@github/copilot-sdk 1.0.9-preview.3 → 1.0.10-preview.0

package/README.md

@@ -131,10 +131,11 @@ Create a new conversation session.
 
 - `sessionId?: string` - Custom session ID.
 - `model?: string` - Model to use ("gpt-5", "claude-sonnet-4.5", etc.). **Required when using custom provider.**
-- `reasoningEffort?: "low" | "medium" | "high" | "xhigh"` - Reasoning effort level for models that support it. Use `listModels()` to check which models support this option.
+- `reasoningEffort?: "low" | "medium" | "high" | "xhigh" | "max"` - Reasoning effort level for models that support it. Use `listModels()` to check which models support this option.
 - `tools?: Tool[]` - Custom tools exposed to the CLI. Tools without `handler` are declaration-only and must be resolved via pending tool-call RPCs.
 - `systemMessage?: SystemMessageConfig` - System message customization (see below)
 - `infiniteSessions?: InfiniteSessionConfig` - Configure automatic context compaction (see below)
+- `workingDirectory?: string` - Working directory for the session (default: runtime process cwd).
 - `enableSessionStore?: boolean` - Enables the cross-session store for search and retrieval across sessions. When unset in `"copilot-cli"` mode, the runtime default applies (enabled). In `"empty"` mode, defaults to disabled.
 - `provider?: ProviderConfig` - Custom API provider configuration (BYOK - Bring Your Own Key). See [Custom Providers](#custom-providers) section.
 - `onPermissionRequest?: PermissionHandler` - Optional handler called before each tool execution to approve or deny it. When omitted, permission requests are emitted as events and left pending for manual resolution. `approveAll` approves requests when managed settings are disabled and throws when `enableManagedSettings` is true. Custom handlers can inspect `managedApprovalRequired` for human-facing confirmation logic. See [Permission Handling](#permission-handling) section.
@@ -1108,6 +1109,21 @@ try {
 }
 ```
 
+## Development
+
+From the repository root:
+
+```bash
+cd test/harness
+npm ci
+```
+
+```bash
+cd nodejs
+npm ci
+npm test
+```
+
 ## License
 
 MIT

package/dist/cjs/client.js

@@ -1027,7 +1027,7 @@ class CopilotClient {
         this.onGetTraceContext,
         {
           mcpAuthHandler: config.onMcpAuthRequest,
-          managedSettingsEnabled: config.enableManagedSettings
+          managedSettingsEnabled: config.enableManagedSettings === true || config.managedSettings !== void 0
         }
       );
       s.registerTools(config.tools);
@@ -1086,7 +1086,8 @@ class CopilotClient {
           overridesBuiltInTool: tool.overridesBuiltInTool,
           skipPermission: tool.skipPermission,
           defer: tool.defer,
-          metadata: tool.metadata
+          metadata: tool.metadata,
+          isTerminal: tool.isTerminal
         })),
         toolSearch: config.toolSearch,
         canvases: config.canvases?.map((canvas) => canvas.declaration),
@@ -1147,13 +1148,15 @@ class CopilotClient {
         pluginDirectories: config.pluginDirectories,
         instructionDirectories: config.instructionDirectories,
         disabledSkills: config.disabledSkills,
+        disabledMcpServers: config.disabledMcpServers,
         infiniteSessions: config.infiniteSessions,
         memory: config.memory,
         gitHubToken: config.gitHubToken,
         remoteSession: config.remoteSession,
         cloud: config.cloud,
         expAssignments: config.expAssignments,
-        enableManagedSettings: config.enableManagedSettings
+        enableManagedSettings: config.enableManagedSettings,
+        managedSettings: config.managedSettings
       });
       const {
         sessionId: returnedSessionId,
@@ -1231,7 +1234,7 @@ class CopilotClient {
       this.onGetTraceContext,
       {
         mcpAuthHandler: config.onMcpAuthRequest,
-        managedSettingsEnabled: config.enableManagedSettings
+        managedSettingsEnabled: config.enableManagedSettings === true || config.managedSettings !== void 0
       }
     );
     session.registerTools(config.tools);
@@ -1303,7 +1306,8 @@ class CopilotClient {
           overridesBuiltInTool: tool.overridesBuiltInTool,
           skipPermission: tool.skipPermission,
           defer: tool.defer,
-          metadata: tool.metadata
+          metadata: tool.metadata,
+          isTerminal: tool.isTerminal
         })),
         toolSearch: config.toolSearch,
         canvases: config.canvases?.map((canvas) => canvas.declaration),
@@ -1357,6 +1361,7 @@ class CopilotClient {
         pluginDirectories: config.pluginDirectories,
         instructionDirectories: config.instructionDirectories,
         disabledSkills: config.disabledSkills,
+        disabledMcpServers: config.disabledMcpServers,
         infiniteSessions: config.infiniteSessions,
         memory: config.memory,
         disableResume: config.suppressResumeEvent,
@@ -1365,7 +1370,8 @@ class CopilotClient {
         remoteSession: config.remoteSession,
         openCanvases: config.openCanvases,
         expAssignments: config.expAssignments,
-        enableManagedSettings: config.enableManagedSettings
+        enableManagedSettings: config.enableManagedSettings,
+        managedSettings: config.managedSettings
       });
       const { workspacePath, capabilities, openCanvases } = response;
       session["_workspacePath"] = workspacePath;

package/dist/cjs/generated/rpc.js

@@ -191,6 +191,12 @@ function createServerRpc(connection) {
        */
       disable: async (params) => connection.sendRequest("extensions.disable", params)
     },
+    /**
+     * Registers the calling SDK client as the per-entrypoint extension launch provider. Call before creating any sessions. When omitted, the runtime temporarily falls back to its built-in Node launcher for backward compatibility.
+     *
+     * @experimental
+     */
+    registerExtensionLaunchProvider: async () => connection.sendRequest("registerExtensionLaunchProvider", {}),
     /** @experimental */
     plugins: {
       /**
@@ -381,6 +387,15 @@ function createServerRpc(connection) {
       }
     },
     /** @experimental */
+    managedSettings: {
+      /**
+       * Discovers device-managed settings from production MDM and managed-file sources, validates them against the runtime-owned managed-settings schema, and returns the canonical JSON without requiring a session.
+       *
+       * @returns Validated device-managed settings discovered before a session exists.
+       */
+      read: async () => connection.sendRequest("managedSettings.read", {})
+    },
+    /** @experimental */
     runtime: {
       /**
        * Gracefully shuts down an SDK-owned runtime. The response is sent only after cleanup completes; callers may then terminate the owned runtime process.
