v1.0.30-preview.1

• Azure OpenAI BYOK providers again receive the default prompt-caching request shape; modelProvider only affects telemetry.
• Go and Rust use owner-only per-user temporary caches on Unix when normal user-cache discovery is unavailable, preserving no-home fallback support.
• Java generated RPC and event DTOs now provide named builders, avoiding source changes when optional schema properties are added.
• Reload invalidated skill catalogs before preparing configured agent skill contexts.
• Go, Node.js, Python, Java: a disconnected session is no longer kept by its client until stop(), so a long-lived client that creates and disconnects many sessions no longer grows in memory.

v1.0.30-preview.0

• Preserve proxy 407 errors for unsupported authentication challenges without waiting for unused target TLS configuration.
• Sandbox config: add userPolicy.filesystem.enumeratePaths (Windows only), granting enumerate-only access to the listed paths.
• Fixed: an empty sendMessages batch after a completed Claude turn no longer fails with "This model does not support assistant message prefill".
• Node.js: when a tool result cannot be sent to the runtime, the SDK now logs the failure and answers the tool call with the error instead of leaving it unanswered.
• Telemetry header helpers avoid blocking-pool admission when their executable path requires no filesystem search.
• Reasoning effort changes made during a tool call now apply to the next model request without waiting for another user message.
• Session opens that fail during post-construction initialization now await native-registration retirement before reporting the original error.
• Requests to OpenAI-compatible chat-completions providers no longer include an internal message field on skill and tool messages.
• Creating or resuming a session, or calling setTools, with two tools of the same name now fails with an error naming the tool, instead of offering the model the first definition while some SDKs ran the last handler.
• Copilot SDK runtime now advertises MCP Apps only when a renderer is configured.
• A customAgents entry that a built-in agent shadows now gets the session.custom_agents_updated warning without enableConfigDiscovery, and subagent.started no longer reports its description for the built-in run.
• Java SDK replaces SpotBugs nullability annotations with JSpecify 1.0.0.
• Avoid waiting for MCP transport handshakes during managed-policy restoration when matching cached tools are available.
• Support managed settings assignments that enable plugins by default.
• Python: with the TCP transport, the SDK now reads the runtime's stderr for as long as the runtime runs, so the runtime can no longer block on a full pipe, and a runtime that exits before announcing its port is reported with its exit code and stderr.
• .NET: a SessionFs SQLite provider can return SQL NULL as DBNull.Value (what ADO.NET readers return); such cells are now sent as null instead of failing the query.
• Fixed scheduled and queued SDK-registered slash commands not running their handlers.
• Java and Python: a system message section transform that returns null or None now leaves the section unchanged, instead of removing it (Java) or replacing it with "None" (Python).
• Fixed disabledSkills, session.skills.disable and session.skills.enable to match a skill name in any letter case, as invoking the skill does, instead of silently changing nothing when the case differs.
• Blob attachments with a MIME type the runtime cannot send now reach the model as their display name and an "omitted" note instead of being dropped silently.
• A refusal from an OpenAI model is now returned as the assistant's reply instead of failing the turn with "No response was returned".
• Prevent initial managed-policy publication from invalidating repository hook loading during session creation.
• Adds experimental decisions.ask and models.list decisionModels for Copilot decision models, behind the DECISIONS_API flag.
• Session event streams no longer include the internal session.memory_changed and instruction.update_delivery events, which the SDKs do not model (.NET reported them as unknown).
• Add experimental memory.storeMemory callback so apps can store agent memories in their own storage.
• Fixed view continuation skipping line suffixes at page boundaries and explicitly marked partial output from oversized lines.
• MAI Code 2 and MAI Code 2 Flash sessions now include model safety guidance in the existing SDK safety section, independently of identity customization; their child agents retain the same model policy.
• Experimental MCP skills now expose readable server-qualified names, reuse cached discovery metadata, and avoid consent failures caused by catalog-only updates.
• Session credentials set with accounts.set (setCredentials) or gitHubAuth.login are now refused when the supplied login is not the token's user, and no longer create a second account for a case-only variant of a saved login.
• Python, .NET, Go, Rust and Java: when a tool result fails to send, the SDK now logs the failure and answers the tool call with the error instead of leaving the turn waiting
• session.plan.readSqlTodos and readSqlTodosWithDependencies now read a SessionFs SQLite database instead of always answering empty.
