@github/copilot-sdk 1.0.18-preview.4 → 1.0.18

package/README.md

@@ -74,6 +74,9 @@ without deleting underlying sessions. Reconnecting does not reclaim a host.
 The optional `onExit` callback reports exits at most once. If the owner connection
 is lost, it reports that loss rather than claiming that listener cleanup was
 acknowledged.
+Call `const { sessions } = await host.listSessions()` to read the complete catalog
+of live and dormant sessions advertised by the host. The method returns a
+`HostListSessionsResult` containing `sessions`, not a session array directly.
 
 `host.pid` is absent for in-process listeners. The optional field is retained
 for separate host process IDs returned by legacy runtimes, never the runtime PID.
@@ -104,6 +107,10 @@ The listener follows the owning client's lifetime. Call `await host.dispose()`
 only when you want to stop it earlier; `await using host` also supports a shorter
 scope. Each disposal call forwards to the runtime, which owns idempotent cleanup.
 The AHP transport remains owned by the host.
+Set top-level `computeId` to reuse the same durable catalog for local and Mission
+Control hosting; it must agree with `githubEnvironment.computeId` when both are
+supplied. Omitted local-only identities are persisted by the runtime, not generated
+by the SDK. Published sessions remain discoverable after hosting stops.
 
 ### Application-owned sessions
 
@@ -165,8 +172,9 @@ still matches the requested identity and workspace.
 Only catalog entries marked as application-owned invoke this callback.
 If the callback is missing, restoring such an entry fails instead of falling
 back to host-owned creation.
-Published resident sessions attach directly, without invoking it or replacing
-their current registrations. Resumed sessions follow the same original-object
+Currently resident published sessions attach directly, without invoking it or replacing
+their current registrations. Dormant published application sessions require this
+resume callback to restore their tools and handlers. Resumed sessions follow the same original-object
 retention, cancellation, late-result release, and `onSessionReleased` rules.
 
 The `copilotd-hosting` library runs inside the runtime provider.

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.94-4";
+const COPILOT_CLI_VERSION = "1.0.94";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/client.js

@@ -1713,7 +1713,7 @@ class CopilotClient {
    * This connection owns the host. Disposing it or disconnecting the client
    * stops the listener without deleting sessions. The host uses a separate
    * SDK connection to the same runtime, not another runtime process.
-   * Only one AHP host may own the catalog in an effective Copilot home
+   * Only one AHP host may own a compute-scoped catalog in an effective Copilot home
    * at a time. Other SDK clients and sessions remain usable in that home.
    * Select localServer, githubEnvironment, or both. An empty localServer
    * selects 127.0.0.1 on an available port. `onExit` runs at most once; owner disconnection cannot
@@ -1731,6 +1731,7 @@ class CopilotClient {
     const rpc = this.rpc;
     const hostId = (0, import_node_crypto.randomUUID)();
     const {
+      computeId,
       localServer,
       githubEnvironment,
       onExit,
@@ -1751,6 +1752,7 @@ class CopilotClient {
     try {
       const info = await rpc.host.start({
         hostId,
+        computeId,
         localServer,
         githubEnvironment,
         sessionFactory: createSession ? true : void 0,
@@ -1761,7 +1763,8 @@ class CopilotClient {
         async () => {
           await rpc.host.dispose({ hostId });
         },
-        (sessionId) => rpc.host.publishSession({ hostId, sessionId })
+        (sessionId) => rpc.host.publishSession({ hostId, sessionId }),
+        () => rpc.host.listSessions({ hostId })
       );
     } catch (error) {
       this.hostExitCallbacks.delete(hostId);

