;
     autoTier?: AutoTier;
+    /**
+     * True when autoTier is a managed-policy default. Omitted for user-authored and legacy values.
+     */
+    autoTierManaged?: boolean;
     context?: WorkingDirectoryContext;
     /**
      * Context tier currently selected at resume time; null when no tier is active
      */
     contextTier?: ContextTier | null;
+    /**
+     * True when contextTier is a managed-policy default. Omitted for user-authored and legacy values.
+     */
+    contextTierManaged?: boolean;
     /**
      * When true, tool calls and permission requests left in flight by the previous session lifetime remain pending after resume and the agentic loop awaits their results. User sends are queued behind the pending work until all such requests reach a terminal state. When false or omitted, pending work is normally marked as interrupted unless the resume passively joined live work owned by another client; sessionWasActive distinguishes that case.
      */
@@ -1625,6 +1659,10 @@ export interface ResumeData {
      * Reasoning effort level used for model calls, if applicable (e.g. "none", "low", "medium", "high", "xhigh", "max")
      */
     reasoningEffort?: string;
+    /**
+     * True when the reasoning effort is a managed-policy default bound to reasoningEffortModel. Omitted for agent-authored, user-authored, independent, and legacy effort.
+     */
+    reasoningEffortManaged?: boolean;
     /**
      * Model that owns effort embedded in an authored model selection. Omitted for independent reasoning-effort overrides and legacy events.
      */
@@ -2204,6 +2242,10 @@ export interface ModelChangeData {
      * Committed Auto preference after the model configuration change, when applicable.
      */
     autoTier?: AutoTier | null;
+    /**
+     * True when autoTier is a managed-policy default. Omitted for user-authored and legacy values.
+     */
+    autoTierManaged?: boolean;
     /**
      * Reason the change happened, when not user-initiated. `"rate_limit_auto_switch"` for changes triggered by the auto-mode-switch rate-limit recovery path, or `"refusal_fallback"` when the active model declined a request (content refusal) and the runtime switched to the configured refusal-fallback model. UI clients can use this to render contextual copy.
      */
@@ -2212,6 +2254,10 @@ export interface ModelChangeData {
      * Context tier after the model change; null explicitly clears a previously selected tier
      */
     contextTier?: ContextTier | null;
+    /**
+     * True when contextTier is a managed-policy default. Omitted for user-authored and legacy values.
+     */
+    contextTierManaged?: boolean;
     /**
      * Newly selected model identifier
      */
@@ -2231,6 +2277,10 @@ export interface ModelChangeData {
      * Reasoning effort level after the model change, if applicable
      */
     reasoningEffort?: string | null;
+    /**
+     * True when the reasoning effort is a managed-policy default bound to reasoningEffortModel. Omitted for agent-authored, user-authored, independent, and legacy effort.
+     */
+    reasoningEffortManaged?: boolean;
     /**
      * Model that owns effort embedded in an authored model selection. Omitted for independent reasoning-effort overrides and legacy events.
      */
@@ -6040,6 +6090,10 @@ export interface AssistantUsageData {
      * Number of rejected speculative prediction tokens
      */
     rejectedPredictionTokens?: number;
+    /**
+     * Serialized (uncompressed) byte length of the request body. A content-free size signal.
+     */
+    requestBodyBytes?: number;
     /**
      * Per-request treatment/eligibility signal returned by the Copilot API in the `X-GitHub-Copilot-Request-TE` response header for the associated model call; `false` when the header was absent or unparseable.
      */
@@ -6053,6 +6107,11 @@ export interface AssistantUsageData {
      */
     timeToFirstTokenMs?: number;
     transport?: AssistantUsageTransport;
+    /**
+     * Milliseconds spent on the WebSocket attempt before falling back to HTTP
+     */
+    websocketFallbackAfterMs?: number;
+    websocketFallbackReason?: ModelCallWebSocketFallbackReason;
 }
 /**
  * Per-request cost and usage data from the CAPI copilot_usage response field
@@ -6208,6 +6267,10 @@ export interface ModelCallFailureData {
      */
     requestBodyBytes?: number;
     requestFingerprint?: ModelCallFailureRequestFingerprint;
+    /**
+     * Zero-based orchestrator retry index of the failed attempt
+     */
+    retryAttempt?: number;
     /**
      * Per-request treatment/eligibility signal returned by the Copilot API in the `X-GitHub-Copilot-Request-TE` response header for the associated model call; `false` when the header was absent or unparseable.
      */
@@ -6222,11 +6285,24 @@ export interface ModelCallFailureData {
      */
     statusCode?: number;
     transport?: ModelCallFailureTransport;
+    /**
+     * Milliseconds spent on the WebSocket attempt before falling back to HTTP
+     */
+    websocketFallbackAfterMs?: number;
+    websocketFallbackReason?: ModelCallWebSocketFallbackReason;
 }
 /**
  * Content-free structural summary of the failing request for diagnosing malformed 4xx calls
  */
 export interface ModelCallFailureRequestFingerprint {
+    /**
+     * Summed byte length of opaque or encrypted reasoning payloads
+     */
+    encryptedContentBytes?: number;
+    /**
+     * Summed byte length of inline image payloads (data URLs and base64 sources)
+     */
+    imageBytes?: number;
     /**
      * Total number of image content parts
      */
@@ -6247,6 +6323,10 @@ export interface ModelCallFailureRequestFingerprint {
      * Tool calls whose name is missing or empty (rejected by strict providers)
      */
     namelessToolCallCount: number;
+    /**
+     * Number of messages carrying opaque or encrypted reasoning
+     */
+    reasoningItemCount?: number;
     /**
      * Total number of tool calls across assistant messages
      */
@@ -11626,7 +11706,7 @@ export interface ManagedSettingsResolvedData {
     source: ManagedSettingsResolvedSource;
 }
 /**
- * Session event "session.managed_settings_enforced". Runtime enforcement of enterprise managed settings: fires when the session blocks or caps a runtime action because enterprise policy governs it, so SDK clients can explain *why* an action was governed. Unlike `session.managed_settings_resolved` (which reports *what* is managed), this reports a concrete governed action — e.g. a user or host tried to turn on a bypass-permissions escalation while policy disables it. Emitted live (not persisted to the session event log) on user/host-initiated attempts only, never for silent policy application. Marked experimental while the managed-settings surface stabilizes.
+ * Session event "session.managed_settings_enforced". Runtime enforcement of enterprise managed settings: fires when the session blocks or caps a runtime action because enterprise policy governs it, so SDK clients can explain *why* an action was governed. Unlike `session.managed_settings_resolved` (which reports *what* is managed), this reports a concrete governed action — e.g. a user or host tried to turn on bypass permissions or Assisted Permissions while the corresponding policy disables it. Emitted live (not persisted to the session event log) on user/host-initiated attempts only, never for silent policy application. Marked experimental while the managed-settings surface stabilizes.
  */
 /** @experimental */
 export interface ManagedSettingsEnforcedEvent {
@@ -11657,7 +11737,7 @@ export interface ManagedSettingsEnforcedEvent {
     type: "session.managed_settings_enforced";
 }
 /**
- * Runtime enforcement of enterprise managed settings: fires when the session blocks or caps a runtime action because enterprise policy governs it, so SDK clients can explain *why* an action was governed. Unlike `session.managed_settings_resolved` (which reports *what* is managed), this reports a concrete governed action — e.g. a user or host tried to turn on a bypass-permissions escalation while policy disables it. Emitted live (not persisted to the session event log) on user/host-initiated attempts only, never for silent policy application. Marked experimental while the managed-settings surface stabilizes.
+ * Runtime enforcement of enterprise managed settings: fires when the session blocks or caps a runtime action because enterprise policy governs it, so SDK clients can explain *why* an action was governed. Unlike `session.managed_settings_resolved` (which reports *what* is managed), this reports a concrete governed action — e.g. a user or host tried to turn on bypass permissions or Assisted Permissions while the corresponding policy disables it. Emitted live (not persisted to the session event log) on user/host-initiated attempts only, never for silent policy application. Marked experimental while the managed-settings surface stabilizes.
  */
 /** @experimental */
 export interface ManagedSettingsEnforcedData {
@@ -11672,7 +11752,7 @@ export interface ManagedSettingsEnforcedData {
      */
     message: string;
     /**
-     * The managed setting key responsible for the enforcement (e.g. `permissions.disableBypassPermissionsMode`).
+     * The managed setting key responsible for the enforcement (for example `permissions.disableBypassPermissionsMode` or `permissions.disableAssistedPermissionsMode`).
      */
     setting: string;
 }

