@github/copilot-sdk 1.0.2 → 1.0.4

package/dist/generated/rpc.d.ts

@@ -4,6 +4,13 @@
  */
 import type { MessageConnection } from "vscode-jsonrpc/node.js";
 import type { AbortReason, Attachment, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpServerSource, McpServerStatus, PermissionPromptRequest, PermissionRule, ReasoningSummary, SessionEvent, SessionMode, ShutdownType, SkillSource, UserToolSessionApproval } from "./session-events.js";
+/**
+ * Initial authentication info for the session.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AuthInfo".
+ */
+export type AuthInfo = HMACAuthInfo | EnvAuthInfo | TokenAuthInfo | CopilotApiTokenAuthInfo | UserAuthInfo | GhCliAuthInfo | ApiKeyAuthInfo;
 /**
  * Which tier this directory belongs to
  *
@@ -166,14 +173,6 @@ export type AgentRegistrySpawnValidationErrorField =
  | "model"
 /** The permissionMode parameter */
  | "permissionMode";
-/**
- * Initial authentication info for the session.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AuthInfo".
- */
-/** @experimental */
-export type AuthInfo = HMACAuthInfo | EnvAuthInfo | TokenAuthInfo | CopilotApiTokenAuthInfo | UserAuthInfo | GhCliAuthInfo | ApiKeyAuthInfo;
 /**
  * Authentication type
  *
@@ -196,18 +195,6 @@ export type AuthInfoType =
  | "token"
 /** Authentication from a Copilot API token. */
  | "copilot-api-token";
-/**
- * Runtime-controlled routing state for an open canvas instance.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CanvasInstanceAvailability".
- */
-/** @experimental */
-export type CanvasInstanceAvailability = 
-/** The owning provider is currently connected and routing calls will be dispatched normally. */
-"ready"
-/** The owning provider is not currently connected. Routing calls fail with canvas_provider_unavailable until the agent re-issues open_canvas (which rehydrates via a fresh canvas.open) or the provider reconnects. */
- | "stale";
 /**
  * Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command
  *
@@ -473,6 +460,18 @@ export type InstructionSourceLocation =
  | "working-directory"
 /** Instructions live in plugin-provided configuration. */
  | "plugin";
+/**
+ * Transport the runtime would otherwise use for this request. `http` (the default when absent) covers plain HTTP and SSE responses; `websocket` indicates a full-duplex message channel where each body chunk maps to one WebSocket message and the `binary` flag distinguishes text from binary frames. The SDK consumer uses this to decide whether to service the request with an HTTP client or a WebSocket client. It is the one piece of request metadata the consumer cannot reliably infer from the URL or headers alone.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpRequestStartTransport".
+ */
+/** @experimental */
+export type LlmInferenceHttpRequestStartTransport = 
+/** Plain HTTP or SSE response. Each body chunk is an opaque byte range; the response is a status line, headers, and a (possibly streamed) body. */
+"http"
+/** Full-duplex WebSocket channel. Each body chunk maps to exactly one WebSocket message and the `binary` flag distinguishes text from binary frames; request and response chunks flow concurrently. */
+ | "websocket";
 /**
  * Repository host type
  *
@@ -654,6 +653,46 @@ export type McpServerConfigHttpOauthGrantType =
 "authorization_code"
 /** Headless client credentials flow using the configured OAuth client. */
  | "client_credentials";
+/**
+ * Host response to the pending OAuth request.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpOauthPendingRequestResponse".
+ */
+/** @experimental */
+export type McpOauthPendingRequestResponse = {
+    /**
+     * Access token acquired by the SDK host
+     */
+    accessToken: string;
+    /**
+     * OAuth token type. Defaults to Bearer when omitted.
+     */
+    tokenType?: string;
+    /**
+     * Refresh token supplied by the host, if available.
+     */
+    refreshToken?: string;
+    /**
+     * Token lifetime in seconds, if known.
+     */
+    expiresIn?: number;
+    kind: "token";
+} | {
+    kind: "cancelled";
+};
+/**
+ * OAuth grant type override for this login.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpOauthLoginGrantType".
+ */
+/** @experimental */
+export type McpOauthLoginGrantType = 
+/** Interactive browser-based OAuth flow using an authorization code, typically with PKCE. */
+"authorization_code"
+/** Headless OAuth flow where a confidential client authenticates directly with a client secret. */
+ | "client_credentials";
 /**
  * Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.
  *
@@ -834,6 +873,18 @@ export type ProviderConfigWireApi =
 "completions"
 /** OpenAI Responses API wire format. */
  | "responses";
+/**
+ * Provider transport. Defaults to "http".
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderConfigTransport".
+ */
+/** @experimental */
+export type ProviderConfigTransport = 
+/** HTTP request/streaming transport. */
+"http"
+/** WebSocket transport. */
+ | "websockets";
 /**
  * Allowed values for the `OptionsUpdateAdditionalContentExclusionPolicyScope` enumeration.
  *
@@ -1022,6 +1073,18 @@ export type ProviderEndpointWireApi =
 "completions"
 /** Newer responses request shape. */
  | "responses";
+/**
+ * Transport to be used for provider requests.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderEndpointTransport".
+ */
+/** @experimental */
+export type ProviderEndpointTransport = 
+/** HTTP request/streaming transport. */
+"http"
+/** WebSocket transport. */
+ | "websockets";
 /**
  * Schema for the `PushAttachment` type.
  *
@@ -1637,7 +1700,9 @@ export type WorkspaceDiffMode =
 /** Return staged, unstaged, and untracked working tree changes. */
 "unstaged"
 /** Return changes compared with the default branch. */
- | "branch";
+ | "branch"
+/** Return the cumulative diff of files Copilot changed this session (used in non-git workspaces). */
+ | "session";
 /**
  * Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
  *
@@ -1650,6 +1715,13 @@ export type WorkspacesWorkspaceDetailsHostType =
 "github"
 /** Workspace repository is hosted on Azure DevOps. */
  | "ado";
+/**
+ * List of all authenticated users
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AccountGetAllUsersResult".
+ */
+export type AccountGetAllUsersResult = AccountAllUsers[];
 /**
  * Parameters for aborting the current turn
  *
@@ -1677,793 +1749,859 @@ export interface AbortResult {
      */
     error?: string;
 }
-export interface AccountGetQuotaRequest {
-    /**
-     * GitHub token for per-user quota lookup. When provided, resolves this token to determine the user's quota instead of using the global auth.
-     */
-    gitHubToken?: string;
-}
 /**
- * Quota usage snapshots for the resolved user, keyed by quota type.
+ * Schema for the `AccountAllUsers` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AccountGetQuotaResult".
+ * via the `definition` "AccountAllUsers".
  */
-export interface AccountGetQuotaResult {
+export interface AccountAllUsers {
+    authInfo: AuthInfo;
     /**
-     * Quota snapshots keyed by type (e.g., chat, completions, premium_interactions)
+     * Associated token, if available
      */
-    quotaSnapshots: {
-        [k: string]: AccountQuotaSnapshot | undefined;
-    };
+    token?: string;
 }
 /**
- * Schema for the `AccountQuotaSnapshot` type.
+ * Schema for the `HMACAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AccountQuotaSnapshot".
+ * via the `definition` "HMACAuthInfo".
  */
-export interface AccountQuotaSnapshot {
-    /**
-     * Whether the user has an unlimited usage entitlement
-     */
-    isUnlimitedEntitlement: boolean;
-    /**
-     * Number of requests included in the entitlement, or -1 for unlimited entitlements
-     */
-    entitlementRequests: number;
-    /**
-     * Number of requests used so far this period
-     */
-    usedRequests: number;
-    /**
-     * Whether usage is still permitted after quota exhaustion
-     */
-    usageAllowedWithExhaustedQuota: boolean;
-    /**
-     * Percentage of entitlement remaining
-     */
-    remainingPercentage: number;
+export interface HMACAuthInfo {
     /**
-     * Number of additional usage requests made this period
+     * HMAC-based authentication used by GitHub-internal services.
      */
-    overage: number;
+    type: "hmac";
     /**
-     * Whether additional usage is allowed when quota is exhausted
+     * Authentication host. HMAC auth always targets the public GitHub host.
      */
-    overageAllowedWithExhaustedQuota: boolean;
+    host: "https://github.com";
     /**
-     * Date when the quota resets (ISO 8601 string)
+     * HMAC secret used to sign requests.
      */
-    resetDate?: string;
+    hmac: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Schema for the `AgentDiscoveryPath` type.
+ * Snapshot of the authenticated user's Copilot subscription info, if known. Mirrors the GitHub API `/copilot_internal/v2/token` user response shape — the runtime trusts this verbatim and does not re-fetch when set.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentDiscoveryPath".
+ * via the `definition` "CopilotUserResponse".
  */
-/** @experimental */
-export interface AgentDiscoveryPath {
-    /**
-     * Absolute path of the search/create directory (may not exist on disk yet)
-     */
-    path: string;
-    scope: AgentDiscoveryPathScope;
-    /**
-     * Whether this is the canonical directory to create a new agent in its tier. At most one entry per tier is preferred.
-     */
-    preferredForCreation: boolean;
-    /**
-     * The input project path this directory was derived from (only for project scope)
-     */
-    projectPath?: string;
+export interface CopilotUserResponse {
+    login?: string;
+    access_type_sku?: string;
+    analytics_tracking_id?: string;
+    assigned_date?: ({
+        [k: string]: unknown | undefined;
+    } | string) | null;
+    can_signup_for_limited?: boolean;
+    chat_enabled?: boolean;
+    copilot_plan?: string;
+    copilotignore_enabled?: boolean;
+    endpoints?: CopilotUserResponseEndpoints;
+    organization_login_list?: string[];
+    organization_list?: ({
+        [k: string]: unknown | undefined;
+    } | ({
+        login?: ({
+            [k: string]: unknown | undefined;
+        } | string) | null;
+        name?: ({
+            [k: string]: unknown | undefined;
+        } | string) | null;
+    } | null)[]) | null;
+    codex_agent_enabled?: boolean;
+    is_mcp_enabled?: ({
+        [k: string]: unknown | undefined;
+    } | boolean) | null;
+    quota_reset_date?: string;
+    quota_snapshots?: CopilotUserResponseQuotaSnapshots;
+    restricted_telemetry?: boolean;
+    is_staff?: boolean;
+    token_based_billing?: boolean;
+    can_upgrade_plan?: boolean;
+    quota_reset_date_utc?: string;
+    limited_user_quotas?: {
+        [k: string]: number | undefined;
+    };
+    limited_user_reset_date?: string;
+    monthly_quotas?: {
+        [k: string]: number | undefined;
+    };
+    cloud_session_storage_enabled?: boolean;
+    cli_remote_control_enabled?: boolean;
 }
 /**
- * Canonical locations where custom agents can be created so the runtime will recognize them.
