@github/copilot-sdk 1.0.5-preview.0 → 1.0.5-preview.1

package/dist/cjs/client.js

@@ -925,7 +925,8 @@ class CopilotClient {
         sessionId,
         this.connection,
         void 0,
-        this.onGetTraceContext
+        this.onGetTraceContext,
+        { mcpAuthHandler: config.onMcpAuthRequest }
       );
       s.registerTools(config.tools);
       s.registerCanvases(config.canvases);
@@ -1057,6 +1058,12 @@ class CopilotClient {
         session = initializeSession(returnedSessionId);
         registeredId = returnedSessionId;
       }
+      if (config.onMcpAuthRequest) {
+        await this.connection.sendRequest("session.eventLog.registerInterest", {
+          sessionId: returnedSessionId,
+          eventType: "mcp.oauth_required"
+        });
+      }
       session["_workspacePath"] = workspacePath;
       session.setCapabilities(capabilities);
       await this.updateSessionOptionsForMode(session, config);
@@ -1100,7 +1107,8 @@ class CopilotClient {
       sessionId,
       this.connection,
       void 0,
-      this.onGetTraceContext
+      this.onGetTraceContext,
+      { mcpAuthHandler: config.onMcpAuthRequest }
     );
     session.registerTools(config.tools);
     session.registerCanvases(config.canvases);
@@ -1142,6 +1150,12 @@ class CopilotClient {
     }
     this.sessions.set(sessionId, session);
     this.setupSessionFs(session, config);
+    if (config.onMcpAuthRequest) {
+      await this.connection.sendRequest("session.eventLog.registerInterest", {
+        sessionId,
+        eventType: "mcp.oauth_required"
+      });
+    }
     const toolFilterOptions = this.resolveToolFilterOptions(config);
     try {
       const response = await this.connection.sendRequest("session.resume", {

