@github/copilot-sdk 1.0.22 → 1.0.23-preview.1

package/README.md

@@ -128,11 +128,13 @@ await using host = await client.startAhpHost({
             ...config,
             onPermissionRequest: approveAll,
             systemMessage: { mode: "append", content: "Use the app's greeting tool." },
-            tools: [defineTool("greeting", {
-                description: "Get the application's greeting",
-                parameters: { type: "object", properties: {} },
-                handler: () => "Hello from the application!",
-            })],
+            tools: [
+                defineTool("greeting", {
+                    description: "Get the application's greeting",
+                    parameters: { type: "object", properties: {} },
+                    handler: () => "Hello from the application!",
+                }),
+            ],
         });
     },
     onSessionReleased: async (originalSession) => {
@@ -272,6 +274,18 @@ new CopilotClient(options?: CopilotClientOptions)
 - `installationConfirmationHandler?: InstallationConfirmationHandler` - Experimental connection-global human review for `installations.confirm`. Receives the typed request and independent request/connection cancellation signals, and returns an explicit decision. Does not enable installation capabilities.
 - `logLevel?: "none" | "error" | "warning" | "info" | "debug" | "all"` - Log level. When omitted, the runtime uses its own default (currently `"info"`).
 - `env?: Record<string, string | undefined>` - Environment variables for the runtime process. When omitted, inherits `process.env`.
+
+    For the native standalone runtime, set `COPILOT_GITHUB_TELEMETRY_DISABLED=true`
+    before startup to disable direct GitHub telemetry uploads for the entire host,
+    including session and sessionless events. Authentication, SDK
+    `onGitHubTelemetry` forwarding, and user-configured OpenTelemetry export remain
+    unchanged. The value must be exactly `"true"` and is read at startup; changing
+    it requires a runtime restart. With `RuntimeConnection.forInProcess()`, set it
+    in the host process environment; per-client `env` is rejected for that
+    transport. This is separate from `enableSessionTelemetry: false`, which
+    disables only a session's telemetry pipeline. The Node CLI host does not use
+    this environment variable.
+
 - `gitHubToken?: string` - GitHub token for authentication. When provided, takes priority over other auth methods.
 - `useLoggedInUser?: boolean` - Whether to use logged-in user for authentication (default: true, but false when `gitHubToken` is provided). Cannot be used with `RuntimeConnection.forUri`.
 - `onListModels?: () => Promise<ModelInfo[]> | ModelInfo[]` - Optional model-list provider, useful when using a custom provider.
@@ -1341,6 +1355,8 @@ Inbound trace context from the CLI is available on the `ToolInvocation` object p
 
 An `onPermissionRequest` handler is optional when you create or resume a session. When provided, it is called before the agent executes each tool (file writes, shell commands, custom tools, etc.) and returns a decision. When omitted, permission requests are emitted as events and left pending for the consumer to resolve with the pending permission RPC.
 
+Callbacks receive optional derived prompt context as `invocation.promptRequest`. The raw request's `managedApprovalRequired` remains managed-policy provenance and enforces one-shot restrictions. Only derived `commands`, `read`, `write`, `url`, and `workflow` prompts can clear the human requirement after Assisted approval; for missing or other prompt kinds, keep the raw marker authoritative.
+
 ### Approve All (simplest)
 
 Use the built-in `approveAll` helper when managed settings are disabled:
@@ -1620,7 +1636,7 @@ const session = await client.createSession({
 - `onPreToolUse` - Intercept tool calls before execution. Can allow/deny or modify arguments.
 - `onPostToolUse` - Process tool results after **successful** execution. Can modify results or add context.
 - `onPostToolUseFailure` - Observe and append hidden guidance to the model after tool executions whose result was `"failure"`. Register this in addition to `onPostToolUse` to see failed tool calls.
-- `onUserPromptSubmitted` - Intercept user prompts. Can modify the prompt before processing.
+- `onUserPromptSubmitted` - Intercept user prompts. Can modify the prompt before processing, or return `{ decision: "block", reason }` to refuse it: no model turn runs, no user message is recorded, and the session emits an ephemeral `session.warning` (`warningType: "policy_blocked"`) carrying the reason.
 - `onSessionStart` - Run logic when a session starts or resumes.
 - `onSessionEnd` - Cleanup or logging when session ends.
 - `onErrorOccurred` - Handle errors with retry/skip/abort strategies.

