@github/copilot-sdk 1.0.28 → 1.0.29-preview.1

package/dist/client.js

@@ -9,7 +9,7 @@ import {
   ResponseError,
   StreamMessageReader,
   StreamMessageWriter
-} from "vscode-jsonrpc/node.js";
+} from "vscode-jsonrpc/node";
 import {
   createServerRpc,
   createInternalServerRpc,
@@ -28,6 +28,7 @@ import { createCopilotRequestAdapter } from "./copilotRequestHandler.js";
 import {
   createInstallationConfirmationAdapter
 } from "./installationConfirmation.js";
+import { registerEntraTokenProvider } from "./entra.js";
 import { getTraceContext } from "./telemetry.js";
 import { toJsonSchema } from "./schema.js";
 import { ToolSet } from "./toolSet.js";
@@ -130,6 +131,30 @@ async function waitForChildExit(child, timeoutMs) {
     }
   });
 }
+async function acquireKerberosToken(connection, callback, request, token) {
+  const ended = () => token.isCancellationRequested ? new ResponseError(-32800, "Kerberos auth request cancelled") : new Error("Kerberos auth connection closed");
+  if (token.isCancellationRequested) {
+    throw ended();
+  }
+  const controller = new AbortController();
+  const abandoned = new Promise((_resolve, reject) => {
+    controller.signal.addEventListener("abort", () => reject(ended()), { once: true });
+  });
+  const abort = () => controller.abort();
+  const subscriptions = [
+    token.onCancellationRequested(abort),
+    connection.onClose(abort),
+    connection.onDispose(abort)
+  ];
+  try {
+    const lookup = Promise.resolve().then(() => callback(request, controller.signal));
+    return { token: await Promise.race([lookup, abandoned]) };
+  } finally {
+    for (const subscription of subscriptions) {
+      subscription.dispose();
+    }
+  }
+}
 const DEFAULT_PROVIDER_NAME = "default";
 function extractBearerTokenProviders(provider, providers) {
   const callbacks = /* @__PURE__ */ new Map();
@@ -307,6 +332,7 @@ class CopilotClient {
   sessionFsConfig = null;
   requestHandler = null;
   extensionLaunchProvider;
+  kerberosAuth;
   installationConfirmationHandler;
   builtinPluginDirectories = [];
   onGitHubTelemetry;
@@ -466,6 +492,7 @@ class CopilotClient {
     this.sessionFsConfig = options.sessionFs ?? null;
     this.requestHandler = options.requestHandler ?? null;
     this.extensionLaunchProvider = options.extensionLaunchProvider;
+    this.kerberosAuth = options.kerberosAuth;
     this.installationConfirmationHandler = options.installationConfirmationHandler;
     this.onGitHubTelemetry = options.onGitHubTelemetry;
     this.setupClientGlobalHandlers();
@@ -481,7 +508,7 @@ class CopilotClient {
     const connArgs = conn.kind === "stdio" || conn.kind === "tcp" ? conn.args ?? [] : [];
     this.connectionExtraArgs = [...connArgs];
     this.options = {
-      entra: options.entra ? { ...options.entra } : void 0,
+      entra: options.entra ? { ...options.entra, tokenProvider: options.entra.tokenProvider } : void 0,
       workingDirectory: options.workingDirectory ?? process.cwd(),
       logLevel: options.logLevel,
       gitHubToken: options.gitHubToken,
@@ -570,6 +597,11 @@ class CopilotClient {
         "SessionFsConfig declares capabilities.binary but the provider does not implement readFileBytes and writeFileBytes."
       );
     }
+    if (this.sessionFsConfig.capabilities?.readFileRange && !provider.readFileRange) {
+      throw new Error(
+        "SessionFsConfig declares capabilities.readFileRange but the provider does not implement readFileRange."
+      );
+    }
     session.clientSessionApis.sessionFs = createSessionFsAdapter(provider);
   }
   setupClientGlobalHandlers() {
@@ -704,6 +736,10 @@ class CopilotClient {
       }
       await this.connectToServer();
       await this.verifyProtocolVersion();
+      if (this.kerberosAuth) {
+        const { mode, scope } = this.kerberosAuth;
+        await this.rpc.kerberosAuth.setProvider(scope ? { mode, scope } : { mode });
+      }
       if (this.extensionLaunchProvider) {
         await this.rpc.registerExtensionLaunchProvider();
       }
@@ -1218,7 +1254,7 @@ class CopilotClient {
     if (config.cloud != null && config.skillProvider) {
       throw new Error("Skill providers are not supported for cloud sessions.");
     }