package/dist/types.d.ts

@@ -1871,6 +1871,11 @@ export interface ManagedSettingsPermissions {
      * values are forwarded so newer runtime policies fail closed.
      */
     disableBypassPermissionsMode?: string;
+    /**
+     * When true, prevents Assisted Permissions from being activated. Omit or
+     * set to false to impose no restriction.
+     */
+    disableAssistedPermissionsMode?: boolean;
     /** Operations that must always be denied. Unioned across managed layers. */
     deny?: string[];
     /**
@@ -2453,6 +2458,12 @@ export interface SessionConfigBase {
      * if omitted, the runtime is expected to reject session creation (fail-closed).
      */
     enableManagedSettings?: boolean;
+    /**
+     * When true, locked managed model controls are enforced for this session.
+     * Conflicting model changes are rejected, and locked startup values replace
+     * conflicting session options. Overridable managed defaults remain mutable.
+     */
+    enforceManagedModelDefaults?: boolean;
     /**
      * Host-injected enterprise managed settings for this session.
      *

package/docs/workflows.md

@@ -186,7 +186,7 @@ session.workflow.resume(
 
 Set `notifyOnComplete` to `true` for workflows that are likely to be invoked by an agent, so the originating session is notified when the workflow completes. Set it to `false` for workflows intended to be invoked programmatically, where the caller awaits the result directly. Set `logPhaseNames` to emit workflow phase names to the session transcript. Both options apply to new and resumed runs.
 
