@github/copilot-sdk 1.0.20-preview.0 → 1.0.20-preview.2

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.96-0";
+const COPILOT_CLI_VERSION = "1.0.96-2";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/generated/rpc.js

@@ -1079,6 +1079,42 @@ function createInternalServerRpc(connection) {
      */
     connect: async (params) => connection.sendRequest("connect", params),
     /** @experimental */
+    mcp: {
+      /** @experimental */
+      registry: {
+        /**
+         * Allocates an ID for one cancellable MCP registry search. The ID exists before the search starts, so callers can cancel before it starts. The networking stack supplies the cancellation namespace. The runtime retains at most 1,024 unused IDs. At capacity, another allocation can reclaim an unused ID. Active searches retain their IDs until they finish.
+         *
+         * @returns Request id naming a cancellable registry search.
+         */
+        allocateRequestId: async () => connection.sendRequest("mcp.registry.allocateRequestId", {}),
+        /**
+         * Searches the MCP registry the supplied credential may read, resolving the registry endpoint from policy first. Hosts usually send credential-free `AuthIdentity`; a `token` identity can be resolved only when it embeds a token, while `env` and `gh-cli` identities can use a token embedded in the request first. The runtime follows registry pages, keeps the newest entry per server name, cuts the list to `limit`, and sorts an empty-query result by GitHub stars. Each server object is carried opaquely.
+         *
+         * @param params Registry search terms, the credential to search under, and the request id that makes the search cancellable.
+         *
+         * @returns Servers selected from the registry response.
+         */
+        search: async (params) => connection.sendRequest("mcp.registry.search", params),
+        /**
+         * Abandons the registry search that uses the given request ID. It acts only on IDs from `mcp.registry.allocateRequestId`, so it never cancels another component's request. Answers `canceled: true` when it stops a running search. Answers `canceled: false` for unknown or reclaimed IDs, completed or canceled searches, and unused reservations. It releases an unused reservation, so a later search with that ID is refused.
+         *
+         * @param params Registry search to abandon.
+         *
+         * @returns Whether the cancel reached a live search.
+         */
+        cancel: async (params) => connection.sendRequest("mcp.registry.cancel", params)
+      },
+      /**
+       * Reports whether the gh-replaceable GitHub MCP tools may be clipped for a session, which a host feeds back as the `excludeGhReplaceableTools` build option. The tools are redundant only when the session can reach a shell *and* the host has the `gh` that would replace them, so both halves are decided here. The shell half runs the platform shell tool through the runtime's own tool-filter matcher, so entry forms like `builtin:bash` and `builtin:*` behave exactly as they do when a session builds its tool catalog. The host half probes for `gh`, and is skipped entirely when the filters already rule the shell out. Host presence alone is not enough: a session restricted to, say, `view` would otherwise lose the built-in issue-read fallback while having no shell to replace it with. The answer describes the host the runtime runs on, so it is never forwarded to a remote engine.
+       *
+       * @param params The session tool filters that decide whether the session still has a shell to run `gh` with.
+       *
+       * @returns Whether the gh-replaceable GitHub MCP tools may be clipped for the session described by the request.
+       */
+      shouldExcludeGitHubTools: async (params) => connection.sendRequest("mcp.shouldExcludeGitHubTools", params)
+    },
+    /** @experimental */
     agents: {
       /**
        * Lists the agents this runtime ships, by name. A consumer separating shipped agents from ones the user or a plugin authored should compare against these names rather than against `AgentInfo.source`: an authored agent may carry the `builtin` source while not being one of these, and the runtime treats the two as separate questions. `disableableNames` is the subset a user may turn off, which a client needs to decide whether to offer a toggle. `yamlBasedNames` is the subset backed by a shipped YAML definition, which a client needs before asking the runtime to load one.
@@ -1136,7 +1172,7 @@ function createInternalServerRpc(connection) {
        */
       loadForConfigDir: async (params) => connection.sendRequest("globalState.loadForConfigDir", params),
       /**
-       * Records one top-level key in the host's machine-wide state, the counterpart to `globalState.load`. A host calls this to remember that it has shown an onboarding step, asked a one-off question, or completed a migration, so the next run can skip it. Only the named key is replaced and the rest of the document is preserved, which lets two writers record different flags without overwriting each other; passing no value removes the key instead. Only the keys a host records itself are writable: `appInstallNudgeResponded`, `appTipShown`, `askedSetupTerminals`, `autoFeedbackLastPromptedAt`, `firstLaunchAt`, `recentModelIds`, `sandboxCredentialProxyCaDeclined` and `sandboxOnboardingShown`. Every other key is refused, including `installedPlugins`, the stored credentials, `trustedFolders`, the staff flags and the signed-in accounts. Plugin enablement must use the plugin APIs, which apply repository and managed-policy checks.
+       * Records one top-level key in the host's machine-wide state, the counterpart to `globalState.load`. A host calls this to remember that it has shown an onboarding step, asked a one-off question, or completed a migration, so the next run can skip it. Only the named key is replaced and the rest of the document is preserved, which lets two writers record different flags without overwriting each other; passing no value removes the key instead. Only the keys a host records itself are writable: `appTipShown`, `askedSetupTerminals`, `autoFeedbackLastPromptedAt`, `firstLaunchAt`, `recentModelIds`, `sandboxCredentialProxyCaDeclined` and `sandboxOnboardingShown`. Every other key is refused, including `installedPlugins`, the stored credentials, `trustedFolders`, the staff flags and the signed-in accounts. Plugin enablement must use the plugin APIs, which apply repository and managed-policy checks.
        *
        * @param params A single top-level key to record in the host's machine-wide state. The write replaces only that key and leaves the rest of the document untouched, so two writers recording different one-off flags do not overwrite each other. The stored credential keys cannot be written through this method.
        */
@@ -1366,6 +1402,12 @@ function createSessionRpc(connection, sessionId) {
        * @returns Managed sandbox enforcement state for a session.
        */
       getEnforcementStatus: async () => connection.sendRequest("session.sandbox.getEnforcementStatus", { sessionId }),
+      /**
+       * Lists possible secret-bearing environment variables available to new sandboxed shells that are not already covered by credential masking. Uses local name rules and known-provider host suggestions, never returns secret values, and changes no settings or network permissions. Returns no suggestions while the session is not sandboxed.
+       *
+       * @returns Possible unconfigured secrets in the sandbox shell environment, sorted by variable name, with no secret values.
+       */
+      getCredentialSuggestions: async () => connection.sendRequest("session.sandbox.getCredentialSuggestions", { sessionId }),
       /**
        * Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.
        *

