diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml
index 6aaf3ddbc7..bb96fb22fd 100644
--- a/.github/workflows/sdk.yml
+++ b/.github/workflows/sdk.yml
@@ -299,6 +299,9 @@ jobs:
     name: "Check schema and SDK freshness"
     needs: detect-layout
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v7
         timeout-minutes: 10
@@ -311,11 +314,10 @@ jobs:
         with:
           install-deps: "false"
       - if: needs.detect-layout.outputs.runtime-source == 'checkout'
-        uses: ./.github/actions/setup-rust-cache
-        timeout-minutes: 8
-        continue-on-error: true
+        uses: ./.github/actions/setup-bazel
         with:
-          cache-key: sdk-codegen
+          datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
+          datadog-site: ${{ vars.DATADOG_SITE || vars.DD_SITE }}
       - uses: actions/setup-go@v6
         with:
           go-version: "1.24"
diff --git a/docs/features/mcp.md b/docs/features/mcp.md
index caac633275..19f12e285b 100644
--- a/docs/features/mcp.md
+++ b/docs/features/mcp.md
@@ -288,9 +288,124 @@ directories for different applications.
 | `type` | `"http"` or `"sse"` | Yes | Server type |
 | `url` | `string` | Yes | Server URL |
 | `headers` | `object` | No | HTTP headers (e.g., for auth) |
+| `oauthClientId` | `string` | No | Non-empty client ID for a statically configured OAuth client |
+| `oauthScopes` | `string[]` | No | Non-empty array of valid RFC 6749 scope tokens. Requires `oauthClientId`; used when the server challenge omits scope or provides an empty scope, before protected-resource metadata fallback |
+| `oauthPublicClient` | `boolean` | No | Whether the configured OAuth client is public and does not require a client secret |
+| `oauthGrantType` | `string` | No | OAuth grant type for the configured client, such as `client_credentials` |
 | `tools` | `string[]` | No | Tools to enable |
 | `timeout` | `number` | No | Timeout in milliseconds |
 
+## Session-scoped MCP diagnostics
+
+Set `diagnostics: { sources: { mcp: { level: "debug" } } }` when you create or
+resume a session to opt in to MCP diagnostics. Every source defaults to `off`.
+The enabled levels are `error`, `warning`, `info`, `debug`, and `trace`. This
+setting is separate from the client's process-level `logLevel`.
+
+> [!WARNING]
+> Diagnostic entries can contain user-provided or server-provided content at
+> every enabled level: `warning` and above can include server stderr, while
+> `debug` and `trace` can additionally include MCP payloads, tool arguments,
+> and paths. Treat every entry as sensitive. Do not automatically upload entries
+> as telemetry or export them without deliberate host action.
+
+The generated `session.rpc.diagnostics` API lets hosts configure and read
+session-scoped, bounded in-memory diagnostics. MCP is the first and currently
+only supported source. Explicitly select it with `sources: ["mcp"]` when reading;
+reading does not enable capture. Use one stoppable read loop
+per output surface and retain its cursor. A read loop owns its cursor and
+presentation; the runtime owns capture, filtering, retention, cursor expiry,
+and wakeups.
+
+```ts
+import { approveAll, CopilotClient } from "@github/copilot-sdk";
+
+const client = new CopilotClient();
+const stop = new AbortController();
+const appendLine = (line: string) => console.log(line);
+
+await client.start();
+const session = await client.createSession({
+    onPermissionRequest: approveAll,
+    diagnostics: { sources: { mcp: { level: "debug" } } },
+});
+
+try {
+    let cursor: string | undefined;
+    while (!stop.signal.aborted) {
+        const page = await session.rpc.diagnostics.read({
+            sources: ["mcp"],
+            cursor,
+            max: 100,
+            waitMs: 30_000,
+        });
+        if (page.cursorStatus === "expired") {
+            appendLine("MCP diagnostic entries were dropped.");
+        }
+        for (const entry of page.entries) {
+            const detail = entry.details.data ? ` ${entry.details.data}` : "";
+            appendLine(
+                `${entry.timestamp} [${entry.level}] [${entry.source}:${entry.details.serverName}] ${entry.message}${detail}`,
+            );
+        }
+        cursor = page.cursor;
+    }
+} finally {
+    await session.disconnect();
+    await client.stop();
+}
+```
+
+The abort signal stops the loop after its current bounded read completes; it is
+not passed to the RPC call. Disabling capture wakes an outstanding read.
+
+MCP startup is lazy: enabling or reading diagnostics does not start a server.
+Configure `mcpServers` on session creation, then either use the session normally
+or call `session.rpc.mcp.startServer({ serverName })` for an installed server
+to troubleshoot initialization without making a model request.
+
+Each record has `source: "mcp"`, timestamp, severity, message, and optional
+`agentId` for non-root agents. Its typed `details` contains the lifecycle,
+protocol, HTTP, or stderr category, server name, a fresh `connectionId` for each
+connection attempt, and optional protocol direction and diagnostic data.
+MCP retention is capped at 1,024 records and 4 MiB per session. Individual encoded
+records are capped at 16 KiB and carry `truncated` when shortened. Reads default
+to 100 records, accept a maximum of 500, and do not consume other readers' data.
+Use `droppedCount`, when present on an expired cursor, to show the known loss.
+Every successful read returns a cursor and cursor status, including empty
+reads. Keep the returned cursor even when no records arrive. A cursor belongs
+to its source selection; start without a cursor when changing that selection.
+Missing, empty, duplicate, or unsupported sources are rejected, as are malformed
+cursors and invalid numeric bounds. Neither records nor capture settings are
+saved in session history.
+
+Call `session.rpc.diagnostics.configure({ sources: { mcp: { level: "off" } } })`
+to disable MCP capture and clear its retained buffer. Configuration updates only
+the explicitly named sources and returns the effective source levels. Empty or
+unknown source configuration is rejected; adding another supported source in
+the future will not implicitly opt an existing caller into it.
+
+Stop the host's read loop too; reads while logging
+is off return immediately rather than waiting. An outstanding long poll wakes
+when logging is disabled. Omitting `diagnostics` during a resident resume
+preserves its current configuration; a cold-loaded session requires a new opt-in.
+Enabling diagnostics from the initial `off` state can begin capture for an
+already-live MCP connection. After diagnostics have been disabled with
+`configure({ sources: { mcp: { level: "off" } } })`, re-enabling can resume capture for the same
+live connection and its existing connection ID. Records that were already in
+flight when diagnostics were disabled are discarded.
+
+The runtime removes configured and structurally recognized credentials from HTTP
+diagnostics before entries reach this API, but this is not a guarantee that
+arbitrary server-provided secrets are absent. It does not expose request or
+response header maps. Only selected metadata, such as `Content-Type`, `Accept`,
+and `MCP-Protocol-Version`, is eligible for capture, but its values are still
+untrusted and can contain sensitive content. Authentication headers, cookies,
+session IDs, query values, URL userinfo, and fragments are omitted. URL paths
+are retained for troubleshooting, so do not place credentials in path segments.
+Protocol payloads and stderr can also contain user content or arbitrary
+server-provided secrets.
+
 ## Troubleshooting
 
 ### Tools not showing up or not being invoked
diff --git a/dotnet/README.md b/dotnet/README.md
index a1d1b9b77c..946210437b 100644
--- a/dotnet/README.md
+++ b/dotnet/README.md
@@ -23,8 +23,7 @@ Set `CopilotCliBinaryPath` to copy a preinstalled binary instead, or set
 
 ## Run the Samples
 
-Try the interactive chat sample from the SDK root (`src/sdk` when nested).
-For checkout builds, first follow [development setup](#development):
+Try the interactive chat sample (from the repo root):
 
 ```bash
 dotnet run --file dotnet/samples/Chat.cs
@@ -139,6 +138,7 @@ Create a new conversation session.
 - `ReasoningEffort` - Reasoning effort level for models that support it ("low", "medium", "high", "xhigh", "max"). Use `ListModelsAsync()` to check which models support this option.
 - `Tools` - Custom tool declarations exposed to the CLI. Declarations without an invocable `AIFunction` are left pending for manual resolution.
 - `SystemMessage` - System message customization
+- `RefreshCustomInstructions` - `true` invalidates process-wide custom-instruction discovery caches before constructing the new session. Omitted or `false` reuses the caches. Other sessions in this runtime may observe updated instructions on later turns or discovery. This does not watch files or override instruction enablement. Available on `SessionConfig`, not `ResumeSessionConfig`.
 - `AvailableTools` - List of tool names to allow
 - `ExcludedTools` - List of tool names to disable
 - `Provider` - Custom API provider configuration (BYOK)
@@ -261,6 +261,10 @@ Use `MessageSource.System` for application-generated system context and
 message's origin; it does not replace the session's system prompt or change
 delivery mode. `SendAndWaitAsync` accepts the same option and still waits for
 session idle, returning null if no assistant message was received.
+Sub-agent events remain visible to listeners but do not complete the wait or
+supply its reply.
+Synchronous listeners registered before `SendAndWaitAsync` finish processing
+the terminal event before the wait completes.
 
 ```csharp
 await session.SendAsync(new MessageOptions
@@ -1239,6 +1243,16 @@ try
     var session = await client.CreateSessionAsync();
     await session.SendAsync(new MessageOptions { Prompt = "Hello" });
 }
+catch (IOException ex) when (ex.InnerException is RemoteRpcException)
+{
+    var remote = (RemoteRpcException)ex.InnerException!;
+    Console.Error.WriteLine($"RPC error {remote.ErrorCode}: {remote.Message}");
+    if (remote.ErrorData is { } data)
+    {
+        // Interpret data according to the remote API's contract.
+        Console.Error.WriteLine($"Error data kind: {data.ValueKind}");
+    }
+}
 catch (IOException ex)
 {
     Console.Error.WriteLine($"Communication Error: {ex.Message}");
@@ -1249,28 +1263,34 @@ catch (Exception ex)
 }
 ```
 
-## Development
+`RemoteRpcException` is in the `GitHub.Copilot` namespace. Remote JSON-RPC
+errors remain wrapped in `IOException`; connection failures are not remote errors.
+`ErrorData` is a `JsonElement?` that preserves objects, arrays, strings, numbers,
+booleans, and empty values without converting them to application-specific types.
+Omitted `data` has no nullable value; explicit JSON `null` has a value with
+`ValueKind == JsonValueKind.Null`. The cloned element remains valid after the
+response document or client is disposed. Exception messages and ordinary exception
+formatting do not include the data payload.
+Avoid logging it indiscriminately: server-provided data may contain sensitive
+information.
 
-Follow [SDK development setup](../CONTRIBUTING.md#developing-an-sdk) for the
-.NET SDK selected by `global.json`, the **.NET 8 test runtime**, and Node/harness
-dependencies. SDK 10 alone does not install the runtime for `net8.0` tests;
-Windows additionally runs `net472` tests.
+## Development
 
-From the SDK root (`src/sdk` in the runtime repository, or the standalone
-repository root):
+Development requires [.NET SDK 10+](https://dotnet.microsoft.com/download) and a supported [Node.js version](../nodejs/README.md#prerequisites). From the repository root:
 
 ```bash
-npm run build:dotnet
-npm run test:dotnet
-npm run check:dotnet
+cd nodejs
+npm ci
 ```
 
-For a focused native test, first
-[prepare the runtime](../CONTRIBUTING.md#testing-an-unreleased-runtime-api),
-then run from `dotnet/` so `global.json` applies:
+```bash
+cd test/harness
+npm ci
+```
 
 ```bash
-dotnet test test/GitHub.Copilot.SDK.Test.csproj --filter "FullyQualifiedName~<test-name>"
+cd dotnet
+dotnet test
 ```
 
 ## License
diff --git a/dotnet/src/Client.cs b/dotnet/src/Client.cs
index 0d7b937b88..0cf2e75bde 100644
--- a/dotnet/src/Client.cs
+++ b/dotnet/src/Client.cs
@@ -1253,6 +1253,7 @@ public async Task<CopilotSession> CreateSessionAsync(SessionConfig config, Cance
                 config.Streaming is true ? true : null,
                 config.IncludeSubAgentStreamingEvents,
                 config.McpServers,
+                config.Diagnostics,
                 config.McpOAuthTokenStorage,
                 config.AuthClientIdMetadataUrl,
                 "direct",
@@ -1284,6 +1285,7 @@ public async Task<CopilotSession> CreateSessionAsync(SessionConfig config, Cance
                 GitHubTokenProviderRegistrationId: registrationId,
                 RemoteSession: config.RemoteSession,
                 Cloud: config.Cloud,
+                RefreshCustomInstructions: config.RefreshCustomInstructions,
                 InstructionDirectories: config.InstructionDirectories,
                 PluginDirectories: config.PluginDirectories,
                 DisabledMcpServers: config.DisabledMcpServers,
@@ -1506,6 +1508,7 @@ public async Task<CopilotSession> ResumeSessionAsync(string sessionId, ResumeSes
                 config.Streaming is true ? true : null,
                 config.IncludeSubAgentStreamingEvents,
                 config.McpServers,
+                config.Diagnostics,
                 config.McpOAuthTokenStorage,
                 config.AuthClientIdMetadataUrl,
                 "direct",
@@ -3073,6 +3076,7 @@ internal record CreateSessionRequest(
         bool? Streaming,
         bool? IncludeSubAgentStreamingEvents,
         IDictionary<string, McpServerConfig>? McpServers,
+        DiagnosticsConfiguration? Diagnostics,
         McpOAuthTokenStorageMode? McpOAuthTokenStorage,
         string? AuthClientIdMetadataUrl,
         string? EnvValueMode,
@@ -3104,6 +3108,7 @@ internal record CreateSessionRequest(
         [property: JsonPropertyName("gitHubTokenProviderRegistrationId")] string? GitHubTokenProviderRegistrationId = null,
         RemoteSessionMode? RemoteSession = null,
         CloudSessionOptions? Cloud = null,
+        bool? RefreshCustomInstructions = null,
         IList<string>? InstructionDirectories = null,
         IList<string>? PluginDirectories = null,
         [property: JsonPropertyName("disabledMcpServers")] IList<string>? DisabledMcpServers = null,
@@ -3203,6 +3208,7 @@ internal record ResumeSessionRequest(
         bool? Streaming,
         bool? IncludeSubAgentStreamingEvents,
         IDictionary<string, McpServerConfig>? McpServers,
+        DiagnosticsConfiguration? Diagnostics,
         McpOAuthTokenStorageMode? McpOAuthTokenStorage,
         string? AuthClientIdMetadataUrl,
         string? EnvValueMode,
diff --git a/dotnet/src/Generated/Rpc.cs b/dotnet/src/Generated/Rpc.cs
index 8fa4e70ee1..f4b993c288 100644
--- a/dotnet/src/Generated/Rpc.cs
+++ b/dotnet/src/Generated/Rpc.cs
@@ -19,7 +19,7 @@
 namespace GitHub.Copilot.Rpc;
 
 /// <summary>Server liveness response, including the echoed message, current server timestamp, and protocol version.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PingResult
 {
     /// <summary>Echoed message (or default greeting).</summary>
@@ -36,7 +36,7 @@ public sealed class PingResult
 }
 
 /// <summary>Optional message to echo back to the caller.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PingRequest
 {
     /// <summary>Optional message to echo back.</summary>
@@ -45,7 +45,7 @@ internal sealed class PingRequest
 }
 
 /// <summary>Handshake result reporting the server's protocol version and package version on success.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ConnectResult
 {
     /// <summary>Always true on success.</summary>
@@ -66,7 +66,7 @@ internal sealed class ConnectResult
 }
 
 /// <summary>Identity of the integrating host, declared once on the `server.connect` handshake so telemetry from this connection is attributed to a single, consistent surface. All fields are optional; omit them to keep the default attribution.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ConnectClientInfo
 {
     /// <summary>Name of the host editor, e.g. `"vscode"`.</summary>
@@ -87,7 +87,7 @@ internal sealed class ConnectClientInfo
 }
 
 /// <summary>Connection-level opt-ins for the `server.connect` handshake. Transport authentication is consumed by the native protocol boundary before dispatch.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ConnectRequest
 {
     /// <summary>Identity of the integrating host. Optional; omit it to keep the default attribution.</summary>
@@ -108,7 +108,7 @@ internal sealed class ConnectRequest
 }
 
 /// <summary>One server-discovered hook action from user, repository, plugin, or managed-policy configuration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DiscoveredHook
 {
     /// <summary>Durable content hash used by hook enablement. Identical actions may intentionally share this key. Omitted when changing the user's disabled-hooks setting cannot change the action's current server-discovered state, including managed-policy hooks, session-start prompt actions, actions suppressed by disable-all settings, and projectless plugin actions that require project-directory expansion.</summary>
@@ -141,7 +141,7 @@ public sealed class DiscoveredHook
 }
 
 /// <summary>Server-discovered hook actions and partial-load diagnostics from user, repository, plugin, and managed-policy sources. Concrete sessions may include additional session-specific hook sources.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HooksDiscoverResult
 {
     /// <summary>Errors for hook sources or actions that could not be loaded, making the result partially incomplete. Other valid actions are still returned. Project-resolution and repository-settings errors are prefixed with their project path.</summary>
@@ -158,7 +158,7 @@ public sealed class HooksDiscoverResult
 }
 
 /// <summary>Optional project paths and host-exclusion behavior for server-scoped hook discovery.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class HooksDiscoverRequest
 {
     /// <summary>When true, omit host-owned user and plugin hook rows and their diagnostics. Managed-policy hooks and trusted repository hooks remain visible, and host disabledHooks still contribute to each remaining row's effective enabled state. This filters sources rather than simulating a host with no settings.</summary>
@@ -171,7 +171,7 @@ internal sealed class HooksDiscoverRequest
 }
 
 /// <summary>Active server-driven promotion for a model, including its discount and optional expiry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelBillingPromo
 {
     /// <summary>Percentage discount (0-100) applied while the promotion is active. May be fractional.</summary>
@@ -196,7 +196,7 @@ public sealed class ModelBillingPromo
 }
 
 /// <summary>Long context tier pricing (available for models with extended context windows).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelBillingTokenPricesLongContext
 {
     /// <summary>Use cacheReadPrice instead. AI Credits cost per billing batch of cached tokens.</summary>
@@ -241,7 +241,7 @@ public sealed class ModelBillingTokenPricesLongContext
 }
 
 /// <summary>Token-level pricing information for this model.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelBillingTokenPrices
 {
     /// <summary>Number of tokens per standard billing batch.</summary>
@@ -294,7 +294,7 @@ public sealed class ModelBillingTokenPrices
 }
 
 /// <summary>Billing information.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelBilling
 {
     /// <summary>Whole-number percentage discount (0-100) applied to usage billed through this model. Populated for the synthetic `auto` model, where requests routed by auto-mode are billed at a reduced rate; absent for concrete models.</summary>
@@ -315,7 +315,7 @@ public sealed class ModelBilling
 }
 
 /// <summary>Vision-specific limits.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelCapabilitiesLimitsVision
 {
     /// <summary>Maximum image size in bytes.</summary>
@@ -332,7 +332,7 @@ public sealed class ModelCapabilitiesLimitsVision
 }
 
 /// <summary>Token limits for prompts, outputs, and context window.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelCapabilitiesLimits
 {
     /// <summary>Maximum total context window size in tokens.</summary>
@@ -353,7 +353,7 @@ public sealed class ModelCapabilitiesLimits
 }
 
 /// <summary>Feature flags indicating what the model supports.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelCapabilitiesSupports
 {
     /// <summary>Resolved Anthropic adaptive-thinking capability — unsupported / optional / required / adaptive_only. 'required' models reject thinking.type='enabled' with HTTP 400 but still accept 'disabled' (e.g. opus-4.7/4.8/5, sonnet-5); 'adaptive_only' models accept nothing but 'adaptive' (e.g. fable, mythos).</summary>
@@ -374,7 +374,7 @@ public sealed class ModelCapabilitiesSupports
 }
 
 /// <summary>Model capabilities and limits.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelCapabilities
 {
     /// <summary>Token limits for prompts, outputs, and context window.</summary>
@@ -387,7 +387,7 @@ public sealed class ModelCapabilities
 }
 
 /// <summary>A service-published message about a model, carrying a stable machine-readable code alongside human-readable text.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelMessage
 {
     /// <summary>Stable machine-readable identifier for the message, such as `client_version_deprecated`. Hosts can key custom presentation off this; unrecognized codes should fall back to displaying `message`.</summary>
@@ -400,7 +400,7 @@ public sealed class ModelMessage
 }
 
 /// <summary>Policy state (if applicable).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelPolicy
 {
     /// <summary>Current policy state for this model.</summary>
@@ -413,7 +413,7 @@ public sealed class ModelPolicy
 }
 
 /// <summary>Service-published warning text that hosts should display when presenting a model.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelWarningText
 {
     /// <summary>Data-retention warning for the model. The text may contain Markdown links and should be rendered as Markdown when supported.</summary>
@@ -422,7 +422,7 @@ public sealed class ModelWarningText
 }
 
 /// <summary>Copilot model metadata, including identifier, display name, capabilities, policy, billing, reasoning efforts, and picker categories.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class Model
 {
     /// <summary>Billing information.</summary>
@@ -483,7 +483,7 @@ public sealed class Model
 }
 
 /// <summary>List of Copilot models available to the resolved user, including capabilities and billing metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelList
 {
     /// <summary>List of available models with full metadata.</summary>
@@ -492,7 +492,7 @@ public sealed class ModelList
 }
 
 /// <summary>RPC data type for ModelsList operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ModelsListRequest
 {
     /// <summary>GitHub token accepted for compatibility with existing SDK clients. When provided, resolves this token instead of using the current account.</summary>
@@ -505,7 +505,7 @@ internal sealed class ModelsListRequest
 }
 
 /// <summary>A well-known model in the runtime's built-in catalog.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class BuiltInModelCatalogEntry
 {
     /// <summary>Well-known runtime model ID suitable for provider or provider-model metadata. This is not necessarily the provider-facing deployment or model name and does not indicate CAPI entitlement or provider availability.</summary>
@@ -514,7 +514,7 @@ public sealed class BuiltInModelCatalogEntry
 }
 
 /// <summary>The running runtime's complete catalog of well-known built-in model IDs, including supported models and additional IDs with built-in metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class BuiltInModelCatalog
 {
     /// <summary>Built-in model entries.</summary>
@@ -522,8 +522,42 @@ public sealed class BuiltInModelCatalog
     public IList<BuiltInModelCatalogEntry> Models { get => field ??= []; set; }
 }
 
+/// <summary>Whether this host can run one sandbox policy feature. A session whose effective policy uses an unsupported feature fails each sandboxed command with `reason`.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class SandboxHostCapability
+{
+    /// <summary>The policy feature, as an extensible string: ignore names you do not recognize. Known values: `network` (sandboxed commands can reach the network; on Linux this needs the tooling for Bubblewrap's private network namespace, such as slirp4netns), `network_filtering` (host rules and the sandbox proxy; on Linux this needs the same tooling as `network`; on Windows it needs Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set `network.allowLocalNetwork`), `denied_paths` (native enforcement of `filesystem.deniedPaths`), and `shell` (shell commands inside the sandbox; on Windows this needs Process Security Environment 1.1 filesystem enumeration support).</summary>
+    [JsonPropertyName("name")]
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Human-readable reason and remedy when the feature is unsupported, such as a package to install or an OS update. Present only when `supported` is false.</summary>
+    [JsonPropertyName("reason")]
+    public string? Reason { get; set; }
+
+    /// <summary>Whether this host can run the feature.</summary>
+    [JsonPropertyName("supported")]
+    public bool Supported { get; set; }
+}
+
+/// <summary>Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class SandboxHostSupport
+{
+    /// <summary>Sandbox policy features whose availability varies between hosts that can run the backend. Empty when `supported` is false, because no feature can run without a backend. Later runtimes can add entries; ignore an entry whose `name` you do not recognize.</summary>
+    [JsonPropertyName("capabilities")]
+    public IList<SandboxHostCapability> Capabilities { get => field ??= []; set; }
+
+    /// <summary>Human-readable reason the sandbox cannot run on this host. Present only when `supported` is false.</summary>
+    [JsonPropertyName("reason")]
+    public string? Reason { get; set; }
+
+    /// <summary>Whether a process-containment backend is usable on this host: Seatbelt on macOS, Bubblewrap on Linux, or ProcessContainer on Windows.</summary>
+    [JsonPropertyName("supported")]
+    public bool Supported { get; set; }
+}
+
 /// <summary>Built-in tool metadata with identifier, optional namespaced name, description, input-parameter schema, and usage instructions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class Tool
 {
     /// <summary>Description of what the tool does.</summary>
@@ -547,13 +581,13 @@ public sealed class Tool
     public IDictionary<string, JsonElement>? Parameters { get; set; }
 
     /// <summary>Telemetry-safety policy for the tool name and input names, not input values. Treat omitted metadata as unsafe.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("safeForTelemetry")]
     public JsonElement? SafeForTelemetry { get; set; }
 }
 
 /// <summary>Built-in tools available for the requested model, with their parameters and instructions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolList
 {
     /// <summary>List of available built-in tools with metadata.</summary>
@@ -562,7 +596,7 @@ public sealed class ToolList
 }
 
 /// <summary>Optional model identifier whose tool overrides should be applied to the listing.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ToolsListRequest
 {
     /// <summary>Optional model ID — when provided, the returned tool list reflects model-specific overrides.</summary>
@@ -571,7 +605,7 @@ internal sealed class ToolsListRequest
 }
 
 /// <summary>Quota usage snapshot for a Copilot quota type, including entitlement, used requests, overage, reset date, and remaining percentage.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AccountQuotaSnapshot
 {
     /// <summary>Number of requests included in the entitlement, or -1 for unlimited entitlements.</summary>
@@ -608,7 +642,7 @@ public sealed class AccountQuotaSnapshot
 }
 
 /// <summary>Quota usage snapshots for the resolved user, keyed by quota type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AccountGetQuotaResult
 {
     /// <summary>Quota snapshots keyed by type (e.g., chat, completions, premium_interactions).</summary>
@@ -617,7 +651,7 @@ public sealed class AccountGetQuotaResult
 }
 
 /// <summary>RPC data type for AccountGetQuota operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class AccountGetQuotaRequest
 {
     /// <summary>GitHub token accepted for compatibility with existing SDK clients. When provided, resolves this token instead of using the current account.</summary>
@@ -631,7 +665,7 @@ internal sealed class AccountGetQuotaRequest
 
 /// <summary>Authentication credentials accepted only at native protocol ingress. Runtime outputs use credential-free `AuthIdentity` metadata.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -652,7 +686,7 @@ public partial class AuthInfo
 
 
 /// <summary>Endpoint URLs from the raw Copilot `/copilot_internal/v2/token` user-response passthrough.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CopilotUserResponseEndpoints
 {
     /// <summary>Copilot API endpoint URL.</summary>
@@ -701,7 +735,7 @@ public sealed class CopilotUserResponseOrganizationListItem
 }
 
 /// <summary>Chat quota snapshot from the raw Copilot user-response passthrough, with entitlement, overage, remaining quota, reset, and billing fields.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CopilotUserResponseQuotaSnapshotsChat
 {
     /// <summary>Number of requests/units included in the entitlement for this period; `-1` denotes an unlimited entitlement.</summary>
@@ -754,7 +788,7 @@ public sealed class CopilotUserResponseQuotaSnapshotsChat
 }
 
 /// <summary>Completions quota snapshot from the raw Copilot user-response passthrough, with entitlement, overage, remaining quota, reset, and billing fields.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CopilotUserResponseQuotaSnapshotsCompletions
 {
     /// <summary>Number of requests/units included in the entitlement for this period; `-1` denotes an unlimited entitlement.</summary>
@@ -807,7 +841,7 @@ public sealed class CopilotUserResponseQuotaSnapshotsCompletions
 }
 
 /// <summary>Premium-interactions quota snapshot from the raw Copilot user-response passthrough, with entitlement, overage, remaining quota, reset, and billing fields.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CopilotUserResponseQuotaSnapshotsPremiumInteractions
 {
     /// <summary>Number of requests/units included in the entitlement for this period; `-1` denotes an unlimited entitlement.</summary>
@@ -860,7 +894,7 @@ public sealed class CopilotUserResponseQuotaSnapshotsPremiumInteractions
 }
 
 /// <summary>Quota snapshot map from the raw Copilot user-response passthrough, with chat, completions, premium-interactions, and other entries.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CopilotUserResponseQuotaSnapshots
 {
     /// <summary>Chat quota snapshot from the raw Copilot user-response passthrough, with entitlement, overage, remaining quota, reset, and billing fields.</summary>
@@ -877,7 +911,7 @@ public sealed class CopilotUserResponseQuotaSnapshots
 }
 
 /// <summary>Snapshot of the authenticated user's Copilot subscription info, if known. Mirrors the GitHub API `/copilot_internal/v2/token` user response shape — the runtime trusts this verbatim and does not re-fetch when set.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CopilotUserResponse
 {
     /// <summary>Copilot access SKU identifier (e.g. `free_limited_copilot`, `copilot_for_business_seat_quota`) used to gate model and feature access.</summary>
@@ -991,7 +1025,7 @@ public sealed class CopilotUserResponse
 
 /// <summary>Authentication-info input variant for GitHub-internal HMAC auth, carrying the public GitHub host and HMAC secret.</summary>
 /// <remarks>The <c>hmac</c> variant of <see cref="AuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AuthInfoHmac : AuthInfo
 {
     /// <inheritdoc />
@@ -1014,7 +1048,7 @@ public partial class AuthInfoHmac : AuthInfo
 
 /// <summary>Authentication-info input variant for a token sourced from an environment variable, with host, optional login, token, and env var name.</summary>
 /// <remarks>The <c>env</c> variant of <see cref="AuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AuthInfoEnv : AuthInfo
 {
     /// <inheritdoc />
@@ -1046,7 +1080,7 @@ public partial class AuthInfoEnv : AuthInfo
 
 /// <summary>Authentication-info input variant for SDK-configured token authentication, carrying host and the secret token value.</summary>
 /// <remarks>The <c>token</c> variant of <see cref="AuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AuthInfoToken : AuthInfo
 {
     /// <inheritdoc />
@@ -1074,7 +1108,7 @@ public partial class AuthInfoToken : AuthInfo
 
 /// <summary>Authentication-info variant backed by an SDK GitHub token callback. It carries routing metadata but never a plaintext token.</summary>
 /// <remarks>The <c>token-provider</c> variant of <see cref="AuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AuthInfoTokenProvider : AuthInfo
 {
     /// <inheritdoc />
@@ -1097,7 +1131,7 @@ public partial class AuthInfoTokenProvider : AuthInfo
 
 /// <summary>Authentication-info variant for direct Copilot API token auth sourced from environment variables, with public GitHub host.</summary>
 /// <remarks>The <c>copilot-api-token</c> variant of <see cref="AuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AuthInfoCopilotApiToken : AuthInfo
 {
     /// <inheritdoc />
@@ -1116,7 +1150,7 @@ public partial class AuthInfoCopilotApiToken : AuthInfo
 
 /// <summary>Authentication-info variant for OAuth user auth, with host and login; the token remains in the runtime secret store.</summary>
 /// <remarks>The <c>user</c> variant of <see cref="AuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AuthInfoUser : AuthInfo
 {
     /// <inheritdoc />
@@ -1139,7 +1173,7 @@ public partial class AuthInfoUser : AuthInfo
 
 /// <summary>Authentication-info input variant for GitHub CLI credentials, carrying host, login, and the `gh auth token` value.</summary>
 /// <remarks>The <c>gh-cli</c> variant of <see cref="AuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AuthInfoGhCli : AuthInfo
 {
     /// <inheritdoc />
@@ -1166,7 +1200,7 @@ public partial class AuthInfoGhCli : AuthInfo
 
 /// <summary>Authentication-info input variant for API-key authentication to a non-GitHub LLM provider, carrying the secret `apiKey` and host.</summary>
 /// <remarks>The <c>api-key</c> variant of <see cref="AuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AuthInfoApiKey : AuthInfo
 {
     /// <inheritdoc />
@@ -1188,7 +1222,7 @@ public partial class AuthInfoApiKey : AuthInfo
 }
 
 /// <summary>Current authentication state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AccountGetCurrentAuthResult
 {
     /// <summary>Authentication errors from the last auth attempt, if any.</summary>
@@ -1201,7 +1235,7 @@ public sealed class AccountGetCurrentAuthResult
 }
 
 /// <summary>Authenticated account entry returned by `account.getAllUsers`.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AccountAllUsers
 {
     /// <summary>Authentication information for this user.</summary>
@@ -1218,7 +1252,7 @@ public sealed class AccountAllUsers
 }
 
 /// <summary>Result of a successful login; throws on failure.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AccountLoginResult
 {
     /// <summary>Whether the credential was persisted to a secure store (system keychain, or the config file when plaintext storage is enabled). False when no secure store was available and the token was not saved, so the consumer can decide how to proceed.</summary>
@@ -1227,7 +1261,7 @@ public sealed class AccountLoginResult
 }
 
 /// <summary>Credentials to validate and store. Omit login to resolve the authenticated user from the token.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class AccountLoginRequest
 {
     /// <summary>GitHub host URL.</summary>
@@ -1244,7 +1278,7 @@ internal sealed class AccountLoginRequest
 }
 
 /// <summary>Logout result indicating if more users remain.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AccountLogoutResult
 {
     /// <summary>Whether other authenticated users remain after logout.</summary>
@@ -1253,7 +1287,7 @@ public sealed class AccountLogoutResult
 }
 
 /// <summary>User to log out.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class AccountLogoutRequest
 {
     /// <summary>Authentication information for the user to log out.</summary>
@@ -1266,7 +1300,7 @@ internal sealed class AccountLogoutRequest
 }
 
 /// <summary>Confirmation that the secret values were registered.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SecretsAddFilterValuesResult
 {
     /// <summary>Whether the values were successfully registered.</summary>
@@ -1275,7 +1309,7 @@ public sealed class SecretsAddFilterValuesResult
 }
 
 /// <summary>Secret values to add to the redaction filter.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SecretsAddFilterValuesRequest
 {
     /// <summary>Raw secret values to register for redaction.</summary>
@@ -1284,7 +1318,7 @@ internal sealed class SecretsAddFilterValuesRequest
 }
 
 /// <summary>Concrete configuration file containing an MCP server declaration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpSourceFile
 {
     /// <summary>RFC 6901 JSON Pointer to the server declaration, when known.</summary>
@@ -1299,7 +1333,7 @@ public sealed class McpSourceFile
 }
 
 /// <summary>Plugin identity associated with an MCP server declaration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpSourcePlugin
 {
     /// <summary>Canonical plugin identity.</summary>
@@ -1322,7 +1356,7 @@ public sealed class McpSourcePlugin
 }
 
 /// <summary>Canonical identity and location of the effective MCP server declaration. The declaration is uniquely addressed by this source id together with the discovered server name.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpSourceRef
 {
     /// <summary>Open semantic editability identifier. Known values are editable and read-only.</summary>
@@ -1353,7 +1387,7 @@ public sealed class McpSourceRef
 }
 
 /// <summary>MCP server discovered by `mcp.discover`, with config source, optional plugin source, transport type, and enabled state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DiscoveredMcpServer
 {
     /// <summary>Canonical identity and location of the effective server declaration.</summary>
@@ -1389,7 +1423,7 @@ public sealed class DiscoveredMcpServer
 }
 
 /// <summary>MCP servers discovered from user, workspace, plugin, and built-in sources.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpDiscoverResult
 {
     /// <summary>MCP servers discovered from all sources.</summary>
@@ -1398,7 +1432,7 @@ public sealed class McpDiscoverResult
 }
 
 /// <summary>Optional working directory used as context for MCP server discovery.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpDiscoverRequest
 {
     /// <summary>Whether to include canonical effectiveSource metadata for each discovered server. Callers must opt in so protocol-3 clients retain the legacy closed response shape.</summary>
@@ -1412,7 +1446,7 @@ internal sealed class McpDiscoverRequest
 
 /// <summary>Outcome of an mcp.planInstall call: either a normalised plan, or one typed refusal. Nothing is written in either case.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -1438,7 +1472,7 @@ public partial class McpPlanInstallResult
 
 
 /// <summary>The protocol version and capability set the runtime actually honoured for a successful catalog operation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CatalogNegotiatedContract
 {
     /// <summary>Wire features the runtime understood for this operation. Includes the five original catalog capabilities and only explicitly requested supported additions, in supported order without duplicates. Capabilities that introduce new success-union variants or operations are therefore included only when explicitly required, preserving older protocol-v3 clients. Always a superset of the caller's required features, because any shortfall is a refusal instead. Operation availability remains a separate typed result.</summary>
@@ -1451,7 +1485,7 @@ public sealed class CatalogNegotiatedContract
 }
 
 /// <summary>The configuration-change alternative for the transportChoices entry at the same index. Only the selected alternative is applied; entries are not cumulative. The payload stays behind the runtime boundary.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpPlanConfigurationChange
 {
     /// <summary>Names of the configuration fields the change would set, without their values.</summary>
@@ -1478,7 +1512,7 @@ public sealed class McpPlanConfigurationChange
 }
 
 /// <summary>Normalised identity of the MCP server a plan targets, independent of how the card spelled it.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpPlanResourceIdentity
 {
     /// <summary>Canonical, normalised name of the server, for example `io.github.owner/server`.</summary>
@@ -1503,7 +1537,7 @@ public sealed class McpPlanResourceIdentity
 }
 
 /// <summary>Outcome of evaluating the planned server against registry and enterprise policy. Evaluation is read-only.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpPlanPolicyResult
 {
     /// <summary>What policy decided for this server.</summary>
@@ -1522,7 +1556,7 @@ public sealed class McpPlanPolicyResult
 }
 
 /// <summary>Semantic digest of a strictly parsed and schema-validated JSON MCP card. Both URL-backed and embedded cards are canonicalised with RFC 8785 JSON Canonicalization Scheme, encoded as UTF-8, and hashed with SHA-256.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CardDigest
 {
     /// <summary>Digest algorithm and canonical representation.</summary>
@@ -1539,7 +1573,7 @@ public sealed class CardDigest
 }
 
 /// <summary>Provenance of the exact validated JSON MCP card content bound privately to a completed plan and its opaque handle.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpPlanProvenance
 {
     /// <summary>Authority associated with the validated card, without path, query, or credentials. Inert untrusted data.</summary>
@@ -1562,7 +1596,7 @@ public sealed class McpPlanProvenance
 }
 
 /// <summary>Where a plan would be written.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpPlanTarget
 {
     /// <summary>Configuration key the server would be recorded under within that scope.</summary>
@@ -1578,7 +1612,7 @@ public sealed class McpPlanTarget
 
 /// <summary>One eligible way to run the server, represented as a tagged package or remote variant so package identity and endpoint states cannot contradict the install method.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>installMethod</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "installMethod",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -1594,7 +1628,7 @@ public partial class McpPlanTransportChoice
 
 /// <summary>One non-secret value a transport choice needs, represented as a scalar or enumerated variant so enum values cannot be missing or attached to another type.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -1610,7 +1644,7 @@ public partial class McpPlanRequiredValue
 
 /// <summary>One non-secret scalar value a transport choice needs before it can be applied.</summary>
 /// <remarks>The <c>scalar</c> variant of <see cref="McpPlanRequiredValue"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanRequiredValueScalar : McpPlanRequiredValue
 {
     /// <inheritdoc />
@@ -1661,7 +1695,7 @@ public partial class McpPlanRequiredValueScalar : McpPlanRequiredValue
 
 /// <summary>One enumerated non-secret value a transport choice needs before it can be applied. The permitted values are structurally required.</summary>
 /// <remarks>The <c>enum</c> variant of <see cref="McpPlanRequiredValue"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanRequiredValueEnum : McpPlanRequiredValue
 {
     /// <inheritdoc />
@@ -1715,7 +1749,7 @@ public partial class McpPlanRequiredValueEnum : McpPlanRequiredValue
 }
 
 /// <summary>A secret a transport choice needs, referenced by placeholder. No secret value ever appears in a plan, and the placeholder resolves against the keychain only when a plan is applied.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpPlanSecretPlaceholder
 {
     /// <summary>Key the secret is supplied under. Inert untrusted data.</summary>
@@ -1737,7 +1771,7 @@ public sealed class McpPlanSecretPlaceholder
 
 /// <summary>An eligible local-package transport choice. Package identity is required and a remote endpoint cannot be represented.</summary>
 /// <remarks>The <c>package</c> variant of <see cref="McpPlanTransportChoice"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanTransportChoicePackage : McpPlanTransportChoice
 {
     /// <inheritdoc />
@@ -1780,7 +1814,7 @@ public partial class McpPlanTransportChoicePackage : McpPlanTransportChoice
 
 /// <summary>An eligible remote-endpoint transport choice. The endpoint is required and package identity cannot be represented.</summary>
 /// <remarks>The <c>remote</c> variant of <see cref="McpPlanTransportChoice"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanTransportChoiceRemote : McpPlanTransportChoice
 {
     /// <inheritdoc />
@@ -1815,7 +1849,7 @@ public partial class McpPlanTransportChoiceRemote : McpPlanTransportChoice
 }
 
 /// <summary>A normalised, inert description of what installing an MCP server would involve. Carries no raw card, no install specification, and no secret value.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpInstallPlan
 {
     /// <summary>Alternative configuration changes, with exactly one entry for each transportChoices entry in the same order. Only the entry for the subsequently selected transport applies; these are not cumulative writes. Payloads remain behind the runtime boundary.</summary>
@@ -1867,7 +1901,7 @@ public sealed class McpInstallPlan
 
 /// <summary>A computed MCP install plan. Nothing has been applied: the plan describes what installing would change, and the plan handle is what a later apply operation would consume.</summary>
 /// <remarks>The <c>planned</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultPlanned : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -1885,7 +1919,7 @@ public partial class McpPlanInstallResultPlanned : McpPlanInstallResult
 
 /// <summary>The caller's protocol version or required capabilities cannot be honoured. Returned instead of a partial or ambiguous success.</summary>
 /// <remarks>The <c>negotiation-refused</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultNegotiationRefused : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -1921,7 +1955,7 @@ public partial class McpPlanInstallResultNegotiationRefused : McpPlanInstallResu
 
 /// <summary>A presented handle was not accepted. Handles are runtime-instance scoped, TTL-bound, and single-use, so each way of failing is reported distinctly.</summary>
 /// <remarks>The <c>handle-rejected</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultHandleRejected : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -1945,7 +1979,7 @@ public partial class McpPlanInstallResultHandleRejected : McpPlanInstallResult
 
 /// <summary>The request was rejected because a bounded field fell outside its permitted range or a required field was unusable. Pagination may also be rejected by the authority after a continuation request; repeat the search without page.</summary>
 /// <remarks>The <c>invalid-request</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultInvalidRequest : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -1965,7 +1999,7 @@ public partial class McpPlanInstallResultInvalidRequest : McpPlanInstallResult
 
 /// <summary>An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.</summary>
 /// <remarks>The <c>authentication-required</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultAuthenticationRequired : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -1985,7 +2019,7 @@ public partial class McpPlanInstallResultAuthenticationRequired : McpPlanInstall
 
 /// <summary>Registry or enterprise policy refused the operation.</summary>
 /// <remarks>The <c>policy-rejected</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultPolicyRejected : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -2005,7 +2039,7 @@ public partial class McpPlanInstallResultPolicyRejected : McpPlanInstallResult
 
 /// <summary>The runtime could not reach the catalog authority or retrieve a card. Covers being offline as well as transport-level failure.</summary>
 /// <remarks>The <c>network-failure</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultNetworkFailure : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -2035,7 +2069,7 @@ public partial class McpPlanInstallResultNetworkFailure : McpPlanInstallResult
 
 /// <summary>Retrieval was refused by the runtime's hardened fetch boundary before any request left the process, or before a redirect was followed.</summary>
 /// <remarks>The <c>unsafe-retrieval</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultUnsafeRetrieval : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -2055,7 +2089,7 @@ public partial class McpPlanInstallResultUnsafeRetrieval : McpPlanInstallResult
 
 /// <summary>A card could not be parsed or did not satisfy its declared media type's schema.</summary>
 /// <remarks>The <c>malformed-card</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultMalformedCard : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -2080,7 +2114,7 @@ public partial class McpPlanInstallResultMalformedCard : McpPlanInstallResult
 
 /// <summary>An upstream catalog response broke the wire contract. Most importantly, every result must carry exactly one of a URL or embedded data: a result carrying both, or neither, is refused here rather than being guessed at.</summary>
 /// <remarks>The <c>contract-violation</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultContractViolation : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -2100,7 +2134,7 @@ public partial class McpPlanInstallResultContractViolation : McpPlanInstallResul
 
 /// <summary>No transport this runtime can use is available for the requested server.</summary>
 /// <remarks>The <c>unavailable-transport</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultUnavailableTransport : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -2120,7 +2154,7 @@ public partial class McpPlanInstallResultUnavailableTransport : McpPlanInstallRe
 
 /// <summary>The candidate is discoverable but cannot be installed. `application/ai-skill` resolves here, because it stays searchable while remaining typed non-installable.</summary>
 /// <remarks>The <c>not-installable</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultNotInstallable : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -2140,7 +2174,7 @@ public partial class McpPlanInstallResultNotInstallable : McpPlanInstallResult
 
 /// <summary>The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.</summary>
 /// <remarks>The <c>unavailable</c> variant of <see cref="McpPlanInstallResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallResultUnavailable : McpPlanInstallResult
 {
     /// <inheritdoc />
@@ -2159,7 +2193,7 @@ public partial class McpPlanInstallResultUnavailable : McpPlanInstallResult
 }
 
 /// <summary>The protocol version and capability set a caller requires, supplied on every catalog request so negotiation cannot be skipped by omission.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CatalogClientContract
 {
     /// <summary>SDK protocol version the caller was generated against. A caller below the runtime's minimum supported version is refused rather than served a partial result.</summary>
@@ -2173,7 +2207,7 @@ public sealed class CatalogClientContract
 
 /// <summary>What an install plan is computed from: a candidate handle from a previous search, or a card supplied directly.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -2189,7 +2223,7 @@ public partial class McpPlanInstallSource
 
 /// <summary>Plan from a candidate returned by a previous catalog search.</summary>
 /// <remarks>The <c>candidate</c> variant of <see cref="McpPlanInstallSource"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallSourceCandidate : McpPlanInstallSource
 {
     /// <inheritdoc />
@@ -2213,7 +2247,7 @@ public partial class McpPlanInstallSourceCandidate : McpPlanInstallSource
 
 /// <summary>A card supplied directly by the caller. Exactly one of a URL or embedded data, encoded structurally so neither both nor neither can be expressed.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -2229,7 +2263,7 @@ public partial class McpServerCardReference
 
 /// <summary>An MCP server card to be retrieved from a URL through the runtime's hardened fetch boundary.</summary>
 /// <remarks>The <c>url</c> variant of <see cref="McpServerCardReference"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpServerCardReferenceUrl : McpServerCardReference
 {
     /// <inheritdoc />
@@ -2250,7 +2284,7 @@ public partial class McpServerCardReferenceUrl : McpServerCardReference
 
 /// <summary>An MCP server card supplied inline as an inert document.</summary>
 /// <remarks>The <c>embedded</c> variant of <see cref="McpServerCardReference"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpServerCardReferenceEmbedded : McpServerCardReference
 {
     /// <inheritdoc />
@@ -2271,7 +2305,7 @@ public partial class McpServerCardReferenceEmbedded : McpServerCardReference
 
 /// <summary>Plan from a card supplied directly by the caller, without a preceding search.</summary>
 /// <remarks>The <c>card</c> variant of <see cref="McpPlanInstallSource"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpPlanInstallSourceCard : McpPlanInstallSource
 {
     /// <inheritdoc />
@@ -2284,7 +2318,7 @@ public partial class McpPlanInstallSourceCard : McpPlanInstallSource
 }
 
 /// <summary>A side-effect-free request for an MCP install plan. Computing a plan never writes configuration, stores a secret, or reloads MCP servers.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpPlanInstallRequest
 {
     /// <summary>Protocol version and capabilities the caller requires.</summary>
@@ -2301,7 +2335,7 @@ internal sealed class McpPlanInstallRequest
 }
 
 /// <summary>User-configured MCP servers, keyed by server name.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpConfigList
 {
     /// <summary>All MCP servers from user config, keyed by name.</summary>
@@ -2310,7 +2344,7 @@ public sealed class McpConfigList
 }
 
 /// <summary>MCP server name and configuration to add to user configuration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpConfigAddRequest
 {
     /// <summary>MCP server configuration (stdio process or remote HTTP/SSE).</summary>
@@ -2326,7 +2360,7 @@ internal sealed class McpConfigAddRequest
 }
 
 /// <summary>MCP server name and replacement configuration to write to user configuration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpConfigUpdateRequest
 {
     /// <summary>MCP server configuration (stdio process or remote HTTP/SSE).</summary>
@@ -2342,7 +2376,7 @@ internal sealed class McpConfigUpdateRequest
 }
 
 /// <summary>MCP server name to remove from user configuration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpConfigRemoveRequest
 {
     /// <summary>OAuth Client ID Metadata Document URL whose persisted credentials should also be removed.</summary>
@@ -2358,7 +2392,7 @@ internal sealed class McpConfigRemoveRequest
 }
 
 /// <summary>MCP server names to enable for new sessions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpConfigEnableRequest
 {
     /// <summary>Names of MCP servers to enable. Each server is removed from the persisted disabled list so new sessions spawn it. Unknown or already-enabled names are ignored.</summary>
@@ -2367,7 +2401,7 @@ internal sealed class McpConfigEnableRequest
 }
 
 /// <summary>MCP server names to disable for new sessions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpConfigDisableRequest
 {
     /// <summary>Names of MCP servers to disable. Each server is added to the persisted disabled list so new sessions skip it. Already-disabled names are ignored. Active sessions keep their current connections until they end.</summary>
@@ -2376,7 +2410,7 @@ internal sealed class McpConfigDisableRequest
 }
 
 /// <summary>Installed plugin that contributes a discovered extension.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DiscoveredExtensionPlugin
 {
     /// <summary>Installed plugin name.</summary>
@@ -2385,7 +2419,7 @@ public sealed class DiscoveredExtensionPlugin
 }
 
 /// <summary>Discovered extension metadata and persistent enablement state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DiscoveredExtension
 {
     /// <summary>Whether this extension's persistent per-ID preference is enabled.</summary>
@@ -2414,7 +2448,7 @@ public sealed class DiscoveredExtension
 }
 
 /// <summary>Extensions discovered from persisted Copilot home state and their effective loading mode. Launch-scoped additional plugins are not included.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DiscoveredExtensions
 {
     /// <summary>Discovered user and enabled installed-plugin extensions from persisted Copilot home state.</summary>
@@ -2427,7 +2461,7 @@ public sealed class DiscoveredExtensions
 }
 
 /// <summary>Source-qualified extension identifiers to persistently enable for future sessions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class DiscoveredExtensionsEnableRequest
 {
     /// <summary>Source-qualified user or plugin extension IDs to enable.</summary>
@@ -2436,7 +2470,7 @@ internal sealed class DiscoveredExtensionsEnableRequest
 }
 
 /// <summary>Source-qualified extension identifiers to persistently disable for future sessions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class DiscoveredExtensionsDisableRequest
 {
     /// <summary>Source-qualified user or plugin extension IDs to disable.</summary>
@@ -2446,7 +2480,7 @@ internal sealed class DiscoveredExtensionsDisableRequest
 
 /// <summary>Outcome of a catalog.search call: either bounded inert candidates, or one typed refusal. Never a partial success.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -2471,7 +2505,7 @@ public partial class CatalogSearchResult
 
 /// <summary>One inert catalog result, represented as an MCP server, discovery-only AI skill, or opt-in Agent Plugin variant so kind, media type, provenance, and available operations cannot contradict each other.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -2487,7 +2521,7 @@ public partial class CatalogCandidate
 
 
 /// <summary>Where and when an MCP server catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CatalogMcpServerCandidateProvenance
 {
     /// <summary>Host of the catalog authority that advertised the reference, without path, query, or credentials. Inert untrusted data.</summary>
@@ -2507,7 +2541,7 @@ public sealed class CatalogMcpServerCandidateProvenance
 
 /// <summary>Where a candidate's card came from. Exactly one of a URL or embedded data: the union has no variant carrying both, and no variant carrying neither, so the rule holds structurally rather than by validation.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -2523,7 +2557,7 @@ public partial class CatalogCandidateSource
 
 /// <summary>Candidate whose card is retrieved from a URL through the runtime's hardened fetch boundary.</summary>
 /// <remarks>The <c>url</c> variant of <see cref="CatalogCandidateSource"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogCandidateSourceUrl : CatalogCandidateSource
 {
     /// <inheritdoc />
@@ -2539,7 +2573,7 @@ public partial class CatalogCandidateSourceUrl : CatalogCandidateSource
 
 /// <summary>Candidate whose card reference arrived inline. The document and its content-derived properties stay behind the runtime boundary.</summary>
 /// <remarks>The <c>embedded</c> variant of <see cref="CatalogCandidateSource"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogCandidateSourceEmbedded : CatalogCandidateSource
 {
     /// <inheritdoc />
@@ -2549,7 +2583,7 @@ public partial class CatalogCandidateSourceEmbedded : CatalogCandidateSource
 
 /// <summary>A versioned, bounded trust observation carried unchanged with a catalog candidate and its private handle context. Current observations require a recognised T1/T2 tier; every non-current state structurally forbids a tier. Eligibility remains `unknown` while Agent Finder supplies no exposure decision, and states absent from its current wire are never inferred from age, relevance, popularity, or a tier transition.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>status</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "status",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -2569,7 +2603,7 @@ public partial class CatalogTrustSnapshot
 
 
 /// <summary>Where and when the runtime observed the trust metadata. Observation time is not the authority's evaluation time and must not be used to infer staleness.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CatalogTrustProvenance
 {
     /// <summary>ISO 8601 timestamp with a timezone offset at which the runtime observed the search result carrying this trust field.</summary>
@@ -2586,7 +2620,7 @@ public sealed class CatalogTrustProvenance
 
 /// <summary>A recognised current Agent Finder T1 or T2 trust tier.</summary>
 /// <remarks>The <c>current</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogTrustSnapshotCurrent : CatalogTrustSnapshot
 {
     /// <inheritdoc />
@@ -2612,7 +2646,7 @@ public partial class CatalogTrustSnapshotCurrent : CatalogTrustSnapshot
 
 /// <summary>Discriminator: the authority omitted trust metadata.</summary>
 /// <remarks>The <c>absent</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogTrustSnapshotAbsent : CatalogTrustSnapshot
 {
     /// <inheritdoc />
@@ -2634,7 +2668,7 @@ public partial class CatalogTrustSnapshotAbsent : CatalogTrustSnapshot
 
 /// <summary>Discriminator: the authority explicitly marked the assessment stale.</summary>
 /// <remarks>The <c>stale</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogTrustSnapshotStale : CatalogTrustSnapshot
 {
     /// <inheritdoc />
@@ -2656,7 +2690,7 @@ public partial class CatalogTrustSnapshotStale : CatalogTrustSnapshot
 
 /// <summary>Discriminator: the authority explicitly reported a downgraded assessment.</summary>
 /// <remarks>The <c>downgraded</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogTrustSnapshotDowngraded : CatalogTrustSnapshot
 {
     /// <inheritdoc />
@@ -2678,7 +2712,7 @@ public partial class CatalogTrustSnapshotDowngraded : CatalogTrustSnapshot
 
 /// <summary>Discriminator: the authority explicitly revoked the assessment.</summary>
 /// <remarks>The <c>revoked</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogTrustSnapshotRevoked : CatalogTrustSnapshot
 {
     /// <inheritdoc />
@@ -2700,7 +2734,7 @@ public partial class CatalogTrustSnapshotRevoked : CatalogTrustSnapshot
 
 /// <summary>Discriminator: the authority supplied a bounded trust value this runtime does not understand.</summary>
 /// <remarks>The <c>unsupported</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogTrustSnapshotUnsupported : CatalogTrustSnapshot
 {
     /// <inheritdoc />
@@ -2722,7 +2756,7 @@ public partial class CatalogTrustSnapshotUnsupported : CatalogTrustSnapshot
 
 /// <summary>Discriminator: the trust field was empty, unbounded, or had the wrong JSON type.</summary>
 /// <remarks>The <c>malformed</c> variant of <see cref="CatalogTrustSnapshot"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogTrustSnapshotMalformed : CatalogTrustSnapshot
 {
     /// <inheritdoc />
@@ -2744,7 +2778,7 @@ public partial class CatalogTrustSnapshotMalformed : CatalogTrustSnapshot
 
 /// <summary>An inert MCP server catalog result. Every free-text field is untrusted external data and must never be treated as an instruction, and the handle is the only way to refer to the candidate in a later operation.</summary>
 /// <remarks>The <c>mcp-server</c> variant of <see cref="CatalogCandidate"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogCandidateMcpServer : CatalogCandidate
 {
     /// <inheritdoc />
@@ -2804,7 +2838,7 @@ public partial class CatalogCandidateMcpServer : CatalogCandidate
 }
 
 /// <summary>Where and when an AI skill catalog reference was observed. Discovery provenance deliberately carries no content digest because search does not establish the exact validated content a later plan will bind.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CatalogAiSkillCandidateProvenance
 {
     /// <summary>Host of the catalog authority that advertised the reference, without path, query, or credentials. Inert untrusted data.</summary>
@@ -2824,7 +2858,7 @@ public sealed class CatalogAiSkillCandidateProvenance
 
 /// <summary>An inert AI skill catalog result. AI skills are discovery-only and cannot be represented as installable through this surface.</summary>
 /// <remarks>The <c>ai-skill</c> variant of <see cref="CatalogCandidate"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogCandidateAiSkill : CatalogCandidate
 {
     /// <inheritdoc />
@@ -2884,7 +2918,7 @@ public partial class CatalogCandidateAiSkill : CatalogCandidate
 }
 
 /// <summary>Where and when an Agent Plugin catalog reference was observed. Discovery provenance deliberately carries no descriptor URL, raw data, candidate handle, or content digest.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CatalogAgentPluginCandidateProvenance
 {
     /// <summary>Host of the catalog authority that advertised the reference, without path, query, or credentials. Inert untrusted data.</summary>
@@ -2903,7 +2937,7 @@ public sealed class CatalogAgentPluginCandidateProvenance
 }
 
 /// <summary>Syntactically validated GitHub repository provenance declared by catalog metadata. This is a source claim rather than proof that the descriptor URL resolves to the repository.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CatalogPluginRepositorySource
 {
     /// <summary>Case-preserving safe relative POSIX path derived from metadata.repoPath.</summary>
@@ -2924,7 +2958,7 @@ public sealed class CatalogPluginRepositorySource
 
 /// <summary>An inert Agent Plugin catalog result. Its canonical catalog identity, declared version, repository source claim, and explicit compatibility tags are safe to correlate, while its descriptor, URL, raw data, and installed-plugin state remain runtime-private. This contract-only variant does not mint or expose a candidate handle.</summary>
 /// <remarks>The <c>plugin</c> variant of <see cref="CatalogCandidate"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogCandidatePlugin : CatalogCandidate
 {
     /// <inheritdoc />
@@ -2983,7 +3017,7 @@ public partial class CatalogCandidatePlugin : CatalogCandidate
 }
 
 /// <summary>Authority-reported navigation metadata, returned only to callers requiring catalog-search-pagination and only when a supported token is present. Tokenless first-page and continuation responses omit this object; no counts are inferred from candidates. The opaque token may be retained for previous or numbered navigation even when hasNextPage is false.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CatalogSearchPagination
 {
     /// <summary>One-based page returned by the authority.</summary>
@@ -3024,7 +3058,7 @@ public sealed class CatalogSearchPagination
 
 /// <summary>A completed catalog search containing inert candidate summaries. MCP server and AI skill variants carry a single-use handle; the Agent Plugin variant is handleless.</summary>
 /// <remarks>The <c>succeeded</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultSucceeded : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3058,7 +3092,7 @@ public partial class CatalogSearchResultSucceeded : CatalogSearchResult
 
 /// <summary>The caller's protocol version or required capabilities cannot be honoured. Returned instead of a partial or ambiguous success.</summary>
 /// <remarks>The <c>negotiation-refused</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultNegotiationRefused : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3094,7 +3128,7 @@ public partial class CatalogSearchResultNegotiationRefused : CatalogSearchResult
 
 /// <summary>The request asked for a candidate kind this runtime does not serve.</summary>
 /// <remarks>The <c>unsupported-kind</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultUnsupportedKind : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3118,7 +3152,7 @@ public partial class CatalogSearchResultUnsupportedKind : CatalogSearchResult
 
 /// <summary>The request was rejected because a bounded field fell outside its permitted range or a required field was unusable. Pagination may also be rejected by the authority after a continuation request; repeat the search without page.</summary>
 /// <remarks>The <c>invalid-request</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultInvalidRequest : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3138,7 +3172,7 @@ public partial class CatalogSearchResultInvalidRequest : CatalogSearchResult
 
 /// <summary>An optional catalog authentication exchange did not establish the caller's identity. Anonymous search remains supported; this refusal is reserved for an operation that cannot continue after the attempted exchange. It is distinct from `policy-rejected` and from a network failure, and the reason identifies the recovery action.</summary>
 /// <remarks>The <c>authentication-required</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultAuthenticationRequired : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3158,7 +3192,7 @@ public partial class CatalogSearchResultAuthenticationRequired : CatalogSearchRe
 
 /// <summary>Registry or enterprise policy refused the operation.</summary>
 /// <remarks>The <c>policy-rejected</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultPolicyRejected : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3178,7 +3212,7 @@ public partial class CatalogSearchResultPolicyRejected : CatalogSearchResult
 
 /// <summary>The runtime could not reach the catalog authority or retrieve a card. Covers being offline as well as transport-level failure.</summary>
 /// <remarks>The <c>network-failure</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultNetworkFailure : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3208,7 +3242,7 @@ public partial class CatalogSearchResultNetworkFailure : CatalogSearchResult
 
 /// <summary>Retrieval was refused by the runtime's hardened fetch boundary before any request left the process, or before a redirect was followed.</summary>
 /// <remarks>The <c>unsafe-retrieval</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultUnsafeRetrieval : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3228,7 +3262,7 @@ public partial class CatalogSearchResultUnsafeRetrieval : CatalogSearchResult
 
 /// <summary>A card could not be parsed or did not satisfy its declared media type's schema.</summary>
 /// <remarks>The <c>malformed-card</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultMalformedCard : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3253,7 +3287,7 @@ public partial class CatalogSearchResultMalformedCard : CatalogSearchResult
 
 /// <summary>An upstream catalog response broke the wire contract. Most importantly, every result must carry exactly one of a URL or embedded data: a result carrying both, or neither, is refused here rather than being guessed at.</summary>
 /// <remarks>The <c>contract-violation</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultContractViolation : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3273,7 +3307,7 @@ public partial class CatalogSearchResultContractViolation : CatalogSearchResult
 
 /// <summary>The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.</summary>
 /// <remarks>The <c>unavailable</c> variant of <see cref="CatalogSearchResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSearchResultUnavailable : CatalogSearchResult
 {
     /// <inheritdoc />
@@ -3292,7 +3326,7 @@ public partial class CatalogSearchResultUnavailable : CatalogSearchResult
 }
 
 /// <summary>An explicit numbered-page request. The SDK treats the token as opaque; only the runtime decodes it and changes its targetPage. Authority validation binds navigation to the original search. No snapshot stability or token TTL is promised.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CatalogSearchPage
 {
     /// <summary>Requested one-based page. Must not exceed either the token's signed pageCount or the navigation window ceil(1000 / pageSize). Repeat the search without page to discover newly available pages beyond that signed pageCount.</summary>
@@ -3308,7 +3342,7 @@ public sealed class CatalogSearchPage
 }
 
 /// <summary>A bounded catalog search. Both the query length and the result count are capped by the schema so a caller cannot request an unbounded scan.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CatalogSearchRequest
 {
     /// <summary>Protocol version and capabilities the caller requires.</summary>
@@ -3338,7 +3372,7 @@ internal sealed class CatalogSearchRequest
 
 /// <summary>Typed outcome of catalog.select. Only the selected host result carries a fresh candidate handle; the model-facing projection removes both that handle and searchId.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -3364,7 +3398,7 @@ public partial class CatalogSelectionResult
 
 /// <summary>The chosen candidate was transferred into a fresh bounded single-use handle for a later explicit planning request.</summary>
 /// <remarks>The <c>selected</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultSelected : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3388,7 +3422,7 @@ public partial class CatalogSelectionResultSelected : CatalogSelectionResult
 
 /// <summary>The caller explicitly declined every candidate and the retained search state was released.</summary>
 /// <remarks>The <c>declined</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultDeclined : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3405,7 +3439,7 @@ public partial class CatalogSelectionResultDeclined : CatalogSelectionResult
 
 /// <summary>The caller cancelled the selection interaction and the retained search state was released.</summary>
 /// <remarks>The <c>cancelled</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultCancelled : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3422,7 +3456,7 @@ public partial class CatalogSelectionResultCancelled : CatalogSelectionResult
 
 /// <summary>The host declared that its live selection interaction timed out, and the retained search state was released.</summary>
 /// <remarks>The <c>timed-out</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultTimedOut : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3439,7 +3473,7 @@ public partial class CatalogSelectionResultTimedOut : CatalogSelectionResult
 
 /// <summary>The selection reference was malformed or unknown.</summary>
 /// <remarks>The <c>invalid</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultInvalid : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3455,7 +3489,7 @@ public partial class CatalogSelectionResultInvalid : CatalogSelectionResult
 
 /// <summary>The runtime-enforced selection reference lifetime elapsed before the request arrived.</summary>
 /// <remarks>The <c>stale</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultStale : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3471,7 +3505,7 @@ public partial class CatalogSelectionResultStale : CatalogSelectionResult
 
 /// <summary>The selection group was already terminated or its pending host hand-off was already claimed.</summary>
 /// <remarks>The <c>replayed</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultReplayed : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3487,7 +3521,7 @@ public partial class CatalogSelectionResultReplayed : CatalogSelectionResult
 
 /// <summary>The selection reference belongs to another runtime instance or session.</summary>
 /// <remarks>The <c>foreign</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultForeign : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3503,7 +3537,7 @@ public partial class CatalogSelectionResultForeign : CatalogSelectionResult
 
 /// <summary>The presented opaque handle was issued for another catalog operation.</summary>
 /// <remarks>The <c>wrong-kind</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultWrongKind : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3519,7 +3553,7 @@ public partial class CatalogSelectionResultWrongKind : CatalogSelectionResult
 
 /// <summary>The caller's protocol version or required capabilities cannot be honoured. Returned instead of a partial or ambiguous success.</summary>
 /// <remarks>The <c>negotiation-refused</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultNegotiationRefused : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3555,7 +3589,7 @@ public partial class CatalogSelectionResultNegotiationRefused : CatalogSelection
 
 /// <summary>The request was rejected because a bounded field fell outside its permitted range or a required field was unusable. Pagination may also be rejected by the authority after a continuation request; repeat the search without page.</summary>
 /// <remarks>The <c>invalid-request</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultInvalidRequest : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3575,7 +3609,7 @@ public partial class CatalogSelectionResultInvalidRequest : CatalogSelectionResu
 
 /// <summary>The operation is not available on this runtime. Distinct from a network failure: nothing was attempted.</summary>
 /// <remarks>The <c>unavailable</c> variant of <see cref="CatalogSelectionResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class CatalogSelectionResultUnavailable : CatalogSelectionResult
 {
     /// <inheritdoc />
@@ -3594,7 +3628,7 @@ public partial class CatalogSelectionResultUnavailable : CatalogSelectionResult
 }
 
 /// <summary>Terminates one retained catalog selection group through an opaque reference previously returned by the model-safe search projection.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CatalogSelectionRequest
 {
     /// <summary>Protocol version and capabilities the caller requires.</summary>
@@ -3621,7 +3655,7 @@ internal sealed class CatalogSelectionRequest
 }
 
 /// <summary>Information about an installed plugin tracked in global state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class InstalledPluginInfo
 {
     /// <summary>Opaque, stable hash identifying a direct (non-marketplace) install source. Present only for direct repo / URL / local installs; absent for marketplace plugins. Same source yields the same id; distinct sources never collide.</summary>
@@ -3666,7 +3700,7 @@ public sealed class InstalledPluginInfo
 }
 
 /// <summary>Plugins installed in user/global state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PluginListResult
 {
     /// <summary>Installed plugins.</summary>
@@ -3675,7 +3709,7 @@ public sealed class PluginListResult
 }
 
 /// <summary>Result of installing a plugin.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PluginInstallResult
 {
     /// <summary>Set when the install path is deprecated (e.g. direct repo / URL / local installs). Callers should surface this to end users.</summary>
@@ -3700,7 +3734,7 @@ public sealed class PluginInstallResult
 }
 
 /// <summary>Plugin source and optional working directory for relative-path resolution.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsInstallRequest
 {
     /// <summary>Plugin install spec. Accepts the same forms as the CLI: "plugin@marketplace" (marketplace install), "owner/repo" or "owner/repo:subpath" (GitHub direct), an http/https/ssh URL, or a local path. Direct (non-marketplace) installs are deprecated and will produce a deprecationWarning in the result.</summary>
@@ -3713,7 +3747,7 @@ internal sealed class PluginsInstallRequest
 }
 
 /// <summary>Name (or spec) of the plugin to uninstall.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsUninstallRequest
 {
     /// <summary>Stable source identity for a direct (non-marketplace) install. Disambiguates uninstall when multiple installed plugins share the same name.</summary>
@@ -3726,7 +3760,7 @@ internal sealed class PluginsUninstallRequest
 }
 
 /// <summary>Result of updating a single plugin.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PluginUpdateResult
 {
     /// <summary>Version after the update, when reported by the plugin manifest.</summary>
@@ -3743,7 +3777,7 @@ public sealed class PluginUpdateResult
 }
 
 /// <summary>Name (or spec) of the plugin to update.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsUpdateRequest
 {
     /// <summary>Plugin name or "plugin@marketplace" spec to update.</summary>
@@ -3752,7 +3786,7 @@ internal sealed class PluginsUpdateRequest
 }
 
 /// <summary>Per-plugin result from updating all plugins, with versions, skills installed, success flag, and optional error.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PluginUpdateAllEntry
 {
     /// <summary>Error message (failure only).</summary>
@@ -3785,7 +3819,7 @@ public sealed class PluginUpdateAllEntry
 }
 
 /// <summary>Result of updating all installed plugins.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PluginUpdateAllResult
 {
     /// <summary>Per-plugin update results in deterministic order.</summary>
@@ -3794,7 +3828,7 @@ public sealed class PluginUpdateAllResult
 }
 
 /// <summary>Plugin names (or specs) to enable, plus the optional working directory the repository-controlled guard is evaluated against.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsEnableRequest
 {
     /// <summary>Plugin names or "plugin@marketplace" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API.</summary>
@@ -3807,7 +3841,7 @@ internal sealed class PluginsEnableRequest
 }
 
 /// <summary>Plugin names (or specs) to disable, plus the optional working directory the repository-controlled guard is evaluated against.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsDisableRequest
 {
     /// <summary>Plugin names or "plugin@marketplace" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins.</summary>
@@ -3820,7 +3854,7 @@ internal sealed class PluginsDisableRequest
 }
 
 /// <summary>Trusted built-in plugin directories to use for this runtime process.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsBuiltinSetRequest
 {
     /// <summary>Complete replacement set of trusted built-in plugin directories. Every entry must be an absolute local filesystem path no longer than 4096 characters.</summary>
@@ -3829,7 +3863,7 @@ internal sealed class PluginsBuiltinSetRequest
 }
 
 /// <summary>Registered marketplace summary.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MarketplaceInfo
 {
     /// <summary>Whether the managed marketplace currently resolved into the runtime marketplace registry. Set to false when the desired managed entry is retained for governance visibility after loading or reconciliation failed.</summary>
@@ -3854,7 +3888,7 @@ public sealed class MarketplaceInfo
 }
 
 /// <summary>All registered marketplaces, including built-in defaults.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MarketplaceListResult
 {
     /// <summary>Registered marketplaces.</summary>
@@ -3863,7 +3897,7 @@ public sealed class MarketplaceListResult
 }
 
 /// <summary>Result of registering a new marketplace.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MarketplaceAddResult
 {
     /// <summary>Final name of the marketplace as resolved from its manifest.</summary>
@@ -3872,7 +3906,7 @@ public sealed class MarketplaceAddResult
 }
 
 /// <summary>Marketplace source and optional working directory for relative-path resolution.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsMarketplacesAddRequest
 {
     /// <summary>Marketplace source. Accepts the same forms as the CLI: "owner/repo" or "owner/repo#ref" (GitHub), an http/https/ssh URL (optionally with #ref), a git scp-style URL (user@host:path), or a local path. The marketplace's own name (from its manifest) is used as the registration key.</summary>
@@ -3885,7 +3919,7 @@ internal sealed class PluginsMarketplacesAddRequest
 }
 
 /// <summary>Outcome of the remove attempt, including dependent-plugin info when applicable.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MarketplaceRemoveResult
 {
     /// <summary>Names of installed plugins that prevented removal. Populated only when `removed=false`.</summary>
@@ -3898,7 +3932,7 @@ public sealed class MarketplaceRemoveResult
 }
 
 /// <summary>Name of the marketplace to remove and an optional force flag.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsMarketplacesRemoveRequest
 {
     /// <summary>When true, also uninstall every plugin sourced from this marketplace. When false (default), removal is a no-op if any plugin from this marketplace is installed and the dependent plugin names are returned in the result.</summary>
@@ -3911,7 +3945,7 @@ internal sealed class PluginsMarketplacesRemoveRequest
 }
 
 /// <summary>Plugin entry advertised by a marketplace.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MarketplacePluginInfo
 {
     /// <summary>Short description from the marketplace catalog, when present.</summary>
@@ -3924,7 +3958,7 @@ public sealed class MarketplacePluginInfo
 }
 
 /// <summary>Plugins advertised by the marketplace.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MarketplaceBrowseResult
 {
     /// <summary>Plugins advertised by the marketplace.</summary>
@@ -3933,7 +3967,7 @@ public sealed class MarketplaceBrowseResult
 }
 
 /// <summary>Name of the marketplace whose plugin catalog to fetch.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsMarketplacesBrowseRequest
 {
     /// <summary>Marketplace name to browse.</summary>
@@ -3942,7 +3976,7 @@ internal sealed class PluginsMarketplacesBrowseRequest
 }
 
 /// <summary>Per-marketplace refresh result, including marketplace name, success flag, and optional failure error.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MarketplaceRefreshEntry
 {
     /// <summary>Error message (failure only).</summary>
@@ -3959,7 +3993,7 @@ public sealed class MarketplaceRefreshEntry
 }
 
 /// <summary>Result of refreshing one or more marketplace catalogs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MarketplaceRefreshResult
 {
     /// <summary>Per-marketplace refresh results in deterministic order.</summary>
@@ -3968,7 +4002,7 @@ public sealed class MarketplaceRefreshResult
 }
 
 /// <summary>RPC data type for PluginsMarketplacesRefresh operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsMarketplacesRefreshRequest
 {
     /// <summary>Marketplace name to refresh. When omitted, every registered marketplace is refreshed.</summary>
@@ -3977,7 +4011,7 @@ internal sealed class PluginsMarketplacesRefreshRequest
 }
 
 /// <summary>Server-side skill metadata, including name, description, source, enabled/invocable state, path, project path, and argument hint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerSkill
 {
     /// <summary>Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field.</summary>
@@ -4018,7 +4052,7 @@ public sealed class ServerSkill
 }
 
 /// <summary>Skills discovered across global and project sources.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerSkillList
 {
     /// <summary>Messages for skills that failed to load (e.g. malformed SKILL.md). Empty when host skills are excluded so host-local paths are not disclosed to multitenant callers.</summary>
@@ -4031,7 +4065,7 @@ public sealed class ServerSkillList
 }
 
 /// <summary>Optional project paths and additional skill directories to include in discovery.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SkillsDiscoverRequest
 {
     /// <summary>When true, omit skills from the host's global sources (personal, custom, plugin, and built-in), returning only project-scoped skills. For multitenant deployments.</summary>
@@ -4052,7 +4086,7 @@ internal sealed class SkillsDiscoverRequest
 }
 
 /// <summary>Canonical directory where skills can be discovered or created, with scope, preference, and optional project path.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SkillDiscoveryPath
 {
     /// <summary>Absolute path of the create/discovery target (may not exist on disk yet).</summary>
@@ -4073,7 +4107,7 @@ public sealed class SkillDiscoveryPath
 }
 
 /// <summary>Canonical locations where skills can be created so the runtime will recognize them.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SkillDiscoveryPathList
 {
     /// <summary>Canonical skill create/discovery directories, in priority order.</summary>
@@ -4082,7 +4116,7 @@ public sealed class SkillDiscoveryPathList
 }
 
 /// <summary>Optional project paths to enumerate.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SkillsGetDiscoveryPathsRequest
 {
     /// <summary>When true, omit the host's personal and custom skill directories, leaving only project directories. For multitenant deployments.</summary>
@@ -4099,7 +4133,7 @@ internal sealed class SkillsGetDiscoveryPathsRequest
 }
 
 /// <summary>Skill names to mark as disabled in global configuration, replacing any previous list.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SkillsConfigSetDisabledSkillsRequest
 {
     /// <summary>List of skill names to disable.</summary>
@@ -4108,7 +4142,7 @@ internal sealed class SkillsConfigSetDisabledSkillsRequest
 }
 
 /// <summary>Adds or removes a single skill from the global disabled list, leaving every other entry untouched.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SkillsConfigSetSkillDisabledRequest
 {
     /// <summary>True to disable the skill, false to enable it.</summary>
@@ -4121,7 +4155,7 @@ internal sealed class SkillsConfigSetSkillDisabledRequest
 }
 
 /// <summary>Agent metadata, including identifiers, display details, source, tools, model, models, reasoning effort, MCP servers, skills, and file path.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentInfo
 {
     /// <summary>Description of the agent's purpose.</summary>
@@ -4141,7 +4175,7 @@ public sealed class AgentInfo
     public string Id { get; set; } = string.Empty;
 
     /// <summary>MCP server configurations attached to this agent, keyed by server name. Server config shape mirrors the MCP `mcpServers` schema.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("mcpServers")]
     public IDictionary<string, JsonElement>? McpServers { get; set; }
 
@@ -4191,7 +4225,7 @@ public sealed class AgentInfo
 }
 
 /// <summary>Agents discovered across user, project, plugin, and remote sources.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerAgentList
 {
     /// <summary>All discovered agents across all sources.</summary>
@@ -4200,7 +4234,7 @@ public sealed class ServerAgentList
 }
 
 /// <summary>Optional project paths to include in agent discovery.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class AgentsDiscoverRequest
 {
     /// <summary>When true, omit the host's agents (the user-level agent directory and all plugin agents), leaving only project and remote agents. For multitenant deployments.</summary>
@@ -4213,7 +4247,7 @@ internal sealed class AgentsDiscoverRequest
 }
 
 /// <summary>Canonical directory where custom agents can be discovered or created, with scope, preference, and optional project path.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentDiscoveryPath
 {
     /// <summary>Absolute path of the search/create directory (may not exist on disk yet).</summary>
@@ -4234,7 +4268,7 @@ public sealed class AgentDiscoveryPath
 }
 
 /// <summary>Canonical locations where custom agents can be created so the runtime will recognize them.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentDiscoveryPathList
 {
     /// <summary>Canonical agent create/discovery directories, in priority order.</summary>
@@ -4243,7 +4277,7 @@ public sealed class AgentDiscoveryPathList
 }
 
 /// <summary>Optional project paths to include when enumerating agent discovery directories.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class AgentsGetDiscoveryPathsRequest
 {
     /// <summary>When true, omit the host's user-level agent directory, leaving only project directories. For multitenant deployments (mirrors `discover`'s `excludeHostAgents`).</summary>
@@ -4256,7 +4290,7 @@ internal sealed class AgentsGetDiscoveryPathsRequest
 }
 
 /// <summary>Loaded instruction source for a session, including path, content, category, location, applicability, and optional description.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class InstructionSource
 {
     /// <summary>Glob pattern(s) from frontmatter — when set, this instruction applies only to matching files.</summary>
@@ -4301,7 +4335,7 @@ public sealed class InstructionSource
 }
 
 /// <summary>Instruction sources discovered across user, repository, and plugin sources.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerInstructionSourceList
 {
     /// <summary>All discovered instruction sources.</summary>
@@ -4310,7 +4344,7 @@ public sealed class ServerInstructionSourceList
 }
 
 /// <summary>Optional project paths to include in instruction discovery.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class InstructionsDiscoverRequest
 {
     /// <summary>When true, omit the host's instruction sources (user/home-level files and plugin rules), leaving only repository and working-directory sources. For multitenant deployments.</summary>
@@ -4323,7 +4357,7 @@ internal sealed class InstructionsDiscoverRequest
 }
 
 /// <summary>Canonical file or directory where custom instructions can be discovered or created, with location, kind, preference, and project path.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class InstructionDiscoveryPath
 {
     /// <summary>Whether the target is a single file or a directory of instruction files.</summary>
@@ -4348,7 +4382,7 @@ public sealed class InstructionDiscoveryPath
 }
 
 /// <summary>Canonical files and directories where custom instructions can be created so the runtime will recognize them.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class InstructionDiscoveryPathList
 {
     /// <summary>Canonical instruction create/discovery files and directories, in priority order.</summary>
@@ -4357,7 +4391,7 @@ public sealed class InstructionDiscoveryPathList
 }
 
 /// <summary>Optional project paths to include when enumerating instruction discovery targets.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class InstructionsGetDiscoveryPathsRequest
 {
     /// <summary>When true, omit the host's user-level instruction targets, leaving only repository targets. For multitenant deployments (mirrors `discover`'s `excludeHostInstructions`).</summary>
@@ -4370,7 +4404,7 @@ internal sealed class InstructionsGetDiscoveryPathsRequest
 }
 
 /// <summary>A literal choice the command input accepts, with a human-facing description.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SlashCommandInputChoice
 {
     /// <summary>Human-readable description shown alongside the choice.</summary>
@@ -4383,7 +4417,7 @@ public sealed class SlashCommandInputChoice
 }
 
 /// <summary>Optional unstructured input hint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SlashCommandInput
 {
     /// <summary>Optional literal choices the input accepts, each with a human-facing description; clients may render these as selectable options.</summary>
@@ -4408,7 +4442,7 @@ public sealed class SlashCommandInput
 }
 
 /// <summary>Slash-command metadata with name, aliases, description, kind, input hint, execution allowance, and schedulability.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SlashCommandInfo
 {
     /// <summary>Canonical aliases without leading slashes.</summary>
@@ -4445,7 +4479,7 @@ public sealed class SlashCommandInfo
 }
 
 /// <summary>Slash commands available in the session, after applying any include/exclude filters.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CommandList
 {
     /// <summary>Commands available in this session.</summary>
@@ -4454,7 +4488,7 @@ public sealed class CommandList
 }
 
 /// <summary>A single user setting's effective value alongside its default, so consumers can render settings left at their default.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UserSettingMetadata
 {
     /// <summary>The centrally-known default for this setting (null when no default is registered).</summary>
@@ -4471,7 +4505,7 @@ public sealed class UserSettingMetadata
 }
 