+ * Schema for the `CopilotUserResponseEndpoints` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentDiscoveryPathList".
+ * via the `definition` "CopilotUserResponseEndpoints".
  */
-/** @experimental */
-export interface AgentDiscoveryPathList {
-    /**
-     * Canonical agent create/discovery directories, in priority order
-     */
-    paths: AgentDiscoveryPath[];
+export interface CopilotUserResponseEndpoints {
+    api?: string;
+    "origin-tracker"?: string;
+    proxy?: string;
+    telemetry?: string;
 }
 /**
- * The currently selected custom agent, or null when using the default agent.
+ * Schema for the `CopilotUserResponseQuotaSnapshots` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentGetCurrentResult".
+ * via the `definition` "CopilotUserResponseQuotaSnapshots".
  */
-/** @experimental */
-export interface AgentGetCurrentResult {
-    /**
-     * Currently selected custom agent, or null if using the default agent
-     */
-    agent?: AgentInfo | null;
+export interface CopilotUserResponseQuotaSnapshots {
+    chat?: CopilotUserResponseQuotaSnapshotsChat;
+    completions?: CopilotUserResponseQuotaSnapshotsCompletions;
+    premium_interactions?: CopilotUserResponseQuotaSnapshotsPremiumInteractions;
+    [k: string]: ({
+        entitlement?: number;
+        overage_count?: number;
+        overage_permitted?: boolean;
+        percent_remaining?: number;
+        quota_id?: string;
+        quota_remaining?: number;
+        remaining?: number;
+        unlimited?: boolean;
+        timestamp_utc?: string;
+        has_quota?: boolean;
+        quota_reset_at?: number;
+        token_based_billing?: boolean;
+    } | null) | undefined;
 }
 /**
- * Schema for the `AgentInfo` type.
+ * Schema for the `CopilotUserResponseQuotaSnapshotsChat` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentInfo".
+ * via the `definition` "CopilotUserResponseQuotaSnapshotsChat".
  */
-/** @experimental */
-export interface AgentInfo {
-    /**
-     * Unique identifier of the custom agent
-     */
-    name: string;
-    /**
-     * Human-readable display name
-     */
-    displayName: string;
-    /**
-     * Description of the agent's purpose
-     */
-    description: string;
-    /**
-     * Absolute local file path of the agent definition. Only set for file-based agents loaded from disk; remote agents do not have a path.
-     */
-    path?: string;
-    /**
-     * Stable identifier for selection. For most agents this is the same as `name`; for plugin/builtin agents it may differ. Always populated; defaults to `name` when no distinct id was assigned.
-     */
-    id: string;
-    source?: AgentInfoSource;
-    /**
-     * Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only.
-     */
-    userInvocable?: boolean;
-    /**
-     * Allowed tool names for this agent. Empty array means none; omitted means inherit defaults.
-     */
-    tools?: string[];
-    /**
-     * Preferred model id for this agent. When omitted, inherits the outer agent's model.
-     */
-    model?: string;
-    /**
-     * MCP server configurations attached to this agent, keyed by server name. Server config shape mirrors the MCP `mcpServers` schema.
-     *
-     * @experimental
-     */
-    mcpServers?: {
-        [k: string]: unknown | undefined;
-    };
-    /**
-     * Skill names preloaded into this agent's context. Omitted means none.
-     */
-    skills?: string[];
+export interface CopilotUserResponseQuotaSnapshotsChat {
+    entitlement?: number;
+    overage_count?: number;
+    overage_permitted?: boolean;
+    percent_remaining?: number;
+    quota_id?: string;
+    quota_remaining?: number;
+    remaining?: number;
+    unlimited?: boolean;
+    timestamp_utc?: string;
+    has_quota?: boolean;
+    quota_reset_at?: number;
+    token_based_billing?: boolean;
 }
 /**
- * Custom agents available to the session.
+ * Schema for the `CopilotUserResponseQuotaSnapshotsCompletions` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentList".
+ * via the `definition` "CopilotUserResponseQuotaSnapshotsCompletions".
  */
-/** @experimental */
-export interface AgentList {
-    /**
-     * Available custom agents
-     */
-    agents: AgentInfo[];
+export interface CopilotUserResponseQuotaSnapshotsCompletions {
+    entitlement?: number;
+    overage_count?: number;
+    overage_permitted?: boolean;
+    percent_remaining?: number;
+    quota_id?: string;
+    quota_remaining?: number;
+    remaining?: number;
+    unlimited?: boolean;
+    timestamp_utc?: string;
+    has_quota?: boolean;
+    quota_reset_at?: number;
+    token_based_billing?: boolean;
 }
 /**
- * Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).
+ * Schema for the `CopilotUserResponseQuotaSnapshotsPremiumInteractions` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistryLiveTargetEntry".
+ * via the `definition` "CopilotUserResponseQuotaSnapshotsPremiumInteractions".
  */
-/** @experimental */
-export interface AgentRegistryLiveTargetEntry {
-    /**
-     * Registry entry schema version (1 = ui-server, 2 = managed-server)
-     */
-    schemaVersion: number;
-    kind: AgentRegistryLiveTargetEntryKind;
+export interface CopilotUserResponseQuotaSnapshotsPremiumInteractions {
+    entitlement?: number;
+    overage_count?: number;
+    overage_permitted?: boolean;
+    percent_remaining?: number;
+    quota_id?: string;
+    quota_remaining?: number;
+    remaining?: number;
+    unlimited?: boolean;
+    timestamp_utc?: string;
+    has_quota?: boolean;
+    quota_reset_at?: number;
+    token_based_billing?: boolean;
+}
+/**
+ * Schema for the `EnvAuthInfo` type.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "EnvAuthInfo".
+ */
+export interface EnvAuthInfo {
     /**
-     * Operating-system pid of the process owning this entry
+     * Personal access token (PAT) or server-to-server token sourced from an environment variable.
      */
-    pid: number;
+    type: "env";
     /**
-     * Bind host for the entry's JSON-RPC server
+     * Authentication host (e.g. https://github.com or a GHES host).
      */
     host: string;
     /**
-     * TCP port the entry's JSON-RPC server is listening on
-     */
-    port: number;
-    /**
-     * Session ID of the foreground session for this entry
-     */
-    sessionId?: string;
-    /**
-     * Friendly session name (when set)
-     */
-    sessionName?: string;
-    /**
-     * Working directory of the session (when known)
-     */
-    cwd?: string;
-    /**
-     * Git branch of the session (when known)
-     */
-    branch?: string;
-    /**
-     * Model identifier currently selected for the session
-     */
-    model?: string;
-    status?: AgentRegistryLiveTargetEntryStatus;
-    attentionKind?: AgentRegistryLiveTargetEntryAttentionKind;
-    /**
-     * Monotonic per-publisher revision counter incremented on every status update. Lets watchers detect transient flips.
-     */
-    statusRevision?: number;
-    lastTerminalEvent?: AgentRegistryLiveTargetEntryLastTerminalEvent;
-    /**
-     * ISO 8601 timestamp captured at registration
+     * User login associated with the token. Undefined for server-to-server tokens (those starting with `ghs_`).
      */
-    startedAt: string;
+    login?: string;
     /**
-     * Copilot CLI version that wrote the entry
+     * The token value itself. Treat as a secret.
      */
-    copilotVersion: string;
+    token: string;
     /**
-     * Wall-clock milliseconds since the watcher last observed this entry (heartbeat freshness)
+     * Name of the environment variable the token was sourced from.
      */
-    lastSeenMs: number;
+    envVar: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Per-spawn log-capture outcome; populated from spawnLiveTarget.
+ * Schema for the `TokenAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistryLogCapture".
+ * via the `definition` "TokenAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistryLogCapture {
+export interface TokenAuthInfo {
     /**
-     * Whether per-spawn log capture is on (false when env-disabled or open failed)
+     * SDK-side token authentication; the host configured the token directly via the SDK.
      */
-    enabled: boolean;
+    type: "token";
     /**
-     * Absolute path to the per-spawn log file (only set when enabled)
+     * Authentication host.
      */
-    path?: string;
+    host: string;
     /**
-     * Human-readable open failure message (only set when enabled === false AND the env-disable opt-out was NOT used)
+     * The token value itself. Treat as a secret.
      */
-    openError?: string;
-    openErrorReason?: AgentRegistryLogCaptureOpenErrorReason;
+    token: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * `child_process.spawn` itself failed before the child entered the registry.
+ * Schema for the `CopilotApiTokenAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnError".
+ * via the `definition` "CopilotApiTokenAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistrySpawnError {
-    /**
-     * Discriminator: child_process.spawn itself failed
-     */
-    kind: "spawn-error";
+export interface CopilotApiTokenAuthInfo {
     /**
-     * Human-readable error message
+     * Direct Copilot API authentication via the `GITHUB_COPILOT_API_TOKEN` + `COPILOT_API_URL` environment-variable pair. The token itself is read from the environment by the runtime, not carried in this struct.
      */
-    message: string;
+    type: "copilot-api-token";
     /**
-     * Underlying errno code (e.g. ENOENT, EACCES) when available
+     * Authentication host (always the public GitHub host).
      */
-    code?: string;
+    host: "https://github.com";
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Spawn succeeded but the child did not publish a matching managed-server entry within the timeout.
+ * Schema for the `UserAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnRegistryTimeout".
+ * via the `definition` "UserAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistrySpawnRegistryTimeout {
+export interface UserAuthInfo {
     /**
-     * Discriminator: spawn succeeded but child never registered
+     * OAuth user authentication. The token itself is held in the runtime's secret token store (keyed by host+login) and is NOT carried in this struct.
      */
-    kind: "registry-timeout";
+    type: "user";
     /**
-     * Process ID of the orphaned child (so the caller can offer 'kill the pid' guidance)
+     * Authentication host.
