feat: add granular per-session flags for multitenancy hardening (#1474)

* feat: add granular per-session flags for multitenancy hardening

Add 7 new optional fields to SessionConfigBase across all 6 SDK languages
(Node.js, Go, Python, .NET, Rust, Java):

- skipEmbeddingRetrieval: prevent cross-session info leakage via embedding cache
- organizationCustomInstructions: inject org-level instructions into system prompt
- enableOnDemandInstructionDiscovery: control instruction file discovery after file views
- enableFileHooks: control loading of file-based hooks from .github/hooks/
- enableHostGitOperations: control git operations on host filesystem
- enableSessionStore: control cross-session store for search/retrieval
- enableSkills: control skill loading (builtin + discovered)

All fields are optional and pass through to the runtime without SDK-side
default coercion. Empty mode applies restrictive defaults for multitenancy.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* address PR review feedback

- Go: change OrganizationCustomInstructions to *string for cross-SDK consistency
- Go: clarify *bool field docs (nil = runtime default, non-nil = forwarded)
- Rust: redact organization_custom_instructions in Debug impls
- Node.js: clarify JSDoc defaults apply only in empty mode
- Python: replace unused imports with parametrized tests

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat: add embeddingCacheStorage per-session option across all SDKs

Adds embeddingCacheStorage field ("persistent" | "in-memory") to session
create and resume across all 6 SDKs. In empty mode, defaults to "in-memory"
for multitenant isolation. Companion to runtime PR #8388.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: apply formatting, convert EmbeddingCacheStorage to enum in .NET, improve tests

- Run formatters across all SDKs (prettier, gofmt, ruff, cargo fmt, spotless, dotnet format)
- Convert EmbeddingCacheStorage from string to EmbeddingCacheStorageMode enum in .NET
- Rename test methods to avoid temporal wording
- Expand EnableFileHooks doc comment in Go ResumeSessionConfig
- Add embeddingCacheStorage test coverage in Go, Java

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: remove runtime implementation details from property docs

Simplify doc comments across all SDKs to focus on user-facing behavior
rather than SDK-to-runtime interaction details. Removes boilerplate like
'When nil, the runtime default is used. When non-nil, the value is passed
through to the runtime.' in favor of concise, behavior-focused docs that
match the existing style of other properties.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* test: rename Java test methods to remove temporal 'new' wording

Rename to use 'granularMultitenancyFields' instead of 'newSessionFields'
for consistency with .NET and Node.js test naming.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: resolve Python SDK test failures

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: add missing Java empty-mode defaults for granular flags

The Cross-SDK Consistency Review identified that Java was only applying
embeddingCacheStorage and mcpOAuthTokenStorage in empty mode, but missing
the 6 boolean flags (skipEmbeddingRetrieval, enableOnDemandInstructionDiscovery,
enableFileHooks, enableHostGitOperations, enableSessionStore, enableSkills).

Also adds embeddingCacheStorage assertion to Node.js empty-mode test for
coverage parity with Go and .NET.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(rust): add embedding_cache_storage to Debug impls and builder API

Add the missing embedding_cache_storage field to:
- SessionConfig custom Debug impl
- ResumeSessionConfig custom Debug impl
- SessionConfig fluent builder (with_embedding_cache_storage)
- ResumeSessionConfig fluent builder (with_embedding_cache_storage)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: .NET empty-mode tests and Java enableConfigDiscovery docs

- Add BaseDirectory and AvailableTools to .NET empty-mode default tests
  so they don't throw at client construction time
- Fix enableConfigDiscovery Javadoc in ResumeSessionConfig: use
  Optional.empty() instead of null in @return, remove null from @param
  (setter takes primitive boolean)
- Fix stale 'runtime default' wording in SessionConfig.java getter

