deps: Bump GitHub.Copilot.SDK from 1.0.11 to 1.0.13 - #2003

Sourced from GitHub.Copilot.SDK's releases.

1.0.13

Feature: cancellation for host-owned external tools

Host-owned external tool callbacks are now cancelled when their runtime request completes or their SDK session terminates. The cancellation primitive is idiomatic per SDK: .NET passes a request token to AIFunction, Node.js exposes ToolInvocation.signal, Go cancels ToolInvocation.TraceContext, Java cancels the returned CompletableFuture, Python cancels the handler task, and Rust drops the handler future. Go handlers that retain TraceContext for background work must derive a separate lifetime because the invocation context is cancelled when the request ends.

Feature: declare application identity with client info

Client options now accept optional client info (application name and version, integration name and version) across all six SDKs, exposed idiomatically per language (clientInfo in Node.js, client_info in Python and Rust, ClientInfo in Go and .NET, setClientInfo in Java). When set, the SDK forwards it on the server.connect handshake so the telemetry the runtime emits on the connection is attributed to the application and its Copilot integration instead of the runtime's own build. All fields are optional, and leaving client info unset keeps the runtime's default attribution. See Client info.

Feature: Node Agent Factories pagination and run notifications

The experimental Node.js Agent Factories convenience API now supports paginated run history. Existing session.factory.listRuns() calls still return the runs array, while calls with afterSeq, beforeSeq, or limit return the full page with cursor and truncation metadata.

Factory run and resume options now accept notifyOnComplete and logPhaseNames. The SDK forwards these options to the Copilot CLI for new and resumed runs.

Feature: selectable ask_user session behavior

Session create and cold resume now accept a language-specific askUserVariant option with legacy and elicitation values. SDK sessions retain the legacy question-and-answer tool by default. Select elicitation and provide an elicitation handler to expose the structured form-based ask_user tool.

Feature: rotating session-scoped GitHub credentials

All six SDKs can now acquire short-lived GitHub credentials through a session-scoped callback. The SDK registers the callback before session create or resume, maps initial and refresh requests to the owning session, and removes registrations on rollback, replacement, session close, and client close. Static per-session gitHubToken credentials remain supported and are mutually exclusive with the callback.

Token responses use the shared tagged token/cancelled shape and require expiresIn, expressed as the positive number of seconds remaining when the callback completes. See github/copilot-agent-runtime#​16381 for the runtime credential-authority implementation.

Initial acquisition occurs during create or resume; cancellation, callback errors, and invalid credentials reject that operation instead of falling back to ambient authentication. Idle sessions refresh only before their next credential-consuming operation.

Feature: extensions can request sensitive environment variables

Copilot CLI extensions can now ask for named sensitive environment variables when they join a session. joinSession() accepts a requestedEnvironmentVariables option listing the variable names the extension needs. The CLI shows a permission prompt naming the extension and the exact variables requested. On approval, only those variables reach that extension and their values are written into the extension process's process.env before joinSession() resolves. On denial, joinSession() rejects, the extension does not load, and its tools never reach the model.

An approval is remembered against the exact set of names the user saw, so an extension that later asks for one more variable prompts again. Names that are unset, or that the CLI does not filter from extensions, are not prompted for. This is the client half of the feature; it requires a Copilot CLI that supports extension environment access, and older CLIs ignore the request and grant nothing.

import { joinSession } from "@​github/copilot-sdk/extension";

const session = await joinSession({
    requestedEnvironmentVariables: ["GITHUB_TOKEN"],
});
const token = process.env.GITHUB_TOKEN;

Feature: early session-event subscription (Rust)

The Rust SDK can now observe every event routed to a session, starting with that session's very first routed event. Client::prepare_session and Client::prepare_resume_session return an inert PreparedSession that owns the session's event channel, so a subscription can be installed before any protocol activity begins:

let prepared = client.prepare_session(
    SessionConfig::default().with_event_buffer_capacity(2048),
)?;
let mut events = prepared.subscribe();
 ... (truncated)