@@ -2623,6 +2638,11 @@ function registerClientSessionApiHandlers(connection, getHandlers) {
   });
 }
 function registerClientGlobalApiHandlers(connection, handlers) {
+  connection.onRequest("extensionLaunchProvider.resolve", async (params) => {
+    const handler = handlers.extensionLaunchProvider;
+    if (!handler) throw new Error("No extensionLaunchProvider client-global handler registered");
+    return handler.resolve(params);
+  });
   connection.onRequest("llmInference.httpRequestStart", async (params) => {
     const handler = handlers.llmInference;
     if (!handler) throw new Error("No llmInference client-global handler registered");

package/dist/cjs/session.js

@@ -449,22 +449,20 @@ class CopilotSession {
   async sendAndWait(optionsOrPrompt, timeout) {
     const options = typeof optionsOrPrompt === "string" ? { prompt: optionsOrPrompt } : optionsOrPrompt;
     const effectiveTimeout = timeout ?? 6e4;
-    let resolveIdle;
-    let rejectWithError;
-    const idlePromise = new Promise((resolve, reject) => {
-      resolveIdle = resolve;
-      rejectWithError = reject;
+    let resolveOutcome;
+    const outcomePromise = new Promise((resolve) => {
+      resolveOutcome = resolve;
     });
     let lastAssistantMessage;
     const unsubscribe = this.on((event) => {
       if (event.type === "assistant.message") {
         lastAssistantMessage = event;
       } else if (event.type === "session.idle") {
-        resolveIdle();
+        resolveOutcome({ kind: "idle" });
       } else if (event.type === "session.error") {
         const error = new Error(event.data.message);
         error.stack = event.data.stack;
-        rejectWithError(error);
+        resolveOutcome({ kind: "error", error });
       }
     });
     let timeoutId;
@@ -480,7 +478,10 @@ class CopilotSession {
           effectiveTimeout
         );
       });
-      await Promise.race([idlePromise, timeoutPromise]);
+      const outcome = await Promise.race([outcomePromise, timeoutPromise]);
+      if (outcome.kind === "error") {
+        throw outcome.error;
+      }
       return lastAssistantMessage;
     } finally {
       if (timeoutId !== void 0) {
@@ -1382,6 +1383,7 @@ class CopilotSession {
       postToolUse: this.hooks.onPostToolUse,
       postToolUseFailure: this.hooks.onPostToolUseFailure,
       userPromptSubmitted: this.hooks.onUserPromptSubmitted,
+      userPromptTransformed: this.hooks.onUserPromptTransformed,
       sessionStart: this.hooks.onSessionStart,
       sessionEnd: this.hooks.onSessionEnd,
       errorOccurred: this.hooks.onErrorOccurred,

package/dist/client.js

@@ -1004,7 +1004,7 @@ class CopilotClient {
         this.onGetTraceContext,
         {
           mcpAuthHandler: config.onMcpAuthRequest,
-          managedSettingsEnabled: config.enableManagedSettings
+          managedSettingsEnabled: config.enableManagedSettings === true || config.managedSettings !== void 0
         }
       );
       s.registerTools(config.tools);
@@ -1063,7 +1063,8 @@ class CopilotClient {
           overridesBuiltInTool: tool.overridesBuiltInTool,
           skipPermission: tool.skipPermission,
           defer: tool.defer,
-          metadata: tool.metadata
+          metadata: tool.metadata,
+          isTerminal: tool.isTerminal
         })),
         toolSearch: config.toolSearch,
         canvases: config.canvases?.map((canvas) => canvas.declaration),
@@ -1124,13 +1125,15 @@ class CopilotClient {
         pluginDirectories: config.pluginDirectories,
         instructionDirectories: config.instructionDirectories,
         disabledSkills: config.disabledSkills,
+        disabledMcpServers: config.disabledMcpServers,
         infiniteSessions: config.infiniteSessions,
         memory: config.memory,
         gitHubToken: config.gitHubToken,
         remoteSession: config.remoteSession,
         cloud: config.cloud,
         expAssignments: config.expAssignments,
-        enableManagedSettings: config.enableManagedSettings
+        enableManagedSettings: config.enableManagedSettings,
+        managedSettings: config.managedSettings
       });
       const {
         sessionId: returnedSessionId,
@@ -1208,7 +1211,7 @@ class CopilotClient {
       this.onGetTraceContext,
       {
         mcpAuthHandler: config.onMcpAuthRequest,
-        managedSettingsEnabled: config.enableManagedSettings
+        managedSettingsEnabled: config.enableManagedSettings === true || config.managedSettings !== void 0
       }
     );
     session.registerTools(config.tools);
@@ -1280,7 +1283,8 @@ class CopilotClient {
           overridesBuiltInTool: tool.overridesBuiltInTool,
           skipPermission: tool.skipPermission,
           defer: tool.defer,
-          metadata: tool.metadata
+          metadata: tool.metadata,
+          isTerminal: tool.isTerminal
         })),
         toolSearch: config.toolSearch,
         canvases: config.canvases?.map((canvas) => canvas.declaration),
@@ -1334,6 +1338,7 @@ class CopilotClient {
         pluginDirectories: config.pluginDirectories,
         instructionDirectories: config.instructionDirectories,
         disabledSkills: config.disabledSkills,
+        disabledMcpServers: config.disabledMcpServers,
         infiniteSessions: config.infiniteSessions,
         memory: config.memory,
         disableResume: config.suppressResumeEvent,
@@ -1342,7 +1347,8 @@ class CopilotClient {
         remoteSession: config.remoteSession,
         openCanvases: config.openCanvases,
         expAssignments: config.expAssignments,
-        enableManagedSettings: config.enableManagedSettings
+        enableManagedSettings: config.enableManagedSettings,
+        managedSettings: config.managedSettings
       });
       const { workspacePath, capabilities, openCanvases } = response;
       session["_workspacePath"] = workspacePath;

package/dist/generated/rpc.d.ts

@@ -398,6 +398,8 @@ export type DebugCollectLogsResultKind =
 "archive"
 /** A directory containing redacted files was written. */
  | "directory";
+/** @experimental */
+export type DisableBypassPermissionsMode = "disable";
 /**
  * Persisted extension discovery source
  *
@@ -1183,6 +1185,63 @@ export type SessionContextAttribution = {
      * Total token count of the current context window the entries are measured against (system message + conversation messages + tool definitions — the same total reported by /context). Divide an entry's `tokens` by this to derive its share.
      */
     totalTokens: number;
+    /**
+     * The concrete model id the entire breakdown was tokenized against (feeds the per-model token multiplier). Under `Auto` (Free/Student) this is the resolved model, not the literal `auto` sentinel, so totals are not undercounted. A single-model approximation of a potentially multi-model Auto session.