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MackinnonBuck

dotnet/src/Client.cs

@@ -637,6 +637,13 @@ private void ApplyConfigDefaultsForMode(SessionConfigBase config)
         if (_options.Mode == CopilotClientMode.Empty)
         {
             config.EnableSessionTelemetry ??= false;
+            config.SkipEmbeddingRetrieval ??= true;
+            config.EmbeddingCacheStorage ??= EmbeddingCacheStorageMode.InMemory;
+            config.EnableOnDemandInstructionDiscovery ??= false;
+            config.EnableFileHooks ??= false;
+            config.EnableHostGitOperations ??= false;
+            config.EnableSessionStore ??= false;
+            config.EnableSkills ??= false;
             config.McpOAuthTokenStorage ??= McpOAuthTokenStorageMode.InMemory;
         }
     }
@@ -876,6 +883,14 @@ public async Task<CopilotSession> CreateSessionAsync(SessionConfig config, Cance
                 config.Agent,
                 config.ConfigDirectory,
                 config.EnableConfigDiscovery,
+                config.SkipEmbeddingRetrieval,
+                config.EmbeddingCacheStorage,
+                config.OrganizationCustomInstructions,
+                config.EnableOnDemandInstructionDiscovery,
+                config.EnableFileHooks,
+                config.EnableHostGitOperations,
+                config.EnableSessionStore,
+                config.EnableSkills,
                 config.SkillDirectories,
                 config.DisabledSkills,
                 config.InfiniteSessions,
@@ -1053,6 +1068,14 @@ public async Task<CopilotSession> ResumeSessionAsync(string sessionId, ResumeSes
                 config.WorkingDirectory,
                 config.ConfigDirectory,
                 config.EnableConfigDiscovery,
+                config.SkipEmbeddingRetrieval,
+                config.EmbeddingCacheStorage,
+                config.OrganizationCustomInstructions,
+                config.EnableOnDemandInstructionDiscovery,
+                config.EnableFileHooks,
+                config.EnableHostGitOperations,
+                config.EnableSessionStore,
+                config.EnableSkills,
                 config.SuppressResumeEvent is true ? true : null,
                 config.Streaming is true ? true : null,
                 config.IncludeSubAgentStreamingEvents,
@@ -2179,6 +2202,14 @@ internal record CreateSessionRequest(
         string? Agent,
         [property: JsonPropertyName("configDir")] string? ConfigDirectory,
         bool? EnableConfigDiscovery,
+        bool? SkipEmbeddingRetrieval,
+        EmbeddingCacheStorageMode? EmbeddingCacheStorage,
+        string? OrganizationCustomInstructions,
+        bool? EnableOnDemandInstructionDiscovery,
+        bool? EnableFileHooks,
+        bool? EnableHostGitOperations,
+        bool? EnableSessionStore,
+        bool? EnableSkills,
         IList<string>? SkillDirectories,
         IList<string>? DisabledSkills,
         InfiniteSessionConfig? InfiniteSessions,
@@ -2247,6 +2278,14 @@ internal record ResumeSessionRequest(
         string? WorkingDirectory,
         [property: JsonPropertyName("configDir")] string? ConfigDirectory,
         bool? EnableConfigDiscovery,
+        bool? SkipEmbeddingRetrieval,
+        EmbeddingCacheStorageMode? EmbeddingCacheStorage,
+        string? OrganizationCustomInstructions,
+        bool? EnableOnDemandInstructionDiscovery,
+        bool? EnableFileHooks,
+        bool? EnableHostGitOperations,
+        bool? EnableSessionStore,
+        bool? EnableSkills,
         bool? SuppressResumeEvent,
         bool? Streaming,
         bool? IncludeSubAgentStreamingEvents,
@@ -2349,6 +2388,7 @@ internal record HooksInvokeResponse(
     [JsonSerializable(typeof(GetSessionMetadataRequest))]
     [JsonSerializable(typeof(GetSessionMetadataResponse))]
     [JsonSerializable(typeof(McpOAuthTokenStorageMode))]
+    [JsonSerializable(typeof(EmbeddingCacheStorageMode))]
     [JsonSerializable(typeof(ModelCapabilitiesOverride))]
     [JsonSerializable(typeof(ProviderConfig))]
     [JsonSerializable(typeof(ResumeSessionRequest))]