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.98";
+const COPILOT_CLI_VERSION = "1.0.99-1";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/client.js

@@ -1775,7 +1775,8 @@ class CopilotClient {
           await rpc.host.dispose({ hostId });
         },
         (sessionId) => rpc.host.publishSession({ hostId, sessionId }),
-        () => rpc.host.listSessions({ hostId })
+        () => rpc.host.listSessions({ hostId }),
+        (sessionId) => rpc.host.unpublishSession({ hostId, sessionId })
       );
     } catch (error) {
       this.hostExitCallbacks.delete(hostId);

package/dist/cjs/copilotRequestHandler.js

@@ -98,7 +98,7 @@ class CopilotWebSocketForwarder extends CopilotWebSocketHandler {
   constructor(context) {
     super(context);
   }
-  sendRequestMessage(data) {
+  sendRequestMessage(data, _ctx) {
     if (this.#upstream?.readyState !== WebSocket.OPEN) {
       return;
     }
@@ -182,6 +182,7 @@ class CopilotRequestHandler {
       requestId: exchange.requestId,
       sessionId: exchange.sessionId,
       agentId: exchange.agentId,
+      agentInvocationId: exchange.agentInvocationId,
       parentAgentId: exchange.parentAgentId,
       interactionType: exchange.interactionType,
       transport: exchange.transport,
@@ -209,7 +210,10 @@ class CopilotRequestHandler {
       let cancelled;
       const clientSettled = (async () => {
         for await (const chunk of exchange.requestBody) {
-          await handler.sendRequestMessage(decodeFrame(chunk));
+          await handler.sendRequestMessage(decodeFrame(chunk.chunk ?? new Uint8Array()), {
+            ...ctx,
+            agentInvocationId: chunk.agentInvocationId
+          });
         }
         return "client-complete";
       })().catch((err) => {
@@ -309,7 +313,7 @@ function routeChunk(exchange, params) {
     return;
   }
   if (params.data && params.data.length > 0) {
-    exchange.pushChunk(decodeChunkData(params.data, !!params.binary));
+    exchange.pushChunk(decodeChunkData(params.data, !!params.binary), params.agentInvocationId);
   }
   if (params.end) {
     exchange.pushEnd();
@@ -319,6 +323,7 @@ class CopilotRequestExchange {
   requestId;
   sessionId;
   agentId;
+  agentInvocationId;
   parentAgentId;
   interactionType;
   method = "GET";
@@ -341,6 +346,7 @@ class CopilotRequestExchange {
   setContext(params) {
     this.sessionId = params.sessionId;
     this.agentId = params.agentId;
+    this.agentInvocationId = params.agentInvocationId;
     this.parentAgentId = params.parentAgentId;
     this.interactionType = params.interactionType;
     this.method = params.method;
@@ -361,8 +367,8 @@ class CopilotRequestExchange {
     return this.#cancelled;
   }
   // --- Request body feed (driven by the adapter as chunk frames arrive) ---
-  pushChunk(chunk) {
-    this.#push({ chunk });
+  pushChunk(chunk, agentInvocationId) {
+    this.#push({ chunk, agentInvocationId });
   }
   pushEnd() {
     this.#push({ end: true });
@@ -405,7 +411,7 @@ class CopilotRequestExchange {
             this.#drained = true;
             return { value: void 0, done: true };
           }
-          return { value: item.chunk ?? new Uint8Array(), done: false };
+          return { value: item, done: false };
         }
       })
     };
@@ -517,9 +523,11 @@ async function buildFetchRequest(exchange) {
 async function drainAsync(stream) {
   const parts = [];
   let total = 0;
-  for await (const chunk of stream) {
-    parts.push(chunk);
-    total += chunk.byteLength;
+  for await (const item of stream) {
+    if (item.chunk) {
+      parts.push(item.chunk);
+      total += item.chunk.byteLength;
+    }
   }
   if (parts.length === 0) {
     return new Uint8Array(0);

