@github/copilot-sdk 1.0.19 → 1.0.20-preview.1

package/README.md

@@ -1377,6 +1377,36 @@ const session = await client.createSession({
 });
 ```
 
+### Managed network policy for client-owned browsers
+
+Obtain a reusable `permissionsContext` from
+`client.rpc.managedSettings.resolve({ selectionId })` for account and device
+policy, or `session.rpc.managedSettings.get()` for the session's retained policy,
+including SDK injection and policy-helper rules. Omit `selectionId` for the current
+account, or device policy only when signed out. Resolution uses the managed-policy
+cache and can fetch server policy; keep it off latency-critical startup paths.
+Older runtimes may omit `permissionsContext`. Treat an absent context as unsupported
+evaluation, not unmanaged policy; do not navigate without a policy decision.
+
+Call `client.rpc.managedSettings.permissions.evaluate({ context: permissionsContext, operations: [{ kind: "url", url: "https://docs.example.com/guide" }] })`.
+This is pure, sessionless evaluation: it performs no policy discovery, I/O,
+prompting, or sandbox changes. Reuse an in-memory context for repeated checks and
+refresh it when managed policy changes. Retain the runtime-owned `permissions`
+object verbatim rather than rebuilding it from the flattened settings display.
+
+The result is `{ results: [{ operation, verdict }], failClosed }`, with one entry per
+input operation in the same order. `deny` blocks navigation, `ask` requires approval,
+`allow` approves under managed policy, and `unmanaged` leaves the consumer's normal
+permission flow in effect. A check never prompts or grants a saved approval.
+Invalid URLs reject the batch. Unknown policy rejects or returns `failClosed: true`
+with all URLs denied; do not navigate on an error.
+
+Check every navigation, redirect, and new-window destination before opening it.
+These APIs evaluate managed permission rules only: they do not replace browser
+security checks, user permissions, or sandbox policy. `permissions.limitTo` neither
+enables the sandbox nor changes `sandbox.userPolicy.network`; configure sandbox
+network restrictions explicitly.
+
 ### Permission Result Kinds
 
 The handler must return one of the `PermissionDecision` shapes (or `{ kind: "no-result" }`). Approval scopes are present-tense — they describe the decision to apply, not the outcome reported back on session events:

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.95";
+const COPILOT_CLI_VERSION = "1.0.96-1";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/client.js

@@ -2455,6 +2455,7 @@ stderr: ${stderrOutput}`
   /** Starts the in-process FFI runtime with SDK-managed typed options. */
   async startInProcessFfi() {
     const explicitEntrypoint = this.resolvedEnv.COPILOT_CLI_PATH;
+    const cliLoginSyncIntegrationId = this.resolvedEnv.GITHUB_COPILOT_INTEGRATION_ID?.trim() || void 0;
     let runtimeLibrary;
     if (explicitEntrypoint) {
       const entrypointDirectory = (0, import_node_path.dirname)((0, import_node_path.resolve)(explicitEntrypoint));
@@ -2466,7 +2467,8 @@ stderr: ${stderrOutput}`
         "runtime.node"
       );
     } else {
-      runtimeLibrary = (0, import_node_path.join)((0, import_node_path.dirname)(await getBundledRuntimePath()), "runtime.node");
+      const bundledRuntimePath = await getBundledRuntimePath();
+      runtimeLibrary = (0, import_node_path.join)((0, import_node_path.dirname)(bundledRuntimePath), "runtime.node");
     }
     const { FfiRuntimeHost } = await import("./ffiRuntimeHost.js");
     const environment = {};
@@ -2495,6 +2497,9 @@ stderr: ${stderrOutput}`
     if (this.options.enableRemoteSessions) {
       args.push("--remote");
     }
+    if (cliLoginSyncIntegrationId) {
+      args.push(`--cli-login-sync-integration-id=${cliLoginSyncIntegrationId}`);
+    }
     const host = FfiRuntimeHost.create(runtimeLibrary, explicitEntrypoint, environment, args);
     this.ffiHost = host;
     await host.start();

package/dist/cjs/generated/rpc.js

@@ -707,6 +707,17 @@ function createServerRpc(connection) {
        * @returns Effective enterprise managed settings for an account, resolved without a session.
        */
       resolve: async (params) => connection.sendRequest("managedSettings.resolve", params),
+      /** @experimental */
+      permissions: {
+        /**
+         * Pure, sessionless evaluation of operations against a supplied permissionsContext. Performs no policy discovery, I/O, prompting, navigation, permission grants, or sandbox changes. Obtain the context from managedSettings.resolve or session.managedSettings.get, or reuse an in-memory context. Results preserve input order and duplicates. Consumers must block deny, obtain approval for ask, and use their normal permission flow for unmanaged. Unknown policy returns failClosed with every operation denied. This is not a substitute for user permissions or other security controls.
+         *
+         * @param params Managed policy context and ordered operations for pure, sessionless evaluation.
+         *
+         * @returns Ordered managed permission verdicts and the supplied policy's fail-closed posture.
+         */
+        evaluate: async (params) => connection.sendRequest("managedSettings.permissions.evaluate", params)
+      },
       /**
        * Returns the managed-settings authoring JSON schema with descriptive `x-composition` annotations aligned with the shared settings-engine vocabulary. These annotations are not a complete runtime composition contract: model, effortLevel, and contextTier remain coupled. Use `managedSettings.compose` for the runtime's effective result. Performs no I/O.
        *
@@ -1068,6 +1079,42 @@ function createInternalServerRpc(connection) {
      */
     connect: async (params) => connection.sendRequest("connect", params),
     /** @experimental */
+    mcp: {
+      /** @experimental */
+      registry: {
+        /**
+         * Allocates an ID for one cancellable MCP registry search. The ID exists before the search starts, so callers can cancel before it starts. The networking stack supplies the cancellation namespace. The runtime retains at most 1,024 unused IDs. At capacity, another allocation can reclaim an unused ID. Active searches retain their IDs until they finish.
