Merge branch 'main' into agents/managed-settings-forward-flag

Author: joshspicer

.github/badges/jacoco-generated.svg

@@ -31,9 +31,7 @@ on:
   merge_group:
 
 permissions:
-  contents: write
-  checks: write
-  pull-requests: write
+  contents: read
 
 jobs:
   java-sdk:
@@ -117,22 +115,6 @@ jobs:
             java/target/surefire-reports-isolated/
           retention-days: 1
 
-      - name: Generate JaCoCo badge
-        if: success() && github.ref == 'refs/heads/main' && matrix.test-jdk == '25'
-        working-directory: .
-        run: bash .github/scripts/generate-java-coverage-badge.sh java/target/site/jacoco-coverage/jacoco.csv .github/badges
-
-      - name: Create PR for JaCoCo badge update
-        if: success() && github.ref == 'refs/heads/main' && matrix.test-jdk == '25'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
-        with:
-          commit-message: "Update Java JaCoCo coverage badge"
-          title: "Update Java JaCoCo coverage badge"
-          body: "Automated Java JaCoCo coverage badge update from CI."
-          branch: auto/update-java-jacoco-badge
-          add-paths: .github/badges/
-          delete-branch: true
-
       - name: Generate Test Report Summary
         if: always()
         uses: ./.github/actions/java-test-report

.github/badges/jacoco-handwritten.svg

@@ -5,6 +5,82 @@ All notable changes to the Copilot SDK are documented in this file.
 This changelog is automatically generated by an AI agent when stable releases are published.
 See [GitHub Releases](https://github.com/github/copilot-sdk/releases) for the full list.
 
+## [java/v1.0.5-01](https://github.com/github/copilot-sdk/releases/tag/java/v1.0.5-01) (2026-07-01)
+
+### Feature: new session options — citations, agent exclusions, and credit limits
+
+Three new options are available on `SessionConfig` and `ResumeSessionConfig`. `enableCitations` (experimental) enables native model citations for supported providers; `excludedBuiltInAgents` hides named built-in agents from discovery; and `sessionLimits` sets a per-session AI-credit budget. ([#1865](https://github.com/github/copilot-sdk/pull/1865))
+
+```java
+SessionConfig config = new SessionConfig()
+    .setEnableCitations(true)
+    .setExcludedBuiltInAgents(List.of("copilot"))
+    .setSessionLimits(new SessionLimitsConfig(100.0));
+```
+
+### New contributors
+
+- @coleflennikenmsft made their first contribution in [#1854](https://github.com/github/copilot-sdk/pull/1854)
+- @szabta89 made their first contribution in [#1856](https://github.com/github/copilot-sdk/pull/1856)
+
+## [v1.0.5](https://github.com/github/copilot-sdk/releases/tag/v1.0.5) (2026-07-01)
+
+### Feature: MCP OAuth host token handlers
+
+SDK applications can now handle OAuth challenges from MCP servers that require host-provided authentication. Register an `onMcpAuthRequest` callback on the session config and the SDK will invoke it whenever an MCP server responds with a `401 WWW-Authenticate` challenge; return an access token (or cancel the request). Supports initial auth, refresh, reauth, and upscope flows across all SDKs. ([#1669](https://github.com/github/copilot-sdk/pull/1669))
+
+```ts
+const session = await client.createSession({
+    onMcpAuthRequest: async (request) => ({
+        accessToken: await myIdentityProvider.getToken(request.serverUrl),
+    }),
+});
+```
+
+```cs
+var session = await client.CreateSessionAsync(new SessionConfig
+{
+    OnMcpAuthRequest = async ctx =>
+        McpAuthResult.FromToken(new McpAuthToken
+        {
+            AccessToken = await myIdentityProvider.GetTokenAsync(ctx.ServerUrl)
+        }),
+});
+```
+
+### Feature: session options for citations, excluded agents, and spending limits
+
+Three additional session configuration options are now available across all SDKs. ([#1865](https://github.com/github/copilot-sdk/pull/1865))
+
+```ts
+const session = await client.createSession({
+    enableCitations: true,
+    excludedBuiltinAgents: ["github-search"],
+    sessionLimits: { maxAiCredits: 10 },
+});
+```
+
+```cs
+var session = await client.CreateSessionAsync(new SessionConfig
+{
+    EnableCitations = true,
+    ExcludedBuiltInAgents = ["github-search"],
+    SessionLimits = new SessionLimitsConfig { MaxAiCredits = 10 },
+});
+```
+
+### Other changes
+
+- improvement: **[All SDKs]** rename BYOK callback field `getBearerToken` → `bearerTokenProvider`; add `sessionId` to `ProviderTokenArgs` for per-session token scoping ([#1796](https://github.com/github/copilot-sdk/pull/1796))
+- bugfix: **[Node]** fix MCP OAuth `registerInterest` sent before `session.resume`, causing "Session not found" errors when resuming a session with `onMcpAuthRequest` ([#1861](https://github.com/github/copilot-sdk/pull/1861))
+- feature: **[Java]** `@CopilotTool` and `@CopilotToolParam` annotations with compile-time annotation processor for ergonomic tool registration via `ToolDefinition.fromObject()` ([#1792](https://github.com/github/copilot-sdk/pull/1792), [#1838](https://github.com/github/copilot-sdk/pull/1838))
+- feature: **[Java]** `ToolInvocation` parameter injection in `@CopilotTool` methods for accessing session context without exposing it to the LLM schema ([#1832](https://github.com/github/copilot-sdk/pull/1832))
+- feature: **[Rust]** add 9 GitHub-anchored variants to `Attachment` enum (`GitHubCommit`, `GitHubRelease`, `GitHubActionsJob`, `GitHubRepository`, `GitHubFileDiff`, `GitHubTreeComparison`, `GitHubUrl`, `GitHubFile`, `GitHubSnippet`) ([#1823](https://github.com/github/copilot-sdk/pull/1823))
+
+### New contributors
+
+- @pallaviraiturkar0 made their first contribution in [#1823](https://github.com/github/copilot-sdk/pull/1823)
+- @roji made their first contribution in [#1827](https://github.com/github/copilot-sdk/pull/1827)
 ## [java/v1.0.4](https://github.com/github/copilot-sdk/releases/tag/java/v1.0.4) (2026-06-25)
 
