Skip to content

Update dependency @github/copilot-sdk to v1 - #90

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-copilot-sdk-1.x
Open

Update dependency @github/copilot-sdk to v1#90
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-copilot-sdk-1.x

Conversation

@renovate

@renovate renovate Bot commented Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@github/copilot-sdk 0.3.0 → 1.0.13 age confidence

Release Notes

github/copilot-sdk (@​github/copilot-sdk)

v1.0.13

Compare Source

Feature: cancellation for host-owned external tools

Host-owned external tool callbacks are now cancelled when their runtime request completes or their SDK session terminates. The cancellation primitive is idiomatic per SDK: .NET passes a request token to AIFunction, Node.js exposes ToolInvocation.signal, Go cancels ToolInvocation.TraceContext, Java cancels the returned CompletableFuture, Python cancels the handler task, and Rust drops the handler future. Go handlers that retain TraceContext for background work must derive a separate lifetime because the invocation context is cancelled when the request ends.

Feature: declare application identity with client info

Client options now accept optional client info (application name and version, integration name and version) across all six SDKs, exposed idiomatically per language (clientInfo in Node.js, client_info in Python and Rust, ClientInfo in Go and .NET, setClientInfo in Java). When set, the SDK forwards it on the server.connect handshake so the telemetry the runtime emits on the connection is attributed to the application and its Copilot integration instead of the runtime's own build. All fields are optional, and leaving client info unset keeps the runtime's default attribution. See Client info.

Feature: Node Agent Factories pagination and run notifications

The experimental Node.js Agent Factories convenience API now supports paginated run history. Existing session.factory.listRuns() calls still return the runs array, while calls with afterSeq, beforeSeq, or limit return the full page with cursor and truncation metadata.

Factory run and resume options now accept notifyOnComplete and logPhaseNames. The SDK forwards these options to the Copilot CLI for new and resumed runs.

Feature: selectable ask_user session behavior

Session create and cold resume now accept a language-specific askUserVariant option with legacy and elicitation values. SDK sessions retain the legacy question-and-answer tool by default. Select elicitation and provide an elicitation handler to expose the structured form-based ask_user tool.

Feature: rotating session-scoped GitHub credentials

All six SDKs can now acquire short-lived GitHub credentials through a session-scoped callback. The SDK registers the callback before session create or resume, maps initial and refresh requests to the owning session, and removes registrations on rollback, replacement, session close, and client close. Static per-session gitHubToken credentials remain supported and are mutually exclusive with the callback.

Token responses use the shared tagged token/cancelled shape and require expiresIn, expressed as the positive number of seconds remaining when the callback completes. See github/copilot-agent-runtime#16381 for the runtime credential-authority implementation.

Initial acquisition occurs during create or resume; cancellation, callback errors, and invalid credentials reject that operation instead of falling back to ambient authentication. Idle sessions refresh only before their next credential-consuming operation.

Feature: extensions can request sensitive environment variables

Copilot CLI extensions can now ask for named sensitive environment variables when they join a session. joinSession() accepts a requestedEnvironmentVariables option listing the variable names the extension needs. The CLI shows a permission prompt naming the extension and the exact variables requested. On approval, only those variables reach that extension and their values are written into the extension process's process.env before joinSession() resolves. On denial, joinSession() rejects, the extension does not load, and its tools never reach the model.

An approval is remembered against the exact set of names the user saw, so an extension that later asks for one more variable prompts again. Names that are unset, or that the CLI does not filter from extensions, are not prompted for. This is the client half of the feature; it requires a Copilot CLI that supports extension environment access, and older CLIs ignore the request and grant nothing.

import { joinSession } from "@github/copilot-sdk/extension";

const session = await joinSession({
    requestedEnvironmentVariables: ["GITHUB_TOKEN"],
});
const token = process.env.GITHUB_TOKEN;
Feature: early session-event subscription (Rust)

The Rust SDK can now observe every event routed to a session, starting with that session's very first routed event. Client::prepare_session and Client::prepare_resume_session return an inert PreparedSession that owns the session's event channel, so a subscription can be installed before any protocol activity begins:

let prepared = client.prepare_session(
    SessionConfig::default().with_event_buffer_capacity(2048),
)?;
let mut events = prepared.subscribe();
let session = prepared.start().await?;

Previously, Session::subscribe could only be called on the returned session, so events the runtime emitted while session.create / session.resume was still in flight were broadcast with no receiver installed and dropped. Ephemeral events such as session.idle are not persisted, so they could not be recovered with getMessages either.

