@github/copilot-sdk 1.0.3 → 1.0.5-preview.0

package/dist/generated/rpc.d.ts

@@ -3,7 +3,14 @@
  * Generated from: api.schema.json
  */
 import type { MessageConnection } from "vscode-jsonrpc/node.js";
-import type { AbortReason, Attachment, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpServerSource, McpServerStatus, PermissionPromptRequest, PermissionRule, ReasoningSummary, SessionEvent, SessionMode, ShutdownType, SkillSource, UserToolSessionApproval } from "./session-events.js";
+import type { AbortReason, Attachment, ContextTier, EmbeddedBlobResourceContents, EmbeddedTextResourceContents, McpServerSource, McpServerStatus, PermissionPromptRequest, PermissionRule, ReasoningSummary, ResponseBudgetConfig, SessionEvent, SessionMode, ShutdownType, SkillSource, UserToolSessionApproval } from "./session-events.js";
+/**
+ * Initial authentication info for the session.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AuthInfo".
+ */
+export type AuthInfo = HMACAuthInfo | EnvAuthInfo | TokenAuthInfo | CopilotApiTokenAuthInfo | UserAuthInfo | GhCliAuthInfo | ApiKeyAuthInfo;
 /**
  * Which tier this directory belongs to
  *
@@ -166,14 +173,6 @@ export type AgentRegistrySpawnValidationErrorField =
  | "model"
 /** The permissionMode parameter */
  | "permissionMode";
-/**
- * Initial authentication info for the session.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AuthInfo".
- */
-/** @experimental */
-export type AuthInfo = HMACAuthInfo | EnvAuthInfo | TokenAuthInfo | CopilotApiTokenAuthInfo | UserAuthInfo | GhCliAuthInfo | ApiKeyAuthInfo;
 /**
  * Authentication type
  *
@@ -196,18 +195,6 @@ export type AuthInfoType =
  | "token"
 /** Authentication from a Copilot API token. */
  | "copilot-api-token";
-/**
- * Runtime-controlled routing state for an open canvas instance.
- *
- * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CanvasInstanceAvailability".
- */
-/** @experimental */
-export type CanvasInstanceAvailability = 
-/** The owning provider is currently connected and routing calls will be dispatched normally. */
-"ready"
-/** The owning provider is not currently connected. Routing calls fail with canvas_provider_unavailable until the agent re-issues open_canvas (which rehydrates via a fresh canvas.open) or the provider reconnects. */
- | "stale";
 /**
  * Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command
  *
@@ -479,6 +466,7 @@ export type InstructionSourceLocation =
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "LlmInferenceHttpRequestStartTransport".
  */
+/** @experimental */
 export type LlmInferenceHttpRequestStartTransport = 
 /** Plain HTTP or SSE response. Each body chunk is an opaque byte range; the response is a status line, headers, and a (possibly streamed) body. */
 "http"
@@ -665,6 +653,24 @@ export type McpServerConfigHttpOauthGrantType =
 "authorization_code"
 /** Headless client credentials flow using the configured OAuth client. */
  | "client_credentials";
+/**
+ * Host response: supply dynamic headers or decline this refresh.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpHeadersHandlePendingHeadersRefreshRequest".
+ */
+/** @experimental */
+export type McpHeadersHandlePendingHeadersRefreshRequest = {
+    /**
+     * Headers to overlay onto the MCP request. Dynamic headers override static config headers but do not replace SDK-managed request headers.
+     */
+    headers: {
+        [k: string]: string | undefined;
+    };
+    kind: "headers";
+} | {
+    kind: "none";
+};
 /**
  * Host response to the pending OAuth request.
  *
@@ -681,10 +687,6 @@ export type McpOauthPendingRequestResponse = {
      * OAuth token type. Defaults to Bearer when omitted.
      */
     tokenType?: string;
-    /**
-     * Refresh token supplied by the host, if available.
-     */
-    refreshToken?: string;
     /**
      * Token lifetime in seconds, if known.
      */
@@ -693,6 +695,18 @@ export type McpOauthPendingRequestResponse = {
 } | {
     kind: "cancelled";
 };
+/**
+ * OAuth grant type override for this login.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpOauthLoginGrantType".
+ */
+/** @experimental */
+export type McpOauthLoginGrantType = 
+/** Interactive browser-based OAuth flow using an authorization code, typically with PKCE. */
+"authorization_code"
+/** Headless OAuth flow where a confidential client authenticates directly with a client secret. */
+ | "client_credentials";
 /**
  * Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.
  *
@@ -873,6 +887,18 @@ export type ProviderConfigWireApi =
 "completions"
 /** OpenAI Responses API wire format. */
  | "responses";
+/**
+ * Provider transport. Defaults to "http".
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderConfigTransport".
+ */
+/** @experimental */
+export type ProviderConfigTransport = 
+/** HTTP request/streaming transport. */
+"http"
+/** WebSocket transport. */
+ | "websockets";
 /**
  * Allowed values for the `OptionsUpdateAdditionalContentExclusionPolicyScope` enumeration.
  *
@@ -1061,6 +1087,18 @@ export type ProviderEndpointWireApi =
 "completions"
 /** Newer responses request shape. */
  | "responses";
+/**
+ * Transport to be used for provider requests.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderEndpointTransport".
+ */
+/** @experimental */
+export type ProviderEndpointTransport = 
+/** HTTP request/streaming transport. */
+"http"
+/** WebSocket transport. */
+ | "websockets";
 /**
  * Schema for the `PushAttachment` type.
  *
@@ -1068,7 +1106,7 @@ export type ProviderEndpointWireApi =
  * via the `definition` "PushAttachment".
  */
 /** @experimental */
-export type PushAttachment = PushAttachmentFile | PushAttachmentDirectory | PushAttachmentSelection | PushAttachmentGitHubReference | PushAttachmentBlob | ExtensionContextPushInput;
+export type PushAttachment = PushAttachmentFile | PushAttachmentDirectory | PushAttachmentSelection | PushAttachmentGitHubReference | PushAttachmentGitHubCommit | PushAttachmentGitHubRelease | PushAttachmentGitHubActionsJob | PushAttachmentGitHubRepository | PushAttachmentGitHubFileDiff | PushAttachmentGitHubTreeComparison | PushAttachmentGitHubUrl | PushAttachmentGitHubFile | PushAttachmentGitHubSnippet | PushAttachmentBlob | ExtensionContextPushInput;
 /**
  * Type of GitHub reference
  *
@@ -1463,7 +1501,7 @@ export type SkillDiscoveryScope =
 /** A configured custom skill directory. */
  | "custom";
 /**
- * Result of invoking the slash command (text output, prompt to send to the agent, or completion).
+ * Result of invoking the slash command (text output, prompt to send to the agent, completion, or subcommand selection).
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "SlashCommandInvocationResult".
@@ -1488,6 +1526,14 @@ export type SubagentSettings = {
      * Names of subagents the user has turned off; they cannot be dispatched
      */
     disabledSubagents?: string[];
+    /**
+     * Maximum number of subagents that can run concurrently; applies to usage-based billing users only
+     */
+    maxConcurrency?: number;
+    /**
+     * Maximum subagent nesting depth; applies to usage-based billing users only
+     */
+    maxDepth?: number;
 } | null;
 /**
  * Context tier override for matching subagents
@@ -1676,7 +1722,9 @@ export type WorkspaceDiffMode =
 /** Return staged, unstaged, and untracked working tree changes. */
 "unstaged"
 /** Return changes compared with the default branch. */
- | "branch";
+ | "branch"
+/** Return the cumulative diff of files Copilot changed this session (used in non-git workspaces). */
+ | "session";
 /**
  * Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.
  *
@@ -1689,6 +1737,13 @@ export type WorkspacesWorkspaceDetailsHostType =
 "github"
 /** Workspace repository is hosted on Azure DevOps. */
  | "ado";
+/**
+ * List of all authenticated users
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AccountGetAllUsersResult".
+ */
+export type AccountGetAllUsersResult = AccountAllUsers[];
 /**
  * Parameters for aborting the current turn
  *
@@ -1716,793 +1771,859 @@ export interface AbortResult {
      */
     error?: string;
 }
-export interface AccountGetQuotaRequest {
-    /**
-     * GitHub token for per-user quota lookup. When provided, resolves this token to determine the user's quota instead of using the global auth.
-     */
-    gitHubToken?: string;
-}
 /**
- * Quota usage snapshots for the resolved user, keyed by quota type.
+ * Schema for the `AccountAllUsers` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AccountGetQuotaResult".
+ * via the `definition` "AccountAllUsers".
  */
-export interface AccountGetQuotaResult {
+export interface AccountAllUsers {
+    authInfo: AuthInfo;
     /**
-     * Quota snapshots keyed by type (e.g., chat, completions, premium_interactions)
+     * Associated token, if available
      */
-    quotaSnapshots: {
-        [k: string]: AccountQuotaSnapshot | undefined;
-    };
+    token?: string;
 }
 /**
- * Schema for the `AccountQuotaSnapshot` type.
+ * Schema for the `HMACAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AccountQuotaSnapshot".
+ * via the `definition` "HMACAuthInfo".
  */
-export interface AccountQuotaSnapshot {
-    /**
-     * Whether the user has an unlimited usage entitlement
-     */
-    isUnlimitedEntitlement: boolean;
-    /**
-     * Number of requests included in the entitlement, or -1 for unlimited entitlements
-     */
-    entitlementRequests: number;
-    /**
-     * Number of requests used so far this period
-     */
-    usedRequests: number;
-    /**
-     * Whether usage is still permitted after quota exhaustion
-     */
-    usageAllowedWithExhaustedQuota: boolean;
-    /**
-     * Percentage of entitlement remaining
-     */
-    remainingPercentage: number;
+export interface HMACAuthInfo {
     /**
-     * Number of additional usage requests made this period
+     * HMAC-based authentication used by GitHub-internal services.
      */
-    overage: number;
+    type: "hmac";
     /**
-     * Whether additional usage is allowed when quota is exhausted
+     * Authentication host. HMAC auth always targets the public GitHub host.
      */
-    overageAllowedWithExhaustedQuota: boolean;
+    host: "https://github.com";
     /**
-     * Date when the quota resets (ISO 8601 string)
+     * HMAC secret used to sign requests.
      */
-    resetDate?: string;
+    hmac: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Schema for the `AgentDiscoveryPath` type.