• Rust: the session_fs example now implements every core SessionFsProvider method and creates a session, and the SessionFsProvider docs say to implement all ten core methods instead of only the ones a backing store needs.
• The Node.js, Python, Go and Rust manual tool resume samples now set a permission handler and stop clients gracefully, so they complete instead of hanging at the permission prompt.
• Sessions whose client tools returned contents, causalDependencies or remediation values outside the event schema can be resumed again, instead of failing with "Session file is corrupted".
• Add LSP inventory, warmup, startup probes, enablement, and shutdown APIs.
• GitHub service calls made while a session's first sign-in is still resolving no longer fail with "The bound session credential source changed".
• .NET: a tool whose AIFunction returns a string, for example through AIFunctionFactoryOptions.MarshalResult or an AIFunction subclass, now sends that text to the model as-is instead of as a quoted JSON string.
• Rust, Java, Python: concurrent installs of the bundled CLI no longer replace a copy another process is already running, which could make the first connection fail on Linux.
• Java: a system message section transform callback that throws or returns null no longer hangs the session; the section keeps its original text, as it does when the callback's future fails.
• Session setup no longer holds the registry lock while waiting for another operation on that session.
• Live tool discovery no longer reports a closed session when an LSP client reset publishes its next generation.
• Fix diagnostic memory sampling prolonging native runtime teardown.
• Fixed permission requests waiting for host event acknowledgements after a response was already settled.
• Local-model registry lookup honors nonempty COPILOT_HOME even if HOME and USERPROFILE are unset.
• Go: a canvas action that returns a ToolResult without ResultType now sends its text and images to the model like a tool result, instead of the whole value as JSON text.
• Add an optional permissionMode to session create and resume configs so a session starts in Manual, Assisted or Allow all mode before its first turn or resumed work; the applied result is available on the session.
• Replaced the experimental kerberosAuth client option with an experimental network option whose resolveProxy and authenticateNegotiate callbacks let the SDK host decide the runtime's proxies, or leave a request to the runtime's own proxy resolution, and supply its Kerberos tokens.
• Python: a tool, slash command, elicitation, skill provider or memory store handler that raises a BaseException that is not an Exception, such as pytest.fail(), now fails its request instead of leaving it unanswered.
• Allocate exclusively owned temporary directories for macOS language-server startup probes.
• Java: a storeMemory callback that throws a non-fatal Error, such as AssertionError, now fails the store_memory call promptly instead of leaving it unanswered until the 60-second timeout.
• Fix .NET client shutdown racing in-flight JSON-RPC sends and preserve terminal error stack traces.
• Java: a slash command or elicitation handler that throws an Error, such as an AssertionError, now fails or cancels its request instead of leaving it unanswered.
• Python: Pending RPC requests now fail when the client is stopped instead of waiting indefinitely.
• MCP deny rules now match the tool name the MCP server advertises as well as the sanitized name exposed to the model.
• .NET: Fix native resource leaks when in-process client startup fails before connection setup completes.
• Fixed cold session create and resume failing with "Custom agent not found" when the requested agent comes from a plugin enabled by enterprise managed settings.
• Preserve SDK correlation IDs in telemetry emitted during native session creation and cold resume.
• A turn that ends while the session event log cannot be written now still emits session.idle, so sendAndWait no longer times out on a completed turn.
• Added Auto mode recovery for failed explicit-model requests in the Copilot SDK.
• The SDK now rejects HTTPS runtime URLs.
• Correct large-tool-output documentation to match the runtime's default threshold of 20480 bytes.
• Retry failed local MCP connections when their effective sandbox launch policy changes.
• In-workspace reads are approved without a judge call.
• Assisted Autopilot no longer asks a human for permission.
• Assisted Autopilot denials return feedback to the agent.
• Required denied work ends with outcome blocked.
• session.task_complete adds blockedActions.
• Task blockers add reason permission_recovery_run_limit.
• Hosts should render blocker and blockedActions.
• Owning hosts can call internal session.ui.handleHuman*.
• handleHuman* covers ask_user, user input, plan exit.
• handleHuman* answers count as human input for the judge.
• Generic handlePending* answers stay non-authoritative.
• Permission requests carry assistedApprovalAssessment.
• The assessment shows judge outcome, exclusion or failure.
• permission.completed stays the authoritative result.
• Add assistedApprovalContext to permissions.configure.
• Judge host context is bounded, per-source and advisory.
• Shell command analysis always runs for SDK sessions.
• Read-only shell com...