package/dist/cjs/generated/rpc.js

@@ -201,6 +201,14 @@ function createServerRpc(connection) {
        * @returns The existing runtime identity and its resource on the listener.
        */
       publishSession: async (params) => connection.sendRequest("host.publishSession", params),
+      /**
+       * Withdraws a live or dormant application publication from an owned live host and revokes AHP attachments without deleting local session history, worktrees, or ongoing work. Returns false when already absent; rejects nonapplication publications.
+       *
+       * @param params Withdraws an application publication without deleting its underlying local session.
+       *
+       * @returns Publication withdrawal outcome; local history, worktrees and ongoing work are preserved.
+       */
+      unpublishSession: async (params) => connection.sendRequest("host.unpublishSession", params),
       /**
        * Reads the complete advertised live and dormant session catalog of an existing host owned by this connection. Does not start hosting, subscribe to sessions, or guarantee resumability.
        *
@@ -262,7 +270,15 @@ function createServerRpc(connection) {
        *
        * @returns The running runtime's complete catalog of well-known built-in model IDs, including supported models and additional IDs with built-in metadata.
        */
-      getBuiltInCatalog: async () => connection.sendRequest("models.getBuiltInCatalog", {})
+      getBuiltInCatalog: async () => connection.sendRequest("models.getBuiltInCatalog", {}),
+      /**
+       * Reports the unit of each model's published token prices: AI Credits or nano-AIU. Pair these units with models.list prices by model ID and use identical account-selection options for both calls. When options are omitted, the current account and its model providers are used.
+       *
+       * @param params Optional opaque account selection or compatibility GitHub token used to list models.
+       *
+       * @returns Price units for every catalog model that publishes token prices.
+       */
+      listTokenPriceUnits: async (params) => connection.sendRequest("models.listTokenPriceUnits", params)
     },
     /** @experimental */
     contentExclusion: {
@@ -515,14 +531,6 @@ function createServerRpc(connection) {
        * @returns Skill installation management result with the honoured contract, or a typed refusal.
        */
       planInstall: async (params) => connection.sendRequest("skills.planInstall", params),
-      /**
-       * Plans installation of the Skill pinned by an Agent Finder materialisation reference without writing files. The runtime retrieves the descriptor only from its fixed Agent Finder authority and applies the same verification as skills.planInstall; the review shows only verified data. Apply the returned plan with skills.applyInstall.
-       *
-       * @param params Side-effect-free planning of one Skill from a materialisation reference rather than a search candidate.
-       *
-       * @returns Skill installation management result with the honoured contract, or a typed refusal.
-       */
-      planInstallFromReference: async (params) => connection.sendRequest("skills.planInstallFromReference", params),
       /**
        * Consumes one verified Skill installation plan, requests explicit human consent through installations.confirm on the original connection, then revalidates and installs the Skill disabled.
        *
@@ -622,33 +630,24 @@ function createServerRpc(connection) {
        */
       getDiscoveryPaths: async (params) => connection.sendRequest("skills.getDiscoveryPaths", params)
     },
-    /**
-     * Registers the calling SDK client as the per-entrypoint extension launch provider. Call before creating any sessions. When omitted, the runtime uses its built-in extension launcher.
-     *
-     * @experimental
-     */
-    registerExtensionLaunchProvider: async () => connection.sendRequest("registerExtensionLaunchProvider", {}),
     /** @experimental */
-    catalog: {
+    plugins: {
       /**
-       * Requests a bounded catalog search. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with search available returns inert candidate summaries, each with an opaque single-use handle scoped to this runtime instance; a runtime without it returns the typed search-unavailable result. Public authorities may be searched anonymously, while an authority that requires credentials yields the typed authentication-required result. All returned text, URLs, and package metadata are untrusted external data and can never trigger instructions, tools, or installation. Read-only: nothing is installed, configured, or persisted.
+       * Plans installation of an Agent Plugin search candidate from its verified Agent Finder materialisation without writing files. Only candidates that carry a handle can be planned. The review shows only verified data, and installing leaves the plugin disabled until it is enabled through plugins.enable.
        *
-       * @param params A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