dotnet/src/Types.cs

@@ -2096,6 +2096,21 @@ public enum McpOAuthTokenStorageMode
     InMemory
 }
 
+/// <summary>
+/// Controls how the embedding cache is stored for a session.
+/// </summary>
+[JsonConverter(typeof(JsonStringEnumConverter<EmbeddingCacheStorageMode>))]
+public enum EmbeddingCacheStorageMode
+{
+    /// <summary>Embeddings are cached on disk, shared across sessions and restarts.</summary>
+    [JsonStringEnumMemberName("persistent")]
+    Persistent,
+
+    /// <summary>Embeddings are cached in memory only and discarded when the session ends.</summary>
+    [JsonStringEnumMemberName("in-memory")]
+    InMemory
+}
+
 /// <summary>
 /// Abstract base class for MCP server configurations.
 /// </summary>
@@ -2402,6 +2417,14 @@ protected SessionConfigBase(SessionConfigBase? other)
         Agent = other.Agent;
         DisabledSkills = other.DisabledSkills is not null ? [.. other.DisabledSkills] : null;
         EnableConfigDiscovery = other.EnableConfigDiscovery;
+        SkipEmbeddingRetrieval = other.SkipEmbeddingRetrieval;
+        EmbeddingCacheStorage = other.EmbeddingCacheStorage;
+        OrganizationCustomInstructions = other.OrganizationCustomInstructions;
+        EnableOnDemandInstructionDiscovery = other.EnableOnDemandInstructionDiscovery;
+        EnableFileHooks = other.EnableFileHooks;
+        EnableHostGitOperations = other.EnableHostGitOperations;
+        EnableSessionStore = other.EnableSessionStore;
+        EnableSkills = other.EnableSkills;
         EnableMcpApps = other.EnableMcpApps;
         ExcludedTools = other.ExcludedTools is not null ? [.. other.ExcludedTools] : null;
         Hooks = other.Hooks;
@@ -2492,6 +2515,63 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// </summary>
     public bool? EnableConfigDiscovery { get; set; }
 
+    /// <summary>
+    /// When <see langword="true"/>, skips embedding-based retrieval for this session.
+    /// Use in multitenant deployments to prevent cross-session information leakage
+    /// through the shared embedding cache.
+    /// </summary>
+    public bool? SkipEmbeddingRetrieval { get; set; }
+
+    /// <summary>
+    /// Controls how the embedding cache is stored for this session.
+    /// <see cref="EmbeddingCacheStorageMode.Persistent"/>: Embeddings are cached on disk and shared across sessions/restarts.
+    /// <see cref="EmbeddingCacheStorageMode.InMemory"/>: Embeddings are cached in memory only and discarded when the session ends.
+    /// </summary>
+    public EmbeddingCacheStorageMode? EmbeddingCacheStorage { get; set; }
+
+    /// <summary>
+    /// Organization-level custom instructions to include in the system prompt.
+    /// Allows hosts to inject organization-specific guidance without relying on
+    /// filesystem-based instruction discovery.
+    /// </summary>
+    public string? OrganizationCustomInstructions { get; set; }
+
+    /// <summary>
+    /// When <see langword="true"/>, enables on-demand discovery of instruction files
+    /// (for example <c>AGENTS.md</c> and <c>.github/copilot-instructions.md</c>)
+    /// after successful file views.
+    /// </summary>
+    public bool? EnableOnDemandInstructionDiscovery { get; set; }
+
+    /// <summary>
+    /// When <see langword="true"/>, enables loading of file-based hooks from
+    /// <c>.github/hooks/</c>. This is separate from <see cref="Hooks"/>, which
+    /// controls SDK hook callback registration.
+    /// </summary>
+    public bool? EnableFileHooks { get; set; }
+
+    /// <summary>
+    /// When <see langword="true"/>, enables git operations on the host filesystem
+    /// such as branch detection, file status, and commit history. When
+    /// <see langword="false"/>, no git context is surfaced in the system prompt.
+    /// </summary>
+    public bool? EnableHostGitOperations { get; set; }
+
+    /// <summary>
+    /// When <see langword="true"/>, enables the cross-session store for search and
+    /// retrieval across sessions. When <see langword="false"/>, session content is
+    /// not written to or read from the shared session store.
+    /// </summary>
+    public bool? EnableSessionStore { get; set; }
+
+    /// <summary>
+    /// When <see langword="true"/>, enables skill loading, including built-in
+    /// skills and discovered skill directories. When <see langword="false"/>, no
+    /// skills are loaded regardless of <see cref="SkillDirectories"/> or
+    /// <see cref="EnableConfigDiscovery"/>.
+    /// </summary>
+    public bool? EnableSkills { get; set; }
+
     /// <summary>
     /// Custom tool declarations available to the language model during the session.
     /// Declarations backed by an <see cref="AIFunction"/> are invoked automatically; declarations without one

