Bump GitHub.Copilot.SDK from 0.1.26 to 0.3.0#7
Open
dependabot[bot] wants to merge 1 commit intomainfrom
Open
Conversation
--- updated-dependencies: - dependency-name: GitHub.Copilot.SDK dependency-version: 0.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated GitHub.Copilot.SDK from 0.1.26 to 0.3.0.
Release notes
Sourced from GitHub.Copilot.SDK's releases.
0.3.0
This release adds new capabilities — per-session authentication, scoped permissions, agent-level tool and skill control, MCP interop utilities, and more — alongside a broad naming cleanup across all four SDK languages. As we close in on a GA release, we've done a deep clean on our naming to bring it closer to the final state, reducing the amount of churn you should expect in subsequent releases. The result is a more consistent, more readable API surface across the board.
New features
Per-session GitHub authentication
Sessions can now carry their own GitHub identity. Different sessions on the same CLI server can have different GitHub users, Copilot plans, and quota limits.
This is independent of the client-level
gitHubToken(which authenticates the CLI process itself, and is not required if all sessions bring their own auth). The session-level token determines the identity used for content exclusion, model routing, and quota checks.Per-agent tool visibility
A new
defaultAgent.excludedToolsoption lets you hide tools from the default agent while keeping them available to custom sub-agents, enabling the orchestrator pattern where the default agent delegates to specialized sub-agents. (#1098)Per-agent skills
Custom agents can now declare
skills: string[]to eagerly inject specific skills into their context at startup. Skills are opt-in — agents receive no skills by default, and sub-agents do not inherit skills from the parent. (#995)Sub-agent streaming content
When streaming is enabled,
assistant.message_deltaandassistant.reasoning_deltaevents are now also delivered for sub-agents. Each event carries anagentIdfield identifying which sub-agent produced it (absent for the root agent). If your application renders all streaming deltas to the UI, you'll want to filter byagentId(or for pure back-compat, setincludeSubAgentStreamingEvents: falseonSessionConfigto get the old behavior of only streaming main-agent content updates). (#1108)Session idle timeout
A new
sessionIdleTimeoutSecondsclient option configures automatic session cleanup after inactivity. When set, sessions without activity for the specified duration are cleaned up. Disabled by default (sessions live indefinitely). Previously, sessions would always time out after 30 minutes of idleness - this change fixes that. (#1093)Custom HTTP headers for BYOK model providers
Provider headers and per-message
requestHeaderscan now be passed throughcreateSession,resumeSession, andsend, enabling custom header forwarding to bring-your-own-key model providers. (#1094)MCP CallToolResult conversion
A new
convertMcpCallToolResult()utility function converts MCPCallToolResultobjects (withcontentarrays of text, image, and resource blocks) into the SDK'sToolResultObjectformat. This makes it easy to use MCP tool servers as backends for SDK tool handlers. (#1049)ProviderConfigexportedProviderConfigis now re-exported from the Node.js and Python SDK entry points, so consumers no longer need to duplicate the type locally when configuring Responses API providers. (#1048)New RPC methods
Additional low-level RPC methods are now available via
session.rpc:... (truncated)
0.3.0-preview.1
This release adds new capabilities — per-session authentication, scoped permissions, agent-level tool and skill control, MCP interop utilities, and more — alongside a broad naming cleanup across all four SDK languages. As we close in on a GA release, we've done a deep clean on our naming to bring it closer to the final state, reducing the amount of churn you should expect in subsequent releases. The result is a more consistent, more readable API surface across the board.
New features
Per-session GitHub authentication
Sessions can now carry their own GitHub identity. Different sessions on the same CLI server can have different GitHub users, Copilot plans, and quota limits.