+ * Snapshot of the authenticated user's Copilot subscription info, if known. Mirrors the GitHub API `/copilot_internal/v2/token` user response shape — the runtime trusts this verbatim and does not re-fetch when set.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentDiscoveryPath".
+ * via the `definition` "CopilotUserResponse".
  */
-/** @experimental */
-export interface AgentDiscoveryPath {
-    /**
-     * Absolute path of the search/create directory (may not exist on disk yet)
-     */
-    path: string;
-    scope: AgentDiscoveryPathScope;
-    /**
-     * Whether this is the canonical directory to create a new agent in its tier. At most one entry per tier is preferred.
-     */
-    preferredForCreation: boolean;
-    /**
-     * The input project path this directory was derived from (only for project scope)
-     */
-    projectPath?: string;
+export interface CopilotUserResponse {
+    login?: string;
+    access_type_sku?: string;
+    analytics_tracking_id?: string;
+    assigned_date?: ({
+        [k: string]: unknown | undefined;
+    } | string) | null;
+    can_signup_for_limited?: boolean;
+    chat_enabled?: boolean;
+    copilot_plan?: string;
+    copilotignore_enabled?: boolean;
+    endpoints?: CopilotUserResponseEndpoints;
+    organization_login_list?: string[];
+    organization_list?: ({
+        [k: string]: unknown | undefined;
+    } | ({
+        login?: ({
+            [k: string]: unknown | undefined;
+        } | string) | null;
+        name?: ({
+            [k: string]: unknown | undefined;
+        } | string) | null;
+    } | null)[]) | null;
+    codex_agent_enabled?: boolean;
+    is_mcp_enabled?: ({
+        [k: string]: unknown | undefined;
+    } | boolean) | null;
+    quota_reset_date?: string;
+    quota_snapshots?: CopilotUserResponseQuotaSnapshots;
+    restricted_telemetry?: boolean;
+    is_staff?: boolean;
+    token_based_billing?: boolean;
+    can_upgrade_plan?: boolean;
+    quota_reset_date_utc?: string;
+    limited_user_quotas?: {
+        [k: string]: number | undefined;
+    };
+    limited_user_reset_date?: string;
+    monthly_quotas?: {
+        [k: string]: number | undefined;
+    };
+    cloud_session_storage_enabled?: boolean;
+    cli_remote_control_enabled?: boolean;
 }
 /**
- * Canonical locations where custom agents can be created so the runtime will recognize them.
+ * Schema for the `CopilotUserResponseEndpoints` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentDiscoveryPathList".
+ * via the `definition` "CopilotUserResponseEndpoints".
  */
-/** @experimental */
-export interface AgentDiscoveryPathList {
-    /**
-     * Canonical agent create/discovery directories, in priority order
-     */
-    paths: AgentDiscoveryPath[];
+export interface CopilotUserResponseEndpoints {
+    api?: string;
+    "origin-tracker"?: string;
+    proxy?: string;
+    telemetry?: string;
 }
 /**
- * The currently selected custom agent, or null when using the default agent.
+ * Schema for the `CopilotUserResponseQuotaSnapshots` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentGetCurrentResult".
+ * via the `definition` "CopilotUserResponseQuotaSnapshots".
  */
-/** @experimental */
-export interface AgentGetCurrentResult {
-    /**
-     * Currently selected custom agent, or null if using the default agent
-     */
-    agent?: AgentInfo | null;
+export interface CopilotUserResponseQuotaSnapshots {
+    chat?: CopilotUserResponseQuotaSnapshotsChat;
+    completions?: CopilotUserResponseQuotaSnapshotsCompletions;
+    premium_interactions?: CopilotUserResponseQuotaSnapshotsPremiumInteractions;
+    [k: string]: ({
+        entitlement?: number;
+        overage_count?: number;
+        overage_permitted?: boolean;
+        percent_remaining?: number;
+        quota_id?: string;
+        quota_remaining?: number;
+        remaining?: number;
+        unlimited?: boolean;
+        timestamp_utc?: string;
+        has_quota?: boolean;
+        quota_reset_at?: number;
+        token_based_billing?: boolean;
+    } | null) | undefined;
 }
 /**
- * Schema for the `AgentInfo` type.
+ * Schema for the `CopilotUserResponseQuotaSnapshotsChat` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentInfo".
+ * via the `definition` "CopilotUserResponseQuotaSnapshotsChat".
  */
-/** @experimental */
-export interface AgentInfo {
-    /**
-     * Unique identifier of the custom agent
-     */
-    name: string;
-    /**
-     * Human-readable display name
-     */
-    displayName: string;
-    /**
-     * Description of the agent's purpose
-     */
-    description: string;
-    /**
-     * Absolute local file path of the agent definition. Only set for file-based agents loaded from disk; remote agents do not have a path.
-     */
-    path?: string;
-    /**
-     * Stable identifier for selection. For most agents this is the same as `name`; for plugin/builtin agents it may differ. Always populated; defaults to `name` when no distinct id was assigned.
-     */
-    id: string;
-    source?: AgentInfoSource;
-    /**
-     * Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only.
-     */
-    userInvocable?: boolean;
-    /**
-     * Allowed tool names for this agent. Empty array means none; omitted means inherit defaults.
-     */
-    tools?: string[];
-    /**
-     * Preferred model id for this agent. When omitted, inherits the outer agent's model.
-     */
-    model?: string;
-    /**
-     * MCP server configurations attached to this agent, keyed by server name. Server config shape mirrors the MCP `mcpServers` schema.
-     *
-     * @experimental
-     */
-    mcpServers?: {
-        [k: string]: unknown | undefined;
-    };
-    /**
-     * Skill names preloaded into this agent's context. Omitted means none.
-     */
-    skills?: string[];
+export interface CopilotUserResponseQuotaSnapshotsChat {
+    entitlement?: number;
+    overage_count?: number;
+    overage_permitted?: boolean;
+    percent_remaining?: number;
+    quota_id?: string;
+    quota_remaining?: number;
+    remaining?: number;
+    unlimited?: boolean;
+    timestamp_utc?: string;
+    has_quota?: boolean;
+    quota_reset_at?: number;
+    token_based_billing?: boolean;
 }
 /**
- * Custom agents available to the session.
+ * Schema for the `CopilotUserResponseQuotaSnapshotsCompletions` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentList".
+ * via the `definition` "CopilotUserResponseQuotaSnapshotsCompletions".
  */
-/** @experimental */
-export interface AgentList {
-    /**
-     * Available custom agents
-     */
-    agents: AgentInfo[];
+export interface CopilotUserResponseQuotaSnapshotsCompletions {
+    entitlement?: number;
+    overage_count?: number;
+    overage_permitted?: boolean;
+    percent_remaining?: number;
+    quota_id?: string;
+    quota_remaining?: number;
+    remaining?: number;
+    unlimited?: boolean;
+    timestamp_utc?: string;
+    has_quota?: boolean;
+    quota_reset_at?: number;
+    token_based_billing?: boolean;
 }
 /**
- * Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).
+ * Schema for the `CopilotUserResponseQuotaSnapshotsPremiumInteractions` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistryLiveTargetEntry".
+ * via the `definition` "CopilotUserResponseQuotaSnapshotsPremiumInteractions".
  */
-/** @experimental */
-export interface AgentRegistryLiveTargetEntry {
-    /**
-     * Registry entry schema version (1 = ui-server, 2 = managed-server)
-     */
-    schemaVersion: number;
-    kind: AgentRegistryLiveTargetEntryKind;
+export interface CopilotUserResponseQuotaSnapshotsPremiumInteractions {
+    entitlement?: number;
+    overage_count?: number;
+    overage_permitted?: boolean;
+    percent_remaining?: number;
+    quota_id?: string;
+    quota_remaining?: number;
+    remaining?: number;
+    unlimited?: boolean;
+    timestamp_utc?: string;
+    has_quota?: boolean;
+    quota_reset_at?: number;
+    token_based_billing?: boolean;
+}
+/**
+ * Schema for the `EnvAuthInfo` type.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "EnvAuthInfo".
+ */
+export interface EnvAuthInfo {
     /**
-     * Operating-system pid of the process owning this entry
+     * Personal access token (PAT) or server-to-server token sourced from an environment variable.
      */
-    pid: number;
+    type: "env";
     /**
-     * Bind host for the entry's JSON-RPC server
+     * Authentication host (e.g. https://github.com or a GHES host).
      */
     host: string;
     /**
-     * TCP port the entry's JSON-RPC server is listening on
-     */
-    port: number;
-    /**
-     * Session ID of the foreground session for this entry
-     */
-    sessionId?: string;
-    /**
-     * Friendly session name (when set)
-     */
-    sessionName?: string;
-    /**
-     * Working directory of the session (when known)
-     */
-    cwd?: string;
-    /**
-     * Git branch of the session (when known)
-     */
-    branch?: string;
-    /**
-     * Model identifier currently selected for the session
-     */
-    model?: string;
-    status?: AgentRegistryLiveTargetEntryStatus;
-    attentionKind?: AgentRegistryLiveTargetEntryAttentionKind;
-    /**
-     * Monotonic per-publisher revision counter incremented on every status update. Lets watchers detect transient flips.
-     */
-    statusRevision?: number;
-    lastTerminalEvent?: AgentRegistryLiveTargetEntryLastTerminalEvent;
-    /**
-     * ISO 8601 timestamp captured at registration
+     * User login associated with the token. Undefined for server-to-server tokens (those starting with `ghs_`).
      */
-    startedAt: string;
+    login?: string;
     /**
-     * Copilot CLI version that wrote the entry
+     * The token value itself. Treat as a secret.
      */
-    copilotVersion: string;
+    token: string;
     /**
-     * Wall-clock milliseconds since the watcher last observed this entry (heartbeat freshness)
+     * Name of the environment variable the token was sourced from.
      */
-    lastSeenMs: number;
+    envVar: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Per-spawn log-capture outcome; populated from spawnLiveTarget.
+ * Schema for the `TokenAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistryLogCapture".
+ * via the `definition` "TokenAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistryLogCapture {
+export interface TokenAuthInfo {
     /**
-     * Whether per-spawn log capture is on (false when env-disabled or open failed)
+     * SDK-side token authentication; the host configured the token directly via the SDK.
      */
-    enabled: boolean;
+    type: "token";
     /**
-     * Absolute path to the per-spawn log file (only set when enabled)
+     * Authentication host.
