@github/copilot-sdk 1.0.23-preview.1 → 1.0.23-preview.3

package/dist/cjs/cliVersion.js

@@ -22,7 +22,7 @@ __export(cliVersion_exports, {
   COPILOT_CLI_VERSION: () => COPILOT_CLI_VERSION
 });
 module.exports = __toCommonJS(cliVersion_exports);
-const COPILOT_CLI_VERSION = "1.0.99-1";
+const COPILOT_CLI_VERSION = "1.0.99-3";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/generated/rpc.js

@@ -761,6 +761,22 @@ function createServerRpc(connection) {
        * @returns Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
        */
       search: async (params) => connection.sendRequest("catalog.search", params),
+      /**
+       * Retrieves one saved feed by its opaque ID, optionally filtered by trust tier. Requires catalog-feeds and catalog-search-credential-required, and uses the same authority, credential policy, optional session binding and candidate projection as catalog.search, so available entries are the same inert candidates, with the same installability, handles and display metadata, and install through the same confirmed flows. Entries keep the feed's order; an entry the runtime cannot present is returned as unavailable with a reason rather than failing the feed. No anonymous retry. Read-only: nothing is installed, configured, or persisted.
+       *
+       * @param params Retrieves one saved feed by its opaque ID. Requires catalog-feeds and catalog-search-credential-required; add catalog-search-session-bound with policySessionId to retain the selected session's authority for installation, exactly as for catalog.search.
+       *
+       * @returns Outcome of catalog.getSavedFeed: the feed with its entries, or one typed refusal. An entry that cannot be presented never fails the feed.
+       */
+      getSavedFeed: async (params) => connection.sendRequest("catalog.getSavedFeed", params),
+      /**
+       * Retrieves one generated feed by strategy and key, such as telemetry/popular, optionally filtered by trust tier. Requires catalog-feeds and catalog-search-credential-required, and uses the same authority, credential policy, optional session binding and candidate projection as catalog.search, so available entries are the same inert candidates, with the same installability, handles and display metadata, and install through the same confirmed flows. Entries keep the feed's order; an entry the runtime cannot present is returned as unavailable with a reason rather than failing the feed. No anonymous retry. Read-only: nothing is installed, configured, or persisted.
+       *
+       * @param params Retrieves one generated feed, computed on every request, by strategy and key, such as `telemetry` and `popular`. Requires catalog-feeds and catalog-search-credential-required; add catalog-search-session-bound with policySessionId to retain the selected session's authority for installation, exactly as for catalog.search.
+       *
+       * @returns Outcome of catalog.getGeneratedFeed: the feed with its entries, or one typed refusal. An entry that cannot be presented never fails the feed.
+       */
+      getGeneratedFeed: async (params) => connection.sendRequest("catalog.getGeneratedFeed", params),
       /**
        * Terminates one retained catalog selection group. A selected outcome returns the native host a fresh single-use candidate handle plus the original searchId for a later explicit mcp.planInstall call; non-selected outcomes release the group without producing a planning input. Candidate state, cards, URLs, credentials and private identifiers remain inside the runtime. The model-facing catalog_select tool projects the result separately and never exposes the candidate handle or searchId.
        *
@@ -2755,6 +2771,14 @@ function createSessionRpc(connection, sessionId) {
        * @returns Progress information for the task, or null when no task with that ID is tracked.
        */
       getProgress: async (params) => connection.sendRequest("session.tasks.getProgress", { ...params, sessionId }),
+      /**
+       * Reads a detached shell task's output after a cursor, optionally waiting for new output or for the shell to finish.
+       *
+       * @param params Detached shell task to read output from, with an optional cursor and long-poll wait. waitMs defaults to zero (maximum 30000).
+       *
+       * @returns Output a detached shell task wrote after the request cursor, with the cursor for the next read.
+       */
+      readOutput: async (params) => connection.sendRequest("session.tasks.readOutput", { ...params, sessionId }),
       /**
        * Returns the first sync-waiting task that can currently be promoted to background mode.
        *

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.99-1";
+export declare const COPILOT_CLI_VERSION = "1.0.99-3";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.99-1";
+const COPILOT_CLI_VERSION = "1.0.99-3";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/generated/rpc.d.ts

@@ -992,7 +992,11 @@ export type CatalogCapability =
 /** Understands `installability`, the reviewable `installPlan` and the optional materialisation `handle` on Agent Plugin candidates, and the verified Agent Plugin installation APIs plugins.planInstall and plugins.applyInstall, and Agent Plugin plans from catalog.planInstallFromReference. Requires agent-plugin-discovery; without it, plugin candidates are unchanged. Advertised only by runtimes with the plugin installer linked; acquisition may still be refused as feature-disabled per selected session. */
  | "agent-plugin-confirmed-installation"
 /** Understands catalog.planInstallFromReference, which plans installing whatever resource an Agent Finder materialisation reference pins. It plans only kinds whose installation capability the caller also requires: skill-confirmed-installation for Skills, agent-plugin-confirmed-installation for Agent Plugins. Advertised only by runtimes with the Skill installation engine linked. */
- | "catalog-reference-installation";
+ | "catalog-reference-installation"
+/** Understands catalog.getSavedFeed and catalog.getGeneratedFeed, which retrieve a saved or generated feed with entries projected exactly like catalog.search candidates. Requires catalog-search-credential-required; add catalog-search-session-bound to bind the retrieval to a selected session. */
+ | "catalog-feeds"
+/** Understands the optional `categories` filter on catalog.search, which the runtime forwards to the catalog authority. Required to send the filter, so an older runtime refuses the request instead of silently returning unfiltered results. */
+ | "catalog-search-categories";
 /**
  * Bounded extensible wire-feature identifier. Known values are described by `CatalogCapability`; newer callers may send future identifiers so an older runtime can return a typed negotiation refusal instead of failing schema validation. Capability negotiation establishes contract understanding, while each operation's result separately reports runtime availability.
  *
@@ -1017,6 +1021,52 @@ export type CatalogContractViolationReason =
  | "duplicate-identity"
 /** A result declared no media type, or one this contract does not model. */
  | "unknown-media-type";
+/**
+ * Discriminator for an available feed entry
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogFeedAvailableStatus".
+ */
+/** @experimental */
+export type CatalogFeedAvailableStatus = "available";
+/**
+ * One feed entry, in its feed position. Only available entries carry a candidate.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogFeedEntry".
+ */
+/** @experimental */
+export type CatalogFeedEntry = CatalogFeedAvailableEntry | CatalogFeedUnavailableEntry | CatalogFeedFilteredEntry;
+/**
+ * Discriminator for an unavailable feed entry
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogFeedUnavailableStatus".
+ */
+/** @experimental */
+export type CatalogFeedUnavailableStatus = "unavailable";
+/**
+ * Why a feed entry cannot be presented
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogFeedUnavailableReason".