-    if (!this.connection) {
+    if (!this.connection || this.startPromise) {
       await this.start();
     }
     const modeDefaults = this.configDefaultsForMode();
@@ -1372,6 +1408,7 @@ class CopilotClient {
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
         ...config.diagnostics !== void 0 ? { diagnostics: config.diagnostics } : {},
+        ...config.lifecycleDiagnostics !== void 0 ? { lifecycleDiagnostics: config.lifecycleDiagnostics } : {},
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
         authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
@@ -1509,7 +1546,7 @@ class CopilotClient {
     if (config.gitHubToken !== void 0 && config.gitHubTokenProvider !== void 0) {
       throw new Error("gitHubToken and gitHubTokenProvider are mutually exclusive");
     }
-    if (!this.connection) {
+    if (!this.connection || this.startPromise) {
       await this.start();
     }
     const session = new CopilotSession(
@@ -1657,6 +1694,7 @@ class CopilotClient {
         ...this.onGitHubTelemetry != null ? { enableGitHubTelemetryForwarding: true } : {},
         mcpServers: toWireMcpServers(config.mcpServers),
         ...config.diagnostics !== void 0 ? { diagnostics: config.diagnostics } : {},
+        ...config.lifecycleDiagnostics !== void 0 ? { lifecycleDiagnostics: config.lifecycleDiagnostics } : {},
         mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
         authClientIdMetadataUrl: config.authClientIdMetadataUrl,
         envValueMode: "direct",
@@ -2087,7 +2125,11 @@ class CopilotClient {
     let serverVersion;
     try {
       const connectParams = {
-        entra: this.options.entra,
+        entra: this.options.entra && {
+          clientId: this.options.entra.clientId,
+          matsAppName: this.options.entra.matsAppName
+        },
+        entraTokenProvider: this.options.entra?.tokenProvider ? true : void 0,
         token: this.effectiveConnectionToken,
         supportedTaskKinds: ["agent", "client", "shell"]
       };
@@ -2099,6 +2141,9 @@ class CopilotClient {
         connectParams.clientInfo = clientInfo;
       }
       const result = await raceAgainstExit(this.internalRpc.connect(connectParams));
+      if (this.options.entra?.tokenProvider && result.entraTokenProvider !== true) {
+        throw new Error("This runtime does not support host-owned Entra token providers.");
+      }
       serverVersion = result.protocolVersion;
     } catch (err) {
       if (err instanceof ResponseError && (err.code === ErrorCodes.MethodNotFound || err.message === "Unhandled method connect")) {
@@ -2355,8 +2400,10 @@ class CopilotClient {
       if (t.filePath !== void 0) env.COPILOT_OTEL_FILE_EXPORTER_PATH = t.filePath;
       if (t.exporterType !== void 0) env.COPILOT_OTEL_EXPORTER_TYPE = t.exporterType;
       if (t.sourceName !== void 0) env.COPILOT_OTEL_SOURCE_NAME = t.sourceName;
-      if (t.captureContent !== void 0)
+      if (t.captureContent !== void 0) {
+        env.OTEL_INSTRUMENTATION_GENAI_CAPTURE_CONTENT = t.captureContent ? "SPAN_ONLY" : "NO_CONTENT";
         env.OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT = String(t.captureContent);
+      }
     }
     return env;
   }
@@ -2737,6 +2784,9 @@ stderr: ${stderrOutput}` : ""}`
       return session.clientSessionApis;
     });
     registerClientGlobalApiHandlers(this.connection, this.clientGlobalHandlers);
+    if (this.options.entra?.tokenProvider) {
+      registerEntraTokenProvider(this.connection, this.options.entra.tokenProvider);
+    }
     if (this.installationConfirmationHandler) {
       const confirmation = createInstallationConfirmationAdapter(
         this.connection,
@@ -2747,6 +2797,14 @@ stderr: ${stderrOutput}` : ""}`
         (params, token) => confirmation.confirm(params, token)
       );
     }
+    if (this.kerberosAuth) {
+      const { callback } = this.kerberosAuth;
+      const connection2 = this.connection;
+      this.connection.onRequest(
+        "kerberosAuth.acquire",
+        (params, token) => acquireKerberosToken(connection2, callback, params, token)
+      );
+    }
     this.connection.onRequest(
       "host.materializeSession",
       (params) => this.createHostSession(params)

