,
}
-/// Session event "session.managed_settings_resolved". Enterprise managed-settings resolution: the effective managed settings the session applied and where they came from, so SDK clients can show users what is enterprise-managed and by which authority. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted; for a session-independent pull, use the SDK `getManagedSettings()` API, which returns the identical payload. Managed settings have a single authoritative source, so the highest-authority present layer (server > device) wins wholesale; `bypassPermissionsDisabled` is deny-wins across layers. Marked experimental while the managed-settings surface stabilizes.
+/// Session event "session.managed_settings_resolved". Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values per ordinary key, while permissions compose restrictively across device, server, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.
///
///
///
@@ -4460,13 +4460,16 @@ pub struct SessionAutoModeResolvedData {
pub struct SessionManagedSettingsResolvedData {
/// Whether enterprise policy disables bypass-permissions ("yolo") mode for this session. Deny-wins across layers, and forced on when `failClosed` is true.
pub bypass_permissions_disabled: bool,
- /// Whether the device (MDM/plist/registry/file) managed-settings layer was present
+ /// Whether a session-local permissions layer injected by the SDK host was present
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub client_managed: Option,
+ /// Whether an actual device MDM/plist/registry/file managed-settings layer was present
pub device_managed: bool,
/// Whether managed policy could not be determined (e.g. a failed server fetch) and the session fell back to the fail-closed restriction. When true, restrictions such as disabling bypass-permissions are enforced even though `settings` may be absent.
pub fail_closed: bool,
/// The setting keys under enterprise management in the effective managed settings (e.g. `model`, `enabledPlugins`, `permissions`). Empty when no managed settings are in force.
pub managed_keys: Vec,
- /// Whether server and device each supplied a permission allowlist, so enforcement intersects them and the flattened settings payload omits `permissions.allow`.
+ /// Whether at least two managed sources supplied permission allowlists, so enforcement intersects them and the flattened settings payload omits `permissions.allow`.
#[serde(skip_serializing_if = "Option::is_none")]
pub permissions_allow_intersected: Option,
/// Whether the server (account/org) managed-settings layer was present
@@ -4474,7 +4477,7 @@ pub struct SessionManagedSettingsResolvedData {
/// The effective (resolved) managed settings values, so clients can render exactly what is enforced. Absent when no managed policy is in force.
#[serde(skip_serializing_if = "Option::is_none")]
pub settings: Option,
- /// Which channel supplied the effective managed settings (the winning layer), or `none` when no policy is in force
+ /// Channel summary: `server`, `device`, or `client` when exactly one channel contributed; `mixed` when multiple channels contributed; otherwise `none`. Consult the per-channel booleans for exact provenance.
pub source: ManagedSettingsResolvedSource,
}
@@ -4617,6 +4620,9 @@ pub struct SkillsLoadedSkill {
/// Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field
#[serde(skip_serializing_if = "Option::is_none")]
pub argument_hint: Option,
+ /// Canonical slash command name used to invoke the skill, without the leading '/'
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub command_name: Option,
/// Description of what the skill does
pub description: String,
/// Whether the skill is currently enabled
@@ -6335,16 +6341,22 @@ pub enum AutoModeResolvedReasoningBucket {
Unknown,
}
-/// Which channel supplied the effective enterprise managed settings (highest-authority present layer wins wholesale)
+/// Summary of which managed-settings channels contributed to the effective session policy. Use the per-channel booleans for exact provenance.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
pub enum ManagedSettingsResolvedSource {
- /// Account/org policy self-fetched from the GitHub managed-settings endpoint (higher authority).
+ /// Only the server/account channel contributed.
#[serde(rename = "server")]
Server,
- /// Device-level MDM policy discovered from plist/registry/file (lower authority).
+ /// Only the device MDM/plist/registry/file channel contributed.
#[serde(rename = "device")]
Device,
- /// No managed policy is in force (no layer contributed).
+ /// Only session-local SDK-host injection contributed.