dotnet/test/E2E/ClientOptionsE2ETests.cs

@@ -177,6 +177,82 @@ public async Task Should_Omit_EnableSessionTelemetry_When_Not_Set()
         await session.DisposeAsync();
     }
 
+    [Fact]
+    public async Task Should_Forward_Granular_Multitenancy_Fields_In_Create_Wire_Request()
+    {
+        var (cliPath, capturePath) = await CreateFakeCliCaptureAsync();
+
+        await using var client = Ctx.CreateClient(options: new CopilotClientOptions
+        {
+            Connection = RuntimeConnection.ForStdio(path: cliPath, args: ["--capture-file", capturePath]),
+            UseLoggedInUser = false,
+        });
+
+        await client.StartAsync();
+
+        var session = await client.CreateSessionAsync(new SessionConfig
+        {
+            SkipEmbeddingRetrieval = false,
+            OrganizationCustomInstructions = "Follow org policy.",
+            EnableOnDemandInstructionDiscovery = true,
+            EmbeddingCacheStorage = EmbeddingCacheStorageMode.Persistent,
+            EnableFileHooks = true,
+            EnableHostGitOperations = false,
+            EnableSessionStore = true,
+            EnableSkills = false,
+            OnPermissionRequest = PermissionHandler.ApproveAll,
+        });
+
+        using var capture = JsonDocument.Parse(await File.ReadAllTextAsync(capturePath));
+        var createRequest = GetCapturedRequestParams(capture.RootElement, "session.create");
+        Assert.False(createRequest.GetProperty("skipEmbeddingRetrieval").GetBoolean());
+        Assert.Equal("Follow org policy.", createRequest.GetProperty("organizationCustomInstructions").GetString());
+        Assert.True(createRequest.GetProperty("enableOnDemandInstructionDiscovery").GetBoolean());
+        Assert.Equal("persistent", createRequest.GetProperty("embeddingCacheStorage").GetString());
+        Assert.True(createRequest.GetProperty("enableFileHooks").GetBoolean());
+        Assert.False(createRequest.GetProperty("enableHostGitOperations").GetBoolean());
+        Assert.True(createRequest.GetProperty("enableSessionStore").GetBoolean());
+        Assert.False(createRequest.GetProperty("enableSkills").GetBoolean());
+
+        await session.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task Should_Apply_Empty_Mode_Defaults_To_CreateSession_Wire_Request()
+    {
+        var (cliPath, capturePath) = await CreateFakeCliCaptureAsync();
+
+        await using var client = Ctx.CreateClient(options: new CopilotClientOptions
+        {
+            Connection = RuntimeConnection.ForStdio(path: cliPath, args: ["--capture-file", capturePath]),
+            Mode = CopilotClientMode.Empty,
+            BaseDirectory = Ctx.WorkDir,
+            UseLoggedInUser = false,
+        });
+
+        await client.StartAsync();
+
+        var session = await client.CreateSessionAsync(new SessionConfig
+        {
+            OnPermissionRequest = PermissionHandler.ApproveAll,
+            AvailableTools = new ToolSet().AddBuiltIn(BuiltInTools.Isolated),
+        });
+
+        using var capture = JsonDocument.Parse(await File.ReadAllTextAsync(capturePath));
+        var createRequest = GetCapturedRequestParams(capture.RootElement, "session.create");
+        Assert.False(createRequest.GetProperty("enableSessionTelemetry").GetBoolean());
+        Assert.True(createRequest.GetProperty("skipEmbeddingRetrieval").GetBoolean());
+        Assert.False(createRequest.GetProperty("enableOnDemandInstructionDiscovery").GetBoolean());
+        Assert.Equal("in-memory", createRequest.GetProperty("embeddingCacheStorage").GetString());
+        Assert.False(createRequest.GetProperty("enableFileHooks").GetBoolean());
+        Assert.False(createRequest.GetProperty("enableHostGitOperations").GetBoolean());
+        Assert.False(createRequest.GetProperty("enableSessionStore").GetBoolean());
+        Assert.False(createRequest.GetProperty("enableSkills").GetBoolean());
+        Assert.False(createRequest.TryGetProperty("organizationCustomInstructions", out _));
+
+        await session.DisposeAsync();
+    }
+
     [Fact]
     public async Task Should_Propagate_Activity_TraceContext_To_Session_Create_And_Send()
     {
@@ -293,6 +369,82 @@ public async Task Should_Propagate_Activity_TraceContext_To_Session_Resume()
         await session.DisposeAsync();
     }
 
