@github/copilot-sdk 1.0.29-preview.1 → 1.0.29-preview.3

package/dist/cjs/client.js

@@ -336,8 +336,10 @@ class CopilotClient {
   effectiveConnectionToken;
   onListModels;
   onGetTraceContext;
-  modelsCache = null;
-  modelsCacheLock = Promise.resolve();
+  modelsCache = {
+    models: null,
+    lock: Promise.resolve()
+  };
   sessionLifecycleHandlers = /* @__PURE__ */ new Set();
   typedLifecycleHandlers = /* @__PURE__ */ new Map();
   _rpc = null;
@@ -906,7 +908,7 @@ class CopilotClient {
       this._rpc = null;
       this._internalRpc = null;
     }
-    this.modelsCache = null;
+    this.modelsCache = { models: null, lock: Promise.resolve() };
     if (this.socket) {
       const socket = this.socket;
       this.socket = null;
@@ -1068,7 +1070,7 @@ class CopilotClient {
       this._rpc = null;
       this._internalRpc = null;
     }
-    this.modelsCache = null;
+    this.modelsCache = { models: null, lock: Promise.resolve() };
     if (this.socket) {
       try {
         this.socket.destroy();
@@ -2087,14 +2089,16 @@ class CopilotClient {
    * @throws Error if not connected (when no custom handler is set)
    */
   async listModels() {
-    await this.modelsCacheLock;
+    const cache = this.modelsCache;
+    const previousLock = cache.lock;
     let resolveLock;
-    this.modelsCacheLock = new Promise((resolve2) => {
+    cache.lock = new Promise((resolve2) => {
       resolveLock = resolve2;
     });
+    await previousLock;
     try {
-      if (this.modelsCache !== null) {
-        return [...this.modelsCache];
+      if (cache.models !== null) {
+        return [...cache.models];
       }
       let models;
       if (this.onListModels) {
@@ -2123,7 +2127,7 @@ class CopilotClient {
           }
         }
       }
-      this.modelsCache = [...models];
+      cache.models = [...models];
       return [...models];
     } finally {
       resolveLock();
@@ -2888,6 +2892,14 @@ stderr: ${stderrOutput}` : ""}`
       "skillProvider.list",
       async (params, token) => await this.resolveSkillProviderSession(params)._handleSkillProviderList(token)
     );
+    this.connection.onRequest(
+      "sessionManagement.create",
+      async (params, token) => {
+        const session = this.sessions.get(params.sessionId);
+        if (!session) throw new Error("Session creation owner is unavailable");
+        return await session._handleSessionManagementCreate(params, token);
+      }
+    );
     this.connection.onRequest(
       "skillProvider.read",
       async (params, token) => {
@@ -2925,7 +2937,7 @@ stderr: ${stderrOutput}` : ""}`
       this.messageWriter = null;
       this._rpc = null;
       this._internalRpc = null;
-      this.modelsCache = null;
+      this.modelsCache = { models: null, lock: Promise.resolve() };
     };
     const disconnectAfterDrain = () => {
       if (exitFallback !== void 0) {
@@ -3021,7 +3033,8 @@ stderr: ${stderrOutput}` : ""}`
     const result = await session._handleUserInputRequest({
       question: params.question,
       choices: params.choices,
-      allowFreeform: params.allowFreeform
+      allowFreeform: params.allowFreeform,
+      requestId: params.requestId
     });
     return result;
   }
@@ -3037,7 +3050,8 @@ stderr: ${stderrOutput}` : ""}`
       summary: params.summary,
       planContent: params.planContent,
       actions: params.actions,
-      recommendedAction: params.recommendedAction
+      recommendedAction: params.recommendedAction,
+      requestId: params.requestId
     });
   }
   async handleAutoModeSwitchRequest(params) {