 /// <summary>Per-key metadata for every known user setting (settings.json overlaid with the legacy config.json, config.json wins), including settings left at their default. Excludes repository- and enterprise-managed overrides.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UserSettingsGetResult
 {
     /// <summary>Every known user setting keyed by setting name, each with its effective value, default, and whether it is at the default.</summary>
@@ -4480,7 +4514,7 @@ public sealed class UserSettingsGetResult
 }
 
 /// <summary>Outcome of writing user settings.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UserSettingsSetResult
 {
     /// <summary>Top-level keys whose write landed in settings.json but is shadowed by a value still present in the legacy config.json (config.json wins on read). The write does not take effect until the legacy value is removed.</summary>
@@ -4489,7 +4523,7 @@ public sealed class UserSettingsSetResult
 }
 
 /// <summary>Partial user settings to write to settings.json. Each top-level key is written individually, replacing the existing value; a key whose value is null is removed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UserSettingsSetRequest
 {
     /// <summary>Partial user settings to write, as a free-form object keyed by setting name.</summary>
@@ -4498,7 +4532,7 @@ internal sealed class UserSettingsSetRequest
 }
 
 /// <summary>Validated device-managed settings discovered before a session exists.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ManagedSettingsReadResult
 {
     /// <summary>Discovery or validation error text when managed settings could not be read safely.</summary>
@@ -4511,7 +4545,7 @@ public sealed class ManagedSettingsReadResult
 }
 
 /// <summary>Indicates whether the calling client was registered as the session filesystem provider.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsSetProviderResult
 {
     /// <summary>Whether the provider was set successfully.</summary>
@@ -4520,7 +4554,7 @@ public sealed class SessionFsSetProviderResult
 }
 
 /// <summary>Optional capabilities declared by the provider.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsSetProviderCapabilities
 {
     /// <summary>Whether the provider supports SQLite query/exists operations.</summary>
@@ -4529,7 +4563,7 @@ public sealed class SessionFsSetProviderCapabilities
 }
 
 /// <summary>Initial working directory, session-state path layout, and path conventions used to register the calling SDK client as the session filesystem provider. A registered provider is authoritative for path interpretation and filesystem facts used by workspace permission validation. Paths are interpreted lexically; home-relative paths (`~` and `~/...`) and Windows drive-relative paths such as `C:foo` are unsupported. Until provider-side canonicalization is supported, providers must not expose symlinks inside allowed roots that escape those roots.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionFsSetProviderRequest
 {
     /// <summary>Optional capabilities declared by the provider.</summary>
@@ -4550,7 +4584,7 @@ internal sealed class SessionFsSetProviderRequest
 }
 
 /// <summary>Indicates whether the calling client was registered as the LLM inference provider.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LlmInferenceSetProviderResult
 {
     /// <summary>Whether the provider was set successfully.</summary>
@@ -4559,7 +4593,7 @@ public sealed class LlmInferenceSetProviderResult
 }
 
 /// <summary>Whether the start frame was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LlmInferenceHttpResponseStartResult
 {
     /// <summary>True when the response start was matched to a pending request; false when unknown.</summary>
@@ -4568,7 +4602,7 @@ public sealed class LlmInferenceHttpResponseStartResult
 }
 
 /// <summary>Response head.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class LlmInferenceHttpResponseStartRequest
 {
     /// <summary>HTTP response headers, preserving multiple values per name.</summary>
@@ -4589,7 +4623,7 @@ internal sealed class LlmInferenceHttpResponseStartRequest
 }
 
 /// <summary>Whether the chunk was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LlmInferenceHttpResponseChunkResult
 {
     /// <summary>True when the chunk was matched to a pending request; false when unknown.</summary>
@@ -4598,7 +4632,7 @@ public sealed class LlmInferenceHttpResponseChunkResult
 }
 
 /// <summary>Set to terminate the response with a transport-level failure. Implies end-of-stream; any further chunks for this requestId are ignored.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LlmInferenceHttpResponseChunkError
 {
     /// <summary>Optional machine-readable error code.</summary>
@@ -4611,7 +4645,7 @@ public sealed class LlmInferenceHttpResponseChunkError
 }
 
 /// <summary>A response body chunk or terminal error.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class LlmInferenceHttpResponseChunkRequest
 {
     /// <summary>When true, `data` is base64-encoded bytes. When absent or false, `data` is UTF-8 text.</summary>
@@ -4636,7 +4670,7 @@ internal sealed class LlmInferenceHttpResponseChunkRequest
 }
 
 /// <summary>Pre-resolved working-directory context for session startup.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionContext
 {
     /// <summary>Active git branch.</summary>
@@ -4661,7 +4695,7 @@ public sealed class SessionContext
 }
 
 /// <summary>GitHub repository the remote session belongs to.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteSessionMetadataRepository
 {
     /// <summary>Branch associated with the remote session.</summary>
@@ -4678,7 +4712,7 @@ public sealed class RemoteSessionMetadataRepository
 }
 
 /// <summary>Remote session metadata for the session to hand off (typically obtained from `sessions.list` with `source: "remote"`).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteSessionMetadataValue
 {
     /// <summary>Most recent working directory context.</summary>
@@ -4747,7 +4781,7 @@ public sealed class RemoteSessionMetadataValue
 }
 
 /// <summary>`sessions.open` handoff progress update with step, status, and optional message.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsOpenProgress
 {
     /// <summary>Optional step message.</summary>
@@ -4764,7 +4798,7 @@ public sealed class SessionsOpenProgress
 }
 
 /// <summary>Result of opening a session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionOpenResult
 {
     /// <summary>Remote session metadata, present when status is `connected`.</summary>
@@ -4793,7 +4827,7 @@ public sealed class SessionOpenResult
 }
 
 /// <summary>Identifier and optional friendly name assigned to the newly forked session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsForkResult
 {
     /// <summary>Friendly name assigned to the forked session, if any.</summary>
@@ -4806,7 +4840,7 @@ public sealed class SessionsForkResult
 }
 
 /// <summary>Source session identifier to fork from, optional event-ID boundary, and optional friendly name for the new session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsForkRequest
 {
     /// <summary>Optional friendly name to assign to the forked session.</summary>
@@ -4823,7 +4857,7 @@ internal sealed class SessionsForkRequest
 }
 
 /// <summary>Repository associated with the connected remote session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectedRemoteSessionMetadataRepository
 {
     /// <summary>Branch associated with the remote session.</summary>
@@ -4840,7 +4874,7 @@ public sealed class ConnectedRemoteSessionMetadataRepository
 }
 
 /// <summary>Metadata for a connected remote session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectedRemoteSessionMetadata
 {
     /// <summary>Neutral SDK discriminator for the connected remote session kind.</summary>
@@ -4889,7 +4923,7 @@ public sealed class ConnectedRemoteSessionMetadata
 }
 
 /// <summary>Remote session connection result.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteSessionConnectionResult
 {
     /// <summary>Metadata for a connected remote session.</summary>
@@ -4902,7 +4936,7 @@ public sealed class RemoteSessionConnectionResult
 }
 
 /// <summary>Remote session connection parameters.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ConnectRemoteSessionParams
 {
     /// <summary>Session ID to connect to.</summary>
@@ -4912,7 +4946,7 @@ internal sealed class ConnectRemoteSessionParams
 
 /// <summary>Local or remote session metadata entry. Narrow on `isRemote` to access source-specific fields.</summary>
 /// <remarks>Data type discriminated by <c>isRemote</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SessionListEntry
 {
     /// <summary>The boolean discriminator.</summary>
@@ -5008,7 +5042,7 @@ public partial class SessionListEntry
 }
 
 /// <summary>Sessions matching the filter, ordered most-recently-modified first.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionList
 {
     /// <summary>Sessions ordered most-recently-modified first. Discriminated by `isRemote`.</summary>
@@ -5017,7 +5051,7 @@ public sealed class SessionList
 }
 
 /// <summary>Optional filter applied to the returned sessions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionListFilter
 {
     /// <summary>Match sessions whose context.branch equals this value.</summary>
@@ -5038,7 +5072,7 @@ public sealed class SessionListFilter
 }
 
 /// <summary>Optional source filter, metadata-load limit, and context filter applied to the returned sessions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsListRequest
 {
     /// <summary>Optional filter applied to the returned sessions.</summary>
@@ -5063,7 +5097,7 @@ internal sealed class SessionsListRequest
 }
 
 /// <summary>Persisted local session metadata, including identifiers, timestamps, summary/name, client, context, detached state, and task ID.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LocalSessionMetadataValue
 {
     /// <summary>Runtime client name that created/last resumed this session.</summary>
@@ -5108,7 +5142,7 @@ public sealed class LocalSessionMetadataValue
 }
 
 /// <summary>Persisted local session metadata when the session exists.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetMetadataResult
 {
     /// <summary>Local session metadata, omitted when the session does not exist.</summary>
@@ -5117,7 +5151,7 @@ internal sealed class SessionsGetMetadataResult
 }
 
 /// <summary>Session ID whose persisted metadata should be read.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetMetadataRequest
 {
     /// <summary>Session ID to inspect.</summary>
@@ -5127,7 +5161,7 @@ internal sealed class SessionsGetMetadataRequest
 
 /// <summary>Client metadata outcome for one requested local session.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>status</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "status",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -5145,7 +5179,7 @@ public partial class SessionsClientMetadataEntry
 
 
 /// <summary>The <c>ok</c> variant of <see cref="SessionsClientMetadataEntry"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SessionsClientMetadataEntryOk : SessionsClientMetadataEntry
 {
     /// <inheritdoc />
@@ -5162,7 +5196,7 @@ public partial class SessionsClientMetadataEntryOk : SessionsClientMetadataEntry
 }
 
 /// <summary>The <c>notFound</c> variant of <see cref="SessionsClientMetadataEntry"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SessionsClientMetadataEntryNotFound : SessionsClientMetadataEntry
 {
     /// <inheritdoc />
@@ -5175,7 +5209,7 @@ public partial class SessionsClientMetadataEntryNotFound : SessionsClientMetadat
 }
 
 /// <summary>The <c>corrupt</c> variant of <see cref="SessionsClientMetadataEntry"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SessionsClientMetadataEntryCorrupt : SessionsClientMetadataEntry
 {
     /// <inheritdoc />
@@ -5188,7 +5222,7 @@ public partial class SessionsClientMetadataEntryCorrupt : SessionsClientMetadata
 }
 
 /// <summary>The <c>unsupportedVersion</c> variant of <see cref="SessionsClientMetadataEntry"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SessionsClientMetadataEntryUnsupportedVersion : SessionsClientMetadataEntry
 {
     /// <inheritdoc />
@@ -5201,7 +5235,7 @@ public partial class SessionsClientMetadataEntryUnsupportedVersion : SessionsCli
 }
 
 /// <summary>The <c>unavailable</c> variant of <see cref="SessionsClientMetadataEntry"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SessionsClientMetadataEntryUnavailable : SessionsClientMetadataEntry
 {
     /// <inheritdoc />
@@ -5222,7 +5256,7 @@ public partial class SessionsClientMetadataEntryUnavailable : SessionsClientMeta
 }
 
 /// <summary>Bounded batch request for client-owned metadata from persisted local sessions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetClientMetadataRequest
 {
     /// <summary>Case-sensitive keys to project from each valid bag. Each key must be non-empty, at most 256 UTF-8 bytes, and outside the reserved `copilot/` and `github/` namespaces. Omit to return every entry.</summary>
@@ -5235,7 +5269,7 @@ internal sealed class SessionsGetClientMetadataRequest
 }
 
 /// <summary>Batch of session events returned by a read, with cursor and continuation metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class EventsReadResult
 {
     /// <summary>Opaque cursor for the next read. Pass back unchanged in the next read.cursor to continue from where this read left off. Always present, even when no events were returned. For a backward read this cursor pages toward OLDER events; keep passing `direction: backward` with it (the cursor is also self-describing, so backward paging continues correctly).</summary>
@@ -5256,7 +5290,7 @@ public sealed class EventsReadResult
 }
 
 /// <summary>Pagination options for reading an inactive or active local session's persisted event journal.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsReadPersistedEventsRequest
 {
     /// <summary>Opaque, process-local, single-use cursor returned by the previous persisted-event read. Omit on the first call and issue continuations sequentially; reusing the same cursor returns an expired terminal page.</summary>
@@ -5277,7 +5311,7 @@ internal sealed class SessionsReadPersistedEventsRequest
 }
 
 /// <summary>Recent local session IDs that contain user-visible history.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsListNonEmptySessionIdsResult
 {
     /// <summary>Session IDs ordered newest-first.</summary>
@@ -5286,7 +5320,7 @@ internal sealed class SessionsListNonEmptySessionIdsResult
 }
 
 /// <summary>Limit for non-empty local session IDs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsListNonEmptySessionIdsRequest
 {
     /// <summary>Maximum number of session IDs to return.</summary>
@@ -5295,7 +5329,7 @@ internal sealed class SessionsListNonEmptySessionIdsRequest
 }
 
 /// <summary>ID of the local session bound to the given GitHub task, or omitted when none.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsFindByTaskIDResult
 {
     /// <summary>Omitted when no local session is bound to that GitHub task.</summary>
@@ -5304,7 +5338,7 @@ public sealed class SessionsFindByTaskIDResult
 }
 
 /// <summary>GitHub task ID to look up.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsFindByTaskIDRequest
 {
     /// <summary>GitHub task ID to look up.</summary>
@@ -5313,7 +5347,7 @@ internal sealed class SessionsFindByTaskIDRequest
 }
 
 /// <summary>Session ID matching the prefix, omitted when no unique match exists.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsFindByPrefixResult
 {
     /// <summary>Omitted when no unique session matches the prefix (no match or ambiguous).</summary>
@@ -5322,7 +5356,7 @@ public sealed class SessionsFindByPrefixResult
 }
 
 /// <summary>UUID prefix to resolve to a unique session ID.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsFindByPrefixRequest
 {
     /// <summary>UUID prefix (&gt;=7 hex chars, &lt;36 chars). Returns the unique session ID, or undefined when there is no match or the prefix matches multiple sessions.</summary>
@@ -5331,7 +5365,7 @@ internal sealed class SessionsFindByPrefixRequest
 }
 
 /// <summary>Most-relevant session ID for the supplied context, or omitted when no sessions exist.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsGetLastForContextResult
 {
     /// <summary>Most-relevant session ID for the supplied context, or omitted when no sessions exist.</summary>
@@ -5340,7 +5374,7 @@ public sealed class SessionsGetLastForContextResult
 }
 
 /// <summary>Optional working-directory context used to score session relevance.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetLastForContextRequest
 {
     /// <summary>Optional working-directory context used to score session relevance. When omitted the most-recently-modified session wins.</summary>
@@ -5349,7 +5383,7 @@ internal sealed class SessionsGetLastForContextRequest
 }
 
 /// <summary>Absolute path to the session's events.jsonl file on disk.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetEventFilePathResult
 {
     /// <summary>Absolute path to the session's events.jsonl file.</summary>
@@ -5358,7 +5392,7 @@ internal sealed class SessionsGetEventFilePathResult
 }
 
 /// <summary>Session ID whose event-log file path to compute.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetEventFilePathRequest
 {
     /// <summary>Session ID whose event-log file path to compute.</summary>
@@ -5367,7 +5401,7 @@ internal sealed class SessionsGetEventFilePathRequest
 }
 
 /// <summary>Map of sessionId -&gt; on-disk size in bytes for each session's workspace directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionSizes
 {
     /// <summary>Map of sessionId -&gt; on-disk size in bytes for the session's workspace directory.</summary>
@@ -5376,7 +5410,7 @@ public sealed class SessionSizes
 }
 
 /// <summary>Session IDs from the input set that are currently in use by another process.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsCheckInUseResult
 {
     /// <summary>Session IDs from the input set that are currently held by another running process via an alive lock file.</summary>
@@ -5385,7 +5419,7 @@ public sealed class SessionsCheckInUseResult
 }
 
 /// <summary>Session IDs to test for live in-use locks.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsCheckInUseRequest
 {
     /// <summary>Session IDs to test for live in-use locks.</summary>
@@ -5394,7 +5428,7 @@ internal sealed class SessionsCheckInUseRequest
 }
 
 /// <summary>The session's persisted remote-steerable flag, or omitted when no value has been persisted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetPersistedRemoteSteerableResult
 {
     /// <summary>The session's persisted remote-steerable flag if recorded; omitted when no value has been persisted.</summary>
@@ -5403,7 +5437,7 @@ internal sealed class SessionsGetPersistedRemoteSteerableResult
 }
 
 /// <summary>Session ID to look up the persisted remote-steerable flag for.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetPersistedRemoteSteerableRequest
 {
     /// <summary>Session ID to look up the persisted remote-steerable flag for.</summary>
@@ -5412,13 +5446,13 @@ internal sealed class SessionsGetPersistedRemoteSteerableRequest
 }
 
 /// <summary>Closes a session: emits shutdown, flushes pending events to disk, releases the in-use lock, disposes the active session. Idempotent: succeeds even if the session is not currently active.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsCloseResult
 {
 }
 
 /// <summary>Session ID to close.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsCloseRequest
 {
     /// <summary>Session ID to close.</summary>
@@ -5427,7 +5461,7 @@ internal sealed class SessionsCloseRequest
 }
 
 /// <summary>Map of sessionId -&gt; bytes freed by removing the session's workspace directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionBulkDeleteResult
 {
     /// <summary>Map of sessionId -&gt; bytes freed by removing the session's workspace directory. Sessions whose deletion failed are omitted from this map (failures are logged on the server but not surfaced per-id; check the map for absent IDs to detect them).</summary>
@@ -5436,7 +5470,7 @@ public sealed class SessionBulkDeleteResult
 }
 
 /// <summary>Session IDs to close, deactivate, and delete from disk.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsBulkDeleteRequest
 {
     /// <summary>Session IDs to close, deactivate, and delete from disk.</summary>
@@ -5445,7 +5479,7 @@ internal sealed class SessionsBulkDeleteRequest
 }
 
 /// <summary>Session ID to delete from disk.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsDeleteRequest
 {
     /// <summary>Session ID to delete.</summary>
@@ -5458,7 +5492,7 @@ internal sealed class SessionsDeleteRequest
 }
 
 /// <summary>Outcome of the prune operation: deleted IDs, dry-run candidates, skipped IDs, total bytes freed, and the dry-run flag.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionPruneResult
 {
     /// <summary>Session IDs that would be deleted in dry-run mode (always empty otherwise).</summary>
@@ -5483,7 +5517,7 @@ public sealed class SessionPruneResult
 }
 
 /// <summary>Age threshold and optional flags controlling which old sessions are pruned (or simulated when dryRun is true).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsPruneOldRequest
 {
     /// <summary>When true, only report what would be deleted without performing any deletion.</summary>
@@ -5504,13 +5538,13 @@ internal sealed class SessionsPruneOldRequest
 }
 
 /// <summary>Flush a session's pending events to disk. No-op when no writer exists for the session (e.g., already closed).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsSaveResult
 {
 }
 
 /// <summary>Session ID whose pending events should be flushed to disk.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsSaveRequest
 {
     /// <summary>Session ID whose pending events should be flushed to disk.</summary>
@@ -5519,13 +5553,13 @@ internal sealed class SessionsSaveRequest
 }
 
 /// <summary>Release the in-use lock held by this process for the given session. No-op when this process does not currently hold a lock for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsReleaseLockResult
 {
 }
 
 /// <summary>Session ID whose in-use lock should be released.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsReleaseLockRequest
 {
     /// <summary>Session ID whose in-use lock should be released.</summary>
@@ -5534,7 +5568,7 @@ internal sealed class SessionsReleaseLockRequest
 }
 
 /// <summary>The enriched metadata records, with summary and context fields backfilled where available. Sessions confirmed empty and unnamed are omitted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionEnrichMetadataResult
 {
     /// <summary>Enriched records, with summary and context backfilled. Sessions confirmed empty and unnamed may be omitted.</summary>
@@ -5543,7 +5577,7 @@ public sealed class SessionEnrichMetadataResult
 }
 
 /// <summary>Session metadata records to enrich with summary and context information.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsEnrichMetadataRequest
 {
     /// <summary>Session metadata records to enrich. Records that already have summary and context are returned unchanged.</summary>
@@ -5552,13 +5586,13 @@ internal sealed class SessionsEnrichMetadataRequest
 }
 
 /// <summary>Reload all hooks (user, plugin, optionally repo) and apply them to the active session. Call after installing or removing plugins so their hooks take effect immediately. No-op when no active session matches the given sessionId.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsReloadPluginHooksResult
 {
 }
 
 /// <summary>Active session ID and an optional flag for deferring repo-level hooks until folder trust.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsReloadPluginHooksRequest
 {
     /// <summary>When true, skip repo-level hooks. Use before folder trust is confirmed; loadDeferredRepoHooks loads them post-trust.</summary>
@@ -5571,7 +5605,7 @@ internal sealed class SessionsReloadPluginHooksRequest
 }
 
 /// <summary>Queued repo-level startup prompts and the total hook command count after loading.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionLoadDeferredRepoHooksResult
 {
     /// <summary>Total hook command count (user + plugin + repo) loaded for the session by this call. Captured atomically with startupPrompts so callers don't need to read a separate counter.</summary>
@@ -5584,7 +5618,7 @@ public sealed class SessionLoadDeferredRepoHooksResult
 }
 
 /// <summary>Active session ID whose deferred repo-level hooks should be loaded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsLoadDeferredRepoHooksRequest
 {
     /// <summary>Active session ID whose deferred repo-level hooks should be loaded.</summary>
@@ -5593,13 +5627,13 @@ internal sealed class SessionsLoadDeferredRepoHooksRequest
 }
 
 /// <summary>Replace the manager-wide additional plugins. New session creations and subsequent hook reloads see the new set; already-running sessions keep their existing hook installation until the next reload.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionsSetAdditionalPluginsResult
 {
 }
 
 /// <summary>Installed plugin record from global state, with marketplace, version, install time, enabled state, cache path, and source.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class InstalledPlugin
 {
     /// <summary>Path where the plugin is cached locally.</summary>
@@ -5640,7 +5674,7 @@ public sealed class InstalledPlugin
 }
 
 /// <summary>Manager-wide additional plugins to register; replaces any previously-configured set.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsSetAdditionalPluginsRequest
 {
     /// <summary>Manager-wide additional plugins to register. Replaces any previously-configured set. Pass an empty array to clear.</summary>
@@ -5649,7 +5683,7 @@ internal sealed class SessionsSetAdditionalPluginsRequest
 }
 
 /// <summary>Dynamic-context board entry count, when available.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetBoardEntryCountResult
 {
     /// <summary>Board entry count, when available.</summary>
@@ -5658,7 +5692,7 @@ internal sealed class SessionsGetBoardEntryCountResult
 }
 
 /// <summary>Session ID whose board entry count should be returned.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsGetBoardEntryCountRequest
 {
     /// <summary>Session ID whose board entry count should be returned.</summary>
@@ -5668,7 +5702,7 @@ internal sealed class SessionsGetBoardEntryCountRequest
 
 /// <summary>State of the runtime-managed remote-control singleton.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>state</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "state",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -5686,7 +5720,7 @@ public partial class RemoteControlStatus
 
 /// <summary>Remote control is not connected.</summary>
 /// <remarks>The <c>off</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class RemoteControlStatusOff : RemoteControlStatus
 {
     /// <inheritdoc />
@@ -5696,7 +5730,7 @@ public partial class RemoteControlStatusOff : RemoteControlStatus
 
 /// <summary>Remote control is in the middle of initial setup.</summary>
 /// <remarks>The <c>connecting</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class RemoteControlStatusConnecting : RemoteControlStatus
 {
     /// <inheritdoc />
@@ -5710,7 +5744,7 @@ public partial class RemoteControlStatusConnecting : RemoteControlStatus
 
 /// <summary>Remote control is connected to a local session.</summary>
 /// <remarks>The <c>active</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class RemoteControlStatusActive : RemoteControlStatus
 {
     /// <inheritdoc />
@@ -5739,7 +5773,7 @@ public partial class RemoteControlStatusActive : RemoteControlStatus
 
 /// <summary>The last setup attempt failed. The singleton is otherwise off.</summary>
 /// <remarks>The <c>error</c> variant of <see cref="RemoteControlStatus"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class RemoteControlStatusError : RemoteControlStatus
 {
     /// <inheritdoc />
@@ -5757,7 +5791,7 @@ public partial class RemoteControlStatusError : RemoteControlStatus
 }
 
 /// <summary>Wrapper for the singleton's current status.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteControlStatusResult
 {
     /// <summary>State of the runtime-managed remote-control singleton.</summary>
@@ -5766,7 +5800,7 @@ public sealed class RemoteControlStatusResult
 }
 
 /// <summary>Reattach to an existing MC session without creating a new one.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteControlConfigExistingMcSession
 {
     /// <summary>Existing MC session ID to reattach to.</summary>
@@ -5779,7 +5813,7 @@ public sealed class RemoteControlConfigExistingMcSession
 }
 
 /// <summary>Configuration for the runtime-managed remote-control singleton.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteControlConfig
 {
     /// <summary>Reattach to an existing MC session without creating a new one.</summary>
@@ -5808,7 +5842,7 @@ public sealed class RemoteControlConfig
 }
 
 /// <summary>Parameters for attaching the remote-control singleton to a session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsStartRemoteControlRequest
 {
     /// <summary>Configuration for the runtime-managed remote-control singleton.</summary>
@@ -5821,7 +5855,7 @@ internal sealed class SessionsStartRemoteControlRequest
 }
 
 /// <summary>Outcome of a transferRemoteControl call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteControlTransferResult
 {
     /// <summary>State of the runtime-managed remote-control singleton.</summary>
@@ -5834,7 +5868,7 @@ public sealed class RemoteControlTransferResult
 }
 
 /// <summary>Parameters for atomically rebinding the remote-control singleton.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsTransferRemoteControlRequest
 {
     /// <summary>When provided, the transfer is rejected unless the singleton currently points at this session id (compare-and-swap semantics to avoid clobbering newer state).</summary>
@@ -5847,7 +5881,7 @@ internal sealed class SessionsTransferRemoteControlRequest
 }
 
 /// <summary>Patch for the singleton's steering state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsSetRemoteControlSteeringRequest
 {
     /// <summary>Target steering state. Today only `true` is actionable on the underlying exporter; `false` is reserved for future use.</summary>
@@ -5856,7 +5890,7 @@ internal sealed class SessionsSetRemoteControlSteeringRequest
 }
 
 /// <summary>Outcome of a stopRemoteControl call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteControlStopResult
 {
     /// <summary>State of the runtime-managed remote-control singleton.</summary>
@@ -5869,7 +5903,7 @@ public sealed class RemoteControlStopResult
 }
 
 /// <summary>RPC data type for SessionsStopRemoteControl operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionsStopRemoteControlRequest
 {
     /// <summary>When provided, the stop is rejected unless the singleton currently points at this session id (compare-and-swap semantics).</summary>
@@ -5882,7 +5916,7 @@ internal sealed class SessionsStopRemoteControlRequest
 }
 
 /// <summary>Params to attach or detach an in-process ExtensionController delegate.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ConfigureSessionExtensionsParams
 {
     /// <summary>Session to attach the extension controller delegate to.</summary>
@@ -5892,7 +5926,7 @@ internal sealed class ConfigureSessionExtensionsParams
 
 /// <summary>Outcome of an agentRegistry.spawn call.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -5909,7 +5943,7 @@ public partial class AgentRegistrySpawnResult
 
 
 /// <summary>Full registry entry for the spawned child. Lets the controller call `handleLiveTargetSelected(entry)` directly without re-reading the registry (avoids a TOCTOU window).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentRegistryLiveTargetEntry
 {
     /// <summary>Kind of attention required when status === "attention". Meaningful only when status === "attention".</summary>
@@ -5987,7 +6021,7 @@ public sealed class AgentRegistryLiveTargetEntry
 }
 
 /// <summary>Canonical process-log discovery outcome; populated from spawnLiveTarget.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentRegistryLogCapture
 {
     /// <summary>Whether a canonical process log was discovered for this managed spawn.</summary>
@@ -6009,7 +6043,7 @@ public sealed class AgentRegistryLogCapture
 
 /// <summary>Managed-server child was spawned and registered successfully.</summary>
 /// <remarks>The <c>spawned</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AgentRegistrySpawnResultSpawned : AgentRegistrySpawnResult
 {
     /// <inheritdoc />
@@ -6038,7 +6072,7 @@ public partial class AgentRegistrySpawnResultSpawned : AgentRegistrySpawnResult
 
 /// <summary>`child_process.spawn` itself failed before the child entered the registry.</summary>
 /// <remarks>The <c>spawn-error</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AgentRegistrySpawnResultSpawnError : AgentRegistrySpawnResult
 {
     /// <inheritdoc />
@@ -6057,7 +6091,7 @@ public partial class AgentRegistrySpawnResultSpawnError : AgentRegistrySpawnResu
 
 /// <summary>Spawn succeeded but the child did not publish a matching managed-server entry within the timeout.</summary>
 /// <remarks>The <c>registry-timeout</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AgentRegistrySpawnResultRegistryTimeout : AgentRegistrySpawnResult
 {
     /// <inheritdoc />
@@ -6076,7 +6110,7 @@ public partial class AgentRegistrySpawnResultRegistryTimeout : AgentRegistrySpaw
 
 /// <summary>Synchronous pre-validation rejected the spawn request.</summary>
 /// <remarks>The <c>validation-error</c> variant of <see cref="AgentRegistrySpawnResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class AgentRegistrySpawnResultValidationError : AgentRegistrySpawnResult
 {
     /// <inheritdoc />
@@ -6098,7 +6132,7 @@ public partial class AgentRegistrySpawnResultValidationError : AgentRegistrySpaw
 }
 
 /// <summary>Inputs to spawn a managed-server child via the controller's spawn delegate.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class AgentRegistrySpawnRequest
 {
     /// <summary>Custom or built-in agent name (e.g. 'explore'). When omitted, the child uses its own default.</summary>
@@ -6127,7 +6161,7 @@ internal sealed class AgentRegistrySpawnRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSuspendRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -6136,7 +6170,7 @@ internal sealed class SessionSuspendRequest
 }
 
 /// <summary>Result of sending a user message.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SendResult
 {
     /// <summary>Unique identifier assigned to the message.</summary>
@@ -6146,7 +6180,7 @@ public sealed class SendResult
 
 /// <summary>Provider-native structured output format. JSON Schema is forwarded without rewriting or validating the schema or the generated output.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -6160,7 +6194,7 @@ public partial class ResponseFormat
 
 
 /// <summary>A JSON Schema output contract. OpenAI receives the name, description, schema and strict setting; Anthropic receives the schema in output_config.format and always uses its native strict enforcement.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class JsonSchemaResponseFormat
 {
     /// <summary>Optional description passed to OpenAI providers.</summary>
@@ -6181,7 +6215,7 @@ public sealed class JsonSchemaResponseFormat
 }
 
 /// <summary>The <c>json_schema</c> variant of <see cref="ResponseFormat"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ResponseFormatJsonSchema : ResponseFormat
 {
     /// <inheritdoc />
@@ -6194,7 +6228,7 @@ public partial class ResponseFormatJsonSchema : ResponseFormat
 }
 
 /// <summary>Parameters for sending a user message to the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SendRequest
 {
     /// <summary>The UI mode the agent was in when this message was sent. Defaults to the session's current mode.</summary>
@@ -6261,7 +6295,7 @@ internal sealed class SendRequest
 }
 
 /// <summary>Result of sending zero or more user messages.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SendMessagesResult
 {
     /// <summary>Unique identifiers assigned to the messages, one per provided message in order. For a batch that starts a run, assistant messages use the final ID as originatingMessageId throughout that run, including tool iterations and stop-hook corrections. Immediate steering does not replace the active run's origin. Empty when no messages were provided; that run has no originatingMessageId.</summary>
@@ -6270,7 +6304,7 @@ public sealed class SendMessagesResult
 }
 
 /// <summary>A single user message to append to the session as part of a `session.sendMessages` turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SendMessageItem
 {
     /// <summary>Optional attachments (files, directories, selections, blobs, GitHub references) to include with this message.</summary>
@@ -6302,7 +6336,7 @@ public sealed class SendMessageItem
 }
 
 /// <summary>Parameters for sending zero or more user messages to the session in a single turn. Remote-backed (Mission Control) sessions do not support this method and will return an error.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SendMessagesRequest
 {
     /// <summary>The UI mode the agent was in when these messages were sent. Defaults to the session's current mode.</summary>
@@ -6347,7 +6381,7 @@ internal sealed class SendMessagesRequest
 }
 
 /// <summary>Internal request for sending a system notification.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SendSystemNotificationRequest
 {
     /// <summary>Optional structured notification kind.</summary>
@@ -6368,7 +6402,7 @@ internal sealed class SendSystemNotificationRequest
 }
 
 /// <summary>Result of aborting the current turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AbortResult
 {
     /// <summary>Error message if the abort failed.</summary>
@@ -6381,7 +6415,7 @@ public sealed class AbortResult
 }
 
 /// <summary>Parameters for aborting the current turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class AbortRequest
 {
     /// <summary>Finite reason code describing why the current turn was aborted.</summary>
@@ -6394,7 +6428,7 @@ internal sealed class AbortRequest
 }
 
 /// <summary>Result of interrupting the main agent turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class InterruptMainTurnResult
 {
     /// <summary>Whether an in-flight main agent turn was interrupted. False when the main loop was not processing.</summary>
@@ -6403,7 +6437,7 @@ public sealed class InterruptMainTurnResult
 }
 
 /// <summary>Parameters for interrupting the main agent turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class InterruptMainTurnRequest
 {
     /// <summary>When true, the user's queued prompts are preserved and run as the next turn once the interrupted turn unwinds; when false (the default), the queue is cleared like a plain abort.</summary>
@@ -6416,7 +6450,7 @@ internal sealed class InterruptMainTurnRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionCancelAllBackgroundAgentsRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -6425,7 +6459,7 @@ internal sealed class SessionCancelAllBackgroundAgentsRequest
 }
 
 /// <summary>Parameters for shutting down the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ShutdownRequest
 {
     /// <summary>Dispatch deferred sessionEnd hooks in the background with their full per-hook timeoutSec instead of awaiting them under the short shared shutdown budget. Set this when the host process keeps running after the session closes (for example the CLI's /clear), so a slow hook neither blocks the close nor is aborted. Hooks still detached when the process later exits are terminated with it. Defaults to false.</summary>
@@ -6446,7 +6480,7 @@ internal sealed class ShutdownRequest
 }
 
 /// <summary>Identifier of the session event that was emitted for the log message.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LogResult
 {
     /// <summary>The unique identifier of the emitted session event.</summary>
@@ -6455,7 +6489,7 @@ public sealed class LogResult
 }
 
 /// <summary>Message text, optional severity level, persistence flag, optional follow-up URL, and optional tip.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class LogRequest
 {
     /// <summary>When true, the message is transient and not persisted to the session event log on disk.</summary>
@@ -6490,7 +6524,7 @@ internal sealed class LogRequest
 }
 
 /// <summary>Managed sandbox enforcement state for a session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxEnforcementStatus
 {
     /// <summary>Whether an enforcement failure has permanently blocked the session.</summary>
@@ -6507,7 +6541,7 @@ public sealed class SandboxEnforcementStatus
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSandboxGetEnforcementStatusRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -6516,7 +6550,7 @@ internal sealed class SessionSandboxGetEnforcementStatusRequest
 }
 
 /// <summary>Result of attempting to disable sandboxing for the current session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxDisableForSessionResult
 {
     /// <summary>The authoritative sandbox enabled state after the operation.</summary>
@@ -6529,7 +6563,7 @@ public sealed class SandboxDisableForSessionResult
 }
 
 /// <summary>Optional informational context describing how and where the permission decision was made. This does not affect permission behavior.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionDecisionContext
 {
     /// <summary>Disposition of the permission request as observed by the responding client.</summary>
@@ -6550,7 +6584,7 @@ public sealed class PermissionDecisionContext
 }
 
 /// <summary>Request to disable sandboxing for the current session while resolving an active sandbox-bypass permission prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SandboxDisableForSessionRequest
 {
     /// <summary>Optional attribution for the permission decision.</summary>
@@ -6567,7 +6601,7 @@ internal sealed class SandboxDisableForSessionRequest
 }
 
 /// <summary>Authentication status and account metadata for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionAuthStatus
 {
     /// <summary>Authentication type.</summary>
@@ -6598,7 +6632,7 @@ public sealed class SessionAuthStatus
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionGitHubAuthGetStatusRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -6607,7 +6641,7 @@ internal sealed class SessionGitHubAuthGetStatusRequest
 }
 
 /// <summary>Indicates whether the credential update succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionSetCredentialsResult
 {
     /// <summary>Whether the session ended up with a populated `copilotUser` for the installed credentials. `true` when the supplied credential already carried `copilotUser` or it was successfully re-resolved server-side. `false` when the credential is installed without `copilotUser` — either re-resolution failed, or the variant cannot be re-resolved from the credential alone (only the raw-token variants `token`, `env`, and `gh-cli` can). In both `false` cases the token swap still applied, but plan/quota/billing metadata is degraded. Present whenever a credential was supplied; omitted only when no credential was supplied (no-op call).</summary>
@@ -6621,7 +6655,7 @@ public sealed class SessionSetCredentialsResult
 
 /// <summary>Authentication credentials accepted by session.gitHubAuth.setCredentials. Session-owned token-provider identities cannot be installed through this method.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -6642,7 +6676,7 @@ public partial class SettableAuthInfo
 
 /// <summary>Authentication-info input variant for GitHub-internal HMAC auth, carrying the public GitHub host and HMAC secret.</summary>
 /// <remarks>The <c>hmac</c> variant of <see cref="SettableAuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SettableAuthInfoHmac : SettableAuthInfo
 {
     /// <inheritdoc />
@@ -6665,7 +6699,7 @@ public partial class SettableAuthInfoHmac : SettableAuthInfo
 
 /// <summary>Authentication-info input variant for a token sourced from an environment variable, with host, optional login, token, and env var name.</summary>
 /// <remarks>The <c>env</c> variant of <see cref="SettableAuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SettableAuthInfoEnv : SettableAuthInfo
 {
     /// <inheritdoc />
@@ -6697,7 +6731,7 @@ public partial class SettableAuthInfoEnv : SettableAuthInfo
 
 /// <summary>Token authentication accepted by session.gitHubAuth.setCredentials.</summary>
 /// <remarks>The <c>token</c> variant of <see cref="SettableAuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SettableAuthInfoToken : SettableAuthInfo
 {
     /// <inheritdoc />
@@ -6720,7 +6754,7 @@ public partial class SettableAuthInfoToken : SettableAuthInfo
 
 /// <summary>Authentication-info variant for direct Copilot API token auth sourced from environment variables, with public GitHub host.</summary>
 /// <remarks>The <c>copilot-api-token</c> variant of <see cref="SettableAuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SettableAuthInfoCopilotApiToken : SettableAuthInfo
 {
     /// <inheritdoc />
@@ -6739,7 +6773,7 @@ public partial class SettableAuthInfoCopilotApiToken : SettableAuthInfo
 
 /// <summary>Authentication-info variant for OAuth user auth, with host and login; the token remains in the runtime secret store.</summary>
 /// <remarks>The <c>user</c> variant of <see cref="SettableAuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SettableAuthInfoUser : SettableAuthInfo
 {
     /// <inheritdoc />
@@ -6762,7 +6796,7 @@ public partial class SettableAuthInfoUser : SettableAuthInfo
 
 /// <summary>Authentication-info input variant for GitHub CLI credentials, carrying host, login, and the `gh auth token` value.</summary>
 /// <remarks>The <c>gh-cli</c> variant of <see cref="SettableAuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SettableAuthInfoGhCli : SettableAuthInfo
 {
     /// <inheritdoc />
@@ -6789,7 +6823,7 @@ public partial class SettableAuthInfoGhCli : SettableAuthInfo
 
 /// <summary>Authentication-info input variant for API-key authentication to a non-GitHub LLM provider, carrying the secret `apiKey` and host.</summary>
 /// <remarks>The <c>api-key</c> variant of <see cref="SettableAuthInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SettableAuthInfoApiKey : SettableAuthInfo
 {
     /// <inheritdoc />
@@ -6811,7 +6845,7 @@ public partial class SettableAuthInfoApiKey : SettableAuthInfo
 }
 
 /// <summary>New auth credentials to install on the session. Omit to leave credentials unchanged.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSetCredentialsParams
 {
     /// <summary>The new auth credentials to install on the session. When omitted or `undefined`, the call is a no-op and the session's existing credentials are preserved. The runtime installs the supplied value immediately for outbound model/API requests. When the credential carries a raw token (`token`, `env`, or `gh-cli`) but no `copilotUser`, the runtime additionally re-resolves `copilotUser` server-side (best-effort, asynchronously, after the synchronous install) so plan/quota/billing metadata regains fidelity; on resolution failure the verbatim credential remains installed. It does NOT otherwise validate the credential. Several variants carry secret material; treat this method's params as containing secrets at rest and in transit.</summary>
@@ -6824,7 +6858,7 @@ internal sealed class SessionSetCredentialsParams
 }
 
 /// <summary>Credential-free authentication identity safe to expose to hosts and user interfaces.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AuthIdentity
 {
     /// <summary>Snapshot of the authenticated user's Copilot subscription info, if known.</summary>
@@ -6853,7 +6887,7 @@ public sealed class AuthIdentity
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionGitHubAuthGetCurrentAuthInfoRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -6862,7 +6896,7 @@ internal sealed class SessionGitHubAuthGetCurrentAuthInfoRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionGitHubAuthGetAllAuthAvailableRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -6871,7 +6905,7 @@ internal sealed class SessionGitHubAuthGetAllAuthAvailableRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionGitHubAuthRefreshCopilotUserRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -6880,7 +6914,7 @@ internal sealed class SessionGitHubAuthRefreshCopilotUserRequest
 }
 
 /// <summary>Internal GitHub login parameters.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionAuthLoginRequest
 {
     /// <summary>GitHub host URL.</summary>
@@ -6905,7 +6939,7 @@ internal sealed class SessionAuthLoginRequest
 }
 
 /// <summary>Parameters for switching the session's active authentication.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionAuthSwitchRequest
 {
     /// <summary>Authentication information to activate.</summary>
@@ -6922,7 +6956,7 @@ internal sealed class SessionAuthSwitchRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionGitHubAuthLogoutRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -6931,7 +6965,7 @@ internal sealed class SessionGitHubAuthLogoutRequest
 }
 
 /// <summary>Parameters identifying a GitHub authentication to log out.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionAuthLogoutUserRequest
 {
     /// <summary>Authentication information to log out.</summary>
@@ -6944,7 +6978,7 @@ internal sealed class SessionAuthLogoutUserRequest
 }
 
 /// <summary>Validation error from an authentication attempt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AuthValidationError
 {
     /// <summary>Optional message returned by GitHub.</summary>
@@ -6957,7 +6991,7 @@ public sealed class AuthValidationError
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionGitHubAuthLastAuthErrorsRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -6966,7 +7000,7 @@ internal sealed class SessionGitHubAuthLastAuthErrorsRequest
 }
 
 /// <summary>A file included in the session debug bundle.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DebugCollectLogsCollectedEntry
 {
     /// <summary>Relative path of the file in the staged bundle/archive.</summary>
@@ -6983,7 +7017,7 @@ public sealed class DebugCollectLogsCollectedEntry
 }
 
 /// <summary>An optional debug bundle entry that could not be included.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DebugCollectLogsSkippedEntry
 {
     /// <summary>Relative path requested for this bundle entry.</summary>
@@ -7000,7 +7034,7 @@ public sealed class DebugCollectLogsSkippedEntry
 }
 
 /// <summary>Result of collecting a session debug bundle.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DebugCollectLogsResult
 {
     /// <summary>Files included in the bundle.</summary>
@@ -7021,7 +7055,7 @@ public sealed class DebugCollectLogsResult
 }
 
 /// <summary>A caller-provided server-local file or directory to include in the debug bundle.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DebugCollectLogsEntry
 {
     /// <summary>Relative path to use inside the staged bundle/archive.</summary>
@@ -7047,7 +7081,7 @@ public sealed class DebugCollectLogsEntry
 
 /// <summary>Destination for the session debug bundle.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -7062,7 +7096,7 @@ public partial class DebugCollectLogsDestination
 
 
 /// <summary>The <c>archive</c> variant of <see cref="DebugCollectLogsDestination"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class DebugCollectLogsDestinationArchive : DebugCollectLogsDestination
 {
     /// <inheritdoc />
@@ -7080,7 +7114,7 @@ public partial class DebugCollectLogsDestinationArchive : DebugCollectLogsDestin
 }
 
 /// <summary>The <c>directory</c> variant of <see cref="DebugCollectLogsDestination"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class DebugCollectLogsDestinationDirectory : DebugCollectLogsDestination
 {
     /// <inheritdoc />
@@ -7093,7 +7127,7 @@ public partial class DebugCollectLogsDestinationDirectory : DebugCollectLogsDest
 }
 
 /// <summary>Built-in session diagnostics to include in the bundle. Omitted fields default to true.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DebugCollectLogsInclude
 {
     /// <summary>Server-local path to the current process log. When set, it is included as `process.log` and its directory is searched for prior logs from the same session.</summary>
@@ -7126,7 +7160,7 @@ public sealed class DebugCollectLogsInclude
 }
 
 /// <summary>Options for collecting a session debug bundle with configurable redaction.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class DebugCollectLogsRequest
 {
     /// <summary>Caller-provided server-local files or directories to include in addition to the runtime's built-in session diagnostics. This lets host applications add their own diagnostics without changing the API shape.</summary>
@@ -7147,7 +7181,7 @@ internal sealed class DebugCollectLogsRequest
 }
 
 /// <summary>Canvas action that the agent or host can invoke. To discover the input schema for a particular action, call the list_canvas_capabilities tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasAction
 {
     /// <summary>Description of the action.</summary>
@@ -7164,7 +7198,7 @@ public sealed class CanvasAction
 }
 
 /// <summary>Canvas available in the current session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DiscoveredCanvas
 {
     /// <summary>Actions the agent or host may invoke on an open instance.</summary>
@@ -7203,7 +7237,7 @@ public sealed class DiscoveredCanvas
 }
 
 /// <summary>Declared canvases available in this session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasList
 {
     /// <summary>Declared canvases available in this session.</summary>
@@ -7212,7 +7246,7 @@ public sealed class CanvasList
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionCanvasListRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -7221,7 +7255,7 @@ internal sealed class SessionCanvasListRequest
 }
 
 /// <summary>Open canvas instance snapshot.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class OpenCanvasInstance
 {
     /// <summary>Provider-local canvas identifier.</summary>
@@ -7262,7 +7296,7 @@ public sealed class OpenCanvasInstance
 }
 
 /// <summary>Live open-canvas snapshot.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasListOpenResult
 {
     /// <summary>Currently open canvas instances.</summary>
@@ -7271,7 +7305,7 @@ public sealed class CanvasListOpenResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionCanvasListOpenRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -7280,7 +7314,7 @@ internal sealed class SessionCanvasListOpenRequest
 }
 
 /// <summary>Canvas open parameters.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CanvasOpenRequest
 {
     /// <summary>Provider-local canvas identifier.</summary>
@@ -7305,7 +7339,7 @@ internal sealed class CanvasOpenRequest
 }
 
 /// <summary>Canvas close parameters.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CanvasCloseRequest
 {
     /// <summary>Open canvas instance identifier.</summary>
@@ -7318,7 +7352,7 @@ internal sealed class CanvasCloseRequest
 }
 
 /// <summary>Canvas action invocation result.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasActionInvokeResult
 {
     /// <summary>Provider-supplied action result.</summary>
@@ -7327,7 +7361,7 @@ public sealed class CanvasActionInvokeResult
 }
 
 /// <summary>Canvas action invocation parameters.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CanvasActionInvokeRequest
 {
     /// <summary>Action name to invoke.</summary>
@@ -7348,7 +7382,7 @@ internal sealed class CanvasActionInvokeRequest
 }
 
 /// <summary>Internal canvas provider registration parameters.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CanvasProviderRegisterRequest
 {
     /// <summary>Canvas contributions supplied by the provider.</summary>
@@ -7369,7 +7403,7 @@ internal sealed class CanvasProviderRegisterRequest
 }
 
 /// <summary>Internal canvas provider unregistration parameters.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CanvasProviderUnregisterRequest
 {
     /// <summary>Connection identifier to unregister.</summary>
@@ -7383,7 +7417,7 @@ internal sealed class CanvasProviderUnregisterRequest
 
 /// <summary>Machine-readable factory run failure.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -7401,7 +7435,7 @@ public partial class FactoryRunFailure
 
 
 /// <summary>The <c>factory_limit_reached</c> variant of <see cref="FactoryRunFailure"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class FactoryRunFailureFactoryLimitReached : FactoryRunFailure
 {
     /// <inheritdoc />
@@ -7427,7 +7461,7 @@ public partial class FactoryRunFailureFactoryLimitReached : FactoryRunFailure
 }
 
 /// <summary>The <c>factory_resume_declined</c> variant of <see cref="FactoryRunFailure"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class FactoryRunFailureFactoryResumeDeclined : FactoryRunFailure
 {
     /// <inheritdoc />
@@ -7444,7 +7478,7 @@ public partial class FactoryRunFailureFactoryResumeDeclined : FactoryRunFailure
 }
 
 /// <summary>The <c>factory_durable_failure</c> variant of <see cref="FactoryRunFailure"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class FactoryRunFailureFactoryDurableFailure : FactoryRunFailure
 {
     /// <inheritdoc />
@@ -7466,7 +7500,7 @@ public partial class FactoryRunFailureFactoryDurableFailure : FactoryRunFailure
 
 /// <summary>The run stopped because its usage accounting could not be completed.</summary>
 /// <remarks>The <c>factory_accounting_incomplete</c> variant of <see cref="FactoryRunFailure"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class FactoryRunFailureFactoryAccountingIncomplete : FactoryRunFailure
 {
     /// <inheritdoc />
@@ -7484,7 +7518,7 @@ public partial class FactoryRunFailureFactoryAccountingIncomplete : FactoryRunFa
 
 /// <summary>The extension that owns the factory disconnected while the run was executing, so the host halted it. The run's journaled subagent results are preserved so a resume can reuse them.</summary>
 /// <remarks>The <c>factory_provider_disconnected</c> variant of <see cref="FactoryRunFailure"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class FactoryRunFailureFactoryProviderDisconnected : FactoryRunFailure
 {
     /// <inheritdoc />
@@ -7498,7 +7532,7 @@ public partial class FactoryRunFailureFactoryProviderDisconnected : FactoryRunFa
 
 /// <summary>Durable metadata describing who initiated a factory pause.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -7513,7 +7547,7 @@ public partial class FactoryPauseInfo
 
 
 /// <summary>The <c>user</c> variant of <see cref="FactoryPauseInfo"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class FactoryPauseInfoUser : FactoryPauseInfo
 {
     /// <inheritdoc />
@@ -7522,7 +7556,7 @@ public partial class FactoryPauseInfoUser : FactoryPauseInfo
 }
 
 /// <summary>The <c>checkpoint</c> variant of <see cref="FactoryPauseInfo"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class FactoryPauseInfoCheckpoint : FactoryPauseInfo
 {
     /// <inheritdoc />
@@ -7535,7 +7569,7 @@ public partial class FactoryPauseInfoCheckpoint : FactoryPauseInfo
 }
 
 /// <summary>Complete current or terminal factory run envelope.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryRunResult
 {
     /// <summary>One-based execution attempt represented by this envelope. Absent before the first attempt starts or when returned by an older runtime.</summary>
@@ -7576,7 +7610,7 @@ public sealed class FactoryRunResult
 }
 
 /// <summary>Wire-only per-invocation factory resource ceiling overrides.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryRunLimits
 {
     /// <summary>Maximum AI credits consumed by factory subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops.</summary>
@@ -7597,7 +7631,7 @@ public sealed class FactoryRunLimits
 }
 
 /// <summary>Options controlling factory invocation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RunOptions
 {
     /// <summary>Per-invocation resource ceiling overrides.</summary>
@@ -7618,7 +7652,7 @@ public sealed class RunOptions
 }
 
 /// <summary>Parameters for invoking a registered factory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryRunRequest
 {
     /// <summary>Factory input value.</summary>
@@ -7639,7 +7673,7 @@ internal sealed class FactoryRunRequest
 }
 
 /// <summary>Resolved persisted factory identity and resumed run envelope.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryResumeResult
 {
     /// <summary>Persisted factory name resolved for the resumed run.</summary>
@@ -7652,7 +7686,7 @@ public sealed class FactoryResumeResult
 }
 
 /// <summary>Parameters for resuming a factory run from its persisted identity.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryResumeRequest
 {
     /// <summary>Optional per-invocation resource ceiling overrides.</summary>
@@ -7677,7 +7711,7 @@ internal sealed class FactoryResumeRequest
 }
 
 /// <summary>Options for an internal tool-originated factory invocation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryToolRunOptions
 {
     /// <summary>Per-invocation resource ceiling overrides.</summary>
@@ -7690,7 +7724,7 @@ internal sealed class FactoryToolRunOptions
 }
 
 /// <summary>Internal parameters for invoking a registered factory from a tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryToolRunRequest
 {
     /// <summary>Factory input value.</summary>
@@ -7715,7 +7749,7 @@ internal sealed class FactoryToolRunRequest
 }
 
 /// <summary>Internal parameters for resuming a factory run from a tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryToolResumeRequest
 {
     /// <summary>Optional per-invocation resource ceiling overrides.</summary>
@@ -7736,7 +7770,7 @@ internal sealed class FactoryToolResumeRequest
 }
 
 /// <summary>Parameters for retrieving a factory run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryGetRunRequest
 {
     /// <summary>Factory run identifier.</summary>
@@ -7749,7 +7783,7 @@ internal sealed class FactoryGetRunRequest
 }
 
 /// <summary>Declared or approved factory resource ceilings.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryDeclaredLimits
 {
     /// <summary>Maximum AI credits consumed by subagents and descendants.</summary>
@@ -7770,7 +7804,7 @@ public sealed class FactoryDeclaredLimits
 }
 
 /// <summary>Durable factory resource consumption.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryRunConsumed
 {
     /// <summary>Accumulated active execution time in milliseconds.</summary>
@@ -7787,7 +7821,7 @@ public sealed class FactoryRunConsumed
 }
 
 /// <summary>Current factory phase identity.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryCurrentPhase
 {
     /// <summary>Current phase identifier.</summary>
@@ -7800,7 +7834,7 @@ public sealed class FactoryCurrentPhase
 }
 
 /// <summary>Prompt-safe terminal factory outcome.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryRunTerminal
 {
     /// <summary>Human-readable terminal error.</summary>
@@ -7825,7 +7859,7 @@ public sealed class FactoryRunTerminal
 }
 
 /// <summary>Durable factory run summary with read-time live overlays.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryRunSummary
 {
     /// <summary>Epoch milliseconds when the current active segment started, or null while inactive.</summary>
@@ -7910,7 +7944,7 @@ public sealed class FactoryRunSummary
 }
 
 /// <summary>A page of factory runs in durable creation order.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryListRunsResult
 {
     /// <summary>Whether terminal runs newer than this page exist.</summary>
@@ -7935,7 +7969,7 @@ public sealed class FactoryListRunsResult
 }
 
 /// <summary>Parameters for paging factory runs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryListRunsRequest
 {
     /// <summary>Exclusive forward cursor.</summary>
@@ -7956,7 +7990,7 @@ internal sealed class FactoryListRunsRequest
 }
 
 /// <summary>Prompt-safe durable identity and live status for a direct factory agent.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryAgentSummary
 {
     /// <summary>Accumulated active agent time in milliseconds.</summary>
@@ -8017,7 +8051,7 @@ public sealed class FactoryAgentSummary
 }
 
 /// <summary>Durable lifecycle and timing for one factory phase.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryPhaseObservation
 {
     /// <summary>Completed active time accumulated by this phase in milliseconds.</summary>
@@ -8074,7 +8108,7 @@ public sealed class FactoryPhaseObservation
 }
 
 /// <summary>One durable factory progress record.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryProgressLine
 {
     /// <summary>Resume attempt that emitted this record.</summary>
@@ -8103,7 +8137,7 @@ public sealed class FactoryProgressLine
 }
 
 /// <summary>A bidirectional page of factory progress.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryProgressPage
 {
     /// <summary>Whether progress records newer than this page exist.</summary>
@@ -8132,7 +8166,7 @@ public sealed class FactoryProgressPage
 }
 
 /// <summary>Full factory run observability detail.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryRunDetail
 {
     /// <summary>Epoch milliseconds when the current active segment started, or null while inactive.</summary>
@@ -8229,7 +8263,7 @@ public sealed class FactoryRunDetail
 }
 
 /// <summary>Parameters for paging factory progress.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryGetRunProgressRequest
 {
     /// <summary>Exclusive forward cursor.</summary>
@@ -8258,7 +8292,7 @@ internal sealed class FactoryGetRunProgressRequest
 }
 
 /// <summary>Parameters for cancelling a factory run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryCancelRequest
 {
     /// <summary>Factory run identifier.</summary>
@@ -8271,7 +8305,7 @@ internal sealed class FactoryCancelRequest
 }
 
 /// <summary>Parameters for pausing a running factory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryPauseRequest
 {
     /// <summary>Factory run identifier.</summary>
@@ -8284,7 +8318,7 @@ internal sealed class FactoryPauseRequest
 }
 
 /// <summary>RPC data type for SessionFactoryPauseAtCheckpoint operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionFactoryPauseAtCheckpointResult
 {
     /// <summary>Whether this execution attempt must pause or may continue.</summary>
@@ -8293,7 +8327,7 @@ internal sealed class SessionFactoryPauseAtCheckpointResult
 }
 
 /// <summary>Parameters for an owned durable pause checkpoint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryPauseCheckpointRequest
 {
     /// <summary>Opaque token identifying the execution attempt that reached the checkpoint.</summary>
@@ -8314,13 +8348,13 @@ internal sealed class FactoryPauseCheckpointRequest
 }
 
 /// <summary>Acknowledgement that a factory request was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryAckResult
 {
 }
 
 /// <summary>One ordered factory progress line.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryLogLine
 {
     /// <summary>Progress line kind.</summary>
@@ -8337,7 +8371,7 @@ public sealed class FactoryLogLine
 }
 
 /// <summary>Parameters for recording factory progress.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryLogRequest
 {
     /// <summary>Opaque token identifying the current factory execution attempt.</summary>
@@ -8358,7 +8392,7 @@ internal sealed class FactoryLogRequest
 }
 
 /// <summary>Result of one factory-scoped subagent call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryAgentResult
 {
     /// <summary>Agent result, omitted when the agent produced no result.</summary>
@@ -8367,7 +8401,7 @@ public sealed class FactoryAgentResult
 }
 
 /// <summary>Options for one factory-scoped subagent call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryAgentOptions
 {
     /// <summary>Optional built-in or custom agent name whose definition configures the subagent.</summary>
@@ -8396,7 +8430,7 @@ public sealed class FactoryAgentOptions
 }
 
 /// <summary>Parameters for one factory-scoped subagent call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryAgentRequest
 {
     /// <summary>Opaque token identifying the current factory execution attempt.</summary>
@@ -8421,7 +8455,7 @@ internal sealed class FactoryAgentRequest
 }
 
 /// <summary>Result of reading a factory journal entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryJournalGetResult
 {
     /// <summary>Whether the journal contained the requested key.</summary>
@@ -8434,7 +8468,7 @@ public sealed class FactoryJournalGetResult
 }
 
 /// <summary>Parameters for reading a factory journal entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryJournalGetRequest
 {
     /// <summary>Opaque token identifying the current factory execution attempt.</summary>
@@ -8455,7 +8489,7 @@ internal sealed class FactoryJournalGetRequest
 }
 
 /// <summary>Parameters for storing a factory journal entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FactoryJournalPutRequest
 {
     /// <summary>Opaque token identifying the current factory execution attempt.</summary>
@@ -8481,7 +8515,7 @@ internal sealed class FactoryJournalPutRequest
 
 /// <summary>Machine-readable workflow run failure.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -8499,7 +8533,7 @@ public partial class WorkflowRunFailure
 
 
 /// <summary>The <c>workflow_limit_reached</c> variant of <see cref="WorkflowRunFailure"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class WorkflowRunFailureWorkflowLimitReached : WorkflowRunFailure
 {
     /// <inheritdoc />
@@ -8525,7 +8559,7 @@ public partial class WorkflowRunFailureWorkflowLimitReached : WorkflowRunFailure
 }
 
 /// <summary>The <c>workflow_resume_declined</c> variant of <see cref="WorkflowRunFailure"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class WorkflowRunFailureWorkflowResumeDeclined : WorkflowRunFailure
 {
     /// <inheritdoc />
@@ -8542,7 +8576,7 @@ public partial class WorkflowRunFailureWorkflowResumeDeclined : WorkflowRunFailu
 }
 
 /// <summary>The <c>workflow_durable_failure</c> variant of <see cref="WorkflowRunFailure"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class WorkflowRunFailureWorkflowDurableFailure : WorkflowRunFailure
 {
     /// <inheritdoc />
@@ -8564,7 +8598,7 @@ public partial class WorkflowRunFailureWorkflowDurableFailure : WorkflowRunFailu
 
 /// <summary>The run stopped because its usage accounting could not be completed.</summary>
 /// <remarks>The <c>workflow_accounting_incomplete</c> variant of <see cref="WorkflowRunFailure"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class WorkflowRunFailureWorkflowAccountingIncomplete : WorkflowRunFailure
 {
     /// <inheritdoc />
@@ -8582,7 +8616,7 @@ public partial class WorkflowRunFailureWorkflowAccountingIncomplete : WorkflowRu
 
 /// <summary>The extension that owns the workflow disconnected while the run was executing, so the host halted it. The run's journaled subagent results are preserved so a resume can reuse them.</summary>
 /// <remarks>The <c>workflow_provider_disconnected</c> variant of <see cref="WorkflowRunFailure"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class WorkflowRunFailureWorkflowProviderDisconnected : WorkflowRunFailure
 {
     /// <inheritdoc />
@@ -8596,7 +8630,7 @@ public partial class WorkflowRunFailureWorkflowProviderDisconnected : WorkflowRu
 
 /// <summary>Durable metadata describing who initiated a workflow pause.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -8611,7 +8645,7 @@ public partial class WorkflowPauseInfo
 
 
 /// <summary>The <c>user</c> variant of <see cref="WorkflowPauseInfo"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class WorkflowPauseInfoUser : WorkflowPauseInfo
 {
     /// <inheritdoc />
@@ -8620,7 +8654,7 @@ public partial class WorkflowPauseInfoUser : WorkflowPauseInfo
 }
 
 /// <summary>The <c>checkpoint</c> variant of <see cref="WorkflowPauseInfo"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class WorkflowPauseInfoCheckpoint : WorkflowPauseInfo
 {
     /// <inheritdoc />
@@ -8633,7 +8667,7 @@ public partial class WorkflowPauseInfoCheckpoint : WorkflowPauseInfo
 }
 
 /// <summary>Complete current or terminal workflow run envelope.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowRunResult
 {
     /// <summary>One-based execution attempt represented by this envelope. Absent before the first attempt starts or when returned by an older runtime.</summary>
@@ -8674,7 +8708,7 @@ public sealed class WorkflowRunResult
 }
 
 /// <summary>Wire-only per-invocation workflow resource ceiling overrides.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowRunLimits
 {
     /// <summary>Maximum AI credits consumed by workflow subagents and their descendants. The post-paid ceiling is soft: parallel turns can settle beyond it before the run stops.</summary>
@@ -8695,7 +8729,7 @@ public sealed class WorkflowRunLimits
 }
 
 /// <summary>Options controlling workflow invocation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowRunOptions
 {
     /// <summary>Per-invocation resource ceiling overrides.</summary>
@@ -8716,7 +8750,7 @@ public sealed class WorkflowRunOptions
 }
 
 /// <summary>Parameters for invoking a registered workflow.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowRunRequest
 {
     /// <summary>Workflow input value.</summary>
@@ -8737,7 +8771,7 @@ internal sealed class WorkflowRunRequest
 }
 
 /// <summary>Resolved persisted workflow identity and resumed run envelope.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowResumeResult
 {
     /// <summary>Terminal resumed run envelope.</summary>
@@ -8750,7 +8784,7 @@ public sealed class WorkflowResumeResult
 }
 
 /// <summary>Parameters for resuming a workflow run from its persisted identity.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowResumeRequest
 {
     /// <summary>Optional per-invocation resource ceiling overrides.</summary>
@@ -8775,7 +8809,7 @@ internal sealed class WorkflowResumeRequest
 }
 
 /// <summary>Options for an internal tool-originated workflow invocation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowToolRunOptions
 {
     /// <summary>Per-invocation resource ceiling overrides.</summary>
@@ -8788,7 +8822,7 @@ internal sealed class WorkflowToolRunOptions
 }
 
 /// <summary>Internal parameters for invoking a registered workflow from a tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowToolRunRequest
 {
     /// <summary>Workflow input value.</summary>
@@ -8813,7 +8847,7 @@ internal sealed class WorkflowToolRunRequest
 }
 
 /// <summary>Internal parameters for resuming a workflow run from a tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowToolResumeRequest
 {
     /// <summary>Optional per-invocation resource ceiling overrides.</summary>
@@ -8834,7 +8868,7 @@ internal sealed class WorkflowToolResumeRequest
 }
 
 /// <summary>Parameters for retrieving a workflow run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowGetRunRequest
 {
     /// <summary>Workflow run identifier.</summary>
@@ -8847,7 +8881,7 @@ internal sealed class WorkflowGetRunRequest
 }
 
 /// <summary>Declared or approved workflow resource ceilings.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowDeclaredLimits
 {
     /// <summary>Maximum AI credits consumed by subagents and descendants.</summary>
@@ -8868,7 +8902,7 @@ public sealed class WorkflowDeclaredLimits
 }
 
 /// <summary>Durable workflow resource consumption.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowRunConsumed
 {
     /// <summary>Accumulated active execution time in milliseconds.</summary>
@@ -8885,7 +8919,7 @@ public sealed class WorkflowRunConsumed
 }
 
 /// <summary>Current workflow phase identity.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowCurrentPhase
 {
     /// <summary>Current phase identifier.</summary>
@@ -8898,7 +8932,7 @@ public sealed class WorkflowCurrentPhase
 }
 
 /// <summary>Prompt-safe terminal workflow outcome.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowRunTerminal
 {
     /// <summary>Human-readable terminal error.</summary>
@@ -8923,7 +8957,7 @@ public sealed class WorkflowRunTerminal
 }
 
 /// <summary>Durable workflow run summary with read-time live overlays.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowRunSummary
 {
     /// <summary>Epoch milliseconds when the current active segment started, or null while inactive.</summary>
@@ -9008,7 +9042,7 @@ public sealed class WorkflowRunSummary
 }
 
 /// <summary>A page of workflow runs in durable creation order.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowListRunsResult
 {
     /// <summary>Whether terminal runs newer than this page exist.</summary>
@@ -9033,7 +9067,7 @@ public sealed class WorkflowListRunsResult
 }
 
 /// <summary>Parameters for paging workflow runs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowListRunsRequest
 {
     /// <summary>Exclusive forward cursor.</summary>
@@ -9054,7 +9088,7 @@ internal sealed class WorkflowListRunsRequest
 }
 
 /// <summary>Prompt-safe durable identity and live status for a direct workflow agent.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowAgentSummary
 {
     /// <summary>Accumulated active agent time in milliseconds.</summary>
@@ -9115,7 +9149,7 @@ public sealed class WorkflowAgentSummary
 }
 
 /// <summary>Durable lifecycle and timing for one workflow phase.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowPhaseObservation
 {
     /// <summary>Completed active time accumulated by this phase in milliseconds.</summary>
@@ -9172,7 +9206,7 @@ public sealed class WorkflowPhaseObservation
 }
 
 /// <summary>One durable workflow progress record.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowProgressLine
 {
     /// <summary>Resume attempt that emitted this record.</summary>
@@ -9201,7 +9235,7 @@ public sealed class WorkflowProgressLine
 }
 
 /// <summary>A bidirectional page of workflow progress.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowProgressPage
 {
     /// <summary>Whether progress records newer than this page exist.</summary>
@@ -9230,7 +9264,7 @@ public sealed class WorkflowProgressPage
 }
 
 /// <summary>Full workflow run observability detail.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowRunDetail
 {
     /// <summary>Epoch milliseconds when the current active segment started, or null while inactive.</summary>
@@ -9327,7 +9361,7 @@ public sealed class WorkflowRunDetail
 }
 
 /// <summary>Parameters for paging workflow progress.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowGetRunProgressRequest
 {
     /// <summary>Exclusive forward cursor.</summary>
@@ -9356,7 +9390,7 @@ internal sealed class WorkflowGetRunProgressRequest
 }
 
 /// <summary>Parameters for cancelling a workflow run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowCancelRequest
 {
     /// <summary>Workflow run identifier.</summary>
@@ -9369,7 +9403,7 @@ internal sealed class WorkflowCancelRequest
 }
 
 /// <summary>Parameters for pausing a running workflow.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowPauseRequest
 {
     /// <summary>Workflow run identifier.</summary>
@@ -9382,7 +9416,7 @@ internal sealed class WorkflowPauseRequest
 }
 
 /// <summary>RPC data type for SessionWorkflowPauseAtCheckpoint operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionWorkflowPauseAtCheckpointResult
 {
     /// <summary>Whether this execution attempt must pause or may continue.</summary>
@@ -9391,7 +9425,7 @@ internal sealed class SessionWorkflowPauseAtCheckpointResult
 }
 
 /// <summary>Parameters for an owned durable pause checkpoint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowPauseCheckpointRequest
 {
     /// <summary>Opaque token identifying the execution attempt that reached the checkpoint.</summary>
@@ -9412,13 +9446,13 @@ internal sealed class WorkflowPauseCheckpointRequest
 }
 
 /// <summary>Acknowledgement that a workflow request was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowAckResult
 {
 }
 
 /// <summary>One ordered workflow progress line.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowLogLine
 {
     /// <summary>Progress line kind.</summary>
@@ -9435,7 +9469,7 @@ public sealed class WorkflowLogLine
 }
 
 /// <summary>Parameters for recording workflow progress.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowLogRequest
 {
     /// <summary>Opaque token identifying the current workflow execution attempt.</summary>
@@ -9456,7 +9490,7 @@ internal sealed class WorkflowLogRequest
 }
 
 /// <summary>Result of one workflow-scoped subagent call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowAgentResult
 {
     /// <summary>Agent result, omitted when the agent produced no result.</summary>
@@ -9465,7 +9499,7 @@ public sealed class WorkflowAgentResult
 }
 
 /// <summary>Options for one workflow-scoped subagent call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowAgentOptions
 {
     /// <summary>Optional built-in or custom agent name whose definition configures the subagent.</summary>
@@ -9494,7 +9528,7 @@ public sealed class WorkflowAgentOptions
 }
 
 /// <summary>Parameters for one workflow-scoped subagent call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowAgentRequest
 {
     /// <summary>Opaque token identifying the current workflow execution attempt.</summary>
@@ -9519,7 +9553,7 @@ internal sealed class WorkflowAgentRequest
 }
 
 /// <summary>Result of reading a workflow journal entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowJournalGetResult
 {
     /// <summary>Whether the journal contained the requested key.</summary>
@@ -9532,7 +9566,7 @@ public sealed class WorkflowJournalGetResult
 }
 
 /// <summary>Parameters for reading a workflow journal entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowJournalGetRequest
 {
     /// <summary>Opaque token identifying the current workflow execution attempt.</summary>
@@ -9553,7 +9587,7 @@ internal sealed class WorkflowJournalGetRequest
 }
 
 /// <summary>Parameters for storing a workflow journal entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkflowJournalPutRequest
 {
     /// <summary>Opaque token identifying the current workflow execution attempt.</summary>
@@ -9578,7 +9612,7 @@ internal sealed class WorkflowJournalPutRequest
 }
 
 /// <summary>The session's authoritative model snapshot. Auto preference fields are configuration for the virtual `auto` model and do not change the selected model identifier. The context tier reflects `Session.getContextTier()`, restored from the session journal on resume.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CurrentModel
 {
     /// <summary>Auto preference currently claimed by an in-progress activation. Null means the activation is returning to provider-default routing.</summary>
@@ -9607,7 +9641,7 @@ public sealed class CurrentModel
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionModelGetCurrentRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -9616,7 +9650,7 @@ internal sealed class SessionModelGetCurrentRequest
 }
 
 /// <summary>RPC data type for ModelSwitchConfirmation operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelSwitchConfirmation
 {
     /// <summary>Current conversation token count before switching models.</summary>
@@ -9633,7 +9667,7 @@ public sealed class ModelSwitchConfirmation
 }
 
 /// <summary>The model identifier active on the session after the switch.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelSwitchToResult
 {
     /// <summary>Compaction confirmation projection when status is confirmation_required.</summary>
@@ -9678,7 +9712,7 @@ public sealed class ModelSwitchToResult
 }
 
 /// <summary>Vision-specific limits.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelCapabilitiesOverrideLimitsVision
 {
     /// <summary>Maximum image size in bytes.</summary>
@@ -9695,7 +9729,7 @@ public sealed class ModelCapabilitiesOverrideLimitsVision
 }
 
 /// <summary>Token limits for prompts, outputs, and context window.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelCapabilitiesOverrideLimits
 {
     /// <summary>Maximum total context window size in tokens.</summary>
@@ -9716,7 +9750,7 @@ public sealed class ModelCapabilitiesOverrideLimits
 }
 
 /// <summary>Feature flags indicating what the model supports.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelCapabilitiesOverrideSupports
 {
     /// <summary>Resolved Anthropic adaptive-thinking capability — unsupported / optional / required / adaptive_only. 'required' models reject thinking.type='enabled' with HTTP 400 but still accept 'disabled' (e.g. opus-4.7/4.8/5, sonnet-5); 'adaptive_only' models accept nothing but 'adaptive' (e.g. fable, mythos).</summary>
@@ -9737,7 +9771,7 @@ public sealed class ModelCapabilitiesOverrideSupports
 }
 
 /// <summary>Optional capability overrides (vision, tool_calls, reasoning, etc.).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelCapabilitiesOverride
 {
     /// <summary>Token limits for prompts, outputs, and context window.</summary>
@@ -9755,7 +9789,7 @@ public sealed class ModelPickerSettingsContextEnvironment
 }
 
 /// <summary>Filesystem and environment context used to resolve model-picker settings.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelPickerSettingsContext
 {
     /// <summary>Optional Copilot configuration directory containing persisted settings.</summary>
@@ -9772,7 +9806,7 @@ public sealed class ModelPickerSettingsContext
 }
 
 /// <summary>RPC data type for ModelPickerPersistence operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelPickerPersistenceRequest
 {
     /// <summary>Whether context tier was explicitly selected and should be persisted.</summary>
@@ -9789,7 +9823,7 @@ public sealed class ModelPickerPersistenceRequest
 }
 
 /// <summary>Target model identifier and optional reasoning effort, summary, capability overrides, and context tier.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ModelSwitchToRequest
 {
     /// <summary>Optional Auto routing preference to stage atomically with selecting `auto`. Pass null to return to provider-default Auto routing. This field is rejected when `modelId` is not `auto`.</summary>
@@ -9858,7 +9892,7 @@ internal sealed class ModelSwitchToRequest
 }
 
 /// <summary>Immediate acknowledgement and Auto preference snapshot after a switch request. This result never implies that a pending preference committed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelSwitchAutoTierResult
 {
     /// <summary>Auto preference currently claimed by an in-progress activation. Null means the activation is returning to provider-default routing.</summary>
@@ -9883,7 +9917,7 @@ public sealed class ModelSwitchAutoTierResult
 }
 
 /// <summary>An Auto preference request for the session. This updates Auto configuration only; it does not change the selected model to `auto`.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ModelSwitchAutoTierRequest
 {
     /// <summary>Auto preference to activate when a future user turn using the `auto` model safely mints a replacement model and token pair. Pass null to return to provider-default Auto routing.</summary>
@@ -9901,7 +9935,7 @@ internal sealed class ModelSwitchAutoTierRequest
 }
 
 /// <summary>Managed, repository, and CLI model overrides to overlay onto the session at startup.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ModelApplyStartupOverlayRequest
 {
     /// <summary>Effective default Auto routing preference from user and managed settings. Applies only to fresh sessions and never replaces a per-session selection.</summary>
@@ -9950,7 +9984,7 @@ internal sealed class ModelApplyStartupOverlayRequest
 }
 
 /// <summary>The applied host allowlist and effective session model policy after intersection.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelSetAllowedModelsResult
 {
     /// <summary>Normalized host allowlist. Omitted when the host restriction was cleared, or when a relay client does not return the host policy.</summary>
@@ -9971,7 +10005,7 @@ public sealed class ModelSetAllowedModelsResult
 }
 
 /// <summary>Host-supplied exact model selection IDs to allow for this running session. CAPI IDs are intersected with repository `.github/allowed_models.txt` policy; provider-qualified IDs remain exempt from repository-only policy but are restricted by this host list. Omit or pass null to clear the host restriction; an explicit empty or disjoint list is rejected. Validation and pre-selection fallback failures preserve the previous restriction. Failures after a fallback selection commits retain the new restriction and selected model; callers should inspect current session state after such an error.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ModelSetAllowedModelsRequest
 {
     /// <summary>Exact model IDs to permit, or null to clear the host restriction.</summary>
@@ -9984,7 +10018,7 @@ internal sealed class ModelSetAllowedModelsRequest
 }
 
 /// <summary>Update the session's reasoning effort without changing the selected model. Use `switchTo` instead when you also need to change the model. The runtime stores the effort on the session and applies it to subsequent turns.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelSetReasoningEffortResult
 {
     /// <summary>Reasoning effort level recorded on the session after the update.</summary>
@@ -9993,7 +10027,7 @@ public sealed class ModelSetReasoningEffortResult
 }
 
 /// <summary>Reasoning effort level to apply to the currently selected model.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ModelSetReasoningEffortRequest
 {
     /// <summary>Reasoning effort level to apply to the currently selected model. The host is responsible for validating the value against the model's supported levels before calling.</summary>
@@ -10006,7 +10040,7 @@ internal sealed class ModelSetReasoningEffortRequest
 }
 
 /// <summary>Cost-category metadata for a CAPI model.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionModelPriceCategory
 {
     /// <summary>CAPI model identifier.</summary>
@@ -10019,7 +10053,7 @@ public sealed class SessionModelPriceCategory
 }
 
 /// <summary>The list of models available to this session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionModelList
 {
     /// <summary>Available models, ordered with the most preferred default first. Includes both Copilot (CAPI) models and any registry BYOK models; a BYOK model appears under its provider-qualified selection id (`provider/id`).</summary>
@@ -10036,7 +10070,7 @@ public sealed class SessionModelList
 }
 
 /// <summary>RPC data type for SessionModelList operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionModelListRequest
 {
     /// <summary>If true, bypasses the per-session model list cache and re-fetches from CAPI.</summary>
@@ -10045,7 +10079,7 @@ public sealed class SessionModelListRequest
 }
 
 /// <summary>RPC data type for SessionModelListRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionModelListRequestWithSession
 {
     /// <summary>Target session identifier.</summary>
@@ -10058,7 +10092,7 @@ internal sealed class SessionModelListRequestWithSession
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionModeGetRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10067,7 +10101,7 @@ internal sealed class SessionModeGetRequest
 }
 
 /// <summary>Outcome of a session mode change, including any model switch it triggered and follow-up the host must perform.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModeSetResult
 {
     /// <summary>Whether the host should arm an interactive continuation after the mode change.</summary>
@@ -10108,7 +10142,7 @@ public sealed class ModeSetResult
 }
 
 /// <summary>Agent interaction mode to apply to the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ModeSetRequest
 {
     /// <summary>Explicit response to a model-switch compaction preflight.</summary>
@@ -10165,7 +10199,7 @@ internal sealed class ModeSetRequest
 }
 
 /// <summary>The session's friendly name, or null when not yet set.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class NameGetResult
 {
     /// <summary>The session name (user-set or auto-generated), or null if not yet set.</summary>
@@ -10174,7 +10208,7 @@ public sealed class NameGetResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionNameGetRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10183,7 +10217,7 @@ internal sealed class SessionNameGetRequest
 }
 
 /// <summary>New friendly name to apply to the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class NameSetRequest
 {
     /// <summary>New session name (1–100 characters, trimmed of leading/trailing whitespace).</summary>
@@ -10199,7 +10233,7 @@ internal sealed class NameSetRequest
 }
 
 /// <summary>Indicates whether the auto-generated summary was applied as the session's name.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class NameSetAutoResult
 {
     /// <summary>Whether the auto-generated summary was persisted. False if the session already has a user-set name, the summary normalized to empty, or the session does not have a workspace.</summary>
@@ -10208,7 +10242,7 @@ public sealed class NameSetAutoResult
 }
 
 /// <summary>Auto-generated session summary to apply as the session's name when no user-set name exists.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class NameSetAutoRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10221,7 +10255,7 @@ internal sealed class NameSetAutoRequest
 }
 
 /// <summary>Existence, contents, and resolved path of the session plan file.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PlanReadResult
 {
     /// <summary>The content of the plan file, or null if it does not exist.</summary>
@@ -10238,7 +10272,7 @@ public sealed class PlanReadResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPlanReadRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10247,7 +10281,7 @@ internal sealed class SessionPlanReadRequest
 }
 
 /// <summary>Replacement contents to write to the session plan file.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PlanUpdateRequest
 {
     /// <summary>The new content for the plan file.</summary>
@@ -10260,7 +10294,7 @@ internal sealed class PlanUpdateRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPlanDeleteRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10269,7 +10303,7 @@ internal sealed class SessionPlanDeleteRequest
 }
 
 /// <summary>A single todo row read from the session SQL `todos` table. All fields are optional because the SQL schema is best-effort and the agent may not have populated every column.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PlanSqlTodosRow
 {
     /// <summary>Todo creation time, as stored by the session SQL schema's `datetime('now')` default: `YYYY-MM-DD HH:MM:SS` in UTC. Lets clients attribute todos to the work item that created them (e.g. scoping a goal's progress to the todos it produced) rather than to the whole session.</summary>
@@ -10294,7 +10328,7 @@ public sealed class PlanSqlTodosRow
 }
 
 /// <summary>Todo rows read from the session SQL database. Empty when no session database is available.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PlanReadSqlTodosResult
 {
     /// <summary>Rows from the session SQL todos table, ordered by creation time with insertion order used to break ties when available and id used for WITHOUT ROWID tables.</summary>
@@ -10303,7 +10337,7 @@ public sealed class PlanReadSqlTodosResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPlanReadSqlTodosRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10312,7 +10346,7 @@ internal sealed class SessionPlanReadSqlTodosRequest
 }
 
 /// <summary>A single dependency edge read from the session SQL `todo_deps` table, indicating that one todo must complete before another.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PlanSqlTodoDependency
 {
     /// <summary>ID of the todo it depends on.</summary>
@@ -10325,7 +10359,7 @@ public sealed class PlanSqlTodoDependency
 }
 
 /// <summary>Todo rows + dependency edges read from the session SQL database.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PlanReadSqlTodosWithDependenciesResult
 {
     /// <summary>Edges from the session SQL todo_deps table. Empty when no database, no todo_deps table, or the SELECT failed. Read independently from `rows`, so a broken todo_deps table does not affect the rows result and vice versa.</summary>
@@ -10338,7 +10372,7 @@ public sealed class PlanReadSqlTodosWithDependenciesResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPlanReadSqlTodosWithDependenciesRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10421,7 +10455,7 @@ public sealed class WorkspacesGetWorkspaceResultWorkspace
 }
 
 /// <summary>Current workspace metadata for the session, including its absolute filesystem path when available.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesGetWorkspaceResult
 {
     /// <summary>Absolute filesystem path to the workspace directory. Omitted when the session has no workspace (e.g. remote sessions).</summary>
