Adds the Copilot Rust SDK (`copilot-sdk` crate) under `rust/`,
alongside Rust codegen plumbed into `scripts/codegen/` and CI under
`.github/workflows/rust-sdk-tests.yml`. The crate ships a JSON-RPC
client, session lifecycle management, system message transforms,
permission policy helpers, the `define_tool` adapter, and per-event
`SessionHandler`/`SessionHooks` traits.

Includes:

- 14 ported E2E scenarios under `rust/tests/` driving the replay-proxy
  harness, plus a hand-curated set of unit tests.
- A rust-coding-skill (`.github/skills/rust-coding-skill/`) capturing
  conventions for error handling, async/concurrency, tracing, and the
  intentional trait exceptions in the SDK's public API.
- Release tooling: `rust-publish-release.yml`, `RELEASING.md`, and
  protocol-version generation wired into the existing automation.
- `PermissionResult` extended with `Deferred` and `Custom` variants
  for richer permission decisions.

Public API is held at 0.1.0-pre. Marked protocol-evolving public enums
`#[non_exhaustive]` so additive variants stay non-breaking.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Christopher Schleiden <cschleiden@github.com>
Co-authored-by: David Dossett <25163139+daviddossett@users.noreply.github.com>
Co-authored-by: Devraj Mehta <devm33@github.com>
Co-authored-by: Dmytro Struk <13853051+dmytrostruk@users.noreply.github.com>
Co-authored-by: Evan Boyle <EvanBoyle@users.noreply.github.com>
Co-authored-by: Jeremy Moseley <jemoseley@microsoft.com>
Co-authored-by: Steve Sanderson <SteveSandersonMS@users.noreply.github.com>

cargo doc was running with --features test-support, which left the
derive feature off and made intra-doc links to define_tool and
schema_for resolve to nothing — failing under the crate's
deny(rustdoc::broken_intra_doc_links).

docs.rs already uses all-features (see Cargo.toml's
[package.metadata.docs.rs]); align CI with that so the docs job
matches what users will see on docs.rs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The 23-line setup checklist duplicated content already in
rust/RELEASING.md. One-line pointer is enough.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Cross-SDK consistency: every other SDK (Node, Python, Go, .NET) uses
`send`/`Send`/`SendAsync` plus `MessageOptions` as the public
parameter type. Rust was the outlier with `send_message` and
`SendOptions`, and the asymmetry with the existing `send_and_wait`
method made it read awkwardly.

- Rename `Session::send_message` -> `Session::send` (and the private
  helper `send_message_inner` -> `send_inner`).
- Rename the public `SendOptions` type -> `MessageOptions`.
- Delete the previous wire-level `MessageOptions` struct: it had no
  internal callers (the wire payload is hand-rolled in send_inner) and
  freeing the name was the cleanest path to parity.

Pre-1.0 type rename, no protocol or behavior change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Previously Session::subscribe and Client::subscribe_lifecycle returned
raw tokio::sync::broadcast::Receiver<T> values. A survey of mature Rust
crates (tonic, lapin, rdkafka, redis-rs, tokio-tungstenite, iroh-gossip,
tokio-stream's BroadcastStream itself) found that none of them expose a
raw broadcast::Receiver in their public API; the dominant pattern is a
named newtype implementing futures::Stream, with overflow surfaced
explicitly in the item type.

Introduce a copilot::subscription module with:

  - EventSubscription / LifecycleSubscription newtypes
  - Inherent recv() returning Result<T, RecvError> for existing
    while-let loop ergonomics
  - Stream impl yielding Result<T, Lagged> so callers can use
    tokio_stream::StreamExt or futures::StreamExt combinators
  - Lagged / RecvError types owned by the SDK so consumers no longer
    import tokio's broadcast error types

Net effect: the channel choice is now an internal implementation detail.
We can swap broadcast for async-broadcast / flume / a custom backpressure
policy, or convert lag into an Event::Lagged variant, without a breaking
change to the public surface.