package/dist/cjs/generated/rpc.js

@@ -65,6 +65,14 @@ function createServerRpc(connection) {
        * @returns The existing runtime identity and its resource on the listener.
        */
       publishSession: async (params) => connection.sendRequest("host.publishSession", params),
+      /**
+       * Reads the complete advertised live and dormant session catalog of an existing host owned by this connection. Does not start hosting, subscribe to sessions, or guarantee resumability.
+       *
+       * @param params Reads a running host's catalog or the runtime's saved default catalog.
+       *
+       * @returns The complete live and dormant advertised catalog, without subscribing to sessions.
+       */
+      listSessions: async (params) => connection.sendRequest("host.listSessions", params),
       /**
        * Starts a connection-owned AHP host with explicit localServer and/or githubEnvironment transports as a supervised SDK participant.
        *

package/dist/cjs/host.js

@@ -23,9 +23,10 @@ __export(host_exports, {
 module.exports = __toCommonJS(host_exports);
 class AhpHost {
   /** @internal */
-  constructor(info, disposeHost, publishHostSession) {
+  constructor(info, disposeHost, publishHostSession, listHostSessions) {
     this.disposeHost = disposeHost;
     this.publishHostSession = publishHostSession;
+    this.listHostSessions = listHostSessions;
     this.hostId = info.hostId;
     this.url = info.url;
     this.environmentId = info.environmentId;
@@ -34,6 +35,7 @@ class AhpHost {
   }
   disposeHost;
   publishHostSession;
+  listHostSessions;
   hostId;
   /** Local WebSocket URL. Absent when only the GitHub environment is enabled. */
   url;
@@ -47,10 +49,14 @@ class AhpHost {
   dispose() {
     return this.disposeHost();
   }
-  /** Publish an existing session attached to this client, until this listener stops. */
+  /** Publish an attached application session into the durable compute-scoped host catalog. */
   publishSession(sessionId) {
     return this.publishHostSession(sessionId);
   }
+  /** List all live and dormant catalog sessions advertised by this host. */
+  listSessions() {
+    return this.listHostSessions();
+  }
   async [Symbol.asyncDispose]() {
     await this.dispose();
   }

package/dist/cjs/session.js

@@ -815,7 +815,8 @@ class CopilotSession {
           args,
           handler,
           traceparent,
-          tracestate
+          tracestate,
+          event.agentId || void 0
         );
       }
     } else if (event.type === "external_tool.completed") {
@@ -906,7 +907,7 @@ class CopilotSession {
    * Executes a tool handler and sends the result back via RPC.
    * @internal
    */
-  async _executeToolAndRespond(requestId, toolName, toolCallId, args, handler, traceparent, tracestate) {
+  async _executeToolAndRespond(requestId, toolName, toolCallId, args, handler, traceparent, tracestate, agentId) {
     const controller = new AbortController();
     if (this.disconnected || this.pendingExternalTools.has(requestId)) {
       return;
@@ -944,7 +945,9 @@ class CopilotSession {
         availableTools,
         traceparent,
         tracestate,
-        signal: controller.signal
+        signal: controller.signal,
+        agentId,
+        requestId
       });
       let result;
       if (rawResult == null) {

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.94-4";
+export declare const COPILOT_CLI_VERSION = "1.0.94";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.94-4";
+const COPILOT_CLI_VERSION = "1.0.94";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/client.d.ts

@@ -254,7 +254,7 @@ export declare class CopilotClient {
      * This connection owns the host. Disposing it or disconnecting the client
      * stops the listener without deleting sessions. The host uses a separate
      * SDK connection to the same runtime, not another runtime process.
-     * Only one AHP host may own the catalog in an effective Copilot home
+     * Only one AHP host may own a compute-scoped catalog in an effective Copilot home
      * at a time. Other SDK clients and sessions remain usable in that home.
      * Select localServer, githubEnvironment, or both. An empty localServer
      * selects 127.0.0.1 on an available port. `onExit` runs at most once; owner disconnection cannot