package/dist/cjs/copilotRequestHandler.js

@@ -109,7 +109,9 @@ class CopilotWebSocketForwarder extends CopilotWebSocketHandler {
     if (this.#upstream) {
       return;
     }
-    const upstream = new WebSocket(this.context.url);
+    const upstream = new WebSocket(this.context.url, {
+      headers: forwardedRequestHeaders(this.context.headers)
+    });
     upstream.binaryType = "arraybuffer";
     this.#upstream = upstream;
     upstream.addEventListener("message", (event) => {
@@ -149,13 +151,16 @@ class CopilotWebSocketForwarder extends CopilotWebSocketHandler {
     });
   }
   async close(status = CopilotWebSocketCloseStatus.normalClosure) {
+    const upstream = this.#upstream;
+    this.#upstream = null;
+    const completion = super.close(status);
     try {
-      if (this.#upstream?.readyState === WebSocket.OPEN || this.#upstream?.readyState === WebSocket.CONNECTING) {
-        this.#upstream?.close();
+      if (upstream?.readyState === WebSocket.OPEN || upstream?.readyState === WebSocket.CONNECTING) {
+        upstream.close();
       }
     } catch {
     }
-    await super.close(status);
+    await completion;
   }
   async [Symbol.asyncDispose]() {
     try {
@@ -494,19 +499,24 @@ const FORBIDDEN_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "te",
   "trailer"
 ]);
-async function buildFetchRequest(exchange) {
+function forwardedRequestHeaders(source) {
   const headers = new Headers();
-  for (const [name, values] of Object.entries(exchange.headers)) {
+  for (const [name, values] of Object.entries(source)) {
     if (!values) {
       continue;
     }
-    if (FORBIDDEN_REQUEST_HEADERS.has(name.toLowerCase())) {
+    const lower = name.toLowerCase();
+    if (FORBIDDEN_REQUEST_HEADERS.has(lower) || lower.startsWith("sec-websocket-")) {
       continue;
     }
     for (const value of values) {
       headers.append(name, value);
     }
   }
+  return headers;
+}
+async function buildFetchRequest(exchange) {
+  const headers = forwardedRequestHeaders(exchange.headers);
   const method = exchange.method.toUpperCase();
   const hasBody = method !== "GET" && method !== "HEAD";
   let body;