+     */
+    modelId: string;
+    /**
+     * How `modelId` was chosen. Not a closed set — tolerate unknown values. Known values today: `autoResolved` (the model Auto resolved to), `selected` (the user's explicitly selected model), `default` (a fallback before any model is known).
+     */
+    modelSource: string;
+    /**
+     * Maximum prompt tokens the resolved model accepts — the denominator for a `##k/###k` context-usage display. Mirrors `SessionContextInfo.promptTokenLimit`.
+     */
+    promptTokenLimit: number;
+    /**
+     * Prompt limit plus the model's output reserve: the full context window `categories.freeSpace` and `categories.buffer` are measured against. Mirrors `SessionContextInfo.limit`.
+     */
+    limit: number;
+    /**
+     * Output reserve plus the tokens past the buffer-exhaustion blocking threshold. Mirrors `SessionContextInfo.bufferTokens`.
+     */
+    bufferTokens: number;
+    /**
+     * Token count at which background compaction starts. Mirrors `SessionContextInfo.compactionThreshold`.
+     */
+    compactionThreshold: number;
+    /**
+     * The six normalized `/context` header buckets, computed from the same tokenization as `entries` so the two never disagree. Convenience rollups: `freeSpace` and `buffer` describe window capacity rather than occupied context, so the values do not sum to `totalTokens`.
+     */
+    categories: {
+        /**
+         * System prompt tokens, excluding custom instructions.
+         */
+        systemPrompt: number;
+        /**
+         * Custom-instructions tokens (0 when none are configured).
+         */
+        customInstructions: number;
+        /**
+         * Non-MCP tool-definition tokens.
+         */
+        systemTools: number;
+        /**
+         * MCP tool-definition tokens.
+         */
+        mcpTools: number;
+        /**
+         * Conversation (user/assistant/tool) message tokens.
+         */
+        messages: number;
+        /**
+         * Remaining unused window capacity (clamped at 0).
+         */
+        freeSpace: number;
+        /**
+         * Output reserve plus post-blocking-threshold buffer.
+         */
+        buffer: number;
+    };
     /**
      * Flat list of per-source attribution entries. Group by `kind` and render unrecognized kinds generically. Nesting and rollups are expressed via `parentId`.
      */
@@ -1494,6 +1553,52 @@ export type PermissionDecisionApproveForSessionApproval = PermissionDecisionAppr
  */
 /** @experimental */
 export type PermissionDecisionApproveForLocationApproval = PermissionDecisionApproveForLocationApprovalCommands | PermissionDecisionApproveForLocationApprovalRead | PermissionDecisionApproveForLocationApprovalWrite | PermissionDecisionApproveForLocationApprovalMcp | PermissionDecisionApproveForLocationApprovalMcpSampling | PermissionDecisionApproveForLocationApprovalMemory | PermissionDecisionApproveForLocationApprovalCustomTool | PermissionDecisionApproveForLocationApprovalExtensionManagement | PermissionDecisionApproveForLocationApprovalFactory | PermissionDecisionApproveForLocationApprovalExtensionPermissionAccess;
+/**
+ * Disposition of a permission request as observed by the responding client.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionDecisionOutcome".
+ */
+/** @experimental */
+export type PermissionDecisionOutcome = 
+/** The request was approved automatically without a new human decision. */
+"auto_approved"
+/** The request was denied without an interactive user decision; source records why. */
+ | "autopilot_denied"
+/** The response came from an interactive user prompt. */
+ | "prompted_user";
+/**
+ * Controlled reason or actor responsible for a permission response.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionDecisionSource".
+ */
+/** @experimental */
+export type PermissionDecisionSource = 
+/** The response followed the auto-approval judge recommendation. */
+"judge_recommendation"
+/** A human supplied the response through an interactive prompt. */
+ | "human_response"
+/** The host applied a standing policy or override rather than a judge recommendation or human decision. */
+ | "host_policy"
+/** The host denied the request because no interactive user response was available. */
+ | "unattended_fallback";
+/**
+ * Client surface that submitted a permission response.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionDecisionSurface".
+ */
+/** @experimental */
+export type PermissionDecisionSurface = 
+/** The interactive Copilot CLI terminal UI. */
+"tui"
+/** The non-interactive Copilot CLI prompt mode. */
+ | "prompt_mode"
+/** The Copilot App client. */
+ | "copilot_app"
+/** A generic Copilot SDK client. */
+ | "sdk";
 /**
  * Tool approval to persist and apply
  *
@@ -4935,6 +5040,61 @@ export interface ExtensionContextPushInput {
         [k: string]: unknown | undefined;
     };
 }
+/**
+ * Opaque integrator-owned process launch profile for one extension entrypoint.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ExtensionLaunchProfile".
+ */
+/** @experimental */
+export interface ExtensionLaunchProfile {
+    /**
+     * Executable used to launch the extension entrypoint.
+     */
+    executable: string;
+    /**
+     * Opaque integrator-defined arguments passed to the executable. The runtime does not append the extension entrypoint.
+     */
+    args: string[];
+    /**
+     * Opaque integrator-defined environment variables. Runtime-owned COPILOT_SDK_PATH, SESSION_ID, and COPILOT_EXTENSION_PARENT_PID values take precedence.
+     */
+    env: {
+        [k: string]: string | undefined;
+    };
+}
+/**
+ * A discovered extension entrypoint that the registered integrator may classify and resolve to an opaque launch profile.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ExtensionLaunchProviderResolveRequest".
+ */
+/** @experimental */
+export interface ExtensionLaunchProviderResolveRequest {
+    /**
+     * Source-qualified extension identifier.
+     */
+    id: string;
+    /**
+     * Human-readable extension name.
+     */
+    name: string;
+    /**
+     * Absolute path to the discovered extension entrypoint.
+     */
+    modulePath: string;
+    source: ExtensionSource;
+}
+/**
+ * The launch profile for a supported entrypoint. Omit launch when the provider does not support the entrypoint.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ExtensionLaunchProviderResolveResult".
+ */
+/** @experimental */
+export interface ExtensionLaunchProviderResolveResult {
+    launch?: ExtensionLaunchProfile;
+}
 /**
  * Extensions discovered for the session, with their current status.
  *
@@ -7041,6 +7201,25 @@ export interface LspInitializeRequest {
      */
     force?: boolean;
 }
+/**
+ * Validated device-managed settings discovered before a session exists.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "ManagedSettingsReadResult".
+ */
+/** @experimental */
+export interface ManagedSettingsReadResult {
+    /**
+     * Validated, canonical managed-settings JSON. Omitted when no managed settings were discovered or when discovered settings failed validation.