+ #[serde(rename = "client")]
+ Client,
+ /// More than one channel contributed. Ordinary keys resolve device over server per key, while permissions compose restrictively across all present layers.
+ #[serde(rename = "mixed")]
+ Mixed,
+ /// No managed policy is in force (no channel contributed).
#[serde(rename = "none")]
None,
/// Unknown variant for forward compatibility.
diff --git a/rust/tests/e2e/rpc_tasks_and_handlers.rs b/rust/tests/e2e/rpc_tasks_and_handlers.rs
index b3010ab78a..b046687f42 100644
--- a/rust/tests/e2e/rpc_tasks_and_handlers.rs
+++ b/rust/tests/e2e/rpc_tasks_and_handlers.rs
@@ -404,6 +404,7 @@ async fn should_return_expected_results_for_missing_pending_handler_requestids()
.rpc()
.permissions()
.handle_pending_permission_request(PermissionDecisionRequest {
+ decision_context: None,
request_id: request_id.into(),
result,
})
diff --git a/test/harness/package-lock.json b/test/harness/package-lock.json
index 4702dbba63..14f382f7cf 100644
--- a/test/harness/package-lock.json
+++ b/test/harness/package-lock.json
@@ -9,7 +9,7 @@
"version": "1.0.0",
"license": "ISC",
"devDependencies": {
- "@github/copilot": "^1.0.78",
+ "@github/copilot": "^1.0.79-5",
"@modelcontextprotocol/sdk": "^1.26.0",
"@types/node": "^25.3.3",
"@types/node-forge": "^1.3.14",
@@ -501,9 +501,9 @@
}
},
"node_modules/@github/copilot": {
- "version": "1.0.78",
- "resolved": "https://registry.npmjs.org/@github/copilot/-/copilot-1.0.78.tgz",
- "integrity": "sha512-jn+8HLZC3R7d6K1/1g9L1iWNKzBVS3JdVcx40r3aWyS5r+MLV1OPNp0fo5OfRMCDIm3NmEaaoqypi9sQkCXuiQ==",
+ "version": "1.0.79-5",
+ "resolved": "https://registry.npmjs.org/@github/copilot/-/copilot-1.0.79-5.tgz",
+ "integrity": "sha512-gQj87QGcWQpAx2YcBcBZ15q5ITA9y9aLDu0mIZb2daIRQqIK8VKtmY70G5d271eqrztTqd2b3Nu0mlB64E5ufg==",
"dev": true,
"license": "SEE LICENSE IN LICENSE.md",
"dependencies": {
@@ -513,20 +513,20 @@
"copilot": "npm-loader.js"
},
"optionalDependencies": {
- "@github/copilot-darwin-arm64": "1.0.78",
- "@github/copilot-darwin-x64": "1.0.78",
- "@github/copilot-linux-arm64": "1.0.78",
- "@github/copilot-linux-x64": "1.0.78",
- "@github/copilot-linuxmusl-arm64": "1.0.78",
- "@github/copilot-linuxmusl-x64": "1.0.78",
- "@github/copilot-win32-arm64": "1.0.78",
- "@github/copilot-win32-x64": "1.0.78"
+ "@github/copilot-darwin-arm64": "1.0.79-5",
+ "@github/copilot-darwin-x64": "1.0.79-5",
+ "@github/copilot-linux-arm64": "1.0.79-5",
+ "@github/copilot-linux-x64": "1.0.79-5",
+ "@github/copilot-linuxmusl-arm64": "1.0.79-5",
+ "@github/copilot-linuxmusl-x64": "1.0.79-5",