package/dist/cjs/generated/rpc.js

@@ -841,9 +841,17 @@ function createServerRpc(connection) {
        *
        * @param params A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.
        *
-       * @returns Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.
+       * @returns Outcome of catalog.search or catalog.recommend: either bounded inert candidates, or one typed refusal. Never a partial success.
        */
       search: async (params) => connection.sendRequest("catalog.search", params),
+      /**
+       * Requests the initial page of at most ten official-product recommendations for a complete task and product, bound to an existing attached local session. Requires catalog-recommend, catalog-search-session-bound and catalog-search-credential-required. Uses the selected GitHub.com user credential on the fixed Agent Finder recommendations route; successful capability negotiation does not establish service acceptance. Returns the existing inert catalog candidates and retained install references with the typed catalog refusal union. No anonymous retry, unfiltered search fallback or continuation is performed. Server-owned product approvals establish provenance, not task suitability. Read-only: nothing is installed, configured or persisted.
+       *
+       * @param params Initial-page official-product recommendations for a complete task. The runtime fixes recommendationPolicy to official-product and pageSize to 10; callers cannot override the policy, request pagination or fall back to search.
+       *
+       * @returns Outcome of catalog.search or catalog.recommend: either bounded inert candidates, or one typed refusal. Never a partial success.
+       */
+      recommend: async (params) => connection.sendRequest("catalog.recommend", params),
       /**
        * Retrieves one saved feed by its opaque ID, optionally filtered by trust tier. Requires catalog-feeds and catalog-search-credential-required, and uses the same authority, credential policy, optional session binding and candidate projection as catalog.search, so available entries are the same inert candidates, with the same installability, handles and display metadata, and install through the same confirmed flows. Entries keep the feed's order; an entry the runtime cannot present is returned as unavailable with a reason rather than failing the feed. No anonymous retry. Read-only: nothing is installed, configured, or persisted.
        *
@@ -2174,6 +2182,49 @@ function createInternalServerRpc(connection) {
 }
 function createSessionRpc(connection, sessionId) {
   return {
+    /** @experimental */
+    management: {
+      /**
+       * Updates opt-in session management policy live. Enabling the master enables all tools before applying individual overrides. Opt-in is scoped to the session's configuration directory.
+       *
+       * @param params Updates the session's live policy without changing persistent host settings.
+       *
+       * @returns Opt-in policy for local session management.
+       */
+      configure: async (params) => connection.sendRequest("session.management.configure", { ...params, sessionId }),
+      /**
+       * Lists other live, opted-in sessions in the same configuration directory. Requires the list tool to be enabled.
+       *
+       * @param params Lists opted-in local peers. The caller is omitted.
+       *
+       * @returns Eligible live peers reported by their owning runtimes.
+       */
+      list: async (params) => connection.sendRequest("session.management.list", { ...params, sessionId }),
+      /**
+       * Injects peer text into an opted-in session. Wakes an idle agent and safely queues delivery to a busy agent. Acceptance does not imply an answer or completed task.
+       *
+       * @param params Sends peer text, never human approval, to another opted-in session.
+       *
+       * @returns Acceptance is not a completed turn or a reply.
+       */
+      message: async (params) => connection.sendRequest("session.management.message", { ...params, sessionId }),
+      /**
+       * Asks the owning host to create and supervise a separate session, preserving permissions and model restrictions. Omitted model, reasoning effort, context tier and cwd inherit the caller's current values; explicit overrides use normal model validation and workspace trust. Records durable creation lineage before delivering the initial task as peer text. Returns the new session ID, not task completion. Requires the create tool and a host creation handler.
+       *
+       * @param params Requests a separate session. Omitted launch options inherit the caller's current configuration.
+       *
+       * @returns Identifies a session owned and supervised by the creating host.
+       */
+      create: async (params) => connection.sendRequest("session.management.create", { ...params, sessionId }),
+      /**
+       * Closes a live opted-in session created by the caller or one of its descendants, preserving saved history and leaving descendants open. Requires the close capability to be enabled. Self, ancestors, siblings and unrelated sessions cannot be closed.
+       *
+       * @param params Closes one live opted-in descendant without deleting its saved history or closing its children.
+       *
+       * @returns Completion of the existing non-deleting close lifecycle.
+       */
+      close: async (params) => connection.sendRequest("session.management.close", { ...params, sessionId })
+    },
     /** @experimental */
     providers: {
       /**
@@ -2811,7 +2862,13 @@ function createSessionRpc(connection, sessionId) {
        *
        * @returns Canonical runtime state for the session's current autopilot objective.
        */
-      getState: async () => connection.sendRequest("session.autopilotObjective.getState", { sessionId })
+      getState: async () => connection.sendRequest("session.autopilotObjective.getState", { sessionId }),
+      /**
+       * Sets whether completing or pausing this session's objective preserves autopilot mode. This in-memory preference defaults to false and must be reapplied when attaching a client.
+       *
+       * @param params Client-resolved preference for retaining autopilot mode after objective completion or pause.
+       */
+      setStayInAutopilot: async (params) => connection.sendRequest("session.autopilotObjective.setStayInAutopilot", { ...params, sessionId })
     },
     /** @experimental */
     completions: {
@@ -3551,6 +3608,12 @@ function createSessionRpc(connection, sessionId) {
        * @returns The selectable model entries and selection ids synthesized for the synchronized BYOK models.
        */
       sync: async (params) => connection.sendRequest("session.provider.sync", { ...params, sessionId }),
+      /**
+       * Returns credential-free provider configuration status for the selected model. This does not validate provider credentials or contact the provider.
+       *
+       * @returns Credential-free provider configuration status for the selected model.
+       */
+      getStatus: async () => connection.sendRequest("session.provider.getStatus", { sessionId }),
       /**
        * Withdraws named host-managed models from the session's BYOK registry, leaving every other entry untouched. The scoped counterpart to `provider.sync`: a snapshot can only describe entries the caller knows about, so using it to remove one model silently withdraws rows registered by another source, such as a plugin calling `provider.add` at runtime. Naming what to remove leaves unrelated entries alone. Selection ids that are not registered are ignored, so withdrawal is idempotent. A provider is removed only when one of the withdrawn models was the last entry referencing it; a provider that simply has no models, which is the normal state while its rows are supplied by catalog discovery, is left in place.
        *
@@ -3891,6 +3954,12 @@ function createSessionRpc(connection, sessionId) {
        * @returns Current permission mode.
        */
       getMode: async () => connection.sendRequest("session.permissions.getMode", { sessionId }),
+      /**
+       * Returns the approval modes currently available under the session's feature and managed permission policy. This read does not change permissions; mutations must still check their authoritative result because policy may change.
+       *
+       * @returns Available permission modes, derived from current session policy.
+       */
+      getCapabilities: async () => connection.sendRequest("session.permissions.getCapabilities", { sessionId }),
       /**
        * Adds or removes session-scoped or location-scoped permission rules.
        *