      */
-    childPid: number;
-    logCapture?: AgentRegistryLogCapture;
+    host: string;
+    /**
+     * OAuth user login.
+     */
+    login: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Inputs to spawn a managed-server child via the controller's spawn delegate.
+ * Schema for the `GhCliAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnRequest".
+ * via the `definition` "GhCliAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistrySpawnRequest {
-    /**
-     * Working directory for the spawned child (must be an existing directory)
-     */
-    cwd: string;
+export interface GhCliAuthInfo {
     /**
-     * Custom or built-in agent name (e.g. 'explore'). When omitted, the child uses its own default.
+     * Authentication via the `gh` CLI's saved credentials.
      */
-    agentName?: string;
+    type: "gh-cli";
     /**
-     * Model identifier to apply to the new session
+     * Authentication host.
      */
-    model?: string;
+    host: string;
     /**
-     * Friendly session name. Must satisfy validateSessionName: non-empty, no leading/trailing whitespace, <=100 chars, no control chars, no double quotes.
+     * User login as reported by `gh auth status`.
      */
-    name?: string;
-    permissionMode?: AgentRegistrySpawnPermissionMode;
+    login: string;
     /**
-     * Optional first user message. Forwarded to the caller (the CLI's spawn wrapper sends it post-attach via the standard LocalRpcSession.send path).
+     * The token returned by `gh auth token`. Treat as a secret.
      */
-    initialPrompt?: string;
+    token: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Managed-server child was spawned and registered successfully.
+ * Schema for the `ApiKeyAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnSpawned".
+ * via the `definition` "ApiKeyAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistrySpawnSpawned {
+export interface ApiKeyAuthInfo {
     /**
-     * Discriminator: managed-server child spawned successfully
+     * API-key authentication for non-GitHub LLM providers (e.g. when running BYOM-style).
      */
-    kind: "spawned";
-    entry: AgentRegistryLiveTargetEntry;
+    type: "api-key";
     /**
-     * Whether the delegate already sent the initial prompt. Always omitted in the current wiring: the controller sends the prompt post-attach via the standard LocalRpcSession.send path.
+     * The API key. Treat as a secret.
      */
-    initialPromptSent?: boolean;
+    apiKey: string;
     /**
-     * If the delegate attempted to send the initial prompt and failed, the categorized error message.
+     * Authentication host.
      */
-    initialPromptError?: string;
-    logCapture?: AgentRegistryLogCapture;
+    host: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Synchronous pre-validation rejected the spawn request.
+ * Current authentication state
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnValidationError".
+ * via the `definition` "AccountGetCurrentAuthResult".
  */
-/** @experimental */
-export interface AgentRegistrySpawnValidationError {
+export interface AccountGetCurrentAuthResult {
+    authInfo?: AuthInfo;
     /**
-     * Discriminator: synchronous pre-validation rejected the request
+     * Authentication errors from the last auth attempt, if any
      */
-    kind: "validation-error";
-    reason: AgentRegistrySpawnValidationErrorReason;
-    field?: AgentRegistrySpawnValidationErrorField;
+    authErrors?: string[];
+}
+export interface AccountGetQuotaRequest {
     /**
-     * Human-readable explanation; safe to surface in the UI banner. Never logged to unrestricted telemetry.
+     * GitHub token for per-user quota lookup. When provided, resolves this token to determine the user's quota instead of using the global auth.
      */
-    message: string;
+    gitHubToken?: string;
 }
 /**
- * Custom agents available to the session after reloading definitions from disk.
+ * Quota usage snapshots for the resolved user, keyed by quota type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentReloadResult".
+ * via the `definition` "AccountGetQuotaResult".
  */
-/** @experimental */
-export interface AgentReloadResult {
+export interface AccountGetQuotaResult {
     /**
-     * Reloaded custom agents
+     * Quota snapshots keyed by type (e.g., chat, completions, premium_interactions)
      */
-    agents: AgentInfo[];
+    quotaSnapshots: {
+        [k: string]: AccountQuotaSnapshot | undefined;
+    };
 }
 /**
- * Optional project paths to include in agent discovery.
+ * Schema for the `AccountQuotaSnapshot` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentsDiscoverRequest".
+ * via the `definition` "AccountQuotaSnapshot".
  */
-/** @experimental */
-export interface AgentsDiscoverRequest {
+export interface AccountQuotaSnapshot {
     /**
-     * Optional list of project directory paths to scan for project-scoped agents. When omitted or empty, only user/plugin/remote-independent agents are returned (no project scan).
+     * Whether the user has an unlimited usage entitlement
      */
-    projectPaths?: string[];
+    isUnlimitedEntitlement: boolean;
     /**
-     * When true, omit the host's agents (the user-level agent directory and all plugin agents), leaving only project and remote agents. For multitenant deployments.
+     * Number of requests included in the entitlement, or -1 for unlimited entitlements
      */
-    excludeHostAgents?: boolean;
+    entitlementRequests: number;
+    /**
+     * Number of requests used so far this period
+     */
+    usedRequests: number;
+    /**
+     * Whether usage is still permitted after quota exhaustion
+     */
+    usageAllowedWithExhaustedQuota: boolean;
+    /**
+     * Percentage of entitlement remaining
+     */
+    remainingPercentage: number;
+    /**
+     * Number of additional usage requests made this period
+     */
+    overage: number;
+    /**
+     * Whether additional usage is allowed when quota is exhausted
+     */
+    overageAllowedWithExhaustedQuota: boolean;
+    /**
+     * Date when the quota resets (ISO 8601 string)
+     */
+    resetDate?: string;
 }
 /**
- * Name of the custom agent to select for subsequent turns.
+ * Credentials to store after successful authentication
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentSelectRequest".
+ * via the `definition` "AccountLoginRequest".
  */
-/** @experimental */
-export interface AgentSelectRequest {
+export interface AccountLoginRequest {
     /**
-     * Name of the custom agent to select
+     * GitHub host URL
      */
-    name: string;
+    host: string;
+    /**
+     * User login/username
+     */
+    login: string;
+    /**
+     * GitHub authentication token
+     */
+    token: string;
 }
 /**
- * The newly selected custom agent.
+ * Result of a successful login; throws on failure
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentSelectResult".
+ * via the `definition` "AccountLoginResult".
  */
-/** @experimental */
-export interface AgentSelectResult {
-    agent: AgentInfo;
+export interface AccountLoginResult {
+    /**
+     * Whether the credential was persisted to a secure store (system keychain, or the config file when plaintext storage is enabled). False when no secure store was available and the token was not saved, so the consumer can decide how to proceed.
+     */
+    storedInVault: boolean;
 }
 /**
- * Optional project paths to include when enumerating agent discovery directories.
+ * User to log out
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentsGetDiscoveryPathsRequest".
+ * via the `definition` "AccountLogoutRequest".
  */
-/** @experimental */
-export interface AgentsGetDiscoveryPathsRequest {
-    /**
-     * Optional list of project directory paths. When omitted or empty, only the user-level directory is returned.
-     */
-    projectPaths?: string[];
+export interface AccountLogoutRequest {
+    authInfo: AuthInfo;
+}
+/**
+ * Logout result indicating if more users remain
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AccountLogoutResult".
+ */
+export interface AccountLogoutResult {
     /**
-     * When true, omit the host's user-level agent directory, leaving only project directories. For multitenant deployments (mirrors `discover`'s `excludeHostAgents`).
+     * Whether other authenticated users remain after logout
      */
-    excludeHostAgents?: boolean;
+    hasMoreUsers: boolean;
 }
 /**
- * Indicates whether the operation succeeded and reports the post-mutation state.
+ * Schema for the `AgentDiscoveryPath` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AllowAllPermissionSetResult".
+ * via the `definition` "AgentDiscoveryPath".
  */
 /** @experimental */
-export interface AllowAllPermissionSetResult {
+export interface AgentDiscoveryPath {
     /**
-     * Whether the operation succeeded
+     * Absolute path of the search/create directory (may not exist on disk yet)
      */
-    success: boolean;
+    path: string;
+    scope: AgentDiscoveryPathScope;
     /**
-     * Authoritative allow-all state after the mutation
+     * Whether this is the canonical directory to create a new agent in its tier. At most one entry per tier is preferred.
      */
-    enabled: boolean;
+    preferredForCreation: boolean;
+    /**
+     * The input project path this directory was derived from (only for project scope)
+     */
+    projectPath?: string;
 }
 /**
- * Current full allow-all permission state.
+ * Canonical locations where custom agents can be created so the runtime will recognize them.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AllowAllPermissionState".
+ * via the `definition` "AgentDiscoveryPathList".
  */
 /** @experimental */
-export interface AllowAllPermissionState {
+export interface AgentDiscoveryPathList {
     /**
-     * Whether full allow-all permissions are currently active
+     * Canonical agent create/discovery directories, in priority order
      */
-    enabled: boolean;
+    paths: AgentDiscoveryPath[];
 }
 /**
- * Schema for the `ApiKeyAuthInfo` type.
+ * The currently selected custom agent, or null when using the default agent.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "ApiKeyAuthInfo".
+ * via the `definition` "AgentGetCurrentResult".
  */
 /** @experimental */
-export interface ApiKeyAuthInfo {
-    /**
-     * API-key authentication for non-GitHub LLM providers (e.g. when running BYOM-style).
-     */
-    type: "api-key";
-    /**
-     * The API key. Treat as a secret.
-     */
-    apiKey: string;
+export interface AgentGetCurrentResult {
     /**
-     * Authentication host.
+     * Currently selected custom agent, or null if using the default agent
      */
-    host: string;
-    copilotUser?: CopilotUserResponse;
+    agent?: AgentInfo | null;
 }
 /**
- * Snapshot of the authenticated user's Copilot subscription info, if known. Mirrors the GitHub API `/copilot_internal/v2/token` user response shape — the runtime trusts this verbatim and does not re-fetch when set.
+ * Schema for the `AgentInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponse".
+ * via the `definition` "AgentInfo".