package/dist/entra.d.ts

@@ -0,0 +1,3 @@
+import type { MessageConnection } from "./jsonrpcTypes.js";
+import type { EntraTokenProvider } from "./types.js";
+export declare function registerEntraTokenProvider(connection: MessageConnection, provider: EntraTokenProvider): void;

package/dist/entra.js

@@ -0,0 +1,59 @@
+import { CancellationTokenSource, ResponseError } from "vscode-jsonrpc/node";
+function registerEntraTokenProvider(connection, provider) {
+  const closed = new CancellationTokenSource();
+  const connectionClosed = closed.token;
+  const close = connection.onClose(() => closed.cancel());
+  const dispose = connection.onDispose(() => {
+    closed.cancel();
+    closed.dispose();
+    close.dispose();
+    dispose.dispose();
+  });
+  connection.onRequest(
+    "entraToken.getToken",
+    async ({ request }, token) => {
+      const combined = new CancellationTokenSource();
+      const subscriptions = [];
+      const checkCancellation = () => {
+        if (connectionClosed.isCancellationRequested || token.isCancellationRequested) {
+          combined.cancel();
+          throw new ResponseError(-32800, "Entra token acquisition cancelled");
+        }
+      };
+      try {
+        const cancelled = new Promise((_resolve, reject) => {
+          const cancel = () => {
+            combined.cancel();
+            reject(new ResponseError(-32800, "Entra token acquisition cancelled"));
+          };
+          subscriptions.push(
+            token.onCancellationRequested(cancel),
+            connectionClosed.onCancellationRequested(cancel)
+          );
+        });
+        checkCancellation();
+        const result = await Promise.race([
+          Promise.resolve().then(() => {
+            checkCancellation();
+            return provider(request, combined.token);
+          }),
+          cancelled
+        ]);
+        checkCancellation();
+        if (result === void 0 || result === null) {
+          throw new ResponseError(-32603, "Entra token provider failed");
+        }
+        return result;
+      } catch {
+        checkCancellation();
+        throw new ResponseError(-32603, "Entra token provider failed");
+      } finally {
+        for (const subscription of subscriptions) subscription.dispose();
+        combined.dispose();
+      }
+    }
+  );
+}
+export {
+  registerEntraTokenProvider
+};

package/dist/extension.d.ts

@@ -42,7 +42,7 @@ export type JoinSessionConfig = Omit<ResumeSessionConfig, "onPermissionRequest"
     workflows?: WorkflowHandle[];
 };
 export type { ExtensionInfo } from "./types.js";
-export { defineWorkflow, WorkflowResumeError, isWorkflowRunTerminal, type WorkflowRunOptions, type WorkflowResumeOptions, type WorkflowLimitOverrides, type WorkflowResumeErrorCode, type SessionWorkflowApi, type WorkflowAgentOptions, type WorkflowContext, type WorkflowDefinition, type WorkflowHandle, type JsonValue, type WorkflowJsonSchema, type WorkflowLimits, type WorkflowMeta, type WorkflowPipelineStage, type WorkflowStepOptions, type WorkflowRunResult, type WorkflowRunStatus, type WorkflowRunSummary, type WorkflowListRunsOptions, type WorkflowRunsPage, type WorkflowRunDetail, type WorkflowProgressPage, type WorkflowProgressLine, type WorkflowPhaseObservation, type WorkflowPhaseStatus, type WorkflowAgentSummary, } from "./workflow.js";
+export { defineWorkflow, WorkflowResumeError, isWorkflowRunTerminal, type WorkflowRunOptions, type WorkflowResumeOptions, type WorkflowLimitOverrides, type WorkflowResumeErrorCode, type SessionWorkflowApi, type WorkflowAgentOptions, type WorkflowContext, type WorkflowDefinition, type WorkflowHandle, type JsonValue, type WorkflowJsonSchema, type WorkflowLimits, type WorkflowMeta, type WorkflowPipelineStage, type WorkflowStepOptions, type WorkflowRunResult, type WorkflowRunStatus, type WorkflowRunSummary, type WorkflowListRunsOptions, type WorkflowRunsPage, type WorkflowRunDetail, type WorkflowProgressPage, type WorkflowProgressLine, type WorkflowPhaseObservation, type WorkflowPhaseStatus, type WorkflowAgentContextObservation, type WorkflowAgentModelObservation, type WorkflowAgentReasoningEffortObservation, type WorkflowAgentSummary, } from "./workflow.js";
 /**
  * Joins the current foreground session.
  *

package/dist/generated/lifecycle-diagnostics.d.ts

@@ -0,0 +1,220 @@
+/**
+ * AUTO-GENERATED FILE - DO NOT EDIT
+ * Generated from: lifecycle-diagnostics.schema.json
+ */
+/**
+ * Union of experimental lifecycle diagnostic event variants emitted by the Copilot CLI runtime.
+ */
+export type LifecycleDiagnosticEvent = RuntimeLifecycleSystemStateDiagnosticEvent | RuntimeLifecycleProgressStateDiagnosticEvent;
+/**
+ * How a settled lifecycle operation or progress record ended.
+ */
+export type RuntimeLifecycleDisposition = "succeeded" | "failed" | "cancelled" | "timed_out" | "superseded" | "abandoned";
+/**
+ * Lifecycle diagnostic event "runtime.lifecycle.system_state". Experimental, ephemeral, observational-only state of one runtime system after an operation transition. Observation and delivery never control runtime work. Process death, diagnostic projection loss, transport loss, or serialization failure can prevent external delivery.
+ */
+export interface RuntimeLifecycleSystemStateDiagnosticEvent {
+    data: RuntimeLifecycleSystemStateData;
+    /**
+     * ISO 8601 timestamp when the lifecycle diagnostic event was projected.
+     */
+    timestamp: string;
+    /**
+     * Type discriminator. Always "runtime.lifecycle.system_state".
+     */
+    type: "runtime.lifecycle.system_state";
+}
+/**
+ * Experimental, observational-only state of one runtime system after an operation transition. Observation and delivery never control runtime work. Process death, diagnostic projection loss, transport loss, or serialization failure can prevent external delivery.
+ */
+export interface RuntimeLifecycleSystemStateData {
+    /**
+     * Complete active operation set after applying the change.
+     */
+    activeOperations: RuntimeLifecycleOperation[];
+    changedOperation: RuntimeLifecycleOperation;
+    /**
+     * Authoritative condition retained after this change. Initial shared values are `current`, `disabled`, `degraded`, and `quiescent`; integrations can add bounded values as the contract matures.
+     */
+    condition?: string;
+    /**
+     * Opaque identity for one session registry generation.
+     */
+    incarnationId: string;
+    /**
+     * Session whose lifecycle owns this system.
+     */
+    sessionId: string;
+    /**
+     * Stable subsystem identifier.
+     */
+    system: string;
+    /**
+     * Orders every observed change to this system in the incarnation.
+     */
+    systemRevision: number;
+}
+/**
+ * Observed state of one readiness or convergence operation.
+ */
+export interface RuntimeLifecycleOperation {
+    disposition?: RuntimeLifecycleDisposition;
+    /**
+     * Opaque operation identifier, unique within the lifecycle incarnation and system.
+     */
+    operationId: string;
+    /**
+     * Orders transitions of this operation.
+     */
+    operationRevision: number;
+    /**
+     * System-owned lifecycle stage.
+     */
+    phase: string;
+    /**
+     * System-owned production boundary within the phase.
+     */
+    step: string;
+    timing: RuntimeLifecycleOperationTiming;
+    /**
+     * System-owned reason the operation started.
+     */
+    trigger: string;
+}
+/**
+ * Fixed timestamps for one observed operation revision.
+ */
+export interface RuntimeLifecycleOperationTiming {
+    /**
+     * ISO 8601 timestamp when the current phase began.
+     */
+    phaseStartedAt: string;
+    /**
+     * ISO 8601 timestamp when the operation began.
+     */
+    startedAt: string;
+    /**
+     * ISO 8601 timestamp when this operation revision was recorded.
+     */
+    transitionedAt: string;
+}
+/**