package/dist/cjs/session.js

@@ -170,6 +170,11 @@ class WorkflowProgressBuffer {
     if (this.closed) {
       throw new Error("Cannot log after the workflow run has settled");
     }
+    if (typeof text !== "string") {
+      throw new TypeError(
+        `${kind}() expects a string; got ${text === null ? "null" : typeof text}.`
+      );
+    }
     this.pending.push({ seq: this.nextSeq++, kind, text });
     this.scheduleFlush();
   }
@@ -297,6 +302,7 @@ class CopilotSession {
   /** Settles once every earlier `setTools` call has finished. */
   setToolsQueue = Promise.resolve();
   pendingExternalTools = /* @__PURE__ */ new Map();
+  pendingSessionCreations = /* @__PURE__ */ new Set();
   canvases = /* @__PURE__ */ new Map();
   bearerTokenProviders = /* @__PURE__ */ new Map();
   commandHandlers = /* @__PURE__ */ new Map();
@@ -309,6 +315,7 @@ class CopilotSession {
   exitPlanModeHandler;
   autoModeSwitchHandler;
   skillProvider;
+  sessionCreationHandler;
   hooks;
   transformCallbacks;
   _rpc = null;
@@ -896,6 +903,10 @@ class CopilotSession {
       controller.abort();
     }
     this.pendingExternalTools.clear();
+    for (const controller of this.pendingSessionCreations) {
+      controller.abort();
+    }
+    this.pendingSessionCreations.clear();
     this.eventHandlers.clear();
     this.typedEventHandlers.clear();
     this.toolHandlers.clear();
@@ -906,6 +917,7 @@ class CopilotSession {
     this.exitPlanModeHandler = void 0;
     this.autoModeSwitchHandler = void 0;
     this.skillProvider = void 0;
+    this.sessionCreationHandler = void 0;
     this.hooks = void 0;
     this.traceContextProvider = void 0;
     this.bearerTokenProviders.clear();
@@ -1575,6 +1587,7 @@ class CopilotSession {
           assertWorkflowResult(result);
           return { result };
         } finally {
+          controller.abort(new DOMException("Workflow run has settled", "AbortError"));
           try {
             await progress.close();
           } finally {
@@ -1869,6 +1882,41 @@ class CopilotSession {
     this.assertConnected();
     this.skillProvider = provider;
   }
+  /**
+   * Registers the host's creation callback without enabling the tool group.
+   * Enable it separately with `session.rpc.management.configure({ enabled: true })`.
+   */
+  async setSessionCreationHandler(handler) {
+    this.assertConnected();
+    const previous = this.sessionCreationHandler;
+    this.sessionCreationHandler = handler;
+    try {
+      return await this.rpc.management.configure({ hasCreateHandler: handler !== void 0 });
+    } catch (error) {
+      if (this.sessionCreationHandler === handler) this.sessionCreationHandler = previous;
+      throw error;
+    }
+  }
+  /** @internal */
+  async _handleSessionManagementCreate(request, token) {
+    this.assertConnected();
+    const handler = this.sessionCreationHandler;
+    if (!handler || request.parentSessionId !== this.sessionId || request.sessionId !== this.sessionId) {
+      throw new Error("Session creation handler is unavailable");
+    }
+    const controller = new AbortController();
+    this.pendingSessionCreations.add(controller);
+    const subscription = token.onCancellationRequested(() => controller.abort());
+    if (token.isCancellationRequested) controller.abort();
+    try {
+      return await handler(request, { signal: controller.signal });
+    } catch {
+      throw new Error("Session creation callback failed");
+    } finally {
+      subscription.dispose();
+      this.pendingSessionCreations.delete(controller);
+    }
+  }
   /**
    * Handles a `skillProvider.list` request from the runtime.
    *