+         *
+         * @returns Request id naming a cancellable registry search.
+         */
+        allocateRequestId: async () => connection.sendRequest("mcp.registry.allocateRequestId", {}),
+        /**
+         * Searches the MCP registry the supplied credential may read, resolving the registry endpoint from policy first. Hosts usually send credential-free `AuthIdentity`; a `token` identity can be resolved only when it embeds a token, while `env` and `gh-cli` identities can use a token embedded in the request first. The runtime follows registry pages, keeps the newest entry per server name, cuts the list to `limit`, and sorts an empty-query result by GitHub stars. Each server object is carried opaquely.
+         *
+         * @param params Registry search terms, the credential to search under, and the request id that makes the search cancellable.
+         *
+         * @returns Servers selected from the registry response.
+         */
+        search: async (params) => connection.sendRequest("mcp.registry.search", params),
+        /**
+         * Abandons the registry search that uses the given request ID. It acts only on IDs from `mcp.registry.allocateRequestId`, so it never cancels another component's request. Answers `canceled: true` when it stops a running search. Answers `canceled: false` for unknown or reclaimed IDs, completed or canceled searches, and unused reservations. It releases an unused reservation, so a later search with that ID is refused.
+         *
+         * @param params Registry search to abandon.
+         *
+         * @returns Whether the cancel reached a live search.
+         */
+        cancel: async (params) => connection.sendRequest("mcp.registry.cancel", params)
+      },
+      /**
+       * Reports whether the gh-replaceable GitHub MCP tools may be clipped for a session, which a host feeds back as the `excludeGhReplaceableTools` build option. The tools are redundant only when the session can reach a shell *and* the host has the `gh` that would replace them, so both halves are decided here. The shell half runs the platform shell tool through the runtime's own tool-filter matcher, so entry forms like `builtin:bash` and `builtin:*` behave exactly as they do when a session builds its tool catalog. The host half probes for `gh`, and is skipped entirely when the filters already rule the shell out. Host presence alone is not enough: a session restricted to, say, `view` would otherwise lose the built-in issue-read fallback while having no shell to replace it with. The answer describes the host the runtime runs on, so it is never forwarded to a remote engine.
+       *
+       * @param params The session tool filters that decide whether the session still has a shell to run `gh` with.
+       *
+       * @returns Whether the gh-replaceable GitHub MCP tools may be clipped for the session described by the request.
+       */
+      shouldExcludeGitHubTools: async (params) => connection.sendRequest("mcp.shouldExcludeGitHubTools", params)
+    },
+    /** @experimental */
     agents: {
       /**
        * Lists the agents this runtime ships, by name. A consumer separating shipped agents from ones the user or a plugin authored should compare against these names rather than against `AgentInfo.source`: an authored agent may carry the `builtin` source while not being one of these, and the runtime treats the two as separate questions. `disableableNames` is the subset a user may turn off, which a client needs to decide whether to offer a toggle. `yamlBasedNames` is the subset backed by a shipped YAML definition, which a client needs before asking the runtime to load one.
@@ -1125,7 +1172,7 @@ function createInternalServerRpc(connection) {
        */
       loadForConfigDir: async (params) => connection.sendRequest("globalState.loadForConfigDir", params),
       /**
-       * Records one top-level key in the host's machine-wide state, the counterpart to `globalState.load`. A host calls this to remember that it has shown an onboarding step, asked a one-off question, or completed a migration, so the next run can skip it. Only the named key is replaced and the rest of the document is preserved, which lets two writers record different flags without overwriting each other; passing no value removes the key instead. Only the keys a host records itself are writable: `appInstallNudgeResponded`, `appTipShown`, `askedSetupTerminals`, `autoFeedbackLastPromptedAt`, `firstLaunchAt`, `recentModelIds`, `sandboxCredentialProxyCaDeclined` and `sandboxOnboardingShown`. Every other key is refused, including `installedPlugins`, the stored credentials, `trustedFolders`, the staff flags and the signed-in accounts. Plugin enablement must use the plugin APIs, which apply repository and managed-policy checks.
+       * Records one top-level key in the host's machine-wide state, the counterpart to `globalState.load`. A host calls this to remember that it has shown an onboarding step, asked a one-off question, or completed a migration, so the next run can skip it. Only the named key is replaced and the rest of the document is preserved, which lets two writers record different flags without overwriting each other; passing no value removes the key instead. Only the keys a host records itself are writable: `appTipShown`, `askedSetupTerminals`, `autoFeedbackLastPromptedAt`, `firstLaunchAt`, `recentModelIds`, `sandboxCredentialProxyCaDeclined` and `sandboxOnboardingShown`. Every other key is refused, including `installedPlugins`, the stored credentials, `trustedFolders`, the staff flags and the signed-in accounts. Plugin enablement must use the plugin APIs, which apply repository and managed-policy checks.
        *
        * @param params A single top-level key to record in the host's machine-wide state. The write replaces only that key and leaves the rest of the document untouched, so two writers recording different one-off flags do not overwrite each other. The stored credential keys cannot be written through this method.
        */
@@ -1355,6 +1402,12 @@ function createSessionRpc(connection, sessionId) {
        * @returns Managed sandbox enforcement state for a session.
        */
       getEnforcementStatus: async () => connection.sendRequest("session.sandbox.getEnforcementStatus", { sessionId }),
+      /**
+       * Lists possible secret-bearing environment variables available to new sandboxed shells that are not already covered by credential masking. Uses local name rules and known-provider host suggestions, never returns secret values, and changes no settings or network permissions. Returns no suggestions while the session is not sandboxed.
+       *
+       * @returns Possible unconfigured secrets in the sandbox shell environment, sorted by variable name, with no secret values.