+    [Fact]
+    public async Task Should_Forward_Granular_Multitenancy_Fields_In_Resume_Wire_Request()
+    {
+        var (cliPath, capturePath) = await CreateFakeCliCaptureAsync();
+
+        await using var client = Ctx.CreateClient(options: new CopilotClientOptions
+        {
+            Connection = RuntimeConnection.ForStdio(path: cliPath, args: ["--capture-file", capturePath]),
+            UseLoggedInUser = false,
+        });
+
+        await client.StartAsync();
+
+        var session = await client.ResumeSessionAsync("resume-session", new ResumeSessionConfig
+        {
+            SkipEmbeddingRetrieval = false,
+            OrganizationCustomInstructions = "Resume org policy.",
+            EnableOnDemandInstructionDiscovery = true,
+            EmbeddingCacheStorage = EmbeddingCacheStorageMode.Persistent,
+            EnableFileHooks = true,
+            EnableHostGitOperations = false,
+            EnableSessionStore = true,
+            EnableSkills = false,
+            OnPermissionRequest = PermissionHandler.ApproveAll,
+        });
+
+        using var capture = JsonDocument.Parse(await File.ReadAllTextAsync(capturePath));
+        var resumeRequest = GetCapturedRequestParams(capture.RootElement, "session.resume");
+        Assert.False(resumeRequest.GetProperty("skipEmbeddingRetrieval").GetBoolean());
+        Assert.Equal("Resume org policy.", resumeRequest.GetProperty("organizationCustomInstructions").GetString());
+        Assert.True(resumeRequest.GetProperty("enableOnDemandInstructionDiscovery").GetBoolean());
+        Assert.Equal("persistent", resumeRequest.GetProperty("embeddingCacheStorage").GetString());
+        Assert.True(resumeRequest.GetProperty("enableFileHooks").GetBoolean());
+        Assert.False(resumeRequest.GetProperty("enableHostGitOperations").GetBoolean());
+        Assert.True(resumeRequest.GetProperty("enableSessionStore").GetBoolean());
+        Assert.False(resumeRequest.GetProperty("enableSkills").GetBoolean());
+
+        await session.DisposeAsync();
+    }
+
+    [Fact]
+    public async Task Should_Apply_Empty_Mode_Defaults_To_ResumeSession_Wire_Request()
+    {
+        var (cliPath, capturePath) = await CreateFakeCliCaptureAsync();
+
+        await using var client = Ctx.CreateClient(options: new CopilotClientOptions
+        {
+            Connection = RuntimeConnection.ForStdio(path: cliPath, args: ["--capture-file", capturePath]),
+            Mode = CopilotClientMode.Empty,
+            BaseDirectory = Ctx.WorkDir,
+            UseLoggedInUser = false,
+        });
+
+        await client.StartAsync();
+
+        var session = await client.ResumeSessionAsync("resume-empty-session", new ResumeSessionConfig
+        {
+            OnPermissionRequest = PermissionHandler.ApproveAll,
+            AvailableTools = new ToolSet().AddBuiltIn(BuiltInTools.Isolated),
+        });
+
+        using var capture = JsonDocument.Parse(await File.ReadAllTextAsync(capturePath));
+        var resumeRequest = GetCapturedRequestParams(capture.RootElement, "session.resume");
+        Assert.False(resumeRequest.GetProperty("enableSessionTelemetry").GetBoolean());
+        Assert.True(resumeRequest.GetProperty("skipEmbeddingRetrieval").GetBoolean());
+        Assert.False(resumeRequest.GetProperty("enableOnDemandInstructionDiscovery").GetBoolean());
+        Assert.Equal("in-memory", resumeRequest.GetProperty("embeddingCacheStorage").GetString());
+        Assert.False(resumeRequest.GetProperty("enableFileHooks").GetBoolean());
+        Assert.False(resumeRequest.GetProperty("enableHostGitOperations").GetBoolean());
+        Assert.False(resumeRequest.GetProperty("enableSessionStore").GetBoolean());
+        Assert.False(resumeRequest.GetProperty("enableSkills").GetBoolean());
+        Assert.False(resumeRequest.TryGetProperty("organizationCustomInstructions", out _));
+
+        await session.DisposeAsync();
+    }
+
     [Fact]
     public void Should_Accept_GitHubToken_Option()
     {