package/dist/cjs/generated/rpc.js

@@ -34,8 +34,11 @@ function createServerRpc(connection) {
      * @param params Optional message to echo back to the caller.
      *
      * @returns Server liveness response, including the echoed message, current server timestamp, and protocol version.
+     *
+     * @experimental
      */
     ping: async (params) => connection.sendRequest("ping", params),
+    /** @experimental */
     models: {
       /**
        * Lists Copilot models available to the authenticated user.
@@ -46,6 +49,7 @@ function createServerRpc(connection) {
        */
       list: async (params) => connection.sendRequest("models.list", params)
     },
+    /** @experimental */
     tools: {
       /**
        * Lists built-in tools available for a model.
@@ -56,6 +60,7 @@ function createServerRpc(connection) {
        */
       list: async (params) => connection.sendRequest("tools.list", params)
     },
+    /** @experimental */
     account: {
       /**
        * Gets Copilot quota usage for the authenticated user or supplied GitHub token.
@@ -94,6 +99,7 @@ function createServerRpc(connection) {
        */
       logout: async (params) => connection.sendRequest("account.logout", params)
     },
+    /** @experimental */
     secrets: {
       /**
        * Registers secret values for redaction in session logs and exports. The SDK calls this to inject dynamically generated secret values (e.g., OIDC tokens).
@@ -104,7 +110,9 @@ function createServerRpc(connection) {
        */
       addFilterValues: async (params) => connection.sendRequest("secrets.addFilterValues", params)
     },
+    /** @experimental */
     mcp: {
+      /** @experimental */
       config: {
         /**
          * Lists MCP servers from user configuration.
@@ -246,7 +254,9 @@ function createServerRpc(connection) {
         refresh: async (params) => connection.sendRequest("plugins.marketplaces.refresh", params)
       }
     },
+    /** @experimental */
     skills: {
+      /** @experimental */
       config: {
         /**
          * Replaces the global list of disabled skills.
@@ -269,8 +279,6 @@ function createServerRpc(connection) {
        * @param params Optional project paths to enumerate.
        *
        * @returns Canonical locations where skills can be created so the runtime will recognize them.
-       *
-       * @experimental
        */
       getDiscoveryPaths: async (params) => connection.sendRequest("skills.getDiscoveryPaths", params)
     },
@@ -312,20 +320,38 @@ function createServerRpc(connection) {
        */
       getDiscoveryPaths: async (params) => connection.sendRequest("instructions.getDiscoveryPaths", params)
     },
+    /** @experimental */
     user: {
+      /** @experimental */
       settings: {
         /**
          * Drops this runtime process's in-memory user settings cache so the next settings read observes disk.
          */
-        reload: async () => connection.sendRequest("user.settings.reload", {})
+        reload: async () => connection.sendRequest("user.settings.reload", {}),
+        /**
+         * Lists every known user setting (settings.json overlaid with the legacy config.json, config.json wins), each with its effective value, its default, and whether it is at the default — so settings the user has never set still appear with their default value. Does not include repository- or enterprise-managed overrides that the runtime layers on top at session time.
+         *
+         * @returns Per-key metadata for every known user setting (settings.json overlaid with the legacy config.json, config.json wins), including settings left at their default. Excludes repository- and enterprise-managed overrides.
+         */
+        get: async () => connection.sendRequest("user.settings.get", {}),
+        /**
+         * Writes one or more user settings to settings.json, replacing each provided top-level key. A key whose value is null is removed. Returns the keys whose new value is shadowed by a legacy config.json entry (config.json wins on read), which the runtime leaves in place — such writes do not take effect until the legacy value is removed.
+         *
+         * @param params Partial user settings to write to settings.json. Each top-level key is written individually, replacing the existing value; a key whose value is null is removed.
+         *
+         * @returns Outcome of writing user settings.
+         */
+        set: async (params) => connection.sendRequest("user.settings.set", params)
       }
     },
+    /** @experimental */
     runtime: {
       /**
        * Gracefully shuts down an SDK-owned runtime. The response is sent only after cleanup completes; callers may then terminate the owned runtime process.
        */
       shutdown: async () => connection.sendRequest("runtime.shutdown", {})
     },
+    /** @experimental */
     sessionFs: {
       /**
        * Registers an SDK client as the session filesystem provider.
@@ -565,6 +591,8 @@ function createInternalServerRpc(connection) {
      * @param params Optional connection token presented by the SDK client during the handshake.
      *
      * @returns Handshake result reporting the server's protocol version and package version on success.
+     *
+     * @experimental
      */
     connect: async (params) => connection.sendRequest("connect", params),
     /** @experimental */
@@ -1847,6 +1875,23 @@ function createSessionRpc(connection, sessionId) {
       notifySteerableChanged: async (params) => connection.sendRequest("session.remote.notifySteerableChanged", { sessionId, ...params })
     },
     /** @experimental */
+    visibility: {
+      /**
+       * Returns the session's current Mission Control sharing status and shareable GitHub URL. Reflects whether the synced session is visible to repository readers ("repo") or restricted to its creator and collaborators ("unshared").
+       *
+       * @returns Current sharing status and shareable GitHub URL for a session.
+       */
+      get: async () => connection.sendRequest("session.visibility.get", { sessionId }),
+      /**
+       * Sets the session's Mission Control sharing status, controlling whether the synced session is visible to repository readers. Returns the effective status and shareable GitHub URL after the change.
+       *
+       * @param params Desired sharing status for the session.
+       *
+       * @returns Effective sharing status and shareable GitHub URL after updating session visibility.
+       */
+      set: async (params) => connection.sendRequest("session.visibility.set", { sessionId, ...params })
+    },
+    /** @experimental */
     schedule: {
       /**
        * Lists the session's currently active scheduled prompts.