@@ -10434,7 +10468,7 @@ public sealed class WorkspacesGetWorkspaceResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionWorkspacesGetWorkspaceRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10443,7 +10477,7 @@ internal sealed class SessionWorkspacesGetWorkspaceRequest
 }
 
 /// <summary>Workspace metadata fields to update.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesUpdateMetadataRequest
 {
     /// <summary>Opaque workspace context supplied by the session host.</summary>
@@ -10460,7 +10494,7 @@ internal sealed class WorkspacesUpdateMetadataRequest
 }
 
 /// <summary>Optional session context used when creating a local workspace.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesEnsureRequest
 {
     /// <summary>Opaque workspace context supplied by the session host.</summary>
@@ -10473,7 +10507,7 @@ internal sealed class WorkspacesEnsureRequest
 }
 
 /// <summary>Relative paths of files stored in the session workspace files directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesListFilesResult
 {
     /// <summary>Slash-separated relative file paths in the workspace files directory.</summary>
@@ -10482,7 +10516,7 @@ public sealed class WorkspacesListFilesResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionWorkspacesListFilesRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10491,7 +10525,7 @@ internal sealed class SessionWorkspacesListFilesRequest
 }
 
 /// <summary>Contents of the requested workspace file as a UTF-8 string.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesReadFileResult
 {
     /// <summary>File content as a UTF-8 string.</summary>
@@ -10500,7 +10534,7 @@ public sealed class WorkspacesReadFileResult
 }
 
 /// <summary>Relative path of the workspace file to read.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesReadFileRequest
 {
     /// <summary>Slash-separated relative path within the workspace files directory.</summary>
@@ -10513,7 +10547,7 @@ internal sealed class WorkspacesReadFileRequest
 }
 
 /// <summary>Relative path and UTF-8 content for the workspace file to create or overwrite.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesCreateFileRequest
 {
     /// <summary>File content to write as a UTF-8 string.</summary>
@@ -10530,7 +10564,7 @@ internal sealed class WorkspacesCreateFileRequest
 }
 
 /// <summary>Filesystem metadata for a path in the session workspace files directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesStatFileResult
 {
     /// <summary>Creation time in Unix epoch milliseconds.</summary>
@@ -10555,7 +10589,7 @@ public sealed class WorkspacesStatFileResult
 }
 
 /// <summary>Relative path of the workspace file or directory to inspect.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesStatFileRequest
 {
     /// <summary>Slash-separated relative path within the workspace files directory.</summary>
@@ -10568,7 +10602,7 @@ internal sealed class WorkspacesStatFileRequest
 }
 
 /// <summary>Directory to create within the session workspace files directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesCreateDirectoryRequest
 {
     /// <summary>Slash-separated relative path within the workspace files directory.</summary>
@@ -10585,7 +10619,7 @@ internal sealed class WorkspacesCreateDirectoryRequest
 }
 
 /// <summary>File or directory to remove from the session workspace files directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesRemovePathRequest
 {
     /// <summary>Whether a missing path should be treated as success. Defaults to false.</summary>
@@ -10606,7 +10640,7 @@ internal sealed class WorkspacesRemovePathRequest
 }
 
 /// <summary>Source and destination paths for a rename within the session workspace files directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesRenamePathRequest
 {
     /// <summary>Slash-separated destination path relative to the workspace files directory.</summary>
@@ -10623,7 +10657,7 @@ internal sealed class WorkspacesRenamePathRequest
 }
 
 /// <summary>Workspace checkpoint metadata with assigned number, human-readable title, and checkpoint filename.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesCheckpoints
 {
     /// <summary>Filename of the checkpoint within the workspace checkpoints directory.</summary>
@@ -10640,7 +10674,7 @@ public sealed class WorkspacesCheckpoints
 }
 
 /// <summary>Workspace checkpoints in chronological order; empty when the workspace is not enabled.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesListCheckpointsResult
 {
     /// <summary>Workspace checkpoints in chronological order. Empty when workspace is not enabled.</summary>
@@ -10649,7 +10683,7 @@ public sealed class WorkspacesListCheckpointsResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionWorkspacesListCheckpointsRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10658,7 +10692,7 @@ internal sealed class SessionWorkspacesListCheckpointsRequest
 }
 
 /// <summary>Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesReadCheckpointResult
 {
     /// <summary>Checkpoint content as a UTF-8 string, or null when the checkpoint or workspace is missing.</summary>
@@ -10667,7 +10701,7 @@ public sealed class WorkspacesReadCheckpointResult
 }
 
 /// <summary>Checkpoint number to read.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesReadCheckpointRequest
 {
     /// <summary>Checkpoint number to read.</summary>
@@ -10690,7 +10724,7 @@ public sealed class WorkspacesAddSummaryResultWorkspace
 }
 
 /// <summary>Persisted summary metadata and refreshed workspace metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesAddSummaryResult
 {
     /// <summary>Metadata for the persisted summary.</summary>
@@ -10703,7 +10737,7 @@ public sealed class WorkspacesAddSummaryResult
 }
 
 /// <summary>Compaction summary checkpoint to persist.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesAddSummaryRequest
 {
     /// <summary>Markdown summary content to persist.</summary>
@@ -10720,7 +10754,7 @@ internal sealed class WorkspacesAddSummaryRequest
 }
 
 /// <summary>Rollback point for local workspace summaries.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesTruncateSummariesRequest
 {
     /// <summary>Number of newest summaries to keep.</summary>
@@ -10733,7 +10767,7 @@ internal sealed class WorkspacesTruncateSummariesRequest
 }
 
 /// <summary>Autopilot objective file content, or null when missing.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesReadAutopilotObjectiveResult
 {
     /// <summary>Autopilot objective file content, or null when missing.</summary>
@@ -10742,7 +10776,7 @@ public sealed class WorkspacesReadAutopilotObjectiveResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionWorkspacesReadAutopilotObjectiveRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10751,7 +10785,7 @@ internal sealed class SessionWorkspacesReadAutopilotObjectiveRequest
 }
 
 /// <summary>Result of writing the autopilot objective file.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesWriteAutopilotObjectiveResult
 {
     /// <summary>Filesystem operation performed.</summary>
@@ -10760,7 +10794,7 @@ public sealed class WorkspacesWriteAutopilotObjectiveResult
 }
 
 /// <summary>Autopilot objective file content to persist.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesWriteAutopilotObjectiveRequest
 {
     /// <summary>Autopilot objective file content.</summary>
@@ -10773,7 +10807,7 @@ internal sealed class WorkspacesWriteAutopilotObjectiveRequest
 }
 
 /// <summary>Result of deleting the autopilot objective file.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesDeleteAutopilotObjectiveResult
 {
     /// <summary>True when a file was deleted.</summary>
@@ -10782,7 +10816,7 @@ public sealed class WorkspacesDeleteAutopilotObjectiveResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionWorkspacesDeleteAutopilotObjectiveRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10791,7 +10825,7 @@ internal sealed class SessionWorkspacesDeleteAutopilotObjectiveRequest
 }
 
 /// <summary>Whether the autopilot objective file exists.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesAutopilotObjectiveExistsResult
 {
     /// <summary>True when the objective file exists.</summary>
@@ -10800,7 +10834,7 @@ public sealed class WorkspacesAutopilotObjectiveExistsResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionWorkspacesAutopilotObjectiveExistsRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10825,7 +10859,7 @@ public sealed class WorkspacesSaveLargePasteResultSaved
 }
 
 /// <summary>Descriptor for the saved paste file, or null when the workspace is unavailable.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesSaveLargePasteResult
 {
     /// <summary>Saved-paste descriptor, or null when the workspace is unavailable (e.g. CCA runtime, non-infinite sessions, remote sessions).</summary>
@@ -10834,7 +10868,7 @@ public sealed class WorkspacesSaveLargePasteResult
 }
 
 /// <summary>Pasted content to save as a UTF-8 file in the session workspace.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesSaveLargePasteRequest
 {
     /// <summary>Pasted content to save as a UTF-8 file.</summary>
@@ -10847,7 +10881,7 @@ internal sealed class WorkspacesSaveLargePasteRequest
 }
 
 /// <summary>A single changed file and its unified diff.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspaceDiffFileChange
 {
     /// <summary>Type of change represented by this file diff.</summary>
@@ -10872,7 +10906,7 @@ public sealed class WorkspaceDiffFileChange
 }
 
 /// <summary>Workspace diff result for the requested mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspaceDiffResult
 {
     /// <summary>Default branch used for a branch diff, when branch mode was requested.</summary>
@@ -10901,7 +10935,7 @@ public sealed class WorkspaceDiffResult
 }
 
 /// <summary>Parameters for computing a workspace diff.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class WorkspacesDiffRequest
 {
     /// <summary>When true, ignore whitespace-only changes (git `--ignore-all-space`). Defaults to false.</summary>
@@ -10918,7 +10952,7 @@ internal sealed class WorkspacesDiffRequest
 }
 
 /// <summary>Current per-window credit limit and consumption for an autopilot objective.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AutopilotObjectiveCreditLimit
 {
     /// <summary>Configured AI-credit cap, when one is set.</summary>
@@ -10936,7 +10970,7 @@ public sealed class AutopilotObjectiveCreditLimit
 }
 
 /// <summary>Public, persistence-independent projection of an autopilot objective.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AutopilotObjectiveState
 {
     /// <summary>Optional summary recorded when the objective completed.</summary>
@@ -10974,7 +11008,7 @@ public sealed class AutopilotObjectiveState
 }
 
 /// <summary>Canonical runtime state for the session's current autopilot objective.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AutopilotObjectiveGetStateResult
 {
     /// <summary>Current objective state, or `null` when the session has no objective.</summary>
@@ -10983,7 +11017,7 @@ public sealed class AutopilotObjectiveGetStateResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionAutopilotObjectiveGetStateRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -10992,7 +11026,7 @@ internal sealed class SessionAutopilotObjectiveGetStateRequest
 }
 
 /// <summary>Characters that, when typed in the composer, should trigger a `completions.request`. Empty when the session has no host-driven completions (e.g. local sessions, or a relay host that does not advertise `completionTriggerCharacters`).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CompletionsGetTriggerCharactersResult
 {
     /// <summary>Trigger characters advertised by the host (e.g. `["@", "#"]`). Empty disables host-driven completions for the session.</summary>
@@ -11001,7 +11035,7 @@ public sealed class CompletionsGetTriggerCharactersResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionCompletionsGetTriggerCharactersRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -11010,7 +11044,7 @@ internal sealed class SessionCompletionsGetTriggerCharactersRequest
 }
 
 /// <summary>A single host-driven completion. Accepting an item replaces `[rangeStart, rangeEnd)` (UTF-16 code units) in the composer with `insertText`; when the range is absent, the active token around the cursor is replaced.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionCompletionItem
 {
     /// <summary>Text spliced into the composer when the item is accepted.</summary>
@@ -11035,7 +11069,7 @@ public sealed class SessionCompletionItem
 }
 
 /// <summary>Host-driven completion items for the current composer input. Empty when the host returns no items or does not support completions.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CompletionsRequestResult
 {
     /// <summary>Completion items in host-ranked order.</summary>
@@ -11044,7 +11078,7 @@ public sealed class CompletionsRequestResult
 }
 
 /// <summary>Request host-driven completions for the current composer input.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CompletionsRequestRequest
 {
     /// <summary>Cursor offset within `text`, in UTF-16 code units.</summary>
@@ -11061,7 +11095,7 @@ internal sealed class CompletionsRequestRequest
 }
 
 /// <summary>Instruction sources loaded for the session, in merge order.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class InstructionsGetSourcesResult
 {
     /// <summary>Instruction sources for the session.</summary>
@@ -11070,7 +11104,7 @@ public sealed class InstructionsGetSourcesResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionInstructionsGetSourcesRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -11078,8 +11112,39 @@ internal sealed class SessionInstructionsGetSourcesRequest
     public string SessionId { get; set; } = string.Empty;
 }
 
+/// <summary>Identifies the target session.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+internal sealed class SessionInstructionsReloadRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
+/// <summary>Diagnostics from reloading skill definitions, with warnings and errors as separate lists.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class SkillsLoadDiagnostics
+{
+    /// <summary>Errors emitted while loading skills (e.g. skills that failed to load entirely).</summary>
+    [JsonPropertyName("errors")]
+    public IList<string> Errors { get => field ??= []; set; }
+
+    /// <summary>Warnings emitted while loading skills (e.g. skills that loaded but had issues).</summary>
+    [JsonPropertyName("warnings")]
+    public IList<string> Warnings { get => field ??= []; set; }
+}
+
+/// <summary>Identifies the target session.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+internal sealed class SessionCustomizationsReloadRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+}
+
 /// <summary>Indicates whether fleet mode was successfully activated.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FleetStartResult
 {
     /// <summary>Whether fleet mode was successfully activated.</summary>
@@ -11088,7 +11153,7 @@ public sealed class FleetStartResult
 }
 
 /// <summary>Parameters for starting fleet orchestration: an optional user prompt combined with the fleet instructions, plus the send options forwarded to the resulting turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FleetStartRequest
 {
     /// <summary>Optional attachments (files, directories, selections, blobs, GitHub references) to include with the fleet request.</summary>
@@ -11114,7 +11179,7 @@ internal sealed class FleetStartRequest
 }
 
 /// <summary>Agents available to the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentList
 {
     /// <summary>Available agents.</summary>
@@ -11123,7 +11188,7 @@ public sealed class AgentList
 }
 
 /// <summary>RPC data type for SessionAgentList operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionAgentListRequest
 {
     /// <summary>When true, request the session's configured built-in agents alongside custom agents. Listing applies feature, context, inclusion, exclusion, and user-disabled-agent policy, but does not evaluate transient invocation requirements such as model availability. Built-in metadata may be omitted when the session cannot project it, such as a relay session.</summary>
@@ -11136,7 +11201,7 @@ public sealed class SessionAgentListRequest
 }
 
 /// <summary>RPC data type for SessionAgentListRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionAgentListRequestWithSession
 {
     /// <summary>When true, request the session's configured built-in agents alongside custom agents. Listing applies feature, context, inclusion, exclusion, and user-disabled-agent policy, but does not evaluate transient invocation requirements such as model availability. Built-in metadata may be omitted when the session cannot project it, such as a relay session.</summary>
@@ -11153,7 +11218,7 @@ internal sealed class SessionAgentListRequestWithSession
 }
 
 /// <summary>An in-memory authored prompt override for an available agent.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class AgentSetPromptRequest
 {
     /// <summary>Stable effective agent id. Plugin namespace separators are normalized.</summary>
@@ -11170,7 +11235,7 @@ internal sealed class AgentSetPromptRequest
 }
 
 /// <summary>The currently selected custom agent, or null when using the default agent.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentGetCurrentResult
 {
     /// <summary>Currently selected custom agent, or null if using the default agent.</summary>
@@ -11179,7 +11244,7 @@ public sealed class AgentGetCurrentResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionAgentGetCurrentRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -11188,7 +11253,7 @@ internal sealed class SessionAgentGetCurrentRequest
 }
 
 /// <summary>The newly selected custom agent.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentSelectResult
 {
     /// <summary>The newly selected custom agent.</summary>
@@ -11197,7 +11262,7 @@ public sealed class AgentSelectResult
 }
 
 /// <summary>Name of the custom agent to select for subsequent turns.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class AgentSelectRequest
 {
     /// <summary>Name of the custom agent to select.</summary>
@@ -11210,7 +11275,7 @@ internal sealed class AgentSelectRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionAgentDeselectRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -11219,7 +11284,7 @@ internal sealed class SessionAgentDeselectRequest
 }
 
 /// <summary>Custom agents available to the session after reloading definitions from disk.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentReloadResult
 {
     /// <summary>Reloaded custom agents.</summary>
@@ -11228,7 +11293,7 @@ public sealed class AgentReloadResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionAgentReloadRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -11237,7 +11302,7 @@ internal sealed class SessionAgentReloadRequest
 }
 
 /// <summary>Identifier assigned to the newly started background agent task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksStartAgentResult
 {
     /// <summary>Generated agent ID for the background task.</summary>
@@ -11246,7 +11311,7 @@ public sealed class TasksStartAgentResult
 }
 
 /// <summary>Agent type, prompt, name, and optional description and model override for the new task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class TasksStartAgentRequest
 {
     /// <summary>Type of agent to start (e.g., 'explore', 'task', 'general-purpose').</summary>
@@ -11276,7 +11341,7 @@ internal sealed class TasksStartAgentRequest
 
 /// <summary>Tracked task union returned by task APIs, containing an agent, client, or shell task.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -11293,7 +11358,7 @@ public partial class TaskInfo
 
 /// <summary>Tracked background agent task metadata, including IDs, status, timing, agent type, prompt, model, result, and latest response.</summary>
 /// <remarks>The <c>agent</c> variant of <see cref="TaskInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskInfoAgent : TaskInfo
 {
     /// <inheritdoc />
@@ -11391,7 +11456,7 @@ public partial class TaskInfoAgent : TaskInfo
 }
 
 /// <summary>Public owner attribution for a client-owned task. Identifiers are opaque and never authorize requests.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TaskClientOwner
 {
     /// <summary>ISO 8601 timestamp when the bound join disconnected.</summary>
@@ -11425,7 +11490,7 @@ public sealed class TaskClientOwner
 
 /// <summary>Tracked client-owned task metadata.</summary>
 /// <remarks>The <c>client</c> variant of <see cref="TaskInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskInfoClient : TaskInfo
 {
     /// <inheritdoc />
@@ -11529,7 +11594,7 @@ public partial class TaskInfoClient : TaskInfo
 
 /// <summary>Tracked shell task metadata, including ID, command, status, timing, attachment/execution mode, log path, and PID.</summary>
 /// <remarks>The <c>shell</c> variant of <see cref="TaskInfo"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskInfoShell : TaskInfo
 {
     /// <inheritdoc />
@@ -11587,7 +11652,7 @@ public partial class TaskInfoShell : TaskInfo
 }
 
 /// <summary>Background tasks currently tracked by the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TaskList
 {
     /// <summary>Currently tracked tasks.</summary>
@@ -11596,7 +11661,7 @@ public sealed class TaskList
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionTasksListRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -11605,7 +11670,7 @@ internal sealed class SessionTasksListRequest
 }
 
 /// <summary>Tracked client-owned task metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TaskClientInfo
 {
     /// <summary>ISO 8601 timestamp when the current active segment started.</summary>
@@ -11698,7 +11763,7 @@ public sealed class TaskClientInfo
 }
 
 /// <summary>Result of registering or reclaiming a client-owned task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksRegisterResult
 {
     /// <summary>True only when this invocation created a new task.</summary>
@@ -11715,7 +11780,7 @@ public sealed class TasksRegisterResult
 }
 
 /// <summary>Registers or reclaims a client-owned task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class TasksRegisterRequest
 {
     /// <summary>Whether the owner supports runtime cancellation requests.</summary>
@@ -11748,7 +11813,7 @@ internal sealed class TasksRegisterRequest
 }
 
 /// <summary>Result of publishing a client-owned task update.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksUpdateResult
 {
     /// <summary>Whether this invocation changed task state.</summary>
@@ -11766,7 +11831,7 @@ public sealed class TasksUpdateResult
 
 /// <summary>Progress or terminal update for a client-owned task.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -11784,7 +11849,7 @@ public partial class TaskClientUpdate
 
 /// <summary>Publishes nonterminal progress for a running or idle client task.</summary>
 /// <remarks>The <c>progress</c> variant of <see cref="TaskClientUpdate"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskClientUpdateProgress : TaskClientUpdate
 {
     /// <inheritdoc />
@@ -11814,7 +11879,7 @@ public partial class TaskClientUpdateProgress : TaskClientUpdate
 
 /// <summary>Reports successful terminal completion.</summary>
 /// <remarks>The <c>completed</c> variant of <see cref="TaskClientUpdate"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskClientUpdateCompleted : TaskClientUpdate
 {
     /// <inheritdoc />
@@ -11834,7 +11899,7 @@ public partial class TaskClientUpdateCompleted : TaskClientUpdate
 
 /// <summary>Reports terminal failure.</summary>
 /// <remarks>The <c>failed</c> variant of <see cref="TaskClientUpdate"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskClientUpdateFailed : TaskClientUpdate
 {
     /// <inheritdoc />
@@ -11858,7 +11923,7 @@ public partial class TaskClientUpdateFailed : TaskClientUpdate
 
 /// <summary>Reports terminal cancellation after external work stopped.</summary>
 /// <remarks>The <c>cancelled</c> variant of <see cref="TaskClientUpdate"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskClientUpdateCancelled : TaskClientUpdate
 {
     /// <inheritdoc />
@@ -11877,7 +11942,7 @@ public partial class TaskClientUpdateCancelled : TaskClientUpdate
 }
 
 /// <summary>Updates a client-owned task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class TasksUpdateRequest
 {
     /// <summary>Canonical runtime-generated task identifier.</summary>
@@ -11898,13 +11963,13 @@ internal sealed class TasksUpdateRequest
 }
 
 /// <summary>Refresh metadata for any detached background shells the runtime knows about. Use after a long pause to pick up exit/output state for shells running outside the agent loop.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksRefreshResult
 {
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionTasksRefreshRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -11913,13 +11978,13 @@ internal sealed class SessionTasksRefreshRequest
 }
 
 /// <summary>Wait until all in-flight background tasks (agents + shells) and any follow-up turns scheduled by their completions have settled. Returns when the runtime is fully drained or after an internal timeout (default 10 minutes; configurable via COPILOT_TASK_WAIT_TIMEOUT_SECONDS).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksWaitForPendingResult
 {
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionTasksWaitForPendingRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -11929,7 +11994,7 @@ internal sealed class SessionTasksWaitForPendingRequest
 
 /// <summary>Progress information for the task, discriminated by type. Returns null when no task with this ID is currently tracked.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -11945,7 +12010,7 @@ public partial class TaskProgress
 
 
 /// <summary>Timestamped display line for task progress output or recent agent activity.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TaskProgressLine
 {
     /// <summary>Display message, e.g., "▸ bash", "✓ edit src/foo.ts".</summary>
@@ -11959,7 +12024,7 @@ public sealed class TaskProgressLine
 
 /// <summary>Progress snapshot for an agent task, with recent activity lines and optional latest intent.</summary>
 /// <remarks>The <c>agent</c> variant of <see cref="TaskProgress"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskProgressAgent : TaskProgress
 {
     /// <inheritdoc />
@@ -11978,7 +12043,7 @@ public partial class TaskProgressAgent : TaskProgress
 
 /// <summary>Generic progress for a client-owned task.</summary>
 /// <remarks>The <c>client</c> variant of <see cref="TaskProgress"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskProgressClient : TaskProgress
 {
     /// <inheritdoc />
@@ -12019,7 +12084,7 @@ public partial class TaskProgressClient : TaskProgress
 
 /// <summary>Progress snapshot for a shell task, with recent stdout/stderr output and optional process ID.</summary>
 /// <remarks>The <c>shell</c> variant of <see cref="TaskProgress"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class TaskProgressShell : TaskProgress
 {
     /// <inheritdoc />
@@ -12037,7 +12102,7 @@ public partial class TaskProgressShell : TaskProgress
 }
 
 /// <summary>Progress information for the task, or null when no task with that ID is tracked.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksGetProgressResult
 {
     /// <summary>Progress information for the task, discriminated by type. Returns null when no task with this ID is currently tracked.</summary>
@@ -12046,7 +12111,7 @@ public sealed class TasksGetProgressResult
 }
 
 /// <summary>Identifier of the background task to fetch progress for.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class TasksGetProgressRequest
 {
     /// <summary>Task identifier (agent ID or shell ID).</summary>
@@ -12059,7 +12124,7 @@ internal sealed class TasksGetProgressRequest
 }
 
 /// <summary>The first sync-waiting task that can currently be promoted to background mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksGetCurrentPromotableResult
 {
     /// <summary>The first sync-waiting task (agent first, then shell) that can currently be promoted to background mode. Omitted if no such task exists. The returned task is guaranteed to have executionMode='sync' and canPromoteToBackground=true at the time of the call.</summary>
@@ -12068,7 +12133,7 @@ public sealed class TasksGetCurrentPromotableResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionTasksGetCurrentPromotableRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12077,7 +12142,7 @@ internal sealed class SessionTasksGetCurrentPromotableRequest
 }
 
 /// <summary>Indicates whether the task was successfully promoted to background mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksPromoteToBackgroundResult
 {
     /// <summary>Whether the task was successfully promoted to background mode.</summary>
@@ -12086,7 +12151,7 @@ public sealed class TasksPromoteToBackgroundResult
 }
 
 /// <summary>Identifier of the task to promote to background mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class TasksPromoteToBackgroundRequest
 {
     /// <summary>Task identifier.</summary>
@@ -12099,7 +12164,7 @@ internal sealed class TasksPromoteToBackgroundRequest
 }
 
 /// <summary>The promoted task as it now exists in background mode, omitted if no promotable task was waiting.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksPromoteCurrentToBackgroundResult
 {
     /// <summary>The promoted task as it now exists in background mode, omitted if no promotable task was waiting. Atomic operation: avoids the race window of getCurrentPromotable + promoteToBackground.</summary>
@@ -12108,7 +12173,7 @@ public sealed class TasksPromoteCurrentToBackgroundResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionTasksPromoteCurrentToBackgroundRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12117,7 +12182,7 @@ internal sealed class SessionTasksPromoteCurrentToBackgroundRequest
 }
 
 /// <summary>Indicates whether the background task was successfully cancelled.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksCancelResult
 {
     /// <summary>Whether the task was successfully cancelled.</summary>
@@ -12126,7 +12191,7 @@ public sealed class TasksCancelResult
 }
 
 /// <summary>Identifier of the background task to cancel.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class TasksCancelRequest
 {
     /// <summary>Task identifier.</summary>
@@ -12139,7 +12204,7 @@ internal sealed class TasksCancelRequest
 }
 
 /// <summary>Indicates whether the task was removed. False when the task does not exist or is still running/idle.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksRemoveResult
 {
     /// <summary>Whether the task was removed. Returns false if the task does not exist or is still running/idle (cancel it first).</summary>
@@ -12148,7 +12213,7 @@ public sealed class TasksRemoveResult
 }
 
 /// <summary>Identifier of the completed or cancelled task to remove from tracking.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class TasksRemoveRequest
 {
     /// <summary>Task identifier.</summary>
@@ -12161,7 +12226,7 @@ internal sealed class TasksRemoveRequest
 }
 
 /// <summary>Indicates whether the message was delivered, with an error message when delivery failed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksSendMessageResult
 {
     /// <summary>Error message if delivery failed.</summary>
@@ -12174,7 +12239,7 @@ public sealed class TasksSendMessageResult
 }
 
 /// <summary>Identifier of the target agent task, message content, and optional sender agent ID.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class TasksSendMessageRequest
 {
     /// <summary>Agent ID of the sender, if sent on behalf of another agent.</summary>
@@ -12195,7 +12260,7 @@ internal sealed class TasksSendMessageRequest
 }
 
 /// <summary>Skill metadata available to a session, with name, description, source, enabled/invocable state, path, plugin, and argument hint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class Skill
 {
     /// <summary>Optional freeform hint describing the skill's expected arguments, from the `argument-hint` frontmatter field.</summary>
@@ -12236,7 +12301,7 @@ public sealed class Skill
 }
 
 /// <summary>Skills available to the session, with their enabled state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SkillList
 {
     /// <summary>Available skills.</summary>
@@ -12245,7 +12310,7 @@ public sealed class SkillList
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSkillsListRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12254,7 +12319,7 @@ internal sealed class SessionSkillsListRequest
 }
 
 /// <summary>Skill invocation record with name, path, content, allowed tools, and turn number.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SkillsInvokedSkill
 {
     /// <summary>Tools that should be auto-approved when this skill is active, captured at invocation time.</summary>
@@ -12283,7 +12348,7 @@ public sealed class SkillsInvokedSkill
 }
 
 /// <summary>Skills invoked during this session, ordered by invocation time (most recent last).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SkillsGetInvokedResult
 {
     /// <summary>Skills invoked during this session, ordered by invocation time (most recent last).</summary>
@@ -12292,7 +12357,7 @@ public sealed class SkillsGetInvokedResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSkillsGetInvokedRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12301,7 +12366,7 @@ internal sealed class SessionSkillsGetInvokedRequest
 }
 
 /// <summary>Name of the skill to enable for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SkillsEnableRequest
 {
     /// <summary>Name of the skill to enable.</summary>
@@ -12314,7 +12379,7 @@ internal sealed class SkillsEnableRequest
 }
 
 /// <summary>Name of the skill to disable for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SkillsDisableRequest
 {
     /// <summary>Name of the skill to disable.</summary>
@@ -12326,21 +12391,8 @@ internal sealed class SkillsDisableRequest
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Diagnostics from reloading skill definitions, with warnings and errors as separate lists.</summary>
-[Experimental(Diagnostics.Experimental)]
-public sealed class SkillsLoadDiagnostics
-{
-    /// <summary>Errors emitted while loading skills (e.g. skills that failed to load entirely).</summary>
-    [JsonPropertyName("errors")]
-    public IList<string> Errors { get => field ??= []; set; }
-
-    /// <summary>Warnings emitted while loading skills (e.g. skills that loaded but had issues).</summary>
-    [JsonPropertyName("warnings")]
-    public IList<string> Warnings { get => field ??= []; set; }
-}
-
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSkillsReloadRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12349,7 +12401,7 @@ internal sealed class SessionSkillsReloadRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSkillsEnsureLoadedRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12358,7 +12410,7 @@ internal sealed class SessionSkillsEnsureLoadedRequest
 }
 
 /// <summary>Recorded MCP server connection failure.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpServerFailureInfo
 {
     /// <summary>Failure message produced when the MCP server connection failed.</summary>
@@ -12371,7 +12423,7 @@ public sealed class McpServerFailureInfo
 }
 
 /// <summary>Recorded MCP server pending-auth state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpServerNeedsAuthInfo
 {
     /// <summary>epoch-ms timestamp at which the server signalled it needs authentication.</summary>
@@ -12380,7 +12432,7 @@ public sealed class McpServerNeedsAuthInfo
 }
 
 /// <summary>Host-level state, omitted when no MCP host is initialized.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpHostState
 {
     /// <summary>Names of currently-connected MCP clients.</summary>
@@ -12413,7 +12465,7 @@ public sealed class McpHostState
 }
 
 /// <summary>MCP server status entry, including config source/plugin source and any connection error.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpServer
 {
     /// <summary>Human-readable display name supplied by a managed server catalog.</summary>
@@ -12453,7 +12505,7 @@ public sealed class McpServer
 }
 
 /// <summary>MCP servers configured for the session, with their connection status and host-level state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpServerList
 {
     /// <summary>Host-level state, omitted when no MCP host is initialized.</summary>
@@ -12466,7 +12518,7 @@ public sealed class McpServerList
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMcpListRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12475,7 +12527,7 @@ internal sealed class SessionMcpListRequest
 }
 
 /// <summary>Normalized MCP Apps discovery metadata from a tool's `_meta.ui` block.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpToolUi
 {
     /// <summary>URI of the tool's MCP App resource, typically a `ui://` resource identifier. Use `session.mcp.resources.read` to fetch its HTML and resource metadata.</summary>
@@ -12488,7 +12540,7 @@ public sealed class McpToolUi
 }
 
 /// <summary>MCP tool metadata with tool name, optional description, and normalized MCP Apps discovery metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpTools
 {
     /// <summary>Tool description, when provided.</summary>
@@ -12505,7 +12557,7 @@ public sealed class McpTools
 }
 
 /// <summary>Tools exposed by the connected MCP server. Throws when the server is not connected.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpListToolsResult
 {
     /// <summary>Tools exposed by the server.</summary>
@@ -12514,7 +12566,7 @@ public sealed class McpListToolsResult
 }
 
 /// <summary>Server name whose tool list should be returned.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpListToolsRequest
 {
     /// <summary>Name of the connected MCP server whose tools to list.</summary>
@@ -12530,7 +12582,7 @@ internal sealed class McpListToolsRequest
 }
 
 /// <summary>Name of the MCP server to enable for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpEnableRequest
 {
     /// <summary>Name of the MCP server to enable.</summary>
@@ -12546,7 +12598,7 @@ internal sealed class McpEnableRequest
 }
 
 /// <summary>Name of the MCP server to disable for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpDisableRequest
 {
     /// <summary>Name of the MCP server to disable.</summary>
@@ -12562,7 +12614,7 @@ internal sealed class McpDisableRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMcpReloadRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12571,7 +12623,7 @@ internal sealed class SessionMcpReloadRequest
 }
 
 /// <summary>Result of moving in-flight MCP loading to the background.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MoveMcpLoadingToBackgroundResult
 {
     /// <summary>Whether an in-flight MCP load was moved to the background, releasing turns that were waiting on it. False when no MCP load was in flight or the waiting turns had already been released.</summary>
@@ -12580,7 +12632,7 @@ public sealed class MoveMcpLoadingToBackgroundResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMcpMoveLoadingToBackgroundRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12589,7 +12641,7 @@ internal sealed class SessionMcpMoveLoadingToBackgroundRequest
 }
 
 /// <summary>MCP server allowed by policy, with server name and optional PII-free explanatory note.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAllowedServer
 {
     /// <summary>Allowed server name.</summary>
@@ -12602,7 +12654,7 @@ public sealed class McpAllowedServer
 }
 
 /// <summary>MCP server whose connection attempt failed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpFailedServer
 {
     /// <summary>The captured connection failure detail.</summary>
@@ -12615,7 +12667,7 @@ public sealed class McpFailedServer
 }
 
 /// <summary>MCP server filtered by policy, with name, reason, and optional redacted reason.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpFilteredServer
 {
     /// <summary>Deprecated. This field is no longer populated.</summary>
@@ -12640,7 +12692,7 @@ public sealed class McpFilteredServer
 }
 
 /// <summary>MCP server startup filtering result.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpStartServersResult
 {
     /// <summary>Non-default servers allowed by policy.</summary>
@@ -12657,7 +12709,7 @@ internal sealed class McpStartServersResult
 }
 
 /// <summary>Opaque MCP reload configuration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpReloadWithConfigRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12666,13 +12718,13 @@ internal sealed class McpReloadWithConfigRequest
 }
 
 /// <summary>MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpExecuteSamplingResult
 {
 }
 
 /// <summary>Outcome of an MCP sampling execution: success result, failure error, or cancellation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpSamplingExecutionResult
 {
     /// <summary>Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.</summary>
@@ -12689,13 +12741,13 @@ public sealed class McpSamplingExecutionResult
 }
 
 /// <summary>Raw MCP CreateMessageRequest params, as received in the `sampling.requested` event. Treated as opaque at the schema layer; the runtime converts the embedded MCP messages into the OpenAI chat-completion shape internally.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpExecuteSamplingRequest
 {
 }
 
 /// <summary>Identifiers and raw MCP CreateMessageRequest params used to run a sampling inference.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpExecuteSamplingParams
 {
     /// <summary>The original MCP JSON-RPC request ID (string or number). Used by the runtime to correlate the inference with the originating MCP request for telemetry; this is distinct from `requestId` (which is the schema-level cancellation handle).</summary>
@@ -12720,7 +12772,7 @@ internal sealed class McpExecuteSamplingParams
 }
 
 /// <summary>Indicates whether an in-flight sampling execution with the given requestId was found and cancelled.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpCancelSamplingExecutionResult
 {
     /// <summary>True if an in-flight execution with the given requestId was found and signalled to cancel. False when no such execution is in flight (already completed, never started, or cancelled by another caller).</summary>
@@ -12729,7 +12781,7 @@ public sealed class McpCancelSamplingExecutionResult
 }
 
 /// <summary>The requestId previously passed to executeSampling that should be cancelled.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpCancelSamplingExecutionParams
 {
     /// <summary>The requestId previously passed to executeSampling that should be cancelled.</summary>
@@ -12742,7 +12794,7 @@ internal sealed class McpCancelSamplingExecutionParams
 }
 
 /// <summary>Env-value mode recorded on the session after the update.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpSetEnvValueModeResult
 {
     /// <summary>Mode recorded on the session after the update.</summary>
@@ -12751,7 +12803,7 @@ public sealed class McpSetEnvValueModeResult
 }
 
 /// <summary>Mode controlling how MCP server env values are resolved (`direct` or `indirect`).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpSetEnvValueModeParams
 {
     /// <summary>How environment-variable values supplied to MCP servers are resolved. "direct" passes literal string values; "indirect" treats values as references (e.g. names of environment variables on the host) that the runtime resolves before launch. Defaults to the runtime's startup mode; clients that intentionally launch MCP servers with literal values (e.g. CLI prompt mode and ACP) set this to "direct".</summary>
@@ -12764,7 +12816,7 @@ internal sealed class McpSetEnvValueModeParams
 }
 
 /// <summary>Indicates whether the auto-managed `github` MCP server was removed (false when nothing to remove).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpRemoveGitHubResult
 {
     /// <summary>True when the auto-managed `github` MCP server was removed; false when no removal happened (e.g. user has explicitly configured a `github` server, or the server was not registered).</summary>
@@ -12773,7 +12825,7 @@ public sealed class McpRemoveGitHubResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMcpRemoveGitHubRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12782,7 +12834,7 @@ internal sealed class SessionMcpRemoveGitHubRequest
 }
 
 /// <summary>Result of configuring GitHub MCP.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpConfigureGitHubResult
 {
     /// <summary>Whether GitHub MCP configuration changed.</summary>
@@ -12791,7 +12843,7 @@ internal sealed class McpConfigureGitHubResult
 }
 
 /// <summary>Credential-free authentication identity used to configure GitHub MCP.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpConfigureGitHubRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -12800,7 +12852,7 @@ internal sealed class McpConfigureGitHubRequest
 }
 
 /// <summary>Server name and optional configuration for an individual MCP server start. Omit `config` for a config-free start-by-name of an already-configured server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpStartServerRequest
 {
     /// <summary>MCP server configuration (stdio process or remote HTTP/SSE). Omit to start the server with its already-registered configuration (config-free start-by-name).</summary>
@@ -12817,7 +12869,7 @@ internal sealed class McpStartServerRequest
 }
 
 /// <summary>Server name and optional replacement configuration for an individual MCP server restart. Omit `config` for a config-free restart-by-name of an already-configured server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpRestartServerRequest
 {
     /// <summary>Replacement MCP server configuration (stdio process or remote HTTP/SSE). Omit to restart the server with its already-registered configuration (config-free restart-by-name).</summary>
@@ -12834,7 +12886,7 @@ internal sealed class McpRestartServerRequest
 }
 
 /// <summary>Server name for an individual MCP server stop.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpStopServerRequest
 {
     /// <summary>Name of the MCP server to stop.</summary>
@@ -12847,7 +12899,7 @@ internal sealed class McpStopServerRequest
 }
 
 /// <summary>Registration parameters for an external MCP client.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpRegisterExternalClientRequest
 {
     /// <summary>Logical server name for the external client.</summary>
@@ -12860,7 +12912,7 @@ internal sealed class McpRegisterExternalClientRequest
 }
 
 /// <summary>Server name identifying the external client to remove.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpUnregisterExternalClientRequest
 {
     /// <summary>Server name of the external client to unregister.</summary>
@@ -12873,7 +12925,7 @@ internal sealed class McpUnregisterExternalClientRequest
 }
 
 /// <summary>Whether the named MCP server is running.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpIsServerRunningResult
 {
     /// <summary>True if the server has an active client and transport.</summary>
@@ -12882,7 +12934,7 @@ public sealed class McpIsServerRunningResult
 }
 
 /// <summary>Server name to check running status for.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpIsServerRunningRequest
 {
     /// <summary>Name of the MCP server to check.</summary>
@@ -12895,7 +12947,7 @@ internal sealed class McpIsServerRunningRequest
 }
 
 /// <summary>Indicates whether the pending MCP OAuth response was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpOauthHandlePendingResult
 {
     /// <summary>Whether the response was accepted. False if the request was unknown, timed out, or already resolved.</summary>
@@ -12905,7 +12957,7 @@ public sealed class McpOauthHandlePendingResult
 
 /// <summary>Host response to the pending OAuth request.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -12920,7 +12972,7 @@ public partial class McpOauthPendingRequestResponse
 
 
 /// <summary>The <c>token</c> variant of <see cref="McpOauthPendingRequestResponse"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpOauthPendingRequestResponseToken : McpOauthPendingRequestResponse
 {
     /// <inheritdoc />
@@ -12943,7 +12995,7 @@ public partial class McpOauthPendingRequestResponseToken : McpOauthPendingReques
 }
 
 /// <summary>The <c>cancelled</c> variant of <see cref="McpOauthPendingRequestResponse"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpOauthPendingRequestResponseCancelled : McpOauthPendingRequestResponse
 {
     /// <inheritdoc />
@@ -12952,7 +13004,7 @@ public partial class McpOauthPendingRequestResponseCancelled : McpOauthPendingRe
 }
 
 /// <summary>Pending MCP OAuth request ID and host-provided token or cancellation response.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpOauthHandlePendingRequest
 {
     /// <summary>OAuth request identifier from the mcp.oauth_required event.</summary>
@@ -12969,7 +13021,7 @@ internal sealed class McpOauthHandlePendingRequest
 }
 
 /// <summary>Identifies the MCP server whose persisted OAuth credentials were updated.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpOauthAuthenticationStateChangedRequest
 {
     /// <summary>Whether the target session must mint a session-scoped access token instead of reusing a shared access token persisted by another session.</summary>
@@ -12986,7 +13038,7 @@ internal sealed class McpOauthAuthenticationStateChangedRequest
 }
 
 /// <summary>OAuth authorization URL the caller should open, or empty when cached tokens already authenticated the server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpOauthLoginResult
 {
     /// <summary>URL the caller should open in a browser to complete OAuth. Omitted when cached tokens were still valid and no browser interaction was needed — the server is already reconnected in that case. When present, the runtime starts the callback listener before returning and continues the flow in the background; completion is signaled via session.mcp_server_status_changed.</summary>
@@ -12997,7 +13049,7 @@ public sealed class McpOauthLoginResult
 }
 
 /// <summary>Remote MCP server name and optional overrides controlling reauthentication, OAuth client display name, callback success-page copy, and static OAuth client selection.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpOauthLoginRequest
 {
     /// <summary>Optional override for the body text shown on the OAuth loopback callback success page. When omitted, the runtime applies a neutral fallback; callers driving interactive auth should pass surface-specific copy telling the user where to return.</summary>
@@ -13042,7 +13094,7 @@ internal sealed class McpOauthLoginRequest
 
 /// <summary>Passive MCP OAuth probe result. `authenticated` means the server accepted the probe request while an OAuth-origin access token was attached; it does not prove the server required or independently validated that token. The probe does not make a second unauthenticated request. Failed is an expected probe-domain outcome; JSON-RPC errors are reserved for API-call failures.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>status</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "status",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -13059,7 +13111,7 @@ public partial class McpOauthProbeResult
 
 
 /// <summary>The <c>no-auth-required</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpOauthProbeResultNoAuthRequired : McpOauthProbeResult
 {
     /// <inheritdoc />
@@ -13072,7 +13124,7 @@ public partial class McpOauthProbeResultNoAuthRequired : McpOauthProbeResult
 }
 
 /// <summary>The <c>authenticated</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpOauthProbeResultAuthenticated : McpOauthProbeResult
 {
     /// <inheritdoc />
@@ -13085,7 +13137,7 @@ public partial class McpOauthProbeResultAuthenticated : McpOauthProbeResult
 }
 
 /// <summary>The <c>needs-auth</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpOauthProbeResultNeedsAuth : McpOauthProbeResult
 {
     /// <inheritdoc />
@@ -13107,7 +13159,7 @@ public partial class McpOauthProbeResultNeedsAuth : McpOauthProbeResult
 }
 
 /// <summary>The <c>failed</c> variant of <see cref="McpOauthProbeResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpOauthProbeResultFailed : McpOauthProbeResult
 {
     /// <inheritdoc />
@@ -13125,7 +13177,7 @@ public partial class McpOauthProbeResultFailed : McpOauthProbeResult
 }
 
 /// <summary>Remote MCP server name for a passive OAuth status probe.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpOauthProbeRequest
 {
     /// <summary>Name of the configured remote MCP server to probe.</summary>
@@ -13141,7 +13193,7 @@ internal sealed class McpOauthProbeRequest
 }
 
 /// <summary>Indicates whether the pending MCP OAuth response was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpOauthRespondResult
 {
     /// <summary>Whether the response was accepted. False if the request was unknown, timed out, or already resolved.</summary>
@@ -13150,7 +13202,7 @@ public sealed class McpOauthRespondResult
 }
 
 /// <summary>Pending MCP OAuth request id to respond to.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpOauthRespondRequest
 {
     /// <summary>OAuth request identifier from the mcp.oauth_required event.</summary>
@@ -13163,7 +13215,7 @@ internal sealed class McpOauthRespondRequest
 }
 
 /// <summary>Indicates whether the pending MCP headers refresh response was accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpHeadersHandlePendingHeadersRefreshRequestResult
 {
     /// <summary>Whether the response was accepted. False if the request was unknown, timed out, or already resolved.</summary>
@@ -13173,7 +13225,7 @@ public sealed class McpHeadersHandlePendingHeadersRefreshRequestResult
 
 /// <summary>Host response: supply dynamic headers or decline this refresh.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -13189,7 +13241,7 @@ public partial class McpHeadersHandlePendingHeadersRefreshRequest
 
 
 /// <summary>The <c>headers</c> variant of <see cref="McpHeadersHandlePendingHeadersRefreshRequest"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpHeadersHandlePendingHeadersRefreshRequestHeaders : McpHeadersHandlePendingHeadersRefreshRequest
 {
     /// <inheritdoc />
@@ -13207,7 +13259,7 @@ public partial class McpHeadersHandlePendingHeadersRefreshRequestHeaders : McpHe
 }
 
 /// <summary>The <c>none</c> variant of <see cref="McpHeadersHandlePendingHeadersRefreshRequest"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpHeadersHandlePendingHeadersRefreshRequestNone : McpHeadersHandlePendingHeadersRefreshRequest
 {
     /// <inheritdoc />
@@ -13216,7 +13268,7 @@ public partial class McpHeadersHandlePendingHeadersRefreshRequestNone : McpHeade
 }
 
 /// <summary>The <c>error</c> variant of <see cref="McpHeadersHandlePendingHeadersRefreshRequest"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class McpHeadersHandlePendingHeadersRefreshRequestError : McpHeadersHandlePendingHeadersRefreshRequest
 {
     /// <inheritdoc />
@@ -13229,7 +13281,7 @@ public partial class McpHeadersHandlePendingHeadersRefreshRequestError : McpHead
 }
 
 /// <summary>MCP headers refresh request id and the host response.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpHeadersHandlePendingHeadersRefreshRequestRequest
 {
     /// <summary>Headers refresh request identifier from mcp.headers_refresh_required.</summary>
@@ -13246,7 +13298,7 @@ internal sealed class McpHeadersHandlePendingHeadersRefreshRequestRequest
 }
 
 /// <summary>MCP Apps resource content with URI, optional MIME type, text or base64 blob, and resource metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsResourceContent
 {
     /// <summary>Resource-level metadata (CSP, permissions, etc.).</summary>
@@ -13271,7 +13323,7 @@ public sealed class McpAppsResourceContent
 }
 
 /// <summary>Resource contents returned by the MCP server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsReadResourceResult
 {
     /// <summary>Resource contents returned by the server.</summary>
@@ -13280,7 +13332,7 @@ public sealed class McpAppsReadResourceResult
 }
 
 /// <summary>MCP server and resource URI to fetch.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpAppsReadResourceRequest
 {
     /// <summary>Name of the MCP server hosting the resource.</summary>
@@ -13300,7 +13352,7 @@ internal sealed class McpAppsReadResourceRequest
 }
 
 /// <summary>App-callable tools from the named MCP server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsListToolsResult
 {
     /// <summary>App-callable tools from the server.</summary>
@@ -13309,7 +13361,7 @@ public sealed class McpAppsListToolsResult
 }
 
 /// <summary>MCP server to list app-callable tools for.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpAppsListToolsRequest
 {
     /// <summary>**Required.** Server whose ui:// view issued the request. Per SEP-1865 ('callable by the app from this server only'), the call is rejected when this differs from `serverName`, and rejected outright when missing.</summary>
@@ -13332,7 +13384,7 @@ internal sealed class McpAppsListToolsRequest
 }
 
 /// <summary>MCP server, tool name, and arguments to invoke from an MCP App view.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpAppsCallToolRequest
 {
     /// <summary>Tool arguments.</summary>
@@ -13363,7 +13415,7 @@ internal sealed class McpAppsCallToolRequest
 }
 
 /// <summary>Host context advertised to MCP App guests.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsSetHostContextDetails
 {
     /// <summary>Display modes the host supports.</summary>
@@ -13396,7 +13448,7 @@ public sealed class McpAppsSetHostContextDetails
 }
 
 /// <summary>Host context to advertise to MCP App guests.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpAppsSetHostContextRequest
 {
     /// <summary>Host context advertised to MCP App guests.</summary>
@@ -13409,7 +13461,7 @@ internal sealed class McpAppsSetHostContextRequest
 }
 
 /// <summary>Current host context.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsHostContextDetails
 {
     /// <summary>Display modes the host supports.</summary>
@@ -13442,7 +13494,7 @@ public sealed class McpAppsHostContextDetails
 }
 
 /// <summary>Current host context advertised to MCP App guests.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsHostContext
 {
     /// <summary>Current host context.</summary>
@@ -13451,7 +13503,7 @@ public sealed class McpAppsHostContext
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMcpAppsGetHostContextRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -13460,7 +13512,7 @@ internal sealed class SessionMcpAppsGetHostContextRequest
 }
 
 /// <summary>Capability negotiation snapshot.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsDiagnoseCapability
 {
     /// <summary>Whether the runtime advertises `extensions.io.modelcontextprotocol/ui` to MCP servers.</summary>
@@ -13477,7 +13529,7 @@ public sealed class McpAppsDiagnoseCapability
 }
 
 /// <summary>What the server returned for this session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsDiagnoseServer
 {
     /// <summary>Whether the named server is currently connected.</summary>
@@ -13498,7 +13550,7 @@ public sealed class McpAppsDiagnoseServer
 }
 
 /// <summary>Diagnostic snapshot of MCP Apps wiring for the named server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsDiagnoseResult
 {
     /// <summary>Capability negotiation snapshot.</summary>
@@ -13511,7 +13563,7 @@ public sealed class McpAppsDiagnoseResult
 }
 
 /// <summary>MCP server to diagnose MCP Apps wiring for.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpAppsDiagnoseRequest
 {
     /// <summary>MCP server to probe.</summary>
@@ -13527,7 +13579,7 @@ internal sealed class McpAppsDiagnoseRequest
 }
 
 /// <summary>MCP resource content with URI, optional MIME type, text or base64 blob, and resource metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpResourceContent
 {
     /// <summary>Resource-level metadata (CSP, permissions, etc.).</summary>
@@ -13552,7 +13604,7 @@ public sealed class McpResourceContent
 }
 
 /// <summary>Resource contents returned by the MCP server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpResourcesReadResult
 {
     /// <summary>Resource contents returned by the server.</summary>
@@ -13561,7 +13613,7 @@ public sealed class McpResourcesReadResult
 }
 
 /// <summary>MCP server and resource URI to fetch.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpResourcesReadRequest
 {
     /// <summary>Name of the MCP server hosting the resource.</summary>
@@ -13581,7 +13633,7 @@ internal sealed class McpResourcesReadRequest
 }
 
 /// <summary>Standard MCP resource annotations plus preserved non-standard annotation fields.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpResourceAnnotations
 {
     /// <summary>Server-provided non-standard annotation fields preserved from the MCP response.</summary>
@@ -13602,7 +13654,7 @@ public sealed class McpResourceAnnotations
 }
 
 /// <summary>A resource icon descriptor plus preserved non-standard icon fields.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpResourceIcon
 {
     /// <summary>Server-provided non-standard icon fields preserved from the MCP response.</summary>
@@ -13627,7 +13679,7 @@ public sealed class McpResourceIcon
 }
 
 /// <summary>An MCP resource descriptor (spec `Resource`): URI, name, and optional title, description, MIME type, size, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpResource
 {
     /// <summary>Resource-level metadata.</summary>
@@ -13672,7 +13724,7 @@ public sealed class McpResource
 }
 
 /// <summary>One page of resources advertised by the named MCP server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpResourcesListResult
 {
     /// <summary>Opaque cursor for the next page, if the server has more resources.</summary>
@@ -13685,7 +13737,7 @@ public sealed class McpResourcesListResult
 }
 
 /// <summary>MCP server whose resources to enumerate.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpResourcesListRequest
 {
     /// <summary>Opaque MCP pagination cursor from a prior `nextCursor` value.</summary>
@@ -13705,7 +13757,7 @@ internal sealed class McpResourcesListRequest
 }
 
 /// <summary>An MCP resource template descriptor (spec `ResourceTemplate`): an RFC 6570 URI template, name, and optional title, description, MIME type, icons, annotations, and metadata. Server-provided fields outside the standard descriptor shape are exposed under `additionalProperties`.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpResourceTemplate
 {
     /// <summary>Resource-template-level metadata.</summary>
@@ -13746,7 +13798,7 @@ public sealed class McpResourceTemplate
 }
 
 /// <summary>One page of resource templates advertised by the named MCP server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpResourcesListTemplatesResult
 {
     /// <summary>Opaque cursor for the next page, if the server has more resource templates.</summary>
@@ -13759,7 +13811,7 @@ public sealed class McpResourcesListTemplatesResult
 }
 
 /// <summary>MCP server whose resource templates to enumerate.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class McpResourcesListTemplatesRequest
 {
     /// <summary>Opaque MCP pagination cursor from a prior `nextCursor` value.</summary>
@@ -13778,8 +13830,178 @@ internal sealed class McpResourcesListTemplatesRequest
     public string SessionId { get; set; } = string.Empty;
 }
 
+/// <summary>MCP diagnostic source configuration.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class McpDiagnosticSourceConfiguration
+{
+    /// <summary>Threshold to apply to MCP diagnostic producers in this session.</summary>
+    [JsonPropertyName("level")]
+    public DiagnosticLogLevel Level { get; set; }
+}
+
+/// <summary>Typed diagnostic source configuration. At least one source is required by diagnostics configuration methods.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class DiagnosticSourcesConfiguration
+{
+    /// <summary>MCP diagnostic capture threshold. Omit to leave the current threshold unchanged.</summary>
+    [JsonPropertyName("mcp")]
+    public McpDiagnosticSourceConfiguration? Mcp { get; set; }
+}
+
+/// <summary>Per-source session diagnostics configuration.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class DiagnosticsConfiguration
+{
+    /// <summary>Diagnostic thresholds keyed by supported source.</summary>
+    [JsonPropertyName("sources")]
+    public DiagnosticSourcesConfiguration Sources { get => field ??= new(); set; }
+}
+
+/// <summary>Patch session diagnostic thresholds for explicitly supplied sources.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+internal sealed class DiagnosticsConfigureRequest
+{
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Sources to configure. At least one supported source must be supplied.</summary>
+    [JsonPropertyName("sources")]
+    public DiagnosticSourcesConfiguration Sources { get => field ??= new(); set; }
+}
+
+/// <summary>One retained session-scoped diagnostic record. Potentially content-bearing diagnostic data is opt-in and must not be exported automatically as telemetry.</summary>
+/// <remarks>Polymorphic base type discriminated by <c>source</c>.</remarks>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+[JsonPolymorphic(
+    TypeDiscriminatorPropertyName = "source",
+    UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
+[JsonDerivedType(typeof(DiagnosticEntryMcp), "mcp")]
+public partial class DiagnosticEntry
+{
+    /// <summary>The type discriminator.</summary>
+    [JsonPropertyName("source")]
+    public virtual string Source { get; set; } = string.Empty;
+}
+
+
+/// <summary>MCP-specific detail for a source-discriminated diagnostic entry.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class McpDiagnosticDetails
+{
+    /// <summary>Fresh identifier for the MCP connection attempt, including failed starts.</summary>
+    [JsonPropertyName("connectionId")]
+    public string ConnectionId { get; set; } = string.Empty;
+
+    /// <summary>Serialized diagnostic detail. Protocol and HTTP records use JSON when detail is present.</summary>
+    [JsonPropertyName("data")]
+    public string? Data { get; set; }
+
+    /// <summary>Protocol-frame direction when kind is protocol.</summary>
+    [JsonPropertyName("direction")]
+    public McpDiagnosticDirection? Direction { get; set; }
+
+    /// <summary>Diagnostic record category.</summary>
+    [JsonPropertyName("kind")]
+    public McpDiagnosticKind Kind { get; set; }
+
+    /// <summary>Configured MCP server name.</summary>
+    [JsonPropertyName("serverName")]
+    public string ServerName { get; set; } = string.Empty;
+}
+
+/// <summary>The <c>mcp</c> variant of <see cref="DiagnosticEntry"/>.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public partial class DiagnosticEntryMcp : DiagnosticEntry
+{
+    /// <inheritdoc />
+    [JsonIgnore]
+    public override string Source => "mcp";
+
+    /// <summary>Agent identifier for a subagent host. Omitted for the root agent.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("agentId")]
+    public string? AgentId { get; set; }
+
+    /// <summary>Typed MCP diagnostic detail.</summary>
+    [JsonPropertyName("details")]
+    public required McpDiagnosticDetails Details { get; set; }
+
+    /// <summary>Severity of this emitted diagnostic record.</summary>
+    [JsonPropertyName("level")]
+    public required DiagnosticSeverity Level { get; set; }
+
+    /// <summary>Human-readable diagnostic summary.</summary>
+    [JsonPropertyName("message")]
+    public required string Message { get; set; }
+
+    /// <summary>Original byte count when a known-size message or data value was truncated.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("originalBytes")]
+    public long? OriginalBytes { get; set; }
+
+    /// <summary>UTC RFC 3339 timestamp captured at the diagnostic source.</summary>
+    [JsonPropertyName("timestamp")]
+    public required string Timestamp { get; set; }
+
+    /// <summary>Whether message or data was truncated to the record-size bound.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("truncated")]
+    public bool? Truncated { get; set; }
+}
+
+/// <summary>One cursor-addressed page of retained session diagnostics.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class DiagnosticsReadResult
+{
+    /// <summary>Opaque cursor for the next independent read.</summary>
+    [JsonPropertyName("cursor")]
+    public string Cursor { get; set; } = string.Empty;
+
+    /// <summary>Whether the requested cursor remained within the retained buffer window.</summary>
+    [JsonPropertyName("cursorStatus")]
+    public DiagnosticCursorStatus CursorStatus { get; set; }
+
+    /// <summary>Number of records lost before this page when known. Omitted when a buffer generation change makes the count unknowable.</summary>
+    [JsonPropertyName("droppedCount")]
+    public long? DroppedCount { get; set; }
+
+    /// <summary>Retained records beginning at the requested cursor.</summary>
+    [JsonPropertyName("entries")]
+    public IList<DiagnosticEntry> Entries { get => field ??= []; set; }
+
+    /// <summary>Whether additional retained records follow this page.</summary>
+    [JsonPropertyName("hasMore")]
+    public bool HasMore { get; set; }
+}
+
+/// <summary>Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the default waitMs is zero (maximum 30000).</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+internal sealed class DiagnosticsReadRequest
+{
+    /// <summary>Opaque cursor returned by an earlier read. Omit to start at the oldest retained record.</summary>
+    [JsonPropertyName("cursor")]
+    public string? Cursor { get; set; }
+
+    /// <summary>Maximum number of records to return, from 1 through 500. Omit for 100.</summary>
+    [JsonPropertyName("max")]
+    public long? Max { get; set; }
+
+    /// <summary>Target session identifier.</summary>
+    [JsonPropertyName("sessionId")]
+    public string SessionId { get; set; } = string.Empty;
+
+    /// <summary>Nonempty selection of sources to read. Each source may be listed once.</summary>
+    [JsonPropertyName("sources")]
+    public IList<DiagnosticSource> Sources { get => field ??= []; set; }
+
+    /// <summary>Maximum time in milliseconds to wait for a new record, from 0 through 30000.</summary>
+    [JsonPropertyName("waitMs")]
+    public int? WaitMs { get; set; }
+}
+
 /// <summary>Feature detection and hard polling limits for the EXPERIMENTAL session connector API.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectorCapabilities
 {
     /// <summary>Connector API contract version.</summary>
@@ -13812,7 +14034,7 @@ public sealed class ConnectorCapabilities
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionConnectorsGetCapabilitiesRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -13821,7 +14043,7 @@ internal sealed class SessionConnectorsGetCapabilitiesRequest
 }
 
 /// <summary>Account-targeted authorization update required by the Connector service. The account ID is an opaque host routing identifier; no credential is included.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectorAuthorizationRequirement
 {
     /// <summary>Exact opaque account selection that made the Connector request.</summary>
@@ -13834,7 +14056,7 @@ public sealed class ConnectorAuthorizationRequirement
 }
 
 /// <summary>Credential-free Connector catalog entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectorCatalogEntry
 {
     /// <summary>Untrusted service description, when present.</summary>
@@ -13859,7 +14081,7 @@ public sealed class ConnectorCatalogEntry
 }
 
 /// <summary>Validated Connector catalog snapshot cached by the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectorCatalogResult
 {
     /// <summary>Validated catalog entries in service order.</summary>
@@ -13876,7 +14098,7 @@ public sealed class ConnectorCatalogResult
 }
 
 /// <summary>Live status of one session-owned MCP projection.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectorRuntimeStatus
 {
     /// <summary>Canonical Connector name that owns this server.</summary>
@@ -13893,7 +14115,7 @@ public sealed class ConnectorRuntimeStatus
 }
 
 /// <summary>Authoritative session connector state. Account IDs are opaque routing identifiers and credentials are never included.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectorStatus
 {
     /// <summary>Opaque account selection pinned to this session, when one has been selected.</summary>
@@ -13926,7 +14148,7 @@ public sealed class ConnectorStatus
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionConnectorsGetStatusRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -13935,7 +14157,7 @@ internal sealed class SessionConnectorsGetStatusRequest
 }
 
 /// <summary>Pins a Connector operation to one host-owned GitHub account through its opaque selection ID. Provider tokens are never accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ConnectorAccountRequest
 {
     /// <summary>Opaque account selection ID previously returned by an account discovery API.</summary>
@@ -13949,7 +14171,7 @@ internal sealed class ConnectorAccountRequest
 
 /// <summary>Typed result of initiating or continuing a Connector connection.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -13966,7 +14188,7 @@ public partial class ConnectorConnectResult
 
 /// <summary>The service is connected and the session MCP graph was reconciled.</summary>
 /// <remarks>The <c>connected</c> variant of <see cref="ConnectorConnectResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ConnectorConnectResultConnected : ConnectorConnectResult
 {
     /// <inheritdoc />
@@ -13980,7 +14202,7 @@ public partial class ConnectorConnectResultConnected : ConnectorConnectResult
 
 /// <summary>Host-owned consent is required before bounded continuation can complete.</summary>
 /// <remarks>The <c>consent_required</c> variant of <see cref="ConnectorConnectResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ConnectorConnectResultConsentRequired : ConnectorConnectResult
 {
     /// <inheritdoc />
@@ -13998,7 +14220,7 @@ public partial class ConnectorConnectResultConsentRequired : ConnectorConnectRes
 
 /// <summary>The service is still completing the connection without a consent URL.</summary>
 /// <remarks>The <c>pending</c> variant of <see cref="ConnectorConnectResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ConnectorConnectResultPending : ConnectorConnectResult
 {
     /// <inheritdoc />
@@ -14011,7 +14233,7 @@ public partial class ConnectorConnectResultPending : ConnectorConnectResult
 }
 
 /// <summary>Selects one Connector and the pinned host-owned account used for its service and MCP authorization.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ConnectorConnectRequest
 {
     /// <summary>Opaque account selection ID. It must match the account already pinned to the session, if any.</summary>
@@ -14028,7 +14250,7 @@ internal sealed class ConnectorConnectRequest
 }
 
 /// <summary>Explicitly bounded continuation of a pending Connector connection.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ConnectorContinueRequest
 {
     /// <summary>Opaque continuation ID returned by connect, reconnect, or an earlier continuation.</summary>
@@ -14053,7 +14275,7 @@ internal sealed class ConnectorContinueRequest
 }
 
 /// <summary>Authoritative result after disconnect and MCP reconciliation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectorDisconnectResult
 {
     /// <summary>Whether the service accepted the idempotent disconnect.</summary>
@@ -14066,7 +14288,7 @@ public sealed class ConnectorDisconnectResult
 }
 
 /// <summary>Requests authoritative Connector-to-MCP reconciliation for the pinned account.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ConnectorReconcileRequest
 {
     /// <summary>Opaque account selection ID. It must match the account already pinned to the session, if any.</summary>
@@ -14083,7 +14305,7 @@ internal sealed class ConnectorReconcileRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionConnectorsWithdrawProjectionRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -14092,7 +14314,7 @@ internal sealed class SessionConnectorsWithdrawProjectionRequest
 }
 
 /// <summary>Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively across device, server, policy-helper, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ManagedSettingsResolvedData
 {
     /// <summary>Whether enterprise policy disables bypass-permissions ("yolo") mode for this session. Deny-wins across layers, and forced on when `failClosed` is true.</summary>
@@ -14141,7 +14363,7 @@ public sealed class ManagedSettingsResolvedData
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionManagedSettingsGetRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -14150,7 +14372,7 @@ internal sealed class SessionManagedSettingsGetRequest
 }
 
 /// <summary>Session plugin metadata, with name, marketplace, optional version, and enabled state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class Plugin
 {
     /// <summary>Opaque stable identity for a direct plugin source.</summary>
@@ -14195,7 +14417,7 @@ public sealed class Plugin
 }
 
 /// <summary>Plugins installed for the session, with their enabled state and version metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PluginList
 {
     /// <summary>Installed plugins.</summary>
@@ -14204,7 +14426,7 @@ public sealed class PluginList
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPluginsListRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -14213,7 +14435,7 @@ internal sealed class SessionPluginsListRequest
 }
 
 /// <summary>Plugin source resolved relative to the session's authoritative working directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPluginsInstallRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -14226,7 +14448,7 @@ internal sealed class SessionPluginsInstallRequest
 }
 
 /// <summary>Name (or spec) of the plugin to uninstall.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsUninstallRequestWithSession
 {
     /// <summary>Stable source identity for a direct (non-marketplace) install. Disambiguates uninstall when multiple installed plugins share the same name.</summary>
@@ -14243,7 +14465,7 @@ internal sealed class PluginsUninstallRequestWithSession
 }
 
 /// <summary>Name (or spec) of the plugin to update.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsUpdateRequestWithSession
 {
     /// <summary>Plugin name or "plugin@marketplace" spec to update.</summary>
@@ -14256,7 +14478,7 @@ internal sealed class PluginsUpdateRequestWithSession
 }
 
 /// <summary>Plugin names (or specs) to enable in the session's authoritative working directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPluginsEnableRequest
 {
     /// <summary>Plugin names or "plugin@marketplace" specs to enable. Unknown names are ignored. Non-marketplace direct installs are always enabled and cannot be toggled via this API.</summary>
@@ -14269,7 +14491,7 @@ internal sealed class SessionPluginsEnableRequest
 }
 
 /// <summary>Plugin names (or specs) to disable in the session's authoritative working directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPluginsDisableRequest
 {
     /// <summary>Plugin names or "plugin@marketplace" specs to disable. Unknown names are ignored. Non-marketplace direct installs cannot be disabled via this API; uninstall them instead. Plugin-owned MCP servers are stopped in active sessions immediately; other plugin contributions remain available until each session reloads plugins.</summary>
@@ -14282,7 +14504,7 @@ internal sealed class SessionPluginsDisableRequest
 }
 
 /// <summary>RPC data type for SessionPluginsReload operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionPluginsReloadRequest
 {
     /// <summary>When true, skip repo-level hooks during the hook reload. Use before folder trust is confirmed; load them post-trust via `sessions.loadDeferredRepoHooks`.</summary>
@@ -14307,7 +14529,7 @@ public sealed class SessionPluginsReloadRequest
 }
 
 /// <summary>RPC data type for SessionPluginsReloadRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPluginsReloadRequestWithSession
 {
     /// <summary>When true, skip repo-level hooks during the hook reload. Use before folder trust is confirmed; load them post-trust via `sessions.loadDeferredRepoHooks`.</summary>
@@ -14336,7 +14558,7 @@ internal sealed class SessionPluginsReloadRequestWithSession
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPluginsMarketplacesListRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -14345,7 +14567,7 @@ internal sealed class SessionPluginsMarketplacesListRequest
 }
 
 /// <summary>Marketplace source and optional working directory for relative-path resolution.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsMarketplacesAddRequestWithSession
 {
     /// <summary>Target session identifier.</summary>
@@ -14362,7 +14584,7 @@ internal sealed class PluginsMarketplacesAddRequestWithSession
 }
 
 /// <summary>Name of the marketplace to remove and an optional force flag.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsMarketplacesRemoveRequestWithSession
 {
     /// <summary>When true, also uninstall every plugin sourced from this marketplace. When false (default), removal is a no-op if any plugin from this marketplace is installed and the dependent plugin names are returned in the result.</summary>
@@ -14379,7 +14601,7 @@ internal sealed class PluginsMarketplacesRemoveRequestWithSession
 }
 
 /// <summary>Name of the marketplace whose plugin catalog to fetch.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PluginsMarketplacesBrowseRequestWithSession
 {
     /// <summary>Marketplace name to browse.</summary>
@@ -14392,7 +14614,7 @@ internal sealed class PluginsMarketplacesBrowseRequestWithSession
 }
 
 /// <summary>RPC data type for SessionPluginsMarketplacesRefresh operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionPluginsMarketplacesRefreshRequest
 {
     /// <summary>Marketplace name to refresh. When omitted, every registered marketplace is refreshed.</summary>
@@ -14401,7 +14623,7 @@ public sealed class SessionPluginsMarketplacesRefreshRequest
 }
 
 /// <summary>RPC data type for SessionPluginsMarketplacesRefreshRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionPluginsMarketplacesRefreshRequestWithSession
 {
     /// <summary>Marketplace name to refresh. When omitted, every registered marketplace is refreshed.</summary>
@@ -14414,7 +14636,7 @@ internal sealed class SessionPluginsMarketplacesRefreshRequestWithSession
 }
 
 /// <summary>Short-lived, rotating credential the caller must send on every request, in addition to `apiKey` if one is present. Omitted when the endpoint does not require one.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderSessionToken
 {
     /// <summary>When the token expires, if known. Callers should refresh by calling `getEndpoint` again before this time, or reactively on any 401/403 response from `baseUrl`.</summary>
@@ -14435,7 +14657,7 @@ public sealed class ProviderSessionToken
 }
 
 /// <summary>A snapshot of the provider endpoint the session is currently configured to talk to.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderEndpoint
 {
     /// <summary>A credential the caller should use with this endpoint. Omitted only when the endpoint accepts unauthenticated requests.</summary>
@@ -14470,7 +14692,7 @@ public sealed class ProviderEndpoint
 }
 
 /// <summary>RPC data type for SessionProviderGetEndpoint operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionProviderGetEndpointRequest
 {
     /// <summary>Model identifier the caller intends to use against the returned endpoint. Used to pick the correct wire shape. Omit to use whichever model the session is currently using.</summary>
@@ -14479,7 +14701,7 @@ public sealed class SessionProviderGetEndpointRequest
 }
 
 /// <summary>RPC data type for SessionProviderGetEndpointRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionProviderGetEndpointRequestWithSession
 {
     /// <summary>Model identifier the caller intends to use against the returned endpoint. Used to pick the correct wire shape. Omit to use whichever model the session is currently using.</summary>
@@ -14492,7 +14714,7 @@ internal sealed class SessionProviderGetEndpointRequestWithSession
 }
 
 /// <summary>The selectable model entries synthesized for the models added by this call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderAddResult
 {
     /// <summary>Synthesized selectable model entries for the newly added BYOK models, each under its provider-qualified selection id (`provider/id`). Empty when only providers were added.</summary>
@@ -14501,7 +14723,7 @@ public sealed class ProviderAddResult
 }
 
 /// <summary>RPC data type for ProtocolSystemMessageAppendConfig operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProtocolSystemMessageAppendConfig
 {
     /// <summary>Text appended to the standard system prompt.</summary>
@@ -14514,7 +14736,7 @@ public sealed class ProtocolSystemMessageAppendConfig
 }
 
 /// <summary>RPC data type for SystemMessageBlock operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SystemMessageBlock
 {
     /// <summary>Whether providers with explicit prompt caching should place a cache breakpoint after this block.</summary>
@@ -14531,7 +14753,7 @@ public sealed class SystemMessageBlock
 }
 
 /// <summary>RPC data type for ProtocolSystemMessageReplaceConfig operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProtocolSystemMessageReplaceConfig
 {
     /// <summary>Complete replacement system-message text.</summary>
@@ -14548,7 +14770,7 @@ public sealed class ProtocolSystemMessageReplaceConfig
 }
 
 /// <summary>RPC data type for ProtocolStaticSectionOverride operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProtocolStaticSectionOverride
 {
     /// <summary>Declarative operation applied to the section.</summary>
@@ -14561,7 +14783,7 @@ public sealed class ProtocolStaticSectionOverride
 }
 
 /// <summary>Polymorphic base type discriminated by <c>action</c>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "action",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -14576,7 +14798,7 @@ public partial class ProtocolMarkerSectionOverride
 
 
 /// <summary>The <c>transform</c> variant of <see cref="ProtocolMarkerSectionOverride"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ProtocolMarkerSectionOverrideTransform : ProtocolMarkerSectionOverride
 {
     /// <inheritdoc />
@@ -14585,7 +14807,7 @@ public partial class ProtocolMarkerSectionOverrideTransform : ProtocolMarkerSect
 }
 
 /// <summary>The <c>preserve</c> variant of <see cref="ProtocolMarkerSectionOverride"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ProtocolMarkerSectionOverridePreserve : ProtocolMarkerSectionOverride
 {
     /// <inheritdoc />
@@ -14594,7 +14816,7 @@ public partial class ProtocolMarkerSectionOverridePreserve : ProtocolMarkerSecti
 }
 
 /// <summary>JSON union data type for <c>ProtocolSectionOverride</c>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 public sealed partial class ProtocolSectionOverride
 {
@@ -14672,7 +14894,7 @@ public override void Write(Utf8JsonWriter writer, ProtocolSectionOverride value,
 }
 
 /// <summary>RPC data type for ProtocolSystemMessageCustomizeConfig operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProtocolSystemMessageCustomizeConfig
 {
     /// <summary>Text appended after the customized sections.</summary>
@@ -14689,7 +14911,7 @@ public sealed class ProtocolSystemMessageCustomizeConfig
 }
 
 /// <summary>JSON union data type for <c>ProtocolSystemMessageConfig</c>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 public sealed partial class ProtocolSystemMessageConfig
 {
@@ -14790,7 +15012,7 @@ public override void Write(Utf8JsonWriter writer, ProtocolSystemMessageConfig va
 }
 
 /// <summary>A BYOK model definition referencing a named provider.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderModelConfig
 {
     /// <summary>Optional capability overrides (vision, tool_calls, reasoning, etc.).</summary>
@@ -14839,7 +15061,7 @@ public sealed class ProviderModelConfig
 }
 
 /// <summary>Azure-specific provider options.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderConfigAzure
 {
     /// <summary>API version. When set, uses the versioned deployment route. When omitted, uses the GA versionless v1 route.</summary>
@@ -14848,7 +15070,7 @@ public sealed class ProviderConfigAzure
 }
 
 /// <summary>External SDK input for a named custom model provider. Ingested by the native protocol boundary before host dispatch.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class NamedProviderConfig
 {
     /// <summary>Static API key used to authenticate provider requests.</summary>
@@ -14893,7 +15115,7 @@ public sealed class NamedProviderConfig
 }
 
 /// <summary>BYOK providers and/or models to add to the session's registry at runtime. Both fields are optional; provide providers, models, or both.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ProviderAddRequest
 {
     /// <summary>BYOK model definitions to register. Each must reference a provider that is already registered or included in this same call. Selection ids (`provider/id`) must be unique across the registry.</summary>
@@ -14910,7 +15132,7 @@ internal sealed class ProviderAddRequest
 }
 
 /// <summary>The selectable model entries and selection ids synthesized for the synchronized BYOK models.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderSyncResult
 {
     /// <summary>True when synchronization withdrew the selected host-managed model, leaving the session with no explicit selection, so ordinary model resolution picks the session default. Synchronization never promotes a surviving host model in its place: publishing a model offers it, and the choice of which model to use stays with the user.</summary>
@@ -14927,7 +15149,7 @@ public sealed class ProviderSyncResult
 }
 
 /// <summary>Authoritative BYOK provider and model registry snapshot to apply atomically to the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ProviderSyncRequest
 {
     /// <summary>BYOK model definition snapshot. Models absent from this list are removed.</summary>
@@ -14944,7 +15166,7 @@ internal sealed class ProviderSyncRequest
 }
 
 /// <summary>Indicates whether the session options patch was applied successfully.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionUpdateOptionsResult
 {
     /// <summary>Number of hooks loaded from installed plugins, returned when installedPlugins is updated.</summary>
@@ -14957,7 +15179,7 @@ public sealed class SessionUpdateOptionsResult
 }
 
 /// <summary>Source descriptor for a `session.options.update` content-exclusion rule, with source name and type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class OptionsUpdateAdditionalContentExclusionPolicyRuleSource
 {
     /// <summary>Name of the policy source.</summary>
@@ -14970,7 +15192,7 @@ public sealed class OptionsUpdateAdditionalContentExclusionPolicyRuleSource
 }
 
 /// <summary>Single content-exclusion rule supplied to `session.options.update`, with paths, match conditions, and source.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class OptionsUpdateAdditionalContentExclusionPolicyRule
 {
     /// <summary>Conditions of which at least one must match.</summary>
@@ -14991,7 +15213,7 @@ public sealed class OptionsUpdateAdditionalContentExclusionPolicyRule
 }
 
 /// <summary>Content-exclusion policy supplied to `session.options.update`, with rules, last-updated data, and scope.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class OptionsUpdateAdditionalContentExclusionPolicy
 {
     /// <summary>Opaque policy update timestamp supplied by the host.</summary>
@@ -15008,7 +15230,7 @@ public sealed class OptionsUpdateAdditionalContentExclusionPolicy
 }
 
 /// <summary>Options scoped to the built-in CAPI (Copilot API) provider.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CapiSessionOptions
 {
     /// <summary>Routing preference for sessions whose model is `auto`. On create or cold resume, this establishes the preference sent as `tier` on CAPI `/auto` requests; when omitted on cold resume, the runtime restores the last committed preference. On resident resume, a different value requests a safe switch after resume succeeds and cannot change an in-flight turn. Successful switches are persisted for later cold resume. When no preference is supplied or restored, CAPI default routing is used. `fast` is an integrator-only latency preset, not a first-party GitHub Copilot product preference.</summary>
@@ -15021,7 +15243,7 @@ public sealed class CapiSessionOptions
 }
 
 /// <summary>Installed plugin record for a session, with marketplace, version, install time, enabled state, cache path, and source.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionInstalledPlugin
 {
     /// <summary>Path where the plugin is cached locally.</summary>
@@ -15062,7 +15284,7 @@ public sealed class SessionInstalledPlugin
 }
 
 /// <summary>Custom model-provider configuration (BYOK).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderConfig
 {
     /// <summary>API key. Optional for local providers like Ollama.</summary>
@@ -15131,7 +15353,7 @@ public sealed class ProviderConfig
 }
 
 /// <summary>Credential-injection capability flags applied while the sandbox is enabled. For the same capability independent of sandboxing, and matched to the credential's GitHub host, see `shell.credentials`; the two are additive.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxConfigAuth
 {
     /// <summary>Whether to export `GH_TOKEN` so the `gh` CLI authenticates inside the sandbox without the OS keyring the sandbox blocks. Default: false (opt-in).</summary>
@@ -15144,7 +15366,7 @@ public sealed class SandboxConfigAuth
 }
 
 /// <summary>macOS seatbelt experimental options.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxConfigUserPolicyExperimentalSeatbelt
 {
     /// <summary>Whether the macOS seatbelt profile may access the keychain.</summary>
@@ -15153,7 +15375,7 @@ public sealed class SandboxConfigUserPolicyExperimentalSeatbelt
 }
 
 /// <summary>Platform-specific experimental policy fields.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxConfigUserPolicyExperimental
 {
     /// <summary>macOS seatbelt experimental options.</summary>
@@ -15162,7 +15384,7 @@ public sealed class SandboxConfigUserPolicyExperimental
 }
 
 /// <summary>Filesystem rules to merge into the base policy.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxConfigUserPolicyFilesystem
 {
     /// <summary>Whether to clear the policy when the session exits.</summary>
@@ -15183,7 +15405,7 @@ public sealed class SandboxConfigUserPolicyFilesystem
 }
 
 /// <summary>HTTP proxy configuration for sandboxed traffic.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxConfigUserPolicyNetworkProxy
 {
     /// <summary>Optional password for proxy authentication, combined with the URL at spawn time. The persisted value may be a literal password, a `${secret:…}` reference resolved from the OS keychain, or a `${VAR}`/`$VAR` environment reference; it is resolved just before the sandboxed process routes through the proxy. The /sandbox dialog stores a real password in the OS keychain and persists only a `${secret:…}` placeholder (never plaintext in settings.json); the field is masked in the dialog and redacted by /settings show.</summary>
@@ -15200,7 +15422,7 @@ public sealed class SandboxConfigUserPolicyNetworkProxy
 }
 
 /// <summary>Network rules to merge into the base policy.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxConfigUserPolicyNetwork
 {
     /// <summary>Hosts allowed through the built-in sandbox proxy. A non-empty list denies unmatched hosts; an absent or empty list allows all hosts not blocked. Supports exact hostnames, IP addresses, and *.example.com for strict subdomains. Host rules do not override the outbound or local-network toggles.</summary>
@@ -15225,7 +15447,7 @@ public sealed class SandboxConfigUserPolicyNetwork
 }
 
 /// <summary>macOS seatbelt-specific options.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxConfigUserPolicySeatbelt
 {
     /// <summary>Whether the macOS seatbelt profile may access the keychain.</summary>
@@ -15234,7 +15456,7 @@ public sealed class SandboxConfigUserPolicySeatbelt
 }
 
 /// <summary>User-managed sandbox policy fragment merged into the auto-discovered base policy.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxConfigUserPolicy
 {
     /// <summary>Deprecated legacy location for `seatbelt`; read only when the top-level `seatbelt` is absent.</summary>
@@ -15255,7 +15477,7 @@ public sealed class SandboxConfigUserPolicy
 }
 
 /// <summary>Resolved sandbox configuration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxConfig
 {
     /// <summary>Whether to auto-add the current working directory to readwritePaths. Default: true.</summary>
@@ -15320,7 +15542,7 @@ public sealed class SandboxConfig
 /// an OS sandboxing backend is available. `sandboxConfig.auth` remains the sandbox-scoped
 /// spelling and is additive with this one.