      */
-    path?: string;
+    host: string;
     /**
-     * Human-readable open failure message (only set when enabled === false AND the env-disable opt-out was NOT used)
+     * The token value itself. Treat as a secret.
      */
-    openError?: string;
-    openErrorReason?: AgentRegistryLogCaptureOpenErrorReason;
+    token: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * `child_process.spawn` itself failed before the child entered the registry.
+ * Schema for the `CopilotApiTokenAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnError".
+ * via the `definition` "CopilotApiTokenAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistrySpawnError {
-    /**
-     * Discriminator: child_process.spawn itself failed
-     */
-    kind: "spawn-error";
+export interface CopilotApiTokenAuthInfo {
     /**
-     * Human-readable error message
+     * Direct Copilot API authentication via the `GITHUB_COPILOT_API_TOKEN` + `COPILOT_API_URL` environment-variable pair. The token itself is read from the environment by the runtime, not carried in this struct.
      */
-    message: string;
+    type: "copilot-api-token";
     /**
-     * Underlying errno code (e.g. ENOENT, EACCES) when available
+     * Authentication host (always the public GitHub host).
      */
-    code?: string;
+    host: "https://github.com";
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Spawn succeeded but the child did not publish a matching managed-server entry within the timeout.
+ * Schema for the `UserAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnRegistryTimeout".
+ * via the `definition` "UserAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistrySpawnRegistryTimeout {
+export interface UserAuthInfo {
     /**
-     * Discriminator: spawn succeeded but child never registered
+     * OAuth user authentication. The token itself is held in the runtime's secret token store (keyed by host+login) and is NOT carried in this struct.
      */
-    kind: "registry-timeout";
+    type: "user";
     /**
-     * Process ID of the orphaned child (so the caller can offer 'kill the pid' guidance)
+     * Authentication host.
      */
-    childPid: number;
-    logCapture?: AgentRegistryLogCapture;
+    host: string;
+    /**
+     * OAuth user login.
+     */
+    login: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Inputs to spawn a managed-server child via the controller's spawn delegate.
+ * Schema for the `GhCliAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnRequest".
+ * via the `definition` "GhCliAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistrySpawnRequest {
-    /**
-     * Working directory for the spawned child (must be an existing directory)
-     */
-    cwd: string;
+export interface GhCliAuthInfo {
     /**
-     * Custom or built-in agent name (e.g. 'explore'). When omitted, the child uses its own default.
+     * Authentication via the `gh` CLI's saved credentials.
      */
-    agentName?: string;
+    type: "gh-cli";
     /**
-     * Model identifier to apply to the new session
+     * Authentication host.
      */
-    model?: string;
+    host: string;
     /**
-     * Friendly session name. Must satisfy validateSessionName: non-empty, no leading/trailing whitespace, <=100 chars, no control chars, no double quotes.
+     * User login as reported by `gh auth status`.
      */
-    name?: string;
-    permissionMode?: AgentRegistrySpawnPermissionMode;
+    login: string;
     /**
-     * Optional first user message. Forwarded to the caller (the CLI's spawn wrapper sends it post-attach via the standard LocalRpcSession.send path).
+     * The token returned by `gh auth token`. Treat as a secret.
      */
-    initialPrompt?: string;
+    token: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Managed-server child was spawned and registered successfully.
+ * Schema for the `ApiKeyAuthInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnSpawned".
+ * via the `definition` "ApiKeyAuthInfo".
  */
-/** @experimental */
-export interface AgentRegistrySpawnSpawned {
+export interface ApiKeyAuthInfo {
     /**
-     * Discriminator: managed-server child spawned successfully
+     * API-key authentication for non-GitHub LLM providers (e.g. when running BYOM-style).
      */
-    kind: "spawned";
-    entry: AgentRegistryLiveTargetEntry;
+    type: "api-key";
     /**
-     * Whether the delegate already sent the initial prompt. Always omitted in the current wiring: the controller sends the prompt post-attach via the standard LocalRpcSession.send path.
+     * The API key. Treat as a secret.
      */
-    initialPromptSent?: boolean;
+    apiKey: string;
     /**
-     * If the delegate attempted to send the initial prompt and failed, the categorized error message.
+     * Authentication host.
      */
-    initialPromptError?: string;
-    logCapture?: AgentRegistryLogCapture;
+    host: string;
+    copilotUser?: CopilotUserResponse;
 }
 /**
- * Synchronous pre-validation rejected the spawn request.
+ * Current authentication state
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentRegistrySpawnValidationError".
+ * via the `definition` "AccountGetCurrentAuthResult".
  */
-/** @experimental */
-export interface AgentRegistrySpawnValidationError {
+export interface AccountGetCurrentAuthResult {
+    authInfo?: AuthInfo;
     /**
-     * Discriminator: synchronous pre-validation rejected the request
+     * Authentication errors from the last auth attempt, if any
      */
-    kind: "validation-error";
-    reason: AgentRegistrySpawnValidationErrorReason;
-    field?: AgentRegistrySpawnValidationErrorField;
-    /**
-     * Human-readable explanation; safe to surface in the UI banner. Never logged to unrestricted telemetry.
+    authErrors?: string[];
+}
+export interface AccountGetQuotaRequest {
+    /**
+     * GitHub token for per-user quota lookup. When provided, resolves this token to determine the user's quota instead of using the global auth.
      */
-    message: string;
+    gitHubToken?: string;
 }
 /**
- * Custom agents available to the session after reloading definitions from disk.
+ * Quota usage snapshots for the resolved user, keyed by quota type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentReloadResult".
+ * via the `definition` "AccountGetQuotaResult".
  */
-/** @experimental */
-export interface AgentReloadResult {
+export interface AccountGetQuotaResult {
     /**
-     * Reloaded custom agents
+     * Quota snapshots keyed by type (e.g., chat, completions, premium_interactions)
      */
-    agents: AgentInfo[];
+    quotaSnapshots: {
+        [k: string]: AccountQuotaSnapshot | undefined;
+    };
 }
 /**
- * Optional project paths to include in agent discovery.
+ * Schema for the `AccountQuotaSnapshot` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentsDiscoverRequest".
+ * via the `definition` "AccountQuotaSnapshot".
  */
-/** @experimental */
-export interface AgentsDiscoverRequest {
+export interface AccountQuotaSnapshot {
     /**
-     * Optional list of project directory paths to scan for project-scoped agents. When omitted or empty, only user/plugin/remote-independent agents are returned (no project scan).
+     * Whether the user has an unlimited usage entitlement
      */
-    projectPaths?: string[];
+    isUnlimitedEntitlement: boolean;
     /**
-     * When true, omit the host's agents (the user-level agent directory and all plugin agents), leaving only project and remote agents. For multitenant deployments.
+     * Number of requests included in the entitlement, or -1 for unlimited entitlements
      */
-    excludeHostAgents?: boolean;
+    entitlementRequests: number;
+    /**
+     * Number of requests used so far this period
+     */
+    usedRequests: number;
+    /**
+     * Whether usage is still permitted after quota exhaustion
+     */
+    usageAllowedWithExhaustedQuota: boolean;
+    /**
+     * Percentage of entitlement remaining
+     */
+    remainingPercentage: number;
+    /**
+     * Number of additional usage requests made this period
+     */
+    overage: number;
+    /**
+     * Whether additional usage is allowed when quota is exhausted
+     */
+    overageAllowedWithExhaustedQuota: boolean;
+    /**
+     * Date when the quota resets (ISO 8601 string)
+     */
+    resetDate?: string;
 }
 /**
- * Name of the custom agent to select for subsequent turns.
+ * Credentials to store after successful authentication
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentSelectRequest".
+ * via the `definition` "AccountLoginRequest".
  */
-/** @experimental */
-export interface AgentSelectRequest {
+export interface AccountLoginRequest {
     /**
-     * Name of the custom agent to select
+     * GitHub host URL
      */
-    name: string;
+    host: string;
+    /**
+     * User login/username
+     */
+    login: string;
+    /**
+     * GitHub authentication token
+     */
+    token: string;
 }
 /**
- * The newly selected custom agent.
+ * Result of a successful login; throws on failure
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentSelectResult".
+ * via the `definition` "AccountLoginResult".
  */
-/** @experimental */
-export interface AgentSelectResult {
-    agent: AgentInfo;
+export interface AccountLoginResult {
+    /**
+     * Whether the credential was persisted to a secure store (system keychain, or the config file when plaintext storage is enabled). False when no secure store was available and the token was not saved, so the consumer can decide how to proceed.
+     */
+    storedInVault: boolean;
 }
 /**
- * Optional project paths to include when enumerating agent discovery directories.
+ * User to log out
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AgentsGetDiscoveryPathsRequest".
+ * via the `definition` "AccountLogoutRequest".
  */
-/** @experimental */
-export interface AgentsGetDiscoveryPathsRequest {
-    /**
-     * Optional list of project directory paths. When omitted or empty, only the user-level directory is returned.
-     */
-    projectPaths?: string[];
+export interface AccountLogoutRequest {
+    authInfo: AuthInfo;
+}
+/**
+ * Logout result indicating if more users remain
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AccountLogoutResult".
+ */
+export interface AccountLogoutResult {
     /**
-     * When true, omit the host's user-level agent directory, leaving only project directories. For multitenant deployments (mirrors `discover`'s `excludeHostAgents`).
+     * Whether other authenticated users remain after logout
      */
-    excludeHostAgents?: boolean;
+    hasMoreUsers: boolean;
 }
 /**
- * Indicates whether the operation succeeded and reports the post-mutation state.
+ * Schema for the `AgentDiscoveryPath` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AllowAllPermissionSetResult".
+ * via the `definition` "AgentDiscoveryPath".
  */
 /** @experimental */
-export interface AllowAllPermissionSetResult {
+export interface AgentDiscoveryPath {
     /**
-     * Whether the operation succeeded
+     * Absolute path of the search/create directory (may not exist on disk yet)
      */
-    success: boolean;
+    path: string;
+    scope: AgentDiscoveryPathScope;
     /**
-     * Authoritative allow-all state after the mutation
+     * Whether this is the canonical directory to create a new agent in its tier. At most one entry per tier is preferred.
      */
-    enabled: boolean;
+    preferredForCreation: boolean;
+    /**
+     * The input project path this directory was derived from (only for project scope)
+     */
+    projectPath?: string;
 }
 /**
- * Current full allow-all permission state.
+ * Canonical locations where custom agents can be created so the runtime will recognize them.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "AllowAllPermissionState".