+       * @param params Side-effect-free planning of one Agent Plugin search candidate through its Agent Finder materialisation.
        *
-       * @returns Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+       * @returns Agent Plugin installation planning result with the honoured contract, or a typed refusal.
        */
-      search: async (params) => connection.sendRequest("catalog.search", params),
+      planInstall: async (params) => connection.sendRequest("plugins.planInstall", params),
       /**
-       * Terminates one retained catalog selection group. A selected outcome returns the native host a fresh single-use candidate handle plus the original searchId for a later explicit mcp.planInstall call; non-selected outcomes release the group without producing a planning input. Candidate state, cards, URLs, credentials and private identifiers remain inside the runtime. The model-facing catalog_select tool projects the result separately and never exposes the candidate handle or searchId.
+       * Consumes one verified Agent Plugin installation plan, requests explicit human consent through installations.confirm on the original connection, then reacquires and verifies every file and registers the plugin, disabled, exactly as a direct plugin install. The installed plugin is listed, enabled and uninstalled through the existing plugins methods.
        *
-       * @param params Terminates one retained catalog selection group through an opaque reference previously returned by the model-safe search projection.
+       * @param params Applies exactly one retained verified Agent Plugin installation plan.
        *
-       * @returns Typed outcome of catalog.select. Only the selected host result carries a fresh candidate handle; the model-facing projection removes both that handle and searchId.
+       * @returns Agent Plugin installation result with the honoured contract, or a typed request/negotiation refusal.
        */
-      select: async (params) => connection.sendRequest("catalog.select", params)
-    },
-    /** @experimental */
-    plugins: {
+      applyInstall: async (params) => connection.sendRequest("plugins.applyInstall", params),
       /**
        * Lists plugins installed in user/global state.
        *
@@ -746,6 +745,39 @@ function createServerRpc(connection) {
         refresh: async (params) => connection.sendRequest("plugins.marketplaces.refresh", params)
       }
     },
+    /**
+     * Registers the calling SDK client as the per-entrypoint extension launch provider. Call before creating any sessions. When omitted, the runtime uses its built-in extension launcher.
+     *
+     * @experimental
+     */
+    registerExtensionLaunchProvider: async () => connection.sendRequest("registerExtensionLaunchProvider", {}),
+    /** @experimental */
+    catalog: {
+      /**
+       * Requests a bounded catalog search. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with search available returns inert candidate summaries, each with an opaque single-use handle scoped to this runtime instance; a runtime without it returns the typed search-unavailable result. Public authorities may be searched anonymously, while an authority that requires credentials yields the typed authentication-required result. All returned text, URLs, and package metadata are untrusted external data and can never trigger instructions, tools, or installation. Read-only: nothing is installed, configured, or persisted.
+       *
+       * @param params A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
+       *
+       * @returns Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+       */
+      search: async (params) => connection.sendRequest("catalog.search", params),
+      /**
+       * Terminates one retained catalog selection group. A selected outcome returns the native host a fresh single-use candidate handle plus the original searchId for a later explicit mcp.planInstall call; non-selected outcomes release the group without producing a planning input. Candidate state, cards, URLs, credentials and private identifiers remain inside the runtime. The model-facing catalog_select tool projects the result separately and never exposes the candidate handle or searchId.
+       *
+       * @param params Terminates one retained catalog selection group through an opaque reference previously returned by the model-safe search projection.
+       *
+       * @returns Typed outcome of catalog.select. Only the selected host result carries a fresh candidate handle; the model-facing projection removes both that handle and searchId.
+       */
+      select: async (params) => connection.sendRequest("catalog.select", params),
+      /**
+       * Plans installing the resource an Agent Finder materialisation reference pins, without writing files and whatever its kind. The runtime retrieves the descriptor once, only from its fixed Agent Finder authority, verifies it, and plans by its resolution policy: a Skill (`agent-skill@1.0.0`) when the caller requires skill-confirmed-installation, an Agent Plugin (`plugin@1.0.0`) when it requires agent-plugin-confirmed-installation. Any other kind is refused as unsupported-resource. The outcome names the kind; apply a Skill plan with skills.applyInstall and an Agent Plugin plan with plugins.applyInstall. The review shows only verified data.
+       *
+       * @param params Side-effect-free planning of whatever resource a materialisation reference pins, rather than a search candidate.
+       *
+       * @returns Planning result for a materialisation reference with the honoured contract, or a typed refusal.
+       */
+      planInstallFromReference: async (params) => connection.sendRequest("catalog.planInstallFromReference", params)
+    },
     /** @experimental */
     agents: {
       /**
@@ -1671,7 +1703,42 @@ function createInternalServerRpc(connection) {
        *
        * @returns Whether the gh-replaceable GitHub MCP tools may be clipped for the session described by the request.
        */
-      shouldExcludeGitHubTools: async (params) => connection.sendRequest("mcp.shouldExcludeGitHubTools", params)
+      shouldExcludeGitHubTools: async (params) => connection.sendRequest("mcp.shouldExcludeGitHubTools", params),
+      /** @experimental */
+      oauth: {
+        /**
+         * Reads the static OAuth client a remote MCP server configuration pins, so a host can decide whether to register a client dynamically or reuse the configured one. Omits `clientConfig` when no non-empty `oauthClientId` is configured. The client secret is deliberately never carried here: the runtime loads it from the OAuth secret store at flow time.
+         *
+         * @param params A remote MCP server configuration whose pinned OAuth client should be read.
+         *
+         * @returns The OAuth client the configuration pins, when it pins one.
+         */
+        staticClientConfig: async (params) => connection.sendRequest("mcp.oauth.staticClientConfig", params),
+        /**
+         * Reads raw protected-resource metadata after a 401 establishes that OAuth is required. Uses the metadata URL from the server's `WWW-Authenticate` challenge when provided; otherwise, tries conventional metadata endpoints derived from the request URL. A host configuring a remote server interactively needs the unparsed document to classify the challenge before it starts OAuth. The request URL and each metadata URL pass through the named session's egress policy and sandbox proxy. The runtime refuses URLs that the session may not reach.
+         *
+         * @param params An OAuth challenge from a remote MCP server whose protected-resource metadata should be read.
+         *
+         * @returns Raw protected-resource metadata from the explicit metadata URL or conventional discovery.
+         */
+        fetchProtectedResourceMetadata: async (params) => connection.sendRequest("mcp.oauth.fetchProtectedResourceMetadata", params),
+        /**
+         * Asks a remote MCP server's authorization server whether it supports Dynamic Client Registration, after a 401 has already established that OAuth is required. A host configuring a remote server interactively needs this to choose between registering a client automatically and asking the user for client credentials. The request travels through the named session's egress policy and sandbox proxy, so a server that session may not reach is refused rather than contacted.
+         *
+         * @param params A remote MCP server whose authorization server should be asked about Dynamic Client Registration.
+         *
+         * @returns Whether the server's authorization server registers clients dynamically.
+         */
+        checkDcrSupport: async (params) => connection.sendRequest("mcp.oauth.checkDcrSupport", params),
+        /**
+         * Reports whether an authorization server URL belongs to Microsoft Entra ID. Entra does not support Dynamic Client Registration, so a host that finds no DCR support can still authorize against it with a pre-registered client instead of asking the user for client credentials.
+         *
+         * @param params An authorization server URL to classify.
+         *
+         * @returns Whether the URL is a Microsoft Entra ID authorization server.
+         */
+        isMicrosoftAuthorizationServer: async (params) => connection.sendRequest("mcp.oauth.isMicrosoftAuthorizationServer", params)
+      }
     },
     /** @experimental */
     instructions: {
@@ -2089,7 +2156,7 @@ function createSessionRpc(connection, sessionId) {
         /**
          * Begin an interactive login flow for a provider kind (dispatch is kind-only) and return its opaque flow id and first step.
          *
-         * @param params Begin an interactive login flow for a provider kind. Dispatch is kind-only.
+         * @param params Begin an interactive login flow for a provider kind, optionally reusing a cached base identity or explicitly requesting provider account selection.
          *
          * @returns A started login flow: its opaque id and first step.
          */