The guarantee is scoped to routed events. For cloud sessions where the server assigns the session ID, the SDK cannot route notifications until the session.create response arrives and the ID is known, so events emitted before that point are not routable to any session. Pin session_id on the config to get router registration before the RPC, and with it complete pre-response coverage.

prepare_* is synchronous and inert: it validates the buffer capacity and allocates a local channel, and performs no router registration, task spawn, or wire activity until start() is first polled. start(self) consumes the handle and PreparedSession is not Clone, so a prepared session can never produce two event loops. Dropping an unstarted handle leaves no state behind; dropping a polled start() future cancels the startup and unregisters the session, so a retry with the same session ID succeeds. Session registrations now carry an ownership identity, so cleanup removes only the exact registration it owns and an abandoned startup can never evict a same-ID retry (or a session that replaced it).

Both SessionConfig and ResumeSessionConfig gained a runtime-only event_buffer_capacity option (default 512, Some(0) rejected as an invalid config). The buffer is finite, so slow subscribers observe Lagged rather than applying backpressure; consumers that need a lossless view of a large startup burst must size the buffer accordingly or drain concurrently with start().

create_session and resume_session are unchanged wrappers over prepare_*(...)?.start() with identical RPC sequences and error kinds.

Feature: host-injected managed settings permissions

Session create and resume accept a new optional managedSettings option that injects an enterprise permissions policy at session startup, alongside the existing enableManagedSettings self-fetch flag. The current contract is permissions-only: disableBypassPermissionsMode (the literal "disable"), plus deny, ask, and allow rule lists. The layer composes restrictively with any server- or device-level managed settings (deny/ask are unioned, every present allow list must admit a tool, and disableBypassPermissionsMode is deny-wins).

This layer is startup-only and is not persisted with the session, so it must be re-supplied on resume to remain in effect; omitting it on resume clears the previously injected layer. It can be combined with enableManagedSettings. Host injection requires Copilot CLI 1.0.79-5 or later and does not require an SDK protocol version bump.

The generated session-event types also expose truthful injected-policy provenance: session.managed_settings_resolved can report source as client or mixed, with optional clientManaged metadata.

const session = await client.createSession({
    managedSettings: {
        permissions: {
            disableBypassPermissionsMode: "disable",
            deny: ["shell(rm*)"],
            ask: ["write"],
        },
    },
});
var session = await client.CreateSessionAsync(new SessionConfig
{
    ManagedSettings = new ManagedSettings
    {
        Permissions = new ManagedSettingsPermissions
        {
            DisableBypassPermissionsMode = DisableBypassPermissionsMode.Disable,
            Deny = ["shell(rm*)"],
            Ask = ["write"],
        },
    },
});
Feature: Auto model routing tier controls

Sessions can now steer auto model routing toward efficiency, balance, or intelligence. An Auto tier can be set at session creation, and a new setAutoTier (and equivalent setModel option) lets sessions stage or reset a tier preference afterward, since the runtime only commits a staged preference on the next successful auto model turn. (#​2437, #​2514)

await session.set_auto_tier("efficiency")
Feature: sandbox bypass and non-object external tool arguments

Sandbox configuration now exposes allowBypass across all six SDKs. External tool overrides such as apply_patch can also receive non-object JSON argument values, which previously failed before reaching the host handler in .NET. (#​2372, #​2496)

Feature: host-resolved feature flag overrides

Session create and resume now accept a featureFlags map across all six SDKs, forwarding host-resolved overrides while preserving the distinction between an unset map and an explicitly empty one. (#​2451)