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.96-0";
+export declare const COPILOT_CLI_VERSION = "1.0.96-2";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.96-0";
+const COPILOT_CLI_VERSION = "1.0.96-2";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/generated/rpc.d.ts

@@ -3427,6 +3427,18 @@ export type McpSetEnvValueModeDetails =
 "direct"
 /** Treat MCP server environment values as host-side references to resolve before launch. */
  | "indirect";
+/**
+ * Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "OptionsUpdateToolFilterPrecedence".
+ */
+/** @experimental */
+export type OptionsUpdateToolFilterPrecedence = 
+/** If availableTools is set, it is the only constraint that applies (excludedTools is ignored). Preserves CLI / pre-existing client behavior. Default. */
+"available"
+/** A tool is enabled if and only if it matches the allowlist (or the allowlist is unset) AND it does not match the denylist. Makes 'all except X' expressible by combining the two lists. */
+ | "excluded";
 /**
  * Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).
  *
@@ -3924,18 +3936,6 @@ export type OptionsUpdateReasoningSummary =
  | "concise"
 /** Request a detailed summary of model reasoning. */
  | "detailed";
-/**
- * Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "OptionsUpdateToolFilterPrecedence".
- */
-/** @experimental */
-export type OptionsUpdateToolFilterPrecedence = 
-/** If availableTools is set, it is the only constraint that applies (excludedTools is ignored). Preserves CLI / pre-existing client behavior. Default. */
-"available"
-/** A tool is enabled if and only if it matches the allowlist (or the allowlist is unset) AND it does not match the denylist. Makes 'all except X' expressible by combining the two lists. */
- | "excluded";
 /**
  * The client's response to the pending permission prompt
  *
@@ -21919,6 +21919,36 @@ export interface SandboxMaskedEnvVar {
      */
     injectHosts: string[];
 }
+/**
+ * A possible secret-bearing environment variable and optional locally suggested HTTPS injection hosts. This is a draft for user review, not an active grant.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxCredentialSuggestion".
+ */
+/** @experimental */
+export interface SandboxCredentialSuggestion {
+    /**
+     * Environment variable name. The secret value is never returned.
+     */
+    name: string;
+    /**
+     * HTTPS hostnames suggested by a local known-provider mapping. An empty list requires the user to supply injection hosts before adding a masking entry. These suggestions do not allow network access.
+     */
+    suggestedInjectHosts: string[];
+}
+/**
+ * Possible unconfigured secrets in the sandbox shell environment, sorted by variable name, with no secret values.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxCredentialSuggestionsResult".
+ */
+/** @experimental */
+export interface SandboxCredentialSuggestionsResult {
+    /**
+     * Candidates for user review. Empty when sandboxing is disabled or no unconfigured candidates are present.
+     */
+    suggestions: SandboxCredentialSuggestion[];
+}
 /**
  * Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.
  *
@@ -31682,6 +31712,12 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Managed sandbox enforcement state for a session.
          */
         getEnforcementStatus: () => Promise<SandboxEnforcementStatus>;
+        /**
+         * Lists possible secret-bearing environment variables available to new sandboxed shells that are not already covered by credential masking. Uses local name rules and known-provider host suggestions, never returns secret values, and changes no settings or network permissions. Returns no suggestions while the session is not sandboxed.
+         *
+         * @returns Possible unconfigured secrets in the sandbox shell environment, sorted by variable name, with no secret values.
+         */
+        getCredentialSuggestions: () => Promise<SandboxCredentialSuggestionsResult>;
         /**
          * Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.
          *