 ### Feature: HTTP request callback support

.github/scripts/generate-java-coverage-badge.sh

@@ -65,7 +65,7 @@ Yes, a GitHub Copilot subscription is required to use the GitHub Copilot SDK, **
 
 ### How does billing work for SDK usage?
 
-Billing for the GitHub Copilot SDK is based on the same model as the Copilot CLI, with each prompt being counted towards your premium request quota. For more information on premium requests, see [Requests in GitHub Copilot](https://docs.github.com/en/copilot/concepts/billing/copilot-requests).
+Billing for the GitHub Copilot SDK is based on the same model as the Copilot CLI, with each prompt being counted towards your usage allowance. For more information on Copilot usage billing, see [Usage in GitHub Copilot](https://docs.github.com/en/copilot/reference/copilot-billing/models-and-pricing).
 
 ### Does it support BYOK (Bring Your Own Key)?
 

.github/workflows/java-sdk-tests.yml

@@ -46,6 +46,7 @@ Guides for building with the SDK's capabilities.
 * [MCP Servers](./features/mcp.md): integrate Model Context Protocol servers
 * [Skills](./features/skills.md): load reusable prompt modules
 * [Plugin Directories](./features/plugin-directories.md): bundle skills, hooks, MCP servers, and agents as a single loadable plugin
+* [Session limits](./features/session-limits.md): set an AI Credits budget for a session
 * [Image Input](./features/image-input.md): send images as attachments
 * [Streaming Events](./features/streaming-events.md): real-time event reference
 * [Steering & Queueing](./features/steering-and-queueing.md): message delivery modes

CHANGELOG.md

@@ -15,6 +15,7 @@ These guides cover the capabilities you can add to your Copilot SDK application.
 | [MCP Servers](./mcp.md) | Integrate Model Context Protocol servers for external tool access |
 | [Skills](./skills.md) | Load reusable prompt modules from directories |
 | [Plugin Directories](./plugin-directories.md) | Bundle skills, hooks, MCP servers, and agents as a single loadable plugin |
+| [Session limits](./session-limits.md) | Set an AI Credits budget for a session and observe budget events |
 | [Image Input](./image-input.md) | Send images to sessions as attachments |
 | [Streaming Events](./streaming-events.md) | Subscribe to real-time session events (40+ event types) |
 | [Steering & Queueing](./steering-and-queueing.md) | Control message delivery—immediate steering vs. sequential queueing |