+     */
+    settingsJson?: {
+        [k: string]: unknown | undefined;
+    };
+    /**
+     * Discovery or validation error text when managed settings could not be read safely.
+     */
+    errorMessage?: string;
+}
 /**
  * Result of registering a new marketplace.
  *
@@ -9957,6 +10136,18 @@ export interface PermissionDecisionDeniedByPermissionRequestHook {
      */
     interrupt?: boolean;
 }
+/**
+ * Optional informational context describing how and where the permission decision was made. This does not affect permission behavior.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "PermissionDecisionContext".
+ */
+/** @experimental */
+export interface PermissionDecisionContext {
+    outcome: PermissionDecisionOutcome;
+    source: PermissionDecisionSource;
+    surface: PermissionDecisionSurface;
+}
 /**
  * Pending permission request ID and the decision to apply (approve/reject and scope).
  *
@@ -9970,6 +10161,7 @@ export interface PermissionDecisionRequest {
      */
     requestId: string;
     result: PermissionDecision;
+    decisionContext?: PermissionDecisionContext;
 }
 /**
  * Location-scoped tool approval to persist.
@@ -12598,9 +12790,9 @@ export interface SandboxConfig {
      */
     ghAuth?: boolean;
     /**
-     * Whether to auto-grant read access to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and, on Unix, up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without exporting CARGO_HOME/GOPATH/etc. Default: true (enabled by default; set to false to opt out).
+     * Whether to auto-grant read access to common developer-tool caches, registries, and toolchains in their default home locations (cargo, go, npm, Maven, and more), plus read-write access to (and, on Unix, up-front creation of) the scratch caches builds write on every run (go-build, ccache, sccache, Gradle caches, Cargo lock/tracker files), so builds work without extra configuration; a relocated CARGO_HOME additionally gets its Cargo lock files granted read-write. Default: true (enabled by default; set to false to opt out).
      */
-    allowDevToolCaches?: boolean;
+    allowDevToolAccess?: boolean;
 }
 /**
  * User-managed sandbox policy fragment merged into the auto-discovered base policy.
@@ -13187,6 +13379,10 @@ export interface ServerSkill {
      * Unique identifier for the skill
      */
     name: string;
+    /**
+     * Canonical slash command name used to invoke the skill, without the leading '/'
+     */
+    commandName?: string;
     /**
      * Description of what the skill does
      */
@@ -14001,6 +14197,38 @@ export interface SessionLoadDeferredRepoHooksResult {
      */
     hookCount: number;
 }
+/**
+ * Enterprise permission policy expressed with the runtime's managed permission-rule syntax.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SessionManagedPermissions".
+ */
+/** @experimental */
+export interface SessionManagedPermissions {
+    disableBypassPermissionsMode?: DisableBypassPermissionsMode;
+    /**
+     * Permission rules that block matching operations. Deny has highest precedence.
+     */
+    deny?: string[];
+    /**
+     * Permission rules that require explicit human approval.
+     */
+    ask?: string[];
+    /**
+     * Permission rules that allow matching operations unless another managed source, deny, or ask rule restricts them.
+     */
+    allow?: string[];
+}
+/**
+ * Managed settings an SDK host may inject at session startup. Only permissions are accepted in this initial contract.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SessionManagedSettings".
+ */
+/** @experimental */
+export interface SessionManagedSettings {
+    permissions?: SessionManagedPermissions;
+}
 /**
  * Point-in-time snapshot of slow-changing session identifier and state fields
  *
@@ -14144,6 +14372,7 @@ export interface SessionOpenOptions {
      * Opt-in: self-fetch and enforce enterprise managed settings at session bootstrap.
      */
     enableManagedSettings?: boolean;
+    managedSettings?: SessionManagedSettings;
     /**
      * Opt in to capturing file changes for session rewind and session diff. Capture cannot reconstruct changes made before it was enabled. On create it starts capture from the first turn. It is also honored on resume: for a session that already has tracked prior turns, tracking continues automatically even if this is omitted; passing it on resume additionally enables tracking for an eligible session that has no prior root turn yet. Resuming a session whose prior root turns were never tracked has no restorable baseline, so tracking stays disabled for it and rewind reports file change tracking as unavailable; the resume itself still succeeds, so sessions that predate tracking remain loadable. The opt-in is only rejected when the session can never track (a subagent session, or one without local session storage). It is intentionally absent from the mutable options update because enabling it after edits have occurred would create an incomplete, misleading baseline. Subagents share the parent session's capture store and are not tracked as separate rewind points: a file a subagent writes is attributed to whichever root user turn was open when the capture was staged, just before the tool body ran. A turn cannot open while a staged capture is still in flight, so a subagent tool that staged under the spawning turn stays attributed to it however late the write lands, while a capture it stages after the user's next message belongs to that later turn. Attribution decides which turn's rewind point counts and file preview include that write; it does not narrow which rewinds revert it, because a rewind restores every capture from the selected turn onward, so the earlier spawning turn reverts it as well.
      */
@@ -14238,6 +14467,10 @@ export interface SessionOpenOptions {
      */
     logInteractiveShells?: boolean;
     envValueMode?: SessionOpenOptionsEnvValueMode;
+    /**
+     * MCP server names disabled for this session. Disabled servers are not started or authenticated on create or cold resume.
+     */
+    disabledMcpServers?: string[];
     /**
      * Whether to include instructions from every MCP server in the system prompt instead of only allowlisted servers.
      */
@@ -15689,6 +15922,10 @@ export interface Skill {
      * Unique identifier for the skill
      */
     name: string;
+    /**
+     * Canonical slash command name used to invoke the skill, without the leading '/'
+     */
+    commandName?: string;
     /**
      * Description of what the skill does
      */
@@ -18161,6 +18398,12 @@ export declare function createServerRpc(connection: MessageConnection): {
          */
         disable: (params: DiscoveredExtensionsDisableRequest) => Promise<void>;
     };
+    /**
+     * Registers the calling SDK client as the per-entrypoint extension launch provider. Call before creating any sessions. When omitted, the runtime temporarily falls back to its built-in Node launcher for backward compatibility.
+     *
+     * @experimental
+     */
+    registerExtensionLaunchProvider: () => Promise<void>;
     /** @experimental */
     plugins: {
         /**
@@ -18351,6 +18594,15 @@ export declare function createServerRpc(connection: MessageConnection): {
         };
     };
     /** @experimental */
+    managedSettings: {
+        /**
+         * Discovers device-managed settings from production MDM and managed-file sources, validates them against the runtime-owned managed-settings schema, and returns the canonical JSON without requiring a session.
+         *
+         * @returns Validated device-managed settings discovered before a session exists.