-Both resolve with the run envelope (`WorkflowRunResult`) for **every** outcome—`completed`, `error`, `halted`, `paused`, and `cancelled` alike. Inspect `status` and read `result` only when the run completed; a limit breach carries a typed `failure`. A `paused` envelope means that the current attempt settled, not that the durable run is permanently finished. Resume the same run ID to start another attempt with its journal and accounting intact. SDK-initiated `run` and `resume` do not request permission, so they have no declined outcome. An SDK-initiated run is refused only when the session already has its maximum number of active top-level runs. Pre-execution resume failures throw `WorkflowResumeError`, whose `code` is one of `not_found`, `non_resumable`, `workflow_run_not_resumable`, `already_active`, `workflow_already_running`, `workflow_limits_invalid`, `workflow_session_disposed`, `workflow_storage_unavailable`, or `workflow_storage_corrupt`.
+Both resolve with the run envelope (`WorkflowRunResult`) for **every** outcome—`completed`, `error`, `halted`, `paused`, and `cancelled` alike. Inspect `status` and read `result` only when the run completed; a limit breach carries a typed `failure`. A `paused` envelope means that the current attempt settled, not that the durable run is permanently finished. Resume the same run ID to start another attempt with its journal and accounting intact. SDK-initiated `run` and `resume` do not request permission, so they have no declined outcome. They still enforce execution eligibility, input validation, and active-run limits. Recognized pre-execution resume failures throw `WorkflowResumeError`, whose `code` is one of `not_found`, `non_resumable`, `workflow_run_not_resumable`, `already_active`, `workflow_already_running`, `workflow_limits_invalid`, `workflow_session_disposed`, `workflow_storage_unavailable`, or `workflow_storage_corrupt`.
 
 Pause a running attempt from outside its workflow body:
 
@@ -206,7 +206,13 @@ The first attempt pauses at `"review-ready"` and ends through cooperative cancel
 
 ## Observe a run
 
-The calling session can inspect its own workflow runs:
+The calling session can inspect its own workflow runs independently of its current execution eligibility. An empty registry enumerates successfully; losing eligibility does not hide already-admitted runs or terminal history. Observation still requires a valid, non-disposed session, and validation, missing-run, and storage errors still propagate.
+
+Workflow storage requires SQLite support from a custom session filesystem. A provider without that capability reports `workflow_storage_unavailable`, not an empty registry or a local-storage fallback.
+
+Compaction waits at most five seconds for its optional active-workflow summary. If storage fails or times out, compaction logs a warning and continues without that summary; aborting compaction cancels the wait. This does not change the results or error handling of explicit workflow observation calls.
+
+Observation does not restore execution eligibility. Starting, resuming, pausing, or cancelling runs, and workflow-owned agent, log, and journal/checkpoint operations still require eligible credentials (token-based billing or trusted HMAC authentication). Ineligible execution requests fail with JSON-RPC `-32601` and `data.code: "dynamic_workflows_unavailable"`.
 
 ```ts
 const runs = await session.workflow.listRuns();

package/package.json

@@ -5,8 +5,8 @@
         "url": "https://github.com/github/copilot-agent-runtime.git",
         "directory": "src/sdk/nodejs"
     },
-    "version": "1.0.17",
-    "copilotCliVersion": "1.0.93",
+    "version": "1.0.18-preview.1",
+    "copilotCliVersion": "1.0.94-1",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
@@ -103,18 +103,18 @@
         "README.md"
     ],
     "copilotRuntime": {
-        "sourceSha": "0e56b9a0033f48e4358ee027a4077cd6ebd61f32",
-        "version": "1.0.93",
+        "sourceSha": "44097658e184184613f404efe56e6c4d3a991656",
+        "version": "1.0.94-1",
         "visibility": "public"
     },
     "optionalDependencies": {
-        "@github/copilot-sdk-darwin-arm64": "1.0.17",
-        "@github/copilot-sdk-darwin-x64": "1.0.17",
-        "@github/copilot-sdk-linux-arm64": "1.0.17",
-        "@github/copilot-sdk-linux-x64": "1.0.17",
-        "@github/copilot-sdk-linuxmusl-arm64": "1.0.17",
-        "@github/copilot-sdk-linuxmusl-x64": "1.0.17",
-        "@github/copilot-sdk-win32-arm64": "1.0.17",
-        "@github/copilot-sdk-win32-x64": "1.0.17"
+        "@github/copilot-sdk-darwin-arm64": "1.0.18-preview.1",
+        "@github/copilot-sdk-darwin-x64": "1.0.18-preview.1",
+        "@github/copilot-sdk-linux-arm64": "1.0.18-preview.1",
+        "@github/copilot-sdk-linux-x64": "1.0.18-preview.1",
+        "@github/copilot-sdk-linuxmusl-arm64": "1.0.18-preview.1",
+        "@github/copilot-sdk-linuxmusl-x64": "1.0.18-preview.1",
+        "@github/copilot-sdk-win32-arm64": "1.0.18-preview.1",
+        "@github/copilot-sdk-win32-x64": "1.0.18-preview.1"
     }
 }