Existing while-let loops in tests and examples continue to compile and
behave identically: close and lag both exit the loop, matching
tokio::sync::broadcast::Receiver.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Local cargo +nightly fmt --check passed without `--config-path
.rustfmt.nightly.toml`, but CI runs with the explicit config and
flagged two diffs: import group flattening and test-mod import order.
Applied with the same flags CI uses.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…n pattern

Two changes prompted by review:

1. SKILL.md was too prose-heavy for an agent to scan. The "Idioms that
   don't port from other languages" section had grown to ~110 lines of
   essay-shaped advice with key rules buried in narrative. Replaced
   with three tight rule sections (Concurrency primitives, Optional
   fields and serde, plus a one-paragraph cross-language porting note
   that points back to the rule sections). Net: 345 -> 255 lines, no
   rule lost.

2. The trait-vs-callback-fields rule was implicit in the SessionHandler
   description but not explicit. Codified in "Traits and conversions"
   as a primary directive: prefer one trait with one default-impl
   method per event over per-event Box<dyn Fn> fields. Cited the three
   precedent traits in async Rust:

   - tower_lsp::LanguageServer (63 methods, default impls; LSP wire
     protocol)
   - rmcp::ServerHandler (26 methods, all default; MCP wire protocol)
   - notify::EventHandler (single on_event(enum) for uniform-shape
     events)

   Confirmed via research that no major async Rust crate ships
   per-event Box<dyn Fn> callback fields as its primary API; the
   pattern fights Send + Sync + 'static, fragments consumer state
   across closures, and skips exhaustiveness. The SDK's SessionHandler
   already uses the recommended shape (per-method with defaults plus a
   default on_event dispatcher); the doc just hadn't named the pattern.

Section ordering tightened: Traits/conversions now leads into
Extension points, then Concurrency primitives (channels matrix +
cancellation), then Optional fields/serde. Reads top-to-bottom for
an agent picking up a fresh task.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Cross-SDK parity gap caught by the SDK consistency reviewer. All
four other SDKs (Node, Python, Go, .NET) expose this field; Rust
omitted it.

The field opts the runtime into continuing any tool calls or
permission requests that were pending when the previous connection
was dropped — it's the key enabler of the pending-work-handoff
pattern used together with `Client::force_stop` to migrate a session
from one process to another without losing in-flight work.

Plumbing:

- `pub continue_pending_work: Option<bool>` on `ResumeSessionConfig`
  with `#[serde(skip_serializing_if = "Option::is_none")]`. Container
  `rename_all = "camelCase"` covers the wire-name `continuePendingWork`.
  No manual payload-construction code is needed; resume_session
  serializes config -> wire via `serde_json::to_value(&config)`.
- `with_continue_pending_work(bool)` builder.
- Default impl: `None`.
- Debug impl: includes the field.

Tests:

- `resume_session_config_builder_composes` extended to cover the
  new field.
- `resume_session_config_serializes_continue_pending_work_to_camel_case`
  asserts the wire shape (`continuePendingWork: true`) and that
  unset values are omitted (skip_serializing_if).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…e-prep

Closes three cross-SDK parity gaps surfaced by the post-merge audit
against upstream commits 662f270, d3abfa2, and 180ca47.

ClientOptions::copilot_home: Option<PathBuf>
- Override the CLI's data directory. Exported as COPILOT_HOME to the
  spawned CLI process. Mirrors Node's copilotHome / Python's
  copilot_home.

ClientOptions::tcp_connection_token: Option<String>
- Optional auth token for TCP transport. Sent in the new `connect`
  JSON-RPC handshake (with backward-compat fall-back to `ping` for
  legacy CLI servers) and exported as COPILOT_CONNECTION_TOKEN to
  spawned CLI processes. When the SDK spawns its own CLI in TCP mode
  and this is unset, a UUID is generated so the loopback listener is
  safe by default. Combining with Transport::Stdio returns
  Error::InvalidConfig from Client::start. Mirrors Node's
  tcpConnectionToken / Python's tcp_connection_token / .NET's
  TcpConnectionToken.
- New `connect` handshake: verify_protocol_version now calls `connect`
  first, falling back to `ping` on -32601 MethodNotFound. The handshake
  carries the effective connection token. Matches Node's
  internalRpc.connect({ token }) sequence in client.ts.
- Adds `uuid` build-dep (1.x with v4 feature) for the auto-generated
  loopback token. Cryptographically-secure source via getrandom (already
  in the transitive dep tree).