Other changes
  • feature: use session.detach instead of session.destroy for SDK session cleanup so disconnecting one client no longer tears down a shared session for other owners (#​2307)
  • bugfix: [Rust] answer the request ID when a tool handler panics (#​2311)
  • bugfix: [Go] close failed session event loops (#​2360)
  • bugfix: support bracketed IPv6 runtime URLs (#​2200)
  • bugfix: [Python] serialize native values in tool results (#​2374)
  • bugfix: [Rust] prevent orphaned CLI processes (#​2292)
  • improvement: [Rust] default ClientMode::Empty to no built-in skills (#​2410)
  • improvement: [Go] auto-detect bundler package name and avoid duplicate license downloads (#​2452, #​2453)
New contributors
  • @lukehoban made their first contribution in #​2292
  • @scordio made their first contribution in #​2382
  • @OllieinCanada made their first contribution in #​2374
  • @gimenete made their first contribution in #​2458
  • @gwwar made their first contribution in #​2464
  • @Pybsama made their first contribution in #​2163
  • @green3sf made their first contribution in #​2360
  • @gokhanarkan made their first contribution in #​2532

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by Release Changelog Generator · copilot · auto · 125.2 AIC · ⌖ 8.09 AIC · ⊞ 11.7K

v1.0.11

Compare Source

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@v1.0.9...v1.0.11

v1.0.9

Compare Source

What's Changed

New Contributors

Full Changelog: github/copilot-sdk@v1.0.8...v1.0.9

v1.0.8

Compare Source

Feature: per-agent reasoning effort

Custom sub-agents can now have their own reasoning effort level, independent of the parent session. When reasoningEffort is omitted on a custom agent, the backend applies its own default — the session-level setting is not inherited. (#​1981)

const session = await client.createSession({
    customAgents: [{
        name: "planner",
        prompt: "You plan tasks.",
        reasoningEffort: "high",
    }],
});
var session = await client.CreateSessionAsync(new SessionOptions {
    CustomAgents = [new CustomAgentConfig {
        Name = "planner",
        Prompt = "You plan tasks.",
        ReasoningEffort = ReasoningEffort.High,
    }],
});
Other changes
  • improvement: strongly type expAssignments session config field across all SDKs (#​2033)
  • bugfix: [Rust] fix ask_user starving the per-session event loop (#​2034)
New contributors
  • @lukewar made their first contribution in #​1880

[!WARNING]

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Release Changelog Generator · 39.1 AIC · ⌖ 5.54 AIC · ⊞ 7.2K

v1.0.7

Compare Source

Feature: in-process (FFI) transport

The SDK can now host the Copilot runtime in-process by loading the native runtime library via its C ABI (FFI), eliminating the overhead of spawning a child process. This experimental transport is available for Node.js, Rust, Python, and Go. (#​1953, #​1915, #​1975, #​1976)

const client = new CopilotClient({ connection: RuntimeConnection.forInProcess() });
var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForInProcess() });
Feature: tool search configuration

A new toolSearch session option controls how the SDK defers tools when the total tool count exceeds a threshold. When enabled (the default), excess MCP and external tools are surfaced on demand through the built-in tool_search_tool rather than pre-loaded into every prompt. Tool results can also include toolReferences to link cited sources back to the tool that produced them. (#​1933)

const session = await client.createSession({
    toolSearch: { defer: "auto" },
});
var session = await client.CreateSessionAsync(new SessionConfig
{
    ToolSearch = new ToolSearchConfig { Defer = "auto" },
});
Feature: opaque metadata passthrough on tool definitions

Tool definitions now accept an optional metadata bag that is forwarded verbatim in session.create and session.resume RPC calls. This lets hosts attach namespaced, implementation-specific metadata to tools without expanding the typed public contract; unknown keys are preserved and round-tripped untouched. (#​1864)

session.defineTool("my-tool", { metadata: { "myapp:priority": 1 } }, handler);
session.DefineTool("my-tool", new ToolOptions { Metadata = new() { ["myapp:priority"] = 1 } }, handler);
Other changes
  • feature: [All SDKs] add canvasProvider field to session create/resume config so hosts can supply a stable canvas-provider identity that survives cold resume (#​1847)
  • feature: [All SDKs] forward enableManagedSettings flag in session create/resume for enterprise managed-settings enforcement (#​1925)
  • feature: [All SDKs] propagate agentId, parentAgentId, and interactionType from LLM inference start frames into request-handler contexts (#​1949)
  • improvement: [Rust] make tool schema and MCP server serialization deterministic by replacing HashMap with IndexMap (#​1931)
  • improvement: [Rust] use native-tls for the build-time CLI download (#​1964)
  • bugfix: [.NET] avoid Windows in-process test teardown deadlock (#​1997)
New contributors

v1.0.6

Compare Source

Feature: inline lambda tool definitions

Developers can now define tools directly at the call site using ToolDefinition.from(...) with typed lambda handlers and Param.of(...) parameter metadata — no separate annotated class required. Async variants (fromAsync) and ToolInvocation context injection (fromWithToolInvocation) are also available. (#​1895)