 /// </summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ShellCredentials
 {
     /// <summary>
@@ -15349,7 +15571,7 @@ public sealed class ShellCredentials
 }
 
 /// <summary>A host-provided script sourced before each built-in shell command when its shell target matches the active shell.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ShellInitScript
 {
     /// <summary>Path to the script to source.</summary>
@@ -15362,7 +15584,7 @@ public sealed class ShellInitScript
 }
 
 /// <summary>Per-session settings for built-in shell tools.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ShellOptions
 {
     /// <summary>Command-scoped GitHub credential injection for shell commands.</summary>
@@ -15397,11 +15619,11 @@ public sealed class ShellOptions
 }
 
 /// <summary>Patch of mutable session options to apply to the running session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionUpdateOptionsParams
 {
     /// <summary>Additional content-exclusion policies to merge into the session's policy set.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("additionalContentExclusionPolicies")]
     public IList<OptionsUpdateAdditionalContentExclusionPolicy>? AdditionalContentExclusionPolicies { get; set; }
 
@@ -15652,7 +15874,7 @@ internal sealed class SessionUpdateOptionsParams
 }
 
 /// <summary>Parameters for (re)loading the merged LSP configuration set.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class LspInitializeRequest
 {
     /// <summary>Force re-initialization even when LSP configs were already loaded for the working directory.</summary>
@@ -15673,7 +15895,7 @@ internal sealed class LspInitializeRequest
 }
 
 /// <summary>Discovered extension metadata, including source-qualified ID, name, discovery source, status, and optional process ID.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class Extension
 {
     /// <summary>Source-qualified ID (e.g., 'project:my-ext', 'user:auth-helper', 'plugin:my-plugin:my-ext').</summary>
@@ -15698,7 +15920,7 @@ public sealed class Extension
 }
 
 /// <summary>Extensions discovered for the session, with their current status.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ExtensionList
 {
     /// <summary>Discovered extensions and their current status.</summary>
@@ -15707,7 +15929,7 @@ public sealed class ExtensionList
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionExtensionsListRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -15716,7 +15938,7 @@ internal sealed class SessionExtensionsListRequest
 }
 
 /// <summary>Source-qualified extension identifier to enable for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ExtensionsEnableRequest
 {
     /// <summary>Source-qualified extension ID to enable.</summary>
@@ -15729,7 +15951,7 @@ internal sealed class ExtensionsEnableRequest
 }
 
 /// <summary>Source-qualified extension identifier to disable for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ExtensionsDisableRequest
 {
     /// <summary>Source-qualified extension ID to disable.</summary>
@@ -15742,7 +15964,7 @@ internal sealed class ExtensionsDisableRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionExtensionsReloadRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -15752,7 +15974,7 @@ internal sealed class SessionExtensionsReloadRequest
 
 /// <summary>Attachment union accepted by push input, covering files, directories, GitHub objects, blobs, snippets, and extension context.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -15780,7 +16002,7 @@ public partial class PushAttachment
 
 
 /// <summary>Optional line range to scope the attachment to a specific section of the file.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PushAttachmentFileLineRange
 {
     /// <summary>End line number (1-based, inclusive).</summary>
@@ -15794,7 +16016,7 @@ public sealed class PushAttachmentFileLineRange
 
 /// <summary>File attachment.</summary>
 /// <remarks>The <c>file</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentFile : PushAttachment
 {
     /// <inheritdoc />
@@ -15817,7 +16039,7 @@ public partial class PushAttachmentFile : PushAttachment
 
 /// <summary>Directory attachment.</summary>
 /// <remarks>The <c>directory</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentDirectory : PushAttachment
 {
     /// <inheritdoc />
@@ -15834,7 +16056,7 @@ public partial class PushAttachmentDirectory : PushAttachment
 }
 
 /// <summary>End position of the selection.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PushAttachmentSelectionDetailsEnd
 {
     /// <summary>End character offset within the line (0-based).</summary>
@@ -15847,7 +16069,7 @@ public sealed class PushAttachmentSelectionDetailsEnd
 }
 
 /// <summary>Start position of the selection.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PushAttachmentSelectionDetailsStart
 {
     /// <summary>Start character offset within the line (0-based).</summary>
@@ -15860,7 +16082,7 @@ public sealed class PushAttachmentSelectionDetailsStart
 }
 
 /// <summary>Position range of the selection within the file.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PushAttachmentSelectionDetails
 {
     /// <summary>End position of the selection.</summary>
@@ -15874,7 +16096,7 @@ public sealed class PushAttachmentSelectionDetails
 
 /// <summary>Code selection attachment from an editor.</summary>
 /// <remarks>The <c>selection</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentSelection : PushAttachment
 {
     /// <inheritdoc />
@@ -15900,7 +16122,7 @@ public partial class PushAttachmentSelection : PushAttachment
 
 /// <summary>GitHub issue, pull request, or discussion reference.</summary>
 /// <remarks>The <c>github_reference</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubReference : PushAttachment
 {
     /// <inheritdoc />
@@ -15929,7 +16151,7 @@ public partial class PushAttachmentGitHubReference : PushAttachment
 }
 
 /// <summary>Pointer to a GitHub repository.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PushGitHubRepoRef
 {
     /// <summary>Numeric GitHub repository id.</summary>
@@ -15947,7 +16169,7 @@ public sealed class PushGitHubRepoRef
 
 /// <summary>Pointer to a GitHub commit.</summary>
 /// <remarks>The <c>github_commit</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubCommit : PushAttachment
 {
     /// <inheritdoc />
@@ -15973,7 +16195,7 @@ public partial class PushAttachmentGitHubCommit : PushAttachment
 
 /// <summary>Pointer to a GitHub release.</summary>
 /// <remarks>The <c>github_release</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubRelease : PushAttachment
 {
     /// <inheritdoc />
@@ -15999,7 +16221,7 @@ public partial class PushAttachmentGitHubRelease : PushAttachment
 
 /// <summary>Pointer to a GitHub Actions job.</summary>
 /// <remarks>The <c>github_actions_job</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubActionsJob : PushAttachment
 {
     /// <inheritdoc />
@@ -16034,7 +16256,7 @@ public partial class PushAttachmentGitHubActionsJob : PushAttachment
 
 /// <summary>Pointer to a GitHub repository.</summary>
 /// <remarks>The <c>github_repository</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubRepository : PushAttachment
 {
     /// <inheritdoc />
@@ -16061,7 +16283,7 @@ public partial class PushAttachmentGitHubRepository : PushAttachment
 }
 
 /// <summary>One side of a file diff (head or base).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PushAttachmentGitHubFileDiffSide
 {
     /// <summary>Repository-relative path to the file.</summary>
@@ -16079,7 +16301,7 @@ public sealed class PushAttachmentGitHubFileDiffSide
 
 /// <summary>Pointer to a single-file diff. At least one of `head` and `base` must be present.</summary>
 /// <remarks>The <c>github_file_diff</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubFileDiff : PushAttachment
 {
     /// <inheritdoc />
@@ -16102,7 +16324,7 @@ public partial class PushAttachmentGitHubFileDiff : PushAttachment
 }
 
 /// <summary>One side of a tree comparison (head or base).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PushAttachmentGitHubTreeComparisonSide
 {
     /// <summary>Repository the revision belongs to.</summary>
@@ -16116,7 +16338,7 @@ public sealed class PushAttachmentGitHubTreeComparisonSide
 
 /// <summary>Pointer to a comparison between two git revisions.</summary>
 /// <remarks>The <c>github_tree_comparison</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubTreeComparison : PushAttachment
 {
     /// <inheritdoc />
@@ -16138,7 +16360,7 @@ public partial class PushAttachmentGitHubTreeComparison : PushAttachment
 
 /// <summary>Generic GitHub URL reference.</summary>
 /// <remarks>The <c>github_url</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubUrl : PushAttachment
 {
     /// <inheritdoc />
@@ -16152,7 +16374,7 @@ public partial class PushAttachmentGitHubUrl : PushAttachment
 
 /// <summary>Pointer to a file in a GitHub repository at a specific ref.</summary>
 /// <remarks>The <c>github_file</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubFile : PushAttachment
 {
     /// <inheritdoc />
@@ -16178,7 +16400,7 @@ public partial class PushAttachmentGitHubFile : PushAttachment
 
 /// <summary>Pointer to a line range inside a file in a GitHub repository.</summary>
 /// <remarks>The <c>github_snippet</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentGitHubSnippet : PushAttachment
 {
     /// <inheritdoc />
@@ -16208,7 +16430,7 @@ public partial class PushAttachmentGitHubSnippet : PushAttachment
 
 /// <summary>Blob attachment with inline base64-encoded data.</summary>
 /// <remarks>The <c>blob</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentBlob : PushAttachment
 {
     /// <inheritdoc />
@@ -16232,7 +16454,7 @@ public partial class PushAttachmentBlob : PushAttachment
 
 /// <summary>Slim input shape for extension_context attachments; identity fields are runtime-derived.</summary>
 /// <remarks>The <c>extension_context</c> variant of <see cref="PushAttachment"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PushAttachmentExtensionContext : PushAttachment
 {
     /// <inheritdoc />
@@ -16251,7 +16473,7 @@ public partial class PushAttachmentExtensionContext : PushAttachment
 }
 
 /// <summary>Parameters for session.extensions.sendAttachmentsToMessage.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SendAttachmentsToMessageParams
 {
     /// <summary>Attachments to push into the next user-message turn. extension_context entries take the slim shape; standard variants take their full AttachmentSchema shape.</summary>
@@ -16268,7 +16490,7 @@ internal sealed class SendAttachmentsToMessageParams
 }
 
 /// <summary>A tool name and arguments to execute through the session's native invocation pipeline.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ToolsExecuteRequest
 {
     /// <summary>Arguments supplied to the tool.</summary>
@@ -16289,7 +16511,7 @@ internal sealed class ToolsExecuteRequest
 }
 
 /// <summary>Custom grammar input format accepted by a built-in tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class BuiltinToolFormat
 {
     /// <summary>Grammar definition accepted by the tool.</summary>
@@ -16306,7 +16528,7 @@ public sealed class BuiltinToolFormat
 }
 
 /// <summary>JSON Schema object accepted by a built-in tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class BuiltinToolInputSchema
 {
     /// <summary>Root type of the tool input schema.</summary>
@@ -16315,7 +16537,7 @@ public sealed class BuiltinToolInputSchema
 }
 
 /// <summary>Rust-owned metadata and input schema for a built-in tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class BuiltinToolDescriptor
 {
     /// <summary>Model-facing description of the tool's behavior.</summary>
@@ -16360,7 +16582,7 @@ public sealed class BuiltinToolDescriptor
 }
 
 /// <summary>Rust-owned built-in tool descriptors for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolsGetBuiltinDescriptorsResult
 {
     /// <summary>Built-in tool descriptors materialized for the session.</summary>
@@ -16369,7 +16591,7 @@ public sealed class ToolsGetBuiltinDescriptorsResult
 }
 
 /// <summary>Shell-specific names and description lines used to materialize built-in shell tool descriptors.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolsShellDescriptorConfig
 {
     /// <summary>Additional model-facing shell description lines.</summary>
@@ -16402,7 +16624,7 @@ public sealed class ToolsShellDescriptorConfig
 }
 
 /// <summary>Options controlling how Rust-owned built-in tool descriptors are materialized.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ToolsGetBuiltinDescriptorsRequest
 {
     /// <summary>Whether background task completion notifications are enabled.</summary>
@@ -16439,7 +16661,7 @@ internal sealed class ToolsGetBuiltinDescriptorsRequest
 }
 
 /// <summary>Task completion notification with summary from the agent.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TaskCompleteData
 {
     /// <summary>Structured blocker details when outcome is blocked.</summary>
@@ -16468,7 +16690,7 @@ public sealed class TaskCompleteData
 }
 
 /// <summary>Binary result returned by a tool for the model.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ExternalToolTextResultForLlmBinaryResultsForLlm
 {
     /// <summary>Base64-encoded binary data.</summary>
@@ -16495,7 +16717,7 @@ public sealed class ExternalToolTextResultForLlmBinaryResultsForLlm
 
 /// <summary>A content block within a tool result, which may be text, terminal output, image, audio, or a resource.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -16516,7 +16738,7 @@ public partial class ExternalToolTextResultForLlmContent
 
 /// <summary>Plain text content block.</summary>
 /// <remarks>The <c>text</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ExternalToolTextResultForLlmContentText : ExternalToolTextResultForLlmContent
 {
     /// <inheritdoc />
@@ -16530,7 +16752,7 @@ public partial class ExternalToolTextResultForLlmContentText : ExternalToolTextR
 
 /// <summary>Terminal/shell output content block with optional exit code and working directory.</summary>
 /// <remarks>The <c>terminal</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ExternalToolTextResultForLlmContentTerminal : ExternalToolTextResultForLlmContent
 {
     /// <inheritdoc />
@@ -16554,7 +16776,7 @@ public partial class ExternalToolTextResultForLlmContentTerminal : ExternalToolT
 
 /// <summary>Shell command exit metadata with optional output preview.</summary>
 /// <remarks>The <c>shell_exit</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ExternalToolTextResultForLlmContentShellExit : ExternalToolTextResultForLlmContent
 {
     /// <inheritdoc />
@@ -16592,7 +16814,7 @@ public partial class ExternalToolTextResultForLlmContentShellExit : ExternalTool
 
 /// <summary>Image content block with base64-encoded data.</summary>
 /// <remarks>The <c>image</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ExternalToolTextResultForLlmContentImage : ExternalToolTextResultForLlmContent
 {
     /// <inheritdoc />
@@ -16611,7 +16833,7 @@ public partial class ExternalToolTextResultForLlmContentImage : ExternalToolText
 
 /// <summary>Audio content block with base64-encoded data.</summary>
 /// <remarks>The <c>audio</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ExternalToolTextResultForLlmContentAudio : ExternalToolTextResultForLlmContent
 {
     /// <inheritdoc />
@@ -16629,7 +16851,7 @@ public partial class ExternalToolTextResultForLlmContentAudio : ExternalToolText
 }
 
 /// <summary>Icon image for a resource.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ExternalToolTextResultForLlmContentResourceLinkIcon
 {
     /// <summary>MIME type of the icon image.</summary>
@@ -16651,7 +16873,7 @@ public sealed class ExternalToolTextResultForLlmContentResourceLinkIcon
 
 /// <summary>Resource link content block referencing an external resource.</summary>
 /// <remarks>The <c>resource_link</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ExternalToolTextResultForLlmContentResourceLink : ExternalToolTextResultForLlmContent
 {
     /// <inheritdoc />
@@ -16694,7 +16916,7 @@ public partial class ExternalToolTextResultForLlmContentResourceLink : ExternalT
 
 /// <summary>Embedded resource content block with inline text or binary data.</summary>
 /// <remarks>The <c>resource</c> variant of <see cref="ExternalToolTextResultForLlmContent"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class ExternalToolTextResultForLlmContentResource : ExternalToolTextResultForLlmContent
 {
     /// <inheritdoc />
@@ -16707,7 +16929,7 @@ public partial class ExternalToolTextResultForLlmContentResource : ExternalToolT
 }
 
 /// <summary>A message injected by a tool result.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolResultNewMessage
 {
     /// <summary>Message content to inject after the tool result.</summary>
@@ -16720,7 +16942,7 @@ public sealed class ToolResultNewMessage
 }
 
 /// <summary>RPC data type for TaskCompletionDecision operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TaskCompletionDecision
 {
     /// <summary>Objective eligibility token captured when the decision was evaluated.</summary>
@@ -16753,7 +16975,7 @@ public sealed class TaskCompletionDecision
 }
 
 /// <summary>Expanded canonical result returned by a session tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolResultExpanded
 {
     /// <summary>Base64-encoded binary results returned to the model.</summary>
@@ -16826,7 +17048,7 @@ public sealed class ToolResultExpanded
 }
 
 /// <summary>Task-completion tool arguments and final result used to build a label-safe session event payload.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ToolsTaskCompleteEventDataRequest
 {
     /// <summary>Final expanded result returned by the task_complete tool.</summary>
@@ -16843,7 +17065,7 @@ internal sealed class ToolsTaskCompleteEventDataRequest
 }
 
 /// <summary>Indicates whether the external tool call result was handled successfully.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HandlePendingToolCallResult
 {
     /// <summary>Whether the tool call result was handled successfully.</summary>
@@ -16852,7 +17074,7 @@ public sealed class HandlePendingToolCallResult
 }
 
 /// <summary>Pending external tool call request ID, with the tool result or an error describing why it failed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class HandlePendingToolCallRequest
 {
     /// <summary>Error message if the tool call failed.</summary>
@@ -16873,13 +17095,13 @@ internal sealed class HandlePendingToolCallRequest
 }
 
 /// <summary>Resolve, build, and validate the runtime tool list for this session. Subagent sessions and consumer flows that need an initialized tool set before `send` invoke this. Default base-class implementation is a no-op for sessions that don't support tool validation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolsInitializeAndValidateResult
 {
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionToolsInitializeAndValidateRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -16888,7 +17110,7 @@ internal sealed class SessionToolsInitializeAndValidateRequest
 }
 
 /// <summary>Lightweight metadata for a currently initialized session tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CurrentToolMetadata
 {
     /// <summary>Whether the tool is loaded on demand via tool search.</summary>
@@ -16921,7 +17143,7 @@ public sealed class CurrentToolMetadata
 }
 
 /// <summary>Current lightweight tool metadata snapshot for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolsGetCurrentMetadataResult
 {
     /// <summary>Current tool metadata, or null when tools have not been initialized yet.</summary>
@@ -16930,7 +17152,7 @@ public sealed class ToolsGetCurrentMetadataResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionToolsGetCurrentMetadataRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -16939,13 +17161,13 @@ internal sealed class SessionToolsGetCurrentMetadataRequest
 }
 
 /// <summary>Empty result after replacing the calling connection's externally implemented tools.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolsSetResult
 {
 }
 
 /// <summary>Serializable definition of a caller-implemented tool whose execution is handled over the SDK connection.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProtocolExternalToolDefinition
 {
     /// <summary>Tool-loading deferral policy.</summary>
@@ -16986,7 +17208,7 @@ public sealed class ProtocolExternalToolDefinition
 }
 
 /// <summary>Complete externally implemented tool list for the calling connection. An empty list removes every tool previously supplied by that connection.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ToolsSetRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -16999,13 +17221,13 @@ internal sealed class ToolsSetRequest
 }
 
 /// <summary>Empty result after applying subagent settings.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolsUpdateSubagentSettingsResult
 {
 }
 
 /// <summary>Subagent model, reasoning effort, context tier, and auto-invocation settings.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SubagentSettingsEntry
 {
     /// <summary>Whether this agent's runtime-defined proactive invocation prompting is enabled, if supported. Currently consumed by the built-in rubber-duck agent.</summary>
@@ -17050,7 +17272,7 @@ public sealed class UpdateSubagentSettingsRequestSubagents
 }
 
 /// <summary>Subagent settings to apply to the current session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UpdateSubagentSettingsRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -17063,7 +17285,7 @@ internal sealed class UpdateSubagentSettingsRequest
 }
 
 /// <summary>RPC data type for SessionCommandsList operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionCommandsListRequest
 {
     /// <summary>Include runtime built-in commands.</summary>
@@ -17080,7 +17302,7 @@ public sealed class SessionCommandsListRequest
 }
 
 /// <summary>RPC data type for SessionCommandsListRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionCommandsListRequestWithSession
 {
     /// <summary>Include runtime built-in commands.</summary>
@@ -17102,7 +17324,7 @@ internal sealed class SessionCommandsListRequestWithSession
 
 /// <summary>Result of invoking the slash command (text output, prompt to send to the agent, completion, or subcommand selection).</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -17124,7 +17346,7 @@ public partial class SlashCommandInvocationResult
 
 /// <summary>Slash-command invocation result containing text output plus Markdown/ANSI rendering flags.</summary>
 /// <remarks>The <c>text</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SlashCommandInvocationResultText : SlashCommandInvocationResult
 {
     /// <inheritdoc />
@@ -17158,7 +17380,7 @@ public partial class SlashCommandInvocationResultText : SlashCommandInvocationRe
 
 /// <summary>Slash-command invocation result that submits an agent prompt, with display prompt, optional mode, optional user-facing notice, and settings-change flag.</summary>
 /// <remarks>The <c>agent-prompt</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SlashCommandInvocationResultAgentPrompt : SlashCommandInvocationResult
 {
     /// <inheritdoc />
@@ -17191,7 +17413,7 @@ public partial class SlashCommandInvocationResultAgentPrompt : SlashCommandInvoc
 
 /// <summary>Slash-command invocation result indicating completion, with optional message and settings-change flag.</summary>
 /// <remarks>The <c>completed</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SlashCommandInvocationResultCompleted : SlashCommandInvocationResult
 {
     /// <inheritdoc />
@@ -17215,7 +17437,7 @@ public partial class SlashCommandInvocationResultCompleted : SlashCommandInvocat
 }
 
 /// <summary>Selectable slash-command subcommand option with name, description, and optional group label.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SlashCommandSelectSubcommandOption
 {
     /// <summary>Human-readable description of the subcommand.</summary>
@@ -17233,7 +17455,7 @@ public sealed class SlashCommandSelectSubcommandOption
 
 /// <summary>Slash-command invocation result asking the client to present subcommand options for a parent command.</summary>
 /// <remarks>The <c>select-subcommand</c> variant of <see cref="SlashCommandInvocationResult"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SlashCommandInvocationResultSelectSubcommand : SlashCommandInvocationResult
 {
     /// <inheritdoc />
@@ -17259,7 +17481,7 @@ public partial class SlashCommandInvocationResultSelectSubcommand : SlashCommand
 }
 
 /// <summary>RPC data type for SlashCommandTimelineEntry operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SlashCommandTimelineEntry
 {
     /// <summary>What the user must do to recover, when the entry reports a failure the runtime knows an action for. The `text` never names a client affordance, so a client that offers one renders it from this value.</summary>
@@ -17280,7 +17502,7 @@ public sealed class SlashCommandTimelineEntry
 }
 
 /// <summary>The <c>add-timeline-entry</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SlashCommandInvocationResultAddTimelineEntry : SlashCommandInvocationResult
 {
     /// <inheritdoc />
@@ -17303,7 +17525,7 @@ public partial class SlashCommandInvocationResultAddTimelineEntry : SlashCommand
 }
 
 /// <summary>RPC data type for SlashCommandModelPickerDialog operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SlashCommandModelPickerDialog
 {
     /// <summary>Discriminator for a model-picker dialog.</summary>
@@ -17324,7 +17546,7 @@ public sealed class SlashCommandModelPickerDialog
 }
 
 /// <summary>The <c>show-dialog</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SlashCommandInvocationResultShowDialog : SlashCommandInvocationResult
 {
     /// <inheritdoc />
@@ -17347,7 +17569,7 @@ public sealed class SlashCommandInvocationResultSetModelRevertOnCancel
 }
 
 /// <summary>The <c>set-model</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SlashCommandInvocationResultSetModel : SlashCommandInvocationResult
 {
     /// <inheritdoc />
@@ -17390,7 +17612,7 @@ public partial class SlashCommandInvocationResultSetModel : SlashCommandInvocati
 }
 
 /// <summary>The <c>set-plan-model</c> variant of <see cref="SlashCommandInvocationResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SlashCommandInvocationResultSetPlanModel : SlashCommandInvocationResult
 {
     /// <inheritdoc />
@@ -17413,7 +17635,7 @@ public partial class SlashCommandInvocationResultSetPlanModel : SlashCommandInvo
 }
 
 /// <summary>Slash command name and optional raw input string to invoke.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CommandsInvokeRequest
 {
     /// <summary>Raw input after the command name.</summary>
@@ -17434,7 +17656,7 @@ internal sealed class CommandsInvokeRequest
 }
 
 /// <summary>Whether finalizing the invocation effect succeeded, and the failure reason when it did not.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CommandsFinalizeInvocationEffectResult
 {
     /// <summary>Failure reason when the invocation effect could not be finalized.</summary>
@@ -17452,7 +17674,7 @@ public sealed class CommandsFinalizeInvocationEffectRequestEffect
 }
 
 /// <summary>The pending slash-command invocation effect to finalize, plus whether the host applied or cancelled it.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CommandsFinalizeInvocationEffectRequest
 {
     /// <summary>The slash-command result object that produced the pending effect, echoed back unchanged.</summary>
@@ -17469,7 +17691,7 @@ internal sealed class CommandsFinalizeInvocationEffectRequest
 }
 
 /// <summary>Indicates whether the pending client-handled command was completed successfully.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CommandsHandlePendingCommandResult
 {
     /// <summary>Whether the command was handled successfully.</summary>
@@ -17478,7 +17700,7 @@ public sealed class CommandsHandlePendingCommandResult
 }
 
 /// <summary>Pending command request ID and an optional error if the client handler failed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CommandsHandlePendingCommandRequest
 {
     /// <summary>Error message if the command handler failed.</summary>
@@ -17495,7 +17717,7 @@ internal sealed class CommandsHandlePendingCommandRequest
 }
 
 /// <summary>Error message produced while executing the command, if any.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ExecuteCommandResult
 {
     /// <summary>Error message produced while executing the command, if any. Omitted when the handler succeeded.</summary>
@@ -17504,7 +17726,7 @@ public sealed class ExecuteCommandResult
 }
 
 /// <summary>Slash command name and argument string to execute synchronously.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ExecuteCommandParams
 {
     /// <summary>Argument string to pass to the command (empty string if none).</summary>
@@ -17522,7 +17744,7 @@ internal sealed class ExecuteCommandParams
 
 /// <summary>Indicates whether the command was accepted into the local execution queue.</summary>
 /// <remarks>Data type discriminated by <c>queued</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class EnqueueCommandResult
 {
     /// <summary>The boolean discriminator.</summary>
@@ -17536,7 +17758,7 @@ public partial class EnqueueCommandResult
 }
 
 /// <summary>Slash-prefixed command string to enqueue for FIFO processing.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class EnqueueCommandParams
 {
     /// <summary>Slash-prefixed command string to enqueue, e.g. '/compact' or '/model gpt-4'. Queued FIFO with any in-flight items; if the session is idle, processing kicks off immediately.</summary>
@@ -17553,7 +17775,7 @@ internal sealed class EnqueueCommandParams
 }
 
 /// <summary>Indicates whether the queued-command response was matched to a pending request.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CommandsRespondToQueuedCommandResult
 {
     /// <summary>Whether a pending queued command with the given request ID was found and resolved. False when the request was already resolved, cancelled, or unknown.</summary>
@@ -17563,7 +17785,7 @@ public sealed class CommandsRespondToQueuedCommandResult
 
 /// <summary>Result of the queued command execution.</summary>
 /// <remarks>Data type discriminated by <c>handled</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class QueuedCommandResult
 {
     /// <summary>The boolean discriminator.</summary>
@@ -17577,7 +17799,7 @@ public partial class QueuedCommandResult
 }
 
 /// <summary>Queued-command request ID and the result indicating whether the host executed it (and whether to stop processing further queued commands).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class CommandsRespondToQueuedCommandRequest
 {
     /// <summary>Request ID from the `command.queued` event the host is responding to.</summary>
@@ -17594,7 +17816,7 @@ internal sealed class CommandsRespondToQueuedCommandRequest
 }
 
 /// <summary>Telemetry engagement ID for the session, when available.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionTelemetryEngagement
 {
     /// <summary>Current telemetry engagement ID, when available.</summary>
@@ -17603,7 +17825,7 @@ public sealed class SessionTelemetryEngagement
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionTelemetryGetEngagementIdRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -17612,7 +17834,7 @@ internal sealed class SessionTelemetryGetEngagementIdRequest
 }
 
 /// <summary>Feature override key/value pairs to attach to subsequent telemetry events from this session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class TelemetrySetFeatureOverridesRequest
 {
     /// <summary>Override key/value pairs to attach to subsequent telemetry events from this session. Replaces any previously-set overrides.</summary>
@@ -17625,7 +17847,7 @@ internal sealed class TelemetrySetFeatureOverridesRequest
 }
 
 /// <summary>Completed transient query. Ordered chunks and the terminal outcome are also delivered through `ui.ephemeral_query` session events while it runs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIEphemeralQueryResult
 {
     /// <summary>Answer returned by the model.</summary>
@@ -17634,7 +17856,7 @@ public sealed class UIEphemeralQueryResult
 }
 
 /// <summary>Transient question to answer without adding it to conversation history.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UIEphemeralQueryRequest
 {
     /// <summary>Question to answer from the current conversation context.</summary>
@@ -17652,7 +17874,7 @@ public sealed class UIElicitationResponseMeta
 }
 
 /// <summary>The elicitation response (accept with form values, decline, or cancel).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIElicitationResponse
 {
     /// <summary>MCP response metadata.</summary>
@@ -17674,7 +17896,7 @@ public sealed class UIElicitationRequestMeta
 }
 
 /// <summary>JSON Schema describing the form fields to present to the user.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIElicitationSchema
 {
     /// <summary>Form field definitions, keyed by field name.</summary>
@@ -17691,7 +17913,7 @@ public sealed class UIElicitationSchema
 }
 
 /// <summary>Metadata controlling an MCP task's lifetime.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpTaskMetadata
 {
     /// <summary>Task time-to-live.</summary>
@@ -17700,7 +17922,7 @@ public sealed class McpTaskMetadata
 }
 
 /// <summary>Prompt message and JSON schema describing the form fields to elicit from the user.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UIElicitationRequest
 {
     /// <summary>MCP request metadata.</summary>
@@ -17729,7 +17951,7 @@ internal sealed class UIElicitationRequest
 }
 
 /// <summary>Indicates whether the elicitation response was accepted; false if it was already resolved by another client.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIElicitationResult
 {
     /// <summary>Whether the response was accepted. False if the request was already resolved by another client.</summary>
@@ -17738,7 +17960,7 @@ public sealed class UIElicitationResult
 }
 
 /// <summary>Pending elicitation request ID and the user's response (accept/decline/cancel + form values).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UIHandlePendingElicitationRequest
 {
     /// <summary>The unique request ID from the elicitation.requested event.</summary>
@@ -17755,7 +17977,7 @@ internal sealed class UIHandlePendingElicitationRequest
 }
 
 /// <summary>Indicates whether the pending UI request was resolved by this call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIHandlePendingResult
 {
     /// <summary>True if the request was still pending and was resolved by this call. False if the request ID was unknown, already resolved by another client (e.g. GitHub), expired, or otherwise no longer pending.</summary>
@@ -17764,7 +17986,7 @@ public sealed class UIHandlePendingResult
 }
 
 /// <summary>User response for a pending user-input request, with answer text and whether it was typed freeform.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIUserInputResponse
 {
     /// <summary>The user's answer text.</summary>
@@ -17777,7 +17999,7 @@ public sealed class UIUserInputResponse
 }
 
 /// <summary>Request ID of a pending `user_input.requested` event and the user's response.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UIHandlePendingUserInputRequest
 {
     /// <summary>The unique request ID from the user_input.requested event.</summary>
@@ -17794,13 +18016,13 @@ internal sealed class UIHandlePendingUserInputRequest
 }
 
 /// <summary>Optional sampling result payload. Omit to reject/cancel the sampling request without providing a result.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIHandlePendingSamplingResponse
 {
 }
 
 /// <summary>Request ID of a pending `sampling.requested` event and an optional sampling result payload (omit to reject).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UIHandlePendingSamplingRequest
 {
     /// <summary>The unique request ID from the sampling.requested event.</summary>
@@ -17817,7 +18039,7 @@ internal sealed class UIHandlePendingSamplingRequest
 }
 
 /// <summary>Request ID of a pending `auto_mode_switch.requested` event and the user's response.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UIHandlePendingAutoModeSwitchRequest
 {
     /// <summary>The unique request ID from the auto_mode_switch.requested event.</summary>
@@ -17834,7 +18056,7 @@ internal sealed class UIHandlePendingAutoModeSwitchRequest
 }
 
 /// <summary>The user's selected action for an exhausted session limit.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UISessionLimitsExhaustedResponse
 {
     /// <summary>Action selected by the user.</summary>
@@ -17851,7 +18073,7 @@ public sealed class UISessionLimitsExhaustedResponse
 }
 
 /// <summary>Request ID of a pending `session_limits_exhausted.requested` event and the user's selected limit action.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UIHandlePendingSessionLimitsExhaustedRequest
 {
     /// <summary>The unique request ID from the session_limits_exhausted.requested event.</summary>
@@ -17868,7 +18090,7 @@ internal sealed class UIHandlePendingSessionLimitsExhaustedRequest
 }
 
 /// <summary>User response for a pending exit-plan-mode request, with approval state, selected action, auto-approve flag, and feedback.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIExitPlanModeResponse
 {
     /// <summary>Whether the plan was approved.</summary>
@@ -17893,7 +18115,7 @@ public sealed class UIExitPlanModeResponse
 }
 
 /// <summary>Request ID of a pending `exit_plan_mode.requested` event and the user's response.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UIHandlePendingExitPlanModeRequest
 {
     /// <summary>The unique request ID from the exit_plan_mode.requested event.</summary>
@@ -17910,7 +18132,7 @@ internal sealed class UIHandlePendingExitPlanModeRequest
 }
 
 /// <summary>Register an in-process handler for `auto_mode_switch.requested` events. The caller still attaches the actual listener via the standard event-subscription mechanism; this registration solely tells the server bridge to skip its own dispatch (so a remote client doesn't race the in-process handler for the same requestId).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIRegisterDirectAutoModeSwitchHandlerResult
 {
     /// <summary>Opaque handle representing the registration. Pass this same handle to `unregisterDirectAutoModeSwitchHandler` when the in-process handler is no longer active. Multiple registrations are reference-counted; the server bridge will only dispatch auto-mode-switch requests when no handles are active.</summary>
@@ -17919,7 +18141,7 @@ public sealed class UIRegisterDirectAutoModeSwitchHandlerResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionUiRegisterDirectAutoModeSwitchHandlerRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -17928,7 +18150,7 @@ internal sealed class SessionUiRegisterDirectAutoModeSwitchHandlerRequest
 }
 
 /// <summary>Indicates whether the handle was active and the registration count was decremented.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UIUnregisterDirectAutoModeSwitchHandlerResult
 {
     /// <summary>True if the handle was active and decremented the counter; false if the handle was unknown.</summary>
@@ -17937,7 +18159,7 @@ public sealed class UIUnregisterDirectAutoModeSwitchHandlerResult
 }
 
 /// <summary>Opaque handle previously returned by `registerDirectAutoModeSwitchHandler` to release.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class UIUnregisterDirectAutoModeSwitchHandlerRequest
 {
     /// <summary>Handle previously returned by `registerDirectAutoModeSwitchHandler`.</summary>
@@ -17950,7 +18172,7 @@ internal sealed class UIUnregisterDirectAutoModeSwitchHandlerRequest
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsConfigureResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -17959,7 +18181,7 @@ public sealed class PermissionsConfigureResult
 }
 
 /// <summary>Source descriptor for a `session.permissions.configure` content-exclusion rule, with source name and type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsConfigureAdditionalContentExclusionPolicyRuleSource
 {
     /// <summary>Name of the policy source.</summary>
@@ -17972,7 +18194,7 @@ public sealed class PermissionsConfigureAdditionalContentExclusionPolicyRuleSour
 }
 
 /// <summary>Single content-exclusion rule supplied to `session.permissions.configure`, with paths, match conditions, and source.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsConfigureAdditionalContentExclusionPolicyRule
 {
     /// <summary>Conditions of which at least one must match.</summary>
@@ -17993,7 +18215,7 @@ public sealed class PermissionsConfigureAdditionalContentExclusionPolicyRule
 }
 
 /// <summary>Content-exclusion policy supplied to `session.permissions.configure`, with rules, last-updated data, and scope.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsConfigureAdditionalContentExclusionPolicy
 {
     /// <summary>Opaque policy update timestamp supplied by the host.</summary>
@@ -18010,7 +18232,7 @@ public sealed class PermissionsConfigureAdditionalContentExclusionPolicy
 }
 
 /// <summary>If specified, replaces the session's path-permission policy. The runtime constructs the appropriate PathManager based on these inputs (rooted at the session's working directory). Omit to leave the current path policy unchanged.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionPathsConfig
 {
     /// <summary>Additional directories to allow tool access to (in addition to the session's working directory). Conventional `.github/skills/` and `.github/agents/` definitions under them also join the session catalogs when their subsystem gates are enabled, so supplying a directory is a trust decision for configuration stored there. When `unrestricted` is true, these are still pre-populated on the UnrestrictedPathManager so they remain visible via getDirectories() (e.g. for @-mention completion).</summary>
@@ -18031,7 +18253,7 @@ public sealed class PermissionPathsConfig
 }
 
 /// <summary>If specified, replaces the session's approved/denied permission rules. Omit to leave the current rules unchanged.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionRulesSet
 {
     /// <summary>Rules that auto-approve matching requests.</summary>
@@ -18044,7 +18266,7 @@ public sealed class PermissionRulesSet
 }
 
 /// <summary>If specified, replaces the session's URL-permission policy. The runtime constructs a fresh DefaultUrlManager based on these inputs. Omit to leave the current URL policy unchanged.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionUrlsConfig
 {
     /// <summary>Initial list of allowed URL/domain patterns. Patterns may include path components. Ignored when `unrestricted` is true.</summary>
@@ -18057,7 +18279,7 @@ public sealed class PermissionUrlsConfig
 }
 
 /// <summary>Patch of permission policy fields to apply (omit a field to leave it unchanged).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionsConfigureParams
 {
     /// <summary>If specified, replaces the host-supplied GitHub Content Exclusion policies on the session (combined with natively-discovered policies when evaluating tool/file access). Omit to leave the current policies unchanged.</summary>
@@ -18090,7 +18312,7 @@ internal sealed class PermissionsConfigureParams
 }
 
 /// <summary>Indicates whether the permission decision was applied; false when the request was already resolved.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionRequestResult
 {
     /// <summary>Whether the permission request was handled successfully.</summary>
@@ -18100,7 +18322,7 @@ public sealed class PermissionRequestResult
 
 /// <summary>The client's response to the pending permission prompt.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -18129,7 +18351,7 @@ public partial class PermissionDecision
 
 /// <summary>Permission-decision request variant to approve only the current permission request.</summary>
 /// <remarks>The <c>approve-once</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveOnce : PermissionDecision
 {
     /// <inheritdoc />
@@ -18144,7 +18366,7 @@ public partial class PermissionDecisionApproveOnce : PermissionDecision
 
 /// <summary>Session-scoped approval to remember (tool prompts only; omitted for path/url prompts).</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -18169,7 +18391,7 @@ public partial class PermissionDecisionApproveForSessionApproval
 
 /// <summary>Session-scoped approval details for specific command identifiers.</summary>
 /// <remarks>The <c>commands</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalCommands : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18183,7 +18405,7 @@ public partial class PermissionDecisionApproveForSessionApprovalCommands : Permi
 
 /// <summary>Session-scoped approval details for read-only filesystem operations.</summary>
 /// <remarks>The <c>read</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalRead : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18193,7 +18415,7 @@ public partial class PermissionDecisionApproveForSessionApprovalRead : Permissio
 
 /// <summary>Session-scoped approval details for filesystem write operations.</summary>
 /// <remarks>The <c>write</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalWrite : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18203,7 +18425,7 @@ public partial class PermissionDecisionApproveForSessionApprovalWrite : Permissi
 
 /// <summary>Session-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.</summary>
 /// <remarks>The <c>mcp</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalMcp : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18221,7 +18443,7 @@ public partial class PermissionDecisionApproveForSessionApprovalMcp : Permission
 
 /// <summary>Session-scoped approval details for MCP sampling requests from a server.</summary>
 /// <remarks>The <c>mcp-sampling</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalMcpSampling : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18235,7 +18457,7 @@ public partial class PermissionDecisionApproveForSessionApprovalMcpSampling : Pe
 
 /// <summary>Session-scoped approval details for writes to long-term memory.</summary>
 /// <remarks>The <c>memory</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalMemory : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18245,7 +18467,7 @@ public partial class PermissionDecisionApproveForSessionApprovalMemory : Permiss
 
 /// <summary>Session-scoped approval details for a custom tool, keyed by tool name.</summary>
 /// <remarks>The <c>custom-tool</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalCustomTool : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18259,7 +18481,7 @@ public partial class PermissionDecisionApproveForSessionApprovalCustomTool : Per
 
 /// <summary>Session-scoped approval details for extension-management operations, optionally narrowed by operation.</summary>
 /// <remarks>The <c>extension-management</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalExtensionManagement : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18274,7 +18496,7 @@ public partial class PermissionDecisionApproveForSessionApprovalExtensionManagem
 
 /// <summary>Session-scoped factory approval, optionally narrowed by approval key.</summary>
 /// <remarks>The <c>factory</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalFactory : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18289,7 +18511,7 @@ public partial class PermissionDecisionApproveForSessionApprovalFactory : Permis
 
 /// <summary>Session-scoped approval details for an extension's permission-gated capability access, keyed by extension name.</summary>
 /// <remarks>The <c>extension-permission-access</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalExtensionPermissionAccess : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18303,7 +18525,7 @@ public partial class PermissionDecisionApproveForSessionApprovalExtensionPermiss
 
 /// <summary>Session-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.</summary>
 /// <remarks>The <c>extension-env-access</c> variant of <see cref="PermissionDecisionApproveForSessionApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSessionApprovalExtensionEnvAccess : PermissionDecisionApproveForSessionApproval
 {
     /// <inheritdoc />
@@ -18321,7 +18543,7 @@ public partial class PermissionDecisionApproveForSessionApprovalExtensionEnvAcce
 
 /// <summary>Permission-decision request variant to approve for the rest of the session, with optional tool approval or URL domain.</summary>
 /// <remarks>The <c>approve-for-session</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForSession : PermissionDecision
 {
     /// <inheritdoc />
@@ -18341,7 +18563,7 @@ public partial class PermissionDecisionApproveForSession : PermissionDecision
 
 /// <summary>Approval to persist for this location.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -18366,7 +18588,7 @@ public partial class PermissionDecisionApproveForLocationApproval
 
 /// <summary>Location-scoped approval details for specific command identifiers.</summary>
 /// <remarks>The <c>commands</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalCommands : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18380,7 +18602,7 @@ public partial class PermissionDecisionApproveForLocationApprovalCommands : Perm
 
 /// <summary>Location-scoped approval details for read-only filesystem operations.</summary>
 /// <remarks>The <c>read</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalRead : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18390,7 +18612,7 @@ public partial class PermissionDecisionApproveForLocationApprovalRead : Permissi
 
 /// <summary>Location-scoped approval details for filesystem write operations.</summary>
 /// <remarks>The <c>write</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalWrite : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18400,7 +18622,7 @@ public partial class PermissionDecisionApproveForLocationApprovalWrite : Permiss
 
 /// <summary>Location-scoped approval details for an MCP server tool, or all tools on the server when `toolName` is null.</summary>
 /// <remarks>The <c>mcp</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalMcp : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18418,7 +18640,7 @@ public partial class PermissionDecisionApproveForLocationApprovalMcp : Permissio
 
 /// <summary>Location-scoped approval details for MCP sampling requests from a server.</summary>
 /// <remarks>The <c>mcp-sampling</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalMcpSampling : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18432,7 +18654,7 @@ public partial class PermissionDecisionApproveForLocationApprovalMcpSampling : P
 
 /// <summary>Location-scoped approval details for writes to long-term memory.</summary>
 /// <remarks>The <c>memory</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalMemory : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18442,7 +18664,7 @@ public partial class PermissionDecisionApproveForLocationApprovalMemory : Permis
 
 /// <summary>Location-scoped approval details for a custom tool, keyed by tool name.</summary>
 /// <remarks>The <c>custom-tool</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalCustomTool : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18456,7 +18678,7 @@ public partial class PermissionDecisionApproveForLocationApprovalCustomTool : Pe
 
 /// <summary>Location-scoped approval details for extension-management operations, optionally narrowed by operation.</summary>
 /// <remarks>The <c>extension-management</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalExtensionManagement : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18471,7 +18693,7 @@ public partial class PermissionDecisionApproveForLocationApprovalExtensionManage
 
 /// <summary>Location-scoped factory approval, optionally narrowed by approval key.</summary>
 /// <remarks>The <c>factory</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalFactory : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18486,7 +18708,7 @@ public partial class PermissionDecisionApproveForLocationApprovalFactory : Permi
 
 /// <summary>Location-scoped approval details for an extension's permission-gated capability access, keyed by extension name.</summary>
 /// <remarks>The <c>extension-permission-access</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalExtensionPermissionAccess : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18500,7 +18722,7 @@ public partial class PermissionDecisionApproveForLocationApprovalExtensionPermis
 
 /// <summary>Location-scoped approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.</summary>
 /// <remarks>The <c>extension-env-access</c> variant of <see cref="PermissionDecisionApproveForLocationApproval"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocationApprovalExtensionEnvAccess : PermissionDecisionApproveForLocationApproval
 {
     /// <inheritdoc />
@@ -18518,7 +18740,7 @@ public partial class PermissionDecisionApproveForLocationApprovalExtensionEnvAcc
 
 /// <summary>Permission-decision request variant to approve and persist a permission for a project location, with approval details and location key.</summary>
 /// <remarks>The <c>approve-for-location</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproveForLocation : PermissionDecision
 {
     /// <inheritdoc />
@@ -18536,7 +18758,7 @@ public partial class PermissionDecisionApproveForLocation : PermissionDecision
 
 /// <summary>Permission-decision request variant to permanently approve a URL domain across sessions.</summary>
 /// <remarks>The <c>approve-permanently</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApprovePermanently : PermissionDecision
 {
     /// <inheritdoc />
@@ -18550,7 +18772,7 @@ public partial class PermissionDecisionApprovePermanently : PermissionDecision
 
 /// <summary>Permission-decision request variant to reject a pending permission request, with optional feedback.</summary>
 /// <remarks>The <c>reject</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionReject : PermissionDecision
 {
     /// <inheritdoc />
@@ -18565,7 +18787,7 @@ public partial class PermissionDecisionReject : PermissionDecision
 
 /// <summary>Permission-decision variant indicating no user was available to confirm the request.</summary>
 /// <remarks>The <c>user-not-available</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionUserNotAvailable : PermissionDecision
 {
     /// <inheritdoc />
@@ -18575,7 +18797,7 @@ public partial class PermissionDecisionUserNotAvailable : PermissionDecision
 
 /// <summary>Permission-decision variant indicating the request was approved.</summary>
 /// <remarks>The <c>approved</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApproved : PermissionDecision
 {
     /// <inheritdoc />
@@ -18585,7 +18807,7 @@ public partial class PermissionDecisionApproved : PermissionDecision
 
 /// <summary>Permission-decision variant indicating approval was remembered for the session, with approval details.</summary>
 /// <remarks>The <c>approved-for-session</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApprovedForSession : PermissionDecision
 {
     /// <inheritdoc />
@@ -18599,7 +18821,7 @@ public partial class PermissionDecisionApprovedForSession : PermissionDecision
 
 /// <summary>Permission-decision variant indicating approval was persisted for a project location, with approval details and location key.</summary>
 /// <remarks>The <c>approved-for-location</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionApprovedForLocation : PermissionDecision
 {
     /// <inheritdoc />
@@ -18617,7 +18839,7 @@ public partial class PermissionDecisionApprovedForLocation : PermissionDecision
 
 /// <summary>Permission-decision variant indicating the request was cancelled before use, with an optional reason.</summary>
 /// <remarks>The <c>cancelled</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionCancelled : PermissionDecision
 {
     /// <inheritdoc />
@@ -18632,7 +18854,7 @@ public partial class PermissionDecisionCancelled : PermissionDecision
 
 /// <summary>Permission-decision variant indicating explicit denial by permission rules, with the matching rules.</summary>
 /// <remarks>The <c>denied-by-rules</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionDeniedByRules : PermissionDecision
 {
     /// <inheritdoc />
@@ -18646,7 +18868,7 @@ public partial class PermissionDecisionDeniedByRules : PermissionDecision
 
 /// <summary>Permission-decision variant indicating no approval rule matched and user confirmation was unavailable.</summary>
 /// <remarks>The <c>denied-no-approval-rule-and-could-not-request-from-user</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFromUser : PermissionDecision
 {
     /// <inheritdoc />
@@ -18656,7 +18878,7 @@ public partial class PermissionDecisionDeniedNoApprovalRuleAndCouldNotRequestFro
 
 /// <summary>Permission-decision variant indicating the user denied an interactive prompt, with optional feedback and force-reject flag.</summary>
 /// <remarks>The <c>denied-interactively-by-user</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionDeniedInteractivelyByUser : PermissionDecision
 {
     /// <inheritdoc />
@@ -18676,7 +18898,7 @@ public partial class PermissionDecisionDeniedInteractivelyByUser : PermissionDec
 
 /// <summary>Permission-decision variant indicating denial by content-exclusion policy, with path and message.</summary>
 /// <remarks>The <c>denied-by-content-exclusion-policy</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionDeniedByContentExclusionPolicy : PermissionDecision
 {
     /// <inheritdoc />
@@ -18694,7 +18916,7 @@ public partial class PermissionDecisionDeniedByContentExclusionPolicy : Permissi
 
 /// <summary>Permission-decision variant indicating denial by a permission request hook, with optional message and interrupt flag.</summary>
 /// <remarks>The <c>denied-by-permission-request-hook</c> variant of <see cref="PermissionDecision"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionDecisionDeniedByPermissionRequestHook : PermissionDecision
 {
     /// <inheritdoc />
@@ -18713,7 +18935,7 @@ public partial class PermissionDecisionDeniedByPermissionRequestHook : Permissio
 }
 
 /// <summary>Pending permission request ID and the decision to apply (approve/reject and scope).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionDecisionRequest
 {
     /// <summary>Optional informational context describing how and where this response was made. Omit it to preserve legacy behavior without attributing an origin.</summary>
@@ -18734,7 +18956,7 @@ internal sealed class PermissionDecisionRequest
 }
 
 /// <summary>Pending permission prompt reconstructed from event history, with request ID and user-facing prompt details.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PendingPermissionRequest
 {
     /// <summary>Permission-recovery episode that authorized this request to surface for interactive attention.</summary>
@@ -18751,7 +18973,7 @@ public sealed class PendingPermissionRequest
 }
 
 /// <summary>List of pending permission requests reconstructed from event history.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PendingPermissionRequestList
 {
     /// <summary>Pending permission prompts reconstructed from the session's event history. Equivalent to the set of `permission.requested` events that have not yet been followed by a matching `permission.completed` event. Used by clients (e.g. the CLI) to hydrate UI for prompts that were emitted before the client attached to the session.</summary>
@@ -18760,7 +18982,7 @@ public sealed class PendingPermissionRequestList
 }
 
 /// <summary>No parameters; returns currently-pending permission requests for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionsPendingRequestsRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -18769,7 +18991,7 @@ internal sealed class PermissionsPendingRequestsRequest
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsSetApproveAllResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -18778,7 +19000,7 @@ public sealed class PermissionsSetApproveAllResult
 }
 
 /// <summary>Allow-all toggle for tool permission requests, with an optional telemetry source.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionsSetApproveAllRequest
 {
     /// <summary>Whether to auto-approve all tool permission requests.</summary>
@@ -18795,7 +19017,7 @@ internal sealed class PermissionsSetApproveAllRequest
 }
 
 /// <summary>Indicates whether the requested permission mode was applied and reports the authoritative post-mutation mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsSetModeResult
 {
     /// <summary>Authoritative permission mode after the mutation.</summary>
@@ -18808,7 +19030,7 @@ public sealed class PermissionsSetModeResult
 }
 
 /// <summary>Permission mode to apply for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionsSetModeRequest
 {
     /// <summary>Optional judge model id for assisted mode. When omitted, the session resolves the provider default: `gpt-5.5` for CAPI sessions and the active session model for BYOK sessions.</summary>
@@ -18829,7 +19051,7 @@ internal sealed class PermissionsSetModeRequest
 }
 
 /// <summary>Current permission mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsGetModeResult
 {
     /// <summary>Current permission mode.</summary>
@@ -18838,7 +19060,7 @@ public sealed class PermissionsGetModeResult
 }
 
 /// <summary>No parameters.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionsGetModeRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -18847,7 +19069,7 @@ internal sealed class PermissionsGetModeRequest
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsModifyRulesResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -18856,7 +19078,7 @@ public sealed class PermissionsModifyRulesResult
 }
 
 /// <summary>Scope and add/remove instructions for modifying session- or location-scoped permission rules.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionsModifyRulesParams
 {
     /// <summary>Rules to add to the scope. Applied before `remove`/`removeAll`.</summary>
@@ -18881,7 +19103,7 @@ internal sealed class PermissionsModifyRulesParams
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsSetRequiredResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -18890,7 +19112,7 @@ public sealed class PermissionsSetRequiredResult
 }
 
 /// <summary>Toggles whether permission prompts should be bridged into session events for this client.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionsSetRequiredRequest
 {
     /// <summary>Whether the client wants `permission.requested` events bridged from the session-owned permission service. CLI clients that render prompt UI set this to `true` for as long as their listener is mounted; headless callers leave it unset (the default is `false`).</summary>
@@ -18903,7 +19125,7 @@ internal sealed class PermissionsSetRequiredRequest
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsResetSessionApprovalsResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -18912,7 +19134,7 @@ public sealed class PermissionsResetSessionApprovalsResult
 }
 
 /// <summary>Clears session-scoped tool approvals and optionally clears location-scoped approvals and exact session-approved paths.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionsResetSessionApprovalsRequest
 {
     /// <summary>Whether location-scoped approvals and exact session-approved paths are cleared too. Defaults to `true`.</summary>
@@ -18925,7 +19147,7 @@ internal sealed class PermissionsResetSessionApprovalsRequest
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsNotifyPromptShownResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -18934,7 +19156,7 @@ public sealed class PermissionsNotifyPromptShownResult
 }
 
 /// <summary>Notification payload describing the permission prompt that the client just rendered.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionPromptShownNotification
 {
     /// <summary>Human-readable description of the prompt the user is being asked to approve. Used by the runtime to fire the registered `permission_prompt` notification hook (e.g. terminal bell, desktop notification).</summary>
@@ -18947,7 +19169,7 @@ internal sealed class PermissionPromptShownNotification
 }
 
 /// <summary>Snapshot of the session's recursive directory grants, exact session-approved paths, and primary working directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionPathsList
 {
     /// <summary>All directories currently allowed for tool access on this session.</summary>
@@ -18964,7 +19186,7 @@ public sealed class PermissionPathsList
 }
 
 /// <summary>No parameters; returns the session's recursive directory grants and exact session-approved paths.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionsPathsListRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -18973,7 +19195,7 @@ internal sealed class PermissionsPathsListRequest
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsPathsAddResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -18982,7 +19204,7 @@ public sealed class PermissionsPathsAddResult
 }
 
 /// <summary>Directory path to add to the session's allowed directories.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionPathsAddParams
 {
     /// <summary>Directory to add to the allow-list. The runtime resolves and validates the path before adding, then loads conventional `.github/skills/` and `.github/agents/` definitions under it when their subsystem gates are enabled. Adding the directory is therefore also a trust decision for configuration stored there.</summary>
@@ -18995,7 +19217,7 @@ internal sealed class PermissionPathsAddParams
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsPathsUpdatePrimaryResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -19004,7 +19226,7 @@ public sealed class PermissionsPathsUpdatePrimaryResult
 }
 
 /// <summary>Directory path to set as the session's new primary working directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionPathsUpdatePrimaryParams
 {
     /// <summary>Directory to set as the new primary working directory for the session's permission policy.</summary>
@@ -19017,7 +19239,7 @@ internal sealed class PermissionPathsUpdatePrimaryParams
 }
 
 /// <summary>Indicates whether the supplied path is within the session's allowed directories.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionPathsAllowedCheckResult
 {
     /// <summary>Whether the path is within the session's allowed directories.</summary>
@@ -19026,7 +19248,7 @@ public sealed class PermissionPathsAllowedCheckResult
 }
 
 /// <summary>Path to evaluate against the session's allowed directories.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionPathsAllowedCheckParams
 {
     /// <summary>Path to check against the session's allowed directories.</summary>
@@ -19039,7 +19261,7 @@ internal sealed class PermissionPathsAllowedCheckParams
 }
 
 /// <summary>Indicates whether the supplied path is within the session's workspace directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionPathsWorkspaceCheckResult
 {
     /// <summary>Whether the path is within the session workspace directory.</summary>
@@ -19048,7 +19270,7 @@ public sealed class PermissionPathsWorkspaceCheckResult
 }
 
 /// <summary>Path to evaluate against the session's workspace (primary) directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionPathsWorkspaceCheckParams
 {
     /// <summary>Path to check against the session workspace directory.</summary>
@@ -19061,7 +19283,7 @@ internal sealed class PermissionPathsWorkspaceCheckParams
 }
 
 /// <summary>Resolved location-permissions key and type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionLocationResolveResult
 {
     /// <summary>Location key used in the location-permissions store.</summary>
@@ -19074,7 +19296,7 @@ public sealed class PermissionLocationResolveResult
 }
 
 /// <summary>Working directory to resolve into a location-permissions key.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionLocationResolveParams
 {
     /// <summary>Target session identifier.</summary>
@@ -19087,7 +19309,7 @@ internal sealed class PermissionLocationResolveParams
 }
 
 /// <summary>Summary of persisted location permissions applied to the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionLocationApplyResult
 {
     /// <summary>Number of persisted allowed directories added to the live path manager.</summary>
@@ -19116,7 +19338,7 @@ public sealed class PermissionLocationApplyResult
 }
 
 /// <summary>Working directory to load persisted location permissions for.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionLocationApplyParams
 {
     /// <summary>Target session identifier.</summary>
@@ -19129,7 +19351,7 @@ internal sealed class PermissionLocationApplyParams
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsLocationsAddToolApprovalResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -19139,7 +19361,7 @@ public sealed class PermissionsLocationsAddToolApprovalResult
 
 /// <summary>Tool approval to persist and apply.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -19164,7 +19386,7 @@ public partial class PermissionsLocationsAddToolApprovalDetails
 
 /// <summary>Location-persisted tool approval details for specific command identifiers.</summary>
 /// <remarks>The <c>commands</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsCommands : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19178,7 +19400,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsCommands : Permis
 
 /// <summary>Location-persisted tool approval details for read-only filesystem operations.</summary>
 /// <remarks>The <c>read</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsRead : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19188,7 +19410,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsRead : Permission
 
 /// <summary>Location-persisted tool approval details for filesystem write operations.</summary>
 /// <remarks>The <c>write</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsWrite : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19198,7 +19420,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsWrite : Permissio
 
 /// <summary>Location-persisted tool approval details for an MCP server tool, or all tools when `toolName` is null.</summary>
 /// <remarks>The <c>mcp</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsMcp : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19216,7 +19438,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsMcp : Permissions
 
 /// <summary>Location-persisted tool approval details for MCP sampling requests from a server.</summary>
 /// <remarks>The <c>mcp-sampling</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsMcpSampling : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19230,7 +19452,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsMcpSampling : Per
 
 /// <summary>Location-persisted tool approval details for writes to long-term memory.</summary>
 /// <remarks>The <c>memory</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsMemory : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19240,7 +19462,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsMemory : Permissi
 
 /// <summary>Location-persisted tool approval details for a custom tool, keyed by tool name.</summary>
 /// <remarks>The <c>custom-tool</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsCustomTool : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19254,7 +19476,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsCustomTool : Perm
 
 /// <summary>Location-persisted tool approval details for extension-management operations, optionally narrowed by operation.</summary>
 /// <remarks>The <c>extension-management</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsExtensionManagement : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19269,7 +19491,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsExtensionManageme
 
 /// <summary>Location-persisted factory approval, optionally narrowed by approval key.</summary>
 /// <remarks>The <c>factory</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsFactory : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19284,7 +19506,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsFactory : Permiss
 
 /// <summary>Location-persisted tool approval details for an extension's permission-gated capability access, keyed by extension name.</summary>
 /// <remarks>The <c>extension-permission-access</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsExtensionPermissionAccess : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19298,7 +19520,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsExtensionPermissi
 
 /// <summary>Location-persisted tool approval details for an extension's access to sensitive environment variables, keyed by extension name and the exact set of variable names.</summary>
 /// <remarks>The <c>extension-env-access</c> variant of <see cref="PermissionsLocationsAddToolApprovalDetails"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class PermissionsLocationsAddToolApprovalDetailsExtensionEnvAccess : PermissionsLocationsAddToolApprovalDetails
 {
     /// <inheritdoc />
@@ -19315,7 +19537,7 @@ public partial class PermissionsLocationsAddToolApprovalDetailsExtensionEnvAcces
 }
 
 /// <summary>Location-scoped tool approval to persist.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionLocationAddToolApprovalParams
 {
     /// <summary>Tool approval to persist and apply.</summary>
@@ -19332,7 +19554,7 @@ internal sealed class PermissionLocationAddToolApprovalParams
 }
 
 /// <summary>Folder trust check result.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FolderTrustCheckResult
 {
     /// <summary>Whether the folder is trusted.</summary>
@@ -19341,7 +19563,7 @@ public sealed class FolderTrustCheckResult
 }
 
 /// <summary>Folder path to check for trust.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FolderTrustCheckParams
 {
     /// <summary>Folder path to check.</summary>
@@ -19354,7 +19576,7 @@ internal sealed class FolderTrustCheckParams
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsFolderTrustAddTrustedResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -19363,7 +19585,7 @@ public sealed class PermissionsFolderTrustAddTrustedResult
 }
 
 /// <summary>Folder path to add to trusted folders.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class FolderTrustAddParams
 {
     /// <summary>Folder path to mark as trusted.</summary>
@@ -19376,7 +19598,7 @@ internal sealed class FolderTrustAddParams
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsUrlsSetUnrestrictedModeResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -19385,7 +19607,7 @@ public sealed class PermissionsUrlsSetUnrestrictedModeResult
 }
 
 /// <summary>Whether the URL-permission policy should run in unrestricted mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class PermissionUrlsSetUnrestrictedModeParams
 {
     /// <summary>Whether to allow access to all URLs without prompting. Toggles the runtime's URL-permission policy in place.</summary>
@@ -19398,7 +19620,7 @@ internal sealed class PermissionUrlsSetUnrestrictedModeParams
 }
 
 /// <summary>The repository the remote session targets.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataSnapshotRemoteMetadataRepository
 {
     /// <summary>The branch the remote session is operating on.</summary>
@@ -19415,7 +19637,7 @@ public sealed class MetadataSnapshotRemoteMetadataRepository
 }
 
 /// <summary>Remote-session-specific metadata. Populated only when `isRemote` is true. Fields are immutable for the lifetime of the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataSnapshotRemoteMetadata
 {
     /// <summary>The pull request number the remote session is associated with, if any.</summary>
@@ -19482,7 +19704,7 @@ public sealed class SessionMetadataSnapshotWorkspace
 }
 
 /// <summary>Point-in-time snapshot of slow-changing session identifier and state fields.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionMetadataSnapshot
 {
     /// <summary>True when the session was detected to be in use by another process at construction time. Local consumers may surface a confirmation prompt before fully attaching. Always false for new sessions.</summary>
@@ -19551,7 +19773,7 @@ public sealed class SessionMetadataSnapshot
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMetadataSnapshotRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -19560,7 +19782,7 @@ internal sealed class SessionMetadataSnapshotRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMetadataGetClientMetadataRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -19569,7 +19791,7 @@ internal sealed class SessionMetadataGetClientMetadataRequest
 }
 
 /// <summary>Atomic patch for client-owned session metadata. Operations apply in clear, remove, then set order. The resulting bag must satisfy the ClientMetadata entry and serialized-size limits. Local storage coordinates concurrent runtime processes; custom SessionFs providers must serialize writers that access the same session from multiple processes.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class MetadataUpdateClientMetadataRequest
 {
     /// <summary>Remove every existing client metadata entry before applying remove and set. Defaults to false.</summary>
@@ -19590,7 +19812,7 @@ internal sealed class MetadataUpdateClientMetadataRequest
 }
 
 /// <summary>Indicates whether the local session is currently processing a turn or background continuation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataIsProcessingResult
 {
