@github/copilot-sdk 1.0.22 → 1.0.23-preview.1

package/dist/generated/rpc.js

@@ -173,6 +173,14 @@ function createServerRpc(connection) {
        * @returns The existing runtime identity and its resource on the listener.
        */
       publishSession: async (params) => connection.sendRequest("host.publishSession", params),
+      /**
+       * Withdraws a live or dormant application publication from an owned live host and revokes AHP attachments without deleting local session history, worktrees, or ongoing work. Returns false when already absent; rejects nonapplication publications.
+       *
+       * @param params Withdraws an application publication without deleting its underlying local session.
+       *
+       * @returns Publication withdrawal outcome; local history, worktrees and ongoing work are preserved.
+       */
+      unpublishSession: async (params) => connection.sendRequest("host.unpublishSession", params),
       /**
        * Reads the complete advertised live and dormant session catalog of an existing host owned by this connection. Does not start hosting, subscribe to sessions, or guarantee resumability.
        *
@@ -234,7 +242,15 @@ function createServerRpc(connection) {
        *
        * @returns The running runtime's complete catalog of well-known built-in model IDs, including supported models and additional IDs with built-in metadata.
        */
-      getBuiltInCatalog: async () => connection.sendRequest("models.getBuiltInCatalog", {})
+      getBuiltInCatalog: async () => connection.sendRequest("models.getBuiltInCatalog", {}),
+      /**
+       * Reports the unit of each model's published token prices: AI Credits or nano-AIU. Pair these units with models.list prices by model ID and use identical account-selection options for both calls. When options are omitted, the current account and its model providers are used.
+       *
+       * @param params Optional opaque account selection or compatibility GitHub token used to list models.
+       *
+       * @returns Price units for every catalog model that publishes token prices.
+       */
+      listTokenPriceUnits: async (params) => connection.sendRequest("models.listTokenPriceUnits", params)
     },
     /** @experimental */
     contentExclusion: {
@@ -487,14 +503,6 @@ function createServerRpc(connection) {
        * @returns Skill installation management result with the honoured contract, or a typed refusal.
        */
       planInstall: async (params) => connection.sendRequest("skills.planInstall", params),
-      /**
-       * Plans installation of the Skill pinned by an Agent Finder materialisation reference without writing files. The runtime retrieves the descriptor only from its fixed Agent Finder authority and applies the same verification as skills.planInstall; the review shows only verified data. Apply the returned plan with skills.applyInstall.
-       *
-       * @param params Side-effect-free planning of one Skill from a materialisation reference rather than a search candidate.
-       *
-       * @returns Skill installation management result with the honoured contract, or a typed refusal.
-       */
-      planInstallFromReference: async (params) => connection.sendRequest("skills.planInstallFromReference", params),
       /**
        * Consumes one verified Skill installation plan, requests explicit human consent through installations.confirm on the original connection, then revalidates and installs the Skill disabled.
        *
@@ -594,33 +602,24 @@ function createServerRpc(connection) {
        */
       getDiscoveryPaths: async (params) => connection.sendRequest("skills.getDiscoveryPaths", params)
     },
-    /**
-     * Registers the calling SDK client as the per-entrypoint extension launch provider. Call before creating any sessions. When omitted, the runtime uses its built-in extension launcher.
-     *
-     * @experimental
-     */
-    registerExtensionLaunchProvider: async () => connection.sendRequest("registerExtensionLaunchProvider", {}),
     /** @experimental */
-    catalog: {
+    plugins: {
       /**
-       * Requests a bounded catalog search. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with search available returns inert candidate summaries, each with an opaque single-use handle scoped to this runtime instance; a runtime without it returns the typed search-unavailable result. Public authorities may be searched anonymously, while an authority that requires credentials yields the typed authentication-required result. All returned text, URLs, and package metadata are untrusted external data and can never trigger instructions, tools, or installation. Read-only: nothing is installed, configured, or persisted.
+       * Plans installation of an Agent Plugin search candidate from its verified Agent Finder materialisation without writing files. Only candidates that carry a handle can be planned. The review shows only verified data, and installing leaves the plugin disabled until it is enabled through plugins.enable.
        *
-       * @param params A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
+       * @param params Side-effect-free planning of one Agent Plugin search candidate through its Agent Finder materialisation.
        *
-       * @returns Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+       * @returns Agent Plugin installation planning result with the honoured contract, or a typed refusal.
        */
-      search: async (params) => connection.sendRequest("catalog.search", params),
+      planInstall: async (params) => connection.sendRequest("plugins.planInstall", params),
       /**
-       * Terminates one retained catalog selection group. A selected outcome returns the native host a fresh single-use candidate handle plus the original searchId for a later explicit mcp.planInstall call; non-selected outcomes release the group without producing a planning input. Candidate state, cards, URLs, credentials and private identifiers remain inside the runtime. The model-facing catalog_select tool projects the result separately and never exposes the candidate handle or searchId.
+       * Consumes one verified Agent Plugin installation plan, requests explicit human consent through installations.confirm on the original connection, then reacquires and verifies every file and registers the plugin, disabled, exactly as a direct plugin install. The installed plugin is listed, enabled and uninstalled through the existing plugins methods.
        *
-       * @param params Terminates one retained catalog selection group through an opaque reference previously returned by the model-safe search projection.
+       * @param params Applies exactly one retained verified Agent Plugin installation plan.
        *
-       * @returns Typed outcome of catalog.select. Only the selected host result carries a fresh candidate handle; the model-facing projection removes both that handle and searchId.
+       * @returns Agent Plugin installation result with the honoured contract, or a typed request/negotiation refusal.
        */
-      select: async (params) => connection.sendRequest("catalog.select", params)
-    },
-    /** @experimental */
-    plugins: {
+      applyInstall: async (params) => connection.sendRequest("plugins.applyInstall", params),
       /**
        * Lists plugins installed in user/global state.
        *
@@ -718,6 +717,39 @@ function createServerRpc(connection) {
         refresh: async (params) => connection.sendRequest("plugins.marketplaces.refresh", params)
       }
     },
+    /**
+     * Registers the calling SDK client as the per-entrypoint extension launch provider. Call before creating any sessions. When omitted, the runtime uses its built-in extension launcher.
+     *
+     * @experimental
+     */
+    registerExtensionLaunchProvider: async () => connection.sendRequest("registerExtensionLaunchProvider", {}),
+    /** @experimental */
+    catalog: {
+      /**
+       * Requests a bounded catalog search. This host-implemented server method is available through SDK/TUI hosts; standalone and C-ABI runtimes whose host does not implement server-method dispatch return JSON-RPC MethodNotFound. A runtime with search available returns inert candidate summaries, each with an opaque single-use handle scoped to this runtime instance; a runtime without it returns the typed search-unavailable result. Public authorities may be searched anonymously, while an authority that requires credentials yields the typed authentication-required result. All returned text, URLs, and package metadata are untrusted external data and can never trigger instructions, tools, or installation. Read-only: nothing is installed, configured, or persisted.
+       *
+       * @param params A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
+       *
+       * @returns Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+       */
+      search: async (params) => connection.sendRequest("catalog.search", params),
+      /**
+       * Terminates one retained catalog selection group. A selected outcome returns the native host a fresh single-use candidate handle plus the original searchId for a later explicit mcp.planInstall call; non-selected outcomes release the group without producing a planning input. Candidate state, cards, URLs, credentials and private identifiers remain inside the runtime. The model-facing catalog_select tool projects the result separately and never exposes the candidate handle or searchId.
+       *
+       * @param params Terminates one retained catalog selection group through an opaque reference previously returned by the model-safe search projection.
+       *
+       * @returns Typed outcome of catalog.select. Only the selected host result carries a fresh candidate handle; the model-facing projection removes both that handle and searchId.
+       */
+      select: async (params) => connection.sendRequest("catalog.select", params),
+      /**
+       * Plans installing the resource an Agent Finder materialisation reference pins, without writing files and whatever its kind. The runtime retrieves the descriptor once, only from its fixed Agent Finder authority, verifies it, and plans by its resolution policy: a Skill (`agent-skill@1.0.0`) when the caller requires skill-confirmed-installation, an Agent Plugin (`plugin@1.0.0`) when it requires agent-plugin-confirmed-installation. Any other kind is refused as unsupported-resource. The outcome names the kind; apply a Skill plan with skills.applyInstall and an Agent Plugin plan with plugins.applyInstall. The review shows only verified data.
+       *
+       * @param params Side-effect-free planning of whatever resource a materialisation reference pins, rather than a search candidate.
+       *
+       * @returns Planning result for a materialisation reference with the honoured contract, or a typed refusal.
+       */
+      planInstallFromReference: async (params) => connection.sendRequest("catalog.planInstallFromReference", params)
+    },
     /** @experimental */
     agents: {
       /**
@@ -1643,7 +1675,42 @@ function createInternalServerRpc(connection) {
        *
        * @returns Whether the gh-replaceable GitHub MCP tools may be clipped for the session described by the request.
        */
-      shouldExcludeGitHubTools: async (params) => connection.sendRequest("mcp.shouldExcludeGitHubTools", params)
+      shouldExcludeGitHubTools: async (params) => connection.sendRequest("mcp.shouldExcludeGitHubTools", params),
+      /** @experimental */
+      oauth: {
+        /**
+         * Reads the static OAuth client a remote MCP server configuration pins, so a host can decide whether to register a client dynamically or reuse the configured one. Omits `clientConfig` when no non-empty `oauthClientId` is configured. The client secret is deliberately never carried here: the runtime loads it from the OAuth secret store at flow time.
+         *
+         * @param params A remote MCP server configuration whose pinned OAuth client should be read.
+         *
+         * @returns The OAuth client the configuration pins, when it pins one.
+         */
+        staticClientConfig: async (params) => connection.sendRequest("mcp.oauth.staticClientConfig", params),
+        /**
+         * Reads raw protected-resource metadata after a 401 establishes that OAuth is required. Uses the metadata URL from the server's `WWW-Authenticate` challenge when provided; otherwise, tries conventional metadata endpoints derived from the request URL. A host configuring a remote server interactively needs the unparsed document to classify the challenge before it starts OAuth. The request URL and each metadata URL pass through the named session's egress policy and sandbox proxy. The runtime refuses URLs that the session may not reach.
+         *
+         * @param params An OAuth challenge from a remote MCP server whose protected-resource metadata should be read.
+         *
+         * @returns Raw protected-resource metadata from the explicit metadata URL or conventional discovery.
+         */
+        fetchProtectedResourceMetadata: async (params) => connection.sendRequest("mcp.oauth.fetchProtectedResourceMetadata", params),
+        /**
+         * Asks a remote MCP server's authorization server whether it supports Dynamic Client Registration, after a 401 has already established that OAuth is required. A host configuring a remote server interactively needs this to choose between registering a client automatically and asking the user for client credentials. The request travels through the named session's egress policy and sandbox proxy, so a server that session may not reach is refused rather than contacted.
+         *
+         * @param params A remote MCP server whose authorization server should be asked about Dynamic Client Registration.
+         *
+         * @returns Whether the server's authorization server registers clients dynamically.
+         */
+        checkDcrSupport: async (params) => connection.sendRequest("mcp.oauth.checkDcrSupport", params),
+        /**
+         * Reports whether an authorization server URL belongs to Microsoft Entra ID. Entra does not support Dynamic Client Registration, so a host that finds no DCR support can still authorize against it with a pre-registered client instead of asking the user for client credentials.
+         *
+         * @param params An authorization server URL to classify.
+         *
+         * @returns Whether the URL is a Microsoft Entra ID authorization server.
+         */
+        isMicrosoftAuthorizationServer: async (params) => connection.sendRequest("mcp.oauth.isMicrosoftAuthorizationServer", params)
+      }
     },
     /** @experimental */
     instructions: {
@@ -2061,7 +2128,7 @@ function createSessionRpc(connection, sessionId) {
         /**
          * Begin an interactive login flow for a provider kind (dispatch is kind-only) and return its opaque flow id and first step.
          *
-         * @param params Begin an interactive login flow for a provider kind. Dispatch is kind-only.
+         * @param params Begin an interactive login flow for a provider kind, optionally reusing a cached base identity or explicitly requesting provider account selection.
          *
          * @returns A started login flow: its opaque id and first step.
          */

package/dist/generated/session-events.d.ts

@@ -3907,6 +3907,10 @@ export interface CompactionStartEvent {
  * Context window breakdown at the start of LLM-powered conversation compaction
  */
 export interface CompactionStartData {
+    /**
+     * Identifier shared with the matching compaction completion event
+     */
+    compactionAttemptId?: string;
     /**
      * Token count from non-system messages (user, assistant, tool) at compaction start
      */
@@ -3919,10 +3923,18 @@ export interface CompactionStartData {
      * Model identifier used for compaction, when known
      */
     model?: string;
+    /**
+     * Destination model for a model-switch compaction when it differs from the compacting model
+     */
+    switchTargetModel?: string;
     /**
      * Token count from system message(s) at compaction start
      */
     systemTokens?: number;
+    /**
+     * Destination prompt-token budget when it differs from the effective compaction token limit
+     */
+    targetPromptTokenLimit?: number;
     /**
      * Model context window token limit the compaction is targeting, when known
      */
@@ -3979,6 +3991,10 @@ export interface CompactionCompleteData {
      * File path where the checkpoint was stored
      */
     checkpointPath?: string;
+    /**
+     * Identifier shared with the matching compaction start event
+     */
+    compactionAttemptId?: string;
     compactionTokensUsed?: CompactionCompleteCompactionTokensUsed;
     /**
      * Token count from non-system messages (user, assistant, tool) after compaction
@@ -3992,10 +4008,30 @@ export interface CompactionCompleteData {
      * Error message if compaction failed
      */
     error?: string;
+    /**
+     * Bounded reason for a typed failed outcome. Unknown future values are preserved.
+     */
+    failureReason?: string;
+    /**
+     * Model identifier at admission when routing later changed to the reported compaction model
+     */
+    initialModel?: string;
     /**
      * Number of messages removed during compaction
      */
     messagesRemoved?: number;
+    /**
+     * Model identifier used for compaction when provider usage does not already supply it
+     */
+    model?: string;
+    /**
+     * Typed terminal outcome for this observed compaction completion. Unknown future values are preserved.
+     */
+    outcome?: string;
+    /**
+     * Bounded reason for an expected non-application outcome such as cancellation or no applicable history. Unknown future values are preserved.
+     */
+    outcomeReason?: string;
     /**
      * Total tokens in conversation after compaction
      */
@@ -4029,10 +4065,22 @@ export interface CompactionCompleteData {
      * LLM-generated summary of the compacted conversation history
      */
     summaryContent?: string;
+    /**
+     * Destination model for a model-switch compaction when it differs from the compacting model
+     */
+    switchTargetModel?: string;
     /**
      * Token count from system message(s) after compaction
      */
     systemTokens?: number;
+    /**
+     * Destination prompt-token budget when it differs from the effective compaction token limit
+     */
+    targetPromptTokenLimit?: number;
+    /**
+     * Open accounting-basis identifier for trustworthy paired pre/post token measurements. The current runtime emits local_full_context_estimate.
+     */
+    tokenAccountingBasis?: string;
     /**
      * Model context window token limit the compaction was targeting, when known
      */
@@ -4582,6 +4630,12 @@ export interface FusionResolvedData {
      * Concrete model selected for Critique review, or the legacy Cascade judge/repair model when role-specific fields are absent.
      */
     secondaryModel: string | null;
+    /**
+     * Identifier of the server policy rule whose workflow the plan's steps describe, when CAPI's sticky root routing replaced the workflow of `ruleId`'s rule to keep the previous turn's root model. Absent when no substitution occurred.
+     *
+     * @experimental
+     */
+    selectedRuleId?: string;
     /**
      * Synthetic HydraFusion model selected for the session.
      */
@@ -7553,6 +7607,12 @@ export interface ToolExecutionCompleteData {
     toolTelemetry?: {
         [k: string]: JsonValue | undefined;
     };
+    /**
+     * Provider-reported usage of a separately metered runtime-owned tool operation, independent of the conversation model. Present on success or failure when usage is known. Experimental.
+     *
+     * @experimental
+     */
+    toolUsage?: ToolExecutionUsage;
     /**
      * Identifier for the agent loop turn this tool was invoked in, matching the corresponding assistant.turn_start event
      */
@@ -8065,6 +8125,50 @@ export interface ToolExecutionCompleteToolDescriptionMetaUI {
      */
     visibility?: ToolExecutionCompleteToolDescriptionMetaUIVisibility[];
 }
+/**
+ * Authoritative usage reported by a separately metered runtime-owned tool operation. May be present on a failed tool when the service reported usage before local result processing failed. Missing token counts or billing mean unavailable, not zero.
+ */
+/** @experimental */
+export interface ToolExecutionUsage {
+    accounting?: UsageAccountingIdentity;
+    copilotUsage?: AssistantUsageCopilotUsage;
+    /**
+     * Total provider-reported input tokens across all modalities.
+     */
+    inputTokens?: number;
+    inputTokensDetails?: ToolExecutionUsageTokenDetails;
+    /**
+     * Requested model for the tool operation, independent of the conversation model. Not a provider-confirmed serving model.
+     */
+    model: string;
+    /**
+     * Total provider-reported output tokens across all modalities.
+     */
+    outputTokens?: number;
+    outputTokensDetails?: ToolExecutionUsageTokenDetails;
+    provider?: ModelProviderRef;
+    /**
+     * Runtime-generated identifier for this metered operation. Deduplicates repeated delivery or replay; not an upstream billing identifier.
+     */
+    requestId: string;
+    /**
+     * Provider-reported sum of input and output tokens.
+     */
+    totalTokens?: number;
+}
+/**
+ * Provider-reported image and text token counts, which are subsets of the corresponding total rather than additional tokens.
+ */
+export interface ToolExecutionUsageTokenDetails {
+    /**
+     * Image tokens included in the corresponding input or output total.
+     */
+    imageTokens: number;
+    /**
+     * Text tokens included in the corresponding input or output total.
+     */
+    textTokens: number;
+}
 /**
  * Session event "tool_search.activated". Persisted generic client-side tool activations restored when a session resumes.
  */

package/dist/host.d.ts

@@ -1,4 +1,4 @@
-import type { HostExitedNotification, HostPublishSessionResult, HostListSessionsResult, HostLocalServerOptions, HostGitHubEnvironmentOptions } from "./generated/rpc.js";
+import type { HostExitedNotification, HostPublishSessionResult, HostUnpublishSessionResult, HostListSessionsResult, HostLocalServerOptions, HostGitHubEnvironmentOptions } from "./generated/rpc.js";
 import type { CopilotSession } from "./session.js";
 import type { SessionConfig, ResumeSessionConfig } from "./types.js";
 /** Host-selected defaults for a fresh application-owned session. @experimental */
@@ -72,6 +72,7 @@ export declare class AhpHost {
     private readonly disposeHost;
     private readonly publishHostSession;
     private readonly listHostSessions;
+    private readonly unpublishHostSession;
     readonly hostId: string;
     /** Local WebSocket URL. Absent when only the GitHub environment is enabled. */
     readonly url: string | undefined;
@@ -85,6 +86,12 @@ export declare class AhpHost {
     dispose(): Promise<void>;
     /** Publish an attached application session into the durable compute-scoped host catalog. */
     publishSession(sessionId: string): Promise<HostPublishSessionResult>;
+    /**
+     * Withdraw a live or dormant application publication and revoke AHP attachments.
+     * Preserves local history, worktrees and ongoing work; returns false when already absent.
+     * Rejects nonapplication publications. Does not stop the host.
+     */
+    unpublishSession(sessionId: string): Promise<HostUnpublishSessionResult>;
     /** List all live and dormant catalog sessions advertised by this host. */
     listSessions(): Promise<HostListSessionsResult>;
     [Symbol.asyncDispose](): Promise<void>;

package/dist/host.js

@@ -1,9 +1,10 @@
 class AhpHost {
   /** @internal */
-  constructor(info, disposeHost, publishHostSession, listHostSessions) {
+  constructor(info, disposeHost, publishHostSession, listHostSessions, unpublishHostSession) {
     this.disposeHost = disposeHost;
     this.publishHostSession = publishHostSession;
     this.listHostSessions = listHostSessions;
+    this.unpublishHostSession = unpublishHostSession;
     this.hostId = info.hostId;
     this.url = info.url;
     this.environmentId = info.environmentId;
@@ -13,6 +14,7 @@ class AhpHost {
   disposeHost;
   publishHostSession;
   listHostSessions;
+  unpublishHostSession;
   hostId;
   /** Local WebSocket URL. Absent when only the GitHub environment is enabled. */
   url;
@@ -30,6 +32,14 @@ class AhpHost {
   publishSession(sessionId) {
     return this.publishHostSession(sessionId);
   }
+  /**
+   * Withdraw a live or dormant application publication and revoke AHP attachments.
+   * Preserves local history, worktrees and ongoing work; returns false when already absent.
+   * Rejects nonapplication publications. Does not stop the host.
+   */
+  unpublishSession(sessionId) {
+    return this.unpublishHostSession(sessionId);
+  }
   /** List all live and dormant catalog sessions advertised by this host. */
   listSessions() {
     return this.listHostSessions();

package/dist/session.js

@@ -825,12 +825,12 @@ class CopilotSession {
         }
       }
     } else if (event.type === "permission.requested") {
-      const { requestId, permissionRequest, resolvedByHook } = event.data;
+      const { requestId, permissionRequest, promptRequest, resolvedByHook } = event.data;
       if (resolvedByHook) {
         return;
       }
       if (this.permissionHandler) {
-        void this._executePermissionAndRespond(requestId, permissionRequest);
+        void this._executePermissionAndRespond(requestId, permissionRequest, promptRequest);
       }
     } else if (event.type === "mcp.oauth_required") {
       const data = event.data;
@@ -989,12 +989,14 @@ class CopilotSession {
    * Executes a permission handler and sends the result back via RPC.
    * @internal
    */
-  async _executePermissionAndRespond(requestId, permissionRequest) {
+  async _executePermissionAndRespond(requestId, permissionRequest, promptRequest) {
     try {
-      const handlerResult = await this.permissionHandler(permissionRequest, {
+      const invocation = {
         sessionId: this.sessionId,
-        managedSettingsEnabled: this.managedSettingsEnabled
-      });
+        managedSettingsEnabled: this.managedSettingsEnabled,
+        ...promptRequest === void 0 ? {} : { promptRequest }
+      };
+      const handlerResult = await this.permissionHandler(permissionRequest, invocation);
       const isAttributed = isAttributedPermissionResult(handlerResult);
       const result = isAttributed ? handlerResult.result : handlerResult;
       const decisionContext = isAttributed ? handlerResult.decisionContext : void 0;

package/dist/types.d.ts

@@ -988,10 +988,11 @@ import type { PermissionDecisionRequest, PermissionDecisionContext } from "./gen
  * access the variant-specific fields (e.g. shell `commands`, write
  * `fileName`/`diff`, mcp `toolName`/`args`).
  *
- * `managedApprovalRequired` indicates that managed policy requires an explicit
- * user decision. Hosts should bypass automatic approval and present their
- * normal confirmation UI. The runtime currently emits it for managed Shell,
- * Read, Edit, and Domain selector asks.
+ * On the raw `permissionRequest`, `managedApprovalRequired` preserves managed
+ * policy provenance and one-shot restrictions. To determine whether a human
+ * response is still required, hosts should prefer
+ * `event.data.promptRequest?.managedApprovalRequired` when `promptRequest` is
+ * present, and fall back to the raw marker for older runtimes.
  */
 export type PermissionRequest = GeneratedPermissionRequest & {
     readonly managedApprovalRequired?: boolean;
@@ -1036,10 +1037,23 @@ export declare function isAttributedPermissionResult(result: PermissionRequestRe
  * permission behavior.
  */
 export declare function createAttributedPermissionResult(result: PermissionRequestResult | AttributedPermissionResult, decisionContext: PermissionDecisionContext): AttributedPermissionResult;
-export type PermissionHandler = (request: PermissionRequest, invocation: {
+/**
+ * Context supplied with a permission request callback.
+ */
+export interface PermissionHandlerInvocation {
     sessionId: string;
     managedSettingsEnabled?: boolean;
-}) => Promise<PermissionRequestResult | AttributedPermissionResult> | PermissionRequestResult | AttributedPermissionResult;
+    /**
+     * Derived user-facing prompt context when supplied by the runtime.
+     *
+     * Managed requests retain their raw `managedApprovalRequired` marker. Only
+     * standard prompt kinds (`commands`, `read`, `write`, `url`, and
+     * `workflow`) can clear that human requirement after Assisted approval.
+     * For missing or other prompt kinds, keep the raw marker authoritative.
+     */
+    promptRequest?: PermissionRequestedData["promptRequest"];
+}
+export type PermissionHandler = (request: PermissionRequest, invocation: PermissionHandlerInvocation) => Promise<PermissionRequestResult | AttributedPermissionResult> | PermissionRequestResult | AttributedPermissionResult;
 /**
  * Approves permission requests when managed settings are disabled.
  */
@@ -1276,6 +1290,14 @@ export interface UserPromptSubmittedHookOutput {
     modifiedPrompt?: string;
     additionalContext?: string;
     suppressOutput?: boolean;
+    /**
+     * `"block"` refuses the prompt: no model turn runs, no user message is
+     * recorded, and the session emits an ephemeral `session.warning`
+     * (`warningType: "policy_blocked"`) carrying {@link reason}.
+     */
+    decision?: "block";
+    /** Why the prompt was blocked, carried by the `session.warning`. */
+    reason?: string;
 }
 /**
  * Handler for user-prompt-submitted hook