This is independent of the client-level
gitHubToken(which authenticates the CLI process itself, and is not required if all sessions bring their own auth). The session-level token determines the identity used for content exclusion, model routing, and quota checks.Per-agent tool visibility
A new
defaultAgent.excludedToolsoption lets you hide tools from the default agent while keeping them available to custom sub-agents, enabling the orchestrator pattern where the default agent delegates to specialized sub-agents. (#1098)Per-agent skills
Custom agents can now declare
skills: string[]to eagerly inject specific skills into their context at startup. Skills are opt-in — agents receive no skills by default, and sub-agents do not inherit skills from the parent. (#995)Sub-agent streaming content
When streaming is enabled,
assistant.message_deltaandassistant.reasoning_deltaevents are now also delivered for sub-agents. Each event carries anagentIdfield identifying which sub-agent produced it (absent for the root agent). If your application renders all streaming deltas to the UI, you'll want to filter byagentId(or for pure back-compat, setincludeSubAgentStreamingEvents: falseonSessionConfigto get the old behavior of only streaming main-agent content updates). (#1108)Session idle timeout
A new
sessionIdleTimeoutSecondsclient option configures automatic session cleanup after inactivity. When set, sessions without activity for the specified duration are cleaned up. Disabled by default (sessions live indefinitely). Previously, sessions would always time out after 30 minutes of idleness - this change fixes that. (#1093)Custom HTTP headers for BYOK model providers
Provider headers and per-message
requestHeaderscan now be passed throughcreateSession,resumeSession, andsend, enabling custom header forwarding to bring-your-own-key model providers. (#1094)MCP CallToolResult conversion
A new
convertMcpCallToolResult()utility function converts MCPCallToolResultobjects (withcontentarrays of text, image, and resource blocks) into the SDK'sToolResultObjectformat. This makes it easy to use MCP tool servers as backends for SDK tool handlers. (#1049)ProviderConfigexportedProviderConfigis now re-exported from the Node.js and Python SDK entry points, so consumers no longer need to duplicate the type locally when configuring Responses API providers. (#1048)New RPC methods
Additional low-level RPC methods are now available via
session.rpc:... (truncated)
0.3.0-preview.0
What's Changed
... (truncated)
0.2.2
Feature: session filesystem support across all four SDKs
The
sessionFsfeature introduced earlier in Node.js is now available across .NET, Go, and Python too, so you can redirect session-scoped storage (events, checkpoints, temp files, workspace state) to your own backing store instead of the runtime's default local filesystem. This is especially useful for serverless and multi-tenant hosts. (#1036)For a full end-to-end sample of a multi-user hosted system using sessionFs, see https://github.com/github/copilot-sdk-server-sample
Feature: override model capabilities when creating a session or switching models
All SDKs can now override individual model capabilities such as vision support without replacing the full capabilities object. This makes BYOK and custom-provider scenarios easier, and lets you change behavior mid-session with
setModel/SetModelAsync. (#1029)... (truncated)
0.2.2-preview.0
Other changes
bugfix: [C#] [Go] tolerate unknown hook types to prevent session hang (#1013)
When the CLI invokes a hook type the SDK doesn't recognize (e.g.
postToolUseFailure), .NET and Go were returning a JSON-RPC error that caused the CLI to terminate the session — appearing as a hang. Unknown hook types are now silently ignored, matching the existing Node.js behavior.0.2.1
Feature: commands and UI elicitation across all four SDKs
Register slash commands that CLI users can invoke and drive interactive input dialogs from any SDK language. This feature was previously Node.js-only; it now ships in Python, Go, and .NET as well. (#906, #908, #960)
Feature:
session.getMetadataacross all SDKsEfficiently fetch metadata for a single session by ID without listing all sessions. Returns
undefined/null(not an error) when the session is not found. (#899)const meta = await client.getSessionMetadata(sessionId);var meta = await client.GetSessionMetadataAsync(sessionId);meta = await client.get_session_metadata(session_id)meta, err := client.GetSessionMetadata(ctx, sessionID)Feature:
sessionFsfor virtualizing per-session storage (Node SDK)... (truncated)
0.2.1-preview.2
Feature:
onElicitationRequestcallback for elicitation provider support[Node] SDK clients can now act as elicitation providers by registering an
onElicitationRequestcallback inSessionConfig. The SDK negotiates therequestElicitationcapability with the runtime, listens for broadcastelicitation.requestedevents, invokes the handler, and responds automatically. (#908)Feature:
getSessionMetadataAPI across all SDKsAll SDKs now expose an efficient O(1) lookup of a single session's metadata by ID — no need to call
listSessionsand filter client-side. (#899)await client.getSessionMetadata(sessionId)— returnsSessionMetadata | undefinedawait client.GetSessionMetadataAsync(sessionId)— returnsSessionMetadata?await client.get_session_metadata(session_id)— returnsSessionMetadata | Noneclient.GetSessionMetadata(ctx, sessionID)— returns(*SessionMetadata, error)Feature: async context manager support for Python client and session
[Python]
CopilotClientandCopilotSessionnow implement the async context manager protocol for automatic resource cleanup. (#475)Other changes
ToolResultObjectvalues were stringified before RPC, causingtoolTelemetryandresultTypeto be silently lost on the server side (#970)postToolUsehooks (#978)New contributors
@Sumanth007made their first contribution in #475@Morabbinmade their first contribution in #9700.2.1-preview.1
Change: ephemeral events no longer included in
getMessages()Following a runtime update to 1.0.12, events like