ToolDefinition greet = ToolDefinition.from(
    "greet", "Greets a user by name",
    Param.of(String.class, "name", "The user's name"),
    name -> "Hello, " + name + "!");
Other changes
  • bugfix: [Java] preserve explicit null map values in JSON-RPC params so user setting clears reach the CLI (#​1906)
  • feature: [Java] add experimental onGitHubTelemetry callback on CopilotClientOptions for receiving forwarded GitHub telemetry events (#​1835)

v1.0.5

Compare Source

Feature: new session options — citations, agent exclusions, and credit limits

Three new options are available on SessionConfig and ResumeSessionConfig. enableCitations (experimental) enables native model citations for supported providers; excludedBuiltInAgents hides named built-in agents from discovery; and sessionLimits sets a per-session AI-credit budget. (#​1865)

SessionConfig config = new SessionConfig()
    .setEnableCitations(true)
    .setExcludedBuiltInAgents(List.of("copilot"))
    .setSessionLimits(new SessionLimitsConfig(100.0));
New contributors

v1.0.4

Compare Source

Feature: HTTP request callback support

Register a CopilotRequestHandler on the client to intercept every outbound LLM inference HTTP or WebSocket request — for both BYOK and CAPI — and mutate, replace, or fully forward it. Useful for logging, header injection, model substitution, or custom routing. (#​1689, #​1775, #​1784)

final class MyHandler extends CopilotRequestHandler {
    @Override
    protected HttpResponse<InputStream> sendRequest(HttpRequest request, CopilotRequestContext ctx) throws Exception {
        HttpRequest mutated = HttpRequest.newBuilder(request, (n, v) -> true)
                .header("X-Debug-Session", ctx.sessionId() == null ? "none" : ctx.sessionId())
                .build();
        return super.sendRequest(mutated, ctx);
    }
}

CopilotClient client = new CopilotClient(
    new CopilotClientOptions().setRequestHandler(new MyHandler()));
Feature: getBearerToken callback for BYOK providers (Managed Identity)

BYOK provider configs now accept a getBearerToken callback so the SDK consumer can resolve bearer tokens (e.g. Azure Managed Identity) on demand. The SDK takes zero Azure SDK dependency — the consumer supplies the callback using any identity library. (#​1748)

var provider = new ProviderConfig()
    .setType("openai")
    .setBaseUrl(baseUrl)
    .setGetBearerToken(args -> cred.getToken(ctx).map(AccessToken::getToken).toFuture());
Feature: experimental multi-provider BYOK registry

Register multiple named providers and models on a single session via NamedProviderConfig and ProviderModelConfig. Custom agents can reference provider-qualified model IDs such as "alpha/sonnet". This feature is experimental. (#​1718)

Feature: preamble system message section and preserve action

Two new customization options for system message sections. SystemMessageSections.PREAMBLE targets only the identity preamble without affecting its sibling sub-sections (identity and tool_instructions are now documented as section groups). The new preserve action protects an individually-addressable section from a group-level remove. (#​1713)

Other changes
  • feature: add optional memory configuration (MemoryConfiguration) to session create and resume (#​1617)
  • feature: defer parameter on tool definitions controls eager vs. lazy tool loading ("auto" or "never") (#​1632)
  • feature: otlpProtocol telemetry option for configuring OTLP export transport ("http/json" or "http/protobuf") (#​1648)
  • feature: ModelBilling.tokenPrices surfaced on public SDK types, exposing per-tier pricing and context window limits (#​1633)
  • feature: CapiSessionOptions.enableWebSocketResponses and ProviderConfig.transport for WebSocket transport control on session create/resume (#​1711)
  • improvement: call runtime.shutdown during client stop for deterministic OTEL telemetry flush before process cleanup (#​1667)
  • improvement: rename SystemPromptSections → SystemMessageSections for cross-SDK consistency; old class deprecated with forRemoval=true (#​1683)
New contributors

v1.0.3

Compare Source

v1.0.2

Compare Source

Feature: opt-in memory for sessions

Sessions can now be configured with persistent memory, allowing the agent to recall information across turns. Set memory: { enabled: true } when creating or resuming a session; when omitted the runtime default applies. (#​1617)

const session = await client.createSession({
    memory: { enabled: true },
});
var session = await client.CreateSessionAsync(new SessionConfig
{
    Memory = new MemoryConfiguration { Enabled = true }
});
Feature: defer parameter for tool definitions