+         */
+        read: () => Promise<ManagedSettingsReadResult>;
+    };
+    /** @experimental */
     runtime: {
         /**
          * Gracefully shuts down an SDK-owned runtime. The response is sent only after cleanup completes; callers may then terminate the owned runtime process.
@@ -20428,6 +20680,18 @@ export interface ClientSessionApiHandlers {
  * function uses `getHandlers` to resolve the session's handlers.
  */
 export declare function registerClientSessionApiHandlers(connection: MessageConnection, getHandlers: (sessionId: string) => ClientSessionApiHandlers): void;
+/** Handler for `extensionLaunchProvider` client global API methods. */
+/** @experimental */
+export interface ExtensionLaunchProviderHandler {
+    /**
+     * Asks the registered SDK client to resolve an opaque process launch profile for one discovered extension entrypoint immediately before launch or reload. The provider must respond within 15 seconds.
+     *
+     * @param params A discovered extension entrypoint that the registered integrator may classify and resolve to an opaque launch profile.
+     *
+     * @returns The launch profile for a supported entrypoint. Omit launch when the provider does not support the entrypoint.
+     */
+    resolve(params: ExtensionLaunchProviderResolveRequest): Promise<ExtensionLaunchProviderResolveResult>;
+}
 /** Handler for `llmInference` client global API methods. */
 /** @experimental */
 export interface LlmInferenceHandler {
@@ -20460,6 +20724,7 @@ export interface GitHubTelemetryHandler {
 }
 /** All client global API handler groups. */
 export interface ClientGlobalApiHandlers {
+    extensionLaunchProvider?: ExtensionLaunchProviderHandler;
     llmInference?: LlmInferenceHandler;
     gitHubTelemetry?: GitHubTelemetryHandler;
 }

package/dist/generated/rpc.js

@@ -163,6 +163,12 @@ function createServerRpc(connection) {
        */
       disable: async (params) => connection.sendRequest("extensions.disable", params)
     },
+    /**
+     * Registers the calling SDK client as the per-entrypoint extension launch provider. Call before creating any sessions. When omitted, the runtime temporarily falls back to its built-in Node launcher for backward compatibility.
+     *
+     * @experimental
+     */
+    registerExtensionLaunchProvider: async () => connection.sendRequest("registerExtensionLaunchProvider", {}),
     /** @experimental */
     plugins: {
       /**
@@ -353,6 +359,15 @@ function createServerRpc(connection) {
       }
     },
     /** @experimental */
+    managedSettings: {
+      /**
+       * Discovers device-managed settings from production MDM and managed-file sources, validates them against the runtime-owned managed-settings schema, and returns the canonical JSON without requiring a session.
+       *
+       * @returns Validated device-managed settings discovered before a session exists.
+       */
+      read: async () => connection.sendRequest("managedSettings.read", {})
+    },
+    /** @experimental */
     runtime: {
       /**
        * Gracefully shuts down an SDK-owned runtime. The response is sent only after cleanup completes; callers may then terminate the owned runtime process.
@@ -2595,6 +2610,11 @@ function registerClientSessionApiHandlers(connection, getHandlers) {
   });
 }
 function registerClientGlobalApiHandlers(connection, handlers) {
+  connection.onRequest("extensionLaunchProvider.resolve", async (params) => {
+    const handler = handlers.extensionLaunchProvider;
+    if (!handler) throw new Error("No extensionLaunchProvider client-global handler registered");
+    return handler.resolve(params);
+  });
   connection.onRequest("llmInference.httpRequestStart", async (params) => {
     const handler = handlers.llmInference;
     if (!handler) throw new Error("No llmInference client-global handler registered");

package/dist/generated/session-events.d.ts

@@ -557,14 +557,18 @@ export type AutoModeResolvedReasoningBucket =
 /** The request looks high-reasoning; a stronger model is appropriate. */
  | "high";
 /**
- * Which channel supplied the effective enterprise managed settings (highest-authority present layer wins wholesale)
+ * Summary of which managed-settings channels contributed to the effective session policy. Use the per-channel booleans for exact provenance.
  */
 export type ManagedSettingsResolvedSource = 
-/** Account/org policy self-fetched from the GitHub managed-settings endpoint (higher authority). */
+/** Only the server/account channel contributed. */
 "server"
-/** Device-level MDM policy discovered from plist/registry/file (lower authority). */
+/** Only the device MDM/plist/registry/file channel contributed. */
  | "device"
-/** No managed policy is in force (no layer contributed). */
+/** Only session-local SDK-host injection contributed. */
+ | "client"
+/** More than one channel contributed. Ordinary keys resolve device over server per key, while permissions compose restrictively across all present layers. */
+ | "mixed"
+/** No managed policy is in force (no channel contributed). */
  | "none";
 /**
  * The category of runtime action that enterprise managed settings governed (blocked or capped)
@@ -8285,7 +8289,7 @@ export interface AutoModeResolvedData {
     stickyOverride?: boolean;
 }
 /**
- * Session event "session.managed_settings_resolved". Enterprise managed-settings resolution: the effective managed settings the session applied and where they came from, so SDK clients can show users what is enterprise-managed and by which authority. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted; for a session-independent pull, use the SDK `getManagedSettings()` API, which returns the identical payload. Managed settings have a single authoritative source, so the highest-authority present layer (server > device) wins wholesale; `bypassPermissionsDisabled` is deny-wins across layers. Marked experimental while the managed-settings surface stabilizes.
+ * Session event "session.managed_settings_resolved". Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values per ordinary key, while permissions compose restrictively across device, server, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.
  */
 /** @experimental */
 export interface ManagedSettingsResolvedEvent {
@@ -8316,7 +8320,7 @@ export interface ManagedSettingsResolvedEvent {
     type: "session.managed_settings_resolved";
 }
 /**
- * Enterprise managed-settings resolution: the effective managed settings the session applied and where they came from, so SDK clients can show users what is enterprise-managed and by which authority. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted; for a session-independent pull, use the SDK `getManagedSettings()` API, which returns the identical payload. Managed settings have a single authoritative source, so the highest-authority present layer (server > device) wins wholesale; `bypassPermissionsDisabled` is deny-wins across layers. Marked experimental while the managed-settings surface stabilizes.
+ * Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values per ordinary key, while permissions compose restrictively across device, server, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.