## 1.0.13-preview.4

### Feature: rewind support across all SDKs

Sessions can now opt into file-change tracking and rewind conversation history and tracked file changes to any prior checkpoint. Enable file tracking when creating a session, then use `rewind` to roll back. ([#​2321](https://github.com/github/copilot-sdk/pull/2321))

```ts
const session = await client.createSession({ enableFileChangeTracking: true });
// ...later
const points = await session.rpc.rewind.list();
await session.rpc.rewind.rewind({ rewindTarget: points[0].id });

var session = await client.CreateSessionAsync(new SessionOptions { EnableFileChangeTracking = true });
var points = await session.Rpc.Rewind.ListAsync();
await session.Rpc.Rewind.RewindAsync(new RewindRequest { RewindTarget = points[0].Id });

session = await client.create_session(enable_file_change_tracking=True)
points = await session.rpc.rewind.list()
await session.rpc.rewind.rewind(rewind_target=points[0].id)

Feature: session-scoped GitHub token providers

Sessions now support expiry-aware GitHub token callbacks in addition to static tokens. The SDK handles refresh requests from the runtime, so extensions always receive fresh credentials. (#​2412)

const session = await client.createSession({
  gitHubTokenProvider: async ({ host, reason }) => ({ token: await fetchToken(host) })
});

var session = await client.CreateSessionAsync(new SessionOptions {
    GitHubTokenProvider = async (req, ct) =>
        new GitHubTokenResult { Token = await FetchTokenAsync(req.Host) }
});

session, _ := client.CreateSession(ctx, copilot.SessionOptions{
    GitHubTokenProvider: func(ctx context.Context, req copilot.TokenProviderRequest) (copilot.TokenProviderResult, error) {
        return copilot.TokenProviderResult{Token: fetchToken(req.Host)}, nil
    },
})

Feature: Java in-process native runtime on all platforms

... (truncated)

1.0.13-preview.3

Feature: rewind support across all SDKs

Sessions can now opt into file-change tracking and conversation rewind. When enableFileChangeTracking is enabled, the session records which files were changed during a conversation turn. You can then list pending rewind points, preview changes, and rewind the conversation history together with any tracked file modifications. (#​2321)

const session = await client.createSession({ enableFileChangeTracking: true });
const points = await session.rpc.rewind.listPendingRewindPoints();
await session.rpc.rewind.rewind({ id: points[0].id });

var session = await client.CreateSessionAsync(new SessionOptions { EnableFileChangeTracking = true });
var points = await session.Rpc.Rewind.ListPendingRewindPointsAsync();
await session.Rpc.Rewind.RewindAsync(new RewindRequest { Id = points[0].Id });

session = await client.create_session(enable_file_change_tracking=True)
points = await session.rpc.rewind.list_pending_rewind_points()
await session.rpc.rewind.rewind(id=points[0].id)

Feature: session-scoped GitHub token providers

Sessions now support a dynamic, expiry-aware GitHub token callback as an alternative to a static gitHubToken. The SDK maps each host request (with host, session, and reason context) to your callback, handling concurrent-session isolation automatically. (#​2412)

const session = await client.createSession({
  gitHubTokenProvider: async ({ host }) => ({ token: await getToken(host), expiresIn: 3600 }),
});

var session = await client.CreateSessionAsync(new SessionOptions
{
    GitHubTokenProvider = async (req, ct) =>
        new GitHubToken { Token = await GetTokenAsync(req.Host, ct), ExpiresIn = TimeSpan.FromHours(1) }
});

session, err := client.CreateSession(ctx, copilot.SessionOptions{
    GitHubTokenProvider: func(ctx context.Context, req copilot.GitHubTokenRequest) (copilot.GitHubToken, error) {
        return copilot.GitHubToken{Token: getToken(req.Host), ExpiresIn: 3600}, nil
    },
})

Feature: built-in plugin directory support

... (truncated)

1.0.13-preview.2

Feature: rewind support across all SDKs

Sessions can now opt in to file-change tracking so that rewinding restores both conversation history and the files that were modified. Enable it with the new enableFileChangeTracking session option. (#​2321)

const session = await client.startSession({ enableFileChangeTracking: true });

var session = await client.StartSessionAsync(new SessionOptions { EnableFileChangeTracking = true });

session = await client.start_session(enable_file_change_tracking=True)

session, _ := client.StartSession(ctx, &copilot.SessionOptions{EnableFileChangeTracking: true})

Session session = client.startSession(new SessionOptions().setEnableFileChangeTracking(true)).get();

let session = client.start_session(SessionOptions { enable_file_change_tracking: Some(true), ..Default::default() }).await?;

Feature: session-scoped GitHub token providers

Applications can now supply a dynamic GitHub token callback instead of a static gitHubToken string. The runtime calls the callback before each token use, so short-lived tokens stay fresh across long-running sessions. (#​2412)

const session = await client.startSession({
  gitHubTokenProvider: async ({ host, reason }) => ({ token: await fetchToken(host) })
});

var session = await client.StartSessionAsync(new SessionOptions
{
    GitHubTokenProvider = async (request, ct) => new GitHubTokenResult(await FetchTokenAsync(request.Host))
});

async def token_provider(request):
    return GitHubTokenResult(token=await fetch_token(request.host))

session = await client.start_session(github_token_provider=token_provider)
 ... (truncated)

## 1.0.13-preview.1

### Feature: `ClientMode::Empty` now disables built-in skills by default

`ClientMode::Empty` now applies deny-by-default isolation to runtime-bundled skills in addition to other built-in capabilities. `includedBuiltinSkills` defaults to `[]` in Empty mode; pass an explicit allowlist to re-enable specific skills. This behavior is consistent across all six SDKs. ([#​2410](https://github.com/github/copilot-sdk/pull/2410))