+ "@github/copilot-win32-arm64": "1.0.79-5",
+ "@github/copilot-win32-x64": "1.0.79-5"
}
},
"node_modules/@github/copilot-darwin-arm64": {
- "version": "1.0.78",
- "resolved": "https://registry.npmjs.org/@github/copilot-darwin-arm64/-/copilot-darwin-arm64-1.0.78.tgz",
- "integrity": "sha512-P11+VyWg8ad0WlywGtO2d7AxqTLJv4hkUicFg6Ycth5lfk00aCu/74YOOZSPO6C2bBBJhAza7oAdmauM6KEojw==",
+ "version": "1.0.79-5",
+ "resolved": "https://registry.npmjs.org/@github/copilot-darwin-arm64/-/copilot-darwin-arm64-1.0.79-5.tgz",
+ "integrity": "sha512-pR/ZrznLn6oOUcIPPgzaOOHKDLmeznV1yHwzkmTrqJVwlFgfFYeqBGTD3YwAqSmGAtXdDk+16o3j0mCg0m3+9A==",
"cpu": [
"arm64"
],
@@ -541,9 +541,9 @@
}
},
"node_modules/@github/copilot-darwin-x64": {
- "version": "1.0.78",
- "resolved": "https://registry.npmjs.org/@github/copilot-darwin-x64/-/copilot-darwin-x64-1.0.78.tgz",
- "integrity": "sha512-stimP3WDFs2GU8nJzTJbtRpZViV4bsf80yg7QrFq+G4RISQ3Nihg/3/H0U6UQF1+txMJ/Ohmb5RFYxSw1Hj2sw==",
+ "version": "1.0.79-5",
+ "resolved": "https://registry.npmjs.org/@github/copilot-darwin-x64/-/copilot-darwin-x64-1.0.79-5.tgz",
+ "integrity": "sha512-L828i0YUiI7IAACsmMnKg7LKrgzu5KqgOyA72BmxPmIYUpRpIxYt8QU8oGeej52de+I6zRYUCSWkLAkKLa6oFw==",
"cpu": [
"x64"
],
@@ -558,9 +558,9 @@
}
},
"node_modules/@github/copilot-linux-arm64": {
- "version": "1.0.78",
- "resolved": "https://registry.npmjs.org/@github/copilot-linux-arm64/-/copilot-linux-arm64-1.0.78.tgz",
- "integrity": "sha512-K31PRKGTm252V1Lof7ypjg283R2QSm3BgoCvZfX2taos4wqC3SaTozSQKwW3dgrAx7A3G3SGEoilVCNqfigdZA==",
+ "version": "1.0.79-5",
+ "resolved": "https://registry.npmjs.org/@github/copilot-linux-arm64/-/copilot-linux-arm64-1.0.79-5.tgz",
+ "integrity": "sha512-r3GT8kHGOhxbf+QaHp4vOQnJTnrreYOM+eTkgyiVrDe9GR5RKOO7XHjr8F9ob29UP4qpci/2LpgcYIJ9yiszgg==",
"cpu": [
"arm64"
],
@@ -575,9 +575,9 @@
}
},
"node_modules/@github/copilot-linux-x64": {
- "version": "1.0.78",
- "resolved": "https://registry.npmjs.org/@github/copilot-linux-x64/-/copilot-linux-x64-1.0.78.tgz",
- "integrity": "sha512-QK3oMtAn9dIv+1u1kx0xNpZNtZxdI+uZVIyLl7myp+Oh2Uj8BLagVv6a7uP0cDphO3TgfIdlvpepCe5MIcx0fw==",
+ "version": "1.0.79-5",
+ "resolved": "https://registry.npmjs.org/@github/copilot-linux-x64/-/copilot-linux-x64-1.0.79-5.tgz",
+ "integrity": "sha512-as7EcVDOC7TtoO9+bX8NrQsACPdPKg6t0HTaAaa7oRAftalGX8ZGhGouBOL6v13vpR2xtLaRRaP3YMwo//XQ9A==",
"cpu": [
"x64"
],
@@ -592,9 +592,9 @@
}
},
"node_modules/@github/copilot-linuxmusl-arm64": {
- "version": "1.0.78",
- "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-arm64/-/copilot-linuxmusl-arm64-1.0.78.tgz",