package/dist/client.js

@@ -1693,7 +1693,7 @@ class CopilotClient {
    * This connection owns the host. Disposing it or disconnecting the client
    * stops the listener without deleting sessions. The host uses a separate
    * SDK connection to the same runtime, not another runtime process.
-   * Only one AHP host may own the catalog in an effective Copilot home
+   * Only one AHP host may own a compute-scoped catalog in an effective Copilot home
    * at a time. Other SDK clients and sessions remain usable in that home.
    * Select localServer, githubEnvironment, or both. An empty localServer
    * selects 127.0.0.1 on an available port. `onExit` runs at most once; owner disconnection cannot
@@ -1711,6 +1711,7 @@ class CopilotClient {
     const rpc = this.rpc;
     const hostId = randomUUID();
     const {
+      computeId,
       localServer,
       githubEnvironment,
       onExit,
@@ -1731,6 +1732,7 @@ class CopilotClient {
     try {
       const info = await rpc.host.start({
         hostId,
+        computeId,
         localServer,
         githubEnvironment,
         sessionFactory: createSession ? true : void 0,
@@ -1741,7 +1743,8 @@ class CopilotClient {
         async () => {
           await rpc.host.dispose({ hostId });
         },
-        (sessionId) => rpc.host.publishSession({ hostId, sessionId })
+        (sessionId) => rpc.host.publishSession({ hostId, sessionId }),
+        () => rpc.host.listSessions({ hostId })
       );
     } catch (error) {
       this.hostExitCallbacks.delete(hostId);

package/dist/generated/rpc.d.ts

@@ -12133,6 +12133,10 @@ export interface HostGitHubEnvironmentOptions {
      * Stable application installation identity, reused across host restarts.
      */
     computeId: string;
+    /**
+     * Require sealed, connection-bound authentication (default true), independent of listener address. False permits unsealed direct credentials and unbound sealed relay credentials; use only when the caller fully controls and trusts the direct transport. Relay token encryption remains mandatory.
+     */
+    requireConnectionBinding?: boolean;
 }
 /**
  * Stops a connection-owned listener and joins its teardown.
@@ -12203,6 +12207,66 @@ export interface HostExitedNotification {
      */
     error?: string | null;
 }
+/**
+ * Reads a running host's catalog or the runtime's saved default catalog.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "HostListSessionsRequest".
+ */
+/** @experimental */
+export interface HostListSessionsRequest {
+    /**
+     * Listener UUID returned by host.start; the caller must own it. Omit to read
+     * the saved default compute-identity catalog without starting a listener.
+     */
+    hostId?: string;
+}
+/**
+ * The complete live and dormant advertised catalog, without subscribing to sessions.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "HostListSessionsResult".
+ */
+/** @experimental */
+export interface HostListSessionsResult {
+    /**
+     * Complete advertised session summaries, in the host's catalog order.
+     */
+    sessions: HostSessionSummary[];
+}
+/**
+ * Metadata advertised by the AHP host, not a guarantee that history can be resumed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "HostSessionSummary".
+ */
+/** @experimental */
+export interface HostSessionSummary {
+    /**
+     * Stable AHP resource URI identifying the session on this host.
+     */