+ * via the `definition` "AgentDiscoveryPathList".
  */
 /** @experimental */
-export interface AllowAllPermissionState {
+export interface AgentDiscoveryPathList {
     /**
-     * Whether full allow-all permissions are currently active
+     * Canonical agent create/discovery directories, in priority order
      */
-    enabled: boolean;
+    paths: AgentDiscoveryPath[];
 }
 /**
- * Schema for the `ApiKeyAuthInfo` type.
+ * The currently selected custom agent, or null when using the default agent.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "ApiKeyAuthInfo".
+ * via the `definition` "AgentGetCurrentResult".
  */
 /** @experimental */
-export interface ApiKeyAuthInfo {
-    /**
-     * API-key authentication for non-GitHub LLM providers (e.g. when running BYOM-style).
-     */
-    type: "api-key";
-    /**
-     * The API key. Treat as a secret.
-     */
-    apiKey: string;
+export interface AgentGetCurrentResult {
     /**
-     * Authentication host.
+     * Currently selected custom agent, or null if using the default agent
      */
-    host: string;
-    copilotUser?: CopilotUserResponse;
+    agent?: AgentInfo | null;
 }
 /**
- * Snapshot of the authenticated user's Copilot subscription info, if known. Mirrors the GitHub API `/copilot_internal/v2/token` user response shape — the runtime trusts this verbatim and does not re-fetch when set.
+ * Schema for the `AgentInfo` type.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponse".
+ * via the `definition` "AgentInfo".
  */
 /** @experimental */
-export interface CopilotUserResponse {
-    login?: string;
-    access_type_sku?: string;
-    analytics_tracking_id?: string;
-    assigned_date?: ({
-        [k: string]: unknown | undefined;
-    } | string) | null;
-    can_signup_for_limited?: boolean;
-    chat_enabled?: boolean;
-    copilot_plan?: string;
-    copilotignore_enabled?: boolean;
-    endpoints?: CopilotUserResponseEndpoints;
-    organization_login_list?: string[];
-    organization_list?: ({
-        [k: string]: unknown | undefined;
-    } | ({
-        login?: ({
-            [k: string]: unknown | undefined;
-        } | string) | null;
-        name?: ({
-            [k: string]: unknown | undefined;
-        } | string) | null;
-    } | null)[]) | null;
-    codex_agent_enabled?: boolean;
-    is_mcp_enabled?: ({
+export interface AgentInfo {
+    /**
+     * Unique identifier of the custom agent
+     */
+    name: string;
+    /**
+     * Human-readable display name
+     */
+    displayName: string;
+    /**
+     * Description of the agent's purpose
+     */
+    description: string;
+    /**
+     * Absolute local file path of the agent definition. Only set for file-based agents loaded from disk; remote agents do not have a path.
+     */
+    path?: string;
+    /**
+     * Stable identifier for selection. For most agents this is the same as `name`; for plugin/builtin agents it may differ. Always populated; defaults to `name` when no distinct id was assigned.
+     */
+    id: string;
+    source?: AgentInfoSource;
+    /**
+     * Whether the agent can be selected directly by the user. Agents marked `false` are subagent-only.
+     */
+    userInvocable?: boolean;
+    /**
+     * Allowed tool names for this agent. Empty array means none; omitted means inherit defaults.
+     */
+    tools?: string[];
+    /**
+     * Preferred model id for this agent. When omitted, inherits the outer agent's model.
+     */
+    model?: string;
+    /**
+     * MCP server configurations attached to this agent, keyed by server name. Server config shape mirrors the MCP `mcpServers` schema.
+     *
+     * @experimental
+     */
+    mcpServers?: {
         [k: string]: unknown | undefined;
-    } | boolean) | null;
-    quota_reset_date?: string;
-    quota_snapshots?: CopilotUserResponseQuotaSnapshots;
-    restricted_telemetry?: boolean;
-    is_staff?: boolean;
-    token_based_billing?: boolean;
-    can_upgrade_plan?: boolean;
-    quota_reset_date_utc?: string;
-    limited_user_quotas?: {
-        [k: string]: number | undefined;
     };
-    limited_user_reset_date?: string;
-    monthly_quotas?: {
-        [k: string]: number | undefined;
-    };
-    cloud_session_storage_enabled?: boolean;
-    cli_remote_control_enabled?: boolean;
+    /**
+     * Skill names preloaded into this agent's context. Omitted means none.
+     */
+    skills?: string[];
 }
 /**
- * Schema for the `CopilotUserResponseEndpoints` type.
+ * Custom agents available to the session.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseEndpoints".
+ * via the `definition` "AgentList".
  */
 /** @experimental */
-export interface CopilotUserResponseEndpoints {
-    api?: string;
-    "origin-tracker"?: string;
-    proxy?: string;
-    telemetry?: string;
+export interface AgentList {
+    /**
+     * Available custom agents
+     */
+    agents: AgentInfo[];
 }
 /**
- * Schema for the `CopilotUserResponseQuotaSnapshots` type.
+ * Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseQuotaSnapshots".
+ * via the `definition` "AgentRegistryLiveTargetEntry".
  */
 /** @experimental */
-export interface CopilotUserResponseQuotaSnapshots {
-    chat?: CopilotUserResponseQuotaSnapshotsChat;
-    completions?: CopilotUserResponseQuotaSnapshotsCompletions;
-    premium_interactions?: CopilotUserResponseQuotaSnapshotsPremiumInteractions;
-    [k: string]: ({
-        entitlement?: number;
-        overage_count?: number;
-        overage_permitted?: boolean;
-        percent_remaining?: number;
-        quota_id?: string;
-        quota_remaining?: number;
-        remaining?: number;
-        unlimited?: boolean;
-        timestamp_utc?: string;
-        has_quota?: boolean;
-        quota_reset_at?: number;
-        token_based_billing?: boolean;
-    } | null) | undefined;
+export interface AgentRegistryLiveTargetEntry {
+    /**
+     * Registry entry schema version (1 = ui-server, 2 = managed-server)
+     */
+    schemaVersion: number;
+    kind: AgentRegistryLiveTargetEntryKind;
+    /**
+     * Operating-system pid of the process owning this entry
+     */
+    pid: number;
+    /**
+     * Bind host for the entry's JSON-RPC server
+     */
+    host: string;
+    /**
+     * TCP port the entry's JSON-RPC server is listening on
+     */
+    port: number;
+    /**
+     * Session ID of the foreground session for this entry
+     */
+    sessionId?: string;
+    /**
+     * Friendly session name (when set)
+     */
+    sessionName?: string;
+    /**
+     * Working directory of the session (when known)
+     */
+    cwd?: string;
+    /**
+     * Git branch of the session (when known)
+     */
+    branch?: string;
+    /**
+     * Model identifier currently selected for the session
+     */
+    model?: string;
+    status?: AgentRegistryLiveTargetEntryStatus;
+    attentionKind?: AgentRegistryLiveTargetEntryAttentionKind;
+    /**
+     * Monotonic per-publisher revision counter incremented on every status update. Lets watchers detect transient flips.
+     */
+    statusRevision?: number;
+    lastTerminalEvent?: AgentRegistryLiveTargetEntryLastTerminalEvent;
+    /**
+     * ISO 8601 timestamp captured at registration
+     */
+    startedAt: string;
+    /**
+     * Copilot CLI version that wrote the entry
+     */
+    copilotVersion: string;
+    /**
+     * Wall-clock milliseconds since the watcher last observed this entry (heartbeat freshness)
+     */
+    lastSeenMs: number;
 }
 /**
- * Schema for the `CopilotUserResponseQuotaSnapshotsChat` type.
+ * Per-spawn log-capture outcome; populated from spawnLiveTarget.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseQuotaSnapshotsChat".
+ * via the `definition` "AgentRegistryLogCapture".
  */
 /** @experimental */
-export interface CopilotUserResponseQuotaSnapshotsChat {
-    entitlement?: number;
-    overage_count?: number;
-    overage_permitted?: boolean;
-    percent_remaining?: number;
-    quota_id?: string;
-    quota_remaining?: number;
-    remaining?: number;
-    unlimited?: boolean;
-    timestamp_utc?: string;
-    has_quota?: boolean;
-    quota_reset_at?: number;
-    token_based_billing?: boolean;
+export interface AgentRegistryLogCapture {
+    /**
+     * Whether per-spawn log capture is on (false when env-disabled or open failed)
+     */
+    enabled: boolean;
+    /**
+     * Absolute path to the per-spawn log file (only set when enabled)
+     */
+    path?: string;
+    /**
+     * Human-readable open failure message (only set when enabled === false AND the env-disable opt-out was NOT used)
+     */
+    openError?: string;
+    openErrorReason?: AgentRegistryLogCaptureOpenErrorReason;
 }
 /**
- * Schema for the `CopilotUserResponseQuotaSnapshotsCompletions` type.
+ * `child_process.spawn` itself failed before the child entered the registry.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseQuotaSnapshotsCompletions".
+ * via the `definition` "AgentRegistrySpawnError".
  */
 /** @experimental */
-export interface CopilotUserResponseQuotaSnapshotsCompletions {
-    entitlement?: number;
-    overage_count?: number;
-    overage_permitted?: boolean;
-    percent_remaining?: number;
-    quota_id?: string;
-    quota_remaining?: number;
-    remaining?: number;
-    unlimited?: boolean;
-    timestamp_utc?: string;
-    has_quota?: boolean;
-    quota_reset_at?: number;
-    token_based_billing?: boolean;
+export interface AgentRegistrySpawnError {
+    /**
+     * Discriminator: child_process.spawn itself failed
+     */
+    kind: "spawn-error";
+    /**
+     * Human-readable error message
+     */
+    message: string;
+    /**
+     * Underlying errno code (e.g. ENOENT, EACCES) when available
+     */
+    code?: string;
 }
 /**
- * Schema for the `CopilotUserResponseQuotaSnapshotsPremiumInteractions` type.
+ * Spawn succeeded but the child did not publish a matching managed-server entry within the timeout.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotUserResponseQuotaSnapshotsPremiumInteractions".
+ * via the `definition` "AgentRegistrySpawnRegistryTimeout".