package/docs/agent-author.md

@@ -140,6 +140,8 @@ All handlers may return `void`/`undefined` (no-op) or an output object.
 |-------|------|--------|
 | `modifiedPrompt` | `string` | Replaces the user's prompt |
 | `additionalContext` | `string` | Appended as hidden context the agent sees |
+| `decision` | `"block"` | Refuses the prompt: no model turn runs and no user message is recorded |
+| `reason` | `string` | Why the prompt was blocked, carried by the ephemeral `session.warning` (`warningType: "policy_blocked"`) |
 
 ### onPreToolUse
 

package/package.json

@@ -5,8 +5,8 @@
         "url": "https://github.com/github/copilot-agent-runtime.git",
         "directory": "src/sdk/nodejs"
     },
-    "version": "1.0.22",
-    "copilotCliVersion": "1.0.98",
+    "version": "1.0.23-preview.1",
+    "copilotCliVersion": "1.0.99-1",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
@@ -44,6 +44,7 @@
         "prepare:runtime": "tsx scripts/prepare-runtime.ts",
         "test": "vitest run",
         "test:unit": "vitest run --exclude=\"test/e2e/**\"",
+        "test:codegen": "vitest run --exclude=\"test/e2e/**\" codegen.test.ts legacy-parameters.test.ts",
         "test:watch": "vitest",
         "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\" --ignore-path .prettierignore",
         "format:check": "prettier --check \"src/**/*.ts\" \"test/**/*.ts\" --ignore-path .prettierignore",
@@ -80,6 +81,7 @@
         "@typescript-eslint/parser": "^8.54.0",
         "esbuild": "^0.28.1",
         "eslint": "^9.0.0",
+        "file-entry-cache": "file:./scripts/eslint-file-cache",
         "glob": "^13.0.1",
         "hpke-js": "^1.8.0",
         "json-schema": "^0.4.0",
@@ -96,6 +98,9 @@
     "engines": {
         "node": "^20.19.0 || >=22.12.0"
     },
+    "overrides": {
+        "file-entry-cache": "$file-entry-cache"
+    },
     "files": [
         "dist/**/*",
         "!dist/tsconfig.tsbuildinfo",
@@ -103,18 +108,18 @@
         "README.md"
     ],
     "copilotRuntime": {
-        "sourceSha": "45ef16251c84707ee25a5bfe5a445a22aafb2878",
-        "version": "1.0.98",
+        "sourceSha": "7ea4e663f9dbacf776b91d6f8f2ff30b3a5b46eb",
+        "version": "1.0.99-1",
         "visibility": "public"
     },
     "optionalDependencies": {
-        "@github/copilot-sdk-darwin-arm64": "1.0.22",
-        "@github/copilot-sdk-darwin-x64": "1.0.22",
-        "@github/copilot-sdk-linux-arm64": "1.0.22",
-        "@github/copilot-sdk-linux-x64": "1.0.22",
-        "@github/copilot-sdk-linuxmusl-arm64": "1.0.22",
-        "@github/copilot-sdk-linuxmusl-x64": "1.0.22",
-        "@github/copilot-sdk-win32-arm64": "1.0.22",
-        "@github/copilot-sdk-win32-x64": "1.0.22"
+        "@github/copilot-sdk-darwin-arm64": "1.0.23-preview.1",
+        "@github/copilot-sdk-darwin-x64": "1.0.23-preview.1",
+        "@github/copilot-sdk-linux-arm64": "1.0.23-preview.1",
+        "@github/copilot-sdk-linux-x64": "1.0.23-preview.1",
+        "@github/copilot-sdk-linuxmusl-arm64": "1.0.23-preview.1",
+        "@github/copilot-sdk-linuxmusl-x64": "1.0.23-preview.1",
+        "@github/copilot-sdk-win32-arm64": "1.0.23-preview.1",
+        "@github/copilot-sdk-win32-x64": "1.0.23-preview.1"
     }
 }