+    resource: string;
+    /**
+     * Authoritative title advertised by the host.
+     */
+    title: string;
+    /**
+     * Session creation time as an ISO 8601 timestamp.
+     */
+    createdAt: string;
+    /**
+     * Last modification time as an ISO 8601 timestamp.
+     */
+    modifiedAt: string;
+    /**
+     * Unsigned 32-bit AHP session status bitset (0..=4294967295); unknown bits must be preserved.
+     */
+    status: number;
+    /**
+     * Optional activity description advertised by the host.
+     */
+    activity?: string;
+}
 /**
  * Local WebSocket transport options.
  *
@@ -12359,6 +12423,11 @@ export interface HostSessionCreateRequest {
      * Resume an app-owned durable session instead of creating a new session.
      */
     resume?: boolean;
+    /**
+     * For an explicit publication, borrow an existing owning-connection resident
+     * instead of invoking the resume factory. Cold sessions still use the factory.
+     */
+    preferResident?: boolean;
     /**
      * Host-selected SDK creation or resume settings, without executable callbacks or tools.
      */
@@ -12421,6 +12490,10 @@ export interface HostStartRequest {
      * Caller-generated UUID identifying this connection-owned listener.
      */
     hostId: string;
+    /**
+     * Stable application identity selecting its durable host catalog. Defaults to the persisted runtime compute GUID; must agree with githubEnvironment.computeId when both are supplied.
+     */
+    computeId?: string;
     localServer?: HostLocalServerOptions;
     githubEnvironment?: HostGitHubEnvironmentOptions;
     /**
@@ -14648,7 +14721,7 @@ export interface McpConfiguredServer {
      * Human-readable display name supplied by configuration.
      */
     displayName?: string;
-    live?: McpConfiguredServerState;
+    live: McpConfiguredServerState;
 }
 /**
  * Observational state for a matching already materialized MCP server.
@@ -29764,6 +29837,11 @@ export interface HostCreateSessionRequest {
      * Resume an app-owned durable session instead of creating a new session.
      */
     resume?: boolean;
+    /**
+     * For an explicit publication, borrow an existing owning-connection resident
+     * instead of invoking the resume factory. Cold sessions still use the factory.
+     */
+    preferResident?: boolean;
     /**
      * Host-selected SDK creation or resume settings, without executable callbacks or tools.
      */
@@ -30406,6 +30484,14 @@ export declare function createServerRpc(connection: MessageConnection): {
          * @returns The existing runtime identity and its resource on the listener.
          */
         publishSession: (params: HostPublishSessionRequest) => Promise<HostPublishSessionResult>;
+        /**
+         * Reads the complete advertised live and dormant session catalog of an existing host owned by this connection. Does not start hosting, subscribe to sessions, or guarantee resumability.
+         *
+         * @param params Reads a running host's catalog or the runtime's saved default catalog.
+         *
+         * @returns The complete live and dormant advertised catalog, without subscribing to sessions.
+         */
+        listSessions: (params: HostListSessionsRequest) => Promise<HostListSessionsResult>;
         /**
          * Starts a connection-owned AHP host with explicit localServer and/or githubEnvironment transports as a supervised SDK participant.
          *