     /// <summary>Whether the session is currently processing user/agent messages. False for non-local sessions (which don't run a local agentic loop). Reflects an in-flight turn or background continuation.</summary>
@@ -19599,7 +19821,7 @@ public sealed class MetadataIsProcessingResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMetadataIsProcessingRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -19608,7 +19830,7 @@ internal sealed class SessionMetadataIsProcessingRequest
 }
 
 /// <summary>Current activity flags for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionActivity
 {
     /// <summary>Whether an in-flight operation can currently be aborted.</summary>
@@ -19621,7 +19843,7 @@ public sealed class SessionActivity
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMetadataActivityRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -19674,7 +19896,7 @@ public sealed class MetadataContextInfoResultContextInfo
 }
 
 /// <summary>Token breakdown for the session's current context window, or null if uninitialized.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataContextInfoResult
 {
     /// <summary>Token breakdown for the current context window, or null if the session has not yet been initialized (no system prompt or tool metadata cached).</summary>
@@ -19683,7 +19905,7 @@ public sealed class MetadataContextInfoResult
 }
 
 /// <summary>Model identifier and token limits used to compute the context-info breakdown.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class MetadataContextInfoRequest
 {
     /// <summary>Maximum output tokens allowed by the target model. Pass 0 if unknown.</summary>
@@ -19816,7 +20038,7 @@ public sealed class MetadataContextAttributionResultContextAttribution
 }
 
 /// <summary>Per-source attribution breakdown for the session's current context window, or null if uninitialized.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataContextAttributionResult
 {
     /// <summary>Per-source context-window attribution, or null if the session has not yet been initialized (no system prompt or tool metadata cached).</summary>
@@ -19825,7 +20047,7 @@ public sealed class MetadataContextAttributionResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionMetadataGetContextAttributionRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -19834,7 +20056,7 @@ internal sealed class SessionMetadataGetContextAttributionRequest
 }
 
 /// <summary>A single large message currently in context.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ContextHeaviestMessage
 {
     /// <summary>Stable identifier for this message within the snapshot.</summary>
@@ -19855,7 +20077,7 @@ public sealed class ContextHeaviestMessage
 }
 
 /// <summary>The heaviest individual messages in the session's context window, most-expensive first.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataContextHeaviestMessagesResult
 {
     /// <summary>Heaviest messages, most-expensive first.</summary>
@@ -19868,7 +20090,7 @@ public sealed class MetadataContextHeaviestMessagesResult
 }
 
 /// <summary>Parameters for the heaviest-messages query.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class MetadataContextHeaviestMessagesRequest
 {
     /// <summary>Maximum number of messages to return, most-expensive first. Omit for the server default.</summary>
@@ -19881,13 +20103,13 @@ internal sealed class MetadataContextHeaviestMessagesRequest
 }
 
 /// <summary>Notify the session that its working directory context has changed. Emits a `session.context_changed` event so consumers (telemetry, OTel tracker, ACP, the timeline UI) can react. Use this when the host has detected a cwd/branch/repo change outside the session's normal lifecycle (e.g., after a shell command in interactive mode). For a local session, a report whose `cwd` diverges from the session's current working directory is ignored (the call still succeeds but records nothing and emits no event); move a local session's working directory via `metadata.setWorkingDirectory` instead.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataRecordContextChangeResult
 {
 }
 
 /// <summary>Updated working directory and git context. Emitted as the new payload of `session.context_changed`.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionWorkingDirectoryContext
 {
     /// <summary>Merge-base commit SHA (fork point from the remote default branch).</summary>
@@ -19924,7 +20146,7 @@ public sealed class SessionWorkingDirectoryContext
 }
 
 /// <summary>Updated working-directory/git context to record on the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class MetadataRecordContextChangeRequest
 {
     /// <summary>Updated working directory and git context. Emitted as the new payload of `session.context_changed`.</summary>
@@ -19937,7 +20159,7 @@ internal sealed class MetadataRecordContextChangeRequest
 }
 
 /// <summary>Update the session's working directory. Used by the host when the user explicitly changes cwd (e.g., the `/cd` slash command). The host is responsible for any related side-effects (file index, etc.); it does NOT change the process working directory (a session's cwd is per-session, not process-global). For local sessions the runtime validates the target first (an absolute path that exists on disk) and re-bases the permission primary directory; a rejected validation fails the call before anything is mutated, persisted, or emitted. Location-scoped permission rules are then re-keyed to the new directory (best-effort). Remote sessions only record the path.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataSetWorkingDirectoryResult
 {
     /// <summary>Working directory after the update.</summary>
@@ -19946,7 +20168,7 @@ public sealed class MetadataSetWorkingDirectoryResult
 }
 
 /// <summary>Absolute path to set as the session's new working directory. For local sessions the path must be absolute and exist on disk: it is validated before any session state changes, and a failing validation rejects the call with nothing mutated, persisted, or emitted. Remote sessions record the path as-is.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class MetadataSetWorkingDirectoryRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -19959,7 +20181,7 @@ internal sealed class MetadataSetWorkingDirectoryRequest
 }
 
 /// <summary>Re-tokenize the session's existing messages against `modelId` and return the token totals. Useful for hosts that want an initial estimate of context usage on session resume, before the next agent turn fires `session.context_info_changed` events. Returns zeros for an empty session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataRecomputeContextTokensResult
 {
     /// <summary>Tokens contributed by user/assistant/tool messages (excludes system/developer prompts).</summary>
@@ -19976,7 +20198,7 @@ public sealed class MetadataRecomputeContextTokensResult
 }
 
 /// <summary>Model identifier to use when re-tokenizing the session's existing messages.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class MetadataRecomputeContextTokensRequest
 {
     /// <summary>Model identifier used for tokenization. The runtime token-counts both chat-context and system-context messages against this model.</summary>
@@ -19989,7 +20211,7 @@ internal sealed class MetadataRecomputeContextTokensRequest
 }
 
 /// <summary>Availability of built-in job tools surfaced to boundary consumers.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionSettingsBuiltInToolAvailabilitySnapshot
 {
     /// <summary>Whether the create-pull-request tool is available.</summary>
@@ -20002,7 +20224,7 @@ public sealed class SessionSettingsBuiltInToolAvailabilitySnapshot
 }
 
 /// <summary>Redacted job settings for a session. The job nonce is excluded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionSettingsJobSnapshot
 {
     /// <summary>Availability of job-specific built-in tools.</summary>
@@ -20019,7 +20241,7 @@ public sealed class SessionSettingsJobSnapshot
 }
 
 /// <summary>Redacted model routing settings for a session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionSettingsModelSnapshot
 {
     /// <summary>Agent service callback URL for job and progress updates.</summary>
@@ -20040,7 +20262,7 @@ public sealed class SessionSettingsModelSnapshot
 }
 
 /// <summary>Online-evaluation settings safe to expose across the SDK boundary.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionSettingsOnlineEvaluationSnapshot
 {
     /// <summary>Whether online evaluation is disabled.</summary>
@@ -20053,7 +20275,7 @@ public sealed class SessionSettingsOnlineEvaluationSnapshot
 }
 
 /// <summary>Redacted repository and GitHub host settings for a session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionSettingsRepoSnapshot
 {
     /// <summary>Checked-out repository branch.</summary>
@@ -20106,7 +20328,7 @@ public sealed class SessionSettingsRepoSnapshot
 }
 
 /// <summary>Redacted validation and memory-tool settings for a session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionSettingsValidationSnapshot
 {
     /// <summary>Whether advisory validation is enabled.</summary>
@@ -20147,7 +20369,7 @@ public sealed class SessionSettingsValidationSnapshot
 }
 
 /// <summary>Redacted, serializable view of session runtime settings for SDK boundary consumers. Secrets and raw feature flags are intentionally excluded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSettingsSnapshot
 {
     /// <summary>Name of the SDK client that created the session.</summary>
@@ -20188,7 +20410,7 @@ internal sealed class SessionSettingsSnapshot
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSettingsSnapshotRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -20197,7 +20419,7 @@ internal sealed class SessionSettingsSnapshotRequest
 }
 
 /// <summary>Result of evaluating a Rust-owned settings predicate.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSettingsEvaluatePredicateResult
 {
     /// <summary>Whether the named settings predicate evaluated to enabled.</summary>
@@ -20206,7 +20428,7 @@ internal sealed class SessionSettingsEvaluatePredicateResult
 }
 
 /// <summary>Named Rust-owned settings predicate to evaluate for this session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionSettingsEvaluatePredicateRequest
 {
     /// <summary>Predicate name. The runtime owns the raw feature-flag names and composition logic.</summary>
@@ -20223,7 +20445,7 @@ internal sealed class SessionSettingsEvaluatePredicateRequest
 }
 
 /// <summary>Content-exclusion decision for one requested path.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ContentExclusionPathCheck
 {
     /// <summary>Whether the session's complete content-exclusion policy excludes the path.</summary>
@@ -20236,7 +20458,7 @@ public sealed class ContentExclusionPathCheck
 }
 
 /// <summary>Batch content-exclusion result. Callers must fail closed when policy evaluation is unavailable.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ContentExclusionCheckPathsResult
 {
     /// <summary>Whether the session's policy service was available for the complete batch. When false, checks is empty and callers must treat every requested path as excluded.</summary>
@@ -20249,7 +20471,7 @@ public sealed class ContentExclusionCheckPathsResult
 }
 
 /// <summary>Local file system absolute paths within the session working directory to check against its content-exclusion policy.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ContentExclusionCheckPathsRequest
 {
     /// <summary>Local file system absolute paths within the session working directory to check. Results are returned in the same order, including duplicates.</summary>
@@ -20262,7 +20484,7 @@ internal sealed class ContentExclusionCheckPathsRequest
 }
 
 /// <summary>Identifier of the spawned process, used to correlate streamed output and exit notifications.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ShellExecResult
 {
     /// <summary>Unique identifier for tracking streamed output.</summary>
@@ -20271,7 +20493,7 @@ public sealed class ShellExecResult
 }
 
 /// <summary>Shell command to run, with optional working directory and timeout in milliseconds.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ShellExecRequest
 {
     /// <summary>Shell command to execute.</summary>
@@ -20293,7 +20515,7 @@ internal sealed class ShellExecRequest
 }
 
 /// <summary>Indicates whether the signal was delivered; false if the process was unknown or already exited.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ShellKillResult
 {
     /// <summary>Whether the signal was sent successfully.</summary>
@@ -20302,7 +20524,7 @@ public sealed class ShellKillResult
 }
 
 /// <summary>Identifier of a process previously returned by "shell.exec" and the signal to send.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ShellKillRequest
 {
     /// <summary>Process identifier returned by shell.exec.</summary>
@@ -20319,7 +20541,7 @@ internal sealed class ShellKillRequest
 }
 
 /// <summary>Result of a user-requested shell command.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UserRequestedShellCommandResult
 {
     /// <summary>Error output when the execution failed.</summary>
@@ -20344,7 +20566,7 @@ public sealed class UserRequestedShellCommandResult
 }
 
 /// <summary>User-requested shell command and cancellation handle.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ShellExecuteUserRequestedRequest
 {
     /// <summary>Shell command to execute.</summary>
@@ -20361,7 +20583,7 @@ internal sealed class ShellExecuteUserRequestedRequest
 }
 
 /// <summary>Cancellation result for a user-requested shell command.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CancelUserRequestedShellCommandResult
 {
     /// <summary>Whether an in-flight execution was found and signalled to cancel.</summary>
@@ -20370,7 +20592,7 @@ public sealed class CancelUserRequestedShellCommandResult
 }
 
 /// <summary>User-requested shell execution cancellation handle.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ShellCancelUserRequestedRequest
 {
     /// <summary>Request ID previously passed to executeUserRequested.</summary>
@@ -20383,7 +20605,7 @@ internal sealed class ShellCancelUserRequestedRequest
 }
 
 /// <summary>Post-compaction context window usage breakdown.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryCompactContextWindow
 {
     /// <summary>Token count from non-system messages (user, assistant, tool).</summary>
@@ -20412,7 +20634,7 @@ public sealed class HistoryCompactContextWindow
 }
 
 /// <summary>Compaction outcome with the number of tokens and messages removed, summary text, and the resulting context window breakdown.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryCompactResult
 {
     /// <summary>Post-compaction context window usage breakdown.</summary>
@@ -20437,7 +20659,7 @@ public sealed class HistoryCompactResult
 }
 
 /// <summary>RPC data type for SessionHistoryCompact operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionHistoryCompactRequest
 {
     /// <summary>Optional user-provided instructions to focus the compaction summary.</summary>
@@ -20456,7 +20678,7 @@ public sealed class SessionHistoryCompactRequest
 }
 
 /// <summary>RPC data type for SessionHistoryCompactRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionHistoryCompactRequestWithSession
 {
     /// <summary>Optional user-provided instructions to focus the compaction summary.</summary>
@@ -20479,7 +20701,7 @@ internal sealed class SessionHistoryCompactRequestWithSession
 }
 
 /// <summary>Number of events that were removed by the truncation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryTruncateResult
 {
     /// <summary>Failure detail when checkpointCleanupFailed is true.</summary>
@@ -20496,7 +20718,7 @@ public sealed class HistoryTruncateResult
 }
 
 /// <summary>Identifier of the event to truncate to; this event and all later events are removed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class HistoryTruncateRequest
 {
     /// <summary>Event ID to truncate to. This event and all events after it are removed from the session.</summary>
@@ -20509,7 +20731,7 @@ internal sealed class HistoryTruncateRequest
 }
 
 /// <summary>A root user turn that the session can rewind to.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryRewindPoint
 {
     /// <summary>Whether at least one file in this turn or a later turn can be restored.</summary>
@@ -20550,7 +20772,7 @@ public sealed class HistoryRewindPoint
 }
 
 /// <summary>Rewind points and file-change-tracking availability for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryListRewindPointsResult
 {
     /// <summary>Whether this session captured file changes from its first turn.</summary>
@@ -20567,7 +20789,7 @@ public sealed class HistoryListRewindPointsResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionHistoryListRewindPointsRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -20576,7 +20798,7 @@ internal sealed class SessionHistoryListRewindPointsRequest
 }
 
 /// <summary>A file that a conversation-and-files rewind would restore.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryRewindFilePreview
 {
     /// <summary>Aggregate change made across the discarded turns.</summary>
@@ -20597,7 +20819,7 @@ public sealed class HistoryRewindFilePreview
 }
 
 /// <summary>Files and aggregate changes for a prospective rewind.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryPreviewRewindResult
 {
     /// <summary>Whether file restore is available for this session. This is authoritative: switch on it and read `reason` only when it is false.</summary>
@@ -20618,7 +20840,7 @@ public sealed class HistoryPreviewRewindResult
 }
 
 /// <summary>Event boundary to preview for conversation-and-files rewind.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class HistoryPreviewRewindRequest
 {
     /// <summary>ID of the user.message event that begins the discarded suffix.</summary>
@@ -20631,7 +20853,7 @@ internal sealed class HistoryPreviewRewindRequest
 }
 
 /// <summary>A captured file that rewind intentionally left unchanged.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistorySkippedFileRestore
 {
     /// <summary>Absolute path of the skipped file.</summary>
@@ -20644,7 +20866,7 @@ public sealed class HistorySkippedFileRestore
 }
 
 /// <summary>Structured outcome of a rewind request.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryRewindResult
 {
     /// <summary>Failure detail. Set only for the failure and partial-failure outcomes (`files-rolled-back`, `rollback-incomplete`, `truncation-failed`, `checkpoint-cleanup-failed`, `snapshot-prune-failed`); omitted for `success` and for the unavailable outcomes (`session-busy`, `file-change-tracking-disabled`, `unsupported-remote-session`).</summary>
@@ -20669,7 +20891,7 @@ public sealed class HistoryRewindResult
 }
 
 /// <summary>Boundary and mode for rewinding session history.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class HistoryRewindRequest
 {
     /// <summary>ID of the user.message event that begins the discarded suffix.</summary>
@@ -20686,7 +20908,7 @@ internal sealed class HistoryRewindRequest
 }
 
 /// <summary>Indicates whether an in-progress background compaction was cancelled.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryCancelBackgroundCompactionResult
 {
     /// <summary>Whether an in-progress background compaction was cancelled. False when no compaction was running, when the session is remote, or when the underlying processor was unavailable.</summary>
@@ -20695,7 +20917,7 @@ public sealed class HistoryCancelBackgroundCompactionResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionHistoryCancelBackgroundCompactionRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -20704,7 +20926,7 @@ internal sealed class SessionHistoryCancelBackgroundCompactionRequest
 }
 
 /// <summary>Indicates whether an in-progress manual compaction was aborted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryAbortManualCompactionResult
 {
     /// <summary>Whether an in-progress manual compaction was aborted. False when no manual compaction was running, when its abort controller was already aborted, or when the session is remote.</summary>
@@ -20713,7 +20935,7 @@ public sealed class HistoryAbortManualCompactionResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionHistoryAbortManualCompactionRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -20722,7 +20944,7 @@ internal sealed class SessionHistoryAbortManualCompactionRequest
 }
 
 /// <summary>Markdown summary of the conversation context (empty when not available).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistorySummarizeForHandoffResult
 {
     /// <summary>Markdown summary of the conversation context produced by an LLM. Empty string when there are no messages or when the session does not support local summarization.</summary>
@@ -20731,7 +20953,7 @@ public sealed class HistorySummarizeForHandoffResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionHistorySummarizeForHandoffRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -20740,7 +20962,7 @@ internal sealed class SessionHistorySummarizeForHandoffRequest
 }
 
 /// <summary>What a successful clear removed. A clear that could not be applied rejects instead of reporting a count.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryClearContextResult
 {
     /// <summary>Number of non-system, non-developer messages that were removed from the conversation. Zero only when the window already held no conversation.</summary>
@@ -20749,7 +20971,7 @@ public sealed class HistoryClearContextResult
 }
 
 /// <summary>Parameters for clearing the conversation and seeding the window that replaces it.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class HistoryClearContextRequest
 {
     /// <summary>First user message of the fresh context window. Required: a cleared window holding only system and developer messages is not a conversation a model can answer, so every clear seeds the window it creates. Delivered by the enclosing turn driver once the agentic loop exits, which is why the call must be made from inside a tool handler.</summary>
@@ -20762,7 +20984,7 @@ internal sealed class HistoryClearContextRequest
 }
 
 /// <summary>User-facing pending queue entry, with kind and display text for a queued message, slash command, or model change.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueuePendingItems
 {
     /// <summary>Agent mode stored on this queued entry, as stamped when it was enqueued. Items without an explicit mode report interactive. This is not necessarily the mode that will constrain the turn: a plan or autopilot session applies its own write gate, continuation loop and permission posture to every drained item regardless of the mode stored here.</summary>
@@ -20784,10 +21006,14 @@ public sealed class QueuePendingItems
     /// <summary>Stable identity of the queued user message. Present for message rows and absent for slash commands and model changes.</summary>
     [JsonPropertyName("messageId")]
     public string? MessageId { get; set; }
+
+    /// <summary>Optional source tag associated with this pending queue entry. This is an open string, not authenticated authorship. In particular, `user` does not prove that a person typed the message. If the source is absent or unrecognized, consumers must not infer human or agent authorship and should handle the entry neutrally. Consumers should tolerate future source values.</summary>
+    [JsonPropertyName("source")]
+    public string? Source { get; set; }
 }
 
 /// <summary>Snapshot of the session's pending queued items and immediate-steering messages.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueuePendingItemsResult
 {
     /// <summary>How many leading entries of `steeringMessages` have already been folded into the running turn (and so have an emitted `user.message`), as opposed to still waiting for one. Absent for hosts that do not distinguish the two.</summary>
@@ -20801,10 +21027,14 @@ public sealed class QueuePendingItemsResult
     /// <summary>Display text for messages currently in the immediate steering queue (interjections sent during a running turn).</summary>
     [JsonPropertyName("steeringMessages")]
     public IList<string> SteeringMessages { get => field ??= []; set; }
+
+    /// <summary>ID of the running turn's user message while the model has not answered it, so `withdrawMessage` can still take it back once nothing sent after it is pending. A message leaves `items` when its turn starts, before its `user.message` is recorded; this tells that message apart from one that was removed. Absent when no turn prompt can be taken back.</summary>
+    [JsonPropertyName("withdrawableTurnMessageId")]
+    public string? WithdrawableTurnMessageId { get; set; }
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionQueuePendingItemsRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -20813,7 +21043,7 @@ internal sealed class SessionQueuePendingItemsRequest
 }
 
 /// <summary>Internal snapshot of native queue state for local session orchestration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueSnapshotResult
 {
     /// <summary>Queue item identifier of a model switch that has been dequeued but not yet applied.</summary>
@@ -20838,7 +21068,7 @@ internal sealed class QueueSnapshotResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionQueueSnapshotRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -20847,7 +21077,7 @@ internal sealed class SessionQueueSnapshotRequest
 }
 
 /// <summary>Result of moving a queued item.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueueMoveItemResult
 {
     /// <summary>True when the item changed position; false when it was already at the requested position.</summary>
@@ -20856,7 +21086,7 @@ public sealed class QueueMoveItemResult
 }
 
 /// <summary>Parameters for moving a queued item by stable id.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueMoveItemRequest
 {
     /// <summary>Stable opaque queued-item id.</summary>
@@ -20873,7 +21103,7 @@ internal sealed class QueueMoveItemRequest
 }
 
 /// <summary>Result of inserting a queued message.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueueInsertAtResult
 {
     /// <summary>Fresh stable opaque id assigned to the inserted item.</summary>
@@ -20882,7 +21112,7 @@ public sealed class QueueInsertAtResult
 }
 
 /// <summary>Serializable message fields accepted by queue.insertAt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueueInsertMessage
 {
     /// <summary>Optional explicit agent mode. When omitted, the session's current mode is assigned.</summary>
@@ -20935,7 +21165,7 @@ public sealed class QueueInsertMessage
 }
 
 /// <summary>Parameters for inserting a queued message at a public visible position.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueInsertAtRequest
 {
     /// <summary>Queued message contents and delivery metadata.</summary>
@@ -20952,7 +21182,7 @@ internal sealed class QueueInsertAtRequest
 }
 
 /// <summary>Result of removing a queued item.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueueRemoveAtResult
 {
     /// <summary>True when the addressed item was removed.</summary>
@@ -20961,7 +21191,7 @@ public sealed class QueueRemoveAtResult
 }
 
 /// <summary>Parameters for removing a queued item by stable id.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueRemoveAtRequest
 {
     /// <summary>Stable opaque ID of the queued item to remove.</summary>
@@ -20974,7 +21204,7 @@ internal sealed class QueueRemoveAtRequest
 }
 
 /// <summary>Result of editing a queued message.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueueUpdateTextResult
 {
     /// <summary>True when the stored text changed.</summary>
@@ -20983,7 +21213,7 @@ public sealed class QueueUpdateTextResult
 }
 
 /// <summary>Parameters for editing a single queued message.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueUpdateTextRequest
 {
     /// <summary>Optional replacement prompt displayed to the user.</summary>
@@ -21003,8 +21233,21 @@ internal sealed class QueueUpdateTextRequest
     public string SessionId { get; set; } = string.Empty;
 }
 
-/// <summary>Conditional withdrawal of a single user message, before the runtime claims it for delivery.</summary>
-[Experimental(Diagnostics.Experimental)]
+/// <summary>Result of withdrawing a user message.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class QueueWithdrawMessageResult
+{
+    /// <summary>True when the running turn was interrupted to withdraw the message. With removed false, the turn was interrupted but its events could not be removed, for example because the model answered first, so the message stays in the interrupted turn.</summary>
+    [JsonPropertyName("interrupted")]
+    public bool Interrupted { get; set; }
+
+    /// <summary>True when the message left the queue or, for a running turn, history.</summary>
+    [JsonPropertyName("removed")]
+    public bool Removed { get; set; }
+}
+
+/// <summary>Conditional withdrawal of a single user message, from its queue or from the running turn it started.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueWithdrawMessageRequest
 {
     /// <summary>The prompt originally sent. A message edited since submission is not withdrawn, so an obsolete draft cannot replace the edit.</summary>
@@ -21021,7 +21264,7 @@ internal sealed class QueueWithdrawMessageRequest
 }
 
 /// <summary>Append to one pending steering message without changing its identity or delivery position.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueAppendSteeringRequest
 {
     /// <summary>Mode captured at submission. Only steering messages in the same mode may be combined.</summary>
@@ -21054,7 +21297,7 @@ internal sealed class QueueAppendSteeringRequest
 }
 
 /// <summary>Result of duplicating a queued item.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueueDuplicateAtResult
 {
     /// <summary>Fresh stable opaque id assigned to the duplicate.</summary>
@@ -21063,7 +21306,7 @@ public sealed class QueueDuplicateAtResult
 }
 
 /// <summary>Parameters for duplicating a queued item.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueDuplicateAtRequest
 {
     /// <summary>Stable opaque ID of the queued item to duplicate.</summary>
@@ -21076,7 +21319,7 @@ internal sealed class QueueDuplicateAtRequest
 }
 
 /// <summary>Parameters for acquiring or releasing the queued-lane drain pause. Acquisition is exclusive and non-idempotent: `paused: true` against an already-paused session fails with `queue_already_paused`. The pause is never released automatically — it is not tied to the caller's lifetime, so a client that exits without sending `paused: false` leaves the lane frozen. Release is unowned: `paused: false` clears the pause for any caller, including one that never acquired it.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueSetDrainPausedRequest
 {
     /// <summary>Whether queued-lane draining should be paused.</summary>
@@ -21089,7 +21332,7 @@ internal sealed class QueueSetDrainPausedRequest
 }
 
 /// <summary>Result of trying to steer a queued message into a live turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueueSendNowResult
 {
     /// <summary>True when the item was accepted into the steering lane; false when no main turn was live.</summary>
@@ -21098,7 +21341,7 @@ public sealed class QueueSendNowResult
 }
 
 /// <summary>Parameters for steering a queued message into a live turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueSendNowRequest
 {
     /// <summary>Stable opaque ID of the queued item to steer into the live turn.</summary>
@@ -21111,7 +21354,7 @@ internal sealed class QueueSendNowRequest
 }
 
 /// <summary>Whether the native queue has pending work.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueHasPendingResult
 {
     /// <summary>True when queued or immediate native work is pending.</summary>
@@ -21120,7 +21363,7 @@ internal sealed class QueueHasPendingResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionQueueHasPendingRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21129,7 +21372,7 @@ internal sealed class SessionQueueHasPendingRequest
 }
 
 /// <summary>Whether a deferred-idle drain should run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueBeginDeferredIdleDrainResult
 {
     /// <summary>True when the host should run finishDeferredIdleDrain asynchronously.</summary>
@@ -21138,7 +21381,7 @@ internal sealed class QueueBeginDeferredIdleDrainResult
 }
 
 /// <summary>Inputs for starting a deferred-idle drain.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueBeginDeferredIdleDrainRequest
 {
     /// <summary>Whether the host still has active background work.</summary>
@@ -21151,7 +21394,7 @@ internal sealed class QueueBeginDeferredIdleDrainRequest
 }
 
 /// <summary>Action selected by the native deferred-idle drain.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueFinishDeferredIdleDrainResult
 {
     /// <summary>Whether the deferred idle was caused by an aborted foreground turn.</summary>
@@ -21164,7 +21407,7 @@ internal sealed class QueueFinishDeferredIdleDrainResult
 }
 
 /// <summary>Inputs for completing a deferred-idle drain.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueFinishDeferredIdleDrainRequest
 {
     /// <summary>Whether the host still has active background work.</summary>
@@ -21181,7 +21424,7 @@ internal sealed class QueueFinishDeferredIdleDrainRequest
 }
 
 /// <summary>Inputs for marking session.idle deferred in native state.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueDeferSessionIdleRequest
 {
     /// <summary>Whether the deferred idle was caused by an aborted foreground turn.</summary>
@@ -21194,7 +21437,7 @@ internal sealed class QueueDeferSessionIdleRequest
 }
 
 /// <summary>Indicates whether a user-facing pending item was removed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueueRemoveMostRecentResult
 {
     /// <summary>True if a user-facing pending item was removed (LIFO across both queues); false when no removable items remained.</summary>
@@ -21203,7 +21446,7 @@ public sealed class QueueRemoveMostRecentResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionQueueRemoveMostRecentRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21212,7 +21455,7 @@ internal sealed class SessionQueueRemoveMostRecentRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionQueueClearRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21221,7 +21464,7 @@ internal sealed class SessionQueueClearRequest
 }
 
 /// <summary>Internal filter for consuming queued system notifications.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueConsumeSystemNotificationsRequest
 {
     /// <summary>Opaque runtime-owned filter object.</summary>
@@ -21234,7 +21477,7 @@ internal sealed class QueueConsumeSystemNotificationsRequest
 }
 
 /// <summary>Result of enqueueing the resume-pending wake item.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class QueueEnqueueResumePendingResult
 {
     /// <summary>True when a wake item was newly queued.</summary>
@@ -21243,7 +21486,7 @@ internal sealed class QueueEnqueueResumePendingResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionQueueEnqueueResumePendingRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21252,7 +21495,7 @@ internal sealed class SessionQueueEnqueueResumePendingRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionQueueProcessRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21261,7 +21504,7 @@ internal sealed class SessionQueueProcessRequest
 }
 
 /// <summary>Cursor, batch size, and optional long-poll/filter parameters for reading session events.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class EventLogReadRequest
 {
     /// <summary>Optional non-empty list of subagent identifiers. When provided, only events owned by one of these agents are returned; ownership recognizes the event envelope's agentId plus legacy data.agentId and data.parentToolCallId markers. This filter takes precedence over agentScope.</summary>
@@ -21303,7 +21546,7 @@ internal sealed class EventLogReadRequest
 }
 
 /// <summary>Snapshot of the current tail cursor without returning any events. Use this when a consumer wants to subscribe to live events going forward without first paginating through the entire persisted history (which would happen if `read` were called without a cursor on a long-lived session).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class EventLogTailResult
 {
     /// <summary>Opaque cursor pointing at the current tail of the session's persisted-events history. Pass back to `read` to receive only events that arrive AFTER this snapshot. When the session has no events, this returns the same sentinel as an unset cursor (i.e. equivalent to omitting the cursor on a first read).</summary>
@@ -21312,7 +21555,7 @@ public sealed class EventLogTailResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionEventLogTailRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21321,7 +21564,7 @@ internal sealed class SessionEventLogTailRequest
 }
 
 /// <summary>Opaque handle representing an event-type interest registration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RegisterEventInterestResult
 {
     /// <summary>Opaque handle for this registration. Pass to releaseInterest to release. Each call to registerInterest produces a fresh handle, even when the same eventType is registered multiple times.</summary>
@@ -21330,7 +21573,7 @@ public sealed class RegisterEventInterestResult
 }
 
 /// <summary>Event type to register consumer interest for, used by runtime gating logic.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class RegisterEventInterestParams
 {
     /// <summary>The event type the consumer wants the runtime to treat as 'observed' for behavior-switching gating. Some runtime code paths inspect whether any consumer is interested in a specific event type and choose a different implementation accordingly (e.g. `mcp.oauth_required`: when interest is registered the runtime delegates interactive OAuth token acquisition to the consumer via `mcp.oauth_required` events; when no interest is registered the runtime still attempts non-interactive reconnect from cached or refreshable tokens, and only marks the server `needs-auth` if usable credentials are unavailable — it does not open a browser or start interactive OAuth without a consumer). SDK clients that long-poll events do NOT automatically appear as listeners to these gating checks — they must explicitly call `registerInterest` for each event type they want the runtime to count as having a consumer. Multiple registrations for the same event type from the same or different consumers are tracked independently and must each be released. See: `mcp.oauth_required`, `sampling.requested`, `auto_mode_switch.requested`, `session_limits_exhausted.requested`, `user_input.requested`, `elicitation.requested`, `command.queued`, `exit_plan_mode.requested`.</summary>
@@ -21343,7 +21586,7 @@ internal sealed class RegisterEventInterestParams
 }
 
 /// <summary>Indicates whether the operation succeeded.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class EventLogReleaseInterestResult
 {
     /// <summary>Whether the operation succeeded.</summary>
@@ -21352,7 +21595,7 @@ public sealed class EventLogReleaseInterestResult
 }
 
 /// <summary>Opaque handle previously returned by `registerInterest` to release.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ReleaseEventInterestParams
 {
     /// <summary>Handle returned by a previous `registerInterest` call. Idempotent: releasing an unknown or already-released handle is a no-op (returns success). When the last outstanding handle for an event type is released, the runtime reverts to its 'no consumer' code path for that event type.</summary>
@@ -21365,7 +21608,7 @@ internal sealed class ReleaseEventInterestParams
 }
 
 /// <summary>Request count and cost metrics for this model.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UsageMetricsModelMetricRequests
 {
     /// <summary>User-initiated premium request cost (with multiplier applied).</summary>
@@ -21378,7 +21621,7 @@ public sealed class UsageMetricsModelMetricRequests
 }
 
 /// <summary>Per-model token-detail entry containing the accumulated token count for one token type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UsageMetricsModelMetricTokenDetail
 {
     /// <summary>Accumulated token count for this token type.</summary>
@@ -21387,7 +21630,7 @@ public sealed class UsageMetricsModelMetricTokenDetail
 }
 
 /// <summary>Token usage metrics for this model.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UsageMetricsModelMetricUsage
 {
     /// <summary>Total tokens read from prompt cache.</summary>
@@ -21412,7 +21655,7 @@ public sealed class UsageMetricsModelMetricUsage
 }
 
 /// <summary>Per-model usage metrics, including request counts/costs, token usage, nano-AI units, and per-token-type details.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UsageMetricsModelMetric
 {
     /// <summary>Latest known prompt-cache expiration for this model. A timestamp in the past indicates that the observed cache has expired.</summary>
@@ -21437,7 +21680,7 @@ public sealed class UsageMetricsModelMetric
 }
 
 /// <summary>Usage attributed to one agent instance, including its identity, API duration, AI units, and per-model breakdown.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UsageMetricsAgentMetric
 {
     /// <summary>Human-readable label for this subagent invocation, copied from the originating `subagent.started` event. For task-tool subagents this is the invocation's task description rather than the agent's configured display name, so group by `agentName` for stable per-agent labels.</summary>
@@ -21463,7 +21706,7 @@ public sealed class UsageMetricsAgentMetric
 }
 
 /// <summary>Aggregated code change metrics.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UsageMetricsCodeChanges
 {
     /// <summary>Distinct file paths modified during the session.</summary>
@@ -21484,7 +21727,7 @@ public sealed class UsageMetricsCodeChanges
 }
 
 /// <summary>Session-wide token-detail entry containing the accumulated token count for one token type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UsageMetricsTokenDetail
 {
     /// <summary>Accumulated token count for this token type.</summary>
@@ -21493,7 +21736,7 @@ public sealed class UsageMetricsTokenDetail
 }
 
 /// <summary>Accumulated session usage metrics, including premium request cost, token counts, model breakdown, and code-change totals.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UsageGetMetricsResult
 {
     /// <summary>Per-agent usage metrics, keyed by agent instance identifier. The main conversation uses the stable key `main`.</summary>
@@ -21547,7 +21790,7 @@ public sealed class UsageGetMetricsResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionUsageGetMetricsRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21557,7 +21800,7 @@ internal sealed class SessionUsageGetMetricsRequest
 
 /// <summary>Prediction result. Available results include prediction details; unavailable results include an explicit reason.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -21572,7 +21815,7 @@ public partial class SessionLimitPredictionResult
 
 
 /// <summary>Baseline data provenance for a prediction.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionLimitPredictionBaselineData
 {
     /// <summary>End of the baseline data slice.</summary>
@@ -21585,7 +21828,7 @@ public sealed class SessionLimitPredictionBaselineData
 }
 
 /// <summary>Semantic usage tier and its AI-credit cap.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionLimitPredictionTierOption
 {
     /// <summary>AI-credit cap for this tier.</summary>
@@ -21598,7 +21841,7 @@ public sealed class SessionLimitPredictionTierOption
 }
 
 /// <summary>Explainable AI-credit session-limit prediction.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionLimitPredictionDetails
 {
     /// <summary>Baseline data provenance.</summary>
@@ -21639,7 +21882,7 @@ public sealed class SessionLimitPredictionDetails
 }
 
 /// <summary>The <c>available</c> variant of <see cref="SessionLimitPredictionResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SessionLimitPredictionResultAvailable : SessionLimitPredictionResult
 {
     /// <inheritdoc />
@@ -21652,7 +21895,7 @@ public partial class SessionLimitPredictionResultAvailable : SessionLimitPredict
 }
 
 /// <summary>The <c>unavailable</c> variant of <see cref="SessionLimitPredictionResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class SessionLimitPredictionResultUnavailable : SessionLimitPredictionResult
 {
     /// <inheritdoc />
@@ -21665,7 +21908,7 @@ public partial class SessionLimitPredictionResultUnavailable : SessionLimitPredi
 }
 
 /// <summary>RPC data type for SessionLimitPredictionPredict operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionLimitPredictionPredictRequest
 {
     /// <summary>Client type to size for. Defaults to `cli-interactive`.</summary>
@@ -21678,7 +21921,7 @@ public sealed class SessionLimitPredictionPredictRequest
 }
 
 /// <summary>RPC data type for SessionLimitPredictionPredictRequestWithSession operations.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionLimitPredictionPredictRequestWithSession
 {
     /// <summary>Client type to size for. Defaults to `cli-interactive`.</summary>
@@ -21695,7 +21938,7 @@ internal sealed class SessionLimitPredictionPredictRequestWithSession
 }
 
 /// <summary>GitHub URL for the session and a flag indicating whether remote steering is enabled.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteEnableResult
 {
     /// <summary>Whether remote steering is enabled.</summary>
@@ -21710,7 +21953,7 @@ public sealed class RemoteEnableResult
 }
 
 /// <summary>Optional remote session mode ("off", "export", or "on"); defaults to enabling both export and remote steering.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class RemoteEnableRequest
 {
     /// <summary>Per-session remote mode. "off" disables remote, "export" exports session events to GitHub without enabling remote steering, "on" enables both export and remote steering.</summary>
@@ -21723,7 +21966,7 @@ internal sealed class RemoteEnableRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionRemoteDisableRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21732,13 +21975,13 @@ internal sealed class SessionRemoteDisableRequest
 }
 
 /// <summary>Persist a steerability change as a `session.remote_steerable_changed` event. Used by the host (CLI / SDK consumer) when it has just finished enabling or disabling steering on a remote exporter that the runtime does not directly own.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteNotifySteerableChangedResult
 {
 }
 
 /// <summary>New remote-steerability state to persist as a `session.remote_steerable_changed` event.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class RemoteNotifySteerableChangedRequest
 {
     /// <summary>Whether the session now supports remote steering via GitHub. The runtime persists this as a `session.remote_steerable_changed` event so resume/replay sees the up-to-date capability.</summary>
@@ -21751,7 +21994,7 @@ internal sealed class RemoteNotifySteerableChangedRequest
 }
 
 /// <summary>Current sharing status and shareable GitHub URL for a session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class VisibilityGetResult
 {
     /// <summary>Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.</summary>
@@ -21770,7 +22013,7 @@ public sealed class VisibilityGetResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionVisibilityGetRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21779,7 +22022,7 @@ internal sealed class SessionVisibilityGetRequest
 }
 
 /// <summary>Effective sharing status and shareable GitHub URL after updating session visibility.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class VisibilitySetResult
 {
     /// <summary>Shareable GitHub URL for the session. Present when the session is synced and the URL can be resolved.</summary>
@@ -21798,7 +22041,7 @@ public sealed class VisibilitySetResult
 }
 
 /// <summary>Desired sharing status for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class VisibilitySetRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21811,7 +22054,7 @@ internal sealed class VisibilitySetRequest
 }
 
 /// <summary>Scheduled prompt entry with ID, timing (`intervalMs`, `cron`, or `at`), prompt text, recurrence, and next run time.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ScheduleEntry
 {
     /// <summary>Absolute fire time (epoch milliseconds) for a one-shot calendar schedule.</summary>
@@ -21857,7 +22100,7 @@ public sealed class ScheduleEntry
 }
 
 /// <summary>Snapshot of the currently active recurring prompts for this session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ScheduleList
 {
     /// <summary>Active scheduled prompts, ordered by id.</summary>
@@ -21866,7 +22109,7 @@ public sealed class ScheduleList
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionScheduleListRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21875,7 +22118,7 @@ internal sealed class SessionScheduleListRequest
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionScheduleHydrateRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21884,7 +22127,7 @@ internal sealed class SessionScheduleHydrateRequest
 }
 
 /// <summary>Whether the session currently has an active self-paced schedule.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ScheduleHasSelfPacedResult
 {
     /// <summary>True when at least one active schedule is self-paced.</summary>
@@ -21893,7 +22136,7 @@ internal sealed class ScheduleHasSelfPacedResult
 }
 
 /// <summary>Identifies the target session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class SessionScheduleHasSelfPacedRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -21902,7 +22145,7 @@ internal sealed class SessionScheduleHasSelfPacedRequest
 }
 
 /// <summary>Result of registering or re-arming a scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ScheduleAddResult
 {
     /// <summary>The registered or updated schedule entry.</summary>
@@ -21915,7 +22158,7 @@ internal sealed class ScheduleAddResult
 }
 
 /// <summary>Register a relative-interval scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ScheduleAddRequest
 {
     /// <summary>Optional display-only prompt label.</summary>
@@ -21940,7 +22183,7 @@ internal sealed class ScheduleAddRequest
 }
 
 /// <summary>Register a cron scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ScheduleAddCronRequest
 {
     /// <summary>5-field cron expression.</summary>
@@ -21969,7 +22212,7 @@ internal sealed class ScheduleAddCronRequest
 }
 
 /// <summary>Register an absolute-time scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ScheduleAddAtRequest
 {
     /// <summary>Epoch milliseconds when the prompt should fire.</summary>
@@ -21994,7 +22237,7 @@ internal sealed class ScheduleAddAtRequest
 }
 
 /// <summary>Register a self-paced scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ScheduleAddSelfPacedRequest
 {
     /// <summary>Optional display-only prompt label.</summary>
@@ -22011,7 +22254,7 @@ internal sealed class ScheduleAddSelfPacedRequest
 }
 
 /// <summary>Re-arm a self-paced scheduled prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ScheduleRearmSelfPacedRequest
 {
     /// <summary>Epoch milliseconds when the prompt should next fire.</summary>
@@ -22028,7 +22271,7 @@ internal sealed class ScheduleRearmSelfPacedRequest
 }
 
 /// <summary>Remove a scheduled prompt by id. The result entry is omitted if the id was unknown.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ScheduleStopResult
 {
     /// <summary>The removed entry, or omitted if no entry matched.</summary>
@@ -22037,7 +22280,7 @@ public sealed class ScheduleStopResult
 }
 
 /// <summary>Identifier of the scheduled prompt to remove.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed class ScheduleStopRequest
 {
     /// <summary>Id of the scheduled prompt to remove.</summary>
@@ -22050,7 +22293,7 @@ internal sealed class ScheduleStopRequest
 }
 
 /// <summary>A bearer token supplied by the SDK client for a BYOK provider. The runtime sets it as `Authorization: Bearer &lt;token&gt;` on the outbound request and does no caching; the SDK consumer owns token caching and refresh.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderTokenAcquireResult
 {
     /// <summary>The bearer token value (without the `Bearer ` prefix).</summary>
@@ -22059,7 +22302,7 @@ public sealed class ProviderTokenAcquireResult
 }
 
 /// <summary>Asks the SDK client to acquire a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Issued by the runtime before each outbound model request; the runtime does no caching, so this is sent once per request.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderTokenAcquireRequest
 {
     /// <summary>Name of the BYOK provider needing a token. For the legacy whole-session provider this is the implicit provider name; for named providers it is the configured provider name.</summary>
@@ -22072,7 +22315,7 @@ public sealed class ProviderTokenAcquireRequest
 }
 
 /// <summary>Result returned by an extension factory closure.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryExecuteResult
 {
     /// <summary>Factory result value.</summary>
@@ -22081,7 +22324,7 @@ public sealed class FactoryExecuteResult
 }
 
 /// <summary>Parameters sent to the owning extension to execute a factory closure.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryExecuteRequest
 {
     /// <summary>Factory input value.</summary>
@@ -22106,7 +22349,7 @@ public sealed class FactoryExecuteRequest
 }
 
 /// <summary>Parameters for cooperatively aborting a factory body.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryAbortRequest
 {
     /// <summary>Opaque token identifying the execution attempt to abort.</summary>
@@ -22123,7 +22366,7 @@ public sealed class FactoryAbortRequest
 }
 
 /// <summary>Result returned by an extension workflow closure.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowExecuteResult
 {
     /// <summary>Workflow result value.</summary>
@@ -22132,7 +22375,7 @@ public sealed class WorkflowExecuteResult
 }
 
 /// <summary>Parameters sent to the owning extension to execute a workflow closure.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowExecuteRequest
 {
     /// <summary>Workflow input value.</summary>
@@ -22157,7 +22400,7 @@ public sealed class WorkflowExecuteRequest
 }
 
 /// <summary>Parameters for cooperatively aborting a workflow body.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowAbortRequest
 {
     /// <summary>Opaque token identifying the execution attempt to abort.</summary>
@@ -22174,7 +22417,7 @@ public sealed class WorkflowAbortRequest
 }
 
 /// <summary>Whether the client authoritatively confirmed its external work stopped.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ClientTaskCancelResult
 {
     /// <summary>True only when the owner confirms that external work stopped before responding.</summary>
@@ -22183,7 +22426,7 @@ public sealed class ClientTaskCancelResult
 }
 
 /// <summary>Runtime-to-owner cancellation request for a client-owned task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ClientTaskCancelRequest
 {
     /// <summary>Opaque identifier shared by coalesced cancellation callers.</summary>
@@ -22208,7 +22451,7 @@ public sealed class ClientTaskCancelRequest
 }
 
 /// <summary>Describes a filesystem error.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsError
 {
     /// <summary>Error classification.</summary>
@@ -22221,7 +22464,7 @@ public sealed class SessionFsError
 }
 
 /// <summary>File content as a UTF-8 string, or a filesystem error if the read failed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsReadFileResult
 {
     /// <summary>File content as UTF-8 string.</summary>
@@ -22234,7 +22477,7 @@ public sealed class SessionFsReadFileResult
 }
 
 /// <summary>Path of the file to read from the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsReadFileRequest
 {
     /// <summary>Path using SessionFs conventions.</summary>
@@ -22247,7 +22490,7 @@ public sealed class SessionFsReadFileRequest
 }
 
 /// <summary>File path, content to write, and optional mode for the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsWriteFileRequest
 {
     /// <summary>Content to write.</summary>
@@ -22268,7 +22511,7 @@ public sealed class SessionFsWriteFileRequest
 }
 
 /// <summary>File path, content to append, and optional mode for the client-provided session filesystem. Implementations create parent directories as needed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsAppendFileRequest
 {
     /// <summary>Content to append.</summary>
@@ -22289,7 +22532,7 @@ public sealed class SessionFsAppendFileRequest
 }
 
 /// <summary>Indicates whether the requested path exists in the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsExistsResult
 {
     /// <summary>Whether the path exists.</summary>
@@ -22298,7 +22541,7 @@ public sealed class SessionFsExistsResult
 }
 
 /// <summary>Path to test for existence in the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsExistsRequest
 {
     /// <summary>Path using SessionFs conventions.</summary>
@@ -22311,7 +22554,7 @@ public sealed class SessionFsExistsRequest
 }
 
 /// <summary>Filesystem metadata for the requested path, or a filesystem error if the stat failed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsStatResult
 {
     /// <summary>ISO 8601 timestamp of creation.</summary>
@@ -22340,7 +22583,7 @@ public sealed class SessionFsStatResult
 }
 
 /// <summary>Path whose metadata should be returned from the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsStatRequest
 {
     /// <summary>Path using SessionFs conventions.</summary>
@@ -22353,7 +22596,7 @@ public sealed class SessionFsStatRequest
 }
 
 /// <summary>Directory path to create in the client-provided session filesystem, with options for recursive creation and POSIX mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsMkdirRequest
 {
     /// <summary>Optional POSIX-style mode for newly created directories.</summary>
@@ -22374,7 +22617,7 @@ public sealed class SessionFsMkdirRequest
 }
 
 /// <summary>Names of entries in the requested directory, or a filesystem error if the read failed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsReaddirResult
 {
     /// <summary>Entry names in the directory.</summary>
@@ -22387,7 +22630,7 @@ public sealed class SessionFsReaddirResult
 }
 
 /// <summary>Directory path whose entries should be listed from the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsReaddirRequest
 {
     /// <summary>Path using SessionFs conventions.</summary>
@@ -22400,7 +22643,7 @@ public sealed class SessionFsReaddirRequest
 }
 
 /// <summary>Directory entry returned by session filesystem `readdirWithTypes`, with name and entry type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsReaddirWithTypesEntry
 {
     /// <summary>Entry name.</summary>
@@ -22413,7 +22656,7 @@ public sealed class SessionFsReaddirWithTypesEntry
 }
 
 /// <summary>Entries in the requested directory paired with file/directory type information, or a filesystem error if the read failed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsReaddirWithTypesResult
 {
     /// <summary>Directory entries with type information.</summary>
@@ -22426,7 +22669,7 @@ public sealed class SessionFsReaddirWithTypesResult
 }
 
 /// <summary>Directory path whose entries (with type information) should be listed from the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsReaddirWithTypesRequest
 {
     /// <summary>Path using SessionFs conventions.</summary>
@@ -22439,7 +22682,7 @@ public sealed class SessionFsReaddirWithTypesRequest
 }
 
 /// <summary>Path to remove from the client-provided session filesystem, with options for recursive removal and force.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsRmRequest
 {
     /// <summary>Ignore errors if the path does not exist.</summary>
@@ -22460,7 +22703,7 @@ public sealed class SessionFsRmRequest
 }
 
 /// <summary>Source and destination paths for renaming or moving an entry in the client-provided session filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsRenameRequest
 {
     /// <summary>Destination path using SessionFs conventions.</summary>
@@ -22477,7 +22720,7 @@ public sealed class SessionFsRenameRequest
 }
 
 /// <summary>Query results including rows, columns, and rows affected, or a filesystem error if execution failed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsSqliteQueryResult
 {
     /// <summary>Column names from the result set.</summary>
@@ -22502,7 +22745,7 @@ public sealed class SessionFsSqliteQueryResult
 }
 
 /// <summary>SQL query, query type, and optional bind parameters for executing a SQLite query against the per-session database. The provider applies its SQLite busy timeout for every call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsSqliteQueryRequest
 {
     /// <summary>Optional named bind parameters.</summary>
@@ -22523,7 +22766,7 @@ public sealed class SessionFsSqliteQueryRequest
 }
 
 /// <summary>Classified SQLite transaction failure. busyOrLocked guarantees rollback; postCommitAmbiguous must never be retried.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsSqliteTransactionError
 {
     /// <summary>Machine-readable classification of the transaction failure.</summary>
@@ -22536,7 +22779,7 @@ public sealed class SessionFsSqliteTransactionError
 }
 
 /// <summary>Per-statement results, or a classified transaction error.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsSqliteTransactionResult
 {
     /// <summary>Classified transaction failure, when execution did not succeed.</summary>
@@ -22549,7 +22792,7 @@ public sealed class SessionFsSqliteTransactionResult
 }
 
 /// <summary>One statement in an atomic SQLite transaction.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsSqliteTransactionStatement
 {
     /// <summary>Optional named bind parameters.</summary>
@@ -22566,7 +22809,7 @@ public sealed class SessionFsSqliteTransactionStatement
 }
 
 /// <summary>Statements to execute atomically. Providers apply busy handling for every call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsSqliteTransactionRequest
 {
     /// <summary>Target session identifier.</summary>
@@ -22579,7 +22822,7 @@ public sealed class SessionFsSqliteTransactionRequest
 }
 
 /// <summary>Indicates whether the per-session SQLite database already exists.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SessionFsSqliteExistsResult
 {
     /// <summary>Whether the session database already exists.</summary>
@@ -22596,7 +22839,7 @@ public sealed class SessionFsSqliteExistsRequest
 }
 
 /// <summary>Canvas open result returned by the provider.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasProviderOpenResult
 {
     /// <summary>Provider-supplied status text.</summary>
@@ -22613,7 +22856,7 @@ public sealed class CanvasProviderOpenResult
 }
 
 /// <summary>Host capabilities.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasHostContextCapabilities
 {
     /// <summary>Whether canvas rendering is supported.</summary>
@@ -22622,7 +22865,7 @@ public sealed class CanvasHostContextCapabilities
 }
 
 /// <summary>Host context supplied by the runtime.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasHostContext
 {
     /// <summary>Host capabilities.</summary>
@@ -22631,7 +22874,7 @@ public sealed class CanvasHostContext
 }
 
 /// <summary>Session context supplied by the runtime.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasSessionContext
 {
     /// <summary>Active session working directory, when known.</summary>
@@ -22640,7 +22883,7 @@ public sealed class CanvasSessionContext
 }
 
 /// <summary>Canvas open parameters sent to the provider.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasProviderOpenRequest
 {
     /// <summary>Provider-local canvas identifier.</summary>
@@ -22673,7 +22916,7 @@ public sealed class CanvasProviderOpenRequest
 }
 
 /// <summary>Canvas close parameters sent to the provider.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasProviderCloseRequest
 {
     /// <summary>Provider-local canvas identifier.</summary>
@@ -22702,7 +22945,7 @@ public sealed class CanvasProviderCloseRequest
 }
 
 /// <summary>Canvas action invocation parameters sent to the provider.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasProviderInvokeActionRequest
 {
     /// <summary>Action name to invoke.</summary>
@@ -22739,7 +22982,7 @@ public sealed class CanvasProviderInvokeActionRequest
 }
 
 /// <summary>Opaque integrator-owned process launch profile for one extension entrypoint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ExtensionLaunchProfile
 {
     /// <summary>Opaque integrator-defined arguments passed to the executable. The runtime does not append the extension entrypoint.</summary>
@@ -22758,7 +23001,7 @@ public sealed class ExtensionLaunchProfile
 }
 
 /// <summary>The launch profile for a supported entrypoint. Omit launch when the provider does not support the entrypoint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ExtensionLaunchProviderResolveResult
 {
     /// <summary>Opaque launch profile, omitted when this provider does not support the entrypoint.</summary>
@@ -22767,7 +23010,7 @@ public sealed class ExtensionLaunchProviderResolveResult
 }
 
 /// <summary>A discovered extension entrypoint that the registered integrator may classify and resolve to an opaque launch profile.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ExtensionLaunchProviderResolveRequest
 {
     /// <summary>Source-qualified extension identifier.</summary>
@@ -22788,13 +23031,13 @@ public sealed class ExtensionLaunchProviderResolveRequest
 }
 
 /// <summary>Acknowledgement. Returning successfully simply means the SDK accepted the start frame; it does not imply the request will succeed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LlmInferenceHttpRequestStartResult
 {
 }
 
 /// <summary>The head of an outbound model-layer HTTP request.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LlmInferenceHttpRequestStartRequest
 {
     /// <summary>Stable identity of the agent trajectory that issued this request. Present when the request originates from an agent turn; absent for requests outside any agent context. This is the same identity used by lifecycle and bridged session events and remains constant across turns and retries.</summary>
@@ -22839,13 +23082,13 @@ public sealed class LlmInferenceHttpRequestStartRequest
 }
 
 /// <summary>Acknowledgement. The SDK is free to ignore the ack and treat chunk delivery as fire-and-forget.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LlmInferenceHttpRequestChunkResult
 {
 }
 
 /// <summary>A request body chunk or cancellation signal.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LlmInferenceHttpRequestChunkRequest
 {
     /// <summary>Identity of the agent invocation (one agentic loop) this body chunk belongs to, matching the `agentInvocationId` semantics on httpRequestStart. Carried per chunk so a persistent transport can attribute successive turns correctly: when a WebSocket connection is reused across turns, the httpRequestStart identity reflects only the turn that opened the connection, so each later turn stamps its own invocation id here. Absent when the runtime has no invocation context for the request, or on the plain-HTTP transport where every request has its own httpRequestStart.</summary>
@@ -22878,7 +23121,7 @@ public sealed class LlmInferenceHttpRequestChunkRequest
 }
 
 /// <summary>Client environment metadata describing the process that produced a telemetry event.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class GitHubTelemetryClientInfo
 {
     /// <summary>Copilot CLI version string.</summary>
@@ -22931,7 +23174,7 @@ public sealed class GitHubTelemetryClientInfo
 }
 
 /// <summary>A single telemetry event in the runtime's native GitHub-shaped telemetry format, forwarded verbatim to opted-in hosts. The `restricted` flag on the enclosing GitHubTelemetryNotification distinguishes standard from restricted events; the payload shape is identical for both.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class GitHubTelemetryEvent
 {
     /// <summary>Client environment metadata.</summary>
@@ -22976,7 +23219,7 @@ public sealed class GitHubTelemetryEvent
 }
 
 /// <summary>Payload for a `gitHubTelemetry.event` notification: a single GitHub telemetry event the runtime forwards to a host connection that opted into telemetry forwarding during the `server.connect` handshake.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class GitHubTelemetryNotification
 {
     /// <summary>The telemetry event, in the runtime's native GitHub-shaped telemetry format.</summary>
@@ -22994,7 +23237,7 @@ public sealed class GitHubTelemetryNotification
 
 /// <summary>SDK host response to a GitHub credential request.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>kind</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "kind",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -23009,7 +23252,7 @@ public partial class GitHubTokenAcquireResult
 
 
 /// <summary>The <c>token</c> variant of <see cref="GitHubTokenAcquireResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class GitHubTokenAcquireResultToken : GitHubTokenAcquireResult
 {
     /// <inheritdoc />
@@ -23031,7 +23274,7 @@ public partial class GitHubTokenAcquireResultToken : GitHubTokenAcquireResult
 }
 
 /// <summary>The <c>cancelled</c> variant of <see cref="GitHubTokenAcquireResult"/>.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public partial class GitHubTokenAcquireResultCancelled : GitHubTokenAcquireResult
 {
     /// <inheritdoc />
@@ -23040,7 +23283,7 @@ public partial class GitHubTokenAcquireResultCancelled : GitHubTokenAcquireResul
 }
 
 /// <summary>Asks the SDK client to acquire a GitHub access token from an opaque callback registration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class GitHubTokenAcquireRequest
 {
     /// <summary>Effective GitHub host for which the callback must return a token.</summary>
@@ -23061,7 +23304,7 @@ public sealed class GitHubTokenAcquireRequest
 }
 
 /// <summary>Closed set of public task kinds a connection can negotiate.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskKind : IEquatable<TaskKind>
@@ -23127,7 +23370,7 @@ public override void Write(Utf8JsonWriter writer, TaskKind value, JsonSerializer
 
 
 /// <summary>Hook event name. Discovery emits the file-configurable subset; SDK callbacks additionally support callback-only events.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct HookType : IEquatable<HookType>
@@ -23235,7 +23478,7 @@ public override void Write(Utf8JsonWriter writer, HookType value, JsonSerializer
 
 
 /// <summary>Configuration tier that contributed a discovered hook action.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct HookOrigin : IEquatable<HookOrigin>
@@ -23304,7 +23547,7 @@ public override void Write(Utf8JsonWriter writer, HookOrigin value, JsonSerializ
 
 
 /// <summary>Resolved Anthropic adaptive-thinking capability for a model.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AdaptiveThinkingSupport : IEquatable<AdaptiveThinkingSupport>
@@ -23373,7 +23616,7 @@ public override void Write(Utf8JsonWriter writer, AdaptiveThinkingSupport value,
 
 
 /// <summary>Model capability category for grouping in the model picker.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ModelPickerCategory : IEquatable<ModelPickerCategory>
@@ -23439,7 +23682,7 @@ public override void Write(Utf8JsonWriter writer, ModelPickerCategory value, Jso
 
 
 /// <summary>Relative cost tier for token-based billing users.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ModelPickerPriceCategory : IEquatable<ModelPickerPriceCategory>
@@ -23508,7 +23751,7 @@ public override void Write(Utf8JsonWriter writer, ModelPickerPriceCategory value
 
 
 /// <summary>Current policy state for this model.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ModelPolicyState : IEquatable<ModelPolicyState>
@@ -23574,7 +23817,7 @@ public override void Write(Utf8JsonWriter writer, ModelPolicyState value, JsonSe
 
 
 /// <summary>Server transport type: stdio, http, sse (deprecated), or memory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct DiscoveredMcpServerType : IEquatable<DiscoveredMcpServerType>
@@ -23643,7 +23886,7 @@ public override void Write(Utf8JsonWriter writer, DiscoveredMcpServerType value,
 
 
 /// <summary>A wire feature a caller can require of the catalog surface, negotiated per request. A grant means the runtime understands the feature's contract, not that the deployment has enabled the operation; typed unavailable results report availability separately.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogCapability : IEquatable<CatalogCapability>
@@ -23730,7 +23973,7 @@ public override void Write(Utf8JsonWriter writer, CatalogCapability value, JsonS
 
 
 /// <summary>Whether a planned configuration change would create or modify an entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpPlanConfigurationOperation : IEquatable<McpPlanConfigurationOperation>
@@ -23793,7 +24036,7 @@ public override void Write(Utf8JsonWriter writer, McpPlanConfigurationOperation
 
 
 /// <summary>Configuration scope an MCP install plan targets.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpPlanScope : IEquatable<McpPlanScope>
@@ -23853,7 +24096,7 @@ public override void Write(Utf8JsonWriter writer, McpPlanScope value, JsonSerial
 
 
 /// <summary>What policy decided for a planned server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpPlanPolicyDecision : IEquatable<McpPlanPolicyDecision>
@@ -23919,7 +24162,7 @@ public override void Write(Utf8JsonWriter writer, McpPlanPolicyDecision value, J
 
 
 /// <summary>Which authority produced a policy decision.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpPlanPolicySource : IEquatable<McpPlanPolicySource>
@@ -23988,7 +24231,7 @@ public override void Write(Utf8JsonWriter writer, McpPlanPolicySource value, Jso
 
 
 /// <summary>Canonical digest algorithm for a validated MCP card.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CardDigestAlgorithm : IEquatable<CardDigestAlgorithm>
@@ -24048,7 +24291,7 @@ public override void Write(Utf8JsonWriter writer, CardDigestAlgorithm value, Jso
 
 
 /// <summary>JSON MCP card media type accepted for install planning.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpServerCardMediaType : IEquatable<McpServerCardMediaType>
@@ -24111,7 +24354,7 @@ public override void Write(Utf8JsonWriter writer, McpServerCardMediaType value,
 
 
 /// <summary>Where a required value is applied when the planned server is launched.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpPlanValueCategory : IEquatable<McpPlanValueCategory>
@@ -24183,7 +24426,7 @@ public override void Write(Utf8JsonWriter writer, McpPlanValueCategory value, Js
 
 
 /// <summary>Scalar type a required value must conform to.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpPlanScalarValueType : IEquatable<McpPlanScalarValueType>
@@ -24252,7 +24495,7 @@ public override void Write(Utf8JsonWriter writer, McpPlanScalarValueType value,
 
 
 /// <summary>Discriminator for an enumerated required value.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpPlanEnumValueType : IEquatable<McpPlanEnumValueType>
@@ -24312,7 +24555,7 @@ public override void Write(Utf8JsonWriter writer, McpPlanEnumValueType value, Js
 
 
 /// <summary>Transport exposed by a locally launched package.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpPlanPackageTransport : IEquatable<McpPlanPackageTransport>
@@ -24372,7 +24615,7 @@ public override void Write(Utf8JsonWriter writer, McpPlanPackageTransport value,
 
 
 /// <summary>Transport exposed by a remote endpoint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpPlanRemoteTransport : IEquatable<McpPlanRemoteTransport>
@@ -24438,7 +24681,7 @@ public override void Write(Utf8JsonWriter writer, McpPlanRemoteTransport value,
 
 
 /// <summary>Why capability and protocol-version negotiation refused a caller.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogNegotiationRefusedReason : IEquatable<CatalogNegotiationRefusedReason>
@@ -24501,7 +24744,7 @@ public override void Write(Utf8JsonWriter writer, CatalogNegotiationRefusedReaso
 
 
 /// <summary>Which kind of opaque handle was presented.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogHandleType : IEquatable<CatalogHandleType>
@@ -24567,7 +24810,7 @@ public override void Write(Utf8JsonWriter writer, CatalogHandleType value, JsonS
 
 
 /// <summary>Why a presented handle was rejected.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogHandleRejectionReason : IEquatable<CatalogHandleRejectionReason>
@@ -24642,7 +24885,7 @@ public override void Write(Utf8JsonWriter writer, CatalogHandleRejectionReason v
 
 
 /// <summary>Which request field was rejected locally or by the catalog authority.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogInvalidRequestField : IEquatable<CatalogInvalidRequestField>
@@ -24732,7 +24975,7 @@ public override void Write(Utf8JsonWriter writer, CatalogInvalidRequestField val
 
 
 /// <summary>Why the catalog authority did not accept the caller's identity.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogAuthenticationRequiredReason : IEquatable<CatalogAuthenticationRequiredReason>
@@ -24798,7 +25041,7 @@ public override void Write(Utf8JsonWriter writer, CatalogAuthenticationRequiredR
 
 
 /// <summary>Categorised network failure, low cardinality so it can be aggregated without carrying a URL.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogNetworkFailureReason : IEquatable<CatalogNetworkFailureReason>
@@ -24888,7 +25131,7 @@ public override void Write(Utf8JsonWriter writer, CatalogNetworkFailureReason va
 
 