package/dist/cjs/session.js

@@ -50,11 +50,12 @@ class CopilotSession {
    * @param traceContextProvider - Optional callback to get W3C Trace Context for outbound RPCs
    * @internal This constructor is internal. Use {@link CopilotClient.createSession} to create sessions.
    */
-  constructor(sessionId, connection, _workspacePath, traceContextProvider) {
+  constructor(sessionId, connection, _workspacePath, traceContextProvider, options) {
     this.sessionId = sessionId;
     this.connection = connection;
     this._workspacePath = _workspacePath;
     this.traceContextProvider = traceContextProvider;
+    this.mcpAuthHandler = options?.mcpAuthHandler;
   }
   sessionId;
   connection;
@@ -66,6 +67,7 @@ class CopilotSession {
   bearerTokenProviders = /* @__PURE__ */ new Map();
   commandHandlers = /* @__PURE__ */ new Map();
   permissionHandler;
+  mcpAuthHandler;
   userInputHandler;
   elicitationHandler;
   exitPlanModeHandler;
@@ -277,6 +279,18 @@ class CopilotSession {
       if (this.permissionHandler) {
         void this._executePermissionAndRespond(requestId, permissionRequest);
       }
+    } else if (event.type === "mcp.oauth_required") {
+      const data = event.data;
+      if (!data?.requestId) {
+        return;
+      }
+      if (!this.mcpAuthHandler) {
+        console.warn(
+          `Received MCP OAuth request without a registered MCP auth handler. SessionId=${this.sessionId}, RequestId=${data.requestId}`
+        );
+        return;
+      }
+      void this._executeMcpAuthAndRespond(data);
     } else if (event.type === "command.execute") {
       const { requestId, commandName, command, args } = event.data;
       void this._executeCommandAndRespond(requestId, commandName, command, args);
@@ -408,6 +422,31 @@ class CopilotSession {
       }
     }
   }
+  /**
+   * Executes an MCP auth handler and sends the result back via RPC.
+   * @internal
+   */
+  async _executeMcpAuthAndRespond(request) {
+    try {
+      const result = await this.mcpAuthHandler(request, { sessionId: this.sessionId });
+      const response = result && "accessToken" in result ? { kind: "token", ...result } : { kind: "cancelled" };
+      await this.rpc.mcp.oauth.handlePendingRequest({
+        requestId: request.requestId,
+        result: response
+      });
+    } catch (_error) {
+      try {
+        await this.rpc.mcp.oauth.handlePendingRequest({
+          requestId: request.requestId,
+          result: { kind: "cancelled" }
+        });
+      } catch (rpcError) {
+        if (!(rpcError instanceof import_node.ConnectionError || rpcError instanceof import_node.ResponseError)) {
+          throw rpcError;
+        }
+      }
+    }
+  }
   /**
    * Executes a command handler and sends the result back via RPC.
    * @internal

package/dist/client.js

@@ -912,7 +912,8 @@ class CopilotClient {
         sessionId,
         this.connection,
         void 0,
-        this.onGetTraceContext
+        this.onGetTraceContext,
+        { mcpAuthHandler: config.onMcpAuthRequest }
       );
       s.registerTools(config.tools);
       s.registerCanvases(config.canvases);
@@ -1044,6 +1045,12 @@ class CopilotClient {
         session = initializeSession(returnedSessionId);
         registeredId = returnedSessionId;
       }
+      if (config.onMcpAuthRequest) {
+        await this.connection.sendRequest("session.eventLog.registerInterest", {
+          sessionId: returnedSessionId,
+          eventType: "mcp.oauth_required"
+        });
+      }
       session["_workspacePath"] = workspacePath;
       session.setCapabilities(capabilities);
       await this.updateSessionOptionsForMode(session, config);
@@ -1087,7 +1094,8 @@ class CopilotClient {
       sessionId,
       this.connection,
       void 0,
-      this.onGetTraceContext
+      this.onGetTraceContext,
+      { mcpAuthHandler: config.onMcpAuthRequest }
     );
     session.registerTools(config.tools);
     session.registerCanvases(config.canvases);
@@ -1129,6 +1137,12 @@ class CopilotClient {
     }
     this.sessions.set(sessionId, session);
     this.setupSessionFs(session, config);
+    if (config.onMcpAuthRequest) {
+      await this.connection.sendRequest("session.eventLog.registerInterest", {
+        sessionId,
+        eventType: "mcp.oauth_required"
+      });
+    }
     const toolFilterOptions = this.resolveToolFilterOptions(config);
     try {
       const response = await this.connection.sendRequest("session.resume", {