  */
 /** @experimental */
 export interface ManagedSettingsResolvedData {
@@ -8325,7 +8329,11 @@ export interface ManagedSettingsResolvedData {
      */
     bypassPermissionsDisabled: boolean;
     /**
-     * Whether the device (MDM/plist/registry/file) managed-settings layer was present
+     * Whether a session-local permissions layer injected by the SDK host was present
+     */
+    clientManaged?: boolean;
+    /**
+     * Whether an actual device MDM/plist/registry/file managed-settings layer was present
      */
     deviceManaged: boolean;
     /**
@@ -8337,7 +8345,7 @@ export interface ManagedSettingsResolvedData {
      */
     managedKeys: string[];
     /**
-     * Whether server and device each supplied a permission allowlist, so enforcement intersects them and the flattened settings payload omits `permissions.allow`.
+     * Whether at least two managed sources supplied permission allowlists, so enforcement intersects them and the flattened settings payload omits `permissions.allow`.
      */
     permissionsAllowIntersected?: boolean;
     /**
@@ -8775,6 +8783,10 @@ export interface SkillsLoadedSkill {
      * Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
      */
     argumentHint?: string;
+    /**
+     * Canonical slash command name used to invoke the skill, without the leading '/'
+     */
+    commandName?: string;
     /**
      * Description of what the skill does
      */

package/dist/index.d.ts

@@ -11,5 +11,5 @@ export { defineFactory, FactoryResumeError, isFactoryRunTerminal } from "./facto
 export { Canvas, CanvasError, createCanvas, type CanvasAction, type CanvasDeclaration, type CanvasHostContext, type CanvasHostContextCapabilities, type CanvasJsonSchema, type CanvasOptions, } from "./canvas.js";
 export { defineTool, approveAll, convertMcpCallToolResult, createSessionFsAdapter, CopilotRequestHandler, CopilotWebSocketHandler, CopilotWebSocketCloseStatus, CopilotWebSocketForwarder, SessionFsSqliteTransactionFailure, SYSTEM_MESSAGE_SECTIONS, } from "./types.js";
 export type * from "./generated/session-events.js";
-export type { CommandContext, CommandDefinition, CommandHandler, CanvasProviderIdentity, CloudSessionOptions, CloudSessionRepository, AutoModeSwitchHandler, AutoModeSwitchRequest, AutoModeSwitchResponse, AgentStopHandler, AgentStopHookInput, AgentStopHookOutput, CopilotClientMode, CopilotClientOptions, CopilotExpAssignmentResponse, StdioRuntimeConnection, InProcessRuntimeConnection, TcpRuntimeConnection, UriRuntimeConnection, ChildProcessRuntimeConnection, CustomAgentConfig, ElicitationFieldValue, ElicitationHandler, ElicitationParams, ElicitationContext, ElicitationResult, ElicitationSchema, ElicitationSchemaField, ExpConfigEntry, ExpFlagValue, ExitPlanModeHandler, ExitPlanModeRequest, ExitPlanModeResult, ExtensionInfo, ForegroundSessionInfo, GetAuthStatusResponse, GetStatusResponse, GitHubMcpToolConfig, GitHubTelemetryNotification, GitHubTelemetryEvent, GitHubTelemetryClientInfo, InfiniteSessionConfig, LargeToolOutputConfig, MemoryConfiguration, UiInputOptions, FactoryLimits, FactoryMeta, MCPStdioServerConfig, MCPHTTPServerConfig, MCPServerConfig, DefaultAgentConfig, BearerTokenProvider, MessageOptions, ModelBilling, ModelBillingTokenPrices, ModelBillingTokenPricesLongContext, CapiSessionOptions, ModelCapabilities, ModelCapabilitiesOverride, ModelInfo, ModelPolicy, NamedProviderConfig, PermissionHandler, PermissionRequest, PermissionRequestedData, PermissionRequestedEvent, PermissionRequestResult, ProviderConfig, ProviderModelConfig, ProviderTokenArgs, RemoteSessionMode, ResumeSessionConfig, SectionOverride, SectionOverrideAction, SectionTransformFn, SessionCapabilities, SessionConfig, SessionConfigBase, SessionEvent, SessionEventHandler, SessionEventPayload, SessionEventType, SessionLifecycleEvent, SessionLifecycleEventMetadata, SessionLifecycleEventType, SessionLifecycleHandler, SessionHooks, SessionCreatedEvent, SessionDeletedEvent, SessionUpdatedEvent, SessionForegroundEvent, SessionBackgroundEvent, SessionContext, SessionListFilter, SessionMetadata, SessionUiApi, SessionFsConfig, SessionFsProvider, SessionFsFileInfo, SessionFsSqliteQueryResult, SessionFsSqliteQueryType, SessionFsSqliteProvider, SessionFsSqliteStatement, SessionFsSqliteTransactionErrorClass, CopilotRequestContext, SystemMessageAppendConfig, SystemMessageConfig, SystemMessageCustomizeConfig, SystemMessageReplaceConfig, SystemMessageSection, TelemetryConfig, TraceContext, TraceContextProvider, Tool, ToolHandler, ToolInvocation, CurrentToolMetadata, ToolTelemetry, ToolResultObject, ToolSearchConfig, TypedSessionEventHandler, TypedSessionLifecycleHandler, ZodSchema, } from "./types.js";
+export type { CommandContext, CommandDefinition, CommandHandler, CanvasProviderIdentity, CloudSessionOptions, CloudSessionRepository, AutoModeSwitchHandler, AutoModeSwitchRequest, AutoModeSwitchResponse, AgentStopHandler, AgentStopHookInput, AgentStopHookOutput, UserPromptTransformedHandler, UserPromptTransformedHookInput, UserPromptTransformedHookOutput, CopilotClientMode, CopilotClientOptions, CopilotExpAssignmentResponse, StdioRuntimeConnection, InProcessRuntimeConnection, TcpRuntimeConnection, UriRuntimeConnection, ChildProcessRuntimeConnection, CustomAgentConfig, ElicitationFieldValue, ElicitationHandler, ElicitationParams, ElicitationContext, ElicitationResult, ElicitationSchema, ElicitationSchemaField, ExpConfigEntry, ExpFlagValue, ExitPlanModeHandler, ExitPlanModeRequest, ExitPlanModeResult, ExtensionInfo, ForegroundSessionInfo, GetAuthStatusResponse, GetStatusResponse, GitHubMcpToolConfig, GitHubTelemetryNotification, GitHubTelemetryEvent, GitHubTelemetryClientInfo, InfiniteSessionConfig, LargeToolOutputConfig, MemoryConfiguration, UiInputOptions, FactoryLimits, FactoryMeta, MCPStdioServerConfig, MCPHTTPServerConfig, MCPServerConfig, DefaultAgentConfig, BearerTokenProvider, MessageOptions, ManagedSettings, ManagedSettingsPermissions, ModelBilling, ModelBillingTokenPrices, ModelBillingTokenPricesLongContext, CapiSessionOptions, ModelCapabilities, ModelCapabilitiesOverride, ModelInfo, ModelPolicy, NamedProviderConfig, PermissionHandler, PermissionRequest, PermissionRequestedData, PermissionRequestedEvent, PermissionRequestResult, ProviderConfig, ProviderModelConfig, ProviderTokenArgs, RemoteSessionMode, ResumeSessionConfig, SectionOverride, SectionOverrideAction, SectionTransformFn, SessionCapabilities, SessionConfig, SessionConfigBase, SessionEvent, SessionEventHandler, SessionEventPayload, SessionEventType, SessionLifecycleEvent, SessionLifecycleEventMetadata, SessionLifecycleEventType, SessionLifecycleHandler, SessionHooks, SessionCreatedEvent, SessionDeletedEvent, SessionUpdatedEvent, SessionForegroundEvent, SessionBackgroundEvent, SessionContext, SessionListFilter, SessionMetadata, SessionUiApi, SessionFsConfig, SessionFsProvider, SessionFsFileInfo, SessionFsSqliteQueryResult, SessionFsSqliteQueryType, SessionFsSqliteProvider, SessionFsSqliteStatement, SessionFsSqliteTransactionErrorClass, CopilotRequestContext, SystemMessageAppendConfig, SystemMessageConfig, SystemMessageCustomizeConfig, SystemMessageReplaceConfig, SystemMessageSection, TelemetryConfig, TraceContext, TraceContextProvider, Tool, ToolHandler, ToolInvocation, CurrentToolMetadata, ToolTelemetry, ToolResultObject, ToolSearchConfig, TypedSessionEventHandler, TypedSessionLifecycleHandler, ZodSchema, } from "./types.js";
 export type { RunOptions, ResumeOptions, FactoryResumeErrorCode, SessionFactoryApi, FactoryAgentOptions, FactoryContext, FactoryDefinition, FactoryHandle, FactoryJsonSchema, JsonValue, FactoryPipelineStage, FactoryStepOptions, FactoryRunResult, FactoryRunStatus, FactoryRunSummary, FactoryRunDetail, FactoryProgressPage, FactoryProgressLine, FactoryPhaseObservation, FactoryPhaseStatus, FactoryAgentSummary, } from "./factory.js";

package/dist/session.js

@@ -430,22 +430,20 @@ class CopilotSession {
   async sendAndWait(optionsOrPrompt, timeout) {
     const options = typeof optionsOrPrompt === "string" ? { prompt: optionsOrPrompt } : optionsOrPrompt;
     const effectiveTimeout = timeout ?? 6e4;
-    let resolveIdle;
-    let rejectWithError;
-    const idlePromise = new Promise((resolve, reject) => {
-      resolveIdle = resolve;
-      rejectWithError = reject;
+    let resolveOutcome;
+    const outcomePromise = new Promise((resolve) => {
+      resolveOutcome = resolve;
     });
     let lastAssistantMessage;
     const unsubscribe = this.on((event) => {
       if (event.type === "assistant.message") {
         lastAssistantMessage = event;
       } else if (event.type === "session.idle") {
-        resolveIdle();
+        resolveOutcome({ kind: "idle" });
       } else if (event.type === "session.error") {
         const error = new Error(event.data.message);
         error.stack = event.data.stack;
-        rejectWithError(error);
+        resolveOutcome({ kind: "error", error });
       }
     });
     let timeoutId;
@@ -461,7 +459,10 @@ class CopilotSession {
           effectiveTimeout
         );
       });
-      await Promise.race([idlePromise, timeoutPromise]);
+      const outcome = await Promise.race([outcomePromise, timeoutPromise]);
+      if (outcome.kind === "error") {
+        throw outcome.error;
+      }
       return lastAssistantMessage;
     } finally {
       if (timeoutId !== void 0) {
@@ -1363,6 +1364,7 @@ class CopilotSession {
       postToolUse: this.hooks.onPostToolUse,
       postToolUseFailure: this.hooks.onPostToolUseFailure,
       userPromptSubmitted: this.hooks.onUserPromptSubmitted,
+      userPromptTransformed: this.hooks.onUserPromptTransformed,
       sessionStart: this.hooks.onSessionStart,
       sessionEnd: this.hooks.onSessionEnd,
       errorOccurred: this.hooks.onErrorOccurred,

package/dist/types.d.ts

@@ -484,6 +484,17 @@ export interface Tool<TArgs = unknown> {
      * Unknown keys are preserved and round-tripped untouched.
      */
     metadata?: Record<string, unknown>;
+    /**
+     * When true, a successful call to this tool ends the agent turn: the runtime's
+     * tool phase halts instead of feeding the tool result back to the model for
+     * another round. A failed call (for example input validation) leaves the loop
+     * running so the model can read the error and retry.
+     *
+     * Use this for tools whose whole purpose is to terminate the turn, such as a
+     * context clear that replaces the conversation the model would otherwise
+     * continue from.
+     */
+    isTerminal?: boolean;
 }
 /**
  * Helper to define a tool with Zod schema and get type inference for the handler.
@@ -497,6 +508,7 @@ export declare function defineTool<T = unknown>(name: string, config: {
     skipPermission?: boolean;
     defer?: "auto" | "never";
     metadata?: Record<string, unknown>;
+    isTerminal?: boolean;
 }): Tool<T>;
 /**
  * SDK-supplied override for the runtime's built-in tool-search behavior.
@@ -1110,6 +1122,29 @@ export interface UserPromptSubmittedHookOutput {
 export type UserPromptSubmittedHandler = (input: UserPromptSubmittedHookInput, invocation: {
     sessionId: string;
 }) => Promise<UserPromptSubmittedHookOutput | void> | UserPromptSubmittedHookOutput | void;
+/**
+ * Input for the user-prompt-transformed hook.
+ *
+ * This hook runs after the runtime has transformed the submitted prompt with
+ * generated context, but before it is persisted to session history or sent to
+ * the model.
+ */
+export interface UserPromptTransformedHookInput extends BaseHookInput {
+    prompt: string;
+    transformedPrompt: string;
+}
+/**
+ * Output for the user-prompt-transformed hook.
+ */
+export interface UserPromptTransformedHookOutput {
+    modifiedTransformedPrompt?: string;
+}
+/**
+ * Handler for the user-prompt-transformed hook.
+ */
+export type UserPromptTransformedHandler = (input: UserPromptTransformedHookInput, invocation: {
+    sessionId: string;
+}) => Promise<UserPromptTransformedHookOutput | void> | UserPromptTransformedHookOutput | void;
 /**
  * Input for session-start hook
  */
@@ -1245,6 +1280,10 @@ export interface SessionHooks {
      * Called when the user submits a prompt
      */
     onUserPromptSubmitted?: UserPromptSubmittedHandler;
+    /**
+     * Called after the runtime transforms a submitted prompt and before it is stored.