+ */
+/** @experimental */
+export type CatalogFeedUnavailableReason = 
+/** The identifier no longer resolves to a resource. */
+"not-found"
+/** The resource is of a kind this caller did not negotiate or this runtime does not support. */
+ | "unsupported-kind"
+/** The resource failed the same validation catalog.search applies, or repeats an earlier entry. */
+ | "invalid-resource";
+/**
+ * Discriminator for a feed entry filtered by trust tier
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogFeedFilteredStatus".
+ */
+/** @experimental */
+export type CatalogFeedFilteredStatus = "filtered";
 /**
  * Which kind of opaque handle was presented
  *
@@ -1082,7 +1132,13 @@ export type CatalogInvalidRequestField =
 /** The opaque selection reference was missing or malformed. */
  | "selectionRef"
 /** The terminal selection outcome was missing or unsupported. */
- | "outcome";
+ | "outcome"
+/** The saved feed ID, or the generated feed strategy or key, was missing or malformed. */
+ | "feed"
+/** The trust tier filter was empty, repeated a tier or named an unknown tier. */
+ | "trustTiers"
+/** The category filter was empty, too long, repeated a category or contained a value that is not a lowercase slug. */
+ | "categories";
 /**
  * How a card failed validation
  *
@@ -1231,6 +1287,12 @@ export type CatalogReferenceInstallationFailureReason =
  | "unsupported-resource"
 /** The resource's entrypoint could not be retrieved or verified. */
  | "entrypoint-unavailable"
+/** GitHub rate limited retrieval from the pinned public source. Retry after retryAfterSeconds when present. */
+ | "source-rate-limited"
+/** No GitHub sign-in or credential is available, so the caller must sign in. */
+ | "no-credential"
+/** Agent Finder refused the GitHub credential (HTTP 401, or a 403 without rate-limit evidence); the caller must sign in again. */
+ | "credential-rejected"
 /** The Skill entrypoint is not a valid Skill. */
  | "invalid-skill"
 /** The plugin manifest is not a valid plugin manifest, or the bundle has another manifest that would take precedence over the reviewed one. */
@@ -1262,6 +1324,10 @@ export type CatalogReferenceInstallationOutcome = {
     kind: "plugin-install-planned";
 } | {
     reason: CatalogReferenceInstallationFailureReason;
+    /**
+     * Whole seconds GitHub asked the caller to wait, present only with source-rate-limited.
+     */
+    retryAfterSeconds?: number;
     /**
      * Reference planning outcome discriminator naming the planned kind.
      */
@@ -1407,11 +1473,28 @@ export type PluginInstallationReview = {
      * when this exceeds 262144 UTF-8 bytes; it is never truncated.
      */
     manifestContent: string;
+    /**
+     * MCP servers the verified files declare, exactly as an install of these files loads
+     * them. Omitted when the plugin declares none.
+     */
+    mcpServers?: PluginInstallationMcpServerReview[];
     /**
      * Exact reviewed Agent Plugin installation action.
      */
     action: "install";
 };
+/**
+ * How a reviewed plugin's MCP server is reached.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PluginInstallationMcpTransport".
+ */
+/** @experimental */
+export type PluginInstallationMcpTransport = 
+/** An HTTP or SSE server reached over the network, which may ask the user to sign in. */
+"remote"
+/** A command the plugin runs on this machine. */
+ | "local";
 /**
  * Planning result for a materialisation reference with the honoured contract, or a typed refusal.
  *
@@ -1426,25 +1509,15 @@ export type CatalogReferenceInstallationResult = {
     kind: "outcome";
     outcome: CatalogReferenceInstallationOutcome;
     negotiated: CatalogNegotiatedContract;
-} | CatalogNegotiationRefusedError | CatalogInvalidRequestError;
-/**
- * Relationship of the backend-reported count to the complete query result set.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CatalogSearchTotalCountRelation".
- */
-/** @experimental */
-export type CatalogSearchTotalCountRelation = 
-/** No exact/full-query or lower-bound guarantee is available. */
-"unknown";
+} | CatalogNegotiationRefusedError | CatalogInvalidRequestError | CatalogNetworkFailureError;
 /**
- * Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+ * Outcome of catalog.getGeneratedFeed: the feed with its entries, or one typed refusal. An entry that cannot be presented never fails the feed.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CatalogSearchResult".
+ * via the `definition` "CatalogResourceGeneratedFeedResult".
  */
 /** @experimental */
-export type CatalogSearchResult = CatalogSearchSucceeded | CatalogNegotiationRefusedError | CatalogUnsupportedKindError | CatalogInvalidRequestError | CatalogAuthenticationRequiredError | CatalogPolicyRejectedError | CatalogNetworkFailureError | CatalogUnsafeRetrievalError | CatalogMalformedCardError | CatalogContractViolationError | CatalogUnavailableError;
+export type CatalogResourceGeneratedFeedResult = CatalogGetGeneratedFeedSucceeded | CatalogNegotiationRefusedError | CatalogInvalidRequestError | CatalogAuthenticationRequiredError | CatalogPolicyRejectedError | CatalogNetworkFailureError | CatalogUnsafeRetrievalError | CatalogMalformedCardError | CatalogUnavailableError;
 /**
  * Which hardened-fetch control refused a retrieval
  *
@@ -1482,7 +1555,35 @@ export type CatalogUnavailableReason =
 /** No catalog authority is configured for this runtime. */
  | "authority-not-configured"
 /** The surface is disabled by policy on this runtime. */
- | "disabled-by-policy";
+ | "disabled-by-policy"
+/** The requested saved feed, or generated feed strategy or key, does not exist. */
+ | "feed-not-found";
+/**
+ * Outcome of catalog.getSavedFeed: the feed with its entries, or one typed refusal. An entry that cannot be presented never fails the feed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogResourceSavedFeedResult".
+ */
+/** @experimental */
+export type CatalogResourceSavedFeedResult = CatalogGetSavedFeedSucceeded | CatalogNegotiationRefusedError | CatalogInvalidRequestError | CatalogAuthenticationRequiredError | CatalogPolicyRejectedError | CatalogNetworkFailureError | CatalogUnsafeRetrievalError | CatalogMalformedCardError | CatalogUnavailableError;
+/**
+ * Relationship of the backend-reported count to the complete query result set.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogSearchTotalCountRelation".
+ */
+/** @experimental */
+export type CatalogSearchTotalCountRelation = 
+/** No exact/full-query or lower-bound guarantee is available. */
+"unknown";
+/**
+ * Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogSearchResult".