SessionConfig::instruction_directories + ResumeSessionConfig::
instruction_directories: Option<Vec<PathBuf>>
- Additional directories the CLI searches for custom instruction files,
  distinct from skill_directories. Pure passthrough on the wire.
  Mirrors Node/Python instructionDirectories.

Error::InvalidConfig(String)
- New #[non_exhaustive] variant for client-construction errors that
  surface from Client::start (token + stdio, empty token, etc).

ClientInner gains effective_connection_token: Option<String> populated
in start(); from_transport now takes the token through (8 args ->
suppressed clippy::too_many_arguments on the internal helper).

Tests:
- protocol_version_test: existing tests updated for the new
  connect-then-ping fallback flow (server responds MethodNotFound on
  connect to exercise the legacy compat path).
- protocol_version_test::connect_handshake_supplies_protocol_version:
  new positive-path test — server responds to connect with a
  protocolVersion.
- lib::tests::build_command_sets_copilot_home_env_when_configured
- lib::tests::build_command_sets_connection_token_env_when_configured
- lib::tests::start_rejects_token_with_stdio_transport
- lib::tests::start_rejects_empty_connection_token

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…rage

Two related changes:

1. Drop the `uuid = "1"` dep added in 02780f0; replace with a
   `generate_connection_token()` helper that pulls 16 bytes from
   `getrandom::getrandom` and hex-encodes them. Same 128 bits of CSPRNG
   entropy, no semantic mismatch (the connection token is an opaque
   secret, not an identifier — typing it as a UUID would conflict with
   the existing pre-1.0 review consensus that schema-shaped IDs stay
   `String`). Output is a 32-char lowercase hex string, distinguishable
   from UUIDs at a glance.

   Rustdoc on the helper documents the decision so a future reader
   doesn't re-litigate it.

2. Address four reviewer items flagged on the github-app sync PR
   (#4399), all of which routed back upstream because src/ and tests/
   are mirrored from copilot-sdk:

   a. `session_config_serializes_instruction_directories_to_camel_case`
      — wire-shape test that `with_instruction_directories(...)`
      populates the field and serializes to `instructionDirectories`.

   b. `resume_session_config_serializes_instruction_directories_to_camel_case`
      — same on the resume path.

   c. `connect_handshake_forwards_explicit_token` and
      `connect_handshake_forwards_auto_generated_token` —
      positive coverage that `tcp_connection_token` actually reaches
      the outbound `connect` request's `token` param. Auto-generated
      case also asserts the shape (32-char lowercase hex) so a
      regression in the helper can't silently weaken loopback
      authentication.

   d. Rewrote the rustdoc on `Client::verify_protocol_version`. It
      claimed "sends a `ping` RPC", but the implementation now tries
      `connect` first and falls back to `ping` only on -32601. New
      docs describe the full handshake sequence and the token-
      forwarding semantics.

Test-support surface: adds two test-only entry points on `Client`
(`from_streams_with_connection_token`, `generate_connection_token_for_test`)
gated behind `cfg(any(test, feature = "test-support"))`, mirroring the
existing `from_streams_with_trace_provider` shape.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Pre-1.0 audit caught that `Client::send_telemetry` and
`Session::send_telemetry` were Rust-only public surface for an RPC
method (`sendTelemetry` / `session.sendTelemetry`) that:

- Is not described in `api.schema.json`.
- Is not exposed by the Node, Python, Go, or .NET SDKs (zero
  matches in their source trees).
- Has been moving around on the CLI side (the impl had a
  METHOD_NOT_FOUND fallback between top-level `sendTelemetry` and
  namespaced `server.sendTelemetry` to compensate).

A schema-undocumented + cross-SDK-absent public method is the
shape of an internal CLI knob, not a stable consumer API.
Consumers' canonical telemetry surface is the spawn-time env
injection via `ClientOptions::telemetry` (`TelemetryConfig`).
That stays.