 /// <summary>Which hardened-fetch control refused a retrieval.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogUnsafeRetrievalReason : IEquatable<CatalogUnsafeRetrievalReason>
@@ -24963,7 +25206,7 @@ public override void Write(Utf8JsonWriter writer, CatalogUnsafeRetrievalReason v
 
 
 /// <summary>Media type a catalog card is interpreted as.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogMediaType : IEquatable<CatalogMediaType>
@@ -25032,7 +25275,7 @@ public override void Write(Utf8JsonWriter writer, CatalogMediaType value, JsonSe
 
 
 /// <summary>How a card failed validation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogMalformedCardReason : IEquatable<CatalogMalformedCardReason>
@@ -25104,7 +25347,7 @@ public override void Write(Utf8JsonWriter writer, CatalogMalformedCardReason val
 
 
 /// <summary>Which wire-contract rule an upstream response broke.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogContractViolationReason : IEquatable<CatalogContractViolationReason>
@@ -25173,7 +25416,7 @@ public override void Write(Utf8JsonWriter writer, CatalogContractViolationReason
 
 
 /// <summary>Why no usable transport could be offered.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogUnavailableTransportReason : IEquatable<CatalogUnavailableTransportReason>
@@ -25239,7 +25482,7 @@ public override void Write(Utf8JsonWriter writer, CatalogUnavailableTransportRea
 
 
 /// <summary>Why a discoverable candidate cannot be installed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogNotInstallableReason : IEquatable<CatalogNotInstallableReason>
@@ -25305,7 +25548,7 @@ public override void Write(Utf8JsonWriter writer, CatalogNotInstallableReason va
 
 
 /// <summary>Why a catalog operation is not available on this runtime.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogUnavailableReason : IEquatable<CatalogUnavailableReason>
@@ -25377,7 +25620,7 @@ public override void Write(Utf8JsonWriter writer, CatalogUnavailableReason value
 
 
 /// <summary>Persisted extension discovery source.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct DiscoveredExtensionSource : IEquatable<DiscoveredExtensionSource>
@@ -25440,7 +25683,7 @@ public override void Write(Utf8JsonWriter writer, DiscoveredExtensionSource valu
 
 
 /// <summary>Effective extension loading and agent-management mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct DiscoveredExtensionMode : IEquatable<DiscoveredExtensionMode>
@@ -25506,7 +25749,7 @@ public override void Write(Utf8JsonWriter writer, DiscoveredExtensionMode value,
 
 
 /// <summary>Whether an MCP server candidate can be planned for installation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogMcpServerInstallability : IEquatable<CatalogMcpServerInstallability>
@@ -25569,7 +25812,7 @@ public override void Write(Utf8JsonWriter writer, CatalogMcpServerInstallability
 
 
 /// <summary>Authority-computed exposure eligibility, kept separate from tier. The current tier-only Agent Finder response maps to `unknown`, never to a locally inferred eligibility.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogTrustEligibility : IEquatable<CatalogTrustEligibility>
@@ -25638,7 +25881,7 @@ public override void Write(Utf8JsonWriter writer, CatalogTrustEligibility value,
 
 
 /// <summary>Bounded authority that supplied a catalogue trust observation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogTrustSource : IEquatable<CatalogTrustSource>
@@ -25698,7 +25941,7 @@ public override void Write(Utf8JsonWriter writer, CatalogTrustSource value, Json
 
 
 /// <summary>Schema version of the catalogue trust snapshot envelope.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogTrustSnapshotSchemaVersion : IEquatable<CatalogTrustSnapshotSchemaVersion>
@@ -25758,7 +26001,7 @@ public override void Write(Utf8JsonWriter writer, CatalogTrustSnapshotSchemaVers
 
 
 /// <summary>Service-computed trust tier currently emitted by Agent Finder. It is independent of search score, popularity, and client-side ranking.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogTrustTier : IEquatable<CatalogTrustTier>
@@ -25821,7 +26064,7 @@ public override void Write(Utf8JsonWriter writer, CatalogTrustTier value, JsonSe
 
 
 /// <summary>Typed non-installable state for an AI skill candidate.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogAiSkillInstallability : IEquatable<CatalogAiSkillInstallability>
@@ -25881,7 +26124,7 @@ public override void Write(Utf8JsonWriter writer, CatalogAiSkillInstallability v
 
 
 /// <summary>Canonical AI skill media type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogAiSkillMediaType : IEquatable<CatalogAiSkillMediaType>
@@ -25941,7 +26184,7 @@ public override void Write(Utf8JsonWriter writer, CatalogAiSkillMediaType value,
 
 
 /// <summary>Explicit Agent Plugin compatibility declared by exact catalog tags. Clients must not infer these values from display text or other metadata.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogAgentPluginCompatibilityTag : IEquatable<CatalogAgentPluginCompatibilityTag>
@@ -26007,7 +26250,7 @@ public override void Write(Utf8JsonWriter writer, CatalogAgentPluginCompatibilit
 
 
 /// <summary>Canonical Agent Plugin media type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogAgentPluginMediaType : IEquatable<CatalogAgentPluginMediaType>
@@ -26067,7 +26310,7 @@ public override void Write(Utf8JsonWriter writer, CatalogAgentPluginMediaType va
 
 
 /// <summary>Relationship of the backend-reported count to the complete query result set.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogSearchTotalCountRelation : IEquatable<CatalogSearchTotalCountRelation>
@@ -26127,7 +26370,7 @@ public override void Write(Utf8JsonWriter writer, CatalogSearchTotalCountRelatio
 
 
 /// <summary>What kind of resource a catalog candidate describes.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogCandidateKind : IEquatable<CatalogCandidateKind>
@@ -26193,7 +26436,7 @@ public override void Write(Utf8JsonWriter writer, CatalogCandidateKind value, Js
 
 
 /// <summary>Terminal outcome declared for a retained catalog selection group.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CatalogSelectionDecision : IEquatable<CatalogSelectionDecision>
@@ -26262,7 +26505,7 @@ public override void Write(Utf8JsonWriter writer, CatalogSelectionDecision value
 
 
 /// <summary>Where completed plugin content was staged before atomic promotion.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PluginInstallStagingMode : IEquatable<PluginInstallStagingMode>
@@ -26325,7 +26568,7 @@ public override void Write(Utf8JsonWriter writer, PluginInstallStagingMode value
 
 
 /// <summary>Which tier this directory belongs to.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SkillDiscoveryScope : IEquatable<SkillDiscoveryScope>
@@ -26394,7 +26637,7 @@ public override void Write(Utf8JsonWriter writer, SkillDiscoveryScope value, Jso
 
 
 /// <summary>Where the agent definition was loaded from.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentInfoSource : IEquatable<AgentInfoSource>
@@ -26469,7 +26712,7 @@ public override void Write(Utf8JsonWriter writer, AgentInfoSource value, JsonSer
 
 
 /// <summary>Which tier this directory belongs to.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentDiscoveryPathScope : IEquatable<AgentDiscoveryPathScope>
@@ -26532,7 +26775,7 @@ public override void Write(Utf8JsonWriter writer, AgentDiscoveryPathScope value,
 
 
 /// <summary>Where this source lives — used for UI grouping.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct InstructionSourceLocation : IEquatable<InstructionSourceLocation>
@@ -26601,7 +26844,7 @@ public override void Write(Utf8JsonWriter writer, InstructionSourceLocation valu
 
 
 /// <summary>Category of instruction source — used for merge logic.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct InstructionSourceType : IEquatable<InstructionSourceType>
@@ -26679,7 +26922,7 @@ public override void Write(Utf8JsonWriter writer, InstructionSourceType value, J
 
 
 /// <summary>Whether the target is a single file or a directory of instruction files.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct InstructionDiscoveryPathKind : IEquatable<InstructionDiscoveryPathKind>
@@ -26742,7 +26985,7 @@ public override void Write(Utf8JsonWriter writer, InstructionDiscoveryPathKind v
 
 
 /// <summary>Which tier this target belongs to.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct InstructionDiscoveryPathLocation : IEquatable<InstructionDiscoveryPathLocation>
@@ -26811,7 +27054,7 @@ public override void Write(Utf8JsonWriter writer, InstructionDiscoveryPathLocati
 
 
 /// <summary>Optional completion hint for the input (e.g. 'directory' for filesystem path completion).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SlashCommandInputCompletion : IEquatable<SlashCommandInputCompletion>
@@ -26871,7 +27114,7 @@ public override void Write(Utf8JsonWriter writer, SlashCommandInputCompletion va
 
 
 /// <summary>Coarse command category for grouping and behavior: runtime built-in, skill-backed command, or SDK/client-owned command.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SlashCommandKind : IEquatable<SlashCommandKind>
@@ -26937,7 +27180,7 @@ public override void Write(Utf8JsonWriter writer, SlashCommandKind value, JsonSe
 
 
 /// <summary>Path conventions used by this filesystem.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionFsSetProviderConventions : IEquatable<SessionFsSetProviderConventions>
@@ -27000,7 +27243,7 @@ public override void Write(Utf8JsonWriter writer, SessionFsSetProviderConvention
 
 
 /// <summary>Repository host type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionContextHostType : IEquatable<SessionContextHostType>
@@ -27063,7 +27306,7 @@ public override void Write(Utf8JsonWriter writer, SessionContextHostType value,
 
 
 /// <summary>What a remote host says one of its sessions is doing right now. Deliberately coarse: this is what a host can report for EVERY session in a catalogue listing, without a client subscribing to each one. AHP's `SessionSummary.status` is the source today; `input-needed` covers both a permission prompt and an `ask_user` question, since the summary does not say which.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct RemoteSessionHostStatus : IEquatable<RemoteSessionHostStatus>
@@ -27132,7 +27375,7 @@ public override void Write(Utf8JsonWriter writer, RemoteSessionHostStatus value,
 
 
 /// <summary>Whether the remote task originated from CCA or CLI `--remote`.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct RemoteSessionMetadataTaskType : IEquatable<RemoteSessionMetadataTaskType>
@@ -27195,7 +27438,7 @@ public override void Write(Utf8JsonWriter writer, RemoteSessionMetadataTaskType
 
 
 /// <summary>Step status.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionsOpenProgressStatus : IEquatable<SessionsOpenProgressStatus>
@@ -27258,7 +27501,7 @@ public override void Write(Utf8JsonWriter writer, SessionsOpenProgressStatus val
 
 
 /// <summary>Handoff step.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionsOpenProgressStep : IEquatable<SessionsOpenProgressStep>
@@ -27333,7 +27576,7 @@ public override void Write(Utf8JsonWriter writer, SessionsOpenProgressStep value
 
 
 /// <summary>Outcome of the open request.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionsOpenStatus : IEquatable<SessionsOpenStatus>
@@ -27405,7 +27648,7 @@ public override void Write(Utf8JsonWriter writer, SessionsOpenStatus value, Json
 
 
 /// <summary>Neutral SDK discriminator for the connected remote session kind.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ConnectedRemoteSessionMetadataKind : IEquatable<ConnectedRemoteSessionMetadataKind>
@@ -27468,7 +27711,7 @@ public override void Write(Utf8JsonWriter writer, ConnectedRemoteSessionMetadata
 
 
 /// <summary>Which session sources to include. Defaults to `local` for backward compatibility.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionSource : IEquatable<SessionSource>
@@ -27534,7 +27777,7 @@ public override void Write(Utf8JsonWriter writer, SessionSource value, JsonSeria
 
 
 /// <summary>Cursor status: 'ok' means the read succeeded against the requested history; 'expired' means the requested continuation is unavailable. Recovery is endpoint-specific: session.eventLog.read returns a boundary window of remaining active history that may overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page and never switches journal generations. An expired persisted read is not successful completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct EventsCursorStatus : IEquatable<EventsCursorStatus>
@@ -27597,7 +27840,7 @@ public override void Write(Utf8JsonWriter writer, EventsCursorStatus value, Json
 
 
 /// <summary>Direction to page through the session's persisted event history. 'forward' pages from the cursor toward newer events; 'backward' returns the newest window first (tail-first) and pages toward older events. Events within a returned batch are always chronological (oldest-to-newest), even for a backward read.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct EventsReadDirection : IEquatable<EventsReadDirection>
@@ -27660,7 +27903,7 @@ public override void Write(Utf8JsonWriter writer, EventsReadDirection value, Jso
 
 
 /// <summary>Kind of attention required when status === "attention". Meaningful only when status === "attention".</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentRegistryLiveTargetEntryAttentionKind : IEquatable<AgentRegistryLiveTargetEntryAttentionKind>
@@ -27732,7 +27975,7 @@ public override void Write(Utf8JsonWriter writer, AgentRegistryLiveTargetEntryAt
 
 
 /// <summary>Process kind tag for the registry entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentRegistryLiveTargetEntryKind : IEquatable<AgentRegistryLiveTargetEntryKind>
@@ -27795,7 +28038,7 @@ public override void Write(Utf8JsonWriter writer, AgentRegistryLiveTargetEntryKi
 
 
 /// <summary>How the most recent turn ended (clean vs aborted). Lets the renderer distinguish done from done_cancelled.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentRegistryLiveTargetEntryLastTerminalEvent : IEquatable<AgentRegistryLiveTargetEntryLastTerminalEvent>
@@ -27858,7 +28101,7 @@ public override void Write(Utf8JsonWriter writer, AgentRegistryLiveTargetEntryLa
 
 
 /// <summary>Coarse lifecycle status of the foreground session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentRegistryLiveTargetEntryStatus : IEquatable<AgentRegistryLiveTargetEntryStatus>
@@ -27927,7 +28170,7 @@ public override void Write(Utf8JsonWriter writer, AgentRegistryLiveTargetEntrySt
 
 
 /// <summary>Categorized reason no canonical process log could be opened.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentRegistryLogCaptureOpenErrorReason : IEquatable<AgentRegistryLogCaptureOpenErrorReason>
@@ -27993,7 +28236,7 @@ public override void Write(Utf8JsonWriter writer, AgentRegistryLogCaptureOpenErr
 
 
 /// <summary>Which parameter field was invalid. Omitted when the rejection is not field-specific.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentRegistrySpawnValidationErrorField : IEquatable<AgentRegistrySpawnValidationErrorField>
@@ -28065,7 +28308,7 @@ public override void Write(Utf8JsonWriter writer, AgentRegistrySpawnValidationEr
 
 
 /// <summary>Categorized reason for the rejection. Low-cardinality enum so telemetry can aggregate by reason without leaking raw paths or agent/model names.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentRegistrySpawnValidationErrorReason : IEquatable<AgentRegistrySpawnValidationErrorReason>
@@ -28140,7 +28383,7 @@ public override void Write(Utf8JsonWriter writer, AgentRegistrySpawnValidationEr
 
 
 /// <summary>Permission posture for the new session. 'yolo' requires the controller-local session to currently be in allow-all mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AgentRegistrySpawnPermissionMode : IEquatable<AgentRegistrySpawnPermissionMode>
@@ -28203,7 +28446,7 @@ public override void Write(Utf8JsonWriter writer, AgentRegistrySpawnPermissionMo
 
 
 /// <summary>The UI mode the agent was in when this message was sent. Defaults to the session's current mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SendAgentMode : IEquatable<SendAgentMode>
@@ -28272,7 +28515,7 @@ public override void Write(Utf8JsonWriter writer, SendAgentMode value, JsonSeria
 
 
 /// <summary>How to deliver the message. `enqueue` (default) appends to the message queue. `immediate` interjects during an in-progress turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SendMode : IEquatable<SendMode>
@@ -28335,7 +28578,7 @@ public override void Write(Utf8JsonWriter writer, SendMode value, JsonSerializer
 
 
 /// <summary>Log severity level. Determines how the message is displayed in the timeline. Defaults to "info".</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionLogLevel : IEquatable<SessionLogLevel>
@@ -28401,7 +28644,7 @@ public override void Write(Utf8JsonWriter writer, SessionLogLevel value, JsonSer
 
 
 /// <summary>Disposition of a permission request as observed by the responding client.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionDecisionOutcome : IEquatable<PermissionDecisionOutcome>
@@ -28467,7 +28710,7 @@ public override void Write(Utf8JsonWriter writer, PermissionDecisionOutcome valu
 
 
 /// <summary>Response capability available to the client when it settled a permission request.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionResponseCapability : IEquatable<PermissionResponseCapability>
@@ -28533,7 +28776,7 @@ public override void Write(Utf8JsonWriter writer, PermissionResponseCapability v
 
 
 /// <summary>Client surface that submitted a permission response.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionDecisionSurface : IEquatable<PermissionDecisionSurface>
@@ -28605,7 +28848,7 @@ public override void Write(Utf8JsonWriter writer, PermissionDecisionSurface valu
 
 
 /// <summary>Authentication type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AuthInfoType : IEquatable<AuthInfoType>
@@ -28686,7 +28929,7 @@ public override void Write(Utf8JsonWriter writer, AuthInfoType value, JsonSerial
 
 
 /// <summary>Source category for a collected debug bundle entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct DebugCollectLogsSource : IEquatable<DebugCollectLogsSource>
@@ -28755,7 +28998,7 @@ public override void Write(Utf8JsonWriter writer, DebugCollectLogsSource value,
 
 
 /// <summary>Destination kind that was written.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct DebugCollectLogsResultKind : IEquatable<DebugCollectLogsResultKind>
@@ -28818,7 +29061,7 @@ public override void Write(Utf8JsonWriter writer, DebugCollectLogsResultKind val
 
 
 /// <summary>Kind of caller-provided debug log entry.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct DebugCollectLogsEntryKind : IEquatable<DebugCollectLogsEntryKind>
@@ -28881,7 +29124,7 @@ public override void Write(Utf8JsonWriter writer, DebugCollectLogsEntryKind valu
 
 
 /// <summary>How a collected debug entry should be redacted before being staged.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct DebugCollectLogsRedaction : IEquatable<DebugCollectLogsRedaction>
@@ -28947,7 +29190,7 @@ public override void Write(Utf8JsonWriter writer, DebugCollectLogsRedaction valu
 
 
 /// <summary>Cumulative resource ceiling that stopped a factory run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FactoryRunFailureKind : IEquatable<FactoryRunFailureKind>
@@ -29013,7 +29256,7 @@ public override void Write(Utf8JsonWriter writer, FactoryRunFailureKind value, J
 
 
 /// <summary>Execution-critical factory storage operation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FactoryDurableOperation : IEquatable<FactoryDurableOperation>
@@ -29103,7 +29346,7 @@ public override void Write(Utf8JsonWriter writer, FactoryDurableOperation value,
 
 
 /// <summary>Current or terminal state of a factory run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FactoryRunStatus : IEquatable<FactoryRunStatus>
@@ -29181,7 +29424,7 @@ public override void Write(Utf8JsonWriter writer, FactoryRunStatus value, JsonSe
 
 
 /// <summary>Derived lifecycle state of a factory phase.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FactoryPhaseStatus : IEquatable<FactoryPhaseStatus>
@@ -29250,7 +29493,7 @@ public override void Write(Utf8JsonWriter writer, FactoryPhaseStatus value, Json
 
 
 /// <summary>Kind of factory progress line.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FactoryLogLineKind : IEquatable<FactoryLogLineKind>
@@ -29313,7 +29556,7 @@ public override void Write(Utf8JsonWriter writer, FactoryLogLineKind value, Json
 
 
 /// <summary>Action the runtime selected for a durable factory pause checkpoint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FactoryPauseCheckpointAction : IEquatable<FactoryPauseCheckpointAction>
@@ -29376,7 +29619,7 @@ public override void Write(Utf8JsonWriter writer, FactoryPauseCheckpointAction v
 
 
 /// <summary>Cumulative resource ceiling that stopped a workflow run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkflowRunFailureKind : IEquatable<WorkflowRunFailureKind>
@@ -29442,7 +29685,7 @@ public override void Write(Utf8JsonWriter writer, WorkflowRunFailureKind value,
 
 
 /// <summary>Execution-critical workflow storage operation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkflowDurableOperation : IEquatable<WorkflowDurableOperation>
@@ -29532,7 +29775,7 @@ public override void Write(Utf8JsonWriter writer, WorkflowDurableOperation value
 
 
 /// <summary>Current or terminal state of a workflow run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkflowRunStatus : IEquatable<WorkflowRunStatus>
@@ -29610,7 +29853,7 @@ public override void Write(Utf8JsonWriter writer, WorkflowRunStatus value, JsonS
 
 
 /// <summary>Derived lifecycle state of a workflow phase.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkflowPhaseStatus : IEquatable<WorkflowPhaseStatus>
@@ -29679,7 +29922,7 @@ public override void Write(Utf8JsonWriter writer, WorkflowPhaseStatus value, Jso
 
 
 /// <summary>Kind of workflow progress line.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkflowLogLineKind : IEquatable<WorkflowLogLineKind>
@@ -29742,7 +29985,7 @@ public override void Write(Utf8JsonWriter writer, WorkflowLogLineKind value, Jso
 
 
 /// <summary>Action the runtime selected for a durable workflow pause checkpoint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkflowPauseCheckpointAction : IEquatable<WorkflowPauseCheckpointAction>
@@ -29805,7 +30048,7 @@ public override void Write(Utf8JsonWriter writer, WorkflowPauseCheckpointAction
 
 
 /// <summary>Whether the requested preference was already effective or was accepted for later transactional activation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ModelSwitchAutoTierStatus : IEquatable<ModelSwitchAutoTierStatus>
@@ -29868,7 +30111,7 @@ public override void Write(Utf8JsonWriter writer, ModelSwitchAutoTierStatus valu
 
 
 /// <summary>Allowed values for the `WorkspacesWorkspaceDetailsHostType` enumeration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkspacesWorkspaceDetailsHostType : IEquatable<WorkspacesWorkspaceDetailsHostType>
@@ -29931,7 +30174,7 @@ public override void Write(Utf8JsonWriter writer, WorkspacesWorkspaceDetailsHost
 
 
 /// <summary>Type of change represented by this file diff.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkspaceDiffFileChangeType : IEquatable<WorkspaceDiffFileChangeType>
@@ -30000,7 +30243,7 @@ public override void Write(Utf8JsonWriter writer, WorkspaceDiffFileChangeType va
 
 
 /// <summary>Diff mode requested by the client.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkspaceDiffMode : IEquatable<WorkspaceDiffMode>
@@ -30066,7 +30309,7 @@ public override void Write(Utf8JsonWriter writer, WorkspaceDiffMode value, JsonS
 
 
 /// <summary>Reason a rewind read (rewind points, file-restore preview, or session diff) could not be answered from the session's file-change captures.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct HistoryRewindUnavailableReason : IEquatable<HistoryRewindUnavailableReason>
@@ -30132,7 +30375,7 @@ public override void Write(Utf8JsonWriter writer, HistoryRewindUnavailableReason
 
 
 /// <summary>Current normalized autopilot objective lifecycle status.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AutopilotObjectiveStatus : IEquatable<AutopilotObjectiveStatus>
@@ -30198,7 +30441,7 @@ public override void Write(Utf8JsonWriter writer, AutopilotObjectiveStatus value
 
 
 /// <summary>Whether task execution is synchronously awaited or managed in the background.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskExecutionMode : IEquatable<TaskExecutionMode>
@@ -30261,7 +30504,7 @@ public override void Write(Utf8JsonWriter writer, TaskExecutionMode value, JsonS
 
 
 /// <summary>Current lifecycle status of the task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskStatus : IEquatable<TaskStatus>
@@ -30333,7 +30576,7 @@ public override void Write(Utf8JsonWriter writer, TaskStatus value, JsonSerializ
 
 
 /// <summary>Client-owned tasks always execute outside the runtime in background mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskClientExecutionMode : IEquatable<TaskClientExecutionMode>
@@ -30393,7 +30636,7 @@ public override void Write(Utf8JsonWriter writer, TaskClientExecutionMode value,
 
 
 /// <summary>Connection class owning a client task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskClientOwnerKind : IEquatable<TaskClientOwnerKind>
@@ -30456,7 +30699,7 @@ public override void Write(Utf8JsonWriter writer, TaskClientOwnerKind value, Jso
 
 
 /// <summary>Presence of the task's bound join.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskClientOwnerPresence : IEquatable<TaskClientOwnerPresence>
@@ -30519,7 +30762,7 @@ public override void Write(Utf8JsonWriter writer, TaskClientOwnerPresence value,
 
 
 /// <summary>Lifecycle status of a client-owned task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskClientStatus : IEquatable<TaskClientStatus>
@@ -30594,7 +30837,7 @@ public override void Write(Utf8JsonWriter writer, TaskClientStatus value, JsonSe
 
 
 /// <summary>Whether the shell runs inside a managed PTY session or as an independent background process.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskShellInfoAttachmentMode : IEquatable<TaskShellInfoAttachmentMode>
@@ -30657,7 +30900,7 @@ public override void Write(Utf8JsonWriter writer, TaskShellInfoAttachmentMode va
 
 
 /// <summary>Discriminator for a client-owned task.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskClientType : IEquatable<TaskClientType>
@@ -30717,7 +30960,7 @@ public override void Write(Utf8JsonWriter writer, TaskClientType value, JsonSeri
 
 
 /// <summary>Active status a client owner may publish with a progress update.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct TaskClientActiveStatus : IEquatable<TaskClientActiveStatus>
@@ -30780,7 +31023,7 @@ public override void Write(Utf8JsonWriter writer, TaskClientActiveStatus value,
 
 
 /// <summary>Consumer allowed to call an MCP tool.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpToolUiVisibility : IEquatable<McpToolUiVisibility>
@@ -30843,7 +31086,7 @@ public override void Write(Utf8JsonWriter writer, McpToolUiVisibility value, Jso
 
 
 /// <summary>Outcome of the sampling inference. 'success' produced a response; 'failure' encountered an error (including agent-side rejection by content filter or criteria); 'cancelled' the caller cancelled this execution via cancelSamplingExecution.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpSamplingExecutionAction : IEquatable<McpSamplingExecutionAction>
@@ -30909,7 +31152,7 @@ public override void Write(Utf8JsonWriter writer, McpSamplingExecutionAction val
 
 
 /// <summary>How environment-variable values supplied to MCP servers are resolved. "direct" passes literal string values; "indirect" treats values as references (e.g. names of environment variables on the host) that the runtime resolves before launch. Defaults to the runtime's startup mode; clients that intentionally launch MCP servers with literal values (e.g. CLI prompt mode and ACP) set this to "direct".</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpSetEnvValueModeDetails : IEquatable<McpSetEnvValueModeDetails>
@@ -30972,7 +31215,7 @@ public override void Write(Utf8JsonWriter writer, McpSetEnvValueModeDetails valu
 
 
 /// <summary>OAuth grant type override for this login.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpOauthLoginGrantType : IEquatable<McpOauthLoginGrantType>
@@ -31035,7 +31278,7 @@ public override void Write(Utf8JsonWriter writer, McpOauthLoginGrantType value,
 
 
 /// <summary>Why a passive MCP OAuth probe determined authentication is needed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpOauthProbeNeedsAuthReason : IEquatable<McpOauthProbeNeedsAuthReason>
@@ -31101,7 +31344,7 @@ public override void Write(Utf8JsonWriter writer, McpOauthProbeNeedsAuthReason v
 
 
 /// <summary>Allowed values for the `McpAppsSetHostContextDetailsAvailableDisplayMode` enumeration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpAppsSetHostContextDetailsAvailableDisplayMode : IEquatable<McpAppsSetHostContextDetailsAvailableDisplayMode>
@@ -31167,7 +31410,7 @@ public override void Write(Utf8JsonWriter writer, McpAppsSetHostContextDetailsAv
 
 
 /// <summary>Current display mode (SEP-1865).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpAppsSetHostContextDetailsDisplayMode : IEquatable<McpAppsSetHostContextDetailsDisplayMode>
@@ -31233,7 +31476,7 @@ public override void Write(Utf8JsonWriter writer, McpAppsSetHostContextDetailsDi
 
 
 /// <summary>Platform type for responsive design.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpAppsSetHostContextDetailsPlatform : IEquatable<McpAppsSetHostContextDetailsPlatform>
@@ -31299,7 +31542,7 @@ public override void Write(Utf8JsonWriter writer, McpAppsSetHostContextDetailsPl
 
 
 /// <summary>UI theme preference per SEP-1865.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpAppsSetHostContextDetailsTheme : IEquatable<McpAppsSetHostContextDetailsTheme>
@@ -31362,7 +31605,7 @@ public override void Write(Utf8JsonWriter writer, McpAppsSetHostContextDetailsTh
 
 
 /// <summary>Allowed values for the `McpAppsHostContextDetailsAvailableDisplayMode` enumeration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpAppsHostContextDetailsAvailableDisplayMode : IEquatable<McpAppsHostContextDetailsAvailableDisplayMode>
@@ -31428,7 +31671,7 @@ public override void Write(Utf8JsonWriter writer, McpAppsHostContextDetailsAvail
 
 
 /// <summary>Current display mode (SEP-1865).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpAppsHostContextDetailsDisplayMode : IEquatable<McpAppsHostContextDetailsDisplayMode>
@@ -31494,7 +31737,7 @@ public override void Write(Utf8JsonWriter writer, McpAppsHostContextDetailsDispl
 
 
 /// <summary>Platform type for responsive design.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpAppsHostContextDetailsPlatform : IEquatable<McpAppsHostContextDetailsPlatform>
@@ -31560,7 +31803,7 @@ public override void Write(Utf8JsonWriter writer, McpAppsHostContextDetailsPlatf
 
 
 /// <summary>UI theme preference per SEP-1865.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpAppsHostContextDetailsTheme : IEquatable<McpAppsHostContextDetailsTheme>
@@ -31622,8 +31865,410 @@ public override void Write(Utf8JsonWriter writer, McpAppsHostContextDetailsTheme
 }
 
 
+/// <summary>Session-scoped diagnostic threshold. Capture is disabled by default and is never persisted with the session.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct DiagnosticLogLevel : IEquatable<DiagnosticLogLevel>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="DiagnosticLogLevel"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="DiagnosticLogLevel"/>.</param>
+    [JsonConstructor]
+    public DiagnosticLogLevel(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="DiagnosticLogLevel"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Disable capture and clear retained diagnostics.</summary>
+    public static DiagnosticLogLevel Off { get; } = new("off");
+
+    /// <summary>Capture failures only.</summary>
+    public static DiagnosticLogLevel Error { get; } = new("error");
+
+    /// <summary>Capture failures, warnings, and stderr.</summary>
+    public static DiagnosticLogLevel Warning { get; } = new("warning");
+
+    /// <summary>Capture lifecycle diagnostics.</summary>
+    public static DiagnosticLogLevel Info { get; } = new("info");
+
+    /// <summary>Capture protocol frames and launch diagnostics.</summary>
+    public static DiagnosticLogLevel Debug { get; } = new("debug");
+
+    /// <summary>Capture HTTP metadata in addition to debug diagnostics.</summary>
+    public static DiagnosticLogLevel Trace { get; } = new("trace");
+
+    /// <summary>Returns a value indicating whether two <see cref="DiagnosticLogLevel"/> instances are equivalent.</summary>
+    public static bool operator ==(DiagnosticLogLevel left, DiagnosticLogLevel right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="DiagnosticLogLevel"/> instances are not equivalent.</summary>
+    public static bool operator !=(DiagnosticLogLevel left, DiagnosticLogLevel right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is DiagnosticLogLevel other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(DiagnosticLogLevel other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{DiagnosticLogLevel}"/> for serializing <see cref="DiagnosticLogLevel"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<DiagnosticLogLevel>
+    {
+        /// <inheritdoc />
+        public override DiagnosticLogLevel Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, DiagnosticLogLevel value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(DiagnosticLogLevel));
+        }
+    }
+}
+
+
+/// <summary>Whether the supplied diagnostic cursor remained within the retained buffer window.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct DiagnosticCursorStatus : IEquatable<DiagnosticCursorStatus>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="DiagnosticCursorStatus"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="DiagnosticCursorStatus"/>.</param>
+    [JsonConstructor]
+    public DiagnosticCursorStatus(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="DiagnosticCursorStatus"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>The cursor is valid for the current retained window.</summary>
+    public static DiagnosticCursorStatus Ok { get; } = new("ok");
+
+    /// <summary>The cursor no longer addresses retained records; reading resumes at the oldest retained record.</summary>
+    public static DiagnosticCursorStatus Expired { get; } = new("expired");
+
+    /// <summary>Returns a value indicating whether two <see cref="DiagnosticCursorStatus"/> instances are equivalent.</summary>
+    public static bool operator ==(DiagnosticCursorStatus left, DiagnosticCursorStatus right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="DiagnosticCursorStatus"/> instances are not equivalent.</summary>
+    public static bool operator !=(DiagnosticCursorStatus left, DiagnosticCursorStatus right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is DiagnosticCursorStatus other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(DiagnosticCursorStatus other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{DiagnosticCursorStatus}"/> for serializing <see cref="DiagnosticCursorStatus"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<DiagnosticCursorStatus>
+    {
+        /// <inheritdoc />
+        public override DiagnosticCursorStatus Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, DiagnosticCursorStatus value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(DiagnosticCursorStatus));
+        }
+    }
+}
+
+
+/// <summary>Direction of an observed MCP protocol frame.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpDiagnosticDirection : IEquatable<McpDiagnosticDirection>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="McpDiagnosticDirection"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpDiagnosticDirection"/>.</param>
+    [JsonConstructor]
+    public McpDiagnosticDirection(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="McpDiagnosticDirection"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Frame emitted by the Copilot MCP client.</summary>
+    public static McpDiagnosticDirection ClientToServer { get; } = new("client-to-server");
+
+    /// <summary>Frame received from the MCP server.</summary>
+    public static McpDiagnosticDirection ServerToClient { get; } = new("server-to-client");
+
+    /// <summary>Returns a value indicating whether two <see cref="McpDiagnosticDirection"/> instances are equivalent.</summary>
+    public static bool operator ==(McpDiagnosticDirection left, McpDiagnosticDirection right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="McpDiagnosticDirection"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpDiagnosticDirection left, McpDiagnosticDirection right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpDiagnosticDirection other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(McpDiagnosticDirection other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{McpDiagnosticDirection}"/> for serializing <see cref="McpDiagnosticDirection"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpDiagnosticDirection>
+    {
+        /// <inheritdoc />
+        public override McpDiagnosticDirection Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpDiagnosticDirection value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpDiagnosticDirection));
+        }
+    }
+}
+
+
+/// <summary>Category for an MCP diagnostic record.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct McpDiagnosticKind : IEquatable<McpDiagnosticKind>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="McpDiagnosticKind"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="McpDiagnosticKind"/>.</param>
+    [JsonConstructor]
+    public McpDiagnosticKind(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="McpDiagnosticKind"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Connection lifecycle transition or failure.</summary>
+    public static McpDiagnosticKind Lifecycle { get; } = new("lifecycle");
+
+    /// <summary>JSON-RPC protocol frame.</summary>
+    public static McpDiagnosticKind Protocol { get; } = new("protocol");
+
+    /// <summary>HTTP request or response metadata.</summary>
+    public static McpDiagnosticKind Http { get; } = new("http");
+
+    /// <summary>Local MCP server standard-error output.</summary>
+    public static McpDiagnosticKind Stderr { get; } = new("stderr");
+
+    /// <summary>Returns a value indicating whether two <see cref="McpDiagnosticKind"/> instances are equivalent.</summary>
+    public static bool operator ==(McpDiagnosticKind left, McpDiagnosticKind right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="McpDiagnosticKind"/> instances are not equivalent.</summary>
+    public static bool operator !=(McpDiagnosticKind left, McpDiagnosticKind right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is McpDiagnosticKind other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(McpDiagnosticKind other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{McpDiagnosticKind}"/> for serializing <see cref="McpDiagnosticKind"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<McpDiagnosticKind>
+    {
+        /// <inheritdoc />
+        public override McpDiagnosticKind Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, McpDiagnosticKind value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(McpDiagnosticKind));
+        }
+    }
+}
+
+
+/// <summary>Severity of an emitted diagnostic record.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct DiagnosticSeverity : IEquatable<DiagnosticSeverity>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="DiagnosticSeverity"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="DiagnosticSeverity"/>.</param>
+    [JsonConstructor]
+    public DiagnosticSeverity(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="DiagnosticSeverity"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Failure that prevented or interrupted communication.</summary>
+    public static DiagnosticSeverity Error { get; } = new("error");
+
+    /// <summary>A recoverable warning or server standard-error output.</summary>
+    public static DiagnosticSeverity Warning { get; } = new("warning");
+
+    /// <summary>Lifecycle transition.</summary>
+    public static DiagnosticSeverity Info { get; } = new("info");
+
+    /// <summary>Protocol-frame or launch diagnostic.</summary>
+    public static DiagnosticSeverity Debug { get; } = new("debug");
+
+    /// <summary>HTTP metadata diagnostic.</summary>
+    public static DiagnosticSeverity Trace { get; } = new("trace");
+
+    /// <summary>Returns a value indicating whether two <see cref="DiagnosticSeverity"/> instances are equivalent.</summary>
+    public static bool operator ==(DiagnosticSeverity left, DiagnosticSeverity right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="DiagnosticSeverity"/> instances are not equivalent.</summary>
+    public static bool operator !=(DiagnosticSeverity left, DiagnosticSeverity right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is DiagnosticSeverity other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(DiagnosticSeverity other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{DiagnosticSeverity}"/> for serializing <see cref="DiagnosticSeverity"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<DiagnosticSeverity>
+    {
+        /// <inheritdoc />
+        public override DiagnosticSeverity Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, DiagnosticSeverity value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(DiagnosticSeverity));
+        }
+    }
+}
+
+
+/// <summary>A supported diagnostic source.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+[JsonConverter(typeof(Converter))]
+[DebuggerDisplay("{Value,nq}")]
+public readonly struct DiagnosticSource : IEquatable<DiagnosticSource>
+{
+    private readonly string? _value;
+
+    /// <summary>Initializes a new instance of the <see cref="DiagnosticSource"/> struct.</summary>
+    /// <param name="value">The value to associate with this <see cref="DiagnosticSource"/>.</param>
+    [JsonConstructor]
+    public DiagnosticSource(string value)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(value);
+        _value = value;
+    }
+
+    /// <summary>Gets the value associated with this <see cref="DiagnosticSource"/>.</summary>
+    public string Value => _value ?? string.Empty;
+
+    /// <summary>Gets the <c>mcp</c> value.</summary>
+    public static DiagnosticSource Mcp { get; } = new("mcp");
+
+    /// <summary>Returns a value indicating whether two <see cref="DiagnosticSource"/> instances are equivalent.</summary>
+    public static bool operator ==(DiagnosticSource left, DiagnosticSource right) => left.Equals(right);
+
+    /// <summary>Returns a value indicating whether two <see cref="DiagnosticSource"/> instances are not equivalent.</summary>
+    public static bool operator !=(DiagnosticSource left, DiagnosticSource right) => !(left == right);
+
+    /// <inheritdoc />
+    public override bool Equals(object? obj) => obj is DiagnosticSource other && Equals(other);
+
+    /// <inheritdoc />
+    public bool Equals(DiagnosticSource other) => string.Equals(Value, other.Value, StringComparison.OrdinalIgnoreCase);
+
+    /// <inheritdoc />
+    public override int GetHashCode() => StringComparer.OrdinalIgnoreCase.GetHashCode(Value);
+
+    /// <inheritdoc />
+    public override string ToString() => Value;
+
+    /// <summary>Provides a <see cref="JsonConverter{DiagnosticSource}"/> for serializing <see cref="DiagnosticSource"/> instances.</summary>
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class Converter : JsonConverter<DiagnosticSource>
+    {
+        /// <inheritdoc />
+        public override DiagnosticSource Read(ref Utf8JsonReader reader, Type typeToConvert, JsonSerializerOptions options)
+        {
+            return new(GeneratedStringEnumJson.ReadValue(ref reader, typeToConvert));
+        }
+
+        /// <inheritdoc />
+        public override void Write(Utf8JsonWriter writer, DiagnosticSource value, JsonSerializerOptions options)
+        {
+            GeneratedStringEnumJson.WriteValue(writer, value.Value, typeof(DiagnosticSource));
+        }
+    }
+}
+
+
 /// <summary>Availability of the EXPERIMENTAL session connector API.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ConnectorAvailability : IEquatable<ConnectorAvailability>
@@ -31689,7 +32334,7 @@ public override void Write(Utf8JsonWriter writer, ConnectorAvailability value, J
 
 
 /// <summary>Stable OAuth scope whose absence prevents Connector management.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ConnectorAuthorizationScope : IEquatable<ConnectorAuthorizationScope>
@@ -31749,7 +32394,7 @@ public override void Write(Utf8JsonWriter writer, ConnectorAuthorizationScope va
 
 
 /// <summary>Authoritative service connection state for one Connector.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ConnectorCatalogStatus : IEquatable<ConnectorCatalogStatus>
@@ -31821,7 +32466,7 @@ public override void Write(Utf8JsonWriter writer, ConnectorCatalogStatus value,
 
 
 /// <summary>Live MCP status of one Connector-owned runtime server.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ConnectorMcpStatus : IEquatable<ConnectorMcpStatus>
@@ -31899,7 +32544,7 @@ public override void Write(Utf8JsonWriter writer, ConnectorMcpStatus value, Json
 
 
 /// <summary>Transport to be used for provider requests.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProviderEndpointTransport : IEquatable<ProviderEndpointTransport>
@@ -31962,7 +32607,7 @@ public override void Write(Utf8JsonWriter writer, ProviderEndpointTransport valu
 
 
 /// <summary>Provider family. Matches the `type` field of a BYOK provider config.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProviderEndpointType : IEquatable<ProviderEndpointType>
@@ -32028,7 +32673,7 @@ public override void Write(Utf8JsonWriter writer, ProviderEndpointType value, Js
 
 
 /// <summary>Wire API to be used, when required for the provider type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProviderEndpointWireApi : IEquatable<ProviderEndpointWireApi>
@@ -32091,7 +32736,7 @@ public override void Write(Utf8JsonWriter writer, ProviderEndpointWireApi value,
 
 
 /// <summary>Defines the allowed values.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProtocolAppendMode : IEquatable<ProtocolAppendMode>
@@ -32151,7 +32796,7 @@ public override void Write(Utf8JsonWriter writer, ProtocolAppendMode value, Json
 
 
 /// <summary>Defines the allowed values.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProtocolReplaceMode : IEquatable<ProtocolReplaceMode>
@@ -32211,7 +32856,7 @@ public override void Write(Utf8JsonWriter writer, ProtocolReplaceMode value, Jso
 
 
 /// <summary>Defines the allowed values.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProtocolCustomizeMode : IEquatable<ProtocolCustomizeMode>
@@ -32271,7 +32916,7 @@ public override void Write(Utf8JsonWriter writer, ProtocolCustomizeMode value, J
 
 
 /// <summary>Defines the allowed values.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProtocolStaticSectionAction : IEquatable<ProtocolStaticSectionAction>
@@ -32340,7 +32985,7 @@ public override void Write(Utf8JsonWriter writer, ProtocolStaticSectionAction va
 
 
 /// <summary>Provider transport. Defaults to "http".</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProviderConfigTransport : IEquatable<ProviderConfigTransport>
@@ -32403,7 +33048,7 @@ public override void Write(Utf8JsonWriter writer, ProviderConfigTransport value,
 
 
 /// <summary>Provider type. Defaults to "openai" for generic OpenAI-compatible APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProviderConfigType : IEquatable<ProviderConfigType>
@@ -32469,7 +33114,7 @@ public override void Write(Utf8JsonWriter writer, ProviderConfigType value, Json
 
 
 /// <summary>Wire API format (openai/azure only). Defaults to "completions".</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProviderConfigWireApi : IEquatable<ProviderConfigWireApi>
@@ -32532,7 +33177,7 @@ public override void Write(Utf8JsonWriter writer, ProviderConfigWireApi value, J
 
 
 /// <summary>Allowed values for the `OptionsUpdateAdditionalContentExclusionPolicyScope` enumeration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct OptionsUpdateAdditionalContentExclusionPolicyScope : IEquatable<OptionsUpdateAdditionalContentExclusionPolicyScope>
@@ -32595,7 +33240,7 @@ public override void Write(Utf8JsonWriter writer, OptionsUpdateAdditionalContent
 
 
 /// <summary>Context tier for models with tiered pricing. The session uses this to derive effective `modelCapabilitiesOverrides` so compaction, truncation, token display, and request limits honor the selected tier.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct OptionsUpdateContextTier : IEquatable<OptionsUpdateContextTier>
@@ -32658,7 +33303,7 @@ public override void Write(Utf8JsonWriter writer, OptionsUpdateContextTier value
 
 
 /// <summary>How env values are passed to MCP servers (`direct` inlines literal values; `indirect` resolves at launch).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct OptionsUpdateEnvValueMode : IEquatable<OptionsUpdateEnvValueMode>
@@ -32721,7 +33366,7 @@ public override void Write(Utf8JsonWriter writer, OptionsUpdateEnvValueMode valu
 
 
 /// <summary>Reasoning summary mode for supported model clients.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct OptionsUpdateReasoningSummary : IEquatable<OptionsUpdateReasoningSummary>
@@ -32787,7 +33432,7 @@ public override void Write(Utf8JsonWriter writer, OptionsUpdateReasoningSummary
 
 
 /// <summary>Origin of the sandbox choice supplied by an internal client.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SandboxConfigSource : IEquatable<SandboxConfigSource>
@@ -32865,7 +33510,7 @@ public override void Write(Utf8JsonWriter writer, SandboxConfigSource value, Jso
 
 
 /// <summary>Session capability enabled for this session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionCapability : IEquatable<SessionCapability>
@@ -32955,7 +33600,7 @@ public override void Write(Utf8JsonWriter writer, SessionCapability value, JsonS
 
 
 /// <summary>Controls automatic non-interactive profile loading where supported. Explicit initScripts are unaffected.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ShellInitProfile : IEquatable<ShellInitProfile>
@@ -33018,7 +33663,7 @@ public override void Write(Utf8JsonWriter writer, ShellInitProfile value, JsonSe
 
 
 /// <summary>Supported built-in shells for initialization scripts.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ShellInitScriptShell : IEquatable<ShellInitScriptShell>
@@ -33081,7 +33726,7 @@ public override void Write(Utf8JsonWriter writer, ShellInitScriptShell value, Js
 
 
 /// <summary>Controls how availableTools (allowlist) and excludedTools (denylist) combine when both are set.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct OptionsUpdateToolFilterPrecedence : IEquatable<OptionsUpdateToolFilterPrecedence>
@@ -33144,7 +33789,7 @@ public override void Write(Utf8JsonWriter writer, OptionsUpdateToolFilterPrecede
 
 
 /// <summary>Discovery source: project (.github/extensions/), user (~/.copilot/extensions/), plugin (installed plugin), or session (session-state/&lt;id&gt;/extensions/).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ExtensionSource : IEquatable<ExtensionSource>
@@ -33213,7 +33858,7 @@ public override void Write(Utf8JsonWriter writer, ExtensionSource value, JsonSer
 
 
 /// <summary>Current status: running, disabled, failed, or starting.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ExtensionStatus : IEquatable<ExtensionStatus>
@@ -33282,7 +33927,7 @@ public override void Write(Utf8JsonWriter writer, ExtensionStatus value, JsonSer
 
 
 /// <summary>Type of GitHub reference.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PushAttachmentGitHubReferenceType : IEquatable<PushAttachmentGitHubReferenceType>
@@ -33348,7 +33993,7 @@ public override void Write(Utf8JsonWriter writer, PushAttachmentGitHubReferenceT
 
 
 /// <summary>Custom input-format kind.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct BuiltinToolFormatType : IEquatable<BuiltinToolFormatType>
@@ -33408,7 +34053,7 @@ public override void Write(Utf8JsonWriter writer, BuiltinToolFormatType value, J
 
 
 /// <summary>Root JSON Schema type for a built-in tool input.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct BuiltinToolInputSchemaType : IEquatable<BuiltinToolInputSchemaType>
@@ -33468,7 +34113,7 @@ public override void Write(Utf8JsonWriter writer, BuiltinToolInputSchemaType val
 
 
 /// <summary>Binary result type discriminator. Use "image" for images and "resource" for other binary data.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ExternalToolTextResultForLlmBinaryResultsForLlmType : IEquatable<ExternalToolTextResultForLlmBinaryResultsForLlmType>
@@ -33531,7 +34176,7 @@ public override void Write(Utf8JsonWriter writer, ExternalToolTextResultForLlmBi
 
 
 /// <summary>Theme variant this icon is intended for.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ExternalToolTextResultForLlmContentResourceLinkIconTheme : IEquatable<ExternalToolTextResultForLlmContentResourceLinkIconTheme>
@@ -33594,7 +34239,7 @@ public override void Write(Utf8JsonWriter writer, ExternalToolTextResultForLlmCo
 
 
 /// <summary>Execution outcome classification.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ToolResultType : IEquatable<ToolResultType>
@@ -33666,7 +34311,7 @@ public override void Write(Utf8JsonWriter writer, ToolResultType value, JsonSeri
 
 
 /// <summary>Controls whether the runtime may defer loading an external tool definition.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ProtocolExternalToolDefer : IEquatable<ProtocolExternalToolDefer>
@@ -33729,7 +34374,7 @@ public override void Write(Utf8JsonWriter writer, ProtocolExternalToolDefer valu
 
 
 /// <summary>Context tier override for matching subagents.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SubagentSettingsEntryContextTier : IEquatable<SubagentSettingsEntryContextTier>
@@ -33795,7 +34440,7 @@ public override void Write(Utf8JsonWriter writer, SubagentSettingsEntryContextTi
 
 
 /// <summary>A session-scoped sandbox transition applied while handling a slash command.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SandboxSessionChange : IEquatable<SandboxSessionChange>
@@ -33858,7 +34503,7 @@ public override void Write(Utf8JsonWriter writer, SandboxSessionChange value, Js
 
 
 /// <summary>Defines the allowed values.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CommandsInvocationOrigin : IEquatable<CommandsInvocationOrigin>
@@ -33918,7 +34563,7 @@ public override void Write(Utf8JsonWriter writer, CommandsInvocationOrigin value
 
 
 /// <summary>Whether a pending slash-command invocation effect was applied or cancelled by the host.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CommandsInvocationEffectOutcome : IEquatable<CommandsInvocationEffectOutcome>
@@ -33981,7 +34626,7 @@ public override void Write(Utf8JsonWriter writer, CommandsInvocationEffectOutcom
 
 
 /// <summary>The user's response: accept (submitted), decline (rejected), or cancel (dismissed).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct UIElicitationResponseAction : IEquatable<UIElicitationResponseAction>
@@ -34047,7 +34692,7 @@ public override void Write(Utf8JsonWriter writer, UIElicitationResponseAction va
 
 
 /// <summary>Structured MCP elicitation mode.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct McpElicitationFormMode : IEquatable<McpElicitationFormMode>
@@ -34107,7 +34752,7 @@ public override void Write(Utf8JsonWriter writer, McpElicitationFormMode value,
 
 
 /// <summary>User's choice for auto-mode switching: yes (allow this turn), yes_always (allow + persist as setting), or no (decline).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct UIAutoModeSwitchResponse : IEquatable<UIAutoModeSwitchResponse>
@@ -34173,7 +34818,7 @@ public override void Write(Utf8JsonWriter writer, UIAutoModeSwitchResponse value
 
 
 /// <summary>User action selected for an exhausted session limit.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct UISessionLimitsExhaustedResponseAction : IEquatable<UISessionLimitsExhaustedResponseAction>
@@ -34242,7 +34887,7 @@ public override void Write(Utf8JsonWriter writer, UISessionLimitsExhaustedRespon
 
 
 /// <summary>The action the user selected. Defaults to 'autopilot' when autoApproveEdits is true, otherwise 'interactive'.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct UIExitPlanModeAction : IEquatable<UIExitPlanModeAction>
@@ -34311,7 +34956,7 @@ public override void Write(Utf8JsonWriter writer, UIExitPlanModeAction value, Js
 
 
 /// <summary>Allowed values for the `PermissionsConfigureAdditionalContentExclusionPolicyScope` enumeration.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionsConfigureAdditionalContentExclusionPolicyScope : IEquatable<PermissionsConfigureAdditionalContentExclusionPolicyScope>
@@ -34374,7 +35019,7 @@ public override void Write(Utf8JsonWriter writer, PermissionsConfigureAdditional
 
 
 /// <summary>Optional source for allow-all telemetry. Defaults to `rpc` when omitted for SDK callers.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionsSetApproveAllSource : IEquatable<PermissionsSetApproveAllSource>
@@ -34446,7 +35091,7 @@ public override void Write(Utf8JsonWriter writer, PermissionsSetApproveAllSource
 
 
 /// <summary>Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionModeSource : IEquatable<PermissionModeSource>
@@ -34521,7 +35166,7 @@ public override void Write(Utf8JsonWriter writer, PermissionModeSource value, Js
 
 
 /// <summary>Whether the change applies to ephemeral session-scoped rules (cleared at session end) or to location-scoped rules persisted via the location-permissions config file.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionsModifyRulesScope : IEquatable<PermissionsModifyRulesScope>
@@ -34584,7 +35229,7 @@ public override void Write(Utf8JsonWriter writer, PermissionsModifyRulesScope va
 
 
 /// <summary>Whether the location is a git repo or directory.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionLocationType : IEquatable<PermissionLocationType>
@@ -34647,7 +35292,7 @@ public override void Write(Utf8JsonWriter writer, PermissionLocationType value,
 
 
 /// <summary>The current agent mode for this session (e.g., 'interactive', 'plan', 'autopilot').</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct MetadataSnapshotCurrentMode : IEquatable<MetadataSnapshotCurrentMode>
@@ -34713,7 +35358,7 @@ public override void Write(Utf8JsonWriter writer, MetadataSnapshotCurrentMode va
 
 
 /// <summary>Whether the remote task originated from Copilot Coding Agent (cca) or a CLI `--remote` invocation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct MetadataSnapshotRemoteMetadataTaskType : IEquatable<MetadataSnapshotRemoteMetadataTaskType>
@@ -34776,7 +35421,7 @@ public override void Write(Utf8JsonWriter writer, MetadataSnapshotRemoteMetadata
 
 
 /// <summary>Repository host type, if known.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct WorkspaceSummaryHostType : IEquatable<WorkspaceSummaryHostType>
@@ -34839,7 +35484,7 @@ public override void Write(Utf8JsonWriter writer, WorkspaceSummaryHostType value
 
 
 /// <summary>Hosting platform type of the repository.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionWorkingDirectoryContextHostType : IEquatable<SessionWorkingDirectoryContextHostType>
@@ -34902,7 +35547,7 @@ public override void Write(Utf8JsonWriter writer, SessionWorkingDirectoryContext
 
 
 /// <summary>Rust-owned settings predicates exposed across the SDK boundary. Raw feature-flag names are intentionally not part of the contract.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionSettingsPredicateName : IEquatable<SessionSettingsPredicateName>
@@ -35016,7 +35661,7 @@ public override void Write(Utf8JsonWriter writer, SessionSettingsPredicateName v
 
 
 /// <summary>Signal to send (default: SIGTERM).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ShellKillSignal : IEquatable<ShellKillSignal>
@@ -35144,7 +35789,7 @@ public override void Write(Utf8JsonWriter writer, SessionHistoryCompactRequestTr
 
 
 /// <summary>Aggregate file change represented by a rewind preview.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct HistoryRewindChangeType : IEquatable<HistoryRewindChangeType>
@@ -35210,7 +35855,7 @@ public override void Write(Utf8JsonWriter writer, HistoryRewindChangeType value,
 
 
 /// <summary>Outcome of a rewind request.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct HistoryRewindOutcome : IEquatable<HistoryRewindOutcome>
@@ -35294,7 +35939,7 @@ public override void Write(Utf8JsonWriter writer, HistoryRewindOutcome value, Js
 
 
 /// <summary>Reason a captured file was not restored.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct HistoryFileRestoreSkipReason : IEquatable<HistoryFileRestoreSkipReason>
@@ -35357,7 +36002,7 @@ public override void Write(Utf8JsonWriter writer, HistoryFileRestoreSkipReason v
 
 
 /// <summary>Scope of a rewind operation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct HistoryRewindMode : IEquatable<HistoryRewindMode>
@@ -35420,7 +36065,7 @@ public override void Write(Utf8JsonWriter writer, HistoryRewindMode value, JsonS
 
 
 /// <summary>Whether this item is a queued user message or a queued slash command / model change.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct QueuePendingItemsKind : IEquatable<QueuePendingItemsKind>
@@ -35483,7 +36128,7 @@ public override void Write(Utf8JsonWriter writer, QueuePendingItemsKind value, J
 
 
 /// <summary>Agent-scope filter: 'primary' returns only main-agent events plus events whose type starts with 'subagent.' (matching the typed-subscription default behavior); 'all' returns events from all agents (matching wildcard-subscription behavior). Default is 'all' to preserve wildcard semantics for catch-up callers.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct EventsAgentScope : IEquatable<EventsAgentScope>
@@ -35546,7 +36191,7 @@ public override void Write(Utf8JsonWriter writer, EventsAgentScope value, JsonSe
 
 
 /// <summary>Client population used for the prediction baseline.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionLimitPredictionClientType : IEquatable<SessionLimitPredictionClientType>
@@ -35609,7 +36254,7 @@ public override void Write(Utf8JsonWriter writer, SessionLimitPredictionClientTy
 
 
 /// <summary>Semantic usage tier used for a recommended cap or additional headroom.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionLimitPredictionTier : IEquatable<SessionLimitPredictionTier>
@@ -35678,7 +36323,7 @@ public override void Write(Utf8JsonWriter writer, SessionLimitPredictionTier val
 
 
 /// <summary>Baseline fallback level used to create the prediction.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionLimitPredictionSource : IEquatable<SessionLimitPredictionSource>
@@ -35744,7 +36389,7 @@ public override void Write(Utf8JsonWriter writer, SessionLimitPredictionSource v
 
 
 /// <summary>Reason a prediction could not be computed.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionLimitPredictionUnavailableReason : IEquatable<SessionLimitPredictionUnavailableReason>
@@ -35807,7 +36452,7 @@ public override void Write(Utf8JsonWriter writer, SessionLimitPredictionUnavaila
 
 
 /// <summary>Per-session remote mode. "off" disables remote, "export" exports session events to GitHub without enabling remote steering, "on" enables both export and remote steering.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct RemoteSessionMode : IEquatable<RemoteSessionMode>
@@ -35873,7 +36518,7 @@ public override void Write(Utf8JsonWriter writer, RemoteSessionMode value, JsonS
 
 
 /// <summary>Sharing status for a synced session. "repo" makes the session visible to anyone with read access to the repository; "unshared" restricts it to the creator and collaborators.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionVisibilityStatus : IEquatable<SessionVisibilityStatus>
@@ -35936,7 +36581,7 @@ public override void Write(Utf8JsonWriter writer, SessionVisibilityStatus value,
 
 
 /// <summary>Why the runtime requests client-task cancellation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct ClientTaskCancelReason : IEquatable<ClientTaskCancelReason>
@@ -35999,7 +36644,7 @@ public override void Write(Utf8JsonWriter writer, ClientTaskCancelReason value,
 
 
 /// <summary>Error classification.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionFsErrorCode : IEquatable<SessionFsErrorCode>
@@ -36062,7 +36707,7 @@ public override void Write(Utf8JsonWriter writer, SessionFsErrorCode value, Json
 
 
 /// <summary>Entry type.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionFsReaddirWithTypesEntryType : IEquatable<SessionFsReaddirWithTypesEntryType>
@@ -36125,7 +36770,7 @@ public override void Write(Utf8JsonWriter writer, SessionFsReaddirWithTypesEntry
 
 
 /// <summary>How to execute the query: 'exec' for DDL/multi-statement (no results), 'query' for SELECT (returns rows), 'run' for INSERT/UPDATE/DELETE (returns rowsAffected).</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionFsSqliteQueryType : IEquatable<SessionFsSqliteQueryType>
@@ -36191,7 +36836,7 @@ public override void Write(Utf8JsonWriter writer, SessionFsSqliteQueryType value
 
 
 /// <summary>SQLite transaction failure classification.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct SessionFsSqliteTransactionErrorClass : IEquatable<SessionFsSqliteTransactionErrorClass>
@@ -36257,7 +36902,7 @@ public override void Write(Utf8JsonWriter writer, SessionFsSqliteTransactionErro
 
 
 /// <summary>Transport the runtime would otherwise use for this request. `http` (the default when absent) covers plain HTTP and SSE responses; `websocket` indicates a full-duplex message channel where each body chunk maps to one WebSocket message and the `binary` flag distinguishes text from binary frames. The SDK consumer uses this to decide whether to service the request with an HTTP client or a WebSocket client. It is the one piece of request metadata the consumer cannot reliably infer from the URL or headers alone.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct LlmInferenceHttpRequestStartTransport : IEquatable<LlmInferenceHttpRequestStartTransport>
@@ -36320,7 +36965,7 @@ public override void Write(Utf8JsonWriter writer, LlmInferenceHttpRequestStartTr
 
 
 /// <summary>Why the runtime is requesting a GitHub credential.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct GitHubTokenAcquireReason : IEquatable<GitHubTokenAcquireReason>
@@ -36396,7 +37041,7 @@ internal ServerRpc(JsonRpc rpc)
     /// <param name="message">Optional message to echo back.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Server liveness response, including the echoed message, current server timestamp, and protocol version.</returns>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task<PingResult> PingAsync(string? message = null, CancellationToken cancellationToken = default)
     {
         var request = new PingRequest { Message = message };
@@ -36410,7 +37055,7 @@ public async Task<PingResult> PingAsync(string? message = null, CancellationToke
     /// <param name="token">Connection token; required when the server was started with COPILOT_CONNECTION_TOKEN.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Handshake result reporting the server's protocol version and package version on success.</returns>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     internal async Task<ConnectResult> ConnectAsync(bool? enableGitHubTelemetryForwarding = null, ConnectClientInfo? clientInfo = null, IList<TaskKind>? supportedTaskKinds = null, string? token = null, CancellationToken cancellationToken = default)
     {
         var request = new ConnectRequest { EnableGitHubTelemetryForwarding = enableGitHubTelemetryForwarding, ClientInfo = clientInfo, SupportedTaskKinds = supportedTaskKinds, Token = token };
@@ -36419,7 +37064,7 @@ internal async Task<ConnectResult> ConnectAsync(bool? enableGitHubTelemetryForwa
 
     /// <summary>Registers the calling SDK client as the per-entrypoint extension launch provider. Call before creating any sessions. When omitted, the runtime uses its built-in extension launcher.</summary>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task RegisterExtensionLaunchProviderAsync(CancellationToken cancellationToken = default)
     {
         await CopilotClient.InvokeRpcAsync(_rpc, "registerExtensionLaunchProvider", [], cancellationToken);
@@ -36437,6 +37082,12 @@ public async Task RegisterExtensionLaunchProviderAsync(CancellationToken cancell
         Interlocked.CompareExchange(ref field, new(_rpc), null) ??
         field;
 
+    /// <summary>Sandbox APIs.</summary>
+    public ServerSandboxApi Sandbox =>
+        field ??
+        Interlocked.CompareExchange(ref field, new(_rpc), null) ??
+        field;
+
     /// <summary>Tools APIs.</summary>
     public ServerToolsApi Tools =>
         field ??
@@ -36547,7 +37198,7 @@ public async Task RegisterExtensionLaunchProviderAsync(CancellationToken cancell
 }
 
 /// <summary>Provides server-scoped Hooks APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerHooksApi
 {
     private readonly JsonRpc _rpc;
@@ -36570,7 +37221,7 @@ public async Task<HooksDiscoverResult> DiscoverAsync(IList<string>? projectPaths
 }
 
 /// <summary>Provides server-scoped Models APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerModelsApi
 {
     private readonly JsonRpc _rpc;
@@ -36600,8 +37251,28 @@ public async Task<BuiltInModelCatalog> GetBuiltInCatalogAsync(CancellationToken
     }
 }
 
+/// <summary>Provides server-scoped Sandbox APIs.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class ServerSandboxApi
+{
+    private readonly JsonRpc _rpc;
+
+    internal ServerSandboxApi(JsonRpc rpc)
+    {
+        _rpc = rpc;
+    }
+
+    /// <summary>Reports whether the host running this runtime can run the command sandbox, without starting a session or spawning a sandboxed command.</summary>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
+    /// <returns>Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package.</returns>
+    public async Task<SandboxHostSupport> GetHostSupportAsync(CancellationToken cancellationToken = default)
+    {
+        return await CopilotClient.InvokeRpcAsync<SandboxHostSupport>(_rpc, "sandbox.getHostSupport", [], cancellationToken);
+    }
+}
+
 /// <summary>Provides server-scoped Tools APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerToolsApi
 {
     private readonly JsonRpc _rpc;
@@ -36623,7 +37294,7 @@ public async Task<ToolList> ListAsync(string? model = null, CancellationToken ca
 }
 
 /// <summary>Provides server-scoped Account APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerAccountApi
 {
     private readonly JsonRpc _rpc;
@@ -36688,7 +37359,7 @@ public async Task<AccountLogoutResult> LogoutAsync(string? selectionId = null, A
 }
 
 /// <summary>Provides server-scoped Secrets APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerSecretsApi
 {
     private readonly JsonRpc _rpc;
@@ -36712,7 +37383,7 @@ public async Task<SecretsAddFilterValuesResult> AddFilterValuesAsync(IList<strin
 }
 
 /// <summary>Provides server-scoped Mcp APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerMcpApi
 {
     private readonly JsonRpc _rpc;
@@ -36756,7 +37427,7 @@ public async Task<McpPlanInstallResult> PlanInstallAsync(CatalogClientContract c
 }
 
 /// <summary>Provides server-scoped McpConfig APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerMcpConfigApi
 {
     private readonly JsonRpc _rpc;
@@ -36843,7 +37514,7 @@ public async Task ReloadAsync(CancellationToken cancellationToken = default)
 }
 
 /// <summary>Provides server-scoped Extensions APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerExtensionsApi
 {
     private readonly JsonRpc _rpc;
@@ -36885,7 +37556,7 @@ public async Task DisableAsync(IList<string> ids, CancellationToken cancellation
 }
 
 /// <summary>Provides server-scoped Catalog APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerCatalogApi
 {
     private readonly JsonRpc _rpc;
@@ -36931,7 +37602,7 @@ public async Task<CatalogSelectionResult> SelectAsync(CatalogClientContract cont
 }
 
 /// <summary>Provides server-scoped Plugins APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerPluginsApi
 {
     private readonly JsonRpc _rpc;
@@ -37032,7 +37703,7 @@ public async Task DisableAsync(IList<string> names, string? workingDirectory = n
 }
 
 /// <summary>Provides server-scoped PluginsBuiltin APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerPluginsBuiltinApi
 {
     private readonly JsonRpc _rpc;
@@ -37055,7 +37726,7 @@ public async Task SetAsync(IList<string> paths, CancellationToken cancellationTo
 }
 
 /// <summary>Provides server-scoped PluginsMarketplaces APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerPluginsMarketplacesApi
 {
     private readonly JsonRpc _rpc;
@@ -37123,7 +37794,7 @@ public async Task<MarketplaceRefreshResult> RefreshAsync(string? name = null, Ca
 }
 
 /// <summary>Provides server-scoped Skills APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerSkillsApi
 {
     private readonly JsonRpc _rpc;
@@ -37166,7 +37837,7 @@ public async Task<SkillDiscoveryPathList> GetDiscoveryPathsAsync(IList<string>?
 }
 
 /// <summary>Provides server-scoped SkillsConfig APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerSkillsConfigApi
 {
     private readonly JsonRpc _rpc;
@@ -37201,7 +37872,7 @@ public async Task SetSkillDisabledAsync(string name, bool disabled, Cancellation
 }
 
 /// <summary>Provides server-scoped Agents APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerAgentsApi
 {
     private readonly JsonRpc _rpc;
@@ -37235,7 +37906,7 @@ public async Task<AgentDiscoveryPathList> GetDiscoveryPathsAsync(IList<string>?
 }
 
 /// <summary>Provides server-scoped Instructions APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerInstructionsApi
 {
     private readonly JsonRpc _rpc;
@@ -37269,7 +37940,7 @@ public async Task<InstructionDiscoveryPathList> GetDiscoveryPathsAsync(IList<str
 }
 
 /// <summary>Provides server-scoped Commands APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerCommandsApi
 {
     private readonly JsonRpc _rpc;
@@ -37289,7 +37960,7 @@ public async Task<CommandList> ListAsync(CancellationToken cancellationToken = d
 }
 
 /// <summary>Provides server-scoped User APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerUserApi
 {
     private readonly JsonRpc _rpc;
@@ -37307,7 +37978,7 @@ internal ServerUserApi(JsonRpc rpc)
 }
 
 /// <summary>Provides server-scoped UserSettings APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerUserSettingsApi
 {
     private readonly JsonRpc _rpc;
@@ -37346,7 +38017,7 @@ public async Task<UserSettingsSetResult> SetAsync(object settings, CancellationT
 }
 
 /// <summary>Provides server-scoped ManagedSettings APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerManagedSettingsApi
 {
     private readonly JsonRpc _rpc;
@@ -37373,7 +38044,7 @@ public async Task ClearCacheAsync(CancellationToken cancellationToken = default)
 }
 
 /// <summary>Provides server-scoped Runtime APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerRuntimeApi
 {
     private readonly JsonRpc _rpc;
@@ -37392,7 +38063,7 @@ public async Task ShutdownAsync(CancellationToken cancellationToken = default)
 }
 
 /// <summary>Provides server-scoped SessionFs APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerSessionFsApi
 {
     private readonly JsonRpc _rpc;
@@ -37420,7 +38091,7 @@ public async Task<SessionFsSetProviderResult> SetProviderAsync(string initialCwd
 }
 
 /// <summary>Provides server-scoped LlmInference APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerLlmInferenceApi
 {
     private readonly JsonRpc _rpc;
@@ -37473,7 +38144,7 @@ public async Task<LlmInferenceHttpResponseChunkResult> HttpResponseChunkAsync(st
 }
 
 /// <summary>Provides server-scoped Sessions APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerSessionsApi
 {
     private readonly JsonRpc _rpc;
@@ -37862,7 +38533,7 @@ internal async Task ConfigureSessionExtensionsAsync(string sessionId, Cancellati
 }
 
 /// <summary>Provides server-scoped AgentRegistry APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ServerAgentRegistryApi
 {
     private readonly JsonRpc _rpc;
@@ -37986,6 +38657,12 @@ internal SessionRpc(CopilotSession session)
         Interlocked.CompareExchange(ref field, new(_session), null) ??
         field;
 
+    /// <summary>Customizations APIs.</summary>
+    public CustomizationsApi Customizations =>
+        field ??
+        Interlocked.CompareExchange(ref field, new(_session), null) ??
+        field;
+
     /// <summary>Fleet APIs.</summary>
     public FleetApi Fleet =>
         field ??
@@ -38016,6 +38693,12 @@ internal SessionRpc(CopilotSession session)
         Interlocked.CompareExchange(ref field, new(_session), null) ??
         field;
 
+    /// <summary>Diagnostics APIs.</summary>
+    public DiagnosticsApi Diagnostics =>
+        field ??
+        Interlocked.CompareExchange(ref field, new(_session), null) ??
+        field;
+
     /// <summary>Connectors APIs.</summary>
     public ConnectorsApi Connectors =>
         field ??