+ */
+/** @experimental */
+export type CatalogSearchResult = CatalogSearchSucceeded | CatalogNegotiationRefusedError | CatalogUnsupportedKindError | CatalogInvalidRequestError | CatalogAuthenticationRequiredError | CatalogPolicyRejectedError | CatalogNetworkFailureError | CatalogUnsafeRetrievalError | CatalogMalformedCardError | CatalogContractViolationError | CatalogUnavailableError;
 /**
  * Terminal outcome declared for a retained catalog selection group
  *
@@ -2852,6 +2953,22 @@ export type SessionLogLevel =
  | "warning"
 /** Error message describing a failure. */
  | "error";
+/**
+ * Administrator-configured Ensemble preference, independent of execution support.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ManagedEnsembleTier".
+ */
+/** @experimental */
+export type ManagedEnsembleTier = 
+/** Balance efficiency and intelligence. */
+"balance"
+/** Prefer higher intelligence. */
+ | "high"
+/** Prefer maximum intelligence. */
+ | "max"
+/** Leave tier selection unmanaged without falling back to legacy Auto policy. */
+ | "unmanaged";
 /** @experimental */
 export type ManagedPermissionOperation = {
     /**
@@ -4441,6 +4558,12 @@ export type PluginInstallationFailureReason =
  | "payload-unavailable"
 /** The acquired files no longer match the reviewed descriptor. */
  | "payload-mismatch"
+/** GitHub rate limited retrieval from the pinned public source; nothing was installed. Retry after retryAfterSeconds when present. */
+ | "source-rate-limited"
+/** No GitHub sign-in or credential is available, so the caller must sign in. */
+ | "no-credential"
+/** Agent Finder refused the GitHub credential (HTTP 401, or a 403 without rate-limit evidence); the caller must sign in again. */
+ | "credential-rejected"
 /** Plugin installation storage or admission is busy. */
  | "busy"
 /** A plugin with the same name or install location already exists. */
@@ -4462,6 +4585,10 @@ export type PluginInstallationManagementOutcome = {
     kind: "install-planned";
 } | {
     reason: PluginInstallationFailureReason;
+    /**
+     * Whole seconds GitHub asked the caller to wait, present only with source-rate-limited.
+     */
+    retryAfterSeconds?: number;
     /**
      * Agent Plugin installation management outcome discriminator.
      */
@@ -4481,7 +4608,7 @@ export type PluginInstallationManagementResult = {
     kind: "outcome";
     outcome: PluginInstallationManagementOutcome;
     negotiated: CatalogNegotiatedContract;
-} | CatalogNegotiationRefusedError | CatalogInvalidRequestError;
+} | CatalogNegotiationRefusedError | CatalogInvalidRequestError | CatalogNetworkFailureError;
 /**
  * Terminal verified Agent Plugin installation result.
  *
@@ -4519,6 +4646,10 @@ export type PluginInstallationOutcome = {
      * Present once an operation has been allocated.
      */
     operationId?: string;
+    /**
+     * Whole seconds GitHub asked the caller to wait, present only with source-rate-limited.
+     */
+    retryAfterSeconds?: number;
     /**
      * Terminal Agent Plugin installation outcome discriminator.
      */
@@ -4538,7 +4669,7 @@ export type PluginInstallationResult = {
     kind: "outcome";
     outcome: PluginInstallationOutcome;
     negotiated: CatalogNegotiatedContract;
-} | CatalogNegotiationRefusedError | CatalogInvalidRequestError;
+} | CatalogNegotiationRefusedError | CatalogInvalidRequestError | CatalogNetworkFailureError;
 /**
  * Where completed plugin content was staged before atomic promotion.
  *
@@ -5457,6 +5588,12 @@ export type SkillInstallationFailureReason =
  | "payload-unavailable"
 /** The acquired payload no longer matches the reviewed descriptor. */
  | "payload-mismatch"
+/** GitHub rate limited retrieval from the pinned public source; nothing was installed. Retry after retryAfterSeconds when present. Reported only to callers that require catalog-reference-installation; others receive payload-unavailable. */
+ | "source-rate-limited"
+/** No GitHub sign-in or credential is available, so the caller must sign in. Reported only to callers that require catalog-reference-installation; others receive policy-context-unavailable. */
+ | "no-credential"
+/** Agent Finder refused the GitHub credential (HTTP 401, or a 403 without rate-limit evidence); the caller must sign in again. Reported only to callers that require catalog-reference-installation; others receive descriptor-unavailable. */
+ | "credential-rejected"
 /** The retained Skill source changed after planning. */
  | "source-changed"
 /** The selected runtime cannot inspect or control the requested lifecycle operation. */
@@ -5543,6 +5680,10 @@ export type SkillInstallationManagementOutcome = {
     kind: "enabled-changed";
 } | {
     reason: SkillInstallationFailureReason;
+    /**
+     * Whole seconds GitHub asked the caller to wait, present only with source-rate-limited.
+     */
+    retryAfterSeconds?: number;
     /**
      * Skill installation management outcome discriminator.
      */
@@ -5686,6 +5827,10 @@ export type SkillInstallationOutcome = {
      * Present once an operation has been allocated.
      */
     operationId?: string;
+    /**
+     * Whole seconds GitHub asked the caller to wait, present only with source-rate-limited.
+     */
+    retryAfterSeconds?: number;
     /**
      * Terminal Skill installation outcome discriminator.
      */
@@ -5705,7 +5850,7 @@ export type SkillInstallationManagementResult = {
     kind: "outcome";
     outcome: SkillInstallationManagementOutcome;
     negotiated: CatalogNegotiatedContract;
-} | CatalogNegotiationRefusedError | CatalogInvalidRequestError;
+} | CatalogNegotiationRefusedError | CatalogInvalidRequestError | CatalogNetworkFailureError;
 /**
  * Skill installation result with the honoured contract, or a typed request/negotiation refusal.
  *
@@ -5720,7 +5865,7 @@ export type SkillInstallationResult = {
     kind: "outcome";
     outcome: SkillInstallationOutcome;
     negotiated: CatalogNegotiatedContract;
-} | CatalogNegotiationRefusedError | CatalogInvalidRequestError;
+} | CatalogNegotiationRefusedError | CatalogInvalidRequestError | CatalogNetworkFailureError;
 /**
  * Result of invoking the slash command (text output, prompt to send to the agent, completion, or subcommand selection).
  *
@@ -8674,7 +8819,7 @@ export interface CatalogAgentPluginCandidate {
      * Publisher taken verbatim from the card. Inert untrusted text.
      */
     publisher?: string;
-    source: CatalogPluginRepositorySource;
+    source?: CatalogPluginRepositorySource;
     /**
      * Explicit validated compatibility tags, in canonical order. An empty list means the source declared no recognised compatibility; clients must not infer compatibility from other fields. `canvas-only` requires both `canvas` and `github-copilot`.
      *
@@ -8729,9 +8874,9 @@ export interface CatalogPluginRepositorySource {
      */
     repository: string;
     /**
-     * Case-preserving safe relative POSIX path derived from metadata.repoPath.