package/dist/cjs/host.js

@@ -23,10 +23,11 @@ __export(host_exports, {
 module.exports = __toCommonJS(host_exports);
 class AhpHost {
   /** @internal */
-  constructor(info, disposeHost, publishHostSession, listHostSessions) {
+  constructor(info, disposeHost, publishHostSession, listHostSessions, unpublishHostSession) {
     this.disposeHost = disposeHost;
     this.publishHostSession = publishHostSession;
     this.listHostSessions = listHostSessions;
+    this.unpublishHostSession = unpublishHostSession;
     this.hostId = info.hostId;
     this.url = info.url;
     this.environmentId = info.environmentId;
@@ -36,6 +37,7 @@ class AhpHost {
   disposeHost;
   publishHostSession;
   listHostSessions;
+  unpublishHostSession;
   hostId;
   /** Local WebSocket URL. Absent when only the GitHub environment is enabled. */
   url;
@@ -53,6 +55,14 @@ class AhpHost {
   publishSession(sessionId) {
     return this.publishHostSession(sessionId);
   }
+  /**
+   * Withdraw a live or dormant application publication and revoke AHP attachments.
+   * Preserves local history, worktrees and ongoing work; returns false when already absent.
+   * Rejects nonapplication publications. Does not stop the host.
+   */
+  unpublishSession(sessionId) {
+    return this.unpublishHostSession(sessionId);
+  }
   /** List all live and dormant catalog sessions advertised by this host. */
   listSessions() {
     return this.listHostSessions();

package/dist/cjs/session.js

@@ -843,12 +843,12 @@ class CopilotSession {
         }
       }
     } else if (event.type === "permission.requested") {
-      const { requestId, permissionRequest, resolvedByHook } = event.data;
+      const { requestId, permissionRequest, promptRequest, resolvedByHook } = event.data;
       if (resolvedByHook) {
         return;
       }
       if (this.permissionHandler) {
-        void this._executePermissionAndRespond(requestId, permissionRequest);
+        void this._executePermissionAndRespond(requestId, permissionRequest, promptRequest);
       }
     } else if (event.type === "mcp.oauth_required") {
       const data = event.data;
@@ -1007,12 +1007,14 @@ class CopilotSession {
    * Executes a permission handler and sends the result back via RPC.
    * @internal
    */
-  async _executePermissionAndRespond(requestId, permissionRequest) {
+  async _executePermissionAndRespond(requestId, permissionRequest, promptRequest) {
     try {
-      const handlerResult = await this.permissionHandler(permissionRequest, {
+      const invocation = {
         sessionId: this.sessionId,
-        managedSettingsEnabled: this.managedSettingsEnabled
-      });
+        managedSettingsEnabled: this.managedSettingsEnabled,
+        ...promptRequest === void 0 ? {} : { promptRequest }
+      };
+      const handlerResult = await this.permissionHandler(permissionRequest, invocation);
       const isAttributed = (0, import_types.isAttributedPermissionResult)(handlerResult);
       const result = isAttributed ? handlerResult.result : handlerResult;
       const decisionContext = isAttributed ? handlerResult.decisionContext : void 0;

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.98";
+export declare const COPILOT_CLI_VERSION = "1.0.99-1";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.98";
+const COPILOT_CLI_VERSION = "1.0.99-1";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/client.js

@@ -1755,7 +1755,8 @@ class CopilotClient {
           await rpc.host.dispose({ hostId });
         },
         (sessionId) => rpc.host.publishSession({ hostId, sessionId }),
-        () => rpc.host.listSessions({ hostId })
+        () => rpc.host.listSessions({ hostId }),
+        (sessionId) => rpc.host.unpublishSession({ hostId, sessionId })
       );
     } catch (error) {
       this.hostExitCallbacks.delete(hostId);