v1.0.29

• Defer allocator reclamation until disposed session data is released on opted-in Linux/glibc hosts, and preserve requests made during trim cooldown.
• Sandbox deny rules support glob patterns, including hidden files and home-relative patterns, without changing literal grants.
• Session-summary failure diagnostics omit private parent directories.
• Start model requests without waiting for host event acknowledgements, while preserving stop-hook ordering and cancellation.
• Reduced memory growth in non-streaming sessions by limiting retained transient events.
• Session event-log reads now return promptly when a session disconnects instead of waiting for the long-poll timeout.
• Fixed a bug where MCP, LSP, and plugin manifest files
• Improved the Node.js SDK README by updating Permission
• Runtime now prevents block compaction when buffers are
• Custom subagents with private MCP connections avoid
• Session metadata from getSessionMetadata and listSessions
• Rust: Breaking: SessionMetadata adds client_name and
• Fixed a bug where stop_bash could incorrectly report a
• Fix Kerberos auth callback handling: .NET callbacks no
• Node.js: a request whose params cannot be serialized no
• Improve Claude token estimates used for session context
• Sandbox blockedHosts now also match visible TLS SNI in
• instructions.getDiscoveryPaths, skills.getDiscoveryPaths
• Fixed a runtime bug where settings merges could overwrite
• Local workspace diffs use the session's current working
• Sandboxed Hugo commands receive Hugo and Go cache grants
• Shell safety warnings are no longer duplicated as
• Added validation for reasoning effort values before they
• Improved runtime caching so MCP call results are preserved
• Added SDK contracts to expose GitHub services through the
• Keep credential assignments redacted across detached-shell
• Added optional causal provenance to inter-agent session
• Clarified errors when a managed sandbox cannot be
• For authenticated github.com sessions, the runtime now
• Eligible WorkIQ OAuth requests use the host's Entra
• Expose Team marketplaces through plugin APIs.
• Fix access to bundled search binaries in sandboxed SDK
• Switching a concrete-model session to Auto now reconciles
• Fusion model switches accept a null reasoning-effort reset
• Sessions created with customAgents and
• Requests can fall back to direct networking when system
• Fixed a bug where hook configuration files encoded with a
• Fixed a bug where LSP files matched by an empty extension
• Java: The deprecated parentToolCallId property of the
• Honor HTTP 429 Retry-After timing using existing request
• Fixed an issue where setting session.mcp.disable after
• Unlisted GPT models now use GPT-6.1 defaults, and unlisted
• Java previews with the same base SDK version now update
• Fixed plugin uninstall behavior so listed plugins can be
• Sessions created on the standalone runtime host now return
• Fixed a runtime bug where continuations with no usage were
• Fixed premature extension readiness reporting that could
• A session whose events cannot be persisted now emits a
• Fixed an issue where failed HTTP MCP tool calls could
• Sessions created or resumed with a stored Efficiency Auto
• Java and Python SDKs now preserve experimental markers on
• Explicitly reap POSIX stdio MCP child processes during
• Preserve application-defined request metadata in MCP App
• Fixed extensions being stuck behind a pending managed
• A leading ~ or ~/ in skillDirectories,
• Added a warning when a top-level SKILL.md in a skills
• Node.js, Python, Go, .NET and Rust: stop() no longer
• Add agent attribution to lifecycle progress diagnostics
• Fixed a runtime issue where preToolUse hooks were not
• Resuming a session on the same connection now replaces the
• Auto model selection no longer falls back to the legacy
• Fix a standalone session startup race between initial
• Fixed a bug where LSP rename applied its WorkspaceEdit as
• Fixed a runtime bug where abort requests could hang if the
• session.rpc.shell.exec now honours a timeout above
• Fixed web_fetch to decode an XML document in the
• createSession and resumeSession now reject a
• Fixed empty input hints in session.commands.list for
• session.options.update now rejects a workingDirectory
• Fixed duplicate session.created and session.deleted events
• Fixed: sign-in flows started with
• session.send, sendAndWait and sendMessages now reject a
• Fixed customizations.reload incorrectly reporting
• Protected sessions can read their selected extension SDK's
• Coalesce renewable GitHub CLI credential acquisition and
• Fixed an issue where ACP clients could not leave autopilot
• Improved telemetry privacy by redacting credentials from
• tasks.getProgress now returns a detached shell's recent
• A malformed managedSettings.permissions.limitTo passed at
• Add experimental session.rpc.history.setCompactionConfig
• Sandboxed Node MCP servers can write to their configured
• command.queued can now carry scheduled slash commands
• Fixed background-output search hints for named BYOK model
• Java: tools defined with ToolDefinition.from or
• Java: session RPC methods now send null entries in map
• Go: a tool call whose result telemetry cannot be encoded
• Node.js, Rust and Go: a client whose working directory
• Java: an elicitation handler whose result is null, or
• Node.js, Python, .NET and Java: a tool call whose result
• Preserve completed conversation history and cancellation
• Sessions on mai-code-1.1-flash no longer fail with
• Session events: IndexedSearchDisabledReason now includes
• Avoid an unnecessary skill-content scan when paging
• Added device-code sign-in support to
• Sending a message with an agentMode outside interactive,
• Improved session handling so system-prompt segments stay
• Fixed Microsoft 365 account display labels after Entra
• none ### Validation - `cd benchmarks/vally; node --test
• Fixed a BYOK runtime bug where reasoning_effort was sent
• Reuse GitHub token metadata across repeated MCP
• Connector requests preserve session account credentials
• Connector startup avoids redundant authentication
• Fixed an issue where refusal fallback retries could fail
• A HydraFusion turn that cannot retrieve the model catalog
• Java: when the runtime stops responding,
• In unattended Assisted Autopilot, a session that declares
• .NET, Python: an elicitation handler that fails with
• Expose runtime-resolved plugin content roots and opaque
• Expose hook definition URIs and canonical plugin ownership
• Cold-resumed Auto compaction preserves session capability
• Sessions whose client tools returned a binary result with
• session.send and sendAndWait now reject a missing or
• The .NET SDK can be packed under a custom NuGet
• SDK resume inventory contention no longer occupies a
• Local-model server adoption preserves complete process
• Preserve proxy 407 errors when Kerberos credentials are
• Policy-helper timeout handling preserves already-resolved
• Python, .NET: a Python tool or slash-command handler that
• Node.js: the bundled runtime now starts on Windows when
• Java SDK: excludedTools denylist is no longer silently
• Automatically initialize staff mode for eligible SDK users
• Sandboxed local MCP servers configured with a cwd now
• Fixed a CLI bug where pasting Unicode line separators
• .NET: builds no longer keep the downloaded Copilot runtime
• Plaintext native HTTP requests skip explicit platform
• .NET: an elicitation handler that accepts with a list of
• Go, Node.js, .NET, Rust: a tool handler that fails with an
• Python, Go and Java: resuming a session with an empty
• Python: CopilotClient now starts its provisioned runtime
• Sandboxed language servers now resolve relative
• Fix Linux file-watch notifications lost when a directory