+     */
+    onUserPromptTransformed?: UserPromptTransformedHandler;
     /**
      * Called when a session starts
      */
@@ -1450,7 +1489,7 @@ export interface LargeToolOutputConfig {
 /**
  * Valid reasoning effort levels for models that support it.
  */
-export type ReasoningEffort = "low" | "medium" | "high" | "xhigh";
+export type ReasoningEffort = "low" | "medium" | "high" | "xhigh" | "max";
 /**
  * Context window tier for the session. "long_context" pins the session to the
  * long-context tier when the selected model supports it.
@@ -1655,6 +1694,43 @@ export interface GitHubMcpToolConfig {
     enableInsidersMode?: boolean;
     disableFormDeferral?: boolean;
 }
+/**
+ * Permissions-only managed policy injected by the host via
+ * {@link SessionConfigBase.managedSettings}.
+ *
+ * Rule strings use the same vocabulary the runtime accepts for fetched managed
+ * policy (e.g. `"Read(**)"`, `"Shell(git push *)"`); malformed rules are
+ * rejected at session creation.
+ */
+export interface ManagedSettingsPermissions {
+    /**
+     * When set to `"disable"`, bypass-permissions ("yolo") mode is turned off
+     * for the session. This is deny-wins: it cannot be re-enabled by any other
+     * layer.
+     */
+    disableBypassPermissionsMode?: "disable";
+    /** Operations that must always be denied. Unioned across managed layers. */
+    deny?: string[];
+    /**
+     * Operations that must prompt for approval. Unioned across managed layers.
+     */
+    ask?: string[];
+    /**
+     * Operations permitted without prompting. Every declared `allow` list
+     * (across managed layers) must admit an operation for it to be allowed.
+     */
+    allow?: string[];
+}
+/**
+ * Host-injected enterprise managed settings. The first supported contract is
+ * permissions-only; unknown sibling keys are rejected by the runtime.
+ *
+ * @see {@link SessionConfigBase.managedSettings}
+ */
+export interface ManagedSettings {
+    /** Managed permission policy for the session. */
+    permissions?: ManagedSettingsPermissions;
+}
 /**
  * Shared configuration fields used by both {@link SessionConfig} (for
  * creating a new session) and {@link ResumeSessionConfig} (for resuming
@@ -2057,6 +2133,12 @@ export interface SessionConfigBase {
      * List of skill names to disable.
      */
     disabledSkills?: string[];
+    /**
+     * Exact MCP server names to disable for this session. Disabled servers are not
+     * started or authenticated when creating or cold-resuming a session. Supplying
+     * this on a resident resume cannot stop servers that are already running.
+     */
+    disabledMcpServers?: string[];
     /**
      * Infinite session configuration for persistent workspaces and automatic compaction.
      * When enabled (default), sessions automatically manage context limits and persist state.
@@ -2085,6 +2167,30 @@ export interface SessionConfigBase {
      * if omitted, the runtime is expected to reject session creation (fail-closed).
      */
     enableManagedSettings?: boolean;
+    /**
+     * Host-injected enterprise managed settings for this session.
+     *
+     * Unlike {@link SessionConfigBase.enableManagedSettings} — which asks the
+     * runtime to *self-fetch* account/org and device policy — this field lets
+     * the host supply the managed policy directly. The runtime validates it
+     * with the same managed-permission parser it uses for fetched policy and
+     * composes it restrictively with any self-fetched (server) and
+     * device-managed (MDM) layers: `deny`/`ask` rules are unioned, every
+     * declared `allow` list must admit an operation, and
+     * `disableBypassPermissionsMode: "disable"` is deny-wins.
+     *
+     * This is startup-only. It is **not** persisted: it must be re-supplied on
+     * {@link CopilotClient.resumeSession | resume}, where it replaces the prior
+     * injected layer (omitting it clears the layer, so warm and cold resume
+     * behave identically). It may be combined with `enableManagedSettings`;
+     * when both are supplied the injected, server, and device restrictions all
+     * apply.
+     *
+     * Requires a Copilot runtime whose RPC schema includes `managedSettings`.
+     * Older runtimes may ignore this additive field, so hosts must not rely on
+     * injected policy until they ship a compatible runtime.
+     */
+    managedSettings?: ManagedSettings;
     /**
      * When true, skips embedding-based retrieval for this session.
      * Use in multitenant deployments to prevent cross-session information leakage

package/docs/agent-author.md

@@ -270,7 +270,7 @@ const unsub = session.on("tool.execution_complete", (event) => {
 | `tool.execution_start`    | `toolCallId`, `toolName`, `arguments`                  |
 | `tool.execution_complete` | `toolCallId`, `success`, `result`, `error`             |
 | `user.message`            | `content`, `attachments`, `source`                     |
-| `session.idle`            | `backgroundTasks`                                      |
+| `session.idle`            | `aborted`                                              |
 | `session.error`           | `errorType`, `message`, `stack`                        |
 | `permission.requested`    | `requestId`, `permissionRequest.kind`                  |
 | `session.shutdown`        | `shutdownType`, `totalPremiumRequests`                 |

package/docs/examples.md

@@ -419,7 +419,7 @@ session.on("assistant.message", (event) => {
 | `tool.execution_start`      | A tool is about to run                           | `toolCallId`, `toolName`, `arguments`                  |
 | `tool.execution_complete`   | A tool finished running                          | `toolCallId`, `success`, `result`, `error`             |
 | `user.message`              | User sent a message                              | `content`, `attachments`, `source`                     |
-| `session.idle`              | Session finished processing a turn               | `backgroundTasks`                                      |
+| `session.idle`              | Session finished processing a turn               | `aborted`                                              |
 | `session.error`             | An error occurred                                | `errorType`, `message`, `stack`                        |
 | `permission.requested`      | Agent needs permission (shell, file write, etc.) | `requestId`, `permissionRequest.kind`                  |
 | `session.shutdown`          | Session is ending                                | `shutdownType`, `totalPremiumRequests`, `codeChanges`  |

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/github/copilot-sdk.git"
   },
-  "version": "1.0.9-preview.3",
+  "version": "1.0.10-preview.0",
   "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
   "main": "./dist/cjs/index.js",
   "types": "./dist/index.d.ts",
@@ -56,7 +56,7 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@github/copilot": "^1.0.78",
+    "@github/copilot": "^1.0.79-6",
     "koffi": "^3.1.0",
     "vscode-jsonrpc": "^8.2.1",
     "zod": "^4.3.6"