+     * Case-preserving safe relative POSIX path derived from metadata.repoPath. Absent when the catalog declared sourceSet without repoPath, meaning the plugin is at the repository root; only callers that require agent-plugin-confirmed-installation receive such a source.
      */
-    path: string;
+    path?: string;
 }
 /**
  * What installing an Agent Plugin would do, for the user to review and confirm. Provisional: the catalogue install data it is built from is not final.
@@ -8749,20 +8894,18 @@ export interface CatalogAgentPluginInstallPlan {
      */
     sources: [CatalogAgentPluginInstallSource] | [CatalogAgentPluginInstallSource, CatalogAgentPluginInstallSource] | [CatalogAgentPluginInstallSource, CatalogAgentPluginInstallSource, CatalogAgentPluginInstallSource];
     /**
-     * The plugin's name, as named in its marketplace or manifest.
+     * The plugin's name, as named in its marketplace or manifest. Omitted from a materialisation-only plan, whose sources are only `materialization`: the verified manifests supply the name in the plugins.planInstall review.
      */
-    pluginName: string;
+    pluginName?: string;
     version?: CatalogResourceVersion;
     /**
      * Exact full commit ID to install, in lowercase hex. Always present when the plan has a repository source; a plan with a marketplace source carries at least one of version and commit.
      */
     commit?: string;
     /**
-     * Components the plugin contributes, in canonical order.
-     *
-     * @minItems 1
+     * Components the plugin contributes, in canonical order. Empty only in a materialisation-only plan, where the verified manifests list them in the plugins.planInstall review.
      */
-    components: [CatalogAgentPluginComponent, ...CatalogAgentPluginComponent[]];
+    components: CatalogAgentPluginComponent[];
     /**
      * Canvas IDs the plugin contributes. Non-empty exactly when components include `canvas`.
      */
@@ -9181,6 +9324,215 @@ export interface CatalogContractViolationError {
      */
     message: string;
 }
+/**
+ * An entry whose resource resolves and is presented as the same candidate catalog.search would return.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogFeedAvailableEntry".
+ */
+/** @experimental */
+export interface CatalogFeedAvailableEntry {
+    status: CatalogFeedAvailableStatus;
+    /**
+     * The entry's resource identifier as saved in the feed.
+     */
+    identifier: string;
+    candidate: CatalogCandidate;
+}
+/**
+ * An entry that cannot be presented, kept in its position so clients decide how to render it.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogFeedUnavailableEntry".
+ */
+/** @experimental */
+export interface CatalogFeedUnavailableEntry {
+    status: CatalogFeedUnavailableStatus;
+    /**
+     * The entry's resource identifier as saved in the feed.
+     */
+    identifier: string;
+    reason: CatalogFeedUnavailableReason;
+}
+/**
+ * An entry whose resource resolves but is not in one of the requested trust tiers.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogFeedFilteredEntry".
+ */
+/** @experimental */
+export interface CatalogFeedFilteredEntry {
+    status: CatalogFeedFilteredStatus;
+    /**
+     * The entry's resource identifier as saved in the feed.
+     */
+    identifier: string;
+}
+/**
+ * A generated feed's identity. It has no version; generatedAt is its only freshness signal.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogGeneratedFeedDescription".
+ */
+/** @experimental */
+export interface CatalogGeneratedFeedDescription {
+    /**
+     * Generation strategy that was requested.
+     */
+    strategy: string;
+    /**
+     * Feed key that was requested.
+     */
+    key: string;
+    /**
+     * When the feed was computed, as reported by the authority. Omitted when the authority reports no valid timestamp.
+     */
+    generatedAt?: string;
+}
+/**
+ * Retrieves one generated feed, computed on every request, by strategy and key, such as `telemetry` and `popular`. Requires catalog-feeds and catalog-search-credential-required; add catalog-search-session-bound with policySessionId to retain the selected session's authority for installation, exactly as for catalog.search.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogGetGeneratedFeedRequest".
+ */
+/** @experimental */
+export interface CatalogGetGeneratedFeedRequest {
+    contract: CatalogClientContract;
+    /**
+     * Select an existing attached local session. Requires authenticated, session-bound catalogue support.
+     * The runtime never creates, resumes or reconfigures a session to honour this selector.
+     */
+    policySessionId?: string;
+    /**
+     * Generation strategy, such as `telemetry`.
+     */
+    strategy: string;
+    /**
+     * Feed key within the strategy, such as `popular`.
+     */
+    key: string;
+    /**
+     * Accept only resources currently assessed at one of these trust tiers. Entries whose resource is in another tier, or has none, are returned as filtered in their original position. Omit for an unfiltered feed.
+     *
+     * @minItems 1
+     * @maxItems 2
+     */
+    trustTiers?: [CatalogTrustTier] | [CatalogTrustTier, CatalogTrustTier];
+}
+/**
+ * A retrieved generated feed. Entries keep the feed's order and are never more than 100.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogGetGeneratedFeedSucceeded".
+ */
+/** @experimental */
+export interface CatalogGetGeneratedFeedSucceeded {
+    /**
+     * Discriminator: the feed was retrieved
+     */
+    kind: "succeeded";
+    /**
+     * Runtime-issued identifier for this retrieval, with the same meaning as a catalog.search searchId, so a plan can be tied to the feed that produced its candidate. Derived from no user, account, device or feed data.
+     */
+    searchId: string;
+    feed: CatalogGeneratedFeedDescription;
+    /**
+     * Feed entries in the feed's order.
+     *
+     * @maxItems 100
+     */
+    entries: CatalogFeedEntry[];
+    negotiated: CatalogNegotiatedContract;
+}
+/**
+ * The protocol version and capability set the runtime actually honoured for a successful catalog operation.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogNegotiatedContract".
+ */
+/** @experimental */
+export interface CatalogNegotiatedContract {
+    /**
+     * Protocol version of the runtime that served the request.
+     */
+    runtimeProtocolVersion: number;
+    /**
+     * Wire features the runtime understood for this operation. Includes the five original catalog capabilities and only explicitly requested supported additions, in supported order without duplicates. Capabilities that introduce new success-union variants or operations are therefore included only when explicitly required, preserving older protocol-v3 clients. Always a superset of the caller's required features, because any shortfall is a refusal instead. Operation availability remains a separate typed result.
+     */
+    grantedCapabilities: CatalogCapability[];
+}
+/**
+ * Retrieves one saved feed by its opaque ID. Requires catalog-feeds and catalog-search-credential-required; add catalog-search-session-bound with policySessionId to retain the selected session's authority for installation, exactly as for catalog.search.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogGetSavedFeedRequest".
+ */
+/** @experimental */
+export interface CatalogGetSavedFeedRequest {
+    contract: CatalogClientContract;
+    /**
+     * Select an existing attached local session. Requires authenticated, session-bound catalogue support.