v1.0.29-preview.9

• Fix a standalone session startup race between initial
• Fixed a bug where LSP rename applied its WorkspaceEdit as
• Fixed a runtime bug where abort requests could hang if the
• session.rpc.shell.exec now honours a timeout above
• Fixed web_fetch to decode an XML document in the
• createSession and resumeSession now reject a
• Fixed empty input hints in session.commands.list for
• session.options.update now rejects a workingDirectory
• Fixed duplicate session.created and session.deleted events
• Fixed: sign-in flows started with
• session.send, sendAndWait and sendMessages now reject a
• Fixed customizations.reload incorrectly reporting
• Protected sessions can read their selected extension SDK's
• Coalesce renewable GitHub CLI credential acquisition and
• Fixed an issue where ACP clients could not leave autopilot
• Improved telemetry privacy by redacting credentials from
• tasks.getProgress now returns a detached shell's recent
• A malformed managedSettings.permissions.limitTo passed at
• Add experimental session.rpc.history.setCompactionConfig
• Sandboxed Node MCP servers can write to their configured
• command.queued can now carry scheduled slash commands
• Fixed background-output search hints for named BYOK model
• Java: tools defined with ToolDefinition.from or
• Java: session RPC methods now send null entries in map
• Go: a tool call whose result telemetry cannot be encoded
• Node.js, Rust and Go: a client whose working directory
• Java: an elicitation handler whose result is null, or
• Node.js, Python, .NET and Java: a tool call whose result
• Preserve completed conversation history and cancellation
• Sessions on mai-code-1.1-flash no longer fail with
• Session events: IndexedSearchDisabledReason now includes
• Avoid an unnecessary skill-content scan when paging
• Added device-code sign-in support to
• Sending a message with an agentMode outside interactive,
• Improved session handling so system-prompt segments stay
• Fixed Microsoft 365 account display labels after Entra
• none ### Validation - `cd benchmarks/vally; node --test
• Fixed a BYOK runtime bug where reasoning_effort was sent
• Reuse GitHub token metadata across repeated MCP
• Connector requests preserve session account credentials
• Connector startup avoids redundant authentication
• Fixed an issue where refusal fallback retries could fail
• A HydraFusion turn that cannot retrieve the model catalog
• Java: when the runtime stops responding,
• In unattended Assisted Autopilot, a session that declares
• .NET, Python: an elicitation handler that fails with
• Expose runtime-resolved plugin content roots and opaque
• Expose hook definition URIs and canonical plugin ownership
• Cold-resumed Auto compaction preserves session capability
• Sessions whose client tools returned a binary result with
• session.send and sendAndWait now reject a missing or
• The .NET SDK can be packed under a custom NuGet
• SDK resume inventory contention no longer occupies a
• Local-model server adoption preserves complete process
• Preserve proxy 407 errors when Kerberos credentials are
• Policy-helper timeout handling preserves already-resolved
• Python, .NET: a Python tool or slash-command handler that
• Node.js: the bundled runtime now starts on Windows when
• Java SDK: excludedTools denylist is no longer silently
• Automatically initialize staff mode for eligible SDK users