+       */
+      getCredentialSuggestions: async () => connection.sendRequest("session.sandbox.getCredentialSuggestions", { sessionId }),
       /**
        * Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.
        *

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.95";
+export declare const COPILOT_CLI_VERSION = "1.0.96-1";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.95";
+const COPILOT_CLI_VERSION = "1.0.96-1";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/client.js

@@ -2435,6 +2435,7 @@ stderr: ${stderrOutput}`
   /** Starts the in-process FFI runtime with SDK-managed typed options. */
   async startInProcessFfi() {
     const explicitEntrypoint = this.resolvedEnv.COPILOT_CLI_PATH;
+    const cliLoginSyncIntegrationId = this.resolvedEnv.GITHUB_COPILOT_INTEGRATION_ID?.trim() || void 0;
     let runtimeLibrary;
     if (explicitEntrypoint) {
       const entrypointDirectory = dirname(resolve(explicitEntrypoint));
@@ -2446,7 +2447,8 @@ stderr: ${stderrOutput}`
         "runtime.node"
       );
     } else {
-      runtimeLibrary = join(dirname(await getBundledRuntimePath()), "runtime.node");
+      const bundledRuntimePath = await getBundledRuntimePath();
+      runtimeLibrary = join(dirname(bundledRuntimePath), "runtime.node");
     }
     const { FfiRuntimeHost } = await import("./ffiRuntimeHost.js");
     const environment = {};
@@ -2475,6 +2477,9 @@ stderr: ${stderrOutput}`
     if (this.options.enableRemoteSessions) {
       args.push("--remote");
     }
+    if (cliLoginSyncIntegrationId) {
+      args.push(`--cli-login-sync-integration-id=${cliLoginSyncIntegrationId}`);
+    }
     const host = FfiRuntimeHost.create(runtimeLibrary, explicitEntrypoint, environment, args);
     this.ffiHost = host;
     await host.start();

package/dist/generated/rpc.d.ts

@@ -3,7 +3,7 @@
  * Generated from: api.schema.json
  */
 import type { MessageConnection } from "vscode-jsonrpc/node.js";
-import type { AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, IndexedSearchState, ManagedSettingsResolvedData, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus, ModelChangeSource, ModelProviderKind, ModelProviderRef, PermissionDecisionSource, PermissionMode, PermissionPromptRequest, PermissionRule, ProviderQuotaState, ReasoningSummary, RemediationAction, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UsageGetMetricsResult, UserToolSessionApproval, Verbosity } from "./session-events.js";
+import type { AbortReason, AgentModelPolicy, Attachment, AutoTier, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, IndexedSearchState, ManagedPermissionsContext, ManagedSettingsResolvedData, McpOauthHttpResponse, McpOauthWWWAuthenticateParams, McpServerMetadata, McpServerSource, McpServerStatus, ModelChangeSource, ModelProviderKind, ModelProviderRef, PermissionDecisionSource, PermissionMode, PermissionPromptRequest, PermissionRule, ProviderQuotaState, ReasoningSummary, RemediationAction, SessionEvent, SessionLimitsConfig, SessionMode, ShutdownType, SkillSource, TaskCompleteData, TaskCompletionOutcome, UsageGetMetricsResult, UserToolSessionApproval, Verbosity } from "./session-events.js";
 /** A value that can be represented losslessly on the SDK JSON wire. */
 export type JsonValue = null | boolean | number | string | JsonValue[] | {
     [key: string]: JsonValue;
@@ -2569,6 +2569,33 @@ export type SessionLogLevel =
  | "warning"
 /** Error message describing a failure. */
  | "error";
+/** @experimental */
+export type ManagedPermissionOperation = {
+    /**
+     * Absolute HTTP(S) URL with a host. Invalid URLs reject the entire evaluation batch.
+     */
+    url: string;
+    /**
+     * Operation to evaluate. Currently only url is supported.
+     */
+    kind: "url";
+};
+/**
+ * Managed-policy verdict only: deny blocks the URL, ask requires approval, allow approves under managed policy, and unmanaged leaves the normal consumer permission flow in effect. No verdict bypasses other security controls.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ManagedPermissionVerdict".
+ */
+/** @experimental */
+export type ManagedPermissionVerdict = 
+/** Managed policy prohibits the operation; do not offer approval. */
+"deny"
+/** Managed policy requires the consumer to obtain approval. */
+ | "ask"
+/** Managed policy allows the operation, subject to other security controls. */
+ | "allow"
+/** Managed policy does not decide the operation; use the consumer's normal permission flow. */
+ | "unmanaged";
 /**
  * What retrying did for one plugin required by managed settings.
  *
@@ -3400,6 +3427,18 @@ export type McpSetEnvValueModeDetails =
 "direct"
 /** Treat MCP server environment values as host-side references to resolve before launch. */
  | "indirect";
+/**
+ * Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "OptionsUpdateToolFilterPrecedence".
+ */
+/** @experimental */
+export type OptionsUpdateToolFilterPrecedence = 
+/** If availableTools is set, it is the only constraint that applies (excludedTools is ignored). Preserves CLI / pre-existing client behavior. Default. */
+"available"
+/** A tool is enabled if and only if it matches the allowlist (or the allowlist is unset) AND it does not match the denylist. Makes 'all except X' expressible by combining the two lists. */
+ | "excluded";
 /**
  * Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
  *
@@ -3897,18 +3936,6 @@ export type OptionsUpdateReasoningSummary =
  | "concise"
 /** Request a detailed summary of model reasoning. */
  | "detailed";
-/**
- * Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "OptionsUpdateToolFilterPrecedence".