+ * Lifecycle diagnostic event "runtime.lifecycle.progress_state". Experimental, ephemeral, observational-only state of runtime progress and the lifecycle operations that block it. Observation and delivery never control runtime or model behavior. Process death, diagnostic projection loss, transport loss, or serialization failure can prevent external delivery.
+ */
+export interface RuntimeLifecycleProgressStateDiagnosticEvent {
+    data: RuntimeLifecycleProgressStateData;
+    /**
+     * ISO 8601 timestamp when the lifecycle diagnostic event was projected.
+     */
+    timestamp: string;
+    /**
+     * Type discriminator. Always "runtime.lifecycle.progress_state".
+     */
+    type: "runtime.lifecycle.progress_state";
+}
+/**
+ * Experimental, observational-only state of runtime progress and the lifecycle operations that block it. Observation and delivery never control runtime or model behavior. Process death, diagnostic projection loss, transport loss, or serialization failure can prevent external delivery.
+ */
+export interface RuntimeLifecycleProgressStateData {
+    /**
+     * Complete dependency blocker set after this progress change.
+     */
+    blockers: RuntimeLifecycleBlocker[];
+    disposition?: RuntimeLifecycleDisposition;
+    /**
+     * Opaque identity for one session registry generation.
+     */
+    incarnationId: string;
+    /**
+     * Progress-owner-defined kind.
+     */
+    kind: string;
+    origin?: RuntimeLifecycleProgressOrigin;
+    /**
+     * Progress-owner-defined phase.
+     */
+    phase: string;
+    /**
+     * Opaque progress identifier, unique within the incarnation and kind.
+     */
+    progressId: string;
+    /**
+     * Orders changes to this progress record.
+     */
+    revision: number;
+    /**
+     * Session whose lifecycle owns this progress.
+     */
+    sessionId: string;
+    timing: RuntimeLifecycleProgressTiming;
+}
+/**
+ * Exact lifecycle operation awaited by a real dependency wait.
+ */
+export interface RuntimeLifecycleBlocker {
+    /**
+     * Current phase of the awaited operation.
+     */
+    currentPhase: string;
+    /**
+     * Current production boundary of the awaited operation.
+     */
+    currentStep: string;
+    operationDisposition?: RuntimeLifecycleDisposition;
+    /**
+     * Opaque awaited operation identifier.
+     */
+    operationId: string;
+    /**
+     * Awaited operation revision observed by this blocker.
+     */
+    operationRevision: number;
+    /**
+     * System-owned capability required by the progress owner.
+     */
+    requirement: string;
+    /**
+     * System that owns the awaited operation.
+     */
+    system: string;
+    timing: RuntimeLifecycleBlockerTiming;
+}
+/**
+ * Timing of one real dependency wait.
+ */
+export interface RuntimeLifecycleBlockerTiming {
+    /**
+     * ISO 8601 timestamp when this dependency began blocking progress.
+     */
+    blockingSince: string;
+}
+/**
+ * Immutable causal origin of a progress record with independent identity and settlement.
+ */
+export interface RuntimeLifecycleProgressOrigin {
+    /**
+     * Kind of the originating progress record.
+     */
+    kind: string;
+    /**
+     * Identifier of the originating progress record.
+     */
+    progressId: string;
+}
+/**
+ * Fixed timestamps for one observed progress revision.
+ */
+export interface RuntimeLifecycleProgressTiming {
+    /**
+     * ISO 8601 timestamp when the current phase began.
+     */
+    phaseStartedAt: string;
+    /**
+     * ISO 8601 timestamp when the progress record began.
+     */
+    startedAt: string;
+    /**
+     * ISO 8601 timestamp when this progress revision was recorded.
+     */
+    transitionedAt: string;
+}