Copilot SDK v0.3.0: Session Auth, Agent Tools, MCP Utils

TL;DR

• Per-session GitHub authentication — different users/quotas on same CLI server
• Agent-level tool visibility and skill control for orchestrator patterns
• Massive naming cleanup across all four SDKs ahead of GA (39 param renames, 27 result renames, 63 event type renames)
• Breaking: `githubToken` → `gitHubToken`, `*Params` → `*Request`, session event types restructured

New

• Per-session GitHub authentication — Sessions now carry their own GitHub identity independent of client-level auth, enabling different users and quota limits on the same CLI server.
• Per-agent tool visibility — New `defaultAgent.excludedTools` option hides tools from the default agent while keeping them available to sub-agents for orchestrator patterns.
• Per-agent skills — Custom agents can declare `skills: string[]` to eagerly inject specific skills at startup; opt-in and non-inherited.
• Sub-agent streaming content — `assistant.message_delta` and `assistant.reasoning_delta` events now delivered for sub-agents with `agentId` field; filter by agent or disable with `includeSubAgentStreamingEvents: false`.
• Session idle timeout — New `sessionIdleTimeoutSeconds` client option configures automatic cleanup after inactivity (previously hardcoded to 30 minutes).
• Custom HTTP headers for BYOK providers — Provider headers and per-message `requestHeaders` now passable through `createSession`, `resumeSession`, and `send`.
• MCP CallToolResult conversion — New `convertMcpCallToolResult()` utility converts MCP tool results to SDK `ToolResultObject` format for easy MCP server integration.
• ProviderConfig exported — `ProviderConfig` now re-exported from Node.js and Python entry points, eliminating need to duplicate types locally.
• New RPC methods — Low-level access to skills config, MCP management, permissions, instructions, usage metrics, and session naming via `session.rpc.*`.

Changed

• Scoped permission approvals — Permission handlers can now return `"approve-for-session"` (session-scoped rules) or `"approve-for-location"` (workspace-persisted). Approval vocabulary clarified: `"approved"` → `"approve-once"`, `"denied-interactively-by-user"` → `"reject"`, `"denied-no-approval-rule-and-could-not-request-from-user"` → `"user-not-available"`.
• Dedicated session event types — Each session event now has individually named `*Event` interface and `*Data` type for direct import; runtime JSON shape unchanged.
• MCP server config types renamed — `MCPLocalServerConfig` → `MCPStdioServerConfig`, `MCPRemoteServerConfig` → `MCPHTTPServerConfig`; `type` field changes from `"local"`/`"remote"` to `"stdio"`/`"http"`.
• SessionFs provider API improved — Now uses idiomatic interface with plain arguments and error-throwing instead of RPC-shaped parameter objects; supply via `createSessionFsHandler` callback.
• githubToken casing corrected — `githubToken`/`GithubToken` → `gitHubToken`/`GitHubToken` across all SDKs for GitHub branding consistency.
• Sub-agent streaming deltas now default-on — Streaming sessions receive sub-agent deltas by default; filter by `event.agentId` or set `includeSubAgentStreamingEvents: false` to suppress.
• Model capabilities normalization — Models omitting `supports` or `limits` fields no longer cause runtime errors.
• .NET richer typing — `integer` → `long`, `date-time` → `DateTimeOffset`, `uuid` → `Guid`, `duration` → `TimeSpan`; data annotations added.
• .NET deprecated APIs annotated — `[Obsolete]` attributes with descriptive messages.

Breaking Changes

• Type naming overhaul — 39 `*Params` types renamed to `*Request`, 27 result types simplified (e.g., `SessionSkillsListResult` → `SkillList`), 63 session event sub-types flattened and prefixed consistently. If your code imports these types by name or uses `Parameters<>` / `ReturnType<>`, update references. Structural access unaffected.
• Empty types removed — 32 empty `{}` types (void params/results) eliminated from Node.js; Go, Python, and .NET had additional void result types also removed.
• Sub-agent streaming deltas now included by default — If your code renders all deltas without checking source, sub-agent content will interleave with main agent output. Filter by `event.agentId` or disable with `includeSubAgentStreamingEvents: false`.
• SessionFs provider interface changed — Old RPC-shaped interface with parameter objects and error-result returns replaced with idiomatic interface using plain arguments and error-throwing.

Update via npm install @github/copilot-sdk@0.3.0 (Node.js), pip install github-copilot-sdk==0.3.0 (Python), or equivalent for Go/.NET. SDK status now public preview.

Source: Copilot SDK