v1.0.29-preview.8

• Sessions created with customAgents and
• Requests can fall back to direct networking when system
• Fixed a bug where hook configuration files encoded with a
• Fixed a bug where LSP files matched by an empty extension
• Java: The deprecated parentToolCallId property of the
• Honor HTTP 429 Retry-After timing using existing request
• Fixed an issue where setting session.mcp.disable after
• Unlisted GPT models now use GPT-6.1 defaults, and unlisted
• Java previews with the same base SDK version now update
• Fixed plugin uninstall behavior so listed plugins can be
• Sessions created on the standalone runtime host now return
• Fixed a runtime bug where continuations with no usage were
• Fixed premature extension readiness reporting that could
• A session whose events cannot be persisted now emits a
• Fixed an issue where failed HTTP MCP tool calls could
• Sessions created or resumed with a stored Efficiency Auto
• Java and Python SDKs now preserve experimental markers on
• Explicitly reap POSIX stdio MCP child processes during
• Preserve application-defined request metadata in MCP App
• Fixed extensions being stuck behind a pending managed
• A leading ~ or ~/ in skillDirectories,
• Added a warning when a top-level SKILL.md in a skills
• Node.js, Python, Go, .NET and Rust: stop() no longer
• Add agent attribution to lifecycle progress diagnostics
• Fixed a runtime issue where preToolUse hooks were not
• Resuming a session on the same connection now replaces the
• Auto model selection no longer falls back to the legacy

Runtime 1.0.102-0.unstable.r41779900948.gf482387

Public unstable runtime 1.0.102-0.unstable.r41779900948.gf482387
Source: f482387bbc8562e15fcc70907b1ad9cd2d832d6e
Visibility: public

v1.0.29-preview.6

• Fixed a bug where MCP, LSP, and plugin manifest files
• Improved the Node.js SDK README by updating Permission
• Runtime now prevents block compaction when buffers are
• Custom subagents with private MCP connections avoid
• Session metadata from getSessionMetadata and listSessions
• Rust: Breaking: SessionMetadata adds client_name and
• Fixed a bug where stop_bash could incorrectly report a
• Fix Kerberos auth callback handling: .NET callbacks no
• Node.js: a request whose params cannot be serialized no
• Improve Claude token estimates used for session context
• Sandbox blockedHosts now also match visible TLS SNI in
• instructions.getDiscoveryPaths, skills.getDiscoveryPaths
• Fixed a runtime bug where settings merges could overwrite
• Local workspace diffs use the session's current working
• Sandboxed Hugo commands receive Hugo and Go cache grants
• Shell safety warnings are no longer duplicated as
• Added validation for reasoning effort values before they
• Improved runtime caching so MCP call results are preserved
• Added SDK contracts to expose GitHub services through the
• Keep credential assignments redacted across detached-shell
• Added optional causal provenance to inter-agent session
• Clarified errors when a managed sandbox cannot be
• For authenticated github.com sessions, the runtime now
• Eligible WorkIQ OAuth requests use the host's Entra
• Expose Team marketplaces through plugin APIs.
• Fix access to bundled search binaries in sandboxed SDK
• Switching a concrete-model session to Auto now reconciles
• Fusion model switches accept a null reasoning-effort reset

v1.0.29-preview.5

No SDK-facing changes in this release.

v1.0.29-preview.4

No SDK-facing changes in this release.

v1.0.29-preview.3

No SDK-facing changes in this release.