package/dist/generated/rpc.js

@@ -1051,6 +1051,42 @@ function createInternalServerRpc(connection) {
      */
     connect: async (params) => connection.sendRequest("connect", params),
     /** @experimental */
+    mcp: {
+      /** @experimental */
+      registry: {
+        /**
+         * Allocates an ID for one cancellable MCP registry search. The ID exists before the search starts, so callers can cancel before it starts. The networking stack supplies the cancellation namespace. The runtime retains at most 1,024 unused IDs. At capacity, another allocation can reclaim an unused ID. Active searches retain their IDs until they finish.
+         *
+         * @returns Request id naming a cancellable registry search.
+         */
+        allocateRequestId: async () => connection.sendRequest("mcp.registry.allocateRequestId", {}),
+        /**
+         * Searches the MCP registry the supplied credential may read, resolving the registry endpoint from policy first. Hosts usually send credential-free `AuthIdentity`; a `token` identity can be resolved only when it embeds a token, while `env` and `gh-cli` identities can use a token embedded in the request first. The runtime follows registry pages, keeps the newest entry per server name, cuts the list to `limit`, and sorts an empty-query result by GitHub stars. Each server object is carried opaquely.
+         *
+         * @param params Registry search terms, the credential to search under, and the request id that makes the search cancellable.
+         *
+         * @returns Servers selected from the registry response.
+         */
+        search: async (params) => connection.sendRequest("mcp.registry.search", params),
+        /**
+         * Abandons the registry search that uses the given request ID. It acts only on IDs from `mcp.registry.allocateRequestId`, so it never cancels another component's request. Answers `canceled: true` when it stops a running search. Answers `canceled: false` for unknown or reclaimed IDs, completed or canceled searches, and unused reservations. It releases an unused reservation, so a later search with that ID is refused.
+         *
+         * @param params Registry search to abandon.
+         *
+         * @returns Whether the cancel reached a live search.
+         */
+        cancel: async (params) => connection.sendRequest("mcp.registry.cancel", params)
+      },
+      /**
+       * Reports whether the gh-replaceable GitHub MCP tools may be clipped for a session, which a host feeds back as the `excludeGhReplaceableTools` build option. The tools are redundant only when the session can reach a shell *and* the host has the `gh` that would replace them, so both halves are decided here. The shell half runs the platform shell tool through the runtime's own tool-filter matcher, so entry forms like `builtin:bash` and `builtin:*` behave exactly as they do when a session builds its tool catalog. The host half probes for `gh`, and is skipped entirely when the filters already rule the shell out. Host presence alone is not enough: a session restricted to, say, `view` would otherwise lose the built-in issue-read fallback while having no shell to replace it with. The answer describes the host the runtime runs on, so it is never forwarded to a remote engine.
+       *
+       * @param params The session tool filters that decide whether the session still has a shell to run `gh` with.
+       *
+       * @returns Whether the gh-replaceable GitHub MCP tools may be clipped for the session described by the request.
+       */
+      shouldExcludeGitHubTools: async (params) => connection.sendRequest("mcp.shouldExcludeGitHubTools", params)
+    },
+    /** @experimental */
     agents: {
       /**