Changes:
- Removed `Client::send_telemetry`, the cached
  `ServerTelemetryRpcMethod` enum, and the
  `ClientInner::server_telemetry_method` field that backed its
  fallback caching.
- Removed `Session::send_telemetry`.
- Removed `ServerTelemetryEvent` and `SessionTelemetryEvent`
  types from `types.rs`.
- Updated three integration tests in `tests/session_test.rs`
  (`send_telemetry_injects_payload_and_session_id`,
  `server_send_telemetry_sends_correct_payload`,
  `server_send_telemetry_falls_back_to_namespaced_method_and_caches_it`)
  by removing them, plus a fourth case in the dispatch-table
  test.
- Dropped now-unused local `METHOD_NOT_FOUND` const from
  the test file.
- Removed the "Rust-only API" README bullet describing the
  shortcut.
- Updated CHANGELOG to drop the type and method enumerations.

Net surface for telemetry: `ClientOptions::telemetry` +
`with_telemetry()` builder, plus the env-var injection in
`Client::build_command`. That's the documented, schema-described,
cross-SDK-consistent way to forward telemetry config to the CLI;
emitting individual telemetry events from consumer code is
intentionally out of scope.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Same audit shape as the send_telemetry removal: a sweep of public
methods that exist as Rust convenience wrappers on top of a typed
RPC, with no equivalent surface in the Node, Python, Go, or .NET
SDKs (zero matches across all four SDK source trees).

The methods are reachable cross-SDK through the typed `rpc()`
namespace — Rust callers simply switch from
`session.method()` to `session.rpc().<namespace>().<method>()`,
mirroring how Node/Python/Go/.NET consumers already drive these.

Removed from `Session`:
- get_model
- set_mode / get_mode
- set_name / get_name
- read_plan / update_plan / delete_plan
- list_workspace_files / read_workspace_file / create_workspace_file
- start_fleet
- set_approve_all_permissions
- call_rpc (generic forwarder; the typed rpc() namespace replaces it)

Removed from `Client`:
- get_quota (typed `client.rpc().account().get_quota()` already
  available everywhere including Rust)

Kept on Session: send, send_and_wait, abort, set_model, log,
disconnect/destroy, subscribe, capabilities, cancellation_token,
stop_event_loop, ui (and the field accessors id/cwd/workspace_path/
remote_url). These are either present in every SDK already (abort,
set_model, send/send_and_wait, log, disconnect) or are Rust-shape
helpers that don't have a typed RPC equivalent (subscribe,
cancellation_token, ui sub-API).

Updated:
- README "Rust-only API" section: dropped the "First-class Session
  convenience methods" bullet and the Client::get_quota bullet.
  What remains as Rust-only is now strictly language-shape items
  (newtypes, Transport enum, permission builders, from_streams,
  on_auto_mode_switch).
- CHANGELOG: dropped enumeration of the removed methods; restated
  what stays.
- 5 integration tests removed (get_name, set_name, list_workspace_files,
  read_workspace_file, create_workspace_file) plus the dispatch-table
  case for session.plan.delete.
- Unused imports cleaned up in session.rs.

Migration for the github-app consumer (the only known caller):
- session.set_approve_all_permissions(b)
  -> session.rpc().permissions().set_approve_all(
       PermissionsSetApproveAllRequest { enabled: b })
- session.set_mode("plan")
  -> session.rpc().mode().set(ModeSetRequest { mode: ... })
- session.read_plan()
  -> session.rpc().plan().read()
- (etc — all typed RPC namespace calls)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Brought in 12 commits from origin/main, including CLI bumps to
1.0.41-0 and 1.0.41-1, plus upstream PR #966 ("Add provider model
and token limit overrides to ProviderConfig"). One trivial codegen
diff (single doc-comment update on `CustomAgentsUpdatedAgent.tools`
for the new "or null when all tools are available" semantics).

PR #966 added four new fields to ProviderConfig across all SDKs:
- `model_id: Option<String>` (well-known model ID for agent config
  + token limit lookup; falls back to SessionConfig::model)
- `wire_model: Option<String>` (model name sent to provider API for
  inference; falls back to model_id, then to SessionConfig::model)
- `max_prompt_tokens: Option<i64>` (overrides resolved model's
  default max prompt tokens; triggers compaction)
- `max_output_tokens: Option<i64>` (overrides resolved model's
  default max output tokens; truncates response)

Plus matching `with_*` builders. Wire-shape: camelCase
(`modelId`/`wireModel`/`maxPromptTokens`/`maxOutputTokens`),
skip_serializing_if when unset.

Extended `provider_config_builder_composes` test to exercise all
four fields and assert their wire shape (camelCase + omission).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>