package/dist/generated/rpc.js

@@ -37,6 +37,14 @@ function createServerRpc(connection) {
        * @returns The existing runtime identity and its resource on the listener.
        */
       publishSession: async (params) => connection.sendRequest("host.publishSession", params),
+      /**
+       * Reads the complete advertised live and dormant session catalog of an existing host owned by this connection. Does not start hosting, subscribe to sessions, or guarantee resumability.
+       *
+       * @param params Reads a running host's catalog or the runtime's saved default catalog.
+       *
+       * @returns The complete live and dormant advertised catalog, without subscribing to sessions.
+       */
+      listSessions: async (params) => connection.sendRequest("host.listSessions", params),
       /**
        * Starts a connection-owned AHP host with explicit localServer and/or githubEnvironment transports as a supervised SDK participant.
        *

package/dist/host.d.ts

@@ -1,4 +1,4 @@
-import type { HostExitedNotification, HostPublishSessionResult, HostLocalServerOptions, HostGitHubEnvironmentOptions } from "./generated/rpc.js";
+import type { HostExitedNotification, HostPublishSessionResult, HostListSessionsResult, HostLocalServerOptions, HostGitHubEnvironmentOptions } from "./generated/rpc.js";
 import type { CopilotSession } from "./session.js";
 import type { SessionConfig, ResumeSessionConfig } from "./types.js";
 /** Host-selected defaults for a fresh application-owned session. @experimental */
@@ -30,6 +30,8 @@ export type AhpHostExit = HostExitedNotification;
  * @experimental
  */
 export interface AhpHostOptions {
+    /** Stable catalog identity; must agree with githubEnvironment.computeId when both are supplied. */
+    computeId?: string;
     /** Enable a local WebSocket listener; an empty object selects loopback defaults. */
     localServer?: HostLocalServerOptions;
     /** Register a Mission Control environment and enable remote WPS connections. */
@@ -43,7 +45,7 @@ export interface AhpHostOptions {
      */
     createSession?: (request: AhpSessionCreateRequest) => Promise<CopilotSession>;
     /**
-     * Resume a durable session previously created by an application factory.
+     * Resume a durable application-owned session, including a previously published session.
      * Return the original object from this client's resumeSession, or an existing
      * attached original without reconfiguring it. Published resident sessions
      * attach directly and never invoke this callback.
@@ -62,13 +64,14 @@ export interface AhpHostOptions {
  * the owning client also stops the host; reconnecting does not reclaim it.
  * Stopping a host does not delete its underlying sessions.
  * Its durable AHP catalog is shared by successive hosts in the runtime's
- * effective Copilot home; a concurrent host for that catalog is rejected.
+ * effective Copilot home and compute identity; a concurrent host for that catalog is rejected.
  *
  * @experimental
  */
 export declare class AhpHost {
     private readonly disposeHost;
     private readonly publishHostSession;
+    private readonly listHostSessions;
     readonly hostId: string;
     /** Local WebSocket URL. Absent when only the GitHub environment is enabled. */
     readonly url: string | undefined;
@@ -80,7 +83,9 @@ export declare class AhpHost {
     readonly pid: number | undefined;
     /** Ask the runtime to stop the listener and await its cleanup, on every call. */
     dispose(): Promise<void>;
-    /** Publish an existing session attached to this client, until this listener stops. */
+    /** Publish an attached application session into the durable compute-scoped host catalog. */
     publishSession(sessionId: string): Promise<HostPublishSessionResult>;
+    /** List all live and dormant catalog sessions advertised by this host. */
+    listSessions(): Promise<HostListSessionsResult>;
     [Symbol.asyncDispose](): Promise<void>;
 }

package/dist/host.js

@@ -1,8 +1,9 @@
 class AhpHost {
   /** @internal */
-  constructor(info, disposeHost, publishHostSession) {
+  constructor(info, disposeHost, publishHostSession, listHostSessions) {
     this.disposeHost = disposeHost;
     this.publishHostSession = publishHostSession;
+    this.listHostSessions = listHostSessions;
     this.hostId = info.hostId;
     this.url = info.url;
     this.environmentId = info.environmentId;
@@ -11,6 +12,7 @@ class AhpHost {
   }
   disposeHost;
   publishHostSession;
+  listHostSessions;
   hostId;
   /** Local WebSocket URL. Absent when only the GitHub environment is enabled. */
   url;
@@ -24,10 +26,14 @@ class AhpHost {
   dispose() {
     return this.disposeHost();
   }
-  /** Publish an existing session attached to this client, until this listener stops. */
+  /** Publish an attached application session into the durable compute-scoped host catalog. */
   publishSession(sessionId) {
     return this.publishHostSession(sessionId);
   }
+  /** List all live and dormant catalog sessions advertised by this host. */
+  listSessions() {
+    return this.listHostSessions();
+  }
   async [Symbol.asyncDispose]() {
     await this.dispose();
   }

package/dist/session.js

@@ -797,7 +797,8 @@ class CopilotSession {
           args,
           handler,
           traceparent,
-          tracestate
+          tracestate,
+          event.agentId || void 0
         );
       }
     } else if (event.type === "external_tool.completed") {
@@ -888,7 +889,7 @@ class CopilotSession {
    * Executes a tool handler and sends the result back via RPC.
    * @internal
    */
-  async _executeToolAndRespond(requestId, toolName, toolCallId, args, handler, traceparent, tracestate) {
+  async _executeToolAndRespond(requestId, toolName, toolCallId, args, handler, traceparent, tracestate, agentId) {
     const controller = new AbortController();
     if (this.disconnected || this.pendingExternalTools.has(requestId)) {
       return;
@@ -926,7 +927,9 @@ class CopilotSession {
         availableTools,
         traceparent,
         tracestate,
-        signal: controller.signal
+        signal: controller.signal,
+        agentId,
+        requestId
       });
       let result;
       if (rawResult == null) {