```ts
// Node — empty mode: built-in skills excluded by default
const session = await client.createSession({ mode: ClientMode.Empty });
// opt back in:
const session = await client.createSession({ mode: ClientMode.Empty, includedBuiltinSkills: ["edit"] });

// C#
var session = await client.CreateSessionAsync(new SessionOptions { Mode = ClientMode.Empty });
// opt back in:
var session = await client.CreateSessionAsync(new SessionOptions { Mode = ClientMode.Empty, IncludedBuiltinSkills = ["edit"] });

# Python
session = await client.create_session(mode=ClientMode.EMPTY)
# opt back in:
session = await client.create_session(mode=ClientMode.EMPTY, included_builtin_skills=["edit"])

// Go
session, err := client.CreateSession(ctx, copilot.SessionOptions{Mode: copilot.ClientModeEmpty})
// opt back in:
session, err := client.CreateSession(ctx, copilot.SessionOptions{Mode: copilot.ClientModeEmpty, IncludedBuiltinSkills: []string{"edit"}})

Generated by Release Changelog Generator · sonnet46 28.6 AIC · ⌖ 4.12 AIC · ⊞ 8.1K

1.0.13-preview.0

Feature: rewind support across all SDKs

Sessions can now opt into file-change tracking and rewind conversation history along with tracked file changes. Enable the new enableFileChangeTracking session option to allow calling rewind later. (#​2321)

const session = await client.createSession({ enableFileChangeTracking: true });
// later:
await session.rpc.conversation.rewind({ ...rewindPoint });

var session = await client.CreateSessionAsync(new SessionOptions { EnableFileChangeTracking = true });

session = await client.create_session(enable_file_change_tracking=True)

session, err := client.CreateSession(ctx, copilot.SessionOptions{EnableFileChangeTracking: true})

Feature: Java in-process runtime (experimental)