@@ -38162,7 +38845,7 @@ internal SessionRpc(CopilotSession session)
 
     /// <summary>Suspends the session while preserving persisted state for later resume.</summary>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task SuspendAsync(CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
@@ -38188,7 +38871,7 @@ public async Task SuspendAsync(CancellationToken cancellationToken = default)
     /// <param name="wait">If true, await completion of the agentic loop for this message before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageId`; the caller can rely on the agent having processed the message before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Result of sending a user message.</returns>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task<SendResult> SendAsync(string prompt, string? displayPrompt = null, IList<Attachment>? attachments = null, SendMode? mode = null, bool? prepend = null, bool? billable = null, string? requiredTool = null, string? source = null, SendAgentMode? agentMode = null, IDictionary<string, string>? requestHeaders = null, ResponseFormat? responseFormat = null, string? traceparent = null, string? tracestate = null, bool? wait = null, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(prompt);
@@ -38210,7 +38893,7 @@ public async Task<SendResult> SendAsync(string prompt, string? displayPrompt = n
     /// <param name="wait">If true, await completion of the agentic loop for this turn before returning. Defaults to false (fire-and-forget). When true, the result still contains the same `messageIds`; the caller can rely on the agent having processed the messages before the call resolves. Transport-dependent tail semantics: on a LOCAL (in-process) session the wait additionally blocks until the completed turn's event tail has been dispatched to this session's in-process subscribers, so a subsequent read of subscriber state already reflects the turn; on a REMOTE session the wait resolves once the loop completes and mirrored delivery follows over the wire. Callers that need the stronger local guarantee on remote sessions should await the event stream explicitly.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Result of sending zero or more user messages.</returns>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task<SendMessagesResult> SendMessagesAsync(IList<SendMessageItem> messages, SendMode? mode = null, bool? prepend = null, SendAgentMode? agentMode = null, IDictionary<string, string>? requestHeaders = null, ResponseFormat? responseFormat = null, string? traceparent = null, string? tracestate = null, bool? wait = null, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(messages);
@@ -38225,7 +38908,7 @@ public async Task<SendMessagesResult> SendMessagesAsync(IList<SendMessageItem> m
     /// <param name="kind">Optional structured notification kind.</param>
     /// <param name="options">Internal delivery options, including passive policy.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     internal async Task SendSystemNotificationAsync(string message, object? kind = null, object? options = null, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(message);
@@ -38239,7 +38922,7 @@ internal async Task SendSystemNotificationAsync(string message, object? kind = n
     /// <param name="reason">Finite reason code describing why the current turn was aborted.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Result of aborting the current turn.</returns>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task<AbortResult> AbortAsync(AbortReason? reason = null, CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
@@ -38252,7 +38935,7 @@ public async Task<AbortResult> AbortAsync(AbortReason? reason = null, Cancellati
     /// <param name="flushQueued">When true, the user's queued prompts are preserved and run as the next turn once the interrupted turn unwinds; when false (the default), the queue is cleared like a plain abort.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Result of interrupting the main agent turn.</returns>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task<InterruptMainTurnResult> InterruptMainTurnAsync(bool? flushQueued = null, CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
@@ -38264,7 +38947,7 @@ public async Task<InterruptMainTurnResult> InterruptMainTurnAsync(bool? flushQue
     /// <summary>Cancels every running background agent (task-registry subagents plus sidekick agents) without interrupting the main agent loop. Promoted attached shells are left running.</summary>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>The number of running background agents (task-registry agents) that were cancelled.</returns>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task<long> CancelAllBackgroundAgentsAsync(CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
@@ -38278,7 +38961,7 @@ public async Task<long> CancelAllBackgroundAgentsAsync(CancellationToken cancell
     /// <param name="reason">Optional human-readable reason. Typically the message of the error that triggered shutdown when type is 'error'.</param>
     /// <param name="detachSessionEndHooks">Dispatch deferred sessionEnd hooks in the background with their full per-hook timeoutSec instead of awaiting them under the short shared shutdown budget. Set this when the host process keeps running after the session closes (for example the CLI's /clear), so a slow hook neither blocks the close nor is aborted. Hooks still detached when the process later exits are terminated with it. Defaults to false.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task ShutdownAsync(ShutdownType? type = null, string? reason = null, bool? detachSessionEndHooks = null, CancellationToken cancellationToken = default)
     {
         _session.ThrowIfDisposed();
@@ -38296,7 +38979,7 @@ public async Task ShutdownAsync(ShutdownType? type = null, string? reason = null
     /// <param name="tip">Optional actionable tip displayed alongside the message. Only honored on `level: "info"`.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
     /// <returns>Identifier of the session event that was emitted for the log message.</returns>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public async Task<LogResult> LogAsync(string message, SessionLogLevel? level = null, string? type = null, bool? ephemeral = null, string? url = null, string? tip = null, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(message);
@@ -38308,7 +38991,7 @@ public async Task<LogResult> LogAsync(string message, SessionLogLevel? level = n
 }
 
 /// <summary>Provides session-scoped Sandbox APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SandboxApi
 {
     private readonly CopilotSession _session;
@@ -38345,7 +39028,7 @@ public async Task<SandboxDisableForSessionResult> DisableForSessionAsync(string
 }
 
 /// <summary>Provides session-scoped GitHubAuth APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class GitHubAuthApi
 {
     private readonly CopilotSession _session;
@@ -38479,7 +39162,7 @@ internal async Task<IList<AuthValidationError>> LastAuthErrorsAsync(Cancellation
 }
 
 /// <summary>Provides session-scoped Debug APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class DebugApi
 {
     private readonly CopilotSession _session;
@@ -38506,7 +39189,7 @@ public async Task<DebugCollectLogsResult> CollectLogsAsync(DebugCollectLogsDesti
 }
 
 /// <summary>Provides session-scoped Canvas APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasApi
 {
     private readonly CopilotSession _session;
@@ -38581,7 +39264,7 @@ public async Task CloseAsync(string instanceId, CancellationToken cancellationTo
 }
 
 /// <summary>Provides session-scoped CanvasAction APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasActionApi
 {
     private readonly CopilotSession _session;
@@ -38609,7 +39292,7 @@ public async Task<CanvasActionInvokeResult> InvokeAsync(string instanceId, strin
 }
 
 /// <summary>Provides session-scoped CanvasProvider APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CanvasProviderApi
 {
     private readonly CopilotSession _session;
@@ -38649,7 +39332,7 @@ internal async Task UnregisterAsync(string connectionId, CancellationToken cance
 }
 
 /// <summary>Provides session-scoped Factory APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryApi
 {
     private readonly CopilotSession _session;
@@ -38866,7 +39549,7 @@ public async Task<FactoryAgentResult> AgentAsync(string factoryRunId, string exe
 }
 
 /// <summary>Provides session-scoped FactoryJournal APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FactoryJournalApi
 {
     private readonly CopilotSession _session;
@@ -38914,7 +39597,7 @@ public async Task<FactoryAckResult> PutAsync(string runId, string executionToken
 }
 
 /// <summary>Provides session-scoped Workflow APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowApi
 {
     private readonly CopilotSession _session;
@@ -39131,7 +39814,7 @@ public async Task<WorkflowAgentResult> AgentAsync(string workflowRunId, string e
 }
 
 /// <summary>Provides session-scoped WorkflowJournal APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkflowJournalApi
 {
     private readonly CopilotSession _session;
@@ -39179,7 +39862,7 @@ public async Task<WorkflowAckResult> PutAsync(string runId, string executionToke
 }
 
 /// <summary>Provides session-scoped Model APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModelApi
 {
     private readonly CopilotSession _session;
@@ -39300,7 +39983,7 @@ public async Task<SessionModelList> ListAsync(SessionModelListRequest? request =
 }
 
 /// <summary>Provides session-scoped Mode APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ModeApi
 {
     private readonly CopilotSession _session;
@@ -39346,7 +40029,7 @@ public async Task<ModeSetResult> SetAsync(SessionMode mode, SessionMode? expecte
 }
 
 /// <summary>Provides session-scoped Name APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class NameApi
 {
     private readonly CopilotSession _session;
@@ -39394,7 +40077,7 @@ public async Task<NameSetAutoResult> SetAutoAsync(string summary, CancellationTo
 }
 
 /// <summary>Provides session-scoped Plan APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PlanApi
 {
     private readonly CopilotSession _session;
@@ -39461,7 +40144,7 @@ public async Task<PlanReadSqlTodosWithDependenciesResult> ReadSqlTodosWithDepend
 }
 
 /// <summary>Provides session-scoped Workspaces APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class WorkspacesApi
 {
     private readonly CopilotSession _session;
@@ -39723,7 +40406,7 @@ public async Task<WorkspaceDiffResult> DiffAsync(WorkspaceDiffMode mode, bool? i
 }
 
 /// <summary>Provides session-scoped AutopilotObjective APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AutopilotObjectiveApi
 {
     private readonly CopilotSession _session;
@@ -39746,7 +40429,7 @@ public async Task<AutopilotObjectiveGetStateResult> GetStateAsync(CancellationTo
 }
 
 /// <summary>Provides session-scoped Completions APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CompletionsApi
 {
     private readonly CopilotSession _session;
@@ -39783,7 +40466,7 @@ public async Task<CompletionsRequestResult> RequestAsync(string text, long offse
 }
 
 /// <summary>Provides session-scoped Instructions APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class InstructionsApi
 {
     private readonly CopilotSession _session;
@@ -39803,10 +40486,43 @@ public async Task<InstructionsGetSourcesResult> GetSourcesAsync(CancellationToke
         var request = new SessionInstructionsGetSourcesRequest { SessionId = _session.SessionId };
         return await CopilotClient.InvokeRpcAsync<InstructionsGetSourcesResult>(_session.Rpc, "session.instructions.getSources", [request], cancellationToken);
     }
+
+    /// <summary>Invalidates cached custom-instruction discovery so subsequent turns and source reads observe instruction files currently on disk.</summary>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
+    public async Task ReloadAsync(CancellationToken cancellationToken = default)
+    {
+        _session.ThrowIfDisposed();
+
+        var request = new SessionInstructionsReloadRequest { SessionId = _session.SessionId };
+        await CopilotClient.InvokeRpcAsync(_session.Rpc, "session.instructions.reload", [request], cancellationToken);
+    }
+}
+
+/// <summary>Provides session-scoped Customizations APIs.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class CustomizationsApi
+{
+    private readonly CopilotSession _session;
+
+    internal CustomizationsApi(CopilotSession session)
+    {
+        _session = session;
+    }
+
+    /// <summary>Reloads all repository and user customizations for the active session: instructions, plugins and their MCP servers and hooks, custom agents, extensions, and skills. Returns diagnostics from the final skill reload.</summary>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
+    /// <returns>Diagnostics from reloading skill definitions, with warnings and errors as separate lists.</returns>
+    public async Task<SkillsLoadDiagnostics> ReloadAsync(CancellationToken cancellationToken = default)
+    {
+        _session.ThrowIfDisposed();
+
+        var request = new SessionCustomizationsReloadRequest { SessionId = _session.SessionId };
+        return await CopilotClient.InvokeRpcAsync<SkillsLoadDiagnostics>(_session.Rpc, "session.customizations.reload", [request], cancellationToken);
+    }
 }
 
 /// <summary>Provides session-scoped Fleet APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class FleetApi
 {
     private readonly CopilotSession _session;
@@ -39833,7 +40549,7 @@ public async Task<FleetStartResult> StartAsync(string? prompt = null, IList<Atta
 }
 
 /// <summary>Provides session-scoped Agent APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class AgentApi
 {
     private readonly CopilotSession _session;
@@ -39916,7 +40632,7 @@ public async Task<AgentReloadResult> ReloadAsync(CancellationToken cancellationT
 }
 
 /// <summary>Provides session-scoped Tasks APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TasksApi
 {
     private readonly CopilotSession _session;
@@ -40105,7 +40821,7 @@ public async Task<TasksSendMessageResult> SendMessageAsync(string id, string mes
 }
 
 /// <summary>Provides session-scoped Skills APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SkillsApi
 {
     private readonly CopilotSession _session;
@@ -40184,7 +40900,7 @@ public async Task EnsureLoadedAsync(CancellationToken cancellationToken = defaul
 }
 
 /// <summary>Provides session-scoped Mcp APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpApi
 {
     private readonly CopilotSession _session;
@@ -40441,7 +41157,7 @@ public async Task<McpIsServerRunningResult> IsServerRunningAsync(string serverNa
 }
 
 /// <summary>Provides session-scoped McpOauth APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpOauthApi
 {
     private readonly CopilotSession _session;
@@ -40526,7 +41242,7 @@ public async Task<McpOauthRespondResult> RespondAsync(string requestId, Cancella
 }
 
 /// <summary>Provides session-scoped McpHeaders APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpHeadersApi
 {
     private readonly CopilotSession _session;
@@ -40553,7 +41269,7 @@ public async Task<McpHeadersHandlePendingHeadersRefreshRequestResult> HandlePend
 }
 
 /// <summary>Provides session-scoped McpApps APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAppsApi
 {
     private readonly CopilotSession _session;
@@ -40649,7 +41365,7 @@ public async Task<McpAppsDiagnoseResult> DiagnoseAsync(string serverName, Cancel
 }
 
 /// <summary>Provides session-scoped McpResources APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpResourcesApi
 {
     private readonly CopilotSession _session;
@@ -40703,8 +41419,49 @@ public async Task<McpResourcesListTemplatesResult> ListTemplatesAsync(string ser
     }
 }
 
+/// <summary>Provides session-scoped Diagnostics APIs.</summary>
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
+public sealed class DiagnosticsApi
+{
+    private readonly CopilotSession _session;
+
+    internal DiagnosticsApi(CopilotSession session)
+    {
+        _session = session;
+    }
+
+    /// <summary>Patches configured session diagnostic sources without restarting their producers. Setting a source level to off clears its retained diagnostics and invalidates cursors selecting that source.</summary>
+    /// <param name="sources">Sources to configure. At least one supported source must be supplied.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
+    /// <returns>Per-source session diagnostics configuration.</returns>
+    public async Task<DiagnosticsConfiguration> ConfigureAsync(DiagnosticSourcesConfiguration sources, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(sources);
+        _session.ThrowIfDisposed();
+
+        var request = new DiagnosticsConfigureRequest { SessionId = _session.SessionId, Sources = sources };
+        return await CopilotClient.InvokeRpcAsync<DiagnosticsConfiguration>(_session.Rpc, "session.diagnostics.configure", [request], cancellationToken);
+    }
+
+    /// <summary>Reads a bounded batch of retained session diagnostics for the selected sources. Records are never consumed and each reader advances independently through its opaque cursor.</summary>
+    /// <param name="sources">Nonempty selection of sources to read. Each source may be listed once.</param>
+    /// <param name="cursor">Opaque cursor returned by an earlier read. Omit to start at the oldest retained record.</param>
+    /// <param name="max">Maximum number of records to return, from 1 through 500. Omit for 100.</param>
+    /// <param name="waitMs">Maximum time in milliseconds to wait for a new record, from 0 through 30000.</param>
+    /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
+    /// <returns>One cursor-addressed page of retained session diagnostics.</returns>
+    public async Task<DiagnosticsReadResult> ReadAsync(IList<DiagnosticSource> sources, string? cursor = null, long? max = null, int? waitMs = null, CancellationToken cancellationToken = default)
+    {
+        ArgumentNullException.ThrowIfNull(sources);
+        _session.ThrowIfDisposed();
+
+        var request = new DiagnosticsReadRequest { SessionId = _session.SessionId, Sources = sources, Cursor = cursor, Max = max, WaitMs = waitMs };
+        return await CopilotClient.InvokeRpcAsync<DiagnosticsReadResult>(_session.Rpc, "session.diagnostics.read", [request], cancellationToken);
+    }
+}
+
 /// <summary>Provides session-scoped Connectors APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ConnectorsApi
 {
     private readonly CopilotSession _session;
@@ -40863,7 +41620,7 @@ internal async Task<ConnectorStatus> WithdrawProjectionAsync(CancellationToken c
 }
 
 /// <summary>Provides session-scoped ManagedSettings APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ManagedSettingsApi
 {
     private readonly CopilotSession _session;
@@ -40886,7 +41643,7 @@ public async Task<ManagedSettingsResolvedData> GetAsync(CancellationToken cancel
 }
 
 /// <summary>Provides session-scoped Plugins APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PluginsApi
 {
     private readonly CopilotSession _session;
@@ -40989,7 +41746,7 @@ public async Task ReloadAsync(SessionPluginsReloadRequest? request = null, Cance
 }
 
 /// <summary>Provides session-scoped PluginsMarketplaces APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PluginsMarketplacesApi
 {
     private readonly CopilotSession _session;
@@ -41065,7 +41822,7 @@ public async Task<MarketplaceRefreshResult> RefreshAsync(SessionPluginsMarketpla
 }
 
 /// <summary>Provides session-scoped Provider APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderApi
 {
     private readonly CopilotSession _session;
@@ -41115,7 +41872,7 @@ public async Task<ProviderSyncResult> SyncAsync(IList<NamedProviderConfig>? prov
 }
 
 /// <summary>Provides session-scoped Options APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class OptionsApi
 {
     private readonly CopilotSession _session;
@@ -41198,7 +41955,7 @@ public async Task<SessionUpdateOptionsResult> UpdateAsync(string? model = null,
 }
 
 /// <summary>Provides session-scoped Lsp APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LspApi
 {
     private readonly CopilotSession _session;
@@ -41223,7 +41980,7 @@ public async Task InitializeAsync(string? workingDirectory = null, string? gitRo
 }
 
 /// <summary>Provides session-scoped Extensions APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ExtensionsApi
 {
     private readonly CopilotSession _session;
@@ -41293,7 +42050,7 @@ public async Task SendAttachmentsToMessageAsync(IList<PushAttachment> attachment
 }
 
 /// <summary>Provides session-scoped Tools APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ToolsApi
 {
     private readonly CopilotSession _session;
@@ -41416,7 +42173,7 @@ public async Task<ToolsUpdateSubagentSettingsResult> UpdateSubagentSettingsAsync
 }
 
 /// <summary>Provides session-scoped Commands APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class CommandsApi
 {
     private readonly CopilotSession _session;
@@ -41527,7 +42284,7 @@ public async Task<CommandsRespondToQueuedCommandResult> RespondToQueuedCommandAs
 }
 
 /// <summary>Provides session-scoped Telemetry APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class TelemetryApi
 {
     private readonly CopilotSession _session;
@@ -41562,7 +42319,7 @@ public async Task SetFeatureOverridesAsync(IDictionary<string, string> features,
 }
 
 /// <summary>Provides session-scoped Ui APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UiApi
 {
     private readonly CopilotSession _session;
@@ -41717,7 +42474,7 @@ public async Task<UIUnregisterDirectAutoModeSwitchHandlerResult> UnregisterDirec
 }
 
 /// <summary>Provides session-scoped Permissions APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsApi
 {
     private readonly CopilotSession _session;
@@ -41887,7 +42644,7 @@ public async Task<PermissionsNotifyPromptShownResult> NotifyPromptShownAsync(str
 }
 
 /// <summary>Provides session-scoped PermissionsPaths APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsPathsApi
 {
     private readonly CopilotSession _session;
@@ -41962,7 +42719,7 @@ public async Task<PermissionPathsWorkspaceCheckResult> IsPathWithinWorkspaceAsyn
 }
 
 /// <summary>Provides session-scoped PermissionsLocations APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsLocationsApi
 {
     private readonly CopilotSession _session;
@@ -42015,7 +42772,7 @@ public async Task<PermissionsLocationsAddToolApprovalResult> AddToolApprovalAsyn
 }
 
 /// <summary>Provides session-scoped PermissionsFolderTrust APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsFolderTrustApi
 {
     private readonly CopilotSession _session;
@@ -42053,7 +42810,7 @@ public async Task<PermissionsFolderTrustAddTrustedResult> AddTrustedAsync(string
 }
 
 /// <summary>Provides session-scoped PermissionsUrls APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class PermissionsUrlsApi
 {
     private readonly CopilotSession _session;
@@ -42077,7 +42834,7 @@ public async Task<PermissionsUrlsSetUnrestrictedModeResult> SetUnrestrictedModeA
 }
 
 /// <summary>Provides session-scoped Metadata APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class MetadataApi
 {
     private readonly CopilotSession _session;
@@ -42223,7 +42980,7 @@ public async Task<MetadataRecomputeContextTokensResult> RecomputeContextTokensAs
 }
 
 /// <summary>Provides session-scoped Settings APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class SettingsApi
 {
     private readonly CopilotSession _session;
@@ -42259,7 +43016,7 @@ internal async Task<SessionSettingsEvaluatePredicateResult> EvaluatePredicateAsy
 }
 
 /// <summary>Provides session-scoped ContentExclusion APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ContentExclusionApi
 {
     private readonly CopilotSession _session;
@@ -42284,7 +43041,7 @@ public async Task<ContentExclusionCheckPathsResult> CheckPathsAsync(IList<string
 }
 
 /// <summary>Provides session-scoped Shell APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ShellApi
 {
     private readonly CopilotSession _session;
@@ -42353,7 +43110,7 @@ public async Task<CancelUserRequestedShellCommandResult> CancelUserRequestedAsyn
 }
 
 /// <summary>Provides session-scoped History APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class HistoryApi
 {
     private readonly CopilotSession _session;
@@ -42474,7 +43231,7 @@ public async Task<HistoryClearContextResult> ClearContextAsync(string prompt, Ca
 }
 
 /// <summary>Provides session-scoped Queue APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class QueueApi
 {
     private readonly CopilotSession _session;
@@ -42563,19 +43320,19 @@ public async Task<QueueUpdateTextResult> UpdateTextAsync(string id, string promp
         return await CopilotClient.InvokeRpcAsync<QueueUpdateTextResult>(_session.Rpc, "session.queue.updateText", [request], cancellationToken);
     }
 
-    /// <summary>Atomically withdraws an unchanged, unconsumed user message from the local queued or steering lane. A client retaining the original draft may restore it only when removed is true. Does not interrupt the running turn.</summary>
+    /// <summary>Atomically withdraws an unchanged user message of a local session: from the queued or steering lane while unconsumed, or from the running turn it started while the model has not answered it and nothing the user sent after it is pending. Withdrawing from the running turn interrupts that turn and removes its events from history. A client retaining the original draft may restore it only when removed is true.</summary>
     /// <param name="messageId">Message identity returned by send, not the queue item id. Batch messages are not eligible.</param>
     /// <param name="expectedPrompt">The prompt originally sent. A message edited since submission is not withdrawn, so an obsolete draft cannot replace the edit.</param>
     /// <param name="cancellationToken">The <see cref="CancellationToken"/> to monitor for cancellation requests. The default is <see cref="CancellationToken.None"/>.</param>
-    /// <returns>Result of removing a queued item.</returns>
-    public async Task<QueueRemoveAtResult> WithdrawMessageAsync(string messageId, string expectedPrompt, CancellationToken cancellationToken = default)
+    /// <returns>Result of withdrawing a user message.</returns>
+    public async Task<QueueWithdrawMessageResult> WithdrawMessageAsync(string messageId, string expectedPrompt, CancellationToken cancellationToken = default)
     {
         ArgumentNullException.ThrowIfNull(messageId);
         ArgumentNullException.ThrowIfNull(expectedPrompt);
         _session.ThrowIfDisposed();
 
         var request = new QueueWithdrawMessageRequest { SessionId = _session.SessionId, MessageId = messageId, ExpectedPrompt = expectedPrompt };
-        return await CopilotClient.InvokeRpcAsync<QueueRemoveAtResult>(_session.Rpc, "session.queue.withdrawMessage", [request], cancellationToken);
+        return await CopilotClient.InvokeRpcAsync<QueueWithdrawMessageResult>(_session.Rpc, "session.queue.withdrawMessage", [request], cancellationToken);
     }
 
     /// <summary>Atomically appends text and attachments to an unchanged, unconsumed local steering message. Returns updated=false if delivery or withdrawal already claimed the message.</summary>
@@ -42741,7 +43498,7 @@ internal async Task ProcessAsync(CancellationToken cancellationToken = default)
 }
 
 /// <summary>Provides session-scoped EventLog APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class EventLogApi
 {
     private readonly CopilotSession _session;
@@ -42809,7 +43566,7 @@ public async Task<EventLogReleaseInterestResult> ReleaseInterestAsync(string han
 }
 
 /// <summary>Provides session-scoped Usage APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class UsageApi
 {
     private readonly CopilotSession _session;
@@ -42832,7 +43589,7 @@ public async Task<UsageGetMetricsResult> GetMetricsAsync(CancellationToken cance
 }
 
 /// <summary>Provides session-scoped LimitPrediction APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class LimitPredictionApi
 {
     private readonly CopilotSession _session;
@@ -42856,7 +43613,7 @@ public async Task<SessionLimitPredictionResult> PredictAsync(SessionLimitPredict
 }
 
 /// <summary>Provides session-scoped Remote APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class RemoteApi
 {
     private readonly CopilotSession _session;
@@ -42902,7 +43659,7 @@ public async Task<RemoteNotifySteerableChangedResult> NotifySteerableChangedAsyn
 }
 
 /// <summary>Provides session-scoped Visibility APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class VisibilityApi
 {
     private readonly CopilotSession _session;
@@ -42937,7 +43694,7 @@ public async Task<VisibilitySetResult> SetAsync(SessionVisibilityStatus status,
 }
 
 /// <summary>Provides session-scoped Schedule APIs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ScheduleApi
 {
     private readonly CopilotSession _session;
@@ -43071,7 +43828,7 @@ public async Task<ScheduleStopResult> StopAsync(long id, CancellationToken cance
 }
 
 /// <summary>Handles `providerToken` client session API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface IProviderTokenHandler
 {
     /// <summary>Asks the SDK client to get a bearer token for a BYOK provider whose config set `hasBearerTokenProvider: true`. Session-scoped: the runtime calls it back on the connection that most recently supplied that provider's config for the session (the creating connection, or a resuming connection if the session was resumed — distinct providers may be owned by different connections), passing the provider name, and uses the returned token as the Authorization header for the outbound model request. The runtime does no caching — it calls this once per outbound request; the SDK consumer owns token acquisition, caching, and refresh.</summary>
@@ -43082,7 +43839,7 @@ public interface IProviderTokenHandler
 }
 
 /// <summary>Handles `factory` client session API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface IFactoryHandler
 {
     /// <summary>Asks the owning extension connection to execute a registered factory closure.</summary>
@@ -43098,7 +43855,7 @@ public interface IFactoryHandler
 }
 
 /// <summary>Handles `workflow` client session API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface IWorkflowHandler
 {
     /// <summary>Asks the owning extension connection to execute a registered dynamic workflow.</summary>
@@ -43114,7 +43871,7 @@ public interface IWorkflowHandler
 }
 
 /// <summary>Handles `tasks` client session API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface ITasksHandler
 {
     /// <summary>Asks the client currently bound to a client-owned session task to confirm that its external work stopped.</summary>
@@ -43125,7 +43882,7 @@ public interface ITasksHandler
 }
 
 /// <summary>Handles `sessionFs` client session API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface ISessionFsHandler
 {
     /// <summary>Reads a file from the client-provided session filesystem.</summary>
@@ -43196,7 +43953,7 @@ public interface ISessionFsHandler
 }
 
 /// <summary>Handles `canvas` client session API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface ICanvasHandler
 {
     /// <summary>Opens a canvas instance on the provider.</summary>
@@ -43383,7 +44140,7 @@ public static void RegisterClientSessionApiHandlers(JsonRpc rpc, Func<string, Cl
 }
 
 /// <summary>Handles `extensionLaunchProvider` client global API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface IExtensionLaunchProviderHandler
 {
     /// <summary>Asks the registered SDK client to resolve an opaque process launch profile for one discovered extension entrypoint immediately before launch or reload. The provider must respond within 15 seconds.</summary>
@@ -43394,7 +44151,7 @@ public interface IExtensionLaunchProviderHandler
 }
 
 /// <summary>Handles `llmInference` client global API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface ILlmInferenceHandler
 {
     /// <summary>Announces an outbound model-layer HTTP request the runtime wants the SDK client to service. Carries the request head only; the body always follows as one or more httpRequestChunk frames keyed by the same requestId, even when the body is empty (a single chunk with end=true).</summary>
@@ -43410,7 +44167,7 @@ public interface ILlmInferenceHandler
 }
 
 /// <summary>Handles `gitHubTelemetry` client global API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface IGitHubTelemetryHandler
 {
     /// <summary>Forwards a single GitHub telemetry event to a host connection that opted into telemetry forwarding during the `server.connect` handshake. Opted-in connections receive their runtime host's events across all its sessions, its sessionless events (for example, `server.sendTelemetry`), and explicitly process-wide events. Events owned by another independently embedded runtime host are not forwarded to this connection.</summary>
@@ -43420,7 +44177,7 @@ public interface IGitHubTelemetryHandler
 }
 
 /// <summary>Handles `gitHubToken` client global API methods.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public interface IGitHubTokenHandler
 {
     /// <summary>Asks the SDK client to mint a GitHub access token for a session whose configuration supplied a GitHub token provider. The runtime acquires the initial token during bootstrap and refreshes it during expiry preflight when one hour or less remains.</summary>
@@ -44078,6 +44835,12 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(DebugCollectLogsRequest))]
 [JsonSerializable(typeof(DebugCollectLogsResult))]
 [JsonSerializable(typeof(DebugCollectLogsSkippedEntry))]
+[JsonSerializable(typeof(DiagnosticEntry))]
+[JsonSerializable(typeof(DiagnosticSourcesConfiguration))]
+[JsonSerializable(typeof(DiagnosticsConfiguration))]
+[JsonSerializable(typeof(DiagnosticsConfigureRequest))]
+[JsonSerializable(typeof(DiagnosticsReadRequest))]
+[JsonSerializable(typeof(DiagnosticsReadResult))]
 [JsonSerializable(typeof(DiscoveredCanvas))]
 [JsonSerializable(typeof(DiscoveredExtension))]
 [JsonSerializable(typeof(DiscoveredExtensionPlugin))]
@@ -44240,6 +45003,8 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(McpConfigUpdateRequest))]
 [JsonSerializable(typeof(McpConfigureGitHubRequest))]
 [JsonSerializable(typeof(McpConfigureGitHubResult))]
+[JsonSerializable(typeof(McpDiagnosticDetails))]
+[JsonSerializable(typeof(McpDiagnosticSourceConfiguration))]
 [JsonSerializable(typeof(McpDisableRequest))]
 [JsonSerializable(typeof(McpDiscoverRequest))]
 [JsonSerializable(typeof(McpDiscoverResult))]
@@ -44511,6 +45276,7 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(QueueUpdateTextRequest))]
 [JsonSerializable(typeof(QueueUpdateTextResult))]
 [JsonSerializable(typeof(QueueWithdrawMessageRequest))]
+[JsonSerializable(typeof(QueueWithdrawMessageResult))]
 [JsonSerializable(typeof(QueuedCommandResult))]
 [JsonSerializable(typeof(RegisterEventInterestParams))]
 [JsonSerializable(typeof(RegisterEventInterestResult))]
@@ -44542,6 +45308,8 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(SandboxDisableForSessionRequest))]
 [JsonSerializable(typeof(SandboxDisableForSessionResult))]
 [JsonSerializable(typeof(SandboxEnforcementStatus))]
+[JsonSerializable(typeof(SandboxHostCapability))]
+[JsonSerializable(typeof(SandboxHostSupport))]
 [JsonSerializable(typeof(ScheduleAddAtRequest))]
 [JsonSerializable(typeof(ScheduleAddCronRequest))]
 [JsonSerializable(typeof(ScheduleAddRequest))]
@@ -44589,6 +45357,7 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(SessionConnectorsGetStatusRequest))]
 [JsonSerializable(typeof(SessionConnectorsWithdrawProjectionRequest))]
 [JsonSerializable(typeof(SessionContext))]
+[JsonSerializable(typeof(SessionCustomizationsReloadRequest))]
 [JsonSerializable(typeof(SessionEnrichMetadataResult))]
 [JsonSerializable(typeof(SessionEventLogTailRequest))]
 [JsonSerializable(typeof(SessionExtensionsListRequest))]
@@ -44636,6 +45405,7 @@ public static void RegisterClientGlobalApiHandlers(JsonRpc rpc, ClientGlobalApiH
 [JsonSerializable(typeof(SessionHistorySummarizeForHandoffRequest))]
 [JsonSerializable(typeof(SessionInstalledPlugin))]
 [JsonSerializable(typeof(SessionInstructionsGetSourcesRequest))]
+[JsonSerializable(typeof(SessionInstructionsReloadRequest))]
 [JsonSerializable(typeof(SessionLimitPredictionBaselineData))]
 [JsonSerializable(typeof(SessionLimitPredictionDetails))]
 [JsonSerializable(typeof(SessionLimitPredictionPredictRequest))]
diff --git a/dotnet/src/Generated/SessionEvents.cs b/dotnet/src/Generated/SessionEvents.cs
index efb270a8b7..5c3618c35d 100644
--- a/dotnet/src/Generated/SessionEvents.cs
+++ b/dotnet/src/Generated/SessionEvents.cs
@@ -412,7 +412,7 @@ public sealed partial class SessionModelDeselectedEvent : SessionEvent
 
 /// <summary>Live-only Auto preference recommendation from Copilot API after a successful Auto model call.</summary>
 /// <remarks>Represents the <c>session.auto_tier_recommendation</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionAutoTierRecommendationEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -478,7 +478,7 @@ public sealed partial class SessionSessionLimitsChangedEvent : SessionEvent
 
 /// <summary>Permission-mode transition details.</summary>
 /// <remarks>Represents the <c>session.permissions_changed</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionPermissionsChangedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -674,7 +674,7 @@ public sealed partial class SessionTaskCompleteEvent : SessionEvent
 
 /// <summary>Behavior-neutral record of structured runtime facts present when an agent completion decision is accepted.</summary>
 /// <remarks>Represents the <c>session.completion_receipt</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCompletionReceiptEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -688,7 +688,7 @@ public sealed partial class SessionCompletionReceiptEvent : SessionEvent
 
 /// <summary>Experimental transient signal that HydraFusion routing has started for an eligible turn.</summary>
 /// <remarks>Represents the <c>session.fusion_route_started</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionFusionRouteStartedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -702,7 +702,7 @@ public sealed partial class SessionFusionRouteStartedEvent : SessionEvent
 
 /// <summary>Experimental durable HydraFusion routing failure and the deterministic concrete fallback selected for the turn.</summary>
 /// <remarks>Represents the <c>session.fusion_route_failed</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionFusionRouteFailedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -716,7 +716,7 @@ public sealed partial class SessionFusionRouteFailedEvent : SessionEvent
 
 /// <summary>Experimental durable validated HydraFusion route and turn policy.</summary>
 /// <remarks>Represents the <c>session.fusion_resolved</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionFusionResolvedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -730,7 +730,7 @@ public sealed partial class SessionFusionResolvedEvent : SessionEvent
 
 /// <summary>Experimental durable aggregate outcome of a HydraFusion turn.</summary>
 /// <remarks>Represents the <c>session.fusion_completed</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionFusionCompletedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -835,7 +835,7 @@ public sealed partial class AssistantIntentEvent : SessionEvent
 
 /// <summary>Experimental transient HydraFusion phase/model/role signal.</summary>
 /// <remarks>Represents the <c>assistant.fusion_phase_started</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantFusionPhaseStartedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -849,7 +849,7 @@ public sealed partial class AssistantFusionPhaseStartedEvent : SessionEvent
 
 /// <summary>Experimental content-safe activity signal for a running HydraFusion phase.</summary>
 /// <remarks>Represents the <c>assistant.fusion_phase_activity</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantFusionPhaseActivityEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -863,7 +863,7 @@ public sealed partial class AssistantFusionPhaseActivityEvent : SessionEvent
 
 /// <summary>Experimental durable HydraFusion phase output and lossless replay checkpoint.</summary>
 /// <remarks>Represents the <c>assistant.fusion_phase_completed</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantFusionPhaseCompletedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -877,7 +877,7 @@ public sealed partial class AssistantFusionPhaseCompletedEvent : SessionEvent
 
 /// <summary>Experimental durable typed HydraFusion phase failure and degradation transition.</summary>
 /// <remarks>Represents the <c>assistant.fusion_phase_failed</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantFusionPhaseFailedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1190,7 +1190,7 @@ public sealed partial class SkillInvokedEvent : SessionEvent
 
 /// <summary>Internal durable skill invocation receipt whose content resolves from an earlier inline skill event in the same session.</summary>
 /// <remarks>Represents the <c>skill.invoked_ref</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SkillInvokedRefEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1204,7 +1204,7 @@ public sealed partial class SkillInvokedRefEvent : SessionEvent
 
 /// <summary>Exact skill context delivered to the model during a tool phase. This is not a user submission or another skill invocation.</summary>
 /// <remarks>Represents the <c>skill.context_delivered</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SkillContextDeliveredEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1218,7 +1218,7 @@ public sealed partial class SkillContextDeliveredEvent : SessionEvent
 
 /// <summary>Internal durable receipt that reconstructs exact model-visible skill context from earlier session content.</summary>
 /// <remarks>Represents the <c>skill.context_delivered_ref</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SkillContextDeliveredRefEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1362,7 +1362,7 @@ public sealed partial class HookProgressEvent : SessionEvent
 
 /// <summary>Canonical bytes for a content-addressed binary asset shared by reference across events.</summary>
 /// <remarks>Represents the <c>session.binary_asset</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionBinaryAssetEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1428,7 +1428,7 @@ public sealed partial class PermissionCompletedEvent : SessionEvent
 
 /// <summary>Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.</summary>
 /// <remarks>Represents the <c>permission.carriedForward</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionCarriedForwardEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1442,7 +1442,7 @@ public sealed partial class PermissionCarriedForwardEvent : SessionEvent
 
 /// <summary>Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.</summary>
 /// <remarks>Represents the <c>permission.messageAuthorization</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionMessageAuthorizationEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1456,7 +1456,7 @@ public sealed partial class PermissionMessageAuthorizationEvent : SessionEvent
 
 /// <summary>Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Also records whether that pass activates ongoing extraction; contextual-assent-only passes do not, so unrelated future messages remain outside extraction.</summary>
 /// <remarks>Represents the <c>permission.messageAuthorizationRead</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionMessageAuthorizationReadEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1470,7 +1470,7 @@ public sealed partial class PermissionMessageAuthorizationReadEvent : SessionEve
 
 /// <summary>Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.</summary>
 /// <remarks>Represents the <c>permission.messageAuthorizationDegraded</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionMessageAuthorizationDegradedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1484,7 +1484,7 @@ public sealed partial class PermissionMessageAuthorizationDegradedEvent : Sessio
 
 /// <summary>Records that deterministic text recognition found likely assent in the human turn immediately following a root Autopilot permission request that was blocked because no interactive response was available. This event grants no authority; its model-facing projection only suggests retrying the unchanged operation.</summary>
 /// <remarks>Represents the <c>permission.assentDetected</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionAssentDetectedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1498,7 +1498,7 @@ public sealed partial class PermissionAssentDetectedEvent : SessionEvent
 
 /// <summary>Freezes a blinded contextual authorization proposal whose verbatim human span was deterministically bound to the immediately preceding blocked permission request. The event carries no action fields; replay re-derives the exact action from the earlier permission request and mints a one-shot message grant only when the binding and span still verify.</summary>
 /// <remarks>Represents the <c>permission.contextualAuthorization</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionContextualAuthorizationEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1655,7 +1655,7 @@ public sealed partial class SessionCustomNotificationEvent : SessionEvent
 
 /// <summary>Ordered output and terminal state for a transient query that does not modify conversation history.</summary>
 /// <remarks>Represents the <c>ui.ephemeral_query</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class UiEphemeralQueryEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1786,7 +1786,7 @@ public sealed partial class SessionLimitsExhaustedCompletedEvent : SessionEvent
 
 /// <summary>Auto Intent resolution: the concrete model the session settled on for the first prompt of an auto-mode session, and why. Lets SDK clients render the chosen model and the full reason it was picked. The core selection fields (chosenModel/reasoningBucket/categoryScores) are stable; the routing-analytics fields (predictedLabel/confidence/candidateModels) mirror the upstream intent service and may evolve, hence the event's experimental stability.</summary>
 /// <remarks>Represents the <c>session.auto_mode_resolved</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionAutoModeResolvedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1800,7 +1800,7 @@ public sealed partial class SessionAutoModeResolvedEvent : SessionEvent
 
 /// <summary>Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively across device, server, policy-helper, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.</summary>
 /// <remarks>Represents the <c>session.managed_settings_resolved</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionManagedSettingsResolvedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1814,7 +1814,7 @@ public sealed partial class SessionManagedSettingsResolvedEvent : SessionEvent
 
 /// <summary>Runtime enforcement of enterprise managed settings: fires when the session blocks or caps a runtime action because enterprise policy governs it, so SDK clients can explain *why* an action was governed. Unlike `session.managed_settings_resolved` (which reports *what* is managed), this reports a concrete governed action — e.g. a user or host tried to turn on a bypass-permissions escalation while policy disables it. Emitted live (not persisted to the session event log) on user/host-initiated attempts only, never for silent policy application. Marked experimental while the managed-settings surface stabilizes.</summary>
 /// <remarks>Represents the <c>session.managed_settings_enforced</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionManagedSettingsEnforcedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1906,7 +1906,7 @@ public sealed partial class SessionBackgroundTasksChangedEvent : SessionEvent
 
 /// <summary>Ephemeral invalidation signal for a changed factory run.</summary>
 /// <remarks>Represents the <c>factory.run_updated</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FactoryRunUpdatedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1920,7 +1920,7 @@ public sealed partial class FactoryRunUpdatedEvent : SessionEvent
 
 /// <summary>Ephemeral signal that a factory run attempt began executing.</summary>
 /// <remarks>Represents the <c>factory.run_started</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FactoryRunStartedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -1934,7 +1934,7 @@ public sealed partial class FactoryRunStartedEvent : SessionEvent
 
 /// <summary>Ephemeral signal that a factory run reached a terminal status.</summary>
 /// <remarks>Represents the <c>factory.run_settled</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FactoryRunSettledEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -2078,7 +2078,7 @@ public sealed partial class SessionExtensionsLoadedEvent : SessionEvent
 
 /// <summary>Payload of `session.canvas.opened` with canvas instance and provider IDs plus optional icon, title, status, URL, and input.</summary>
 /// <remarks>Represents the <c>session.canvas.opened</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasOpenedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -2092,7 +2092,7 @@ public sealed partial class SessionCanvasOpenedEvent : SessionEvent
 
 /// <summary>Payload of `session.canvas.registry_changed` listing the canvas declarations currently available.</summary>
 /// <remarks>Represents the <c>session.canvas.registry_changed</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasRegistryChangedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -2106,7 +2106,7 @@ public sealed partial class SessionCanvasRegistryChangedEvent : SessionEvent
 
 /// <summary>Payload of `session.canvas.closed` with the closed canvas instance ID, provider ID, and canvas ID.</summary>
 /// <remarks>Represents the <c>session.canvas.closed</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasClosedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -2120,7 +2120,7 @@ public sealed partial class SessionCanvasClosedEvent : SessionEvent
 
 /// <summary>Transient signal that an open canvas instance's provider has dropped (for example the extension is reloading mid-session). The host should keep the panel mounted and surface a reconnecting affordance rather than tearing it down; a subsequent `session.canvas.opened` for the same instanceId clears the affordance once the provider reconnects with a fresh url. Ephemeral and never persisted, so it is never replayed on cold resume.</summary>
 /// <remarks>Represents the <c>session.canvas.unavailable</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasUnavailableEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -2134,7 +2134,7 @@ public sealed partial class SessionCanvasUnavailableEvent : SessionEvent
 
 /// <summary>Durable record that a canvas instance is open, used to restore open canvases on cold session resume. Intentionally omits the transient url and availability.</summary>
 /// <remarks>Represents the <c>session.canvas.recorded</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasRecordedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -2148,7 +2148,7 @@ public sealed partial class SessionCanvasRecordedEvent : SessionEvent
 
 /// <summary>Durable record that a canvas instance was closed, superseding a prior instance_recorded during resume replay.</summary>
 /// <remarks>Represents the <c>session.canvas.removed</c> event.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasRemovedEvent : SessionEvent
 {
     /// <inheritdoc />
@@ -2662,7 +2662,7 @@ public sealed partial class SessionModelDeselectedData
 }
 
 /// <summary>Live-only Auto preference recommendation from Copilot API after a successful Auto model call.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionAutoTierRecommendationData
 {
     /// <summary>Recommended Auto preference.</summary>
@@ -2721,23 +2721,23 @@ public sealed partial class SessionSessionLimitsChangedData
 }
 
 /// <summary>Permission-mode transition details.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionPermissionsChangedData
 {
     /// <summary>Explicit LLM judge model override used by assisted mode; omitted when the provider default applies.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApprovalModel")]
     public string? AssistedApprovalModel { get; set; }
 
     /// <summary>Permission mode after the change.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("mode")]
     public PermissionMode? Mode { get; set; }
 
     /// <summary>Permission mode before the change.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("previousMode")]
     public PermissionMode? PreviousMode { get; set; }
@@ -2844,11 +2844,16 @@ public sealed partial class SessionTruncationData
 /// <summary>Session rewind details including target event and count of removed events.</summary>
 public sealed partial class SessionSnapshotRewindData
 {
+    /// <summary>The removed events, starting with `upToEventId`. Later events not listed were kept, such as a background agent's events that interleaved with a withdrawn turn.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("eventIds")]
+    public string[]? EventIds { get; set; }
+
     /// <summary>Number of events that were removed by the rewind.</summary>
     [JsonPropertyName("eventsRemoved")]
     public required long EventsRemoved { get; set; }
 
-    /// <summary>Event ID that was rewound to; this event and all after it were removed.</summary>
+    /// <summary>First removed event. Without `eventIds`, it and every event after it were removed.</summary>
     [JsonPropertyName("upToEventId")]
     public required string UpToEventId { get; set; }
 }
@@ -2923,7 +2928,7 @@ public sealed partial class SessionShutdownData
     public required TimeSpan TotalApiDuration { get; set; }
 
     /// <summary>Session-wide accumulated nano-AI units cost.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("totalNanoAiu")]
     public double? TotalNanoAiu { get; set; }
@@ -3251,7 +3256,7 @@ public sealed partial class SessionTaskCompleteData
 }
 
 /// <summary>Behavior-neutral record of structured runtime facts present when an agent completion decision is accepted.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCompletionReceiptData
 {
     /// <summary>One-based accepted completion receipt ordinal in the durable session history.</summary>
@@ -3289,7 +3294,7 @@ public sealed partial class SessionCompletionReceiptData
 }
 
 /// <summary>Experimental transient signal that HydraFusion routing has started for an eligible turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionFusionRouteStartedData
 {
     /// <summary>Identifier for this routing attempt before a durable Fusion turn exists.</summary>
@@ -3312,7 +3317,7 @@ public sealed partial class SessionFusionRouteStartedData
 }
 
 /// <summary>Experimental durable HydraFusion routing failure and the deterministic concrete fallback selected for the turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionFusionRouteFailedData
 {
     /// <summary>Identifier of the routing attempt that failed.</summary>
@@ -3347,7 +3352,7 @@ public sealed partial class SessionFusionRouteFailedData
 }
 
 /// <summary>Experimental durable validated HydraFusion route and turn policy.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionFusionResolvedData
 {
     /// <summary>Version of the validated HydraFusion event contract.</summary>
@@ -3372,7 +3377,7 @@ public sealed partial class SessionFusionResolvedData
     public required string FusionId { get; set; }
 
     /// <summary>Short human-readable summary of the selected workflow, suitable for immediate client display after routing. May be absent in older durable events; omit the explanation or derive one from pattern and phasePlan. Display text, not a stable machine-readable value.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("hint")]
     public string? Hint { get; set; }
@@ -3387,7 +3392,7 @@ public sealed partial class SessionFusionResolvedData
     public required FusionPattern Pattern { get; set; }
 
     /// <summary>Presentation-neutral phase plan for clients that render workflow progress.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("phasePlan")]
     public FusionPhasePlanStep[]? PhasePlan { get; set; }
@@ -3454,7 +3459,7 @@ public sealed partial class SessionFusionResolvedData
 }
 
 /// <summary>Experimental durable aggregate outcome of a HydraFusion turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionFusionCompletedData
 {
     /// <summary>Total cached input tokens reported across all phases.</summary>
@@ -3606,7 +3611,7 @@ public sealed partial class UserMessageData
     [JsonPropertyName("parentAgentTaskId")]
     public string? ParentAgentTaskId { get; set; }
 
-    /// <summary>Responses reasoning settings anchored before this model-facing message, for cache-stable history replay.</summary>
+    /// <summary>Provider reasoning settings anchored before this model-facing message for cache-stable replay; the historical responsesReasoning name is retained for compatibility.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("responsesReasoning")]
     public ResponsesReasoning? ResponsesReasoning { get; set; }
@@ -3750,7 +3755,7 @@ public sealed partial class AssistantIntentData
 }
 
 /// <summary>Experimental transient HydraFusion phase/model/role signal.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantFusionPhaseStartedData
 {
     /// <summary>Conversation scope in which the phase executes.</summary>
@@ -3783,7 +3788,7 @@ public sealed partial class AssistantFusionPhaseStartedData
 }
 
 /// <summary>Experimental content-safe activity signal for a running HydraFusion phase.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantFusionPhaseActivityData
 {
     /// <summary>Kind of real activity observed.</summary>
@@ -3826,7 +3831,7 @@ public sealed partial class AssistantFusionPhaseActivityData
 }
 
 /// <summary>Experimental durable HydraFusion phase output and lossless replay checkpoint.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantFusionPhaseCompletedData
 {
     /// <summary>Provider-normalized textual output produced by the phase.</summary>
@@ -3893,7 +3898,7 @@ public sealed partial class AssistantFusionPhaseCompletedData
 }
 
 /// <summary>Experimental durable typed HydraFusion phase failure and degradation transition.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantFusionPhaseFailedData
 {
     /// <summary>Conversation scope in which the phase executed.</summary>
@@ -4041,7 +4046,7 @@ public sealed partial class AssistantMessageData
     public long? ChunkIndex { get; set; }
 
     /// <summary>Provider-agnostic citations linking spans of this message's content to the sources that support them. Experimental; only populated when citation emission is enabled.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("citations")]
     public Citations? Citations { get; set; }
@@ -4061,7 +4066,7 @@ public sealed partial class AssistantMessageData
     public string? EncryptedContent { get; set; }
 
     /// <summary>Experimental HydraFusion source attribution for this ordinary authoritative assistant message.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("fusion")]
     public FusionAttribution? Fusion { get; set; }
@@ -4273,7 +4278,7 @@ public sealed partial class AssistantUsageData
     public AssistantUsageCopilotUsage? CopilotUsage { get; set; }
 
     /// <summary>Model multiplier cost for billing purposes.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("cost")]
     public double? Cost { get; set; }
@@ -4296,7 +4301,7 @@ public sealed partial class AssistantUsageData
     internal string? FrontierSource { get; set; }
 
     /// <summary>Experimental HydraFusion attribution for this concrete model call's usage.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("fusion")]
     public FusionAttribution? Fusion { get; set; }
@@ -4624,7 +4629,7 @@ public sealed partial class ModelCallFailureData
     public ModelCallFailureKind? FailureKind { get; set; }
 
     /// <summary>Experimental HydraFusion attribution for this failed concrete model call.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("fusion")]
     public FusionAttribution? Fusion { get; set; }
@@ -4745,7 +4750,7 @@ public sealed partial class ModelCallFinishedData
 public sealed partial class ModelCallStartData
 {
     /// <summary>Experimental HydraFusion attribution for this concrete model call.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("fusion")]
     public FusionAttribution? Fusion { get; set; }
@@ -4805,7 +4810,7 @@ public sealed partial class ToolExecutionStartData
     public bool? DisplayVerbatim { get; set; }
 
     /// <summary>Experimental HydraFusion attribution for this tool execution.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("fusion")]
     public FusionAttribution? Fusion { get; set; }
@@ -4916,7 +4921,7 @@ public sealed partial class ToolExecutionCompleteData
     public ToolExecutionCompleteError? Error { get; set; }
 
     /// <summary>Experimental HydraFusion attribution for this tool completion.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("fusion")]
     public FusionAttribution? Fusion { get; set; }
@@ -4932,7 +4937,7 @@ public sealed partial class ToolExecutionCompleteData
     public bool? IsUserRequested { get; set; }
 
     /// <summary>FIDES IFC label projected from tool ingress metadata (MCP `CallToolResult._meta` or synthesized built-in ingress labels). Persisted as `{ ifc: ... }` so the label survives session resume, including model-visible failure results. Experimental.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("mcpMeta")]
     public JsonElement? McpMeta { get; set; }
@@ -4967,7 +4972,7 @@ public sealed partial class ToolExecutionCompleteData
     public bool? Sandboxed { get; set; }
 
     /// <summary>Experimental shell completion facts captured before the persisted result contents are stripped.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("shellExecution")]
     public ToolExecutionCompleteShellExecution? ShellExecution { get; set; }
@@ -5598,7 +5603,7 @@ public sealed partial class SystemNotificationData
     [JsonPropertyName("kind")]
     public required SystemNotification Kind { get; set; }
 
-    /// <summary>Responses reasoning settings anchored before this model-facing message, for cache-stable history replay.</summary>
+    /// <summary>Provider reasoning settings anchored before this model-facing message for cache-stable replay; the historical responsesReasoning name is retained for compatibility.</summary>
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("responsesReasoning")]
     public ResponsesReasoning? ResponsesReasoning { get; set; }
@@ -5655,7 +5660,7 @@ public sealed partial class PermissionCompletedData
     public TaskBlocker? Blocker { get; set; }
 
     /// <summary>Who decided this permission request. Absent on completions recorded before this field existed, which consumers must treat as "not a human decision" rather than assuming one. Authorization records are minted only for `human_response`; an assisted-approval verdict, a host policy, an unattended fallback, and a hook resolution all produce the same `result` a person does, so this is the only field that distinguishes them.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("decisionSource")]
     public PermissionDecisionSource? DecisionSource { get; set; }
@@ -5680,155 +5685,155 @@ public sealed partial class PermissionCompletedData
 }
 
 /// <summary>Records that a live authorization record from an earlier human decision in this session contained a permission proposal, so it ran without another prompt. This mints no authority: it accounts for one more effect against the prior grant, which is what lets a replayed session agree with the live one about how much of that grant is left.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionCarriedForwardData
 {
     /// <summary>Always `authorization_carry_forward`. Stated explicitly so a consumer reading this event cannot mistake it for a human, host-policy, or assisted-approval decision.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("decisionSource")]
     public required PermissionDecisionSource DecisionSource { get; set; }
 
     /// <summary>Identity of the prior authorization record that contained the proposal.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("recordId")]
     public required string RecordId { get; set; }
 
     /// <summary>Authorization edge minted for this admission. Not a prompt id: no prompt was raised, so no client should expect a request with this id.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("requestId")]
     public required string RequestId { get; set; }
 
     /// <summary>Tool call this admission authorizes. Its execution receipts the prior grant, which is how a single-effect approval is spent rather than carried forward again.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("toolCallId")]
     public required string ToolCallId { get; set; }
 }
 
 /// <summary>Freezes one blinded, verbatim-verified authorization claim the runtime minted from a human user message, so a resumed session re-establishes the same grant deterministically instead of re-running the extraction model. This mints no authority on its own: it records what a blinded proposer pointed at and the trusted discriminator the runtime established, and deterministic establishment runs on replay. Persisted so recorded authority survives compaction and process resume.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionMessageAuthorizationData
 {
     /// <summary>The kind of effect authorized, as an action-class identifier.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("actionClass")]
     public required string ActionClass { get; set; }
 
     /// <summary>Whether the claim granted or denied authority.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("polarity")]
     public required PermissionMessageAuthorizationPolarity Polarity { get; set; }
 
     /// <summary>Deterministic identity of the record, derived from the turn and span offsets so re-extracting the same span mints nothing new.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("recordId")]
     public required string RecordId { get; set; }
 
     /// <summary>End byte offset of the authorizing span within the turn.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("spanEnd")]
     public required long SpanEnd { get; set; }
 
     /// <summary>Start byte offset of the authorizing span within the turn.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("spanStart")]
     public required long SpanStart { get; set; }
 
     /// <summary>Concrete named targets that appear verbatim inside the span.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("targetMembers")]
     public string[]? TargetMembers { get; set; }
 
     /// <summary>The task the permission is scoped to, when the human named one.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("task")]
     public string? Task { get; set; }
 
     /// <summary>The human turn the quoted span was read from.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("turnIndex")]
     public required long TurnIndex { get; set; }
 
     /// <summary>The trusted version discriminator, when one exists. Exact shell-command grants carry the byte-identical commands grounded in the human span; world-derived classes carry a file object, remote tip, or runner only when that state was captured safely. An opaque object mirroring the runtime's adjacently-tagged resolution.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("world")]
     public JsonElement? World { get; set; }
 }
 
 /// <summary>Records that one human turn has been read by the blinded authorization proposer, whether or not it minted anything, so a resumed session does not re-run the extraction model on a turn the live session already read. Also records whether that pass activates ongoing extraction; contextual-assent-only passes do not, so unrelated future messages remain outside extraction.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionMessageAuthorizationReadData
 {
     /// <summary>Whether this read activates ongoing message-backed extraction. False for a contextual-assent-only pass while auto-approval is off, so unrelated future messages remain outside extraction.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("activatesExtraction")]
     public bool? ActivatesExtraction { get; set; }
 
     /// <summary>The human turn that was read by the proposer.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("turnIndex")]
     public required long TurnIndex { get; set; }
 }
 
 /// <summary>Records that message-backed authorization could not safely represent one human turn before compaction. The runtime may compact the original message after this marker is durable, but message-derived carry-forward and assisted auto-approval remain disabled for the rest of the session so subsequent commands continue through the ordinary permission prompt.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionMessageAuthorizationDegradedData
 {
     /// <summary>The human turn that could not be represented safely.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("turnIndex")]
     public required long TurnIndex { get; set; }
 }
 
 /// <summary>Records that deterministic text recognition found likely assent in the human turn immediately following a root Autopilot permission request that was blocked because no interactive response was available. This event grants no authority; its model-facing projection only suggests retrying the unchanged operation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionAssentDetectedData
 {
     /// <summary>Permission request the likely assent may refer to. The runtime derives this from the preceding durable blocker; the human message and extraction model do not choose it.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("requestId")]
     public required string RequestId { get; set; }
 
     /// <summary>Human turn whose text triggered the deterministic assent recognizer.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("turnIndex")]
     public required long TurnIndex { get; set; }
 }
 
 /// <summary>Freezes a blinded contextual authorization proposal whose verbatim human span was deterministically bound to the immediately preceding blocked permission request. The event carries no action fields; replay re-derives the exact action from the earlier permission request and mints a one-shot message grant only when the binding and span still verify.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionContextualAuthorizationData
 {
     /// <summary>Whether the contextual human span granted or denied authority.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("polarity")]
     public required PermissionMessageAuthorizationPolarity Polarity { get; set; }
 
     /// <summary>Deterministic identity of the contextual message grant.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("recordId")]
     public required string RecordId { get; set; }
 
     /// <summary>Original blocked permission request selected by deterministic event ordering, never by the extraction model.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("requestId")]
     public required string RequestId { get; set; }
 
     /// <summary>End byte offset of the contextual decision span within the turn.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("spanEnd")]
     public required long SpanEnd { get; set; }
 
     /// <summary>Start byte offset of the contextual decision span within the turn.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("spanStart")]
     public required long SpanStart { get; set; }
 
     /// <summary>Human turn containing the contextual decision.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonPropertyName("turnIndex")]
     public required long TurnIndex { get; set; }
 }
@@ -6072,7 +6077,7 @@ public sealed partial class SessionCustomNotificationData
 }
 
 /// <summary>Ordered output and terminal state for a transient query that does not modify conversation history.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class UiEphemeralQueryData
 {
     /// <summary>Full response text, present for the `completed` phase.</summary>
@@ -6251,7 +6256,7 @@ public sealed partial class SessionLimitsExhaustedCompletedData
 }
 
 /// <summary>Auto Intent resolution: the concrete model the session settled on for the first prompt of an auto-mode session, and why. Lets SDK clients render the chosen model and the full reason it was picked. The core selection fields (chosenModel/reasoningBucket/categoryScores) are stable; the routing-analytics fields (predictedLabel/confidence/candidateModels) mirror the upstream intent service and may evolve, hence the event's experimental stability.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionAutoModeResolvedData
 {
     /// <summary>Models offered to the router for this resolution.</summary>
@@ -6330,7 +6335,7 @@ public sealed partial class SessionAutoModeResolvedData
 }
 
 /// <summary>Enterprise managed-settings resolution: the effective managed settings the session applied and which channels contributed, so SDK clients can show users what is enterprise-managed. Fires whenever managed policy is (re)applied — at session start, on resume, and on account switch. This is an ephemeral live snapshot (delivered to subscribers but not persisted to the session event log), because at session start it resolves before `session.start` is emitted. Device values take precedence over server values, then the policy helper, per ordinary key, while permissions compose restrictively across device, server, policy-helper, and SDK-client layers. The account-scoped `getManagedSettings()` API does not include session-local client injection. Marked experimental while the managed-settings surface stabilizes.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionManagedSettingsResolvedData
 {
     /// <summary>Whether enterprise policy disables bypass-permissions ("yolo") mode for this session. Deny-wins across layers, and forced on when `failClosed` is true.</summary>
@@ -6384,7 +6389,7 @@ public sealed partial class SessionManagedSettingsResolvedData
 }
 
 /// <summary>Runtime enforcement of enterprise managed settings: fires when the session blocks or caps a runtime action because enterprise policy governs it, so SDK clients can explain *why* an action was governed. Unlike `session.managed_settings_resolved` (which reports *what* is managed), this reports a concrete governed action — e.g. a user or host tried to turn on a bypass-permissions escalation while policy disables it. Emitted live (not persisted to the session event log) on user/host-initiated attempts only, never for silent policy application. Marked experimental while the managed-settings surface stabilizes.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionManagedSettingsEnforcedData
 {
     /// <summary>The category of runtime action that managed policy governed.</summary>
@@ -6497,7 +6502,7 @@ public sealed partial class SessionBackgroundTasksChangedData
 }
 
 /// <summary>Ephemeral invalidation signal for a changed factory run.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FactoryRunUpdatedData
 {
     /// <summary>Monotonic revision now available for the run.</summary>
@@ -6510,7 +6515,7 @@ public sealed partial class FactoryRunUpdatedData
 }
 
 /// <summary>Ephemeral signal that a factory run attempt began executing.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FactoryRunStartedData
 {
     /// <summary>Attempt number this start committed; a resumed run increments it.</summary>
@@ -6527,7 +6532,7 @@ public sealed partial class FactoryRunStartedData
 }
 
 /// <summary>Ephemeral signal that a factory run reached a terminal status.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FactoryRunSettledData
 {
     /// <summary>AI credits this run consumed, in nano-AIU.</summary>
@@ -6654,7 +6659,7 @@ public sealed partial class SessionExtensionsLoadedData
 }
 
 /// <summary>Payload of `session.canvas.opened` with canvas instance and provider IDs plus optional icon, title, status, URL, and input.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasOpenedData
 {
     /// <summary>Provider-local canvas identifier.</summary>
@@ -6701,7 +6706,7 @@ public sealed partial class SessionCanvasOpenedData
 }
 
 /// <summary>Payload of `session.canvas.registry_changed` listing the canvas declarations currently available.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasRegistryChangedData
 {
     /// <summary>Canvas declarations currently available.</summary>
@@ -6710,7 +6715,7 @@ public sealed partial class SessionCanvasRegistryChangedData
 }
 
 /// <summary>Payload of `session.canvas.closed` with the closed canvas instance ID, provider ID, and canvas ID.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasClosedData
 {
     /// <summary>Provider-local canvas identifier.</summary>
@@ -6729,7 +6734,7 @@ public sealed partial class SessionCanvasClosedData
 }
 
 /// <summary>Transient signal that an open canvas instance's provider has dropped (for example the extension is reloading mid-session). The host should keep the panel mounted and surface a reconnecting affordance rather than tearing it down; a subsequent `session.canvas.opened` for the same instanceId clears the affordance once the provider reconnects with a fresh url. Ephemeral and never persisted, so it is never replayed on cold resume.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasUnavailableData
 {
     /// <summary>Provider-local canvas identifier.</summary>
@@ -6748,7 +6753,7 @@ public sealed partial class SessionCanvasUnavailableData
 }
 
 /// <summary>Durable record that a canvas instance is open, used to restore open canvases on cold session resume. Intentionally omits the transient url and availability.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasRecordedData
 {
     /// <summary>Provider-local canvas identifier.</summary>
@@ -6777,7 +6782,7 @@ public sealed partial class SessionCanvasRecordedData
 }
 
 /// <summary>Durable record that a canvas instance was closed, superseding a prior instance_recorded during resume replay.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class SessionCanvasRemovedData
 {
     /// <summary>Provider-local canvas identifier.</summary>
@@ -7050,13 +7055,13 @@ public sealed partial class HandoffRepository
 public sealed partial class ShutdownModelMetricRequests
 {
     /// <summary>Cumulative cost multiplier for requests to this model.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("cost")]
     public double? Cost { get; set; }
 
     /// <summary>Total number of API requests made to this model.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("count")]
     public long? Count { get; set; }
@@ -7111,7 +7116,7 @@ public sealed partial class ShutdownModelMetric
     public IDictionary<string, ShutdownModelMetricTokenDetail>? TokenDetails { get; set; }
 
     /// <summary>Accumulated nano-AI units cost for this model.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("totalNanoAiu")]
     public double? TotalNanoAiu { get; set; }
@@ -7282,7 +7287,7 @@ public sealed partial class CompactionCompleteCompactionTokensUsed
     public long? OutputTokens { get; set; }
 }
 
-/// <summary>Original request-level and effective conversation reasoning effort for a Responses history boundary.</summary>
+/// <summary>Original request-level and effective conversation reasoning effort for a provider history boundary; the historical type name is retained for compatibility.</summary>
 /// <remarks>Nested data type for <c>ResponsesReasoning</c>.</remarks>
 public sealed partial class ResponsesReasoning
 {
@@ -7367,7 +7372,7 @@ public sealed partial class PermissionRecoveryData
 
 /// <summary>Structured reason that the task cannot continue without intervention.</summary>
 /// <remarks>Nested data type for <c>TaskBlocker</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class TaskBlocker
 {
     /// <summary>Category of intervention that blocked the task.</summary>
@@ -7425,7 +7430,7 @@ public sealed partial class CompletionReceiptFinalTool
 
 /// <summary>Durable server recommendation for subsequent HydraFusion turns.</summary>
 /// <remarks>Nested data type for <c>FusionFollowUpRecommendation</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FusionFollowUpRecommendation
 {
     /// <summary>Recommended routing action for the next compaction turn.</summary>
@@ -7439,7 +7444,7 @@ public sealed partial class FusionFollowUpRecommendation
 
 /// <summary>Presentation-neutral phase planned for a HydraFusion turn.</summary>
 /// <remarks>Nested data type for <c>FusionPhasePlanStep</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FusionPhasePlanStep
 {
     /// <summary>Whether the phase executes only when an earlier phase requests it.</summary>
@@ -7461,7 +7466,7 @@ public sealed partial class FusionPhasePlanStep
 
 /// <summary>Validated HydraFusion routing capability scores.</summary>
 /// <remarks>Nested data type for <c>FusionScores</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FusionScores
 {
     /// <summary>Code-generation capability score returned by the authenticated router.</summary>
@@ -8033,7 +8038,7 @@ public partial class Attachment
 
 /// <summary>Internal durable terminal request staged by a HydraFusion phase until an idempotent final commit selects it.</summary>
 /// <remarks>Nested data type for <c>FusionStagedTerminal</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 internal sealed partial class FusionStagedTerminal
 {
     /// <summary>Gets or sets the <c>arguments</c> value.</summary>
@@ -8059,7 +8064,7 @@ internal sealed partial class FusionStagedTerminal
 
 /// <summary>Aggregate concrete-model usage for one HydraFusion phase.</summary>
 /// <remarks>Nested data type for <c>FusionPhaseUsage</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FusionPhaseUsage
 {
     /// <summary>Total cached input tokens reported for the phase.</summary>
@@ -8090,7 +8095,7 @@ public sealed partial class FusionPhaseUsage
 
 /// <summary>A source that backs one or more cited spans in the assistant's response.</summary>
 /// <remarks>Nested data type for <c>CitationSource</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class CitationSource
 {
     /// <summary>Stable, turn-scoped identifier for this source, referenced by CitationReference.sourceId.</summary>
@@ -8119,7 +8124,7 @@ public sealed partial class CitationSource
 
 /// <summary>A character range within the source's text content.</summary>
 /// <remarks>The <c>char</c> variant of <see cref="CitationLocation"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class CitationLocationChar : CitationLocation
 {
     /// <inheritdoc />
@@ -8137,7 +8142,7 @@ public sealed partial class CitationLocationChar : CitationLocation
 
 /// <summary>A page range within a paginated source document.</summary>
 /// <remarks>The <c>page</c> variant of <see cref="CitationLocation"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class CitationLocationPage : CitationLocation
 {
     /// <inheritdoc />
@@ -8155,7 +8160,7 @@ public sealed partial class CitationLocationPage : CitationLocation
 
 /// <summary>A content-block range within a structured source document.</summary>
 /// <remarks>The <c>block</c> variant of <see cref="CitationLocation"/>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class CitationLocationBlock : CitationLocation
 {
     /// <inheritdoc />
@@ -8173,7 +8178,7 @@ public sealed partial class CitationLocationBlock : CitationLocation
 
 /// <summary>Location within a cited source (character, page, or content-block range) that supports a span.</summary>
 /// <remarks>Polymorphic base type discriminated by <c>type</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonPolymorphic(
     TypeDiscriminatorPropertyName = "type",
     UnknownDerivedTypeHandling = JsonUnknownDerivedTypeHandling.FallBackToBaseType)]
@@ -8190,7 +8195,7 @@ public partial class CitationLocation
 
 /// <summary>A single citation occurrence linking a span of generated text to a supporting source.</summary>
 /// <remarks>Nested data type for <c>CitationReference</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class CitationReference
 {
     /// <summary>The exact text from the source that supports the cited span, when provided by the model.</summary>
@@ -8215,7 +8220,7 @@ public sealed partial class CitationReference
 
 /// <summary>A contiguous span of generated assistant text and the source references that support it.</summary>
 /// <remarks>Nested data type for <c>CitationSpan</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class CitationSpan
 {
     /// <summary>End offset of the cited span within the final assistant message content (UTF-16 code units, zero-based, exclusive).</summary>
@@ -8233,7 +8238,7 @@ public sealed partial class CitationSpan
 
 /// <summary>Provider-agnostic citations linking spans of the assistant's response to their supporting sources.</summary>
 /// <remarks>Nested data type for <c>Citations</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class Citations
 {
     /// <summary>Deduplicated set of sources referenced by the citation spans.</summary>
@@ -8247,7 +8252,7 @@ public sealed partial class Citations
 
 /// <summary>Experimental attribution linking an ordinary event to the HydraFusion turn, phase, and concrete source that produced it.</summary>
 /// <remarks>Nested data type for <c>FusionAttribution</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class FusionAttribution
 {
     /// <summary>Idempotency identifier for the authoritative commit, when the event belongs to the selected output.</summary>
@@ -8264,6 +8269,11 @@ public sealed partial class FusionAttribution
     [JsonPropertyName("fusionId")]
     public required string FusionId { get; set; }
 
+    /// <summary>Whether this model request consumed a user steering message rather than only internal Fusion work.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("hasUserSteering")]
+    public bool? HasUserSteering { get; set; }
+
     /// <summary>HydraFusion orchestration pattern selected for the turn.</summary>
     [JsonPropertyName("pattern")]
     public required string Pattern { get; set; }
@@ -8304,7 +8314,7 @@ public sealed partial class FusionAttribution
 
 /// <summary>Neutral provider-tagged reasoning content blocks preserved verbatim for round-tripping.</summary>
 /// <remarks>Nested data type for <c>AssistantMessageReasoningBlocks</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantMessageReasoningBlocks
 {
     /// <summary>Provider-native reasoning items or content blocks preserved verbatim, in order. A single response can carry several, and provider signatures or identifiers may depend on their exact content and ordering.</summary>
@@ -8319,7 +8329,7 @@ public sealed partial class AssistantMessageReasoningBlocks
 
 /// <summary>Neutral provider-tagged server-side tool-use payload (tool search, advisor) for verbatim round-tripping.</summary>
 /// <remarks>Nested data type for <c>AssistantMessageServerTools</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class AssistantMessageServerTools
 {
     /// <summary>Advisor model identifier associated with the server-tool payload.</summary>
@@ -8557,7 +8567,7 @@ public sealed partial class ModelCallFailureRequestFingerprint
 public sealed partial class ToolExecutionStartShellToolInfo
 {
     /// <summary>The command with a redundant leading `cd` into the working directory removed, present only when there was one to remove. Computed with the same routine the shell driver applies before spawning, so a surface that renders this shows the text that actually runs. Consumers that display it should keep the original tool arguments available on demand.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("displayCommand")]
     public string? DisplayCommand { get; set; }
@@ -8664,7 +8674,7 @@ public sealed partial class PersistedBinaryImage
 
 /// <summary>A binary result whose data was omitted from persistence due to the inline size limit.</summary>
 /// <remarks>Nested data type for <c>OmittedBinaryResult</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class OmittedBinaryResult
 {
     /// <summary>Decoded byte length of the omitted binary data.</summary>
@@ -8696,7 +8706,7 @@ public sealed partial class OmittedBinaryResult
 
 /// <summary>A reference to binary data persisted once on a session.binary_asset event and shared by id.</summary>
 /// <remarks>Nested data type for <c>BinaryAssetReference</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class BinaryAssetReference
 {
     /// <summary>Content-addressed id of the session.binary_asset event that holds this binary's bytes (e.g. "sha256:...").</summary>
@@ -8829,7 +8839,7 @@ public override void Write(Utf8JsonWriter writer, PersistedBinaryResult value, J
 
 /// <summary>A source supplied by a tool that should be made available to the model as citable content.</summary>
 /// <remarks>Nested data type for <c>CitableSource</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class CitableSource
 {
     /// <summary>The source text made available to the model as citable content.</summary>
@@ -9325,13 +9335,13 @@ public sealed partial class ToolExecutionCompleteUIResource
 public sealed partial class ToolExecutionCompleteResult
 {
     /// <summary>Model-facing binary results (base64 inline or size-omitted markers) sent to the LLM for this tool call.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("binaryResultsForLlm")]
     public PersistedBinaryResult[]? BinaryResultsForLlm { get; set; }
 
     /// <summary>Provider-neutral source material this tool makes available to the model as citable content. Persisted so it survives session resume. Experimental.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("citableSources")]
     public CitableSource[]? CitableSources { get; set; }
@@ -9351,7 +9361,7 @@ public sealed partial class ToolExecutionCompleteResult
     public string? DetailedContent { get; set; }
 
     /// <summary>FIDES IFC label projected from tool ingress metadata (MCP `CallToolResult._meta` or synthesized built-in ingress labels) — persisted as `{ ifc: ... }` (only the `ifc` key, not the whole `_meta`). Persisted so the FIDES IFC label survives session resume: the engine rehydrates accumulated taint by replaying these on load. Populated for ingress sources when FIDES IFC is on. Experimental.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("mcpMeta")]
     public JsonElement? McpMeta { get; set; }
@@ -9369,7 +9379,7 @@ public sealed partial class ToolExecutionCompleteResult
 
 /// <summary>Experimental shell completion facts retained independently of the full tool result.</summary>
 /// <remarks>Nested data type for <c>ToolExecutionCompleteShellExecution</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class ToolExecutionCompleteShellExecution
 {
     /// <summary>Process exit code reported by the shell driver.</summary>
@@ -10283,13 +10293,13 @@ public override bool? ManagedApprovalRequired
     public bool? RequestSandboxPermissive { get; set; }
 
     /// <summary>Runtime-resolved canonical object each possiblePaths entry names, keyed by the requested spelling, used for authorization identity checks. Internal and experimental; clients should continue to display possiblePaths.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("resolvedPaths")]
     public IDictionary<string, string>? ResolvedPaths { get; set; }
 
     /// <summary>Runtime-resolved canonical working directory the command runs in, used for authorization identity checks. Internal and experimental; clients should not display it.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("resolvedWorkingDirectory")]
     public string? ResolvedWorkingDirectory { get; set; }
@@ -10354,7 +10364,7 @@ public override bool? ManagedApprovalRequired
     public string? RequestSandboxBypassReason { get; set; }
 
     /// <summary>Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("resolvedPath")]
     public string? ResolvedPath { get; set; }
@@ -10401,7 +10411,7 @@ public override bool? ManagedApprovalRequired
     public string? RequestSandboxBypassReason { get; set; }
 
     /// <summary>Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("resolvedPath")]
     public string? ResolvedPath { get; set; }
@@ -10426,7 +10436,7 @@ public sealed partial class PermissionRequestMcp : PermissionRequest
     public JsonElement? Args { get; set; }
 
     /// <summary>Advisory runtime permission recommendation. The SDK host remains responsible for deciding the request and may reject it.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("permissionRecommendation")]
     public PermissionRecommendation? PermissionRecommendation { get; set; }
@@ -10523,7 +10533,7 @@ public sealed partial class PermissionApprovalEvaluation
 
 /// <summary>Assisted-approval judge information attached to a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request. The `recommendation` conveys the judge's disposition for this request.</summary>
 /// <remarks>Nested data type for <c>PermissionAssistedApproval</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class PermissionAssistedApproval
 {
     /// <summary>Runtime reason and judge-call metadata. Absent on older events; missing metadata means unknown, not that the judge was skipped.</summary>
@@ -10565,7 +10575,7 @@ public sealed partial class PermissionRequestMemory : PermissionRequest
     public PermissionRequestMemoryAction? Action { get; set; }
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -10868,7 +10878,7 @@ public sealed partial class PermissionPromptRequestCommands : PermissionPromptRe
     public override string Kind => "commands";
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -10929,7 +10939,7 @@ public sealed partial class PermissionPromptRequestWrite : PermissionPromptReque
     public override string Kind => "write";
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -10961,7 +10971,7 @@ public sealed partial class PermissionPromptRequestWrite : PermissionPromptReque
     public string? NewFileContents { get; set; }
 
     /// <summary>Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display fileName.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("resolvedPath")]
     public string? ResolvedPath { get; set; }
@@ -10981,7 +10991,7 @@ public sealed partial class PermissionPromptRequestRead : PermissionPromptReques
     public override string Kind => "read";
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11000,7 +11010,7 @@ public sealed partial class PermissionPromptRequestRead : PermissionPromptReques
     public required string Path { get; set; }
 
     /// <summary>Runtime-resolved canonical path used for authorization identity checks. Internal and experimental; clients should continue to display path.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("resolvedPath")]
     public string? ResolvedPath { get; set; }
@@ -11025,7 +11035,7 @@ public sealed partial class PermissionPromptRequestMcp : PermissionPromptRequest
     public JsonElement? Args { get; set; }
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11036,7 +11046,7 @@ public sealed partial class PermissionPromptRequestMcp : PermissionPromptRequest
     public bool? CanOfferServerWideApproval { get; set; }
 
     /// <summary>Advisory runtime permission recommendation. The host remains responsible for deciding the request and may reject it.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("permissionRecommendation")]
     public PermissionRecommendation? PermissionRecommendation { get; set; }
@@ -11068,7 +11078,7 @@ public sealed partial class PermissionPromptRequestUrl : PermissionPromptRequest
     public override string Kind => "url";
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11121,7 +11131,7 @@ public sealed partial class PermissionPromptRequestMemory : PermissionPromptRequ
     public PermissionRequestMemoryAction? Action { get; set; }
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11170,7 +11180,7 @@ public sealed partial class PermissionPromptRequestCustomTool : PermissionPrompt
     public JsonElement? Args { get; set; }
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11202,7 +11212,7 @@ public sealed partial class PermissionPromptRequestPath : PermissionPromptReques
     public required PermissionPromptRequestPathAccessKind AccessKind { get; set; }
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11226,7 +11236,7 @@ public sealed partial class PermissionPromptRequestHook : PermissionPromptReques
     public override string Kind => "hook";
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11260,7 +11270,7 @@ public sealed partial class PermissionPromptRequestExtensionManagement : Permiss
     public override string Kind => "extension-management";
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11293,7 +11303,7 @@ public sealed partial class PermissionPromptRequestFactory : PermissionPromptReq
     public required string ApprovalKey { get; set; }
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11378,7 +11388,7 @@ public sealed partial class PermissionPromptRequestExtensionPermissionAccess : P
     public override string Kind => "extension-permission-access";
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11406,7 +11416,7 @@ public sealed partial class PermissionPromptRequestExtensionEnvAccess : Permissi
     public override string Kind => "extension-env-access";
 
     /// <summary>Assisted-approval judge information for this request; present only in assisted mode.</summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("assistedApproval")]
     public PermissionAssistedApproval? AssistedApproval { get; set; }
@@ -11853,6 +11863,11 @@ public sealed partial class McpOauthRequiredStaticClientConfig
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
     [JsonPropertyName("publicClient")]
     public bool? PublicClient { get; set; }
+
+    /// <summary>Configured OAuth scope string used when the server challenge omits scope or provides an empty scope.</summary>
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
+    [JsonPropertyName("scope")]
+    public string? Scope { get; set; }
 }
 
 /// <summary>OAuth WWW-Authenticate parameters parsed from an MCP auth challenge.</summary>
@@ -12101,7 +12116,7 @@ public sealed partial class ExtensionsLoadedExtension
 
 /// <summary>A single action within a canvas declaration, with its name, optional description, and optional input schema.</summary>
 /// <remarks>Nested data type for <c>CanvasRegistryChangedCanvasAction</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class CanvasRegistryChangedCanvasAction
 {
     /// <summary>Action description.</summary>
@@ -12121,7 +12136,7 @@ public sealed partial class CanvasRegistryChangedCanvasAction
 
 /// <summary>A single canvas declaration in `session.canvas.registry_changed`, including provider IDs, display metadata, input schema, and actions.</summary>
 /// <remarks>Nested data type for <c>CanvasRegistryChangedCanvas</c>.</remarks>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed partial class CanvasRegistryChangedCanvas
 {
     /// <summary>Actions the agent or host may invoke.</summary>
@@ -13471,7 +13486,7 @@ public override void Write(Utf8JsonWriter writer, AutoTierSwitchFailureReason va
 }
 
 /// <summary>Permission mode for the session.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionMode : IEquatable<PermissionMode>
@@ -14526,7 +14541,7 @@ public override void Write(Utf8JsonWriter writer, CompletionReceiptStopReason va
 }
 
 /// <summary>Kind of turn for which HydraFusion routing is running.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FusionTurnKind : IEquatable<FusionTurnKind>
@@ -14588,7 +14603,7 @@ public override void Write(Utf8JsonWriter writer, FusionTurnKind value, JsonSeri
 }
 
 /// <summary>Server-recommended routing behavior for a later HydraFusion turn.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FusionFollowUpAction : IEquatable<FusionFollowUpAction>
@@ -14650,7 +14665,7 @@ public override void Write(Utf8JsonWriter writer, FusionFollowUpAction value, Js
 }
 
 /// <summary>Validated HydraFusion execution pattern.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FusionPattern : IEquatable<FusionPattern>
@@ -14715,7 +14730,7 @@ public override void Write(Utf8JsonWriter writer, FusionPattern value, JsonSeria
 }
 
 /// <summary>HydraFusion phase kind.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FusionPhaseKind : IEquatable<FusionPhaseKind>
@@ -14792,7 +14807,7 @@ public override void Write(Utf8JsonWriter writer, FusionPhaseKind value, JsonSer
 }
 
 /// <summary>Conversation scope in which a HydraFusion phase executes.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FusionConversationScope : IEquatable<FusionConversationScope>
@@ -15299,7 +15314,7 @@ public override void Write(Utf8JsonWriter writer, ModelCallFailureTransport valu
 }
 
 /// <summary>Content-safe activity observed while a HydraFusion phase is running.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FusionPhaseActivityKind : IEquatable<FusionPhaseActivityKind>
@@ -15364,7 +15379,7 @@ public override void Write(Utf8JsonWriter writer, FusionPhaseActivityKind value,
 }
 
 /// <summary>How a durable phase checkpoint contributes its exact message to canonical root history.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FusionProjectionMode : IEquatable<FusionProjectionMode>
@@ -15429,7 +15444,7 @@ public override void Write(Utf8JsonWriter writer, FusionProjectionMode value, Js
 }
 
 /// <summary>Durable outcome status of a HydraFusion phase.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct FusionPhaseStatus : IEquatable<FusionPhaseStatus>
@@ -15555,7 +15570,7 @@ public override void Write(Utf8JsonWriter writer, AssistantMessageToolRequestTyp
 }
 
 /// <summary>The system that produced a citation.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct CitationProvider : IEquatable<CitationProvider>
@@ -17929,7 +17944,7 @@ public override void Write(Utf8JsonWriter writer, SystemNotificationFactoryCompl
 }
 
 /// <summary>Advisory recommendation the runtime attaches to a permission request whose origin it can vouch for by construction. Unlike the auto-approval judge this does not depend on auto mode and does not evaluate what the tool call does; its absence simply means the runtime has no opinion and the request follows the host's normal approval flow.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionRecommendation : IEquatable<PermissionRecommendation>
@@ -18325,7 +18340,7 @@ public override void Write(Utf8JsonWriter writer, PermissionApprovalEvaluationRe
 }
 
 /// <summary>Why the assisted-approval judge produced no usable recommendation. Present only alongside an `error` recommendation, where the human-readable reason is a fixed string and therefore cannot distinguish these cases. Intended to make a judge failure reportable by a consumer that has no access to the host's logs.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AssistedApprovalJudgeFailureReason : IEquatable<AssistedApprovalJudgeFailureReason>
@@ -18396,7 +18411,7 @@ public override void Write(Utf8JsonWriter writer, AssistedApprovalJudgeFailureRe
 }
 
 /// <summary>Outcome of the assisted-approval safety judge for a permission request. Present only in assisted mode; its absence means the judge did not evaluate the request.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct AssistedApprovalRecommendation : IEquatable<AssistedApprovalRecommendation>
@@ -18781,7 +18796,7 @@ public override void Write(Utf8JsonWriter writer, PermissionDecisionSource value
 }
 
 /// <summary>Which direction a message-backed authorization claim moves authority in.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct PermissionMessageAuthorizationPolarity : IEquatable<PermissionMessageAuthorizationPolarity>
@@ -19227,7 +19242,7 @@ public override void Write(Utf8JsonWriter writer, McpHeadersRefreshCompletedOutc
 }
 
 /// <summary>Lifecycle phase for a Rust-owned ephemeral query stream.</summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 [JsonConverter(typeof(Converter))]
 [DebuggerDisplay("{Value,nq}")]
 public readonly struct UIEphemeralQueryPhase : IEquatable<UIEphemeralQueryPhase>
diff --git a/dotnet/src/JsonRpc.cs b/dotnet/src/JsonRpc.cs
index 36ddab30d8..889cccab22 100644
--- a/dotnet/src/JsonRpc.cs
+++ b/dotnet/src/JsonRpc.cs
@@ -1021,13 +1021,32 @@ internal sealed class ConnectionLostException() : IOException("The JSON-RPC conn
 /// <summary>
 /// Thrown when the remote side returns a JSON-RPC error response.