- "integrity": "sha512-F/0cTMsz6ug4yiXn3RKaCAMsLR261U5Njb6G9Y/HeAI7ES/tKEo2t5SHuvgXaIH4mYiZsRvfDKdX7c0WgBX/Jg==",
+ "version": "1.0.79-5",
+ "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-arm64/-/copilot-linuxmusl-arm64-1.0.79-5.tgz",
+ "integrity": "sha512-znO0FerQz6kUj46GqjGACR+ernRrAL3iymYo3ipGdf/E71fZnhyZ4BReh0ajRk6b2O5b7dbItk6K0K3Vr/Wn4g==",
"cpu": [
"arm64"
],
@@ -609,9 +609,9 @@
}
},
"node_modules/@github/copilot-linuxmusl-x64": {
- "version": "1.0.78",
- "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-x64/-/copilot-linuxmusl-x64-1.0.78.tgz",
- "integrity": "sha512-YMaJaeBGbArGAFYel+yFaFW/0rFgh0Oqki2f2mUtlonTX/xHr8EB4+mTnMJkHYMFy4gOTC3OtSEEe1NaW/cBXQ==",
+ "version": "1.0.79-5",
+ "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-x64/-/copilot-linuxmusl-x64-1.0.79-5.tgz",
+ "integrity": "sha512-6hDWKHNEyMwvsPwHYp+Yz3QIojFfheVzhpgz+zZde1uLSf7okiV3qP5Uyuwixv4qoissxnD+2o8eL6VAJl3fsg==",
"cpu": [
"x64"
],
@@ -626,9 +626,9 @@
}
},
"node_modules/@github/copilot-win32-arm64": {
- "version": "1.0.78",
- "resolved": "https://registry.npmjs.org/@github/copilot-win32-arm64/-/copilot-win32-arm64-1.0.78.tgz",
- "integrity": "sha512-ktDkFXaaecEKD3hpM6ydM9lKOdoCfsQsXCmzLzE7DCmSpbbMCdfPfWfZ7MOclmKmpZ5/MNfr4U2l8CUqGerzYA==",
+ "version": "1.0.79-5",
+ "resolved": "https://registry.npmjs.org/@github/copilot-win32-arm64/-/copilot-win32-arm64-1.0.79-5.tgz",
+ "integrity": "sha512-kvt3YrwZ4/VhAMsUau/T1SCzg4e5/ki7gBF2bxJqszh3B+7DVDXZB/jaUPexLUAbGhxSAzB9c02X1tgzt3m4nw==",
"cpu": [
"arm64"
],
@@ -643,9 +643,9 @@
}
},
"node_modules/@github/copilot-win32-x64": {
- "version": "1.0.78",
- "resolved": "https://registry.npmjs.org/@github/copilot-win32-x64/-/copilot-win32-x64-1.0.78.tgz",
- "integrity": "sha512-Gd8l2T4eqYEWlOEPd0SZznQ+YYgYrwOkE0QXodMkhCBbPdgu/uTzb7mnISWwnVAgqs7pONdF1GOpHkTo+ay8CQ==",
+ "version": "1.0.79-5",
+ "resolved": "https://registry.npmjs.org/@github/copilot-win32-x64/-/copilot-win32-x64-1.0.79-5.tgz",
+ "integrity": "sha512-e+5DJhN92vMvqrK0O4hV4KTCe5AP9F75K3PbGlSzEAjHhaXYxvPcx3hsL85SEMAoBrXItx64kHQMQm33Jo9K+Q==",
"cpu": [
"x64"
],
diff --git a/test/harness/package.json b/test/harness/package.json
index f1556534d0..4cb25e1065 100644
--- a/test/harness/package.json
+++ b/test/harness/package.json
@@ -14,7 +14,7 @@
"node": "^20.19.0 || >=22.12.0"
},
"devDependencies": {
- "@github/copilot": "^1.0.78",
+ "@github/copilot": "^1.0.79-5",
"@modelcontextprotocol/sdk": "^1.26.0",
"@types/node": "^25.3.3",
"@types/node-forge": "^1.3.14",