Tools now support a defer option controlling whether they are pre-loaded eagerly or surfaced lazily through tool search. Use "auto" (the default) to allow lazy loading, or "never" to force pre-loading. (#​1632)

defineTool("lookup_issue", {
    description: "Fetch issue details",
    parameters: z.object({ id: z.string() }),
    defer: "auto",
    handler: async ({ id }) => { /* ... */ },
});
var tool = CopilotTool.DefineTool(
    async ([Description("Issue ID")] string id) => { /* ... */ },
    toolOptions: new CopilotToolOptions { Defer = CopilotToolDefer.Auto });
Other changes
  • feature: [All SDKs] add otlpProtocol telemetry option ("http/json" or "http/protobuf") for configuring OTLP export transport (#​1648)
  • feature: [All SDKs] surface ModelBilling.tokenPrices on public SDK types, exposing per-tier input/output/cache pricing and context window limits (#​1633)
  • improvement: [All SDKs] call runtime.shutdown during normal client stop for deterministic OTEL telemetry flush before process cleanup (#​1667)
  • improvement: [Go] thread context.Context through the JSON-RPC request path for proper cancellation support (#​1643)
  • improvement: [Java] add getOpenCanvases() to CopilotSession to track currently open canvas instances, matching the other SDKs (#​1606)
  • improvement: [Java] rename SystemPromptSections to SystemMessageSections for cross-SDK consistency; old class deprecated with forRemoval=true (#​1683)
  • bugfix: [Python] round sub-millisecond durations in to_timedelta_int to avoid serialization errors (#​1668)
  • bugfix: [Rust] skip CLI binary download in build.rs when DOCS_RS env var is set (#​1660)
New contributors

v1.0.1

Compare Source

Feature: @CopilotExperimental compile-time gate for Java SDK

The Java SDK now ships a @CopilotExperimental annotation and a JSR 269 annotation processor that causes compilation to fail when experimental SDK APIs are referenced without opting in. Annotate a class or method with @AllowCopilotExperimental, or pass -Acopilot.experimental.allowed=true to the compiler to acknowledge the experimental status. (#​1601)

// Opt in at the declaration level
`@AllowCopilotExperimental`
public class MyApp {
    // experimental SDK types and methods may be used here
}
<!-- Or opt in for the entire compilation unit via Maven -->
<compilerArgs>
    <arg>-Acopilot.experimental.allowed=true</arg>
</compilerArgs>
Other changes
  • bugfix: [Node, Python, Go, .NET, Rust] open_canvases snapshot now correctly shrinks when session.canvas.closed is emitted — previously closed canvases were never removed (#​1604)
  • bugfix: [Go] generator no longer produces discriminator accessor names t

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch from 2d34b7a to 0362bac Compare June 10, 2026 17:15
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch 2 times, most recently from 88232d4 to 4d6bce6 Compare June 22, 2026 05:31
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch 2 times, most recently from 1dc9208 to 7c6e4ab Compare July 1, 2026 20:33
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch 2 times, most recently from 9d3b50e to 0ca03b6 Compare July 12, 2026 10:43
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch 3 times, most recently from 66a31bd to c9ab673 Compare July 23, 2026 03:10
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch 2 times, most recently from a83aa5f to abbdc4e Compare July 30, 2026 19:00
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch 2 times, most recently from 14788c9 to 32d690d Compare August 11, 2026 23:50
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch from 32d690d to 200a58f Compare August 14, 2026 22:40
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch from 200a58f to c00d4d6 Compare August 26, 2026 16:37
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch from c00d4d6 to a79d876 Compare September 2, 2026 23:37
@renovate
renovate Bot force-pushed the renovate/github-copilot-sdk-1.x branch from a79d876 to 58c1a7d Compare September 5, 2026 01:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants