Update SDK snapshot for Copilot CLI 1.0.92-1

Author: copilot-cli-release-app[bot]

.github/workflows/sdk-nodejs.yml

@@ -31,7 +31,7 @@ jobs:
       fail-fast: false
       matrix:
         os: ${{ fromJSON(inputs.platform == 'linux-x64' && '["ubuntu-latest"]' || inputs.platform == 'darwin-arm64' && '["macos-latest"]' || inputs.platform == 'win32-x64' && '["windows-latest"]' || '["ubuntu-latest","macos-latest","windows-latest"]') }}
-        transport: [default, inprocess]
+        transport: ${{ fromJSON(github.event_name == 'merge_group' && '["default"]' || '["default","inprocess"]') }}
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -54,6 +54,9 @@ jobs:
           cache: npm
           cache-dependency-path: ${{ inputs.sdk-home }}/nodejs/package-lock.json
       - run: npm ci --ignore-scripts
+      - name: Install generator test dependencies
+        run: npm ci --ignore-scripts
+        working-directory: ${{ inputs.sdk-home }}/scripts/codegen
       # TEMPORARY MERGE QUEUE REDUCTION: pull requests and main pushes retain
       # static checks; merge groups rerun only SDK compatibility coverage.
       - if: github.event_name != 'merge_group' && runner.os == 'Linux' && matrix.transport == 'default'
@@ -121,6 +124,7 @@ jobs:
           transport: ${{ matrix.transport }}
           command: |
             npm ci --ignore-scripts
+            (cd "$COPILOT_SDK_ROOT/scripts/codegen" && npm ci --ignore-scripts)
             npm run build
             (cd "$COPILOT_SDK_ROOT/test/harness" && npm ci --ignore-scripts)
 

.github/workflows/sdk-platform.yml

@@ -1,5 +1,5 @@
-# Runs all SDK language checks for one runtime platform, allowing each platform
-# to start as soon as its runtime artifact is available.
+# Runs SDK language checks for one runtime platform as soon as its artifact is
+# available. Merge groups retain only the Node.js compatibility lane.
 name: "SDK platform"
 
 on:
@@ -24,34 +24,39 @@ jobs:
     secrets: inherit
 
   python:
+    if: github.event_name != 'merge_group'
     uses: ./.github/workflows/sdk-python.yml
     with:
       platform: ${{ inputs.platform }}
       sdk-home: ${{ inputs.sdk-home }}
     secrets: inherit
 
   go:
+    if: github.event_name != 'merge_group'
     uses: ./.github/workflows/sdk-go.yml
     with:
       platform: ${{ inputs.platform }}
       sdk-home: ${{ inputs.sdk-home }}
     secrets: inherit
 
   dotnet:
+    if: github.event_name != 'merge_group'
     uses: ./.github/workflows/sdk-dotnet.yml
     with:
       platform: ${{ inputs.platform }}
       sdk-home: ${{ inputs.sdk-home }}
     secrets: inherit
 
   rust:
+    if: github.event_name != 'merge_group'
     uses: ./.github/workflows/sdk-rust.yml
     with:
       platform: ${{ inputs.platform }}
       sdk-home: ${{ inputs.sdk-home }}
     secrets: inherit
 
   java:
+    if: github.event_name != 'merge_group'
     uses: ./.github/workflows/sdk-java.yml
     with:
       platform: ${{ inputs.platform }}

.github/workflows/sdk-runtime-artifact.yml

@@ -3,6 +3,7 @@ name: "SDK runtime artifact"
 env:
   COPILOT_AUTO_UPDATE: "false"
   COPILOT_BAZEL_ANG_ENABLED: ${{ vars.COPILOT_BAZEL_ANG_ENABLED }}
+  COPILOT_BAZEL_ANG_SCOPE: ${{ vars.COPILOT_BAZEL_ANG_SCOPE }}
   COPILOT_RUNTIME_E2E_TEST_HOOKS: "1"
   CARGO_PROFILE_DEV_DEBUG: line-tables-only
   GIT_HTTP_LOW_SPEED_LIMIT: 1000

.github/workflows/sdk.yml

@@ -4,6 +4,7 @@ name: "SDK build and test"
 
 env:
   COPILOT_BAZEL_ANG_ENABLED: ${{ vars.COPILOT_BAZEL_ANG_ENABLED }}
+  COPILOT_BAZEL_ANG_SCOPE: ${{ vars.COPILOT_BAZEL_ANG_SCOPE }}
   HUSKY: 0
   POWERSHELL_UPDATECHECK: Off
   SETUP_NODE_TIMEOUT_MINUTES: 10
@@ -49,8 +50,9 @@ jobs:
           fi
 
   # TEMPORARY MERGE QUEUE REDUCTION: pull requests and main pushes retain the
-  # full platform matrix. Merge groups rerun Linux x64 as the representative
-  # compatibility lane. Remove the merge_group gates below to restore it.
+  # full SDK matrix. Merge groups rerun only Linux x64 Node.js out-of-process
+  # CAPI coverage. Remove the merge_group gates here and in sdk-platform.yml
+  # and sdk-nodejs.yml to restore the full matrix.
   build-runtime-windows-x64-addons:
     name: "Build runtime addons (win32-x64)"
     needs: detect-layout
@@ -454,7 +456,7 @@ jobs:
                 exit 1
               fi
             done
-            echo "Linux x64 SDK compatibility and generated clients passed"
+            echo "Linux x64 Node.js SDK compatibility and generated clients passed"
             exit 0
           fi
 

BUILD.bazel

@@ -1,6 +1,7 @@
 SHARED_CODEGEN_INPUTS = [
     "nodejs/scripts/releaseArtifacts.ts",
     "nodejs/src/cliVersion.ts",
+    "scripts/codegen/legacy-parameters.ts",
     "scripts/codegen/package-lock.json",
     "scripts/codegen/package.json",
     "scripts/codegen/utils.ts",
@@ -222,6 +223,7 @@ genrule(
         "java/scripts/codegen/package-lock.json",
         "java/scripts/codegen/package.json",
         "nodejs/package.json",
+        "scripts/codegen/legacy-parameters.ts",
         "scripts/runtime-layout.mjs",
         "scripts/runtime-release.mjs",
     ],

CONTRIBUTING.md

@@ -116,6 +116,15 @@ npm --prefix nodejs ci --ignore-scripts
 npm --prefix test/harness ci --ignore-scripts
 ```
 
+Node tests, including the unit-only profile, run generator subprocesses and
+require the codegen package's own dependencies. Prepare these before invoking
+Node tests directly or from a standalone SDK checkout (runtime build/test tasks
+already prepare them):
+
+```bash
+npm --prefix scripts/codegen ci --ignore-scripts
+```
+
 The full Node test task also runs the corrections-script tests:
 
 ```bash
@@ -319,6 +328,16 @@ For TypeScript SDK E2Es, use the existing
 `nodejs/test/e2e/harness/sdkTestContext.ts` fixture. In the runtime repository,
 also follow the `e2e-test-author` skill's SDK section.
 
+The Node.js Vitest global setup bundles the shared replay proxy once per run
+into Vitest's project-owned temporary directory (and refreshes it on watch
+reruns). Each E2E context launches that bundle directly with the test runner's
+Node executable, without an npm, shell, or TypeScript-loader subprocess.
+Focused Vitest commands use the same setup; no separate proxy build is needed.
+If startup or shutdown cleanup cannot confirm that the child exited, `CapiProxy`
+retains the child handle so callers can retry cleanup with `stop()`.
+Once shutdown is acknowledged, it waits for the child to finish flushing captures
+and exit rather than applying a forced-termination timeout to the flush.
+
 Owned-stdio shutdown regressions share
 `test/harness/stdio-shutdown-runtime.cjs` across all six SDKs. Launch it with
 Node and arguments `<cleanup-marker> <mode> <pid-file>`. The fixture acknowledges

docs/features/mcp.md

@@ -183,6 +183,57 @@ On session creation and a **cold** resume, disabled servers are not started and
 the runtime does not initiate their authentication. A resident resume cannot
 undo a server that the runtime has already spawned. Names are matched exactly.
 
+## Listing and retrieving prompts
+
+The experimental generated MCP namespace exposes the wire JSON-RPC methods
+`session.mcp.prompts.list` and `session.mcp.prompts.get`. Use the language-specific
+SDK accessors below to call them. These methods target one connected server in the
+current session; they do not combine results from multiple servers.
+
+| SDK | List prompts | Get a prompt |
+| --- | --- | --- |
+| Node.js | `session.rpc.mcp.prompts.list(...)` | `session.rpc.mcp.prompts.get(...)` |
+| Python | `session.rpc.mcp.prompts.list(...)` | `session.rpc.mcp.prompts.get(...)` |
+| Go | `session.RPC.MCP.Prompts().List(...)` | `session.RPC.MCP.Prompts().Get(...)` |
+| .NET | `session.Rpc.Mcp.Prompts.ListAsync(...)` | `session.Rpc.Mcp.Prompts.GetAsync(...)` |
+| Java | `session.getRpc().mcp.prompts.list(...)` | `session.getRpc().mcp.prompts.get(...)` |
+| Rust | `session.rpc().mcp().prompts().list(...)` | `session.rpc().mcp().prompts().get(...)` |
+
+Listing requires `serverName` and accepts an optional opaque `cursor`. Each
+call returns one page of typed prompt definitions and an optional `nextCursor`.
+Pass that cursor in another list call to request the next page. Definitions
+include names, optional titles and descriptions, and argument definitions.
+An omitted argument `required` flag remains distinct from `false`.
+
+Getting a prompt requires `serverName` and `promptName`, with an optional
+`arguments` dictionary whose values are strings. Omitting `arguments` leaves the
+MCP request's arguments absent; passing `{}` sends an explicitly empty dictionary.
+The runtime preserves this distinction for the server. The result contains an optional
+description and ordered messages with typed roles and opaque JSON `content`.
+Inspect each content block's `type` before interpreting it; content is not
+flattened into text. Nested resources, annotations, metadata, unfamiliar content
+types, and additional content fields retain their JSON structure. Server
+extensions on typed descriptors, messages, and result envelopes are available under
+`additionalProperties`. A server extension itself named `additionalProperties`
+is preserved as an entry inside that map, not merged into it.
+The protocol's top-level `resultType: "complete"` discriminator is consumed by
+the runtime; it is not returned as an SDK field or a server extension.
+Requests fail explicitly if the runtime cannot preserve the raw response,
+including stdio response frames exceeding the 1 MiB capture limit.
+
+The returned prompt messages are not automatically sent to the model or used to
+execute tools or fetch referenced resources. Your application decides how to
+use the result.
+While generating that result, an MCP server can request sampling or elicitation
+through multi round-trip continuations. These requests use the same configured
+host responders as other MCP operations; prompt retrieval does not grant
+additional permission or bypass the host's decision. A missing responder or
+responder error fails the request, and an elicitation decline is returned to the
+server unchanged. State-only continuations do not invoke either responder.
+
+After an existing `mcp.prompts.list_changed` session event, list the named
+server's prompts again to refresh your application's view.
+
 ## Tool configuration
 
 You can control which tools are available to an MCP server using the `tools` field.
@@ -295,6 +346,53 @@ directories for different applications.
 | `tools` | `string[]` | No | Tools to enable |
 | `timeout` | `number` | No | Timeout in milliseconds |
 
+## OAuth ownership for remote servers
+
+Choose one OAuth ownership model for each authentication attempt:
+
+1. **Runtime-managed loopback**: Call `session.mcp.oauth.login` without a
+   redirect URI. The runtime opens a local callback listener and owns discovery,
+   PKCE, state validation, token exchange, persistence, refresh, and reconnect.
+1. **Runtime-managed hosted callback**: Call `session.mcp.oauth.login` with a
+   trusted public HTTPS redirect URI. Your host receives the callback, but the
+   runtime continues to own the OAuth protocol and credentials.
+1. **Host-managed OAuth**: Use the SDK's MCP authentication request handler and
+   return a host-acquired access token. Your host owns authorization and refresh.
+
+Do not register a host-managed OAuth handler for an authentication attempt that
+uses a runtime-managed hosted callback. Wait until the remote server enters the
+`needs-auth` state, then call the generated `session.rpc.mcp.oauth.login` method
+directly with the server name and callback URI:
+
+```jsonc
+{
+    "serverName": "remote-mcp",
+    "redirectUri": "https://agent.example.com/oauth/callback"
+}
+```
+
+The selected static, CIMD, or dynamically registered OAuth client must advertise
+that exact URI. The URI must use HTTPS and must not contain a query or fragment.
+When browser interaction is required, the result contains `authorizationUrl`
+and `authorizationId`. Open `authorizationUrl` in the user's browser and retain
+`authorizationId` with the target session.
+
+After the authorization server redirects to your endpoint, call the generated
+`session.rpc.mcp.oauth.complete` method:
+
+```jsonc
+{
+    "authorizationId": "<opaque-state>",
+    "callbackUrl": "https://agent.example.com/oauth/callback?code=...&state=..."
+}
+```
+
+Construct `callbackUrl` from the configured public redirect origin and path plus
+the callback's original query. Do not pass an internal service URL or trust
+client-supplied `Forwarded` or `X-Forwarded-*` headers. The runtime validates the
+origin, port, path, state, and OAuth response before accepting delivery. Token
+exchange, persistence, and MCP reconnect then continue asynchronously.
+
 ## Session-scoped MCP diagnostics
 
 Set `diagnostics: { sources: { mcp: { level: "debug" } } }` when you create or