  */
 /** @experimental */
-export interface CopilotUserResponseQuotaSnapshotsPremiumInteractions {
-    entitlement?: number;
-    overage_count?: number;
-    overage_permitted?: boolean;
-    percent_remaining?: number;
-    quota_id?: string;
-    quota_remaining?: number;
-    remaining?: number;
-    unlimited?: boolean;
-    timestamp_utc?: string;
-    has_quota?: boolean;
-    quota_reset_at?: number;
-    token_based_billing?: boolean;
+export interface AgentRegistrySpawnRegistryTimeout {
+    /**
+     * Discriminator: spawn succeeded but child never registered
+     */
+    kind: "registry-timeout";
+    /**
+     * Process ID of the orphaned child (so the caller can offer 'kill the pid' guidance)
+     */
+    childPid: number;
+    logCapture?: AgentRegistryLogCapture;
 }
 /**
- * Schema for the `HMACAuthInfo` type.
+ * Inputs to spawn a managed-server child via the controller's spawn delegate.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "HMACAuthInfo".
+ * via the `definition` "AgentRegistrySpawnRequest".
  */
 /** @experimental */
-export interface HMACAuthInfo {
+export interface AgentRegistrySpawnRequest {
     /**
-     * HMAC-based authentication used by GitHub-internal services.
+     * Working directory for the spawned child (must be an existing directory)
      */
-    type: "hmac";
+    cwd: string;
     /**
-     * Authentication host. HMAC auth always targets the public GitHub host.
+     * Custom or built-in agent name (e.g. 'explore'). When omitted, the child uses its own default.
      */
-    host: "https://github.com";
+    agentName?: string;
     /**
-     * HMAC secret used to sign requests.
+     * Model identifier to apply to the new session
      */
-    hmac: string;
-    copilotUser?: CopilotUserResponse;
+    model?: string;
+    /**
+     * Friendly session name. Must satisfy validateSessionName: non-empty, no leading/trailing whitespace, <=100 chars, no control chars, no double quotes.
+     */
+    name?: string;
+    permissionMode?: AgentRegistrySpawnPermissionMode;
+    /**
+     * Optional first user message. Forwarded to the caller (the CLI's spawn wrapper sends it post-attach via the standard LocalRpcSession.send path).
+     */
+    initialPrompt?: string;
 }
 /**
- * Schema for the `EnvAuthInfo` type.
+ * Managed-server child was spawned and registered successfully.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "EnvAuthInfo".
+ * via the `definition` "AgentRegistrySpawnSpawned".
  */
 /** @experimental */
-export interface EnvAuthInfo {
-    /**
-     * Personal access token (PAT) or server-to-server token sourced from an environment variable.
-     */
-    type: "env";
-    /**
-     * Authentication host (e.g. https://github.com or a GHES host).
-     */
-    host: string;
+export interface AgentRegistrySpawnSpawned {
     /**
-     * User login associated with the token. Undefined for server-to-server tokens (those starting with `ghs_`).
+     * Discriminator: managed-server child spawned successfully
      */
-    login?: string;
+    kind: "spawned";
+    entry: AgentRegistryLiveTargetEntry;
     /**
-     * The token value itself. Treat as a secret.
+     * Whether the delegate already sent the initial prompt. Always omitted in the current wiring: the controller sends the prompt post-attach via the standard LocalRpcSession.send path.
      */
-    token: string;
+    initialPromptSent?: boolean;
     /**
-     * Name of the environment variable the token was sourced from.
+     * If the delegate attempted to send the initial prompt and failed, the categorized error message.
      */
-    envVar: string;
-    copilotUser?: CopilotUserResponse;
+    initialPromptError?: string;
+    logCapture?: AgentRegistryLogCapture;
 }
 /**
- * Schema for the `TokenAuthInfo` type.
+ * Synchronous pre-validation rejected the spawn request.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "TokenAuthInfo".
+ * via the `definition` "AgentRegistrySpawnValidationError".
  */
 /** @experimental */
-export interface TokenAuthInfo {
+export interface AgentRegistrySpawnValidationError {
     /**
-     * SDK-side token authentication; the host configured the token directly via the SDK.
+     * Discriminator: synchronous pre-validation rejected the request
      */
-    type: "token";
+    kind: "validation-error";
+    reason: AgentRegistrySpawnValidationErrorReason;
+    field?: AgentRegistrySpawnValidationErrorField;
     /**
-     * Authentication host.
+     * Human-readable explanation; safe to surface in the UI banner. Never logged to unrestricted telemetry.
      */
-    host: string;
+    message: string;
+}
+/**
+ * Custom agents available to the session after reloading definitions from disk.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentReloadResult".
+ */
+/** @experimental */
+export interface AgentReloadResult {
     /**
-     * The token value itself. Treat as a secret.
+     * Reloaded custom agents
      */
-    token: string;
-    copilotUser?: CopilotUserResponse;
+    agents: AgentInfo[];
 }
 /**
- * Schema for the `CopilotApiTokenAuthInfo` type.
+ * Optional project paths to include in agent discovery.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "CopilotApiTokenAuthInfo".
+ * via the `definition` "AgentsDiscoverRequest".
  */
 /** @experimental */
-export interface CopilotApiTokenAuthInfo {
+export interface AgentsDiscoverRequest {
     /**
-     * Direct Copilot API authentication via the `GITHUB_COPILOT_API_TOKEN` + `COPILOT_API_URL` environment-variable pair. The token itself is read from the environment by the runtime, not carried in this struct.
+     * Optional list of project directory paths to scan for project-scoped agents. When omitted or empty, only user/plugin/remote-independent agents are returned (no project scan).
      */
-    type: "copilot-api-token";
+    projectPaths?: string[];
     /**
-     * Authentication host (always the public GitHub host).
+     * When true, omit the host's agents (the user-level agent directory and all plugin agents), leaving only project and remote agents. For multitenant deployments.
      */
-    host: "https://github.com";
-    copilotUser?: CopilotUserResponse;
+    excludeHostAgents?: boolean;
 }
 /**
- * Schema for the `UserAuthInfo` type.
+ * Name of the custom agent to select for subsequent turns.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "UserAuthInfo".
+ * via the `definition` "AgentSelectRequest".
  */
 /** @experimental */
-export interface UserAuthInfo {
+export interface AgentSelectRequest {
     /**
-     * OAuth user authentication. The token itself is held in the runtime's secret token store (keyed by host+login) and is NOT carried in this struct.
+     * Name of the custom agent to select
      */
-    type: "user";
+    name: string;
+}
+/**
+ * The newly selected custom agent.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentSelectResult".
+ */
+/** @experimental */
+export interface AgentSelectResult {
+    agent: AgentInfo;
+}
+/**
+ * Optional project paths to include when enumerating agent discovery directories.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AgentsGetDiscoveryPathsRequest".
+ */
+/** @experimental */
+export interface AgentsGetDiscoveryPathsRequest {
     /**
-     * Authentication host.
+     * Optional list of project directory paths. When omitted or empty, only the user-level directory is returned.
      */
-    host: string;
+    projectPaths?: string[];
     /**
-     * OAuth user login.
+     * When true, omit the host's user-level agent directory, leaving only project directories. For multitenant deployments (mirrors `discover`'s `excludeHostAgents`).
      */
-    login: string;
-    copilotUser?: CopilotUserResponse;
+    excludeHostAgents?: boolean;
 }
 /**
- * Schema for the `GhCliAuthInfo` type.
+ * Indicates whether the operation succeeded and reports the post-mutation state.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "GhCliAuthInfo".
+ * via the `definition` "AllowAllPermissionSetResult".
  */
 /** @experimental */
-export interface GhCliAuthInfo {
-    /**
-     * Authentication via the `gh` CLI's saved credentials.
-     */
-    type: "gh-cli";
+export interface AllowAllPermissionSetResult {
     /**
-     * Authentication host.
+     * Whether the operation succeeded
      */
-    host: string;
+    success: boolean;
     /**
-     * User login as reported by `gh auth status`.
+     * Authoritative allow-all state after the mutation
      */
-    login: string;
+    enabled: boolean;
+}
+/**
+ * Current full allow-all permission state.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "AllowAllPermissionState".
+ */
+/** @experimental */
+export interface AllowAllPermissionState {
     /**
-     * The token returned by `gh auth token`. Treat as a secret.
+     * Whether full allow-all permissions are currently active
      */
-    token: string;
-    copilotUser?: CopilotUserResponse;
+    enabled: boolean;
 }
 /**
  * Cancellation result for a user-requested shell command.
@@ -2716,11 +2837,6 @@ export interface OpenCanvasInstance {
     input?: {
         [k: string]: unknown | undefined;
     };
-    /**
-     * Whether this snapshot came from an idempotent reopen
-     */
-    reopen: boolean;
-    availability: CanvasInstanceAvailability;
 }
 /**
  * Canvas open parameters.
@@ -2880,6 +2996,19 @@ export interface CanvasProviderOpenResult {
      */
     status?: string;
 }
+/**
+ * Options scoped to the built-in CAPI (Copilot API) provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "CapiSessionOptions".
+ */
+/** @experimental */
+export interface CapiSessionOptions {
+    /**
+     * Whether to use WebSocket transport for the CAPI Responses API. Enabled by default when the model advertises `ws:/responses` support; set to `false` to force the HTTP Responses transport in environments where WebSockets are blocked (e.g. behind a proxy). Setting this to `false` is equivalent to the `COPILOT_CLI_DISABLE_WEBSOCKET_RESPONSES` environment variable.
+     */
+    enableWebSocketResponses?: boolean;
+}
 /**
  * Slash commands available in the session, after applying any include/exclude filters.
  *
@@ -4008,6 +4137,10 @@ export interface InstalledPluginInfo {
      * Marketplace the plugin came from. Empty string ("") for direct repo / URL / local installs.
      */
     marketplace: string;
+    /**
+     * Opaque, stable hash identifying a direct (non-marketplace) install source. Present only for direct repo / URL / local installs; absent for marketplace plugins. Same source yields the same id; distinct sources never collide.
+     */
+    directSourceId?: string;
     /**
      * Installed version (when reported by the plugin manifest)
      */
@@ -4159,6 +4292,7 @@ export interface LlmInferenceHeaders {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "LlmInferenceHttpRequestChunkRequest".
  */
+/** @experimental */
 export interface LlmInferenceHttpRequestChunkRequest {
     /**
      * Matches the requestId from the originating httpRequestStart frame.
@@ -4191,6 +4325,7 @@ export interface LlmInferenceHttpRequestChunkRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "LlmInferenceHttpRequestChunkResult".