package/dist/cliVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const COPILOT_CLI_VERSION = "1.0.106-2";
+export declare const COPILOT_CLI_VERSION = "1.0.106-4";
 export declare const COPILOT_CLI_USE_NPM_PACKAGE = false;

package/dist/cliVersion.js

@@ -1,4 +1,4 @@
-const COPILOT_CLI_VERSION = "1.0.106-2";
+const COPILOT_CLI_VERSION = "1.0.106-4";
 const COPILOT_CLI_USE_NPM_PACKAGE = false;
 export {
   COPILOT_CLI_USE_NPM_PACKAGE,

package/dist/client.d.ts

@@ -38,7 +38,6 @@ export declare class CopilotClient {
     private onListModels?;
     private onGetTraceContext?;
     private modelsCache;
-    private modelsCacheLock;
     private sessionLifecycleHandlers;
     private typedLifecycleHandlers;
     private _rpc;

package/dist/client.js

@@ -318,8 +318,10 @@ class CopilotClient {
   effectiveConnectionToken;
   onListModels;
   onGetTraceContext;
-  modelsCache = null;
-  modelsCacheLock = Promise.resolve();
+  modelsCache = {
+    models: null,
+    lock: Promise.resolve()
+  };
   sessionLifecycleHandlers = /* @__PURE__ */ new Set();
   typedLifecycleHandlers = /* @__PURE__ */ new Map();
   _rpc = null;
@@ -888,7 +890,7 @@ class CopilotClient {
       this._rpc = null;
       this._internalRpc = null;
     }
-    this.modelsCache = null;
+    this.modelsCache = { models: null, lock: Promise.resolve() };
     if (this.socket) {
       const socket = this.socket;
       this.socket = null;
@@ -1050,7 +1052,7 @@ class CopilotClient {
       this._rpc = null;
       this._internalRpc = null;
     }
-    this.modelsCache = null;
+    this.modelsCache = { models: null, lock: Promise.resolve() };
     if (this.socket) {
       try {
         this.socket.destroy();
@@ -2069,14 +2071,16 @@ class CopilotClient {
    * @throws Error if not connected (when no custom handler is set)
    */
   async listModels() {
-    await this.modelsCacheLock;
+    const cache = this.modelsCache;
+    const previousLock = cache.lock;
     let resolveLock;
-    this.modelsCacheLock = new Promise((resolve2) => {
+    cache.lock = new Promise((resolve2) => {
       resolveLock = resolve2;
     });
+    await previousLock;
     try {
-      if (this.modelsCache !== null) {
-        return [...this.modelsCache];
+      if (cache.models !== null) {
+        return [...cache.models];
       }
       let models;
       if (this.onListModels) {
@@ -2105,7 +2109,7 @@ class CopilotClient {
           }
         }
       }
-      this.modelsCache = [...models];
+      cache.models = [...models];
       return [...models];
     } finally {
       resolveLock();
@@ -2870,6 +2874,14 @@ stderr: ${stderrOutput}` : ""}`
       "skillProvider.list",
       async (params, token) => await this.resolveSkillProviderSession(params)._handleSkillProviderList(token)
     );
+    this.connection.onRequest(
+      "sessionManagement.create",
+      async (params, token) => {
+        const session = this.sessions.get(params.sessionId);
+        if (!session) throw new Error("Session creation owner is unavailable");
+        return await session._handleSessionManagementCreate(params, token);
+      }
+    );
     this.connection.onRequest(
       "skillProvider.read",
       async (params, token) => {
@@ -2907,7 +2919,7 @@ stderr: ${stderrOutput}` : ""}`
       this.messageWriter = null;
       this._rpc = null;
       this._internalRpc = null;
-      this.modelsCache = null;
+      this.modelsCache = { models: null, lock: Promise.resolve() };
     };
     const disconnectAfterDrain = () => {
       if (exitFallback !== void 0) {
@@ -3003,7 +3015,8 @@ stderr: ${stderrOutput}` : ""}`
     const result = await session._handleUserInputRequest({
       question: params.question,
       choices: params.choices,
-      allowFreeform: params.allowFreeform
+      allowFreeform: params.allowFreeform,
+      requestId: params.requestId
     });
     return result;
   }
@@ -3019,7 +3032,8 @@ stderr: ${stderrOutput}` : ""}`
       summary: params.summary,
       planContent: params.planContent,
       actions: params.actions,
-      recommendedAction: params.recommendedAction
+      recommendedAction: params.recommendedAction,
+      requestId: params.requestId
     });
   }
   async handleAutoModeSwitchRequest(params) {