        * Lists the agents this runtime ships, by name. A consumer separating shipped agents from ones the user or a plugin authored should compare against these names rather than against `AgentInfo.source`: an authored agent may carry the `builtin` source while not being one of these, and the runtime treats the two as separate questions. `disableableNames` is the subset a user may turn off, which a client needs to decide whether to offer a toggle. `yamlBasedNames` is the subset backed by a shipped YAML definition, which a client needs before asking the runtime to load one.
@@ -1108,7 +1144,7 @@ function createInternalServerRpc(connection) {
        */
       loadForConfigDir: async (params) => connection.sendRequest("globalState.loadForConfigDir", params),
       /**
-       * Records one top-level key in the host's machine-wide state, the counterpart to `globalState.load`. A host calls this to remember that it has shown an onboarding step, asked a one-off question, or completed a migration, so the next run can skip it. Only the named key is replaced and the rest of the document is preserved, which lets two writers record different flags without overwriting each other; passing no value removes the key instead. Only the keys a host records itself are writable: `appInstallNudgeResponded`, `appTipShown`, `askedSetupTerminals`, `autoFeedbackLastPromptedAt`, `firstLaunchAt`, `recentModelIds`, `sandboxCredentialProxyCaDeclined` and `sandboxOnboardingShown`. Every other key is refused, including `installedPlugins`, the stored credentials, `trustedFolders`, the staff flags and the signed-in accounts. Plugin enablement must use the plugin APIs, which apply repository and managed-policy checks.
+       * Records one top-level key in the host's machine-wide state, the counterpart to `globalState.load`. A host calls this to remember that it has shown an onboarding step, asked a one-off question, or completed a migration, so the next run can skip it. Only the named key is replaced and the rest of the document is preserved, which lets two writers record different flags without overwriting each other; passing no value removes the key instead. Only the keys a host records itself are writable: `appTipShown`, `askedSetupTerminals`, `autoFeedbackLastPromptedAt`, `firstLaunchAt`, `recentModelIds`, `sandboxCredentialProxyCaDeclined` and `sandboxOnboardingShown`. Every other key is refused, including `installedPlugins`, the stored credentials, `trustedFolders`, the staff flags and the signed-in accounts. Plugin enablement must use the plugin APIs, which apply repository and managed-policy checks.
        *
        * @param params A single top-level key to record in the host's machine-wide state. The write replaces only that key and leaves the rest of the document untouched, so two writers recording different one-off flags do not overwrite each other. The stored credential keys cannot be written through this method.
        */
@@ -1338,6 +1374,12 @@ function createSessionRpc(connection, sessionId) {
        * @returns Managed sandbox enforcement state for a session.
        */
       getEnforcementStatus: async () => connection.sendRequest("session.sandbox.getEnforcementStatus", { sessionId }),
+      /**
+       * Lists possible secret-bearing environment variables available to new sandboxed shells that are not already covered by credential masking. Uses local name rules and known-provider host suggestions, never returns secret values, and changes no settings or network permissions. Returns no suggestions while the session is not sandboxed.
+       *
+       * @returns Possible unconfigured secrets in the sandbox shell environment, sorted by variable name, with no secret values.
+       */
+      getCredentialSuggestions: async () => connection.sendRequest("session.sandbox.getCredentialSuggestions", { sessionId }),
       /**
        * Disables sandboxing for the remainder of the current session and approves the referenced pending sandbox-bypass permission request. The request is rejected unless the exact request is still pending and the effective sandbox policy permits bypass.
        *