  */
 /** @experimental */
-export interface CopilotUserResponse {
-    login?: string;
-    access_type_sku?: string;
-    analytics_tracking_id?: string;
-    assigned_date?: ({
-        [k: string]: unknown | undefined;
-    } | string) | null;
-    can_signup_for_limited?: boolean;
-    chat_enabled?: boolean;
-    copilot_plan?: string;
-    copilotignore_enabled?: boolean;
-    endpoints?: CopilotUserResponseEndpoints;
-    organization_login_list?: string[];
-    organization_list?: ({
-        [k: string]: unknown | undefined;
-    } | ({
-        login?: ({
-            [k: string]: unknown | undefined;
-        } | string) | null;
-        name?: ({
-            [k: string]: unknown | undefined;
-        } | string) | null;
-    } | null)[]) | null;
-    codex_agent_enabled?: boolean;
-    is_mcp_enabled?: ({
+export interface AgentInfo {
+    /**
+     * Unique identifier of the custom agent
+     */
+    name: string;
+    /**
+     * Human-readable display name
+     */
+    displayName: string;
+    /**
+     * Description of the agent's purpose
+     */
+    description: string;
+    /**
+     * Absolute local file path of the agent definition. Only set for file-based agents loaded from disk; remote agents do not have a path.
+     */
+    path?: string;
+    /**
+     * Stable identifier for selection. For most agents this is the same as `name`; for plugin/builtin agents it may differ. Always populated; defaults to `name` when no distinct id was assigned.
+     */
+    id: string;
+    source?: AgentInfoSource;
+    /**
+     * Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only.
+     */
+    userInvocable?: boolean;
+    /**
+     * Allowed tool names for this agent. Empty array means none; omitted means inherit defaults.
+     */
+    tools?: string[];
+    /**
+     * Preferred model id for this agent. When omitted, inherits the outer agent's model.
+     */
+    model?: string;
+    /**
+     * MCP server configurations attached to this agent, keyed by server name. Server config shape mirrors the MCP `mcpServers` schema.
+     *
+     * @experimental
+     */
+    mcpServers?: {
         [k: string]: unknown | undefined;
-    } | boolean) | null;
-    quota_reset_date?: string;
-    quota_snapshots?: CopilotUserResponseQuotaSnapshots;
-    restricted_telemetry?: boolean;
-    is_staff?: boolean;
-    token_based_billing?: boolean;
-    can_upgrade_plan?: boolean;
-    quota_reset_date_utc?: string;
-    limited_user_quotas?: {
-        [k: string]: number | undefined;
     };
-    limited_user_reset_date?: string;
-    monthly_quotas?: {
-        [k: string]: number | undefined;
-    };
-    cloud_session_storage_enabled?: boolean;
-    cli_remote_control_enabled?: boolean;
+    /**
+     * Skill names preloaded into this agent's context. Omitted means none.
+     */
+    skills?: string[];
 }
 /**
- * Schema for the `CopilotUserResponseEndpoints` type.
+ * Custom agents available to the session.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseEndpoints".
+ * via the `definition` "AgentList".
  */
 /** @experimental */
-export interface CopilotUserResponseEndpoints {
-    api?: string;
-    "origin-tracker"?: string;
-    proxy?: string;
-    telemetry?: string;
+export interface AgentList {
+    /**
+     * Available custom agents
+     */
+    agents: AgentInfo[];
 }
 /**
- * Schema for the `CopilotUserResponseQuotaSnapshots` type.
+ * Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseQuotaSnapshots".
+ * via the `definition` "AgentRegistryLiveTargetEntry".
  */
 /** @experimental */
-export interface CopilotUserResponseQuotaSnapshots {
-    chat?: CopilotUserResponseQuotaSnapshotsChat;
-    completions?: CopilotUserResponseQuotaSnapshotsCompletions;
-    premium_interactions?: CopilotUserResponseQuotaSnapshotsPremiumInteractions;
-    [k: string]: ({
-        entitlement?: number;
-        overage_count?: number;
-        overage_permitted?: boolean;
-        percent_remaining?: number;
-        quota_id?: string;
-        quota_remaining?: number;
-        remaining?: number;
-        unlimited?: boolean;
-        timestamp_utc?: string;
-        has_quota?: boolean;
-        quota_reset_at?: number;
-        token_based_billing?: boolean;
-    } | null) | undefined;
+export interface AgentRegistryLiveTargetEntry {
+    /**
+     * Registry entry schema version (1 = ui-server, 2 = managed-server)
+     */
+    schemaVersion: number;
+    kind: AgentRegistryLiveTargetEntryKind;
+    /**
+     * Operating-system pid of the process owning this entry
+     */
+    pid: number;
+    /**
+     * Bind host for the entry's JSON-RPC server
+     */
+    host: string;
+    /**
+     * TCP port the entry's JSON-RPC server is listening on
+     */
+    port: number;
+    /**
+     * Session ID of the foreground session for this entry
+     */
+    sessionId?: string;
+    /**
+     * Friendly session name (when set)
+     */
+    sessionName?: string;
+    /**
+     * Working directory of the session (when known)
+     */
+    cwd?: string;
+    /**
+     * Git branch of the session (when known)
+     */
+    branch?: string;
+    /**
+     * Model identifier currently selected for the session
+     */
+    model?: string;
+    status?: AgentRegistryLiveTargetEntryStatus;
+    attentionKind?: AgentRegistryLiveTargetEntryAttentionKind;
+    /**
+     * Monotonic per-publisher revision counter incremented on every status update. Lets watchers detect transient flips.
+     */
+    statusRevision?: number;
+    lastTerminalEvent?: AgentRegistryLiveTargetEntryLastTerminalEvent;
+    /**
+     * ISO 8601 timestamp captured at registration
+     */
+    startedAt: string;
+    /**
+     * Copilot CLI version that wrote the entry
+     */
+    copilotVersion: string;
+    /**
+     * Wall-clock milliseconds since the watcher last observed this entry (heartbeat freshness)
+     */
+    lastSeenMs: number;
 }
 /**
- * Schema for the `CopilotUserResponseQuotaSnapshotsChat` type.
+ * Per-spawn log-capture outcome; populated from spawnLiveTarget.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseQuotaSnapshotsChat".
+ * via the `definition` "AgentRegistryLogCapture".
  */
 /** @experimental */
-export interface CopilotUserResponseQuotaSnapshotsChat {
-    entitlement?: number;
-    overage_count?: number;
-    overage_permitted?: boolean;
-    percent_remaining?: number;
-    quota_id?: string;
-    quota_remaining?: number;
-    remaining?: number;
-    unlimited?: boolean;
-    timestamp_utc?: string;
-    has_quota?: boolean;
-    quota_reset_at?: number;
-    token_based_billing?: boolean;
+export interface AgentRegistryLogCapture {
+    /**
+     * Whether per-spawn log capture is on (false when env-disabled or open failed)
+     */
+    enabled: boolean;
+    /**
+     * Absolute path to the per-spawn log file (only set when enabled)
+     */
+    path?: string;
+    /**
+     * Human-readable open failure message (only set when enabled === false AND the env-disable opt-out was NOT used)
+     */
+    openError?: string;
+    openErrorReason?: AgentRegistryLogCaptureOpenErrorReason;
 }
 /**
- * Schema for the `CopilotUserResponseQuotaSnapshotsCompletions` type.
+ * `child_process.spawn` itself failed before the child entered the registry.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseQuotaSnapshotsCompletions".
+ * via the `definition` "AgentRegistrySpawnError".
  */
 /** @experimental */
-export interface CopilotUserResponseQuotaSnapshotsCompletions {
-    entitlement?: number;
-    overage_count?: number;
-    overage_permitted?: boolean;
-    percent_remaining?: number;
-    quota_id?: string;
-    quota_remaining?: number;
-    remaining?: number;
-    unlimited?: boolean;
-    timestamp_utc?: string;
-    has_quota?: boolean;
-    quota_reset_at?: number;
-    token_based_billing?: boolean;
+export interface AgentRegistrySpawnError {
+    /**
+     * Discriminator: child_process.spawn itself failed
+     */
+    kind: "spawn-error";
+    /**
+     * Human-readable error message
+     */
+    message: string;
+    /**
+     * Underlying errno code (e.g. ENOENT, EACCES) when available
+     */
+    code?: string;
 }
 /**
- * Schema for the `CopilotUserResponseQuotaSnapshotsPremiumInteractions` type.
+ * Spawn succeeded but the child did not publish a matching managed-server entry within the timeout.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseQuotaSnapshotsPremiumInteractions".
+ * via the `definition` "AgentRegistrySpawnRegistryTimeout".
  */
 /** @experimental */
-export interface CopilotUserResponseQuotaSnapshotsPremiumInteractions {
-    entitlement?: number;
-    overage_count?: number;
-    overage_permitted?: boolean;
-    percent_remaining?: number;
-    quota_id?: string;
-    quota_remaining?: number;
-    remaining?: number;
-    unlimited?: boolean;
-    timestamp_utc?: string;
-    has_quota?: boolean;
-    quota_reset_at?: number;
-    token_based_billing?: boolean;
+export interface AgentRegistrySpawnRegistryTimeout {
+    /**
+     * Discriminator: spawn succeeded but child never registered
+     */
+    kind: "registry-timeout";
+    /**
+     * Process ID of the orphaned child (so the caller can offer 'kill the pid' guidance)
+     */
+    childPid: number;
+    logCapture?: AgentRegistryLogCapture;
 }
 /**
- * Schema for the `HMACAuthInfo` type.
+ * Inputs to spawn a managed-server child via the controller's spawn delegate.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "HMACAuthInfo".
+ * via the `definition` "AgentRegistrySpawnRequest".
  */
 /** @experimental */
-export interface HMACAuthInfo {
+export interface AgentRegistrySpawnRequest {
     /**
-     * HMAC-based authentication used by GitHub-internal services.
+     * Working directory for the spawned child (must be an existing directory)
      */
-    type: "hmac";
+    cwd: string;
     /**
-     * Authentication host. HMAC auth always targets the public GitHub host.
+     * Custom or built-in agent name (e.g. 'explore'). When omitted, the child uses its own default.
      */
-    host: "https://github.com";
+    agentName?: string;
     /**
-     * HMAC secret used to sign requests.
+     * Model identifier to apply to the new session
      */
-    hmac: string;
-    copilotUser?: CopilotUserResponse;
+    model?: string;
+    /**
+     * Friendly session name. Must satisfy validateSessionName: non-empty, no leading/trailing whitespace, <=100 chars, no control chars, no double quotes.