package/dist/copilotRequestHandler.js

@@ -82,7 +82,9 @@ class CopilotWebSocketForwarder extends CopilotWebSocketHandler {
     if (this.#upstream) {
       return;
     }
-    const upstream = new WebSocket(this.context.url);
+    const upstream = new WebSocket(this.context.url, {
+      headers: forwardedRequestHeaders(this.context.headers)
+    });
     upstream.binaryType = "arraybuffer";
     this.#upstream = upstream;
     upstream.addEventListener("message", (event) => {
@@ -122,13 +124,16 @@ class CopilotWebSocketForwarder extends CopilotWebSocketHandler {
     });
   }
   async close(status = CopilotWebSocketCloseStatus.normalClosure) {
+    const upstream = this.#upstream;
+    this.#upstream = null;
+    const completion = super.close(status);
     try {
-      if (this.#upstream?.readyState === WebSocket.OPEN || this.#upstream?.readyState === WebSocket.CONNECTING) {
-        this.#upstream?.close();
+      if (upstream?.readyState === WebSocket.OPEN || upstream?.readyState === WebSocket.CONNECTING) {
+        upstream.close();
       }
     } catch {
     }
-    await super.close(status);
+    await completion;
   }
   async [Symbol.asyncDispose]() {
     try {
@@ -467,19 +472,24 @@ const FORBIDDEN_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "te",
   "trailer"
 ]);
-async function buildFetchRequest(exchange) {
+function forwardedRequestHeaders(source) {
   const headers = new Headers();
-  for (const [name, values] of Object.entries(exchange.headers)) {
+  for (const [name, values] of Object.entries(source)) {
     if (!values) {
       continue;
     }
-    if (FORBIDDEN_REQUEST_HEADERS.has(name.toLowerCase())) {
+    const lower = name.toLowerCase();
+    if (FORBIDDEN_REQUEST_HEADERS.has(lower) || lower.startsWith("sec-websocket-")) {
       continue;
     }
     for (const value of values) {
       headers.append(name, value);
     }
   }
+  return headers;
+}
+async function buildFetchRequest(exchange) {
+  const headers = forwardedRequestHeaders(exchange.headers);
   const method = exchange.method.toUpperCase();
   const hasBody = method !== "GET" && method !== "HEAD";
   let body;