v1.0.13

Feature: cancellation for host-owned external tools

Host-owned external tool callbacks are now cancelled when their runtime request completes or their SDK session terminates. The cancellation primitive is idiomatic per SDK: .NET passes a request token to AIFunction, Node.js exposes ToolInvocation.signal, Go cancels ToolInvocation.TraceContext, Java cancels the returned CompletableFuture, Python cancels the handler task, and Rust drops the handler future. Go handlers that retain TraceContext for background work must derive a separate lifetime because the invocation context is cancelled when the request ends.

Feature: declare application identity with client info

Client options now accept optional client info (application name and version, integration name and version) across all six SDKs, exposed idiomatically per language (clientInfo in Node.js, client_info in Python and Rust, ClientInfo in Go and .NET, setClientInfo in Java). When set, the SDK forwards it on the server.connect handshake so the telemetry the runtime emits on the connection is attributed to the application and its Copilot integration instead of the runtime's own build. All fields are optional, and leaving client info unset keeps the runtime's default attribution. See Client info.

Feature: Node Agent Factories pagination and run notifications

The experimental Node.js Agent Factories convenience API now supports paginated run history. Existing session.factory.listRuns() calls still return the runs array, while calls with afterSeq, beforeSeq, or limit return the full page with cursor and truncation metadata.

Factory run and resume options now accept notifyOnComplete and logPhaseNames. The SDK forwards these options to the Copilot CLI for new and resumed runs.

Feature: selectable ask_user session behavior

Session create and cold resume now accept a language-specific askUserVariant option with legacy and elicitation values. SDK sessions retain the legacy question-and-answer tool by default. Select elicitation and provide an elicitation handler to expose the structured form-based ask_user tool.

Feature: rotating session-scoped GitHub credentials

All six SDKs can now acquire short-lived GitHub credentials through a session-scoped callback. The SDK registers the callback before session create or resume, maps initial and refresh requests to the owning session, and removes registrations on rollback, replacement, session close, and client close. Static per-session gitHubToken credentials remain supported and are mutually exclusive with the callback.

Token responses use the shared tagged token/cancelled shape and require expiresIn, expressed as the positive number of seconds remaining when the callback completes. See github/copilot-agent-runtime#16381 for the runtime credential-authority implementation.

Initial acquisition occurs during create or resume; cancellation, callback errors, and invalid credentials reject that operation instead of falling back to ambient authentication. Idle sessions refresh only before their next credential-consuming operation.

Feature: extensions can request sensitive environment variables

Copilot CLI extensions can now ask for named sensitive environment variables when they join a session. joinSession() accepts a requestedEnvironmentVariables option listing the variable names the extension needs. The CLI shows a permission prompt naming the extension and the exact variables requested. On approval, only those variables reach that extension and their values are written into the extension process's process.env before joinSession() resolves. On denial, joinSession() rejects, the extension does not load, and its tools never reach the model.

An approval is remembered against the exact set of names the user saw, so an extension that later asks for one more variable prompts again. Names that are unset, or that the CLI does not filter from extensions, are not prompted for. This is the client half of the feature; it requires a Copilot CLI that supports extension environment access, and older CLIs ignore the request and grant nothing.

import { joinSession } from "@github/copilot-sdk/extension";

const session = await joinSession({
    requestedEnvironmentVariables: ["GITHUB_TOKEN"],
});
const token = process.env.GITHUB_TOKEN;

Feature: early session-event subscription (Rust)

The Rust SDK can now observe every event routed to a session, starting with that session's very first routed event. Client::prepare_session and Client::prepare_resume_session return an inert PreparedSession that owns the session's event channel, so a subscription can be installed before any protocol activity begins:

let prepared = client.prepare_session(
    SessionConfig::default().with_event_buffer_capacity(2048),
)?;
let mut events = prepared.subscribe();
let session = prepared.start().await?;

Previously, Session::subscribe could only be called on the returned session, so events the runtime emitted while session.create / session.resume was still in flight were broadcast with no receiver installed and dropped. Ephemeral events such as session.idle are not persisted, so they could not be recovered with getMessages either.