+     */
+    name?: string;
+    permissionMode?: AgentRegistrySpawnPermissionMode;
+    /**
+     * Optional first user message. Forwarded to the caller (the CLI's spawn wrapper sends it post-attach via the standard LocalRpcSession.send path).
+     */
+    initialPrompt?: string;
 }
 /**
- * Schema for the `EnvAuthInfo` type.
+ * Managed-server child was spawned and registered successfully.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "EnvAuthInfo".
+ * via the `definition` "AgentRegistrySpawnSpawned".
  */
 /** @experimental */
-export interface EnvAuthInfo {
-    /**
-     * Personal access token (PAT) or server-to-server token sourced from an environment variable.
-     */
-    type: "env";
-    /**
-     * Authentication host (e.g. https://github.com or a GHES host).
-     */
-    host: string;
+export interface AgentRegistrySpawnSpawned {
     /**
-     * User login associated with the token. Undefined for server-to-server tokens (those starting with `ghs_`).
+     * Discriminator: managed-server child spawned successfully
      */
-    login?: string;
+    kind: "spawned";
+    entry: AgentRegistryLiveTargetEntry;
     /**
-     * The token value itself. Treat as a secret.
+     * Whether the delegate already sent the initial prompt. Always omitted in the current wiring: the controller sends the prompt post-attach via the standard LocalRpcSession.send path.
      */
-    token: string;
+    initialPromptSent?: boolean;
     /**
-     * Name of the environment variable the token was sourced from.
+     * If the delegate attempted to send the initial prompt and failed, the categorized error message.
      */
-    envVar: string;
-    copilotUser?: CopilotUserResponse;
+    initialPromptError?: string;
+    logCapture?: AgentRegistryLogCapture;
 }
 /**
- * Schema for the `TokenAuthInfo` type.
+ * Synchronous pre-validation rejected the spawn request.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "TokenAuthInfo".
+ * via the `definition` "AgentRegistrySpawnValidationError".
  */
 /** @experimental */
-export interface TokenAuthInfo {
+export interface AgentRegistrySpawnValidationError {
     /**
-     * SDK-side token authentication; the host configured the token directly via the SDK.
+     * Discriminator: synchronous pre-validation rejected the request
      */
-    type: "token";
+    kind: "validation-error";
+    reason: AgentRegistrySpawnValidationErrorReason;
+    field?: AgentRegistrySpawnValidationErrorField;
     /**
-     * Authentication host.
+     * Human-readable explanation; safe to surface in the UI banner. Never logged to unrestricted telemetry.
      */
-    host: string;
+    message: string;
+}
+/**
+ * Custom agents available to the session after reloading definitions from disk.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentReloadResult".
+ */
+/** @experimental */
+export interface AgentReloadResult {
     /**
-     * The token value itself. Treat as a secret.
+     * Reloaded custom agents
      */
-    token: string;
-    copilotUser?: CopilotUserResponse;
+    agents: AgentInfo[];
 }
 /**
- * Schema for the `CopilotApiTokenAuthInfo` type.
+ * Optional project paths to include in agent discovery.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotApiTokenAuthInfo".
+ * via the `definition` "AgentsDiscoverRequest".
  */
 /** @experimental */
-export interface CopilotApiTokenAuthInfo {
+export interface AgentsDiscoverRequest {
     /**
-     * Direct Copilot API authentication via the `GITHUB_COPILOT_API_TOKEN` + `COPILOT_API_URL` environment-variable pair. The token itself is read from the environment by the runtime, not carried in this struct.
+     * Optional list of project directory paths to scan for project-scoped agents. When omitted or empty, only user/plugin/remote-independent agents are returned (no project scan).
      */
-    type: "copilot-api-token";
+    projectPaths?: string[];
     /**
-     * Authentication host (always the public GitHub host).
+     * When true, omit the host's agents (the user-level agent directory and all plugin agents), leaving only project and remote agents. For multitenant deployments.
      */
-    host: "https://github.com";
-    copilotUser?: CopilotUserResponse;
+    excludeHostAgents?: boolean;
 }
 /**
- * Schema for the `UserAuthInfo` type.
+ * Name of the custom agent to select for subsequent turns.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "UserAuthInfo".
+ * via the `definition` "AgentSelectRequest".
  */
 /** @experimental */
-export interface UserAuthInfo {
+export interface AgentSelectRequest {
     /**
-     * OAuth user authentication. The token itself is held in the runtime's secret token store (keyed by host+login) and is NOT carried in this struct.
+     * Name of the custom agent to select
      */
-    type: "user";
+    name: string;
+}
+/**
+ * The newly selected custom agent.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentSelectResult".
+ */
+/** @experimental */
+export interface AgentSelectResult {
+    agent: AgentInfo;
+}
+/**
+ * Optional project paths to include when enumerating agent discovery directories.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentsGetDiscoveryPathsRequest".
+ */
+/** @experimental */
+export interface AgentsGetDiscoveryPathsRequest {
     /**
-     * Authentication host.
+     * Optional list of project directory paths. When omitted or empty, only the user-level directory is returned.
      */
-    host: string;
+    projectPaths?: string[];
     /**
-     * OAuth user login.
+     * When true, omit the host's user-level agent directory, leaving only project directories. For multitenant deployments (mirrors `discover`'s `excludeHostAgents`).
      */
-    login: string;
-    copilotUser?: CopilotUserResponse;
+    excludeHostAgents?: boolean;
 }
 /**
- * Schema for the `GhCliAuthInfo` type.
+ * Indicates whether the operation succeeded and reports the post-mutation state.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "GhCliAuthInfo".
+ * via the `definition` "AllowAllPermissionSetResult".
  */
 /** @experimental */
-export interface GhCliAuthInfo {
-    /**
-     * Authentication via the `gh` CLI's saved credentials.
-     */
-    type: "gh-cli";
+export interface AllowAllPermissionSetResult {
     /**
-     * Authentication host.
+     * Whether the operation succeeded
      */
-    host: string;
+    success: boolean;
     /**
-     * User login as reported by `gh auth status`.
+     * Authoritative allow-all state after the mutation
      */
-    login: string;
+    enabled: boolean;
+}
+/**
+ * Current full allow-all permission state.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AllowAllPermissionState".
+ */
+/** @experimental */
+export interface AllowAllPermissionState {
     /**
-     * The token returned by `gh auth token`. Treat as a secret.
+     * Whether full allow-all permissions are currently active
      */
-    token: string;
-    copilotUser?: CopilotUserResponse;
+    enabled: boolean;
 }
 /**
  * Cancellation result for a user-requested shell command.
@@ -2677,11 +2815,6 @@ export interface OpenCanvasInstance {
     input?: {
         [k: string]: unknown | undefined;
     };
-    /**
-     * Whether this snapshot came from an idempotent reopen
-     */
-    reopen: boolean;
-    availability: CanvasInstanceAvailability;
 }
 /**
  * Canvas open parameters.
@@ -2841,6 +2974,19 @@ export interface CanvasProviderOpenResult {
      */
     status?: string;
 }
+/**
+ * Options scoped to the built-in CAPI (Copilot API) provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CapiSessionOptions".
+ */
+/** @experimental */
+export interface CapiSessionOptions {
+    /**
+     * Whether to use WebSocket transport for the CAPI Responses API. Enabled by default when the model advertises `ws:/responses` support; set to `false` to force the HTTP Responses transport in environments where WebSockets are blocked (e.g. behind a proxy). Setting this to `false` is equivalent to the `COPILOT_CLI_DISABLE_WEBSOCKET_RESPONSES` environment variable.
+     */
+    enableWebSocketResponses?: boolean;
+}
 /**
  * Slash commands available in the session, after applying any include/exclude filters.
  *
@@ -3450,7 +3596,6 @@ export interface ExternalToolTextResultForLlm {
      * Structured content blocks from the tool
      */
     contents?: ExternalToolTextResultForLlmContent[];
-    [k: string]: unknown | undefined;
 }
 /**
  * Binary result returned by a tool for the model
@@ -4089,21 +4234,213 @@ export interface InstructionSource {
     type: InstructionSourceType;
     location: InstructionSourceLocation;
     /**
-     * Glob pattern(s) from frontmatter — when set, this instruction applies only to matching files
+     * Glob pattern(s) from frontmatter — when set, this instruction applies only to matching files
+     */
+    applyTo?: string[];
+    /**
+     * Short description (body after frontmatter) for use in instruction tables
+     */
+    description?: string;
+    /**
+     * When true, this source starts disabled and must be toggled on by the user
+     */
+    defaultDisabled?: boolean;
+    /**
+     * The project path this source was discovered from. Only set by sessionless discovery for repository/working-directory sources, where it disambiguates same-named files (e.g. .github/copilot-instructions.md) across multiple workspace roots. The session-scoped getSources leaves it unset.
+     */
+    projectPath?: string;
+}
+/**
+ * HTTP headers as a map from lowercased header name to a list of values. Multi-valued headers (e.g. Set-Cookie) preserve all values.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHeaders".
+ */
+/** @experimental */
+export interface LlmInferenceHeaders {
+    [k: string]: string[] | undefined;
+}
+/**
+ * A request body chunk or cancellation signal.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpRequestChunkRequest".
+ */
+/** @experimental */
+export interface LlmInferenceHttpRequestChunkRequest {
+    /**
+     * Matches the requestId from the originating httpRequestStart frame.
+     */
+    requestId: string;
+    /**
+     * Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty.
+     */
+    data: string;
+    /**
+     * When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.
+     */
+    binary?: boolean;
+    /**
+     * When true, this is the final body chunk for the request. The SDK may rely on having received an end-marked chunk before treating the request body as complete.
+     */
+    end?: boolean;
+    /**
+     * When true, the runtime is cancelling the in-flight request (e.g. upstream consumer aborted). `data` is ignored. Implies end-of-request.
+     */
+    cancel?: boolean;
+    /**
+     * Optional human-readable reason for the cancellation, propagated for logging.
+     */
+    cancelReason?: string;
+}
+/**
+ * Acknowledgement. The SDK is free to ignore the ack and treat chunk delivery as fire-and-forget.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpRequestChunkResult".
+ */
+/** @experimental */
+export interface LlmInferenceHttpRequestChunkResult {
+}
+/**
+ * The head of an outbound model-layer HTTP request.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpRequestStartRequest".