package/dist/types.d.ts

@@ -522,6 +522,24 @@ export interface ToolInvocation {
     tracestate?: string;
     /** Aborted when the runtime completes this request or the session disconnects. */
     signal?: AbortSignal;
+    /**
+     * Sub-agent instance that issued this call (the `agentId` of its session
+     * events). `undefined` for a root-agent call, and for every call when the
+     * runtime does not attribute sub-agent tool calls.
+     *
+     * @experimental
+     */
+    agentId?: string;
+    /**
+     * Runtime request id of this call: the key
+     * `session.tools.handlePendingToolCall` and `session.tools.listPendingRequests`
+     * use. A root-agent call stays answerable after the session is resumed with
+     * pending work continued; a sub-agent's call can be answered only while that
+     * sub-agent is still running.
+     *
+     * @experimental
+     */
+    requestId?: string;
 }
 export type ToolHandler<TArgs = unknown> = (args: TArgs, invocation: ToolInvocation) => Promise<unknown> | unknown;
 /**

package/package.json

@@ -5,8 +5,8 @@
         "url": "https://github.com/github/copilot-agent-runtime.git",
         "directory": "src/sdk/nodejs"
     },
-    "version": "1.0.18-preview.4",
-    "copilotCliVersion": "1.0.94-4",
+    "version": "1.0.18",
+    "copilotCliVersion": "1.0.94",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
@@ -81,6 +81,7 @@
         "esbuild": "^0.28.1",
         "eslint": "^9.0.0",
         "glob": "^13.0.1",
+        "hpke-js": "^1.8.0",
         "json-schema": "^0.4.0",
         "json-schema-to-typescript": "^15.0.4",
         "prettier": "^3.8.1",
@@ -103,18 +104,18 @@
         "README.md"
     ],
     "copilotRuntime": {
-        "sourceSha": "eb9442810f652729e706715ab1093119e20876e0",
-        "version": "1.0.94-4",
+        "sourceSha": "fdeb5949944ebccf3bb4dda8552a21aa1a09b6f6",
+        "version": "1.0.94",
         "visibility": "public"
     },
     "optionalDependencies": {
-        "@github/copilot-sdk-darwin-arm64": "1.0.18-preview.4",
-        "@github/copilot-sdk-darwin-x64": "1.0.18-preview.4",
-        "@github/copilot-sdk-linux-arm64": "1.0.18-preview.4",
-        "@github/copilot-sdk-linux-x64": "1.0.18-preview.4",
-        "@github/copilot-sdk-linuxmusl-arm64": "1.0.18-preview.4",
-        "@github/copilot-sdk-linuxmusl-x64": "1.0.18-preview.4",
-        "@github/copilot-sdk-win32-arm64": "1.0.18-preview.4",
-        "@github/copilot-sdk-win32-x64": "1.0.18-preview.4"
+        "@github/copilot-sdk-darwin-arm64": "1.0.18",
+        "@github/copilot-sdk-darwin-x64": "1.0.18",
+        "@github/copilot-sdk-linux-arm64": "1.0.18",
+        "@github/copilot-sdk-linux-x64": "1.0.18",
+        "@github/copilot-sdk-linuxmusl-arm64": "1.0.18",
+        "@github/copilot-sdk-linuxmusl-x64": "1.0.18",
+        "@github/copilot-sdk-win32-arm64": "1.0.18",
+        "@github/copilot-sdk-win32-x64": "1.0.18"
     }
 }