package/dist/generated/session-events.d.ts

@@ -12406,7 +12406,7 @@ export interface ManagedSettingsResolvedEvent {
 /** @experimental */
 export interface ManagedSettingsResolvedData {
     /**
-     * Whether enterprise policy disables bypass-permissions ("yolo") mode for this session. Deny-wins across layers, and forced on when `failClosed` is true.
+     * Whether an explicit enterprise policy restriction disables bypass-permissions ("yolo") mode for this session. Deny-wins across layers; an unresolved policy does not force this on by itself.
      */
     bypassPermissionsDisabled: boolean;
     /**
@@ -12418,7 +12418,7 @@ export interface ManagedSettingsResolvedData {
      */
     deviceManaged: boolean;
     /**
-     * Whether managed policy could not be determined (e.g. a failed server fetch) and the session fell back to the fail-closed restriction. When true, restrictions such as disabling bypass-permissions are enforced even though `settings` may be absent.
+     * Whether managed policy could not be determined (e.g. a failed server fetch) and unresolved-policy safeguards remain active. This does not by itself disable bypass-permissions; `bypassPermissionsDisabled` reports only an explicit policy restriction.
      */
     failClosed: boolean;
     /**

package/package.json

@@ -5,8 +5,8 @@
         "url": "https://github.com/github/copilot-agent-runtime.git",
         "directory": "src/sdk/nodejs"
     },
-    "version": "1.0.20-preview.0",
-    "copilotCliVersion": "1.0.96-0",
+    "version": "1.0.20-preview.2",
+    "copilotCliVersion": "1.0.96-2",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
@@ -104,18 +104,18 @@
         "README.md"
     ],
     "copilotRuntime": {
-        "sourceSha": "2d97cdf84e4eed006767c83f2e6dc61b07754b35",
-        "version": "1.0.96-0",
+        "sourceSha": "8227e3a7b5f74c8dde298fcc69dcb27a9a044a93",
+        "version": "1.0.96-2",
         "visibility": "public"
     },
     "optionalDependencies": {
-        "@github/copilot-sdk-darwin-arm64": "1.0.20-preview.0",
-        "@github/copilot-sdk-darwin-x64": "1.0.20-preview.0",
-        "@github/copilot-sdk-linux-arm64": "1.0.20-preview.0",
-        "@github/copilot-sdk-linux-x64": "1.0.20-preview.0",
-        "@github/copilot-sdk-linuxmusl-arm64": "1.0.20-preview.0",
-        "@github/copilot-sdk-linuxmusl-x64": "1.0.20-preview.0",
-        "@github/copilot-sdk-win32-arm64": "1.0.20-preview.0",
-        "@github/copilot-sdk-win32-x64": "1.0.20-preview.0"
+        "@github/copilot-sdk-darwin-arm64": "1.0.20-preview.2",
+        "@github/copilot-sdk-darwin-x64": "1.0.20-preview.2",
+        "@github/copilot-sdk-linux-arm64": "1.0.20-preview.2",
+        "@github/copilot-sdk-linux-x64": "1.0.20-preview.2",
+        "@github/copilot-sdk-linuxmusl-arm64": "1.0.20-preview.2",
+        "@github/copilot-sdk-linuxmusl-x64": "1.0.20-preview.2",
+        "@github/copilot-sdk-win32-arm64": "1.0.20-preview.2",
+        "@github/copilot-sdk-win32-x64": "1.0.20-preview.2"
     }
 }