go/client.go

@@ -609,6 +609,14 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 	if config.EnableConfigDiscovery {
 		req.EnableConfigDiscovery = Bool(true)
 	}
+	req.SkipEmbeddingRetrieval = config.SkipEmbeddingRetrieval
+	req.EmbeddingCacheStorage = config.EmbeddingCacheStorage
+	req.OrganizationCustomInstructions = config.OrganizationCustomInstructions
+	req.EnableOnDemandInstructionDiscovery = config.EnableOnDemandInstructionDiscovery
+	req.EnableFileHooks = config.EnableFileHooks
+	req.EnableHostGitOperations = config.EnableHostGitOperations
+	req.EnableSessionStore = config.EnableSessionStore
+	req.EnableSkills = config.EnableSkills
 	req.Tools = config.Tools
 	systemMessage := c.systemMessageForMode(config.SystemMessage)
 	wireSystemMessage, transformCallbacks := extractTransformCallbacks(systemMessage)
@@ -952,6 +960,14 @@ func (c *Client) ResumeSessionWithOptions(ctx context.Context, sessionID string,
 	if config.EnableConfigDiscovery {
 		req.EnableConfigDiscovery = Bool(true)
 	}
+	req.SkipEmbeddingRetrieval = config.SkipEmbeddingRetrieval
+	req.EmbeddingCacheStorage = config.EmbeddingCacheStorage
+	req.OrganizationCustomInstructions = config.OrganizationCustomInstructions
+	req.EnableOnDemandInstructionDiscovery = config.EnableOnDemandInstructionDiscovery
+	req.EnableFileHooks = config.EnableFileHooks
+	req.EnableHostGitOperations = config.EnableHostGitOperations
+	req.EnableSessionStore = config.EnableSessionStore
+	req.EnableSkills = config.EnableSkills
 	if config.SuppressResumeEvent {
 		req.DisableResume = Bool(true)
 	}