+     * The runtime never creates, resumes or reconfigures a session to honour this selector.
+     */
+    policySessionId?: string;
+    /**
+     * Opaque saved feed ID. Treat it as an indivisible string.
+     */
+    feedId: string;
+    /**
+     * Accept only resources currently assessed at one of these trust tiers. Entries whose resource is in another tier, or has none, are returned as filtered in their original position. Omit for an unfiltered feed.
+     *
+     * @minItems 1
+     * @maxItems 2
+     */
+    trustTiers?: [CatalogTrustTier] | [CatalogTrustTier, CatalogTrustTier];
+}
+/**
+ * A retrieved saved feed. Entries keep the feed's order and are never more than 100.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogGetSavedFeedSucceeded".
+ */
+/** @experimental */
+export interface CatalogGetSavedFeedSucceeded {
+    /**
+     * Discriminator: the feed was retrieved
+     */
+    kind: "succeeded";
+    /**
+     * Runtime-issued identifier for this retrieval, with the same meaning as a catalog.search searchId, so a plan can be tied to the feed that produced its candidate. Derived from no user, account, device or feed data.
+     */
+    searchId: string;
+    feed: CatalogSavedFeedDescription;
+    /**
+     * Feed entries in the feed's order.
+     *
+     * @maxItems 100
+     */
+    entries: CatalogFeedEntry[];
+    negotiated: CatalogNegotiatedContract;
+}
+/**
+ * A saved feed's identity. Its version changes only when the feed's definition is replaced, not when a referenced resource changes.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogSavedFeedDescription".
+ */
+/** @experimental */
+export interface CatalogSavedFeedDescription {
+    /**
+     * Opaque feed ID.
+     */
+    id: string;
+    /**
+     * Feed name as saved by its creator. Inert untrusted text.
+     */
+    name: string;
+    /**
+     * Version of the saved feed definition.
+     */
+    version: number;
+}
 /**
  * A presented handle was not accepted. Handles are runtime-instance scoped, TTL-bound, and single-use, so each way of failing is reported distinctly.
  *
@@ -9270,23 +9622,6 @@ export interface CatalogMaterializationReference {
      */
     bundleDigest: string;
 }
-/**
- * The protocol version and capability set the runtime actually honoured for a successful catalog operation.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CatalogNegotiatedContract".
- */
-/** @experimental */
-export interface CatalogNegotiatedContract {
-    /**
-     * Protocol version of the runtime that served the request.
-     */
-    runtimeProtocolVersion: number;
-    /**
-     * Wire features the runtime understood for this operation. Includes the five original catalog capabilities and only explicitly requested supported additions, in supported order without duplicates. Capabilities that introduce new success-union variants or operations are therefore included only when explicitly required, preserving older protocol-v3 clients. Always a superset of the caller's required features, because any shortfall is a refusal instead. Operation availability remains a separate typed result.
-     */
-    grantedCapabilities: CatalogCapability[];
-}
 /**
  * The caller's protocol version or required capabilities cannot be honoured. Returned instead of a partial or ambiguous success.
  *
@@ -9461,6 +9796,12 @@ export interface InstallationCatalogueIdentity {
      */
     source: string;
     trustAtInstall?: CatalogTrustSnapshot;
+    /**
+     * HTTPS URL of the resource's icon on raw.githubusercontent.com, retained from the catalogue
+     * candidate. Untrusted external content: load it without credentials. Omitted when the
+     * candidate had none.
+     */
+    iconUrl?: string;
 }
 /**
  * Source identity retained from Agent Finder and the pinned GitHub descriptor.
@@ -9697,6 +10038,60 @@ export interface PluginInstallationFileReview {
      */
     digest: string;
 }
+/**
+ * One MCP server a reviewed plugin declares.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PluginInstallationMcpServerReview".
+ */
+/** @experimental */
+export interface PluginInstallationMcpServerReview {
+    /**
+     * Server name as the plugin declares it.
+     */
+    name: string;
+    transport: PluginInstallationMcpTransport;
+    /**
+     * Host of a remote server's URL.
+     */
+    host?: string;
+}
+/**
+ * Retrieval was refused by the runtime's hardened fetch boundary before any request left the process, or before a redirect was followed.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogUnsafeRetrievalError".
+ */
+/** @experimental */
+export interface CatalogUnsafeRetrievalError {
+    /**
+     * Discriminator: retrieval was refused as unsafe
+     */
+    kind: "unsafe-retrieval";
+    reason: CatalogUnsafeRetrievalReason;
+    /**
+     * Human-readable explanation, safe to surface. Never contains the refused URL, nor a query, handle, or secret.
+     */
+    message: string;
+}
+/**
+ * The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CatalogUnavailableError".
+ */
+/** @experimental */
+export interface CatalogUnavailableError {
+    /**
+     * Discriminator: the operation is not available
+     */
+    kind: "unavailable";
+    reason: CatalogUnavailableReason;
+    /**
+     * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
+     */
+    message: string;
+}
 /**
  * An explicit numbered-page request. SDK consumers treat the token as opaque. For bound search, the runtime unwraps an expiring owner-bound reference to the private authority token; only the runtime changes the authority token's targetPage. Legacy unbound navigation keeps its authority-issued token semantics. No snapshot stability is promised.
  *
@@ -9781,6 +10176,13 @@ export interface CatalogSearchRequest {
      * @maxItems 3
      */
     kinds?: [CatalogCandidateKind] | [CatalogCandidateKind, CatalogCandidateKind] | [CatalogCandidateKind, CatalogCandidateKind, CatalogCandidateKind];
+    /**
+     * Restrict results to resources in at least one of these server-defined workflow categories, such as `design` or `test`. Requires the `catalog-search-categories` capability. Each value is a lowercase slug; the known set is not exhaustive, and a category the server does not recognise matches nothing. Omit to search every category.
+     *
+     * @minItems 1
+     * @maxItems 10
+     */
+    categories?: [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string, string, string];
     page?: CatalogSearchPage;
 }
 /**
@@ -9837,42 +10239,6 @@ export interface CatalogUnsupportedKindError {
      */
     message: string;
 }
-/**
- * Retrieval was refused by the runtime's hardened fetch boundary before any request left the process, or before a redirect was followed.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CatalogUnsafeRetrievalError".
- */
-/** @experimental */
-export interface CatalogUnsafeRetrievalError {
-    /**
-     * Discriminator: retrieval was refused as unsafe
-     */
-    kind: "unsafe-retrieval";
-    reason: CatalogUnsafeRetrievalReason;
-    /**
-     * Human-readable explanation, safe to surface. Never contains the refused URL, nor a query, handle, or secret.
-     */
-    message: string;
-}
-/**
- * The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CatalogUnavailableError".