  */
+/** @experimental */
 export interface LlmInferenceHttpRequestChunkResult {
 }
 /**
@@ -4199,6 +4334,7 @@ export interface LlmInferenceHttpRequestChunkResult {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "LlmInferenceHttpRequestStartRequest".
  */
+/** @experimental */
 export interface LlmInferenceHttpRequestStartRequest {
     /**
      * Opaque runtime-minted id, unique per in-flight request. The SDK uses this to correlate httpRequestChunk frames and to address its httpResponseStart / httpResponseChunk replies back to the runtime.
@@ -4225,6 +4361,7 @@ export interface LlmInferenceHttpRequestStartRequest {
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "LlmInferenceHttpRequestStartResult".
  */
+/** @experimental */
 export interface LlmInferenceHttpRequestStartResult {
 }
 /**
@@ -5212,6 +5349,33 @@ export interface McpFilteredServer {
      */
     enterpriseName?: string;
 }
+/**
+ * MCP headers refresh request id and the host response.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpHeadersHandlePendingHeadersRefreshRequestRequest".
+ */
+/** @experimental */
+export interface McpHeadersHandlePendingHeadersRefreshRequestRequest {
+    /**
+     * Headers refresh request identifier from mcp.headers_refresh_required
+     */
+    requestId: string;
+    result: McpHeadersHandlePendingHeadersRefreshRequest;
+}
+/**
+ * Indicates whether the pending MCP headers refresh response was accepted.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpHeadersHandlePendingHeadersRefreshRequestResult".
+ */
+/** @experimental */
+export interface McpHeadersHandlePendingHeadersRefreshRequestResult {
+    /**
+     * Whether the response was accepted. False if the request was unknown, timed out, or already resolved.
+     */
+    success: boolean;
+}
 /**
  * Host-level state, omitted when no MCP host is initialized.
  *
@@ -5380,7 +5544,7 @@ export interface McpOauthHandlePendingResult {
     success: boolean;
 }
 /**
- * Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, and the callback success-page copy.
+ * Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "McpOauthLoginRequest".
@@ -5403,6 +5567,19 @@ export interface McpOauthLoginRequest {
      * Optional override for the body text shown on the OAuth loopback callback success page. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass surface-specific copy telling the user where to return.
      */
     callbackSuccessMessage?: string;
+    /**
+     * Optional OAuth client ID override for this login. When set, the runtime uses this pre-registered static client instead of dynamic client registration.
+     */
+    clientId?: string;
+    /**
+     * Optional OAuth client secret override for this login. The runtime treats this as an ephemeral host-owned secret, uses it for this authentication attempt and does not persist it.
+     */
+    clientSecret?: string;
+    /**
+     * Optional override indicating whether the static OAuth client is public. When false, the runtime treats it as confidential and uses the per-login clientSecret if provided, otherwise retrieving the client secret from the MCP OAuth secret store.
+     */
+    publicClient?: boolean;
+    grantType?: McpOauthLoginGrantType;
 }
 /**
  * OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.
@@ -5883,6 +6060,10 @@ export interface ModelBilling {
      */
     multiplier?: number;
     tokenPrices?: ModelBillingTokenPrices;
+    /**
+     * Whole-number percentage discount (0-100) applied to usage billed through this model. Populated for the synthetic `auto` model, where requests routed by auto-mode are billed at a reduced rate; absent for concrete models.
+     */
+    discountPercent?: number;
 }
 /**
  * Token-level pricing information for this model
@@ -5900,7 +6081,8 @@ export interface ModelBillingTokenPrices {
      */
     outputPrice?: number;
     /**
-     * Deprecated: use cacheReadPrice. AI Credits cost per billing batch of cached tokens
+     * @deprecated
+     * Use cacheReadPrice instead. AI Credits cost per billing batch of cached tokens
      */
     cachePrice?: number;
     /**
@@ -5916,7 +6098,8 @@ export interface ModelBillingTokenPrices {
      */
     batchSize?: number;
     /**
-     * Deprecated: use maxPromptTokens. Prompt token budget for the default tier. The total context window is this value plus the model's max_output_tokens.
+     * @deprecated
+     * Use maxPromptTokens instead. Prompt token budget for the default tier. The total context window is this value plus the model's max_output_tokens.
      */
     contextMax?: number;
     /**
@@ -5941,7 +6124,8 @@ export interface ModelBillingTokenPricesLongContext {
      */
     outputPrice?: number;
     /**
-     * Deprecated: use cacheReadPrice. AI Credits cost per billing batch of cached tokens
+     * @deprecated
+     * Use cacheReadPrice instead. AI Credits cost per billing batch of cached tokens
      */
     cachePrice?: number;
     /**
@@ -5953,7 +6137,8 @@ export interface ModelBillingTokenPricesLongContext {
      */
     cacheWritePrice?: number;
     /**
-     * Deprecated: use maxPromptTokens. Prompt token budget for the long context tier. The total context window is this value plus the model's max_output_tokens.
+     * @deprecated
+     * Use maxPromptTokens instead. Prompt token budget for the long context tier. The total context window is this value plus the model's max_output_tokens.
      */
     contextMax?: number;
     /**
@@ -6146,6 +6331,7 @@ export interface NamedProviderConfig {
     name: string;
     type?: ProviderConfigType;
     wireApi?: ProviderConfigWireApi;
+    transport?: ProviderConfigTransport;
     /**
      * API endpoint URL.
      */
@@ -6165,6 +6351,10 @@ export interface NamedProviderConfig {
     headers?: {
         [k: string]: string | undefined;
     };
+    /**
+     * When true, the SDK client supplies bearer tokens on demand: the runtime calls the client-session `providerToken.getToken` callback before each request and applies the returned token as an `Authorization: Bearer <token>` header. This is the bearer/OAuth scheme used by Azure AD / managed-identity tokens and provider OAuth access tokens (including Anthropic's), not a provider-specific API-key header such as Anthropic's `x-api-key`. The token-acquiring function itself stays on the SDK side and is never serialized; only this flag crosses the wire. When set alongside `apiKey`/`bearerToken`, the callback takes precedence: the runtime applies the token returned by `providerToken.getToken` as the `Authorization: Bearer` header for each request and does not send the static credential.
+     */
+    hasBearerTokenProvider?: boolean;
 }
 /**
  * Azure-specific provider options.
@@ -7910,6 +8100,10 @@ export interface PluginsUninstallRequest {
      * Plugin name or "plugin@marketplace" spec to uninstall. When ambiguous, prefer the fully-qualified spec.
      */
     name: string;
+    /**
+     * Stable source identity for a direct (non-marketplace) install. Disambiguates uninstall when multiple installed plugins share the same name.
+     */
+    directSourceId?: string | null;
 }
 /**
  * Name (or spec) of the plugin to update.
@@ -8025,6 +8219,78 @@ export interface SessionsPollSpawnedSessionsEvent {
      */
     sessionId: string;
 }
+/**
+ * BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderAddRequest".
+ */
+/** @experimental */
+export interface ProviderAddRequest {
+    /**
+     * Named BYOK provider connections to register, additive to any providers already in the registry. Each name must be unique across the registry and must not contain '/'.
+     */
+    providers?: NamedProviderConfig[];
+    /**
+     * BYOK model definitions to register. Each must reference a provider that is already registered or included in this same call. Selection ids (`provider/id`) must be unique across the registry.
+     */
+    models?: ProviderModelConfig[];
+}
+/**
+ * A BYOK model definition referencing a named provider.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderModelConfig".
+ */
+/** @experimental */
+export interface ProviderModelConfig {
+    /**
+     * Provider-local model id, unique within its provider. The session-wide selection id (shown in the model list and passed to switchTo) is the provider-qualified `provider/id`.
+     */
+    id: string;
+    /**
+     * Name of the NamedProviderConfig that serves this model.
+     */
+    provider: string;
+    /**
+     * The model name sent to the provider API for inference. Defaults to `id`.
+     */
+    wireModel?: string;
+    /**
+     * Well-known base model id used for behavior/capability/config lookup. Defaults to `id`.
+     */
+    modelId?: string;
+    /**
+     * Display name for model pickers. Defaults to the provider-qualified selection id (`provider/id`).
+     */
+    name?: string;
+    /**
+     * Maximum prompt/input tokens for the model.
+     */
+    maxPromptTokens?: number;
+    /**
+     * Maximum context window tokens for the model.
+     */
+    maxContextWindowTokens?: number;
+    /**
+     * Maximum output tokens for the model.
+     */
+    maxOutputTokens?: number;
+    capabilities?: ModelCapabilitiesOverride;
+}
+/**
+ * The selectable model entries synthesized for the models added by this call.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderAddResult".
+ */
+/** @experimental */
+export interface ProviderAddResult {
+    /**
+     * Synthesized selectable model entries for the newly added BYOK models, each under its provider-qualified selection id (`provider/id`). Empty when only providers were added.
+     */
+    models: unknown[];
+}
 /**
  * Custom model-provider configuration (BYOK).
  *
@@ -8035,6 +8301,7 @@ export interface SessionsPollSpawnedSessionsEvent {
 export interface ProviderConfig {
     type?: ProviderConfigType;
     wireApi?: ProviderConfigWireApi;
+    transport?: ProviderConfigTransport;
     /**
      * API endpoint URL.
      */
@@ -8074,6 +8341,10 @@ export interface ProviderConfig {
     headers?: {
         [k: string]: string | undefined;
     };
+    /**
+     * When true, the SDK client supplies bearer tokens on demand: the runtime calls the client-session `providerToken.getToken` callback before each request and applies the returned token as an `Authorization: Bearer <token>` header. This is the bearer/OAuth scheme used by Azure AD / managed-identity tokens and provider OAuth access tokens (including Anthropic's), not a provider-specific API-key header such as Anthropic's `x-api-key`. The token-acquiring function itself stays on the SDK side and is never serialized; only this flag crosses the wire. When set alongside `apiKey`/`bearerToken`, the callback takes precedence: the runtime applies the token returned by `providerToken.getToken` as the `Authorization: Bearer` header for each request and does not send the static credential.
+     */
+    hasBearerTokenProvider?: boolean;
 }
 /**
  * A snapshot of the provider endpoint the session is currently configured to talk to.
@@ -8085,6 +8356,7 @@ export interface ProviderConfig {
 export interface ProviderEndpoint {
     type: ProviderEndpointType;
     wireApi?: ProviderEndpointWireApi;
+    transport?: ProviderEndpointTransport;
     /**
      * Base URL to pass to the LLM client library.
      */
@@ -8140,46 +8412,34 @@ export interface ProviderGetEndpointRequest {
     modelId?: string;
 }
 /**
- * A BYOK model definition referencing a named provider.
+ * Asks the SDK client to acquire a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Issued by the runtime before each outbound model request; the runtime does no caching, so this is sent once per request.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
- * via the `definition` "ProviderModelConfig".
+ * via the `definition` "ProviderTokenAcquireRequest".
  */
 /** @experimental */
-export interface ProviderModelConfig {
-    /**
-     * Provider-local model id, unique within its provider. The session-wide selection id (shown in the model list and passed to switchTo) is the provider-qualified `provider/id`.
-     */
-    id: string;
-    /**
-     * Name of the NamedProviderConfig that serves this model.
-     */
-    provider: string;
-    /**
-     * The model name sent to the provider API for inference. Defaults to `id`.
-     */
-    wireModel?: string;
-    /**
-     * Well-known base model id used for behavior/capability/config lookup. Defaults to `id`.
-     */
-    modelId?: string;
-    /**
-     * Display name for model pickers. Defaults to the provider-qualified selection id (`provider/id`).
-     */
-    name?: string;
+export interface ProviderTokenAcquireRequest {
     /**
-     * Maximum prompt/input tokens for the model.
+     * Target session identifier
      */
-    maxPromptTokens?: number;
+    sessionId: string;
     /**
-     * Maximum context window tokens for the model.
+     * Name of the BYOK provider needing a token. For the legacy whole-session `provider` this is the implicit provider name; for named providers it is `NamedProviderConfig.name`.
      */
-    maxContextWindowTokens?: number;
+    providerName: string;
+}
+/**
+ * A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer <token>` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ProviderTokenAcquireResult".
+ */
+/** @experimental */
+export interface ProviderTokenAcquireResult {
     /**
-     * Maximum output tokens for the model.
+     * The bearer token value (without the `Bearer ` prefix).
      */
-    maxOutputTokens?: number;
-    capabilities?: ModelCapabilitiesOverride;
+    token: string;
 }
 /**
  * File attachment
@@ -8342,6 +8602,279 @@ export interface PushAttachmentGitHubReference {
      */
     url: string;
 }
+/**
+ * Pointer to a GitHub commit.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubCommit".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubCommit {
+    /**
+     * Attachment type discriminator
+     */
+    type: "github_commit";
+    repo: PushGitHubRepoRef;
+    /**
+     * Full commit SHA
+     */
+    oid: string;
+    /**
+     * First line of the commit message
+     */
+    message: string;
+    /**
+     * URL to the commit on GitHub
+     */
+    url: string;
+}
+/**
+ * Pointer to a GitHub repository.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushGitHubRepoRef".
+ */
+/** @experimental */
+export interface PushGitHubRepoRef {
+    /**
+     * Numeric GitHub repository id
+     */
+    id?: number;
+    /**
+     * Repository name (without owner)
+     */
+    name: string;
+    /**
+     * Repository owner login (user or organization)
+     */
+    owner: string;
+}
+/**
+ * Pointer to a GitHub release.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubRelease".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubRelease {
+    /**
+     * Attachment type discriminator
+     */
+    type: "github_release";
+    repo: PushGitHubRepoRef;
+    /**
+     * Git tag the release is anchored to
+     */
+    tagName: string;
+    /**
+     * Human-readable release name
+     */
+    name: string;
+    /**
+     * URL to the release on GitHub
+     */
+    url: string;
+}
+/**
+ * Pointer to a GitHub Actions job.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubActionsJob".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubActionsJob {
+    /**
+     * Attachment type discriminator
+     */
+    type: "github_actions_job";
+    repo: PushGitHubRepoRef;
+    /**
+     * Job id within the workflow run
+     */
+    jobId: number;
+    /**
+     * Display name of the job
+     */
+    jobName: string;
+    /**
+     * Display name of the workflow the job ran in
+     */
+    workflowName: string;
+    /**
+     * URL to the job on GitHub
+     */
+    url: string;
+    /**
+     * Terminal conclusion of the job when finished (e.g., success, failure, cancelled). Absent for in-progress jobs.
+     */
+    conclusion?: string;
+}
+/**
+ * Pointer to a GitHub repository.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubRepository".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubRepository {
+    /**
+     * Attachment type discriminator
+     */
+    type: "github_repository";
+    repo: PushGitHubRepoRef;
+    /**
+     * URL to the repository on GitHub
+     */
+    url: string;
+    /**
+     * Short description of the repository
+     */
+    description?: string;
+    /**
+     * Git ref this attachment is anchored at (branch, tag, or commit). When absent the default branch is implied.
+     */
+    ref?: string;
+}
+/**
+ * Pointer to a single-file diff. At least one of `head` and `base` must be present.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubFileDiff".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubFileDiff {
+    /**
+     * Attachment type discriminator
+     */
+    type: "github_file_diff";
+    /**
+     * URL to the diff on GitHub (e.g., a commit, compare, or PR-file URL)
+     */
+    url: string;
+    head?: PushAttachmentGitHubFileDiffSide;
+    base?: PushAttachmentGitHubFileDiffSide;
+}
+/**
+ * One side of a file diff (head or base)
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubFileDiffSide".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubFileDiffSide {
+    repo: PushGitHubRepoRef;
+    /**
+     * Git ref (branch, tag, or commit SHA) the file is read at
+     */
+    ref: string;
+    /**
+     * Repository-relative path to the file
+     */
+    path: string;
+}
+/**
+ * Pointer to a comparison between two git revisions.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubTreeComparison".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubTreeComparison {
+    /**
+     * Attachment type discriminator
+     */
+    type: "github_tree_comparison";
+    /**
+     * URL to the comparison on GitHub
+     */
+    url: string;
+    base: PushAttachmentGitHubTreeComparisonSide;
+    head: PushAttachmentGitHubTreeComparisonSide;
+}
+/**
+ * One side of a tree comparison (head or base)
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubTreeComparisonSide".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubTreeComparisonSide {
+    repo: PushGitHubRepoRef;
+    /**
+     * Git revision (branch, tag, or commit SHA)
+     */
+    revision: string;
+}
+/**
+ * Generic GitHub URL reference.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubUrl".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubUrl {
+    /**
+     * Attachment type discriminator
+     */
+    type: "github_url";
+    /**
+     * URL to the GitHub resource
+     */
+    url: string;
+}
+/**
+ * Pointer to a file in a GitHub repository at a specific ref.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubFile".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubFile {
+    /**
+     * Attachment type discriminator
+     */
+    type: "github_file";
+    repo: PushGitHubRepoRef;
+    /**
+     * Git ref the file is read at (branch, tag, or commit SHA)
+     */
+    ref: string;
+    /**
+     * Repository-relative path to the file
+     */
+    path: string;
+    /**
+     * URL to the file on GitHub
+     */
+    url: string;
+}
+/**
+ * Pointer to a line range inside a file in a GitHub repository.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PushAttachmentGitHubSnippet".
+ */
+/** @experimental */
+export interface PushAttachmentGitHubSnippet {
+    /**
+     * Attachment type discriminator
+     */
+    type: "github_snippet";
+    repo: PushGitHubRepoRef;
+    /**
+     * Git ref the file is read at (branch, tag, or commit SHA)
+     */
+    ref: string;
+    /**
+     * Repository-relative path to the file
+     */
+    path: string;
+    /**
+     * URL to the snippet on GitHub (with line anchor)
+     */
+    url: string;
+    lineRange: PushAttachmentFileLineRange;
+}
 /**
  * Blob attachment with inline base64-encoded data
  *
@@ -8794,12 +9327,6 @@ export interface SandboxConfig {
      */
     enabled: boolean;
     userPolicy?: SandboxConfigUserPolicy;
-    /**
-     * Raw `ContainerConfig` (per `@microsoft/mxc-sdk`) passed directly to `spawnSandboxFromConfig`, bypassing policy merging.
-     */
-    config?: {
-        [k: string]: unknown | undefined;
-    };
     /**
      * Whether to auto-add the current working directory to readwritePaths. Default: true.
      */
@@ -8815,6 +9342,7 @@ export interface SandboxConfig {
 export interface SandboxConfigUserPolicy {
     filesystem?: SandboxConfigUserPolicyFilesystem;
     network?: SandboxConfigUserPolicyNetwork;
+    seatbelt?: SandboxConfigUserPolicySeatbelt;
     experimental?: SandboxConfigUserPolicyExperimental;
 }
 /**
@@ -8867,6 +9395,19 @@ export interface SandboxConfigUserPolicyNetwork {
      */
     blockedHosts?: string[];
 }
+/**
+ * macOS seatbelt-specific options.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxConfigUserPolicySeatbelt".
+ */
+/** @experimental */
+export interface SandboxConfigUserPolicySeatbelt {
+    /**
+     * Whether the macOS seatbelt profile may access the keychain.
+     */
+    keychainAccess?: boolean;
+}
 /**
  * Platform-specific experimental policy fields.
  *
@@ -8926,6 +9467,10 @@ export interface ScheduleEntry {
      * Whether the schedule re-arms after each tick (`/every`) or fires once (`/after`).
      */
     recurring: boolean;
+    /**
+     * True for a self-paced (`dynamic`) schedule: no fixed cadence; the model arms each next run via the `manage_schedule` `wakeup` action. `nextRunAt` is model-controlled.
+     */
+    selfPaced?: boolean;
     /**
      * Display-only label for the prompt as shown in the UI (e.g. `/skill-name` for a skill-invocation schedule). The actual enqueued prompt is `prompt`.
      */
@@ -9136,6 +9681,10 @@ export interface ServerSkill {
      * The project path this skill belongs to (only for project/inherited skills)
      */
     projectPath?: string;
+    /**
+     * Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
+     */
+    argumentHint?: string;
 }
 /**
  * Skills discovered across global and project sources.
@@ -9916,6 +10465,7 @@ export interface SessionOpenOptions {
     isExperimentalMode?: boolean;
     authInfo?: AuthInfo;
     provider?: ProviderConfig;
+    capi?: CapiSessionOptions;
     /**
      * Named BYOK provider connections, additive to CAPI auth. Combining with `provider` is rejected.