session.idleare now truly ephemeral — they are only observable via live event listeners and are not returned bysession.getMessages()/get_messages(). This makes session resume behave consistently whether the session was previously active in-process or is being resumed from disk. (#927)If your code calls
getMessages()and checks for asession.idleevent to determine whether a turn is complete, switch to using a live event listener instead:Other changes
COPILOT_CLI_PATHenv var is now read from the effective environment configured on the client (e.g. viaoptions.env), not just the process environment — consistent across all SDKs (#925)0.2.1-preview.0
Feature: commands and UI elicitation support for Node.js
The Node.js SDK now supports registering slash commands and prompting users with interactive dialogs. Pass
commandsin session config to handle CLI slash commands; usesession.uito show confirm, select, or text-input prompts. The feature was already available in other SDKs. (#906)Feature: custom model listing for BYOK mode
All four SDKs now accept an
onListModelscallback in client options. When provided,client.listModels()calls your handler instead of querying the CLI — useful for BYOK setups where you want to expose your provider's available models. (#730)on_list_models=lambda: [ModelInfo(id="gpt-4o", display_name="GPT-4o")]OnListModels: func(ctx context.Context) ([]copilot.ModelInfo, error) { ... }Feature: blob attachments for inline image data
A new
blobattachment type lets you send base64-encoded content directly to a session without writing it to disk first — useful when images are already in memory (screenshots, API responses, generated images). (#731)OpenTelemetry support across all SDKs
All four SDK languages now support distributed tracing with the Copilot CLI. Set
telemetryin your client options to configure an OTLP exporter; W3C trace context is automatically propagated onsession.create,session.resume, andsession.send, and restored in tool handlers so tool execution is linked to the originating trace. (#785)0.1.33-preview.3
Feature: OpenTelemetry support across all SDKs
All four SDK languages now support distributed tracing with the Copilot CLI. Set
telemetryin your client options to configure an OTLP exporter; W3C trace context is then propagated onsession.create,session.resume, andsession.send, and restored in tool handlers so tool execution is linked to the originating trace. (#785)Feature: blob attachment type for inline base64 data
A new
blobattachment type lets you send images or other binary content directly to a session without writing to disk first — useful when data is already in memory (screenshots, API responses, generated images). (#731)Feature: Node.js CommonJS (CJS) compatibility
The Node.js SDK now ships both ESM and CJS builds, fixing crashes in VS Code extensions and other tools bundled with esbuild's
format: "cjs". No changes needed in consumer code — Node automatically selects the right format. (#546)Feature:
reasoningEffortwhen switching modelsAll SDKs now accept an optional
reasoningEffortparameter insetModel()for models that support it. (#712)... (truncated)
0.1.33-preview.0
Feature: pre-select a custom agent at session creation
You can now specify which custom agent should be active when a session starts, without needing a separate
session.rpc.agent.select()call. (#722)Feature: custom model listing for BYOK
Applications using bring-your-own-key providers can now supply
onListModelsin client options to overrideclient.listModels()with their own model list, instead of forwarding the call to the CLI. (#730)on_list_models=lambda: my_provider_modelsOnListModels: func(ctx context.Context) ([]copilot.ModelInfo, error) { return myModels, nil }Feature: new events and APIs (system notifications, session log, extension support)
Updated to match the latest CLI runtime, adding:
system.notificationevents, a session log RPC API,reasoningEffortchanges after model switch,alreadyInUseflag on sessions, and the groundwork for extension-based integrations. (#737)Other changes
no-resultpermission outcome so extensions can attach to sessions without actively answering permission requests (#802)session.start) could be dropped; also addsOnEventcatch-all handler toSessionConfig(#664)... (truncated)
0.1.32
Feature: backward compatibility with v2 CLI servers
SDK applications written against the v3 API now also work when connected to a v2 CLI server, with no code changes required.
0.1.31
Feature: strongly-typed
PermissionRequestResultKindfor .NET and GoRather than comparing
result.Kindagainst undiscoverable magic strings like"approved"or"denied-interactively-by-user", .NET and Go now provide typed constants. Node and Python already had typed unions for this; this brings full parity. (#631)Other changes
get_last_session_id()/GetLastSessionID()for SDK-wide parity (was already available in Node and .NET) (#671)timeoutparameter to generated RPC methods, allowing callers to override the default 30s timeout for long-running operations (#681)PermissionRequestfields are now properly typed (ToolName,Diff,Path, etc.) instead of a genericExtra map[string]anycatch-all (#685)0.1.30
Feature: support overriding built-in tools
Applications can now override built-in tools such as
grep,edit_file, orread_file. To do this, register a custom tool with the same name and set the override flag. Without the flag, the runtime will return an error if the name clashes with a built-in. (#636)Feature: simpler API for changing model mid-session
While
session.rpc.model.switchTo()already worked, there is now a convenience method directly on the session object. (#621)await session.setModel("gpt-4.1")await session.SetModelAsync("gpt-4.1")await session.set_model("gpt-4.1")err := session.SetModel(ctx, "gpt-4.1")Other changes
OnDisposeCalland improve implementation (#626)SemaphoreSlimlocks for handler fields (#625)PermissionHandler.approve_alltype annotations (#618)New contributors
@giulio-leonemade their first contribution in #618... (truncated)
0.1.29
v0.1.29 (2026-02-27)
Changes
CopilotClient.stop()now raises anExceptionGroupinstead of silently returning a list of exceptions (#603)0.1.28
What's Changed
New Contributors
Full Changelog: github/copilot-sdk@v0.1.25...v0.1.28
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)