- */
-/** @experimental */
-export interface CatalogUnavailableError {
-    /**
-     * Discriminator: the operation is not available
-     */
-    kind: "unavailable";
-    reason: CatalogUnavailableReason;
-    /**
-     * Human-readable explanation, safe to surface. Never contains a query, URL, handle, or secret.
-     */
-    message: string;
-}
 /**
  * The caller cancelled the selection interaction and the retained search state was released.
  *
@@ -14194,6 +14560,32 @@ export interface InstalledPluginInfo {
      * Whether the managed desired plugin currently has an installed or live record. Set to false for a managed desired entry retained in the listing after installation or reconciliation failed.
      */
     installed?: boolean;
+    /**
+     * Description from the manifest of the installed copy. Present only for a direct install pinned to one GitHub commit, such as a verified install from GitHub.
+     */
+    description?: string;
+    verifiedSource?: InstalledPluginVerifiedSource;
+    /**
+     * HTTPS URL of the plugin's icon on raw.githubusercontent.com, retained from the catalogue entry it was installed from. Untrusted external content: load it without credentials. Present only for a direct install pinned to one GitHub commit whose catalogue entry had an icon.
+     */
+    iconUrl?: string;
+}
+/**
+ * The GitHub repository and commit an installed plugin is pinned to.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "InstalledPluginVerifiedSource".
+ */
+/** @experimental */
+export interface InstalledPluginVerifiedSource {
+    /**
+     * GitHub repository in `owner/repo` form.
+     */
+    repository: string;
+    /**
+     * Full 40-character hexadecimal commit SHA the plugin is pinned to.
+     */
+    revision: string;
 }
 /**
  * Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.
@@ -14892,6 +15284,7 @@ export interface ManagedSettingsValues {
      */
     model?: string;
     autoTier?: AutoTier;
+    ensembleTier?: ManagedEnsembleTier;
     /**
      * Managed reasoning-effort default for the managed concrete model. The runtime clamps it to an entitled effort when model availability is known.
      */
@@ -14908,6 +15301,7 @@ export interface ManagedSettingsValues {
 export interface ManagedSettingsMeta {
     model?: ManagedSettingMeta;
     autoTier?: ManagedSettingMeta;
+    ensembleTier?: ManagedSettingMeta;
     effortLevel?: ManagedSettingMeta;
     contextTier?: ManagedSettingMeta;
 }
@@ -25396,6 +25790,10 @@ export interface SessionOpenOptions {
      * @experimental
      */
     additionalContentExclusionPolicies?: SessionOpenOptionsAdditionalContentExclusionPolicy[];
+    /**
+     * Live gate for repository-origin file hooks, including the primary repository, trusted repository-configured roots, and accepted startup additional directories (including CLI --add-dir). False suppresses these hooks; explicit hookDirectories and SDK callbacks are independent. Additional-root eligibility and the DISABLE_ADDITIONAL_DIRECTORY_HOOKS escape hatch are captured at create/cold resume, not expanded by later grants or feature-flag changes. Discovery uses containing Git roots, so supply only trusted repositories: commands and prompts need no further approval. Policy, hook-disable settings, and sandbox rules still apply. Provider-backed sessions skip repository hooks with a warning on omission, skip silently on false, and reject explicit true.
+     */
+    enableFileHooks?: boolean;
     memory?: MemoryConfiguration;
     /**
      * Capabilities enabled for this session.
@@ -28496,6 +28894,20 @@ export interface TasksGetProgressResult {
      */
     progress?: TaskProgress | null;
 }
+/**
+ * How a shell task ended, reported with the read that reaches the end of its output.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TaskShellOutputExit".
+ */
+/** @experimental */
+export interface TaskShellOutputExit {
+    status: TaskStatus;
+    /**
+     * Process exit code, when the runtime recorded one. Absent when the shell was stopped before reporting an exit code.
+     */
+    exitCode?: number;
+}
 /**
  * The promoted task as it now exists in background mode, omitted if no promotable task was waiting.
  *
@@ -28532,6 +28944,45 @@ export interface TasksPromoteToBackgroundResult {
      */
     promoted: boolean;
 }
+/**
+ * Detached shell task to read output from, with an optional cursor and long-poll wait. waitMs defaults to zero (maximum 30000).
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TasksReadOutputRequest".
+ */
+/** @experimental */
+export interface TasksReadOutputRequest {
+    /**
+     * Identifier of a detached shell task, as returned by tasks.list
+     */
+    id: string;
+    /**
+     * Opaque cursor returned by an earlier read of the same task. Omit to read from the beginning of the shell's output. If the output no longer reaches the cursor, for example because its log was removed, the request fails; read again without a cursor.
+     */
+    cursor?: string;
+    /**
+     * Milliseconds to wait for new output, or for the shell to finish, when the cursor is already at the end of the available output. 0 (default) returns immediately. Capped at 30000ms.
+     */
+    waitMs?: number;
+}
+/**
+ * Output a detached shell task wrote after the request cursor, with the cursor for the next read.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "TasksReadOutputResult".
+ */
+/** @experimental */
+export interface TasksReadOutputResult {
+    /**
+     * Output after the request cursor, decoded as UTF-8 and redacted. At most 64 KiB per read, so a large backlog takes several reads; the text never splits a character, and text that stops before the end of the output ends at a line break when it contains one. Empty when no new output is available. Detached shells write stdout and stderr to one output, so the text does not separate them.
+     */
+    text: string;
+    /**
+     * Opaque cursor to pass to the next read of this task. Always present, even when no output was returned.
+     */
+    cursor: string;
+    exit?: TaskShellOutputExit;
+}
 /**
  * Refresh metadata for any detached background shells the runtime knows about. Use after a long pause to pick up exit/output state for shells running outside the agent loop.
  *
@@ -33283,6 +33734,22 @@ export declare function createServerRpc(connection: MessageConnection): {
          * @returns Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
          */
         search: (params: CatalogSearchRequest) => Promise<CatalogSearchResult>;
+        /**
+         * Retrieves one saved feed by its opaque ID, optionally filtered by trust tier. Requires catalog-feeds and catalog-search-credential-required, and uses the same authority, credential policy, optional session binding and candidate projection as catalog.search, so available entries are the same inert candidates, with the same installability, handles and display metadata, and install through the same confirmed flows. Entries keep the feed's order; an entry the runtime cannot present is returned as unavailable with a reason rather than failing the feed. No anonymous retry. Read-only: nothing is installed, configured, or persisted.
+         *
+         * @param params Retrieves one saved feed by its opaque ID. Requires catalog-feeds and catalog-search-credential-required; add catalog-search-session-bound with policySessionId to retain the selected session's authority for installation, exactly as for catalog.search.
+         *
+         * @returns Outcome of catalog.getSavedFeed: the feed with its entries, or one typed refusal. An entry that cannot be presented never fails the feed.