+ */
+/** @experimental */
+export interface LlmInferenceHttpRequestStartRequest {
+    /**
+     * Opaque runtime-minted id, unique per in-flight request. The SDK uses this to correlate httpRequestChunk frames and to address its httpResponseStart / httpResponseChunk replies back to the runtime.
+     */
+    requestId: string;
+    /**
+     * Id of the runtime session that triggered this request, when one is in scope. Absent for requests issued outside any session (e.g. startup model-catalog or capability resolution). This is a payload field — not a dispatch key — because the client-global API is registered process-wide rather than per session.
+     */
+    sessionId?: string;
+    /**
+     * HTTP method, e.g. GET, POST.
+     */
+    method: string;
+    /**
+     * Absolute request URL.
+     */
+    url: string;
+    headers: LlmInferenceHeaders;
+    transport?: LlmInferenceHttpRequestStartTransport;
+}
+/**
+ * Acknowledgement. Returning successfully simply means the SDK accepted the start frame; it does not imply the request will succeed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpRequestStartResult".
+ */
+/** @experimental */
+export interface LlmInferenceHttpRequestStartResult {
+}
+/**
+ * Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpResponseChunkError".
+ */
+/** @experimental */
+export interface LlmInferenceHttpResponseChunkError {
+    /**
+     * Human-readable failure description.
+     */
+    message: string;
+    /**
+     * Optional machine-readable error code.
+     */
+    code?: string;
+}
+/**
+ * A response body chunk or terminal error.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpResponseChunkRequest".
+ */
+/** @experimental */
+export interface LlmInferenceHttpResponseChunkRequest {
+    /**
+     * Matches the requestId from the originating httpRequestStart frame.
+     */
+    requestId: string;
+    /**
+     * Body byte range. UTF-8 text when `binary` is absent or false; base64-encoded bytes when `binary` is true. May be empty (e.g. when the response body is empty: send a single chunk with empty data and end=true).
+     */
+    data: string;
+    /**
+     * When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.
+     */
+    binary?: boolean;
+    /**
+     * When true, this is the final body chunk for the response. The runtime treats the response body as complete after receiving an end-marked chunk.
+     */
+    end?: boolean;
+    error?: LlmInferenceHttpResponseChunkError;
+}
+/**
+ * Whether the chunk was accepted.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpResponseChunkResult".
+ */
+/** @experimental */
+export interface LlmInferenceHttpResponseChunkResult {
+    /**
+     * True when the chunk was matched to a pending request; false when unknown.
+     */
+    accepted: boolean;
+}
+/**
+ * Response head.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpResponseStartRequest".
+ */
+/** @experimental */
+export interface LlmInferenceHttpResponseStartRequest {
+    /**
+     * Matches the requestId from the originating httpRequestStart frame.
+     */
+    requestId: string;
+    /**
+     * HTTP status code.
      */
-    applyTo?: string[];
+    status: number;
     /**
-     * Short description (body after frontmatter) for use in instruction tables
+     * Optional HTTP status reason phrase.
      */
-    description?: string;
+    statusText?: string;
+    headers: LlmInferenceHeaders;
+}
+/**
+ * Whether the start frame was accepted.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceHttpResponseStartResult".
+ */
+/** @experimental */
+export interface LlmInferenceHttpResponseStartResult {
     /**
-     * When true, this source starts disabled and must be toggled on by the user
+     * True when the response start was matched to a pending request; false when unknown.
      */
-    defaultDisabled?: boolean;
+    accepted: boolean;
+}
+/**
+ * Indicates whether the calling client was registered as the LLM inference provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "LlmInferenceSetProviderResult".
+ */
+/** @experimental */
+export interface LlmInferenceSetProviderResult {
     /**
-     * The project path this source was discovered from. Only set by sessionless discovery for repository/working-directory sources, where it disambiguates same-named files (e.g. .github/copilot-instructions.md) across multiple workspace roots. The session-scoped getSources leaves it unset.
+     * Whether the provider was set successfully
      */
-    projectPath?: string;
+    success: boolean;
 }
 /**
  * Schema for the `LocalSessionMetadataValue` type.
@@ -4746,7 +5083,6 @@ export interface McpServerAuthConfigRedirectPort {
      * Fixed port for the OAuth redirect callback server.
      */
     redirectPort?: number;
-    [k: string]: unknown | undefined;
 }
 /**
  * Remote MCP server configuration accessed over HTTP or SSE.
@@ -4937,7 +5273,9 @@ export interface McpExecuteSamplingParams {
     /**
      * The original MCP JSON-RPC request ID (string or number). Used by the runtime to correlate the inference with the originating MCP request for telemetry; this is distinct from `requestId` (which is the schema-level cancellation handle).
      */
-    mcpRequestId: string | number;
+    mcpRequestId: {
+        [k: string]: unknown | undefined;
+    };
     request: McpExecuteSamplingRequest;
 }
 /**
@@ -5126,7 +5464,34 @@ export interface McpTools {
     description?: string;
 }
 /**
- * Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, and the callback success-page copy.
+ * Pending MCP OAuth request ID and host-provided token or cancellation response.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpOauthHandlePendingRequest".
+ */
+/** @experimental */
+export interface McpOauthHandlePendingRequest {
+    /**
+     * OAuth request identifier from the mcp.oauth_required event
+     */
+    requestId: string;
+    result: McpOauthPendingRequestResponse;
+}
+/**
+ * Indicates whether the pending MCP OAuth response was accepted.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpOauthHandlePendingResult".
+ */
+/** @experimental */
+export interface McpOauthHandlePendingResult {
+    /**
+     * Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
+     */
+    success: boolean;
+}
+/**
+ * Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "McpOauthLoginRequest".
@@ -5149,6 +5514,19 @@ export interface McpOauthLoginRequest {
      * Optional override for the body text shown on the OAuth loopback callback success page. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass surface-specific copy telling the user where to return.
      */
     callbackSuccessMessage?: string;
+    /**
+     * Optional OAuth client ID override for this login. When set, the runtime uses this pre-registered static client instead of dynamic client registration.
+     */
+    clientId?: string;
+    /**
+     * Optional OAuth client secret override for this login. The runtime treats this as an ephemeral host-owned secret, uses it for this authentication attempt and does not persist it.
+     */
+    clientSecret?: string;
+    /**
+     * Optional override indicating whether the static OAuth client is public. When false, the runtime treats it as confidential and uses the per-login clientSecret if provided, otherwise retrieving the client secret from the MCP OAuth secret store.
+     */
+    publicClient?: boolean;
+    grantType?: McpOauthLoginGrantType;
 }
 /**
  * OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.
@@ -5646,17 +6024,31 @@ export interface ModelBillingTokenPrices {
      */
     outputPrice?: number;
     /**
-     * AI Credits cost per billing batch of cached tokens
+     * @deprecated
+     * Use cacheReadPrice instead. AI Credits cost per billing batch of cached tokens
      */
     cachePrice?: number;
+    /**
+     * AI Credits cost per billing batch of cached (read) tokens
+     */
+    cacheReadPrice?: number;
+    /**
+     * AI Credits cost per billing batch of cache-write (cache creation) tokens.
+     */
+    cacheWritePrice?: number;
     /**
      * Number of tokens per standard billing batch
      */
     batchSize?: number;
     /**
-     * Prompt token budget (max_prompt_tokens) for the default tier. The total context window is this value plus the model's max_output_tokens.
+     * @deprecated
+     * Use maxPromptTokens instead. Prompt token budget for the default tier. The total context window is this value plus the model's max_output_tokens.
      */
     contextMax?: number;
+    /**
+     * Prompt token budget for the default tier. The total context window is this value plus the model's max_output_tokens.
+     */
+    maxPromptTokens?: number;
     longContext?: ModelBillingTokenPricesLongContext;
 }
 /**
@@ -5675,13 +6067,27 @@ export interface ModelBillingTokenPricesLongContext {
      */
     outputPrice?: number;
     /**
-     * AI Credits cost per billing batch of cached tokens
+     * @deprecated
+     * Use cacheReadPrice instead. AI Credits cost per billing batch of cached tokens
      */
     cachePrice?: number;
     /**
-     * Prompt token budget (max_prompt_tokens) for the long context tier. The total context window is this value plus the model's max_output_tokens.
+     * AI Credits cost per billing batch of cached (read) tokens
+     */
+    cacheReadPrice?: number;
+    /**
+     * AI Credits cost per billing batch of cache-write (cache creation) tokens.
+     */
+    cacheWritePrice?: number;
+    /**
+     * @deprecated
+     * Use maxPromptTokens instead. Prompt token budget for the long context tier. The total context window is this value plus the model's max_output_tokens.
      */
     contextMax?: number;
+    /**
+     * Prompt token budget for the long context tier. The total context window is this value plus the model's max_output_tokens.
+     */
+    maxPromptTokens?: number;
 }
 /**
  * Optional capability overrides (vision, tool_calls, reasoning, etc.).
@@ -5868,6 +6274,7 @@ export interface NamedProviderConfig {
     name: string;
     type?: ProviderConfigType;
     wireApi?: ProviderConfigWireApi;
+    transport?: ProviderConfigTransport;
     /**
      * API endpoint URL.
      */
@@ -5887,6 +6294,10 @@ export interface NamedProviderConfig {
     headers?: {
         [k: string]: string | undefined;
     };
+    /**
+     * When true, the SDK client supplies bearer tokens on demand: the runtime calls the client-session `providerToken.getToken` callback before each request and applies the returned token as an `Authorization: Bearer <token>` header. This is the bearer/OAuth scheme used by Azure AD / managed-identity tokens and provider OAuth access tokens (including Anthropic's), not a provider-specific API-key header such as Anthropic's `x-api-key`. The token-acquiring function itself stays on the SDK side and is never serialized; only this flag crosses the wire. When set alongside `apiKey`/`bearerToken`, the callback takes precedence: the runtime applies the token returned by `providerToken.getToken` as the `Authorization: Bearer` header for each request and does not send the static credential.
+     */
+    hasBearerTokenProvider?: boolean;
 }
 /**
  * Azure-specific provider options.
@@ -5962,9 +6373,8 @@ export interface NameSetRequest {
 /** @experimental */
 export interface OptionsUpdateAdditionalContentExclusionPolicy {
     rules: OptionsUpdateAdditionalContentExclusionPolicyRule[];
-    last_updated_at: string | number;
+    last_updated_at: unknown;
     scope: OptionsUpdateAdditionalContentExclusionPolicyScope;
-    [k: string]: unknown | undefined;
 }
 /**
  * Schema for the `OptionsUpdateAdditionalContentExclusionPolicyRule` type.