package/dist/copilotRequestHandler.d.ts

@@ -9,6 +9,8 @@ export interface CopilotRequestContext {
     readonly requestId: string;
     readonly sessionId?: string;
     readonly agentId?: string;
+    /** Runtime-provided logical invocation identity, unchanged across physical retries. */
+    readonly agentInvocationId?: string;
     readonly parentAgentId?: string;
     readonly interactionType?: string;
     readonly transport: "http" | "websocket";
@@ -47,7 +49,11 @@ export declare abstract class CopilotWebSocketHandler implements AsyncDisposable
     protected constructor(context: CopilotRequestContext);
     sendResponseMessage(data: string | Uint8Array): Promise<void>;
     close(status?: CopilotWebSocketCloseStatus): Promise<void>;
-    abstract sendRequestMessage(data: string | Uint8Array): Promise<void> | void;
+    /**
+     * Forward a runtime message. When supplied by the adapter, ctx carries this
+     * message's invocation identity, not the identity that opened the connection.
+     */
+    abstract sendRequestMessage(data: string | Uint8Array, ctx?: CopilotRequestContext): Promise<void> | void;
     [Symbol.asyncDispose](): Promise<void>;
 }
 /**
@@ -65,7 +71,7 @@ export declare abstract class CopilotWebSocketHandler implements AsyncDisposable
 export declare class CopilotWebSocketForwarder extends CopilotWebSocketHandler {
     #private;
     constructor(context: CopilotRequestContext);
-    sendRequestMessage(data: string | Uint8Array): void;
+    sendRequestMessage(data: string | Uint8Array, _ctx?: CopilotRequestContext): void;
     close(status?: CopilotWebSocketCloseStatus): Promise<void>;
     [Symbol.asyncDispose](): Promise<void>;
 }

package/dist/copilotRequestHandler.js

@@ -71,7 +71,7 @@ class CopilotWebSocketForwarder extends CopilotWebSocketHandler {
   constructor(context) {
     super(context);
   }
-  sendRequestMessage(data) {
+  sendRequestMessage(data, _ctx) {
     if (this.#upstream?.readyState !== WebSocket.OPEN) {
       return;
     }
@@ -155,6 +155,7 @@ class CopilotRequestHandler {
       requestId: exchange.requestId,
       sessionId: exchange.sessionId,
       agentId: exchange.agentId,
+      agentInvocationId: exchange.agentInvocationId,
       parentAgentId: exchange.parentAgentId,
       interactionType: exchange.interactionType,
       transport: exchange.transport,
@@ -182,7 +183,10 @@ class CopilotRequestHandler {
       let cancelled;
       const clientSettled = (async () => {
         for await (const chunk of exchange.requestBody) {
-          await handler.sendRequestMessage(decodeFrame(chunk));
+          await handler.sendRequestMessage(decodeFrame(chunk.chunk ?? new Uint8Array()), {
+            ...ctx,
+            agentInvocationId: chunk.agentInvocationId
+          });
         }
         return "client-complete";
       })().catch((err) => {
@@ -282,7 +286,7 @@ function routeChunk(exchange, params) {
     return;
   }
   if (params.data && params.data.length > 0) {
-    exchange.pushChunk(decodeChunkData(params.data, !!params.binary));
+    exchange.pushChunk(decodeChunkData(params.data, !!params.binary), params.agentInvocationId);
   }
   if (params.end) {
     exchange.pushEnd();
@@ -292,6 +296,7 @@ class CopilotRequestExchange {
   requestId;
   sessionId;
   agentId;
+  agentInvocationId;
   parentAgentId;
   interactionType;
   method = "GET";
@@ -314,6 +319,7 @@ class CopilotRequestExchange {
   setContext(params) {
     this.sessionId = params.sessionId;
     this.agentId = params.agentId;
+    this.agentInvocationId = params.agentInvocationId;
     this.parentAgentId = params.parentAgentId;
     this.interactionType = params.interactionType;
     this.method = params.method;
@@ -334,8 +340,8 @@ class CopilotRequestExchange {
     return this.#cancelled;
   }
   // --- Request body feed (driven by the adapter as chunk frames arrive) ---
-  pushChunk(chunk) {
-    this.#push({ chunk });
+  pushChunk(chunk, agentInvocationId) {
+    this.#push({ chunk, agentInvocationId });
   }
   pushEnd() {
     this.#push({ end: true });
@@ -378,7 +384,7 @@ class CopilotRequestExchange {
             this.#drained = true;
             return { value: void 0, done: true };
           }
-          return { value: item.chunk ?? new Uint8Array(), done: false };
+          return { value: item, done: false };
         }
       })
     };
@@ -490,9 +496,11 @@ async function buildFetchRequest(exchange) {
 async function drainAsync(stream) {
   const parts = [];
   let total = 0;
-  for await (const chunk of stream) {
-    parts.push(chunk);
-    total += chunk.byteLength;
+  for await (const item of stream) {
+    if (item.chunk) {
+      parts.push(item.chunk);
+      total += item.chunk.byteLength;
+    }
   }
   if (parts.length === 0) {
     return new Uint8Array(0);