+         */
+        getSavedFeed: (params: CatalogGetSavedFeedRequest) => Promise<CatalogResourceSavedFeedResult>;
+        /**
+         * Retrieves one generated feed by strategy and key, such as telemetry/popular, optionally filtered by trust tier. Requires catalog-feeds and catalog-search-credential-required, and uses the same authority, credential policy, optional session binding and candidate projection as catalog.search, so available entries are the same inert candidates, with the same installability, handles and display metadata, and install through the same confirmed flows. Entries keep the feed's order; an entry the runtime cannot present is returned as unavailable with a reason rather than failing the feed. No anonymous retry. Read-only: nothing is installed, configured, or persisted.
+         *
+         * @param params Retrieves one generated feed, computed on every request, by strategy and key, such as `telemetry` and `popular`. Requires catalog-feeds and catalog-search-credential-required; add catalog-search-session-bound with policySessionId to retain the selected session's authority for installation, exactly as for catalog.search.
+         *
+         * @returns Outcome of catalog.getGeneratedFeed: the feed with its entries, or one typed refusal. An entry that cannot be presented never fails the feed.
+         */
+        getGeneratedFeed: (params: CatalogGetGeneratedFeedRequest) => Promise<CatalogResourceGeneratedFeedResult>;
         /**
          * Terminates one retained catalog selection group. A selected outcome returns the native host a fresh single-use candidate handle plus the original searchId for a later explicit mcp.planInstall call; non-selected outcomes release the group without producing a planning input. Candidate state, cards, URLs, credentials and private identifiers remain inside the runtime. The model-facing catalog_select tool projects the result separately and never exposes the candidate handle or searchId.
          *
@@ -34399,6 +34866,14 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns Progress information for the task, or null when no task with that ID is tracked.
          */
         getProgress: (params: TasksGetProgressRequest) => Promise<TasksGetProgressResult>;
+        /**
+         * Reads a detached shell task's output after a cursor, optionally waiting for new output or for the shell to finish.
+         *
+         * @param params Detached shell task to read output from, with an optional cursor and long-poll wait. waitMs defaults to zero (maximum 30000).
+         *
+         * @returns Output a detached shell task wrote after the request cursor, with the cursor for the next read.
+         */
+        readOutput: (params: TasksReadOutputRequest) => Promise<TasksReadOutputResult>;
         /**
          * Returns the first sync-waiting task that can currently be promoted to background mode.
          *

package/dist/generated/rpc.js

@@ -733,6 +733,22 @@ function createServerRpc(connection) {
        * @returns Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
        */
       search: async (params) => connection.sendRequest("catalog.search", params),
+      /**
+       * Retrieves one saved feed by its opaque ID, optionally filtered by trust tier. Requires catalog-feeds and catalog-search-credential-required, and uses the same authority, credential policy, optional session binding and candidate projection as catalog.search, so available entries are the same inert candidates, with the same installability, handles and display metadata, and install through the same confirmed flows. Entries keep the feed's order; an entry the runtime cannot present is returned as unavailable with a reason rather than failing the feed. No anonymous retry. Read-only: nothing is installed, configured, or persisted.
+       *
+       * @param params Retrieves one saved feed by its opaque ID. Requires catalog-feeds and catalog-search-credential-required; add catalog-search-session-bound with policySessionId to retain the selected session's authority for installation, exactly as for catalog.search.
+       *
+       * @returns Outcome of catalog.getSavedFeed: the feed with its entries, or one typed refusal. An entry that cannot be presented never fails the feed.
+       */
+      getSavedFeed: async (params) => connection.sendRequest("catalog.getSavedFeed", params),
+      /**
+       * Retrieves one generated feed by strategy and key, such as telemetry/popular, optionally filtered by trust tier. Requires catalog-feeds and catalog-search-credential-required, and uses the same authority, credential policy, optional session binding and candidate projection as catalog.search, so available entries are the same inert candidates, with the same installability, handles and display metadata, and install through the same confirmed flows. Entries keep the feed's order; an entry the runtime cannot present is returned as unavailable with a reason rather than failing the feed. No anonymous retry. Read-only: nothing is installed, configured, or persisted.
+       *
+       * @param params Retrieves one generated feed, computed on every request, by strategy and key, such as `telemetry` and `popular`. Requires catalog-feeds and catalog-search-credential-required; add catalog-search-session-bound with policySessionId to retain the selected session's authority for installation, exactly as for catalog.search.
+       *
+       * @returns Outcome of catalog.getGeneratedFeed: the feed with its entries, or one typed refusal. An entry that cannot be presented never fails the feed.
+       */
+      getGeneratedFeed: async (params) => connection.sendRequest("catalog.getGeneratedFeed", params),
       /**
        * Terminates one retained catalog selection group. A selected outcome returns the native host a fresh single-use candidate handle plus the original searchId for a later explicit mcp.planInstall call; non-selected outcomes release the group without producing a planning input. Candidate state, cards, URLs, credentials and private identifiers remain inside the runtime. The model-facing catalog_select tool projects the result separately and never exposes the candidate handle or searchId.
        *
@@ -2727,6 +2743,14 @@ function createSessionRpc(connection, sessionId) {
        * @returns Progress information for the task, or null when no task with that ID is tracked.
        */
       getProgress: async (params) => connection.sendRequest("session.tasks.getProgress", { ...params, sessionId }),
+      /**
+       * Reads a detached shell task's output after a cursor, optionally waiting for new output or for the shell to finish.
+       *
+       * @param params Detached shell task to read output from, with an optional cursor and long-poll wait. waitMs defaults to zero (maximum 30000).
+       *
+       * @returns Output a detached shell task wrote after the request cursor, with the cursor for the next read.
+       */
+      readOutput: async (params) => connection.sendRequest("session.tasks.readOutput", { ...params, sessionId }),
       /**
        * Returns the first sync-waiting task that can currently be promoted to background mode.
        *

package/dist/generated/session-events.d.ts

@@ -786,6 +786,14 @@ export type AssistantUsageApiEndpoint =
  | "/responses"
 /** WebSocket Responses API endpoint. */
  | "ws:/responses";
+/**
+ * How the runtime fell back to an uncompressed request body after a compressed body was rejected
+ */
+export type ModelCallRequestBodyCompressionFallback = 
+/** A compressed body was rejected with HTTP 400 or 415 and this outcome comes from the single uncompressed resend. */
+"retried"
+/** Request body compression was already turned off for the session by an earlier rejection, so the body was sent uncompressed. */
+ | "disabled";
 /**
  * Content-Encoding applied to the request body sent on the wire
  */
@@ -6777,6 +6785,12 @@ export interface AssistantUsageData {
      * Serialized (uncompressed) byte length of the request body, before any Content-Encoding. A content-free size signal.