The guarantee is scoped to routed events. For cloud sessions where the server assigns the session ID, the SDK cannot route notifications until the session.create response arrives and the ID is known, so events emitted before that point are not routable to any session. Pin session_id on the config to get router registration before the RPC, and with it complete pre-response coverage.

prepare_* is synchronous and inert: it validates the buffer capacity and allocates a local channel, and performs no router registration, task spawn, or wire activity until start() is first polled. start(self) consumes the handle and PreparedSession is not Clone, so a prepared session can never produce two event loops. Dropping an unstarted handle leaves no state behind; dropping a polled start() future cancels the startup and unregisters the session, so a retry with the same session ID succeeds. Session registrations now carry an ownership identity, so cleanup removes only the exact registration it owns and an abandoned startup can never evict a same-ID retry (or a session that replaced it).

Both SessionConfig and ResumeSessionConfig gained a runtime-only event_buffer_capacity option (default 512, Some(0) rejected as an invalid config). The buffer is finite, so slow subscribers observe Lagged rather than applying backpressure; consumers that need a lossless view of a large startup burst must size the buffer accordingly or drain concurrently with start().

create_session and resume_session are unchanged wrappers over prepare_*(...)?.start() with identical RPC sequences and error kinds.

Feature: host-injected managed settings permissions

Session create and resume accept a new optional managedSettings option that injects an enterprise permissions policy at session startup, alongside the existing enableManagedSettings self-fetch flag. The current contract is permissions-only: disableBypassPermissionsMode (the literal "disable"), plus deny, ask, and allow rule lists. The layer composes restrictively with any server- or device-level managed settings (deny/ask are unioned, every present allow list must admit a tool, and disableBypassPermissionsMode is deny-wins).

This layer is startup-only and is not persisted with the session, so it must be re-supplied on resume to remain in effect; omitting it on resume clears the previously injected layer. It can be combined with enableManagedSettings. Host injection requires Copilot CLI 1.0.79-5 or later and does not require an SDK protocol version bump.

The generated session-event types also expose truthful injected-policy provenance: session.managed_settings_resolved can report source as client or mixed, with optional clientManaged metadata.

const session = await client.createSession({
    managedSettings: {
        permissions: {
            disableBypassPermissionsMode: "disable",
            deny: ["shell(rm*)"],
            ask: ["write"],
        },
    },
});

var session = await client.CreateSessionAsync(new SessionConfig
{
    ManagedSettings = new ManagedSettings
    {
        Permissions = new ManagedSettingsPermissions
        {
            DisableBypassPermissionsMode = DisableBypassPermissionsMode.Disable,
            Deny = ["shell(rm*)"],
            Ask = ["write"],
        },
    },
});

Feature: Auto model routing tier controls

Sessions can now steer auto model routing toward efficiency, balance, or intelligence. An Auto tier can be set at session creation, and a new setAutoTier (and equivalent setModel option) lets sessions stage or reset a tier preference afterward, since the runtime only commits a staged preference on the next successful auto model turn. (#2437, #2514)

await session.set_auto_tier("efficiency")

Feature: sandbox bypass and non-object external tool arguments

Sandbox configuration now exposes allowBypass across all six SDKs. External tool overrides such as apply_patch can also receive non-object JSON argument values, which previously failed before reaching the host handler in .NET. (#2372, #2496)

Feature: host-resolved feature flag overrides

Session create and resume now accept a featureFlags map across all six SDKs, forwarding host-resolved overrides while preserving the distinction between an unset map and an explicitly empty one. (#2451)

Other changes

• feature: use session.detach instead of session.destroy for SDK session cleanup so disconnecting one client no longer tears down a shared session for other owners (#2307)
• bugfix: [Rust] answer the request ID when a tool handler panics (#2311)
• bugfix: [Go] close failed session event loops (#2360)
• bugfix: support bracketed IPv6 runtime URLs (#2200)
• bugfix: [Python] serialize native values in tool results (#2374)
• bugfix: [Rust] prevent orphaned CLI processes (#2292)
• improvement: [Rust] default ClientMode::Empty to no built-in skills (#2410)
• improvement: [Go] auto-detect bundler package name and avoid duplicate license downloads (#2452, #2453)

New contributors

• @lukehoban made their first contribution in #2292
• @scordio made their first contribution in #2382
• @OllieinCanada made their first contribution in #2374
• @gimenete made their first contribution in #2458
• @gwwar made their first contribution in #2464
• @Pybsama made their first contribution in #2163
• @green3sf made their first contribution in #2360
• @gokhanarkan made their first contribution in #2532

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by Release Changelog Generator · copilot · auto · 125.2 AIC · ⌖ 8.09 AIC · ⊞ 11.7K