      *
@@ -9979,6 +10529,10 @@ export interface SessionOpenOptions {
      */
     logInteractiveShells?: boolean;
     envValueMode?: SessionOpenOptionsEnvValueMode;
+    /**
+     * Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.
+     */
+    allowAllMcpServerInstructions?: boolean;
     /**
      * Additional directories to search for skills.
      */
@@ -10046,6 +10600,7 @@ export interface SessionOpenOptions {
      */
     maxInlineBinaryBytes?: number;
     modelCapabilitiesOverrides?: ModelCapabilitiesOverride;
+    responseBudget?: ResponseBudgetConfig;
     /**
      * Runtime context discriminator for agent filtering.
      */
@@ -10407,6 +10962,10 @@ export interface SessionSetCredentialsResult {
      * Whether the operation succeeded
      */
     success: boolean;
+    /**
+     * Whether the session ended up with a populated `copilotUser` for the installed credentials. `true` when the supplied credential already carried `copilotUser` or it was successfully re-resolved server-side. `false` when the credential is installed without `copilotUser` — either re-resolution failed, or the variant cannot be re-resolved from the credential alone (only the raw-token variants `token`, `env`, and `gh-cli` can). In both `false` cases the token swap still applied, but plan/quota/billing metadata is degraded. Present whenever a credential was supplied; omitted only when no credential was supplied (no-op call).
+     */
+    copilotUserResolved?: boolean;
 }
 /**
  * UUID prefix to resolve to a unique session ID.
@@ -10887,6 +11446,7 @@ export interface SessionUpdateOptionsParams {
      */
     isExperimentalMode?: boolean;
     provider?: ProviderConfig;
+    capi?: CapiSessionOptions;
     /**
      * Absolute working-directory path for shell tools.
      */
@@ -10918,6 +11478,10 @@ export interface SessionUpdateOptionsParams {
      */
     logInteractiveShells?: boolean;
     envValueMode?: OptionsUpdateEnvValueMode;
+    /**
+     * Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.
+     */
+    allowAllMcpServerInstructions?: boolean;
     /**
      * Additional directories to search for skills.
      */
@@ -11033,6 +11597,10 @@ export interface SessionUpdateOptionsParams {
      */
     enableSkills?: boolean;
     contextTier?: OptionsUpdateContextTier;
+    /**
+     * Optional response budget limits. Pass null to clear the response budget.
+     */
+    responseBudget?: ResponseBudgetConfig | null;
 }
 /**
  * Indicates whether the session options patch was applied successfully.
@@ -11185,6 +11753,10 @@ export interface Skill {
      * Name of the plugin that provides the skill, when source is 'plugin'
      */
     pluginName?: string;
+    /**
+     * Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
+     */
+    argumentHint?: string;
 }
 /**
  * Schema for the `SkillDiscoveryPath` type.
@@ -13113,6 +13685,34 @@ export declare function createServerRpc(connection: MessageConnection): {
          * @returns Quota usage snapshots for the resolved user, keyed by quota type.
          */
         getQuota: (params: AccountGetQuotaRequest) => Promise<AccountGetQuotaResult>;
+        /**
+         * Gets the currently active authentication credentials from the global auth manager.
+         *
+         * @returns Current authentication state
+         */
+        getCurrentAuth: () => Promise<AccountGetCurrentAuthResult>;
+        /**
+         * Gets all authenticated users available for account switching.
+         *
+         * @returns List of all authenticated users
+         */
+        getAllUsers: () => Promise<AccountGetAllUsersResult>;
+        /**
+         * Stores authentication credentials after successful login (e.g., device code flow).
+         *
+         * @param params Credentials to store after successful authentication
+         *
+         * @returns Result of a successful login; throws on failure
+         */
+        login: (params: AccountLoginRequest) => Promise<AccountLoginResult>;
+        /**
+         * Removes user authentication from keychain and persisted state.
+         *
+         * @param params User to log out
+         *
+         * @returns Logout result indicating if more users remain
+         */
+        logout: (params: AccountLogoutRequest) => Promise<AccountLogoutResult>;
     };
     secrets: {
         /**
@@ -13613,7 +14213,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
      */
     shutdown: (params: ShutdownRequest) => Promise<void>;
     /** @experimental */
-    auth: {
+    gitHubAuth: {
         /**
          * Gets authentication status and account metadata for the session.
          *
@@ -14090,13 +14690,24 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
             /**
              * Starts OAuth authentication for a remote MCP server.
              *
-             * @param params Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, and the callback success-page copy.
+             * @param params Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.
              *
              * @returns OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.
              */
             login: (params: McpOauthLoginRequest) => Promise<McpOauthLoginResult>;
         };
         /** @experimental */
+        headers: {
+            /**
+             * Responds to a pending MCP dynamic headers refresh request. Hosts that subscribe to `mcp.headers_refresh_required` use this to provide short-lived per-server headers or to indicate that no dynamic headers are available for this refresh.
+             *
+             * @param params MCP headers refresh request id and the host response.
+             *
+             * @returns Indicates whether the pending MCP headers refresh response was accepted.
+             */
+            handlePendingHeadersRefreshRequest: (params: McpHeadersHandlePendingHeadersRefreshRequestRequest) => Promise<McpHeadersHandlePendingHeadersRefreshRequestResult>;
+        };
+        /** @experimental */
         apps: {
             /**
              * Fetch an MCP resource (typically a `ui://` MCP App bundle, per SEP-1865) from a connected server. Requires the `mcp-apps` session capability.
@@ -14169,6 +14780,14 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          * @returns A snapshot of the provider endpoint the session is currently configured to talk to.
          */
         getEndpoint: (params?: ProviderGetEndpointRequest) => Promise<ProviderEndpoint>;
+        /**
+         * Adds BYOK providers and/or models to the session's registry at runtime, extending the additive registry built from the session's `providers`/`models` options. Both fields are optional, so a call may add providers only, models only, or both. Within a single call providers are registered before models, so a model may reference a provider added in the same call; across calls a model may reference any provider already registered (from session creation or a prior add). A model whose referenced provider is not registered by the end of the call is rejected. Newly added models become selectable via `model.list` / `model.switchTo` and are inherited by sub-agents spawned afterwards.
+         *
+         * @param params BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.
+         *
+         * @returns The selectable model entries synthesized for the models added by this call.
+         */
+        add: (params: ProviderAddRequest) => Promise<ProviderAddResult>;
     };
     /** @experimental */
     options: {
@@ -14267,7 +14886,7 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
          *
          * @param params Slash command name and optional raw input string to invoke.
          *
-         * @returns Result of invoking the slash command (text output, prompt to send to the agent, or completion).
+         * @returns Result of invoking the slash command (text output, prompt to send to the agent, completion, or subcommand selection).
          */
         invoke: (params: CommandsInvokeRequest) => Promise<SlashCommandInvocationResult>;
         /**
@@ -14803,6 +15422,18 @@ export declare function createSessionRpc(connection: MessageConnection, sessionI
         stop: (params: ScheduleStopRequest) => Promise<ScheduleStopResult>;
     };
 };
+/** Handler for `providerToken` client session API methods. */
+/** @experimental */
+export interface ProviderTokenHandler {
+    /**
+     * Asks the SDK client to get a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Session-scoped: the runtime calls it back on the connection that most recently supplied that provider's config for the session (the creating connection, or a resuming connection if the session was resumed — distinct providers may be owned by different connections), passing the provider name, and uses the returned token as the Authorization header for the outbound model request. The runtime does no caching — it calls this once per outbound request; the SDK consumer owns token acquisition, caching, and refresh.
+     *
+     * @param params Asks the SDK client to acquire a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Issued by the runtime before each outbound model request; the runtime does no caching, so this is sent once per request.
+     *
+     * @returns A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer <token>` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.
+     */
+    getToken(params: ProviderTokenAcquireRequest): Promise<ProviderTokenAcquireResult>;
+}
 /** Handler for `sessionFs` client session API methods. */
 /** @experimental */
 export interface SessionFsHandler {
@@ -14931,6 +15562,7 @@ export interface CanvasHandler {
 }
 /** All client session API handler groups. */
 export interface ClientSessionApiHandlers {
+    providerToken?: ProviderTokenHandler;
     sessionFs?: SessionFsHandler;
     canvas?: CanvasHandler;
 }
@@ -14941,3 +15573,35 @@ export interface ClientSessionApiHandlers {
  * function uses `getHandlers` to resolve the session's handlers.
  */
 export declare function registerClientSessionApiHandlers(connection: MessageConnection, getHandlers: (sessionId: string) => ClientSessionApiHandlers): void;
+/** Handler for `llmInference` client global API methods. */
+/** @experimental */
+export interface LlmInferenceHandler {
+    /**
+     * Announces an outbound model-layer HTTP request the runtime wants the SDK client to service. Carries the request head only; the body always follows as one or more httpRequestChunk frames keyed by the same requestId, even when the body is empty (a single chunk with end=true).
+     *
+     * @param params The head of an outbound model-layer HTTP request.
+     *
+     * @returns Acknowledgement. Returning successfully simply means the SDK accepted the start frame; it does not imply the request will succeed.
+     */
+    httpRequestStart(params: LlmInferenceHttpRequestStartRequest): Promise<LlmInferenceHttpRequestStartResult>;
+    /**
+     * Delivers a body byte range (or a cancellation signal) for a request previously announced via httpRequestStart, correlated by requestId. The runtime fires at least one chunk per request — when there is no body, a single chunk with empty data and end=true. Mid-stream the runtime may send a chunk with cancel=true to abort the request; the SDK then stops issuing httpResponseChunk frames and may emit a terminal httpResponseChunk with error set.
+     *
+     * @param params A request body chunk or cancellation signal.
+     *
+     * @returns Acknowledgement. The SDK is free to ignore the ack and treat chunk delivery as fire-and-forget.
+     */
+    httpRequestChunk(params: LlmInferenceHttpRequestChunkRequest): Promise<LlmInferenceHttpRequestChunkResult>;
+}
+/** All client global API handler groups. */
+export interface ClientGlobalApiHandlers {
+    llmInference?: LlmInferenceHandler;
+}
+/**
+ * Register client global API handlers on a JSON-RPC connection.
+ * The server calls these methods to delegate work to the client.
+ * Unlike session-scoped client APIs, these methods carry no implicit
+ * `sessionId` dispatch key — a single set of handlers serves the entire
+ * connection.
+ */
+export declare function registerClientGlobalApiHandlers(connection: MessageConnection, handlers: ClientGlobalApiHandlers): void;