      */
     requestBodyBytes?: number;
+    requestBodyCompressionFallback?: ModelCallRequestBodyCompressionFallback;
+    requestBodyCompressionFallbackFrom?: ModelCallRequestBodyEncoding;
+    /**
+     * HTTP status that rejected the compressed body before the uncompressed resend; present only when requestBodyCompressionFallback is retried
+     */
+    requestBodyCompressionRejectedStatus?: number;
     requestBodyEncoding?: ModelCallRequestBodyEncoding;
     /**
      * Byte length of the request body actually sent on the wire for the attempt that produced this outcome, after any Content-Encoding. Equals requestBodyBytes when the body was not compressed.
@@ -6988,6 +7002,12 @@ export interface ModelCallFailureData {
      * Serialized (uncompressed) byte length of the failed request body, before any Content-Encoding. A content-free size signal.
      */
     requestBodyBytes?: number;
+    requestBodyCompressionFallback?: ModelCallRequestBodyCompressionFallback;
+    requestBodyCompressionFallbackFrom?: ModelCallRequestBodyEncoding;
+    /**
+     * HTTP status that rejected the compressed body before the uncompressed resend; present only when requestBodyCompressionFallback is retried
+     */
+    requestBodyCompressionRejectedStatus?: number;
     requestBodyEncoding?: ModelCallRequestBodyEncoding;
     /**
      * Byte length of the failed request body actually sent on the wire, after any Content-Encoding. Equals requestBodyBytes when the body was not compressed.
@@ -7444,6 +7464,12 @@ export interface ToolShellOutputEvent {
  * Live, append-only shell output. Not persisted or replayed to late subscribers. Text is decoded and redacted per chunk; chunks need not contain complete lines.
  */
 export interface ToolShellOutputData {
+    /**
+     * Experimental HydraFusion attribution of the staged phase whose tool call produced this output. Absent outside a staged phase.
+     *
+     * @experimental
+     */
+    fusion?: FusionAttribution;
     /**
      * Zero-based publication sequence across all output streams for this tool call. Not a byte offset or an OS write-order guarantee.
      */
@@ -9280,6 +9306,12 @@ export interface PermissionRequestedEvent {
  */
 export interface PermissionRequestedData {
     agentMode?: SessionMode;
+    /**
+     * Experimental HydraFusion attribution of the staged phase whose tool call raised this request. Absent outside a staged phase.
+     *
+     * @experimental
+     */
+    fusion?: FusionAttribution;
     /**
      * Delegated agent that owns permission recovery when the owner session multiplexes remote agents. Absent otherwise.
      */

package/package.json

@@ -5,8 +5,8 @@
         "url": "https://github.com/github/copilot-agent-runtime.git",
         "directory": "src/sdk/nodejs"
     },
-    "version": "1.0.23-preview.1",
-    "copilotCliVersion": "1.0.99-1",
+    "version": "1.0.23-preview.3",
+    "copilotCliVersion": "1.0.99-3",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
@@ -54,6 +54,7 @@
         "generate": "cd ../scripts/codegen && npm run generate",
         "set:cli-version": "node scripts/set-cli-version.js",
         "update:protocol-version": "tsx scripts/update-protocol-version.ts",
+        "vendor:tools": "tsx scripts/vendor-build-tools.ts",
         "prepublishOnly": "npm run build",
         "package": "npm run clean && npm run build && node scripts/set-version.js && npm run pack:release && npm version 0.0.0-dev --no-git-tag-version --allow-same-version"
     },
@@ -72,6 +73,7 @@
         "zod": "4.3.6"
     },
     "devDependencies": {
+        "@hpke/core": "^1.9.0",
         "@microsoft/agent-host-protocol-v09": "npm:@microsoft/agent-host-protocol@0.9.0",
         "@platformatic/vfs": "^0.3.0",
         "@types/node": "^25.2.0",
@@ -83,24 +85,26 @@
         "eslint": "^9.0.0",
         "file-entry-cache": "file:./scripts/eslint-file-cache",
         "glob": "^13.0.1",
-        "hpke-js": "^1.8.0",
         "json-schema": "^0.4.0",
         "json-schema-to-typescript": "^15.0.4",
-        "prettier": "^3.8.1",
+        "prettier": "file:../../../third_party/build-tools/prettier-3.8.1",
         "rimraf": "^6.1.2",
         "semver": "^7.7.3",
         "tar": "^7.5.22",
-        "tsx": "^4.20.6",
+        "tsx": "file:../../../third_party/build-tools/tsx-4.22.4",
         "typescript": "^5.0.0",
+        "vite": "file:../../../third_party/build-tools/vite-8.3.4",
         "vitest": "^4.1.11",
         "ws": "^8.21.0"
     },
+    "overrides": {
+        "file-entry-cache": "$file-entry-cache",
+        "prettier": "$prettier",
+        "vite": "$vite"
+    },
     "engines": {
         "node": "^20.19.0 || >=22.12.0"
     },
-    "overrides": {
-        "file-entry-cache": "$file-entry-cache"
-    },
     "files": [
         "dist/**/*",
         "!dist/tsconfig.tsbuildinfo",
@@ -108,18 +112,18 @@
         "README.md"
     ],
     "copilotRuntime": {
-        "sourceSha": "7ea4e663f9dbacf776b91d6f8f2ff30b3a5b46eb",
-        "version": "1.0.99-1",
+        "sourceSha": "a408f87a893e2126164b60ef936972cfca65dcf2",
+        "version": "1.0.99-3",
         "visibility": "public"
     },
     "optionalDependencies": {
-        "@github/copilot-sdk-darwin-arm64": "1.0.23-preview.1",
-        "@github/copilot-sdk-darwin-x64": "1.0.23-preview.1",
-        "@github/copilot-sdk-linux-arm64": "1.0.23-preview.1",
-        "@github/copilot-sdk-linux-x64": "1.0.23-preview.1",
-        "@github/copilot-sdk-linuxmusl-arm64": "1.0.23-preview.1",
-        "@github/copilot-sdk-linuxmusl-x64": "1.0.23-preview.1",
-        "@github/copilot-sdk-win32-arm64": "1.0.23-preview.1",
-        "@github/copilot-sdk-win32-x64": "1.0.23-preview.1"
+        "@github/copilot-sdk-darwin-arm64": "1.0.23-preview.3",
+        "@github/copilot-sdk-darwin-x64": "1.0.23-preview.3",
+        "@github/copilot-sdk-linux-arm64": "1.0.23-preview.3",
+        "@github/copilot-sdk-linux-x64": "1.0.23-preview.3",
+        "@github/copilot-sdk-linuxmusl-arm64": "1.0.23-preview.3",
+        "@github/copilot-sdk-linuxmusl-x64": "1.0.23-preview.3",
+        "@github/copilot-sdk-win32-arm64": "1.0.23-preview.3",
+        "@github/copilot-sdk-win32-x64": "1.0.23-preview.3"
     }
 }