- */
-/** @experimental */
-export type OptionsUpdateToolFilterPrecedence = 
-/** If availableTools is set, it is the only constraint that applies (excludedTools is ignored). Preserves CLI / pre-existing client behavior. Default. */
-"available"
-/** A tool is enabled if and only if it matches the allowlist (or the allowlist is unset) AND it does not match the denylist. Makes 'all except X' expressible by combining the two lists. */
- | "excluded";
 /**
  * The client's response to the pending permission prompt
  *
@@ -6721,6 +6748,10 @@ export interface AccountStatus {
      */
     login: string;
     kind: AccountKind;
+    /**
+     * Human-readable credential source used to authenticate this account, such as `gh` or `GITHUB_TOKEN`.
+     */
+    authSource?: string;
     /**
      * Opaque id of the account this one was derived from (e.g. an EMU account's base Entra identity); absent for a root account. Matches the base identity account's selectionId, forming the derivation edge.
      */
@@ -13666,6 +13697,42 @@ export interface ManagedMcpServerConfig {
      */
     headersRefreshTtlMs?: number;
 }
+/** @experimental */
+export interface ManagedPermissionEvaluation {
+    operation: ManagedPermissionOperation;
+    verdict: ManagedPermissionVerdict;
+}
+/**
+ * Managed policy context and ordered operations for pure, sessionless evaluation.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ManagedPermissionsEvaluateRequest".
+ */
+/** @experimental */
+export interface ManagedPermissionsEvaluateRequest {
+    context: ManagedPermissionsContext;
+    /**
+     * Operations to evaluate, preserving input order and duplicates. An empty batch is valid.
+     */
+    operations: ManagedPermissionOperation[];
+}
+/**
+ * Ordered managed permission verdicts and the supplied policy's fail-closed posture.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ManagedPermissionsEvaluateResult".
+ */
+/** @experimental */
+export interface ManagedPermissionsEvaluateResult {
+    /**
+     * One verdict per input operation, in the same order, including duplicates.
+     */
+    results: ManagedPermissionEvaluation[];
+    /**
+     * Managed permission policy could not be determined; every operation is denied.
+     */
+    failClosed: boolean;
+}
 /**
  * Retry outcome for one plugin required by managed settings.
  *
@@ -13863,6 +13930,7 @@ export interface ManagedSettingsResolveRequest {
  */
 /** @experimental */
 export interface ManagedSettingsResolveResult {
+    permissionsContext?: ManagedPermissionsContext;
     /**
      * Printable opaque identity of the account the settings were resolved for, suitable for comparison and storage, not an account selectionId. Absent when no account was available, in which case only device policy is reported.
      */
@@ -21851,6 +21919,36 @@ export interface SandboxMaskedEnvVar {
      */
     injectHosts: string[];
 }
+/**
+ * A possible secret-bearing environment variable and optional locally suggested HTTPS injection hosts. This is a draft for user review, not an active grant.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxCredentialSuggestion".
+ */
+/** @experimental */
+export interface SandboxCredentialSuggestion {
+    /**
+     * Environment variable name. The secret value is never returned.
+     */
+    name: string;
+    /**
+     * HTTPS hostnames suggested by a local known-provider mapping. An empty list requires the user to supply injection hosts before adding a masking entry. These suggestions do not allow network access.
+     */
+    suggestedInjectHosts: string[];
+}
+/**
+ * Possible unconfigured secrets in the sandbox shell environment, sorted by variable name, with no secret values.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxCredentialSuggestionsResult".
+ */
+/** @experimental */
+export interface SandboxCredentialSuggestionsResult {
+    /**
+     * Candidates for user review. Empty when sandboxing is disabled or no unconfigured candidates are present.
+     */
+    suggestions: SandboxCredentialSuggestion[];
+}
 /**
  * Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.
  *
@@ -29991,6 +30089,37 @@ export interface HostGetConfigurationResult {
 /** @experimental */
 export interface HostReadyResult {
 }
+/**
+ * Ordered managed permission verdicts and the supplied policy's fail-closed posture.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ManagedSettingsPermissionsEvaluateResult".
+ */
+/** @experimental */
+export interface ManagedSettingsPermissionsEvaluateResult {
+    /**
+     * One verdict per input operation, in the same order, including duplicates.
+     */
+    results: ManagedPermissionEvaluation[];
+    /**
+     * Managed permission policy could not be determined; every operation is denied.
+     */
+    failClosed: boolean;
+}
+/**
+ * Managed policy context and ordered operations for pure, sessionless evaluation.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ManagedSettingsPermissionsEvaluateRequest".
+ */
+/** @experimental */
+export interface ManagedSettingsPermissionsEvaluateRequest {
+    context: ManagedPermissionsContext;
+    /**
+     * Operations to evaluate, preserving input order and duplicates. An empty batch is valid.
+     */
+    operations: ManagedPermissionOperation[];
+}
 /** @experimental */
 export interface SessionWorkflowPauseAtCheckpointResult {
     action: WorkflowPauseCheckpointAction;
@@ -31184,6 +31313,17 @@ export declare function createServerRpc(connection: MessageConnection): {
          * @returns Effective enterprise managed settings for an account, resolved without a session.
          */
         resolve: (params: ManagedSettingsResolveRequest) => Promise<ManagedSettingsResolveResult>;
+        /** @experimental */
+        permissions: {
+            /**
+             * Pure, sessionless evaluation of operations against a supplied permissionsContext. Performs no policy discovery, I/O, prompting, navigation, permission grants, or sandbox changes. Obtain the context from managedSettings.resolve or session.managedSettings.get, or reuse an in-memory context. Results preserve input order and duplicates. Consumers must block deny, obtain approval for ask, and use their normal permission flow for unmanaged. Unknown policy returns failClosed with every operation denied. This is not a substitute for user permissions or other security controls.
+             *
+             * @param params Managed policy context and ordered operations for pure, sessionless evaluation.
+             *
+             * @returns Ordered managed permission verdicts and the supplied policy's fail-closed posture.
+             */
+            evaluate: (params: ManagedSettingsPermissionsEvaluateRequest) => Promise<ManagedSettingsPermissionsEvaluateResult>;
+        };
         /**
          * Returns the managed-settings authoring JSON schema with descriptive `x-composition` annotations aligned with the shared settings-engine vocabulary. These annotations are not a complete runtime composition contract: model, effortLevel, and contextTier remain coupled. Use `managedSettings.compose` for the runtime's effective result. Performs no I/O.
          *
@@ -31572,6 +31712,12 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Managed sandbox enforcement state for a session.
          */
         getEnforcementStatus: () => Promise<SandboxEnforcementStatus>;
+        /**
+         * Lists possible secret-bearing environment variables available to new sandboxed shells that are not already covered by credential masking. Uses local name rules and known-provider host suggestions, never returns secret values, and changes no settings or network permissions. Returns no suggestions while the session is not sandboxed.
+         *
+         * @returns Possible unconfigured secrets in the sandbox shell environment, sorted by variable name, with no secret values.
+         */
+        getCredentialSuggestions: () => Promise<SandboxCredentialSuggestionsResult>;
         /**
          * Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.
          *

package/dist/generated/rpc.js

@@ -679,6 +679,17 @@ function createServerRpc(connection) {
        * @returns Effective enterprise managed settings for an account, resolved without a session.
        */
       resolve: async (params) => connection.sendRequest("managedSettings.resolve", params),
+      /** @experimental */
+      permissions: {
+        /**
+         * Pure, sessionless evaluation of operations against a supplied permissionsContext. Performs no policy discovery, I/O, prompting, navigation, permission grants, or sandbox changes. Obtain the context from managedSettings.resolve or session.managedSettings.get, or reuse an in-memory context. Results preserve input order and duplicates. Consumers must block deny, obtain approval for ask, and use their normal permission flow for unmanaged. Unknown policy returns failClosed with every operation denied. This is not a substitute for user permissions or other security controls.
+         *
+         * @param params Managed policy context and ordered operations for pure, sessionless evaluation.
+         *
+         * @returns Ordered managed permission verdicts and the supplied policy's fail-closed posture.
+         */
+        evaluate: async (params) => connection.sendRequest("managedSettings.permissions.evaluate", params)
+      },
       /**
        * Returns the managed-settings authoring JSON schema with descriptive `x-composition` annotations aligned with the shared settings-engine vocabulary. These annotations are not a complete runtime composition contract: model, effortLevel, and contextTier remain coupled. Use `managedSettings.compose` for the runtime's effective result. Performs no I/O.
        *
@@ -1040,6 +1051,42 @@ function createInternalServerRpc(connection) {
      */
     connect: async (params) => connection.sendRequest("connect", params),
     /** @experimental */
+    mcp: {
+      /** @experimental */
+      registry: {
+        /**
+         * Allocates an ID for one cancellable MCP registry search. The ID exists before the search starts, so callers can cancel before it starts. The networking stack supplies the cancellation namespace. The runtime retains at most 1,024 unused IDs. At capacity, another allocation can reclaim an unused ID. Active searches retain their IDs until they finish.
+         *
+         * @returns Request id naming a cancellable registry search.
+         */
+        allocateRequestId: async () => connection.sendRequest("mcp.registry.allocateRequestId", {}),
+        /**
+         * Searches the MCP registry the supplied credential may read, resolving the registry endpoint from policy first. Hosts usually send credential-free `AuthIdentity`; a `token` identity can be resolved only when it embeds a token, while `env` and `gh-cli` identities can use a token embedded in the request first. The runtime follows registry pages, keeps the newest entry per server name, cuts the list to `limit`, and sorts an empty-query result by GitHub stars. Each server object is carried opaquely.
+         *
+         * @param params Registry search terms, the credential to search under, and the request id that makes the search cancellable.
+         *
+         * @returns Servers selected from the registry response.
+         */
+        search: async (params) => connection.sendRequest("mcp.registry.search", params),
+        /**
+         * Abandons the registry search that uses the given request ID. It acts only on IDs from `mcp.registry.allocateRequestId`, so it never cancels another component's request. Answers `canceled: true` when it stops a running search. Answers `canceled: false` for unknown or reclaimed IDs, completed or canceled searches, and unused reservations. It releases an unused reservation, so a later search with that ID is refused.
+         *
+         * @param params Registry search to abandon.
+         *
+         * @returns Whether the cancel reached a live search.
+         */
+        cancel: async (params) => connection.sendRequest("mcp.registry.cancel", params)
+      },
+      /**
+       * Reports whether the gh-replaceable GitHub MCP tools may be clipped for a session, which a host feeds back as the `excludeGhReplaceableTools` build option. The tools are redundant only when the session can reach a shell *and* the host has the `gh` that would replace them, so both halves are decided here. The shell half runs the platform shell tool through the runtime's own tool-filter matcher, so entry forms like `builtin:bash` and `builtin:*` behave exactly as they do when a session builds its tool catalog. The host half probes for `gh`, and is skipped entirely when the filters already rule the shell out. Host presence alone is not enough: a session restricted to, say, `view` would otherwise lose the built-in issue-read fallback while having no shell to replace it with. The answer describes the host the runtime runs on, so it is never forwarded to a remote engine.
+       *
+       * @param params The session tool filters that decide whether the session still has a shell to run `gh` with.
+       *
+       * @returns Whether the gh-replaceable GitHub MCP tools may be clipped for the session described by the request.
+       */
+      shouldExcludeGitHubTools: async (params) => connection.sendRequest("mcp.shouldExcludeGitHubTools", params)
+    },
+    /** @experimental */
     agents: {
       /**
        * Lists the agents this runtime ships, by name. A consumer separating shipped agents from ones the user or a plugin authored should compare against these names rather than against `AgentInfo.source`: an authored agent may carry the `builtin` source while not being one of these, and the runtime treats the two as separate questions. `disableableNames` is the subset a user may turn off, which a client needs to decide whether to offer a toggle. `yamlBasedNames` is the subset backed by a shipped YAML definition, which a client needs before asking the runtime to load one.
@@ -1097,7 +1144,7 @@ function createInternalServerRpc(connection) {
        */
       loadForConfigDir: async (params) => connection.sendRequest("globalState.loadForConfigDir", params),
       /**
-       * Records one top-level key in the host's machine-wide state, the counterpart to `globalState.load`. A host calls this to remember that it has shown an onboarding step, asked a one-off question, or completed a migration, so the next run can skip it. Only the named key is replaced and the rest of the document is preserved, which lets two writers record different flags without overwriting each other; passing no value removes the key instead. Only the keys a host records itself are writable: `appInstallNudgeResponded`, `appTipShown`, `askedSetupTerminals`, `autoFeedbackLastPromptedAt`, `firstLaunchAt`, `recentModelIds`, `sandboxCredentialProxyCaDeclined` and `sandboxOnboardingShown`. Every other key is refused, including `installedPlugins`, the stored credentials, `trustedFolders`, the staff flags and the signed-in accounts. Plugin enablement must use the plugin APIs, which apply repository and managed-policy checks.
+       * Records one top-level key in the host's machine-wide state, the counterpart to `globalState.load`. A host calls this to remember that it has shown an onboarding step, asked a one-off question, or completed a migration, so the next run can skip it. Only the named key is replaced and the rest of the document is preserved, which lets two writers record different flags without overwriting each other; passing no value removes the key instead. Only the keys a host records itself are writable: `appTipShown`, `askedSetupTerminals`, `autoFeedbackLastPromptedAt`, `firstLaunchAt`, `recentModelIds`, `sandboxCredentialProxyCaDeclined` and `sandboxOnboardingShown`. Every other key is refused, including `installedPlugins`, the stored credentials, `trustedFolders`, the staff flags and the signed-in accounts. Plugin enablement must use the plugin APIs, which apply repository and managed-policy checks.
        *
        * @param params A single top-level key to record in the host's machine-wide state. The write replaces only that key and leaves the rest of the document untouched, so two writers recording different one-off flags do not overwrite each other. The stored credential keys cannot be written through this method.
        */
@@ -1327,6 +1374,12 @@ function createSessionRpc(connection, sessionId) {
        * @returns Managed sandbox enforcement state for a session.
        */
       getEnforcementStatus: async () => connection.sendRequest("session.sandbox.getEnforcementStatus", { sessionId }),
+      /**
+       * Lists possible secret-bearing environment variables available to new sandboxed shells that are not already covered by credential masking. Uses local name rules and known-provider host suggestions, never returns secret values, and changes no settings or network permissions. Returns no suggestions while the session is not sandboxed.
+       *
+       * @returns Possible unconfigured secrets in the sandbox shell environment, sorted by variable name, with no secret values.
+       */
+      getCredentialSuggestions: async () => connection.sendRequest("session.sandbox.getCredentialSuggestions", { sessionId }),
       /**
        * Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.
        *

package/dist/generated/session-events.d.ts

@@ -435,6 +435,38 @@ export type ProviderQuotaCapacityState =
  | "unknown"
 /** Client-only compatibility placeholder when acquisitionStatus is unavailable or failed; not an observed service verdict. */
  | "unavailable";
+/**
+ * Identity scope of a monthly usage reading.
+ */
+export type ProviderMonthlyUsageScope = 
+/** Consumption of the authenticated user within the parent observation's service and returned cycle. */
+"user"
+/** The service did not establish a recognized usage scope. */
+ | "unknown";
+/**
+ * Availability of a service's monthly consumption reading.
+ */
+export type ProviderMonthlyUsageState = 
+/** The service reported a usable consumption reading, including an explicit zero. */
+"available"
+/** The service found no usage policy; no consumption amount is known. */
+ | "no_policy"
+/** The read failed or its data could not be used; consumption is unknown. */
+ | "unavailable"
+/** The service reported an unrecognized usage state. */
+ | "unknown";
+/**
+ * Units explicitly reported by a quota provider.
+ */
+export type ProviderQuotaUnit = 
+/** AI credits, not tokens or currency. */
+"ai_credits"
+/** Requests charged against an entitlement. */
+ | "requests"
+/** Model tokens. */
+ | "tokens"
+/** The observation does not establish a quantity unit. */
+ | "unknown";
 /**
  * Timing and purpose of a provider quota observation.
  */
@@ -453,18 +485,6 @@ export type ProviderQuotaQuantityKind =
  | "advisory_balance"
 /** No quantity measurement, as with admission-only response headers. */
  | "none";
-/**
- * Units explicitly reported by a quota provider.
- */
-export type ProviderQuotaUnit = 
-/** AI credits, not tokens or currency. */
-"ai_credits"
-/** Requests charged against an entitlement. */
- | "requests"
-/** Model tokens. */
- | "tokens"
-/** The observation does not establish a quantity unit. */
- | "unknown";
 /**
  * What initiated a conversation compaction
  */
@@ -764,6 +784,16 @@ export type AssistantUsageApiEndpoint =
  | "/responses"
 /** WebSocket Responses API endpoint. */
  | "ws:/responses";
+/**
+ * Content-Encoding applied to the request body sent on the wire
+ */
+export type ModelCallRequestBodyEncoding = 
+/** The request body was sent uncompressed (including every WebSocket request). */
+"identity"
+/** The request body was sent gzip-compressed. */
+ | "gzip"
+/** The request body was sent zstd-compressed. */
+ | "zstd";
 /**
  * Transport used for a successful model call
  */
@@ -772,6 +802,34 @@ export type AssistantUsageTransport =
 "http"
 /** WebSocket transport. */
  | "websocket";
+/**
+ * Normalized cause of the WebSocket failure that triggered the HTTP fallback
+ */
+export type ModelCallWebSocketFallbackErrorKind = 
+/** DNS resolution of the WebSocket host failed. */
+"dns"
+/** The TLS handshake or a TLS record failed. */
+ | "tls"
+/** A WebSocket connect or read timed out. */
+ | "timeout"
+/** The peer refused the TCP connection. */
+ | "connection_refused"
+/** The connection was reset, aborted, or ended mid-stream without a close. */
+ | "connection_reset"
+/** The peer closed the WebSocket. */
+ | "closed_by_peer"
+/** The runtime closed the WebSocket itself. */
+ | "closed_locally"
+/** The socket was already closed before it was used. */
+ | "not_connected"
+/** The upgrade or request was rejected with an HTTP status. */
+ | "http_status"
+/** A WebSocket protocol violation or an undecodable frame. */
+ | "protocol"
+/** The WebSocket request could not be built. */
+ | "configuration"
+/** A failure that maps onto none of the other kinds. */
+ | "other";
 /**
  * Why a WebSocket-capable model call was carried by the HTTP fallback
  */
@@ -3569,6 +3627,7 @@ export interface ProviderQuotaState {
      * HTTP status from acquisition, when available.
      */
     httpStatus?: number;
+    monthlyUsage?: ProviderMonthlyUsage;
     observationKind?: ProviderQuotaObservationKind;
     /**
      * When the runtime observed this reading, not a charge timestamp or guarantee that consumption has settled.
@@ -3643,6 +3702,31 @@ export interface ProviderQuotaBudgetMetadata {
      */
     usageAllowedWhenExhausted: boolean;
 }
+/**
+ * An authoritative monthly usage reading for the observation's provider, account, and service.
+ */
+/** @experimental */
+export interface ProviderMonthlyUsage {
+    /**
+     * Nonnegative finite consumption reported by the service, preserving zero and fractions. Present only when state is available; never computed from tokens or balance differences.
+     */
+    consumedQuantity?: number;
+    /**
+     * Start of the service-reported monthly billing cycle, in UTC RFC 3339.
+     */
+    cycleStart?: string;
+    /**
+     * Service read time in UTC RFC 3339, not a ledger reconciliation watermark or confirmation of the latest inference charge.
+     */
+    queriedAt?: string;
+    /**
+     * End of the service-reported monthly billing cycle, in UTC RFC 3339.
+     */
+    resetOn?: string;
+    scope: ProviderMonthlyUsageScope;
+    state: ProviderMonthlyUsageState;
+    unit: ProviderQuotaUnit;
+}
 /**
  * Session event "session.context_changed". Updated working directory and git context after the change
  */
@@ -6614,9 +6698,14 @@ export interface AssistantUsageData {
      */
     rejectedPredictionTokens?: number;
     /**
-     * Serialized (uncompressed) byte length of the request body. A content-free size signal.
+     * Serialized (uncompressed) byte length of the request body, before any Content-Encoding. A content-free size signal.
      */
     requestBodyBytes?: number;
+    requestBodyEncoding?: ModelCallRequestBodyEncoding;
+    /**
+     * Byte length of the request body actually sent on the wire for the attempt that produced this outcome, after any Content-Encoding. Equals requestBodyBytes when the body was not compressed.
+     */
+    requestBodyWireBytes?: number;
     /**
      * Per-request treatment/eligibility signal returned by the Copilot API in the `X-GitHub-Copilot-Request-TE` response header for the associated model call; `false` when the header was absent or unparseable.
      */
@@ -6634,7 +6723,24 @@ export interface AssistantUsageData {
      * Milliseconds spent on the WebSocket attempt before falling back to HTTP
      */
     websocketFallbackAfterMs?: number;
+    /**
+     * WebSocket close code received before the HTTP fallback
+     */
+    websocketFallbackCloseCode?: number;
+    websocketFallbackErrorKind?: ModelCallWebSocketFallbackErrorKind;
     websocketFallbackReason?: ModelCallWebSocketFallbackReason;
+    /**
+     * Whether a WebSocket reconnect was attempted before falling back to HTTP
+     */
+    websocketFallbackReconnectAttempted?: boolean;
+    /**
+     * Whether the HTTP fallback started during this model call, rather than being inherited from an earlier call
+     */
+    websocketFallbackStartedThisCall?: boolean;
+    /**
+     * HTTP status of the WebSocket upgrade rejection or WebSocket API error that triggered the HTTP fallback
+     */
+    websocketFallbackStatusCode?: number;
 }
 /**
  * Ordered accounting identity assigned under the source session's emission lock.
@@ -6803,9 +6909,14 @@ export interface ModelCallFailureData {
      */
     reasoningEffort?: string;
     /**
-     * Serialized (uncompressed) byte length of the failed request body. A content-free size signal.
+     * Serialized (uncompressed) byte length of the failed request body, before any Content-Encoding. A content-free size signal.
      */
     requestBodyBytes?: number;
+    requestBodyEncoding?: ModelCallRequestBodyEncoding;
+    /**
+     * Byte length of the failed request body actually sent on the wire, after any Content-Encoding. Equals requestBodyBytes when the body was not compressed.
+     */
+    requestBodyWireBytes?: number;
     requestFingerprint?: ModelCallFailureRequestFingerprint;
     /**
      * Zero-based orchestrator retry index of the failed attempt
@@ -6829,7 +6940,24 @@ export interface ModelCallFailureData {
      * Milliseconds spent on the WebSocket attempt before falling back to HTTP
      */
     websocketFallbackAfterMs?: number;
+    /**
+     * WebSocket close code received before the HTTP fallback
+     */
+    websocketFallbackCloseCode?: number;
+    websocketFallbackErrorKind?: ModelCallWebSocketFallbackErrorKind;
     websocketFallbackReason?: ModelCallWebSocketFallbackReason;
+    /**
+     * Whether a WebSocket reconnect was attempted before falling back to HTTP
+     */
+    websocketFallbackReconnectAttempted?: boolean;
+    /**
+     * Whether the HTTP fallback started during this model call, rather than being inherited from an earlier call
+     */
+    websocketFallbackStartedThisCall?: boolean;
+    /**
+     * HTTP status of the WebSocket upgrade rejection or WebSocket API error that triggered the HTTP fallback
+     */
+    websocketFallbackStatusCode?: number;
 }
 /**
  * Content-free structural summary of the failing request for diagnosing malformed 4xx calls
@@ -12278,7 +12406,7 @@ export interface ManagedSettingsResolvedEvent {
 /** @experimental */
 export interface ManagedSettingsResolvedData {
     /**
-     * Whether enterprise policy disables bypass-permissions ("yolo") mode for this session. Deny-wins across layers, and forced on when `failClosed` is true.
+     * Whether an explicit enterprise policy restriction disables bypass-permissions ("yolo") mode for this session. Deny-wins across layers; an unresolved policy does not force this on by itself.
      */
     bypassPermissionsDisabled: boolean;
     /**
@@ -12290,7 +12418,7 @@ export interface ManagedSettingsResolvedData {
      */
     deviceManaged: boolean;
     /**
-     * Whether managed policy could not be determined (e.g. a failed server fetch) and the session fell back to the fail-closed restriction. When true, restrictions such as disabling bypass-permissions are enforced even though `settings` may be absent.
+     * Whether managed policy could not be determined (e.g. a failed server fetch) and unresolved-policy safeguards remain active. This does not by itself disable bypass-permissions; `bypassPermissionsDisabled` reports only an explicit policy restriction.
      */
     failClosed: boolean;
     /**
@@ -12301,6 +12429,7 @@ export interface ManagedSettingsResolvedData {
      * Whether at least two managed sources supplied permission allowlists, so enforcement intersects them and the flattened settings payload omits `permissions.allow`.
      */
     permissionsAllowIntersected?: boolean;
+    permissionsContext?: ManagedPermissionsContext;
     /**
      * Whether the policy-helper managed-settings layer was present. The policy helper is the weakest channel: it fills keys no enterprise source set and can never replace one.
      */
@@ -12319,6 +12448,19 @@ export interface ManagedSettingsResolvedData {
     settings?: JsonValue;
     source: ManagedSettingsResolvedSource;
 }
+/**
+ * Reusable managed permission evaluation context. Treat permissions as runtime-owned policy data and retain it verbatim; it includes source-aware composition metadata. This is a snapshot, not a capability or approval token; only use contexts obtained from trusted policy sources.
+ */
+export interface ManagedPermissionsContext {
+    /**
+     * Policy could not be determined; evaluation must deny every operation.
+     */
+    failClosed: boolean;
+    /**
+     * Runtime-owned composed permissions object. Absent when no permission policy is configured.
+     */
+    permissions?: JsonValue;
+}
 /**
  * Session event "session.managed_settings_enforced". Runtime enforcement of enterprise managed settings: fires when the session blocks or caps a runtime action because enterprise policy governs it, so SDK clients can explain *why* an action was governed. Unlike `session.managed_settings_resolved` (which reports *what* is managed), this reports a concrete governed action — e.g. a user or host tried to turn on bypass permissions or Assisted Permissions while the corresponding policy disables it. Emitted live (not persisted to the session event log) on user/host-initiated attempts only, never for silent policy application. Marked experimental while the managed-settings surface stabilizes.
  */

package/package.json

@@ -5,8 +5,8 @@
         "url": "https://github.com/github/copilot-agent-runtime.git",
         "directory": "src/sdk/nodejs"
     },
-    "version": "1.0.19",
-    "copilotCliVersion": "1.0.95",
+    "version": "1.0.20-preview.1",
+    "copilotCliVersion": "1.0.96-1",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
@@ -104,18 +104,18 @@
         "README.md"
     ],
     "copilotRuntime": {
-        "sourceSha": "f5ba50575c25c247798fb12ded26c48b421577ce",
-        "version": "1.0.95",
+        "sourceSha": "f225a827d983e1be1e047b1d7baed68d8a509264",
+        "version": "1.0.96-1",
         "visibility": "public"
     },
     "optionalDependencies": {
-        "@github/copilot-sdk-darwin-arm64": "1.0.19",
-        "@github/copilot-sdk-darwin-x64": "1.0.19",
-        "@github/copilot-sdk-linux-arm64": "1.0.19",
-        "@github/copilot-sdk-linux-x64": "1.0.19",
-        "@github/copilot-sdk-linuxmusl-arm64": "1.0.19",
-        "@github/copilot-sdk-linuxmusl-x64": "1.0.19",
-        "@github/copilot-sdk-win32-arm64": "1.0.19",
-        "@github/copilot-sdk-win32-x64": "1.0.19"
+        "@github/copilot-sdk-darwin-arm64": "1.0.20-preview.1",
+        "@github/copilot-sdk-darwin-x64": "1.0.20-preview.1",
+        "@github/copilot-sdk-linux-arm64": "1.0.20-preview.1",
+        "@github/copilot-sdk-linux-x64": "1.0.20-preview.1",
+        "@github/copilot-sdk-linuxmusl-arm64": "1.0.20-preview.1",
+        "@github/copilot-sdk-linuxmusl-x64": "1.0.20-preview.1",
+        "@github/copilot-sdk-win32-arm64": "1.0.20-preview.1",
+        "@github/copilot-sdk-win32-x64": "1.0.20-preview.1"
     }
 }