The Java SDK now ships platform-native classifier JARs that load the Copilot runtime directly in-process via JNA — no separate CLI child process required. Currently available for linux-x64, Windows x64, and Apple Silicon macOS. (#​2301, #​2393, #​2402)

CopilotClientOptions options = new CopilotClientOptions()
    .setConnection(RuntimeConnection.forInProcess());
CopilotClient client = new CopilotClient(options);
client.start().get();

Feature: permission decision context forwarding

Permission handlers can now attach decisionContext so the runtime can attribute whether a decision came from a person, host policy, or an automated recommendation. This is additive for Node, Python, Go, .NET, and Java. Rust clients that construct or match PermissionResult::Decision directly must migrate to the new struct variant. (#​2294)

• TypeScript: createAttributedPermissionResult(result, context)
• Python: copilot.create_attributed_permission_result(result, context)
• Go: copilot.NewAttributedPermissionResult(result, context)
• C#: set DecisionContext on the permission decision
• Java: PermissionRequestResult.approveOnce().setDecisionContext(context)
• Rust: PermissionResult::approve_once().with_context(context)

Feature: built-in plugin directory support

Applications can now register a set of host-bundled plugin directories that are trusted unconditionally and loaded before any user session begins. (#​2330)

Feature: extensions can request sensitive environment variables (Node)

... (truncated)

1.0.12-preview.0

Feature: rewind support across all SDKs

Sessions now support rewinding conversation history and tracked file changes. Enable file-change tracking when creating a session, then rewind to a previous checkpoint to discard later turns and restore file state. (#​2321)

const session = await client.createSession({ enableFileChangeTracking: true });
const rewindPoints = await session.rpc.rewind.listRewindPoints();
await session.rpc.rewind.rewind({ rewindPointId: rewindPoints[0].rewindPointId });

session = await client.create_session(enable_file_change_tracking=True)
rewind_points = await session.rpc.rewind.list_rewind_points()
await session.rpc.rewind.rewind(rewind_point_id=rewind_points[0].rewind_point_id)

session, _ := client.CreateSession(ctx, &copilot.SessionOptions{EnableFileChangeTracking: true})
points, _ := session.RPC.Rewind.ListRewindPoints(ctx)
_ = session.RPC.Rewind.Rewind(ctx, &copilot.RewindRequest{RewindPointId: points[0].RewindPointId})

var session = await client.CreateSessionAsync(new SessionOptions { EnableFileChangeTracking = true });
var points = await session.Rpc.Rewind.ListRewindPointsAsync();
await session.Rpc.Rewind.RewindAsync(new RewindRequest { RewindPointId = points[0].RewindPointId });

SessionOptions options = new SessionOptions().setEnableFileChangeTracking(true);
var session = client.createSession(options).get();
var points = session.getRpc().getRewind().listRewindPoints().get();
session.getRpc().getRewind().rewind(new RewindRequest().setRewindPointId(points.get(0).getRewindPointId())).get();

let session = client.create_session(SessionOptions { enable_file_change_tracking: Some(true), ..Default::default() }).await?;
let points = session.rpc.rewind.list_rewind_points().await?;
session.rpc.rewind.rewind(RewindRequest { rewind_point_id: points[0].rewind_point_id.clone() }).await?;

Feature: Java in-process Copilot CLI (linux-x64)

The Java SDK now supports an in-process connection mode on linux-x64 that loads the Copilot runtime as a native library via JNA — no separate CLI child process required. Add the copilot-sdk-java-runtime classifier JAR for your platform alongside the core SDK JAR. (#​2301)

CopilotClientOptions options = new CopilotClientOptions()
    .setConnection(RuntimeConnection.forInProcess());
CopilotClient client = new CopilotClient(options);
client.start().get();
 ... (truncated)

Commits viewable in [compare view](https://github.com/github/copilot-sdk/compare/v1.0.11...v1.0.13).
</details>

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=GitHub.Copilot.SDK&package-manager=nuget&previous-version=1.0.11&new-version=1.0.13)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>