@@ -5978,7 +6388,6 @@ export interface OptionsUpdateAdditionalContentExclusionPolicyRule {
     ifAnyMatch?: string[];
     ifNoneMatch?: string[];
     source: OptionsUpdateAdditionalContentExclusionPolicyRuleSource;
-    [k: string]: unknown | undefined;
 }
 /**
  * Schema for the `OptionsUpdateAdditionalContentExclusionPolicyRuleSource` type.
@@ -6974,9 +7383,8 @@ export interface PermissionRulesSet {
 /** @experimental */
 export interface PermissionsConfigureAdditionalContentExclusionPolicy {
     rules: PermissionsConfigureAdditionalContentExclusionPolicyRule[];
-    last_updated_at: string | number;
+    last_updated_at: unknown;
     scope: PermissionsConfigureAdditionalContentExclusionPolicyScope;
-    [k: string]: unknown | undefined;
 }
 /**
  * Schema for the `PermissionsConfigureAdditionalContentExclusionPolicyRule` type.
@@ -6990,7 +7398,6 @@ export interface PermissionsConfigureAdditionalContentExclusionPolicyRule {
     ifAnyMatch?: string[];
     ifNoneMatch?: string[];
     source: PermissionsConfigureAdditionalContentExclusionPolicyRuleSource;
-    [k: string]: unknown | undefined;
 }
 /**
  * Schema for the `PermissionsConfigureAdditionalContentExclusionPolicyRuleSource` type.
@@ -7751,6 +8158,78 @@ export interface SessionsPollSpawnedSessionsEvent {
      */
     sessionId: string;
 }
+/**
+ * BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderAddRequest".
+ */
+/** @experimental */
+export interface ProviderAddRequest {
+    /**
+     * Named BYOK provider connections to register, additive to any providers already in the registry. Each name must be unique across the registry and must not contain '/'.
+     */
+    providers?: NamedProviderConfig[];
+    /**
+     * BYOK model definitions to register. Each must reference a provider that is already registered or included in this same call. Selection ids (`provider/id`) must be unique across the registry.
+     */
+    models?: ProviderModelConfig[];
+}
+/**
+ * A BYOK model definition referencing a named provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderModelConfig".
+ */
+/** @experimental */
+export interface ProviderModelConfig {
+    /**
+     * Provider-local model id, unique within its provider. The session-wide selection id (shown in the model list and passed to switchTo) is the provider-qualified `provider/id`.
+     */
+    id: string;
+    /**
+     * Name of the NamedProviderConfig that serves this model.
+     */
+    provider: string;
+    /**
+     * The model name sent to the provider API for inference. Defaults to `id`.
+     */
+    wireModel?: string;
+    /**
+     * Well-known base model id used for behavior/capability/config lookup. Defaults to `id`.
+     */
+    modelId?: string;
+    /**
+     * Display name for model pickers. Defaults to the provider-qualified selection id (`provider/id`).
+     */
+    name?: string;
+    /**
+     * Maximum prompt/input tokens for the model.
+     */
+    maxPromptTokens?: number;
+    /**
+     * Maximum context window tokens for the model.
+     */
+    maxContextWindowTokens?: number;
+    /**
+     * Maximum output tokens for the model.
+     */
+    maxOutputTokens?: number;
+    capabilities?: ModelCapabilitiesOverride;
+}
+/**
+ * The selectable model entries synthesized for the models added by this call.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderAddResult".
+ */
+/** @experimental */
+export interface ProviderAddResult {
+    /**
+     * Synthesized selectable model entries for the newly added BYOK models, each under its provider-qualified selection id (`provider/id`). Empty when only providers were added.
+     */
+    models: unknown[];
+}
 /**
  * Custom model-provider configuration (BYOK).
  *
@@ -7761,6 +8240,7 @@ export interface SessionsPollSpawnedSessionsEvent {
 export interface ProviderConfig {
     type?: ProviderConfigType;
     wireApi?: ProviderConfigWireApi;
+    transport?: ProviderConfigTransport;
     /**
      * API endpoint URL.
      */
@@ -7800,6 +8280,10 @@ export interface ProviderConfig {
     headers?: {
         [k: string]: string | undefined;
     };
+    /**
+     * When true, the SDK client supplies bearer tokens on demand: the runtime calls the client-session `providerToken.getToken` callback before each request and applies the returned token as an `Authorization: Bearer <token>` header. This is the bearer/OAuth scheme used by Azure AD / managed-identity tokens and provider OAuth access tokens (including Anthropic's), not a provider-specific API-key header such as Anthropic's `x-api-key`. The token-acquiring function itself stays on the SDK side and is never serialized; only this flag crosses the wire. When set alongside `apiKey`/`bearerToken`, the callback takes precedence: the runtime applies the token returned by `providerToken.getToken` as the `Authorization: Bearer` header for each request and does not send the static credential.
+     */
+    hasBearerTokenProvider?: boolean;
 }
 /**
  * A snapshot of the provider endpoint the session is currently configured to talk to.
@@ -7811,6 +8295,7 @@ export interface ProviderConfig {
 export interface ProviderEndpoint {
     type: ProviderEndpointType;
     wireApi?: ProviderEndpointWireApi;
+    transport?: ProviderEndpointTransport;
     /**
      * Base URL to pass to the LLM client library.
      */
@@ -7866,46 +8351,34 @@ export interface ProviderGetEndpointRequest {
     modelId?: string;
 }
 /**
- * A BYOK model definition referencing a named provider.
+ * Asks the SDK client to acquire a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Issued by the runtime before each outbound model request; the runtime does no caching, so this is sent once per request.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "ProviderModelConfig".
+ * via the `definition` "ProviderTokenAcquireRequest".
  */
 /** @experimental */
-export interface ProviderModelConfig {
-    /**
-     * Provider-local model id, unique within its provider. The session-wide selection id (shown in the model list and passed to switchTo) is the provider-qualified `provider/id`.
-     */
-    id: string;
-    /**
-     * Name of the NamedProviderConfig that serves this model.
-     */
-    provider: string;
-    /**
-     * The model name sent to the provider API for inference. Defaults to `id`.
-     */
-    wireModel?: string;
-    /**
-     * Well-known base model id used for behavior/capability/config lookup. Defaults to `id`.
-     */
-    modelId?: string;
-    /**
-     * Display name for model pickers. Defaults to the provider-qualified selection id (`provider/id`).
-     */
-    name?: string;
+export interface ProviderTokenAcquireRequest {
     /**
-     * Maximum prompt/input tokens for the model.
+     * Target session identifier
      */
-    maxPromptTokens?: number;
+    sessionId: string;
     /**
-     * Maximum context window tokens for the model.
+     * Name of the BYOK provider needing a token. For the legacy whole-session `provider` this is the implicit provider name; for named providers it is `NamedProviderConfig.name`.
      */
-    maxContextWindowTokens?: number;
+    providerName: string;
+}
+/**
+ * A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer <token>` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderTokenAcquireResult".
+ */
+/** @experimental */
+export interface ProviderTokenAcquireResult {
     /**
-     * Maximum output tokens for the model.
+     * The bearer token value (without the `Bearer ` prefix).
      */
-    maxOutputTokens?: number;
-    capabilities?: ModelCapabilitiesOverride;
+    token: string;
 }
 /**
  * File attachment
@@ -8520,12 +8993,6 @@ export interface SandboxConfig {
      */
     enabled: boolean;
     userPolicy?: SandboxConfigUserPolicy;
-    /**
-     * Raw `ContainerConfig` (per `@microsoft/mxc-sdk`) passed directly to `spawnSandboxFromConfig`, bypassing policy merging.
-     */
-    config?: {
-        [k: string]: unknown | undefined;
-    };
     /**
      * Whether to auto-add the current working directory to readwritePaths. Default: true.
      */
@@ -8541,6 +9008,7 @@ export interface SandboxConfig {
 export interface SandboxConfigUserPolicy {
     filesystem?: SandboxConfigUserPolicyFilesystem;
     network?: SandboxConfigUserPolicyNetwork;
+    seatbelt?: SandboxConfigUserPolicySeatbelt;
     experimental?: SandboxConfigUserPolicyExperimental;
 }
 /**
@@ -8593,6 +9061,19 @@ export interface SandboxConfigUserPolicyNetwork {
      */
     blockedHosts?: string[];
 }
+/**
+ * macOS seatbelt-specific options.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxConfigUserPolicySeatbelt".
+ */
+/** @experimental */
+export interface SandboxConfigUserPolicySeatbelt {
+    /**
+     * Whether the macOS seatbelt profile may access the keychain.
+     */
+    keychainAccess?: boolean;
+}
 /**
  * Platform-specific experimental policy fields.
  *
@@ -8652,6 +9133,10 @@ export interface ScheduleEntry {
      * Whether the schedule re-arms after each tick (`/every`) or fires once (`/after`).
      */
     recurring: boolean;
+    /**
+     * True for a self-paced (`dynamic`) schedule: no fixed cadence; the model arms each next run via the `manage_schedule` `wakeup` action. `nextRunAt` is model-controlled.
+     */
+    selfPaced?: boolean;
     /**
      * Display-only label for the prompt as shown in the UI (e.g. `/skill-name` for a skill-invocation schedule). The actual enqueued prompt is `prompt`.
      */
@@ -8862,6 +9347,10 @@ export interface ServerSkill {
      * The project path this skill belongs to (only for project/inherited skills)
      */
     projectPath?: string;
+    /**
+     * Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
+     */
+    argumentHint?: string;
 }
 /**
  * Skills discovered across global and project sources.
@@ -9273,7 +9762,7 @@ export interface SessionFsSqliteQueryRequest {
      * Optional named bind parameters
      */
     params?: {
-        [k: string]: (string | number | null) | undefined;
+        [k: string]: unknown | undefined;
     };
 }
 /**
@@ -9642,6 +10131,7 @@ export interface SessionOpenOptions {
     isExperimentalMode?: boolean;
     authInfo?: AuthInfo;
     provider?: ProviderConfig;
+    capi?: CapiSessionOptions;
     /**
      * Named BYOK provider connections, additive to CAPI auth. Combining with `provider` is rejected.
      *
@@ -9741,6 +10231,12 @@ export interface SessionOpenOptions {
      * Whether model responses stream as delta events.
      */
     enableStreaming?: boolean;
+    /**
+     * Experimental: enable native model citations (Anthropic models today), normalized onto the `assistant.message` event. Off by default; may change or be removed while the citations surface is experimental.
+     *
+     * @experimental
+     */
+    enableCitations?: boolean;
     /**
      * Override URL for the Copilot API endpoint.
      */
@@ -9799,9 +10295,8 @@ export interface SessionOpenOptions {
 /** @experimental */
 export interface SessionOpenOptionsAdditionalContentExclusionPolicy {
     rules: SessionOpenOptionsAdditionalContentExclusionPolicyRule[];
-    last_updated_at: string | number;
+    last_updated_at: unknown;
     scope: SessionOpenOptionsAdditionalContentExclusionPolicyScope;
-    [k: string]: unknown | undefined;
 }
 /**
  * Schema for the `SessionOpenOptionsAdditionalContentExclusionPolicyRule` type.
@@ -9815,7 +10310,6 @@ export interface SessionOpenOptionsAdditionalContentExclusionPolicyRule {
     ifAnyMatch?: string[];
     ifNoneMatch?: string[];
     source: SessionOpenOptionsAdditionalContentExclusionPolicyRuleSource;
-    [k: string]: unknown | undefined;
 }
 /**
  * Schema for the `SessionOpenOptionsAdditionalContentExclusionPolicyRuleSource` type.
@@ -10609,6 +11103,7 @@ export interface SessionUpdateOptionsParams {
      */
     isExperimentalMode?: boolean;
     provider?: ProviderConfig;
+    capi?: CapiSessionOptions;
     /**
      * Absolute working-directory path for shell tools.
      */
@@ -10907,6 +11402,10 @@ export interface Skill {
      * Name of the plugin that provides the skill, when source is 'plugin'
      */
     pluginName?: string;
+    /**
+     * Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
+     */
+    argumentHint?: string;
 }
 /**
  * Schema for the `SkillDiscoveryPath` type.
@@ -12835,6 +13334,34 @@ export declare function createServerRpc(connection: MessageConnection): {
          * @returns Quota usage snapshots for the resolved user, keyed by quota type.
          */
         getQuota: (params: AccountGetQuotaRequest) => Promise<AccountGetQuotaResult>;
+        /**
+         * Gets the currently active authentication credentials from the global auth manager.
+         *
+         * @returns Current authentication state
+         */
+        getCurrentAuth: () => Promise<AccountGetCurrentAuthResult>;
+        /**
+         * Gets all authenticated users available for account switching.
+         *
+         * @returns List of all authenticated users
+         */
+        getAllUsers: () => Promise<AccountGetAllUsersResult>;
+        /**
+         * Stores authentication credentials after successful login (e.g., device code flow).
+         *
+         * @param params Credentials to store after successful authentication
+         *
+         * @returns Result of a successful login; throws on failure
+         */
+        login: (params: AccountLoginRequest) => Promise<AccountLoginResult>;
+        /**
+         * Removes user authentication from keychain and persisted state.
+         *
+         * @param params User to log out
+         *
+         * @returns Logout result indicating if more users remain
+         */
+        logout: (params: AccountLogoutRequest) => Promise<AccountLogoutResult>;
     };
     secrets: {
         /**
@@ -13079,6 +13606,31 @@ export declare function createServerRpc(connection: MessageConnection): {
         setProvider: (params: SessionFsSetProviderRequest) => Promise<SessionFsSetProviderResult>;
     };
     /** @experimental */
+    llmInference: {
+        /**
+         * Registers an SDK client as the LLM inference callback provider.
+         *
+         * @returns Indicates whether the calling client was registered as the LLM inference provider.
+         */
+        setProvider: () => Promise<LlmInferenceSetProviderResult>;
+        /**
+         * Delivers the response head (status + headers) for an in-flight request, correlated by the requestId the runtime supplied in httpRequestStart. Must be called exactly once per request before any httpResponseChunk frames.
+         *
+         * @param params Response head.
+         *
+         * @returns Whether the start frame was accepted.
+         */
+        httpResponseStart: (params: LlmInferenceHttpResponseStartRequest) => Promise<LlmInferenceHttpResponseStartResult>;
+        /**
+         * Delivers a body byte range (or a terminal transport error) for an in-flight response, correlated by requestId. Set `end` true on the last chunk. When `error` is set the response terminates with a transport-level failure and the runtime raises an APIConnectionError.
+         *
+         * @param params A response body chunk or terminal error.
+         *
+         * @returns Whether the chunk was accepted.
+         */
+        httpResponseChunk: (params: LlmInferenceHttpResponseChunkRequest) => Promise<LlmInferenceHttpResponseChunkResult>;
+    };
+    /** @experimental */
     sessions: {
         /**
          * Creates or resumes a local session and returns the opened session ID.
@@ -13776,10 +14328,18 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
         isServerRunning: (params: McpIsServerRunningRequest) => Promise<McpIsServerRunningResult>;
         /** @experimental */
         oauth: {
+            /**
+             * Resolves a pending MCP OAuth request with a host-provided token or cancellation. The pending request is emitted as mcp.oauth_required with the data necessary to authorize the request.
+             *
+             * @param params Pending MCP OAuth request ID and host-provided token or cancellation response.
+             *
+             * @returns Indicates whether the pending MCP OAuth response was accepted.
+             */
+            handlePendingRequest: (params: McpOauthHandlePendingRequest) => Promise<McpOauthHandlePendingResult>;
             /**
              * Starts OAuth authentication for a remote MCP server.
              *
-             * @param params Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, and the callback success-page copy.
+             * @param params Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.
              *
              * @returns OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.
              */
@@ -13858,6 +14418,14 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns A snapshot of the provider endpoint the session is currently configured to talk to.
          */
         getEndpoint: (params?: ProviderGetEndpointRequest) => Promise<ProviderEndpoint>;
+        /**
+         * Adds BYOK providers and/or models to the session's registry at runtime, extending the additive registry built from the session's `providers`/`models` options. Both fields are optional, so a call may add providers only, models only, or both. Within a single call providers are registered before models, so a model may reference a provider added in the same call; across calls a model may reference any provider already registered (from session creation or a prior add). A model whose referenced provider is not registered by the end of the call is rejected. Newly added models become selectable via `model.list` / `model.switchTo` and are inherited by sub-agents spawned afterwards.
+         *
+         * @param params BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.
+         *
+         * @returns The selectable model entries synthesized for the models added by this call.
+         */
+        add: (params: ProviderAddRequest) => Promise<ProviderAddResult>;
     };
     /** @experimental */
     options: {
@@ -14492,6 +15060,18 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
         stop: (params: ScheduleStopRequest) => Promise<ScheduleStopResult>;
     };
 };
+/** Handler for `providerToken` client session API methods. */
+/** @experimental */
+export interface ProviderTokenHandler {
+    /**
+     * Asks the SDK client to get a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Session-scoped: the runtime calls it back on the connection that most recently supplied that provider's config for the session (the creating connection, or a resuming connection if the session was resumed — distinct providers may be owned by different connections), passing the provider name, and uses the returned token as the Authorization header for the outbound model request. The runtime does no caching — it calls this once per outbound request; the SDK consumer owns token acquisition, caching, and refresh.
+     *
+     * @param params Asks the SDK client to acquire a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Issued by the runtime before each outbound model request; the runtime does no caching, so this is sent once per request.
+     *
+     * @returns A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer <token>` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.
+     */
+    getToken(params: ProviderTokenAcquireRequest): Promise<ProviderTokenAcquireResult>;
+}
 /** Handler for `sessionFs` client session API methods. */
 /** @experimental */
 export interface SessionFsHandler {
@@ -14620,6 +15200,7 @@ export interface CanvasHandler {
 }
 /** All client session API handler groups. */
 export interface ClientSessionApiHandlers {
+    providerToken?: ProviderTokenHandler;
     sessionFs?: SessionFsHandler;
     canvas?: CanvasHandler;
 }
@@ -14630,3 +15211,35 @@ export interface ClientSessionApiHandlers {
  * function uses `getHandlers` to resolve the session's handlers.
  */
 export declare function registerClientSessionApiHandlers(connection: MessageConnection, getHandlers: (sessionId: string) => ClientSessionApiHandlers): void;
+/** Handler for `llmInference` client global API methods. */
+/** @experimental */
+export interface LlmInferenceHandler {
+    /**
+     * Announces an outbound model-layer HTTP request the runtime wants the SDK client to service. Carries the request head only; the body always follows as one or more httpRequestChunk frames keyed by the same requestId, even when the body is empty (a single chunk with end=true).
+     *
+     * @param params The head of an outbound model-layer HTTP request.
+     *
+     * @returns Acknowledgement. Returning successfully simply means the SDK accepted the start frame; it does not imply the request will succeed.
+     */
+    httpRequestStart(params: LlmInferenceHttpRequestStartRequest): Promise<LlmInferenceHttpRequestStartResult>;
+    /**
+     * Delivers a body byte range (or a cancellation signal) for a request previously announced via httpRequestStart, correlated by requestId. The runtime fires at least one chunk per request — when there is no body, a single chunk with empty data and end=true. Mid-stream the runtime may send a chunk with cancel=true to abort the request; the SDK then stops issuing httpResponseChunk frames and may emit a terminal httpResponseChunk with error set.
+     *
+     * @param params A request body chunk or cancellation signal.
+     *
+     * @returns Acknowledgement. The SDK is free to ignore the ack and treat chunk delivery as fire-and-forget.
+     */
+    httpRequestChunk(params: LlmInferenceHttpRequestChunkRequest): Promise<LlmInferenceHttpRequestChunkResult>;
+}
+/** All client global API handler groups. */
+export interface ClientGlobalApiHandlers {
+    llmInference?: LlmInferenceHandler;
+}
+/**
+ * Register client global API handlers on a JSON-RPC connection.
+ * The server calls these methods to delegate work to the client.
+ * Unlike session-scoped client APIs, these methods carry no implicit
+ * `sessionId` dispatch key — a single set of handlers serves the entire
+ * connection.
+ */
+export declare function registerClientGlobalApiHandlers(connection: MessageConnection, handlers: ClientGlobalApiHandlers): void;