 /// </summary>
-internal sealed class RemoteRpcException(string message, int errorCode, JsonElement? errorData = null, Exception? innerException = null) : Exception(message, innerException)
+/// <remarks>
+/// Client RPC calls wrap this exception in an <see cref="IOException"/>.
+/// Inspect its <see cref="Exception.InnerException"/> to access the remote error.
+/// </remarks>
+/// <param name="message">The remote error message.</param>
+/// <param name="errorCode">The numeric JSON-RPC error code.</param>
+/// <param name="errorData">The optional valid JSON error data, cloned to retain its lifetime. Pass <see langword="null"/> when absent, not a default <see cref="JsonElement"/>.</param>
+/// <param name="innerException">The exception that caused this error, if any.</param>
+/// <exception cref="InvalidOperationException"><paramref name="errorData"/> has <see cref="JsonValueKind.Undefined"/> value kind.</exception>
+/// <exception cref="ObjectDisposedException">The document owning <paramref name="errorData"/> has already been disposed.</exception>
+public sealed class RemoteRpcException(string message, int errorCode, JsonElement? errorData = null, Exception? innerException = null) : Exception(message, innerException)
 {
     /// <summary>JSON-RPC 2.0 reserved error code: requested method does not exist.</summary>
-    public const int MethodNotFoundErrorCode = -32601;
+    internal const int MethodNotFoundErrorCode = -32601;
 
+    /// <summary>Gets the numeric code from the JSON-RPC error response.</summary>
     public int ErrorCode { get; } = errorCode;
 
+    /// <summary>Gets the unmodified JSON data from the remote error, if provided.</summary>
+    /// <remarks>
+    /// A missing <c>data</c> member produces a nullable value with no value.
+    /// An explicit JSON <c>null</c> produces a present element whose
+    /// <see cref="JsonElement.ValueKind"/> is <see cref="JsonValueKind.Null"/>.
+    /// All valid JSON value kinds are preserved. The element is cloned and remains
+    /// valid after the response document and client are disposed.
+    /// </remarks>
     public JsonElement? ErrorData { get; } = errorData.HasValue ? errorData.Value.Clone() : null;
 }
 
diff --git a/dotnet/src/Session.cs b/dotnet/src/Session.cs
index 3b2e1c349d..ce50859571 100644
--- a/dotnet/src/Session.cs
+++ b/dotnet/src/Session.cs
@@ -75,7 +75,7 @@ public sealed partial class CopilotSession : IAsyncDisposable
     private volatile Func<AutoModeSwitchRequest, AutoModeSwitchInvocation, Task<AutoModeSwitchResponse>>? _autoModeSwitchHandler;
     private ImmutableArray<EventSubscription> _eventHandlers = ImmutableArray<EventSubscription>.Empty;
 
-    private sealed record EventSubscription(Type EventType, Action<SessionEvent> Handler);
+    private sealed record EventSubscription(Type EventType, Action<SessionEvent> Handler, bool RootAgentOnly);
 
     private SessionHooks? _hooks;
     private readonly SemaphoreSlim _hooksLock = new(1, 1);
@@ -373,6 +373,8 @@ public async Task<string> SendAsync(MessageOptions options, CancellationToken ca
     /// </para>
     /// <para>
     /// Events are still delivered to handlers registered via <see cref="On{T}"/> while waiting.
+    /// Sub-agent events with a non-empty AgentId do not complete the wait or supply its reply.
+    /// Synchronous handlers registered before this call process the terminal event before the wait completes.
     /// </para>
     /// </remarks>
     /// <example>
@@ -432,7 +434,7 @@ void Handler(SessionEvent evt)
             }
         }
 
-        using var subscription = On<SessionEvent>(Handler);
+        using var subscription = OnCore<SessionEvent>(Handler, rootAgentOnly: true);
 
         await SendAsync(options, cancellationToken);
 
@@ -516,11 +518,14 @@ void Handler(SessionEvent evt)
     /// </code>
     /// </example>
     public IDisposable On<T>(Action<T> handler) where T : SessionEvent
+        => OnCore(handler, rootAgentOnly: false);
+
+    private ActionDisposable OnCore<T>(Action<T> handler, bool rootAgentOnly) where T : SessionEvent
     {
         ArgumentNullException.ThrowIfNull(handler);
         ThrowIfDisposed();
 
-        var subscription = new EventSubscription(typeof(T), evt => handler((T)evt));
+        var subscription = new EventSubscription(typeof(T), evt => handler((T)evt), rootAgentOnly);
         ImmutableInterlocked.Update(ref _eventHandlers, array => array.Add(subscription));
         return new ActionDisposable(() => ImmutableInterlocked.Update(ref _eventHandlers, array => array.Remove(subscription)));
     }
@@ -560,9 +565,12 @@ private async Task ProcessEventsAsync()
         {
             var dispatchTimestamp = Stopwatch.GetTimestamp();
             var eventType = sessionEvent.GetType();
+            // Preserve wire attribution without moving waiters ahead of earlier user handlers.
+            var isRootAgentEvent = string.IsNullOrEmpty(sessionEvent.AgentId);
             foreach (var subscription in _eventHandlers)
             {
-                if (!subscription.EventType.IsAssignableFrom(eventType))
+                if (!subscription.EventType.IsAssignableFrom(eventType) ||
+                    (subscription.RootAgentOnly && !isRootAgentEvent))
                 {
                     continue;
                 }
diff --git a/dotnet/src/Types.cs b/dotnet/src/Types.cs
index 5e559c4cd0..100ff55ed4 100644
--- a/dotnet/src/Types.cs
+++ b/dotnet/src/Types.cs
@@ -156,7 +156,7 @@ public static UriRuntimeConnection ForUri(string url, string? connectionToken =
     /// Works across the SDK's target frameworks: modern .NET uses <c>NativeLibrary</c>,
     /// while <c>netstandard2.0</c> consumers use a built-in fallback native loader.
     /// </remarks>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public static InProcessRuntimeConnection ForInProcess()
         => new();
 }
@@ -201,7 +201,7 @@ internal StdioRuntimeConnection() { }
 /// To point at a non-default runtime entrypoint, set the <c>COPILOT_CLI_PATH</c>
 /// environment variable.
 /// </summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class InProcessRuntimeConnection : RuntimeConnection
 {
     internal InProcessRuntimeConnection() { }
@@ -431,7 +431,7 @@ private CopilotClientOptions(CopilotClientOptions? other)
     /// <see cref="CopilotRequestHandler"/> subclass instead of the runtime's own
     /// outbound call.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public CopilotRequestHandler? RequestHandler { get; set; }
 
     /// <summary>
@@ -439,7 +439,7 @@ private CopilotClientOptions(CopilotClientOptions? other)
     /// When set, the SDK registers the provider during <c>StartAsync()</c>
     /// before any session can be created.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public IExtensionLaunchProviderHandler? ExtensionLaunchProvider { get; set; }
 
     /// <summary>
@@ -447,7 +447,7 @@ private CopilotClientOptions(CopilotClientOptions? other)
     /// connection; setting a handler opts created/resumed sessions into forwarding.
     /// The SDK awaits the handler task so it may perform asynchronous work.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [EditorBrowsable(EditorBrowsableState.Never)]
     public Func<Rpc.GitHubTelemetryNotification, Task>? OnGitHubTelemetry { get; set; }
 
@@ -1263,7 +1263,7 @@ public sealed class ElicitationContext
 /// <summary>
 /// Context for an MCP OAuth request callback.
 /// </summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAuthContext
 {
     /// <summary>Identifier of the session that triggered the MCP OAuth request.</summary>
@@ -1294,7 +1294,7 @@ public sealed class McpAuthContext
 /// <summary>
 /// Host-provided OAuth token data for a pending MCP OAuth request.
 /// </summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAuthToken
 {
     /// <summary>Access token acquired by the SDK host.</summary>
@@ -1310,7 +1310,7 @@ public sealed class McpAuthToken
 /// <summary>
 /// Result returned by an MCP auth request handler.
 /// </summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class McpAuthResult
 {
     /// <summary>Whether the request should be cancelled instead of resolved with a token.</summary>
@@ -1358,7 +1358,7 @@ public sealed class SessionUiCapabilities
     /// (or <c>COPILOT_MCP_APPS=true</c> env override) is on. Otherwise absent or
     /// <c>false</c>, indicating the runtime silently dropped the opt-in.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public bool? McpApps { get; set; }
 }
 
@@ -2433,7 +2433,7 @@ public sealed class ProviderConfig
     /// and does not send the static credential.
     /// </summary>
     [JsonIgnore]
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public Func<ProviderTokenArgs, Task<string>>? BearerTokenProvider { get; set; }
 
     /// <summary>
@@ -2541,7 +2541,7 @@ public sealed class AzureOptions
 /// <see cref="SessionConfigBase.Provider"/> is rejected.
 /// </para>
 /// </summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class NamedProviderConfig
 {
     /// <summary>
@@ -2602,7 +2602,7 @@ public sealed class NamedProviderConfig
     /// and does not send the static credential.
     /// </summary>
     [JsonIgnore]
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public Func<ProviderTokenArgs, Task<string>>? BearerTokenProvider { get; set; }
 
     /// <summary>
@@ -2624,7 +2624,7 @@ public sealed class NamedProviderConfig
 /// (shown in the model list and passed to model switching) is the provider-qualified
 /// <c>provider/id</c>, so BYOK ids never collide with bare CAPI ids.
 /// </summary>
-[Experimental(Diagnostics.Experimental)]
+[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
 public sealed class ProviderModelConfig
 {
     /// <summary>
@@ -2836,6 +2836,12 @@ public sealed class McpHttpServerConfig : McpServerConfig
     /// </summary>
     [JsonPropertyName("oauthGrantType")]
     public McpHttpServerConfigOauthGrantType? OauthGrantType { get; set; }
+
+    /// <summary>
+    /// Optional OAuth scopes to request for the statically configured client.
+    /// </summary>
+    [JsonPropertyName("oauthScopes")]
+    public IList<string>? OauthScopes { get; set; }
 }
 
 // ============================================================================
@@ -3091,14 +3097,14 @@ public struct SetModelOptions
     /// <c>auto</c>; use <see cref="CopilotSession.SetAutoTierAsync"/> to change the
     /// preference without changing the selected model.
     /// </remarks>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public AutoTier? AutoTier { get; set; }
 
     /// <summary>
     /// Returns to the provider's default Auto routing as part of this switch.
     /// Mutually exclusive with <see cref="AutoTier"/>.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public bool ResetAutoTier { get; set; }
 }
 
@@ -3336,6 +3342,7 @@ protected SessionConfigBase(SessionConfigBase? other)
                 : new Dictionary<string, McpServerConfig>(other.McpServers))
             : null;
         McpOAuthTokenStorage = other.McpOAuthTokenStorage;
+        Diagnostics = other.Diagnostics;
         AuthClientIdMetadataUrl = other.AuthClientIdMetadataUrl;
         Model = other.Model;
         ModelCapabilities = other.ModelCapabilities;
@@ -3429,7 +3436,7 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// Citations are experimental, off by default, and currently available for Anthropic models.
     /// This option may change or be removed while citation support is experimental.
     /// </remarks>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public bool? EnableCitations { get; set; }
 
     /// <summary>
@@ -3568,14 +3575,14 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// API authentication (unlike <see cref="Provider"/>); combine with <see cref="Models"/>.
     /// Cannot be combined with <see cref="Provider"/>.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public IList<NamedProviderConfig>? Providers { get; set; }
 
     /// <summary>
     /// BYOK model definitions added to the session's selectable model list, each
     /// referencing a <see cref="Providers"/> entry by name.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public IList<ProviderModelConfig>? Models { get; set; }
 
     /// <summary>
@@ -3678,7 +3685,7 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// to register UI-enabled tool variants the consumer cannot display.
     /// </para>
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public bool EnableMcpApps { get; set; }
 
     /// <summary>
@@ -3725,6 +3732,14 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// </summary>
     public IDictionary<string, McpServerConfig>? McpServers { get; set; }
 
+    /// <summary>
+    /// Enables session-scoped MCP diagnostic capture. Diagnostics are off by default.
+    /// Debug and trace entries can contain MCP payloads, tool arguments, paths, and
+    /// server stderr. Hosts must not upload entries as telemetry or export them
+    /// without deliberate user action.
+    /// </summary>
+    public DiagnosticsConfiguration? Diagnostics { get; set; }
+
     /// <summary>
     /// Controls how MCP OAuth tokens are stored for this session.
     /// Default: <see cref="McpOAuthTokenStorageMode.InMemory"/> for safe multitenant behavior.
@@ -3793,7 +3808,7 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// These settings only model the caller's configured limits. Enforcement and
     /// limit-exhaustion behavior are handled by the runtime.
     /// </remarks>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public SessionLimitsConfig? SessionLimits { get; set; }
 
     /// <summary>
@@ -3842,7 +3857,7 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// reject session creation or resume instead of falling back to ambient
     /// authentication. This cannot be combined with <see cref="GitHubToken"/>.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore]
     public Func<GitHubTokenProviderArgs, Task<GitHubTokenProviderResult>>? GitHubTokenProvider { get; set; }
 
@@ -3906,21 +3921,21 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// these to the agent and routes inbound <c>canvas.*</c> requests for any
     /// declared canvas to <see cref="CanvasHandler"/>.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public IList<CanvasDeclaration>? Canvases { get; set; }
 
     /// <summary>
     /// When <see langword="true"/>, asks the host to expose canvas renderer tools
     /// for this session. The host typically grants this only to trusted clients.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public bool? RequestCanvasRenderer { get; set; }
 
     /// <summary>
     /// When <see langword="true"/>, asks the host to expose extension-discovery
     /// tools for this session. The host typically grants this only to trusted clients.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public bool? RequestExtensions { get; set; }
 
     /// <summary>
@@ -3930,7 +3945,7 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// <c>extension.js</c>), the runtime falls back to the bundled SDK
     /// without throwing. Takes precedence over any server-level default.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public string? ExtensionSdkPath { get; set; }
 
     /// <summary>
@@ -3938,7 +3953,7 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// Required when <see cref="Canvases"/> is set so the runtime can attribute
     /// declared canvases back to this provider.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public ExtensionInfo? ExtensionInfo { get; set; }
 
     /// <summary>
@@ -3948,7 +3963,7 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// a control connection survive reconnect and CLI restart. Honored on
     /// session create and resume.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public CanvasProviderIdentity? CanvasProvider { get; set; }
 
     /// <summary>
@@ -3956,7 +3971,7 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// <c>canvas.open</c> / <c>canvas.close</c> / <c>canvas.action.invoke</c>
     /// requests to this handler.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore]
     public ICanvasHandler? CanvasHandler { get; set; }
 #pragma warning restore GHCP001
@@ -3965,7 +3980,7 @@ protected SessionConfigBase(SessionConfigBase? other)
     /// Optional handler for MCP OAuth requests from MCP servers.
     /// When provided, the SDK can satisfy MCP server OAuth requests with host-provided token data or cancellation.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     [JsonIgnore]
     public Func<McpAuthContext, Task<McpAuthResult?>>? OnMcpAuthRequest { get; set; }
 }
@@ -3988,6 +4003,7 @@ private SessionConfig(SessionConfig? other) : base(other)
 
         SessionId = other.SessionId;
         Cloud = other.Cloud;
+        RefreshCustomInstructions = other.RefreshCustomInstructions;
     }
 
     /// <summary>Optional session identifier; a new ID is generated if not provided.</summary>
@@ -3999,6 +4015,14 @@ private SessionConfig(SessionConfig? other) : base(other)
     /// </summary>
     public CloudSessionOptions? Cloud { get; set; }
 
+    /// <summary>
+    /// When true, invalidates process-wide custom-instruction discovery caches before
+    /// constructing this new session. Omitted or false reuses the caches.
+    /// Other sessions in this runtime may observe updated instructions on later turns
+    /// or discovery. This does not watch files or override instruction enablement.
+    /// </summary>
+    public bool? RefreshCustomInstructions { get; set; }
+
     /// <summary>
     /// Creates a shallow clone of this <see cref="SessionConfig"/> instance.
     /// </summary>
@@ -4059,7 +4083,7 @@ private ResumeSessionConfig(ResumeSessionConfig? other) : base(other)
     /// When provided on resume, the runtime can rehydrate canvas state so consumers
     /// do not need to re-open canvases that were active before the previous shutdown.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public IList<OpenCanvasInstance>? OpenCanvases { get; set; }
 #pragma warning restore GHCP001
 
@@ -4147,7 +4171,7 @@ private MessageOptions(MessageOptions? other)
     /// it is not a persisted session default.
     /// Use <see cref="CopilotSession.Rpc"/> for advanced response-format options.
     /// </summary>
-    [Experimental(Diagnostics.Experimental)]
+    [Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]
     public JsonElement? ResponseSchema { get; set; }
 
     /// <summary>
diff --git a/dotnet/test/E2E/PendingWorkResumeE2ETests.cs b/dotnet/test/E2E/PendingWorkResumeE2ETests.cs
index 8f3f17dcb2..13b2817c3a 100644
--- a/dotnet/test/E2E/PendingWorkResumeE2ETests.cs
+++ b/dotnet/test/E2E/PendingWorkResumeE2ETests.cs
@@ -126,10 +126,17 @@ await session1.SendAsync(new MessageOptions
                 OnPermissionRequest = PermissionHandler.ApproveAll,
             });
 
+            var finalResponse = TestHelper.GetNextEventOfTypeAsync<AssistantMessageEvent>(
+                session2,
+                message => message.Data.Content?.Contains("EXTERNAL_RESUMED_BETA", StringComparison.Ordinal) == true,
+                PendingWorkTimeout);
+            var resumedTurnIdle = TestHelper.GetNextEventOfTypeAsync<SessionIdleEvent>(session2, PendingWorkTimeout);
             var toolResult = await session2.Rpc.Tools.HandlePendingToolCallAsync(
                 toolEvent.Data.RequestId,
                 result: JsonDocument.Parse("\"EXTERNAL_RESUMED_BETA\"").RootElement.Clone());
             Assert.True(toolResult.Success);
+            Assert.Contains("EXTERNAL_RESUMED_BETA", (await finalResponse).Data.Content);
+            await resumedTurnIdle;
 
             await session2.DisposeAsync();
             await resumedClient.ForceStopAsync();
diff --git a/dotnet/test/E2E/RpcShellEdgeCaseE2ETests.cs b/dotnet/test/E2E/RpcShellEdgeCaseE2ETests.cs
index 25055a671a..1c3b110509 100644
--- a/dotnet/test/E2E/RpcShellEdgeCaseE2ETests.cs
+++ b/dotnet/test/E2E/RpcShellEdgeCaseE2ETests.cs
@@ -28,16 +28,14 @@ public async Task Shell_Exec_With_Timeout_Kills_Long_Running_Command()
         var markerPath = Path.Join(Ctx.WorkDir, $"shell-timeout-{Guid.NewGuid():N}.txt");
         var startedPath = Path.Join(Ctx.WorkDir, $"shell-timeout-started-{Guid.NewGuid():N}.txt");
 
-        // Sleep 30s but use a much shorter timeout — runtime should SIGTERM the child before the
-        // sleep completes, which means the marker file must NEVER appear within a wait
-        // window comfortably greater than the timeout but well under the sleep duration.
-        // Process startup on Windows can exceed 200ms on loaded runners, so match the
-        // platform-specific allowance used by the Rust coverage for this RPC.
+        // Sleep 30s but use a shorter timeout — runtime should terminate the child before
+        // the sleep completes. On loaded Windows runners, cmd.exe can start more than 2s
+        // after the RPC returns its process ID; allow it to reach the startup marker.
         var timeout = OperatingSystem.IsWindows()
-            ? TimeSpan.FromSeconds(2)
+            ? TimeSpan.FromSeconds(10)
             : TimeSpan.FromMilliseconds(200);
         var command = OperatingSystem.IsWindows()
-            ? $"powershell -NoLogo -NoProfile -Command \"Set-Content -LiteralPath '{startedPath}' -Value started; Start-Sleep -Seconds 30; Set-Content -LiteralPath '{markerPath}' -Value should-not-exist\""
+            ? $"echo started>\"{startedPath}\" & ping.exe -n 31 127.0.0.1 >nul & echo should-not-exist>\"{markerPath}\""
             : $"printf 'started' > '{startedPath}'; sleep 30; printf 'should-not-exist' > '{markerPath}'";
 
         // On Windows, terminating the shell wrapper can briefly leave children alive.
@@ -50,6 +48,9 @@ await TestHelper.WaitForConditionAsync(
             timeout: TimeSpan.FromSeconds(30),
             timeoutMessage: "Timed-out shell command did not start.");
 
+        // The startup marker can precede the timeout; don't probe the process map
+        // until the configured timeout has had a chance to terminate the command.
+        await Task.Delay(timeout);
         await AssertProcessMapCleanedUpAsync(session, result.ProcessId, "Timed-out shell command");
 
         Assert.False(File.Exists(markerPath), "Marker file should not exist; timeout should have killed the child before the sleep completed.");
diff --git a/dotnet/test/E2E/RpcShellUserRequestedE2ETests.cs b/dotnet/test/E2E/RpcShellUserRequestedE2ETests.cs
index c51b385d81..3f181c20d2 100644
--- a/dotnet/test/E2E/RpcShellUserRequestedE2ETests.cs
+++ b/dotnet/test/E2E/RpcShellUserRequestedE2ETests.cs
@@ -39,23 +39,16 @@ public async Task Should_Cancel_User_Requested_Shell_Command()
         var missing = await session.Rpc.Shell.CancelUserRequestedAsync($"missing-{Guid.NewGuid():N}");
         Assert.False(missing.Cancelled);
 
-        // De-race an in-flight cancellation: launch a long command that first writes a marker file
-        // (so we know it is genuinely running) and then sleeps. Keep the marker outside the fixture
-        // workspace so Windows cleanup is not blocked by lingering process handles.
+        // Poll cancellation until the runtime has registered the request. This is the authoritative
+        // readiness signal and avoids depending on PowerShell-specific command syntax when the
+        // Windows runtime legitimately falls back to cmd.exe.
         var requestId = $"req-{Guid.NewGuid():N}";
-        var markerPath = Path.Join(Path.GetTempPath(), $"shell-cancel-{Guid.NewGuid():N}.txt");
         var executeTask = session.Rpc.Shell.ExecuteUserRequestedAsync(
             requestId,
-            CreateMarkerThenSleepCommand(markerPath, seconds: 60));
+            CreateLongRunningCommand(seconds: 60));
 
         try
         {
-            await WaitForFileExistsAsync(markerPath);
-
-            // The marker proves the child process reached the command body, but the runtime may not
-            // yet have registered the request in its cancellable in-flight map. Poll the cancel until
-            // it takes effect so the assertion is not racy. WaitForConditionAsync stops on the first
-            // call that reports Cancelled, so the command is cancelled exactly once.
             await TestHelper.WaitForConditionAsync(
                 async () => (await session.Rpc.Shell.CancelUserRequestedAsync(requestId)).Cancelled,
                 timeout: TimeSpan.FromSeconds(15),
@@ -70,50 +63,27 @@ await TestHelper.WaitForConditionAsync(
         {
             if (!executeTask.IsCompleted)
             {
+                try { await session.Rpc.Shell.CancelUserRequestedAsync(requestId); }
+                catch (Exception ex) when (ex is TimeoutException or OperationCanceledException or ObjectDisposedException)
+                {
+                    // Preserve the primary test failure across expected teardown races.
+                }
                 try { await executeTask.WaitAsync(TimeSpan.FromSeconds(30)); }
-                catch { /* best-effort drain so the long command does not outlive the test */ }
+                catch (TimeoutException) { /* best-effort drain timed out */ }
+                catch (OperationCanceledException) { /* cancellation completed during teardown */ }
             }
-
-            TryDeleteFile(markerPath);
         }
     }
 
-    private static string CreateMarkerThenSleepCommand(string markerPath, int seconds)
+    private static string CreateLongRunningCommand(int seconds)
     {
-        // The runtime already runs the command through the platform shell (pwsh -Command "<cmd>" on
-        // Windows, sh -c "<cmd>" elsewhere), so emit the script body directly instead of spawning a
-        // *second* nested shell. Cancellation kills only the shell the runtime spawned; a nested
-        // powershell.exe/sh would be orphaned and keep the session working directory locked, which
-        // breaks fixture cleanup on Windows (manifesting as an IOException during teardown).
         if (OperatingSystem.IsWindows())
         {
-            return $"Set-Content -LiteralPath '{markerPath}' -Value 'running'; Start-Sleep -Seconds {seconds}";
+            // ping.exe is available to both PowerShell and cmd.exe and spaces loopback requests
+            // roughly one second apart. The first request is immediate, hence seconds + 1.
+            return $"ping.exe -n {seconds + 1} 127.0.0.1";
         }
 
-        return $"echo running > '{markerPath}'; sleep {seconds}";
-    }
-
-    private static async Task WaitForFileExistsAsync(string path)
-    {
-        await TestHelper.WaitForConditionAsync(
-            () => File.Exists(path),
-            timeout: TimeSpan.FromSeconds(30),
-            timeoutMessage: $"Timed out waiting for the shell command to create '{path}'.",
-            pollInterval: TimeSpan.FromMilliseconds(100));
-    }
-
-    private static void TryDeleteFile(string path)
-    {
-        try
-        {
-            if (File.Exists(path))
-            {
-                File.Delete(path);
-            }
-        }
-        catch (Exception ex) when (TestHelper.IsTransientFileSystemException(ex))
-        {
-            // Best-effort cleanup; the OS temp directory is reclaimed independently.
-        }
+        return $"sleep {seconds}";
     }
 }
diff --git a/dotnet/test/E2E/ScenarioTestingRuntimeE2ETests.cs b/dotnet/test/E2E/ScenarioTestingRuntimeE2ETests.cs
index 0d3e3d81cb..1cb28ca171 100644
--- a/dotnet/test/E2E/ScenarioTestingRuntimeE2ETests.cs
+++ b/dotnet/test/E2E/ScenarioTestingRuntimeE2ETests.cs
@@ -7,6 +7,7 @@
 using System.Text.Json;
 using GitHub.Copilot.Rpc;
 using GitHub.Copilot.Test.Harness;
+using Microsoft.Extensions.Logging;
 using Xunit;
 using Xunit.Abstractions;
 
@@ -127,13 +128,25 @@ public async Task Should_Cancel_Externally_When_Startup_Handshake_Hangs()
                 args: ["--capture-file", capturePath, "--pid-file", pidPath, "--behavior", "hang-connect"]),
             UseLoggedInUser = false,
         });
-        using var cancellation = new CancellationTokenSource(TimeSpan.FromMilliseconds(500));
-
-        await Assert.ThrowsAnyAsync<OperationCanceledException>(() => client.StartAsync(cancellation.Token));
-
-        var pid = int.Parse(await File.ReadAllTextAsync(pidPath), CultureInfo.InvariantCulture);
-        await AssertProcessExitedAsync(pid);
-        await client.ForceStopAsync();
+        using var cancellation = new CancellationTokenSource();
+        var start = client.StartAsync(cancellation.Token);
+        try
+        {
+            using var capture = await WaitForCaptureAsync(
+                capturePath,
+                root => root.GetProperty("requests").EnumerateArray()
+                    .Any(request => request.GetProperty("method").GetString() == "connect"));
+            cancellation.Cancel();
+            await Assert.ThrowsAnyAsync<OperationCanceledException>(() => start.WaitAsync(TestTimeout));
+
+            var pid = int.Parse(await File.ReadAllTextAsync(pidPath), CultureInfo.InvariantCulture);
+            await AssertProcessExitedAsync(pid);
+        }
+        finally
+        {
+            cancellation.Cancel();
+            await client.ForceStopAsync();
+        }
     }
 
     [Fact]
@@ -194,17 +207,19 @@ public async Task Should_Bound_Graceful_Stop_Then_Force_Stop()
     [Fact]
     public async Task Should_Fail_Fast_After_Transport_Failure()
     {
-        var (cliPath, capturePath, pidPath) = await CreateFakeRuntimeAsync("exit-after-create");
+        var (cliPath, capturePath, pidPath) = await CreateFakeRuntimeAsync("normal");
         await using var client = Ctx.CreateClient(options: new CopilotClientOptions
         {
             Connection = RuntimeConnection.ForStdio(
                 path: cliPath,
-                args: ["--capture-file", capturePath, "--pid-file", pidPath, "--behavior", "exit-after-create"]),
+                args: ["--capture-file", capturePath, "--pid-file", pidPath, "--behavior", "normal"]),
             UseLoggedInUser = false,
         });
         await using var session = await Ctx.CreateSessionAsync(client);
 
         var pid = int.Parse(await File.ReadAllTextAsync(pidPath), CultureInfo.InvariantCulture);
+        using var process = Process.GetProcessById(pid);
+        process.Kill();
         await AssertProcessExitedAsync(pid);
 
         Exception sendException;
@@ -417,9 +432,6 @@ function handle(message) {
           if (message.method === "session.create") {
             const sessionId = message.params?.sessionId ?? "fake-session";
             respond(message.id, { sessionId, workspacePath: null, capabilities: null });
-            if (behavior === "exit-after-create") {
-              setTimeout(() => process.exit(17), 25);
-            }
             return;
           }
 
diff --git a/dotnet/test/E2E/SessionE2ETests.cs b/dotnet/test/E2E/SessionE2ETests.cs
index 800bd56667..9855bc8eae 100644
--- a/dotnet/test/E2E/SessionE2ETests.cs
+++ b/dotnet/test/E2E/SessionE2ETests.cs
@@ -513,11 +513,38 @@ public async Task SendAndWait_Blocks_Until_Session_Idle_And_Returns_Final_Assist
     {
         var session = await CreateSessionAsync();
         var events = new ConcurrentQueue<string>();
+        var idleEntered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        using var releaseIdle = new ManualResetEventSlim();
+        var idleHandlerFinished = false;
 
-        session.On<SessionEvent>(evt => events.Enqueue(evt.Type));
+        using var subscription = session.On<SessionEvent>(evt =>
+        {
+            if (evt is SessionIdleEvent)
+            {
+                idleEntered.TrySetResult();
+                if (!releaseIdle.Wait(TimeSpan.FromSeconds(30)))
+                {
+                    return;
+                }
+                idleHandlerFinished = true;
+            }
+            events.Enqueue(evt.Type);
+        });
 
-        var response = await session.SendAndWaitAsync(new MessageOptions { Prompt = "What is 2+2?" });
+        var pending = session.SendAndWaitAsync(new MessageOptions { Prompt = "What is 2+2?" });
+        try
+        {
+            await idleEntered.Task.WaitAsync(TimeSpan.FromSeconds(30));
+            await Assert.ThrowsAsync<TimeoutException>(() =>
+                pending.WaitAsync(TimeSpan.FromMilliseconds(250)));
+        }
+        finally
+        {
+            releaseIdle.Set();
+        }
+        var response = await pending;
 
+        Assert.True(idleHandlerFinished, "The earlier idle listener must finish before SendAndWaitAsync returns");
         Assert.NotNull(response);
         Assert.Equal("assistant.message", response!.Type);
         Assert.Contains("4", response.Data.Content ?? string.Empty);
diff --git a/dotnet/test/E2E/SessionEventLoopLeakE2ETests.cs b/dotnet/test/E2E/SessionEventLoopLeakE2ETests.cs
index 40470109c5..b09960b244 100644
--- a/dotnet/test/E2E/SessionEventLoopLeakE2ETests.cs
+++ b/dotnet/test/E2E/SessionEventLoopLeakE2ETests.cs
@@ -3,6 +3,7 @@
  *--------------------------------------------------------------------------------------------*/
 
 using GitHub.Copilot.Test.Harness;
+using GitHub.Copilot.Rpc;
 using System.Collections;
 using System.Reflection;
 using Xunit;
@@ -48,51 +49,12 @@ private static bool IsEventChannelClosed(CopilotSession session)
         return completion.IsCompleted;
     }
 
-    /// <summary>
-    /// Continuously scans <see cref="CopilotClient"/>'s session dictionary on a dedicated,
-    /// tightly-spinning thread (not the thread pool, and no <c>await</c>-based yielding) so
-    /// that even a sub-millisecond in-flight registration window — as seen with a fast local
-    /// RPC failure like a nonexistent-session resume — is reliably observed.
-    /// </summary>
-    private sealed class SessionSniffer : IDisposable
+    private static SessionFsConfig CreateSessionFsConfig() => new()
     {
-        private readonly List<CopilotSession> _seen = [];
-        private readonly Thread _thread;
-        private volatile bool _stop;
-
-        public SessionSniffer(IDictionary sessions)
-        {
-            _thread = new Thread(() =>
-            {
-                var iterations = 0L;
-                while (!_stop)
-                {
-                    iterations++;
-                    foreach (CopilotSession s in sessions.Values)
-                    {
-                        lock (_seen)
-                        {
-                            if (!_seen.Contains(s)) _seen.Add(s);
-                        }
-                    }
-                }
-                Iterations = iterations;
-            })
-            { IsBackground = true };
-            _thread.Start();
-        }
-
-        public long Iterations { get; private set; }
-
-        public IReadOnlyList<CopilotSession> Stop()
-        {
-            _stop = true;
-            _thread.Join();
-            lock (_seen) return [.. _seen];
-        }
-
-        public void Dispose() => _stop = true;
-    }
+        InitialWorkingDirectory = "/",
+        SessionStatePath = "/session-state",
+        Conventions = SessionFsSetProviderConventions.Posix,
+    };
 
     [Fact]
     public async Task CreateSessionAsync_Failure_Does_Not_Leak_The_Session_Or_Its_Event_Loop()
@@ -104,7 +66,11 @@ public async Task CreateSessionAsync_Failure_Does_Not_Leak_The_Session_Or_Its_Ev
         {
             ["COPILOT_DEBUG_GITHUB_API_URL"] = Ctx.ProxyUrl,
         };
-        var client = Ctx.CreateClient(environment: env, autoInjectGitHubToken: false);
+        var client = Ctx.CreateClient(
+            options: new CopilotClientOptions { SessionFs = CreateSessionFsConfig() },
+            environment: env,
+            autoInjectGitHubToken: false);
+        var seen = new List<CopilotSession>();
 
         async Task CreateFailingAsync()
         {
@@ -112,31 +78,29 @@ async Task CreateFailingAsync()
             {
                 GitHubToken = "invalid-token",
                 OnPermissionRequest = PermissionHandler.ApproveAll,
+                CreateSessionFsProvider = session =>
+                {
+                    seen.Add(session);
+                    return new MissingSessionFsProvider();
+                },
             }));
             Assert.Contains("401", ex.ToString(), StringComparison.OrdinalIgnoreCase);
         }
 
         // Warm up: the first call establishes the CLI connection.
         await CreateFailingAsync();
+        seen.Clear();
 
         var sessions = GetSessionsMap(client);
 
-        // The session is registered (and its event-loop consumer started) before the RPC
-        // completes, and is only ever removed inside CreateSessionAsync's own catch block —
-        // by the time a failed call *returns* to us, RemoveFromClient() has already run, so
-        // polling the dictionary after each await observes nothing. We must instead observe
-        // it concurrently, while each call is still in flight, to capture the real session
-        // object and verify its event channel actually got closed.
-        using var sniffer = new SessionSniffer(sessions);
-
+        // The public provider factory exposes each wrapper before its failing RPC,
+        // without depending on a polling thread observing a transient registration.
         for (var i = 0; i < 20; i++)
         {
             await CreateFailingAsync();
         }
 
-        var seen = sniffer.Stop();
-
-        Assert.True(seen.Count > 0, "Test did not observe any in-flight session registrations; cannot validate the fix.");
+        Assert.Equal(20, seen.Count);
         Assert.Empty(sessions);
 
         foreach (var s in seen)
@@ -154,26 +118,28 @@ public async Task ResumeSessionAsync_Failure_Does_Not_Leak_The_Session_Or_Its_Ev
         // pre-registered session would land in a different, short-lived client's dictionary
         // that we'd never get to observe. A single, reused client lets us watch one
         // dictionary across all 20 failed calls.
-        var client = Ctx.CreateClient();
+        var client = Ctx.CreateClient(options: new CopilotClientOptions { SessionFs = CreateSessionFsConfig() });
         var sessions = GetSessionsMap(client);
+        var seen = new List<CopilotSession>();
 
         async Task ResumeNonExistentAsync()
         {
-            await Assert.ThrowsAnyAsync<Exception>(() =>
+            var exception = await Assert.ThrowsAnyAsync<Exception>(() =>
                 Ctx.ResumeSessionAsync(client, "non-existent-leak-check-session", new ResumeSessionConfig
                 {
                     OnPermissionRequest = PermissionHandler.ApproveAll,
+                    CreateSessionFsProvider = session =>
+                    {
+                        seen.Add(session);
+                        return new MissingSessionFsProvider();
+                    },
                 }));
+            Assert.Contains("not found", exception.ToString(), StringComparison.OrdinalIgnoreCase);
         }
 
         // Warm up: the first call establishes the CLI connection.
         await ResumeNonExistentAsync();
-
-        // Same rationale as the CreateSessionAsync test above: the pre-registered session is
-        // already removed from the dictionary by the time a failed call returns, so we must
-        // observe it concurrently, while the call is still in flight, to actually validate
-        // that its event channel got closed rather than just that it got unregistered.
-        using var sniffer = new SessionSniffer(sessions);
+        seen.Clear();
 
         var baseline = sessions.Count;
         for (var i = 0; i < 20; i++)
@@ -181,9 +147,7 @@ await Assert.ThrowsAnyAsync<Exception>(() =>
             await ResumeNonExistentAsync();
         }
 
-        var seen = sniffer.Stop();
-
-        Assert.True(seen.Count > 0, $"Test did not observe any in-flight session registrations (sniffer ran {sniffer.Iterations} iterations); cannot validate the fix.");
+        Assert.Equal(20, seen.Count);
 
         Assert.True(
             sessions.Count == baseline,
@@ -195,4 +159,36 @@ await Assert.ThrowsAnyAsync<Exception>(() =>
             Assert.True(IsEventChannelClosed(s), "A failed ResumeSessionAsync's session had its event channel left open, leaking its background event-processing task.");
         }
     }
+
+    private sealed class MissingSessionFsProvider : SessionFsProvider
+    {
+        protected override Task<string> ReadFileAsync(string path, CancellationToken cancellationToken) =>
+            throw new FileNotFoundException("Session file does not exist.", path);
+
+        protected override Task<bool> ExistsAsync(string path, CancellationToken cancellationToken) => Task.FromResult(false);
+
+        protected override Task<SessionFsStatResult> StatAsync(string path, CancellationToken cancellationToken) =>
+            throw new FileNotFoundException("Session file does not exist.", path);
+
+        protected override Task<IList<string>> ReadDirectoryAsync(string path, CancellationToken cancellationToken) =>
+            Task.FromResult<IList<string>>([]);
+
+        protected override Task<IList<SessionFsReaddirWithTypesEntry>> ReadDirectoryWithTypesAsync(string path, CancellationToken cancellationToken) =>
+            Task.FromResult<IList<SessionFsReaddirWithTypesEntry>>([]);
+
+        protected override Task WriteFileAsync(string path, string content, int? mode, CancellationToken cancellationToken) =>
+            throw new NotSupportedException();
+
+        protected override Task AppendFileAsync(string path, string content, int? mode, CancellationToken cancellationToken) =>
+            throw new NotSupportedException();
+
+        protected override Task MakeDirectoryAsync(string path, bool recursive, int? mode, CancellationToken cancellationToken) =>
+            throw new NotSupportedException();
+
+        protected override Task RemoveAsync(string path, bool recursive, bool force, CancellationToken cancellationToken) =>
+            throw new NotSupportedException();
+
+        protected override Task RenameAsync(string src, string dest, CancellationToken cancellationToken) =>
+            throw new NotSupportedException();
+    }
 }
diff --git a/dotnet/test/Unit/ClientSessionLifetimeTests.cs b/dotnet/test/Unit/ClientSessionLifetimeTests.cs
index 3ae2493a8d..f5c98acb14 100644
--- a/dotnet/test/Unit/ClientSessionLifetimeTests.cs
+++ b/dotnet/test/Unit/ClientSessionLifetimeTests.cs
@@ -710,6 +710,58 @@ public async Task ResumeSessionAsync_Forwards_AskUserVariant_On_Cold_Resume()
         Assert.False(defaultRequest.Params.TryGetProperty("askUserVariant", out _));
     }
 
+    [Fact]
+    public async Task SessionRequests_Forward_And_Omit_Diagnostics()
+    {
+        await using var server = await FakeCopilotServer.StartAsync();
+        await using var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForUri(server.Url) });
+
+        await using var created = await client.CreateSessionAsync(new SessionConfig
+        {
+            Diagnostics = new DiagnosticsConfiguration
+            {
+                Sources = new DiagnosticSourcesConfiguration
+                {
+                    Mcp = new McpDiagnosticSourceConfiguration { Level = DiagnosticLogLevel.Debug }
+                }
+            },
+            OnPermissionRequest = PermissionHandler.ApproveAll
+        });
+        await using var resumed = await client.ResumeSessionAsync("diagnostics-resume", new ResumeSessionConfig
+        {
+            Diagnostics = new DiagnosticsConfiguration
+            {
+                Sources = new DiagnosticSourcesConfiguration
+                {
+                    Mcp = new McpDiagnosticSourceConfiguration { Level = DiagnosticLogLevel.Trace }
+                }
+            },
+            OnPermissionRequest = PermissionHandler.ApproveAll
+        });
+
+        var createRequest = Assert.Single(server.Requests, request => request.Method == "session.create");
+        var resumeRequest = Assert.Single(server.Requests, request => request.Method == "session.resume");
+        Assert.Equal("debug", createRequest.Params.GetProperty("diagnostics").GetProperty("sources")
+            .GetProperty("mcp").GetProperty("level").GetString());
+        Assert.Equal("trace", resumeRequest.Params.GetProperty("diagnostics").GetProperty("sources")
+            .GetProperty("mcp").GetProperty("level").GetString());
+
+        server.ClearRequests();
+        await using var defaultCreated = await client.CreateSessionAsync(new SessionConfig
+        {
+            OnPermissionRequest = PermissionHandler.ApproveAll
+        });
+        await using var defaultResumed = await client.ResumeSessionAsync("diagnostics-default-resume", new ResumeSessionConfig
+        {
+            OnPermissionRequest = PermissionHandler.ApproveAll
+        });
+
+        var defaultCreateRequest = Assert.Single(server.Requests, request => request.Method == "session.create");
+        var defaultResumeRequest = Assert.Single(server.Requests, request => request.Method == "session.resume");
+        Assert.False(defaultCreateRequest.Params.TryGetProperty("diagnostics", out _));
+        Assert.False(defaultResumeRequest.Params.TryGetProperty("diagnostics", out _));
+    }
+
     [Fact]
     public async Task SessionRequests_Serialize_AdditionalDirectories()
     {
@@ -2004,6 +2056,128 @@ public async Task SendAndWaitAsync_Skips_Autopilot_Continuation_Idle()
         Assert.Equal("final", result.Data.Content);
     }
 
+    [Fact]
+    public async Task SendAndWaitAsync_Ignores_Child_Events()
+    {
+        await using var server = await FakeCopilotServer.StartAsync();
+        await using var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForUri(server.Url) });
+        await using var session = await client.CreateSessionAsync(new SessionConfig());
+        var sendTask = session.SendAndWaitAsync(new MessageOptions { Prompt = "delegate" });
+        await WaitForRequestAsync(server, "session.send");
+        var childMessageReceived = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var childErrorReceived = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        var childIdleReceived = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        using var messageSubscription = session.On<AssistantMessageEvent>(message =>
+        {
+            if (message.AgentId == "child-1")
+            {
+                childMessageReceived.TrySetResult();
+            }
+        });
+        using var errorSubscription = session.On<SessionErrorEvent>(error =>
+        {
+            if (error.AgentId == "child-1")
+            {
+                childErrorReceived.TrySetResult();
+            }
+        });
+        using var idleSubscription = session.On<SessionIdleEvent>(idle =>
+        {
+            if (idle.AgentId == "child-1")
+            {
+                childIdleReceived.TrySetResult();
+            }
+        });
+        await server.SendSessionEventAsync(session.SessionId, "assistant.message", new()
+        {
+            ["messageId"] = "child-message",
+            ["content"] = "child reply"
+        }, "child-1");
+        await server.SendSessionEventAsync(session.SessionId, "session.error", new()
+        {
+            ["errorType"] = "query",
+            ["message"] = "child failed"
+        }, "child-1");
+        await server.SendSessionEventAsync(session.SessionId, "session.idle", new(), "child-1");
+        await childMessageReceived.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        await childErrorReceived.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        await childIdleReceived.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        Assert.False(sendTask.IsCompleted);
+
+        await server.SendSessionEventAsync(session.SessionId, "session.idle", new());
+        var result = await sendTask.WaitAsync(TimeSpan.FromSeconds(5));
+        Assert.Null(result);
+    }
+
+    [Fact]
+    public async Task SendAndWaitAsync_Waits_For_Earlier_Idle_Handler()
+    {
+        await using var server = await FakeCopilotServer.StartAsync();
+        await using var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForUri(server.Url) });
+        await using var session = await client.CreateSessionAsync(new SessionConfig());
+        var entered = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        using var release = new ManualResetEventSlim();
+        var handlerFinished = false;
+        using var subscription = session.On<SessionIdleEvent>(_ =>
+        {
+            entered.TrySetResult();
+            handlerFinished = release.Wait(TimeSpan.FromSeconds(5));
+        });
+        var pending = session.SendAndWaitAsync(new MessageOptions { Prompt = "hello" });
+        await WaitForRequestAsync(server, "session.send");
+        try
+        {
+            await server.SendSessionEventAsync(session.SessionId, "session.idle", new());
+            await entered.Task.WaitAsync(TimeSpan.FromSeconds(5));
+            await Assert.ThrowsAsync<TimeoutException>(() =>
+                pending.WaitAsync(TimeSpan.FromMilliseconds(250)));
+        }
+        finally
+        {
+            release.Set();
+        }
+        Assert.Null(await pending.WaitAsync(TimeSpan.FromSeconds(5)));
+        Assert.True(handlerFinished);
+    }
+
+    [Fact]
+    public async Task SendAndWaitAsync_Classifies_Events_Before_User_Handler_Mutates_AgentId()
+    {
+        await using var server = await FakeCopilotServer.StartAsync();
+        await using var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForUri(server.Url) });
+        await using var session = await client.CreateSessionAsync(new SessionConfig());
+        using var mutation = session.On<SessionEvent>(evt =>
+            evt.AgentId = evt.AgentId == "child-1" ? null : "root");
+
+        var sendTask = session.SendAndWaitAsync(new MessageOptions { Prompt = "delegate" });
+        await WaitForRequestAsync(server, "session.send");
+        var childIdleReceived = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+        using var observer = session.On<SessionIdleEvent>(idle =>
+        {
+            if (idle.AgentId is null)
+            {
+                childIdleReceived.TrySetResult();
+            }
+        });
+        await server.SendSessionEventAsync(session.SessionId, "assistant.message", new()
+        {
+            ["messageId"] = "child-message",
+            ["content"] = "child reply"
+        }, "child-1");
+        await server.SendSessionEventAsync(session.SessionId, "session.idle", new(), "child-1");
+        await childIdleReceived.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        Assert.False(sendTask.IsCompleted);
+
+        await server.SendSessionEventAsync(session.SessionId, "assistant.message", new()
+        {
+            ["messageId"] = "root-message",
+            ["content"] = "root reply"
+        });
+        await server.SendSessionEventAsync(session.SessionId, "session.idle", new());
+        var result = await sendTask.WaitAsync(TimeSpan.FromSeconds(5));
+        Assert.Equal("root reply", result?.Data.Content);
+    }
+
     [MethodImpl(MethodImplOptions.NoInlining)]
     private static async Task<WeakReference<CopilotSession>> CreateDroppedSessionAsync(CopilotClient client)
     {
@@ -2355,6 +2529,39 @@ public async Task ResumeSessionAsync_Serializes_ManagedSettings_Permissions()
         Assert.Equal("shell(rm*)", Assert.Single(permissions.GetProperty("deny").EnumerateArray()).GetString());
     }
 
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    [InlineData(null)]
+    public async Task CreateSessionAsync_Serializes_RefreshCustomInstructions_Only_On_Create(bool? refresh)
+    {
+        await using var server = await FakeCopilotServer.StartAsync();
+        await using var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForUri(server.Url) });
+        var config = new SessionConfig();
+        if (refresh.HasValue)
+        {
+            config.RefreshCustomInstructions = refresh;
+        }
+
+        await using var session = await client.CreateSessionAsync(config);
+
+        var createRequest = Assert.Single(server.Requests, request => request.Method == "session.create");
+        if (refresh.HasValue)
+        {
+            Assert.True(createRequest.Params.TryGetProperty("refreshCustomInstructions", out var value), createRequest.Params.ToString());
+            Assert.Equal(refresh.Value, value.GetBoolean());
+        }
+        else
+        {
+            Assert.False(createRequest.Params.TryGetProperty("refreshCustomInstructions", out _), createRequest.Params.ToString());
+        }
+
+        await using var resumed = await client.ResumeSessionAsync("resumed-session", new ResumeSessionConfig());
+
+        var resumeRequest = Assert.Single(server.Requests, request => request.Method == "session.resume");
+        Assert.False(resumeRequest.Params.TryGetProperty("refreshCustomInstructions", out _), resumeRequest.Params.ToString());
+    }
+
     private static void DispatchEvent(CopilotSession session, SessionEvent evt)
     {
         var method = typeof(CopilotSession).GetMethod("DispatchEvent", BindingFlags.Instance | BindingFlags.NonPublic)
@@ -2465,6 +2672,8 @@ public static Task<FakeCopilotServer> StartAsync()
 
         public Func<RpcRequestRecord, CancellationToken, Task>? AfterResponseAsync { get; set; }
 
+        public Func<RpcRequestRecord, object?>? ResponseFactory { get; set; }
+
         public IReadOnlyList<RpcRequestRecord> Requests
         {
             get
@@ -2779,6 +2988,7 @@ private async Task HandleRequestAsync(Stream stream, JsonElement request, Cancel
                 },
                 "session.detach" => await DetachSessionAsync(cancellationToken),
                 "runtime.shutdown" => HandleRuntimeShutdown(),
+                _ when ResponseFactory is { } responseFactory => responseFactory(requestRecord),
                 _ => throw new InvalidOperationException($"Unexpected RPC method '{method}'.")
             };
 
diff --git a/dotnet/test/Unit/CloneTests.cs b/dotnet/test/Unit/CloneTests.cs
index 0234431892..649fe4a1f9 100644
--- a/dotnet/test/Unit/CloneTests.cs
+++ b/dotnet/test/Unit/CloneTests.cs
@@ -178,6 +178,28 @@ public void SessionConfig_Clone_CopiesAllProperties()
         Assert.Same(original.OnAutoModeSwitchRequest, clone.OnAutoModeSwitchRequest);
     }
 
+    [Theory]
+    [InlineData(true)]
+    [InlineData(false)]
+    [InlineData(null)]
+    public void SessionConfig_Clone_PreservesRefreshCustomInstructions(bool? refresh)
+    {
+        var original = new SessionConfig { RefreshCustomInstructions = refresh };
+
+        var clone = original.Clone();
+
+        Assert.NotSame(original, clone);
+        Assert.Equal(refresh, clone.RefreshCustomInstructions);
+    }
+
+    [Fact]
+    public void SessionConfig_RefreshCustomInstructions_IsCreateOnlyAndDefaultsToNull()
+    {
+        Assert.Null(new SessionConfig().RefreshCustomInstructions);
+        Assert.Null(typeof(SessionConfigBase).GetProperty(nameof(SessionConfig.RefreshCustomInstructions)));
+        Assert.Null(typeof(ResumeSessionConfig).GetProperty(nameof(SessionConfig.RefreshCustomInstructions)));
+    }
+
     [Fact]
     public void SessionConfig_Clone_CollectionsAreIndependent()
     {
diff --git a/dotnet/test/Unit/RpcConnectorsTests.cs b/dotnet/test/Unit/RpcConnectorsTests.cs
new file mode 100644
index 0000000000..f7304700bd
--- /dev/null
+++ b/dotnet/test/Unit/RpcConnectorsTests.cs
@@ -0,0 +1,297 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+#if NET8_0_OR_GREATER
+using System.Text.Json;
+using GitHub.Copilot.Rpc;
+using Xunit;
+
+namespace GitHub.Copilot.Test.Unit;
+
+public sealed partial class ClientSessionLifetimeTests
+{
+    [Fact]
+    public async Task Session_Rpc_Connectors_Reports_Capabilities_Status_And_Catalogs()
+    {
+        await using var server = await FakeCopilotServer.StartAsync();
+        server.ResponseFactory = CreateConnectorRpcResponse;
+        await using var client = new CopilotClient(new CopilotClientOptions
+        {
+            Connection = RuntimeConnection.ForUri(server.Url)
+        });
+        await using var session = await client.CreateSessionAsync(new SessionConfig());
+        server.ClearRequests();
+
+        var connectors = session.Rpc.Connectors;
+        Assert.Same(connectors, session.Rpc.Connectors);
+
+        var capabilities = await connectors.GetCapabilitiesAsync();
+        Assert.Equal(1, capabilities.ApiVersion);
+        Assert.Equal(ConnectorAvailability.Enabled, capabilities.Availability);
+        Assert.True(capabilities.ConsentContinuation);
+        Assert.Equal(5, capabilities.MaxPollAttempts);
+        Assert.Equal(2_000, capabilities.MaxPollIntervalMs);
+        Assert.Equal(30_000, capabilities.MaxDeadlineMs);
+        Assert.True(capabilities.OpaqueAccountSelection);
+
+        var status = await connectors.GetStatusAsync();
+        Assert.Equal("account-1", status.AccountId);
+        Assert.Equal(2, status.PendingConnections);
+        Assert.Equal(7, status.Catalog?.Revision);
+        var runtimeServer = Assert.Single(status.RuntimeServers);
+        Assert.Equal("slack", runtimeServer.ConnectorName);
+        Assert.Equal("connector-slack", runtimeServer.RuntimeServerId);
+        Assert.Equal(ConnectorMcpStatus.Connected, runtimeServer.Status);
+
+        var listed = await connectors.ListAsync("account-1");
+        AssertConnectorCatalog(listed, 3, ConnectorCatalogStatus.NotConnected);
+
+        var refreshed = await connectors.RefreshAsync("account-1");
+        AssertConnectorCatalog(refreshed, 4, ConnectorCatalogStatus.Connected);
+
+        Assert.Collection(
+            server.Requests,
+            request => AssertConnectorRequest(
+                request,
+                "session.connectors.getCapabilities",
+                session.SessionId),
+            request => AssertConnectorRequest(
+                request,
+                "session.connectors.getStatus",
+                session.SessionId),
+            request => AssertConnectorRequest(
+                request,
+                "session.connectors.list",
+                session.SessionId,
+                ("accountId", "account-1")),
+            request => AssertConnectorRequest(
+                request,
+                "session.connectors.refresh",
+                session.SessionId,
+                ("accountId", "account-1")));
+    }
+
+    [Fact]
+    public async Task Session_Rpc_Connectors_Maps_Connection_Wire_And_Result_Variants()
+    {
+        await using var server = await FakeCopilotServer.StartAsync();
+        server.ResponseFactory = CreateConnectorRpcResponse;
+        await using var client = new CopilotClient(new CopilotClientOptions
+        {
+            Connection = RuntimeConnection.ForUri(server.Url)
+        });
+        await using var session = await client.CreateSessionAsync(new SessionConfig());
+        server.ClearRequests();
+
+        var connected = Assert.IsType<ConnectorConnectResultConnected>(
+            await session.Rpc.Connectors.ConnectAsync("account-1", "slack"));
+        Assert.Equal("connected", connected.Kind);
+        Assert.Equal(8, connected.Status.Catalog?.Revision);
+
+        var consent = Assert.IsType<ConnectorConnectResultConsentRequired>(
+            await session.Rpc.Connectors.ReconnectAsync("account-1", "slack"));
+        Assert.Equal("consent_required", consent.Kind);
+        Assert.Equal("https://example.com/consent", consent.ConsentUrl);
+        Assert.Equal("continuation-reconnect", consent.ContinuationId);
+
+        var pending = Assert.IsType<ConnectorConnectResultPending>(
+            await session.Rpc.Connectors.ContinueConnectionAsync(
+                "continuation-reconnect",
+                maxAttempts: 3,
+                pollIntervalMs: 1_000,
+                deadlineMs: 10_000));
+        Assert.Equal("pending", pending.Kind);
+        Assert.Equal("continuation-next", pending.ContinuationId);
+
+        Assert.Collection(
+            server.Requests,
+            request => AssertConnectorRequest(
+                request,
+                "session.connectors.connect",
+                session.SessionId,
+                ("accountId", "account-1"),
+                ("connectorName", "slack")),
+            request => AssertConnectorRequest(
+                request,
+                "session.connectors.reconnect",
+                session.SessionId,
+                ("accountId", "account-1"),
+                ("connectorName", "slack")),
+            request => AssertConnectorRequest(
+                request,
+                "session.connectors.continueConnection",
+                session.SessionId,
+                ("continuationId", "continuation-reconnect"),
+                ("maxAttempts", 3L),
+                ("pollIntervalMs", 1_000L),
+                ("deadlineMs", 10_000L)));
+    }
+
+    [Fact]
+    public async Task Session_Rpc_Connectors_Maps_Disconnect_And_Reconcile()
+    {
+        await using var server = await FakeCopilotServer.StartAsync();
+        server.ResponseFactory = CreateConnectorRpcResponse;
+        await using var client = new CopilotClient(new CopilotClientOptions
+        {
+            Connection = RuntimeConnection.ForUri(server.Url)
+        });
+        await using var session = await client.CreateSessionAsync(new SessionConfig());
+        server.ClearRequests();
+
+        var disconnected = await session.Rpc.Connectors.DisconnectAsync("account-1", "slack");
+        Assert.True(disconnected.Disconnected);
+        Assert.Equal(9, disconnected.Status.Catalog?.Revision);
+
+        var reconciled = await session.Rpc.Connectors.ReconcileAsync("account-1", refreshCatalog: true);
+        Assert.Equal(10, reconciled.Catalog?.Revision);
+        Assert.Empty(reconciled.RuntimeServers);
+
+        Assert.Collection(
+            server.Requests,
+            request => AssertConnectorRequest(
+                request,
+                "session.connectors.disconnect",
+                session.SessionId,
+                ("accountId", "account-1"),
+                ("connectorName", "slack")),
+            request => AssertConnectorRequest(
+                request,
+                "session.connectors.reconcile",
+                session.SessionId,
+                ("accountId", "account-1"),
+                ("refreshCatalog", true)));
+    }
+
+    private static Dictionary<string, object?> CreateConnectorRpcResponse(RpcRequestRecord request) =>
+        request.Method switch
+        {
+            "session.connectors.getCapabilities" => new Dictionary<string, object?>
+            {
+                ["apiVersion"] = 1L,
+                ["availability"] = "enabled",
+                ["consentContinuation"] = true,
+                ["maxDeadlineMs"] = 30_000L,
+                ["maxPollAttempts"] = 5L,
+                ["maxPollIntervalMs"] = 2_000L,
+                ["opaqueAccountSelection"] = true
+            },
+            "session.connectors.getStatus" => CreateConnectorStatusResponse(7, pendingConnections: 2),
+            "session.connectors.list" => CreateConnectorCatalogResponse(3, "not_connected"),
+            "session.connectors.refresh" => CreateConnectorCatalogResponse(4, "connected"),
+            "session.connectors.connect" => new Dictionary<string, object?>
+            {
+                ["kind"] = "connected",
+                ["status"] = CreateConnectorStatusResponse(8)
+            },
+            "session.connectors.reconnect" => new Dictionary<string, object?>
+            {
+                ["kind"] = "consent_required",
+                ["consentUrl"] = "https://example.com/consent",
+                ["continuationId"] = "continuation-reconnect"
+            },
+            "session.connectors.continueConnection" => new Dictionary<string, object?>
+            {
+                ["kind"] = "pending",
+                ["continuationId"] = "continuation-next"
+            },
+            "session.connectors.disconnect" => new Dictionary<string, object?>
+            {
+                ["disconnected"] = true,
+                ["status"] = CreateConnectorStatusResponse(9)
+            },
+            "session.connectors.reconcile" => CreateConnectorStatusResponse(
+                10,
+                includeRuntimeServer: false),
+            _ => throw new InvalidOperationException($"Unexpected Connector RPC method '{request.Method}'.")
+        };
+
+    private static Dictionary<string, object?> CreateConnectorStatusResponse(
+        long revision,
+        long pendingConnections = 0,
+        bool includeRuntimeServer = true) =>
+        new()
+        {
+            ["accountId"] = "account-1",
+            ["apiVersion"] = 1L,
+            ["availability"] = "enabled",
+            ["catalog"] = CreateConnectorCatalogResponse(revision, "connected"),
+            ["pendingConnections"] = pendingConnections,
+            ["runtimeServers"] = includeRuntimeServer
+                ? new object?[]
+                {
+                    new Dictionary<string, object?>
+                    {
+                        ["connectorName"] = "slack",
+                        ["runtimeServerId"] = "connector-slack",
+                        ["status"] = "connected"
+                    }
+                }
+                : Array.Empty<object?>()
+        };
+
+    private static Dictionary<string, object?> CreateConnectorCatalogResponse(long revision, string status) =>
+        new()
+        {
+            ["connectors"] = new object?[]
+            {
+                new Dictionary<string, object?>
+                {
+                    ["description"] = "Slack workspace search",
+                    ["displayName"] = "Slack",
+                    ["name"] = "slack",
+                    ["runtimeServerIds"] = new object?[] { "connector-slack" },
+                    ["status"] = status
+                }
+            },
+            ["refreshedAtMs"] = 1_750_000_000_000L,
+            ["revision"] = revision
+        };
+
+    private static void AssertConnectorCatalog(
+        ConnectorCatalogResult catalog,
+        long revision,
+        ConnectorCatalogStatus status)
+    {
+        Assert.Equal(revision, catalog.Revision);
+        Assert.Equal(1_750_000_000_000L, catalog.RefreshedAtMs);
+        var connector = Assert.Single(catalog.Connectors);
+        Assert.Equal("Slack", connector.DisplayName);
+        Assert.Equal("slack", connector.Name);
+        Assert.Equal(status, connector.Status);
+        Assert.Equal(["connector-slack"], connector.RuntimeServerIds);
+    }
+
+    private static void AssertConnectorRequest(
+        RpcRequestRecord request,
+        string method,
+        string sessionId,
+        params (string Name, object Value)[] expectedProperties)
+    {
+        Assert.Equal(method, request.Method);
+        Assert.Equal(expectedProperties.Length + 1, request.Params.EnumerateObject().Count());
+        Assert.Equal(sessionId, request.Params.GetProperty("sessionId").GetString());
+
+        foreach (var (name, expectedValue) in expectedProperties)
+        {
+            var actualValue = request.Params.GetProperty(name);
+            switch (expectedValue)
+            {
+                case string stringValue:
+                    Assert.Equal(stringValue, actualValue.GetString());
+                    break;
+                case long longValue:
+                    Assert.Equal(longValue, actualValue.GetInt64());
+                    break;
+                case bool boolValue:
+                    Assert.Equal(boolValue, actualValue.GetBoolean());
+                    break;
+                default:
+                    throw new InvalidOperationException(
+                        $"Unsupported expected JSON value type '{expectedValue.GetType().Name}'.");
+            }
+        }
+    }
+}
+#endif
diff --git a/dotnet/test/Unit/RpcErrorDataTests.cs b/dotnet/test/Unit/RpcErrorDataTests.cs
new file mode 100644
index 0000000000..3c35c8e0cd
--- /dev/null
+++ b/dotnet/test/Unit/RpcErrorDataTests.cs
@@ -0,0 +1,242 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+#if NET8_0_OR_GREATER
+using System.Globalization;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+#endif
+using System.Text.Json;
+using Xunit;
+
+namespace GitHub.Copilot.Test.Unit;
+
+public sealed class RpcErrorDataTests
+{
+    private const string ErrorMessage = "Request failed";
+    private const int ErrorCode = -32042;
+
+    public static TheoryData<string?, JsonValueKind?> ErrorPayloads => new()
+    {
+        { """{"privateDetail":"payload-only-marker","nested":{"items":[1,false,null]}}""", JsonValueKind.Object },
+        { """[{"value":"payload-only-marker"},[1,true],null]""", JsonValueKind.Array },
+        { "{}", JsonValueKind.Object },
+        { "[]", JsonValueKind.Array },
+        { "\"payload-only-marker\"", JsonValueKind.String },
+        { "\"\"", JsonValueKind.String },
+        { "9007199254740993", JsonValueKind.Number },
+        { "1.234567890123456789", JsonValueKind.Number },
+        { "0", JsonValueKind.Number },
+        { "true", JsonValueKind.True },
+        { "false", JsonValueKind.False },
+        { "null", JsonValueKind.Null },
+        { null, null },
+    };
+
+    // The constructor contract also ships in netstandard2.0, exercised by net472.
+    [Theory]
+    [MemberData(nameof(ErrorPayloads))]
+    public void Constructor_Preserves_Data_After_Document_Disposal(string? data, JsonValueKind? kind)
+    {
+        var inner = new IOException("original cause");
+        RemoteRpcException error;
+        using (var document = data is null ? null : JsonDocument.Parse(data))
+        {
+            error = new RemoteRpcException(ErrorMessage, ErrorCode, document?.RootElement, inner);
+        }
+
+        Assert.Equal(ErrorCode, error.ErrorCode);
+        Assert.Equal(ErrorMessage, error.Message);
+        Assert.Same(inner, error.InnerException);
+        Assert.DoesNotContain("payload-only-marker", error.ToString());
+        Assert.Equal(kind.HasValue, error.ErrorData.HasValue);
+        if (kind.HasValue)
+        {
+            Assert.Equal(kind.Value, error.ErrorData!.Value.ValueKind);
+            Assert.Equal(data, error.ErrorData.Value.GetRawText());
+        }
+    }
+
+    [Fact]
+    public void Constructor_Rejects_Undefined_Data()
+    {
+        Assert.Throws<InvalidOperationException>(() =>
+            new RemoteRpcException(ErrorMessage, ErrorCode, default(JsonElement)));
+    }
+
+#if NET8_0_OR_GREATER
+    [Theory]
+    [MemberData(nameof(ErrorPayloads))]
+    public async Task Session_Create_Preserves_Remote_Error_And_Data(string? data, JsonValueKind? kind)
+    {
+        using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+        var dataMember = data is null ? "" : ",\"data\":" + data;
+        await using var server = new FakeCopilotServer("session.create",
+            $$"""{"code":{{ErrorCode}},"message":"{{ErrorMessage}}"{{dataMember}}}""");
+        IOException error;
+        await using (var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForUri(server.Url) }))
+        {
+            error = await Assert.ThrowsAsync<IOException>(() =>
+                client.CreateSessionAsync(new SessionConfig(), timeout.Token));
+
+            // Processing a later response ensures the error response document has been disposed.
+            var ping = await client.PingAsync(cancellationToken: timeout.Token);
+            Assert.Equal("pong", ping.Message);
+        }
+
+        var remote = Assert.IsType<RemoteRpcException>(error.InnerException);
+        Assert.Same(remote, error.GetBaseException());
+        Assert.Equal(ErrorCode, remote.ErrorCode);
+        Assert.Equal(ErrorMessage, remote.Message);
+        Assert.Equal($"Communication error with Copilot CLI: {ErrorMessage}", error.Message);
+        Assert.Equal($"GitHub.Copilot.RemoteRpcException: {ErrorMessage}", remote.ToString().Split(Environment.NewLine)[0]);
+        Assert.Equal($"System.IO.IOException: {error.Message}", error.ToString().Split(Environment.NewLine)[0]);
+        Assert.DoesNotContain("payload-only-marker", remote.ToString());
+        Assert.DoesNotContain("payload-only-marker", error.ToString());
+        Assert.Equal(kind.HasValue, remote.ErrorData.HasValue);
+        if (kind.HasValue)
+        {
+            var payload = remote.ErrorData!.Value;
+            Assert.Equal(kind.Value, payload.ValueKind);
+            Assert.Equal(data, payload.GetRawText());
+        }
+    }
+
+    [Fact]
+    public async Task Successful_Response_Is_Not_An_Error()
+    {
+        using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+        await using var server = new FakeCopilotServer("session.create", null);
+        await using var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForUri(server.Url) });
+
+        var response = await client.PingAsync(cancellationToken: timeout.Token);
+
+        Assert.Equal("pong", response.Message);
+    }
+
+    [Fact]
+    public async Task Connection_Loss_Is_Not_A_Remote_Error()
+    {
+        using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+        await using var server = new FakeCopilotServer("ping", null);
+        await using var client = new CopilotClient(new CopilotClientOptions { Connection = RuntimeConnection.ForUri(server.Url) });
+
+        var error = await Assert.ThrowsAsync<IOException>(() => client.PingAsync(cancellationToken: timeout.Token));
+
+        Assert.NotNull(error.InnerException);
+        Assert.IsNotType<RemoteRpcException>(error.InnerException);
+        Assert.Equal("Communication error with Copilot CLI: The JSON-RPC connection was lost.", error.Message);
+    }
+
+    private sealed class FakeCopilotServer : IAsyncDisposable
+    {
+        private readonly TcpListener _listener = new(IPAddress.Loopback, 0);
+        private readonly CancellationTokenSource _cts = new(TimeSpan.FromSeconds(15));
+        private readonly Task _serverTask;
+        private readonly string _method;
+        private readonly string? _error;
+
+        public FakeCopilotServer(string method, string? error)
+        {
+            _method = method;
+            _error = error;
+            _listener.Start();
+            Url = $"http://127.0.0.1:{((IPEndPoint)_listener.LocalEndpoint).Port}";
+            _serverTask = RunAsync();
+        }
+
+        public string Url { get; }
+
+        public async ValueTask DisposeAsync()
+        {
+            using var cancellation = _cts;
+            _cts.Cancel();
+            try
+            {
+                await _serverTask.WaitAsync(TimeSpan.FromSeconds(5));
+            }
+            catch (OperationCanceledException ex) when (ex.CancellationToken == _cts.Token)
+            {
+                // Canceling a pending accept/read/write is the expected shutdown path.
+                return;
+            }
+            finally
+            {
+                _listener.Stop();
+            }
+        }
+
+        private async Task RunAsync()
+        {
+            using var connection = await _listener.AcceptTcpClientAsync(_cts.Token);
+            using var stream = connection.GetStream();
+            while (!_cts.IsCancellationRequested)
+            {
+                using var request = await ReadMessageAsync(stream, _cts.Token);
+                if (request is null)
+                {
+                    return;
+                }
+                if (!request.RootElement.TryGetProperty("id", out var id))
+                {
+                    continue;
+                }
+                var method = request.RootElement.GetProperty("method").GetString();
+                string response;
+                if (method == _method)
+                {
+                    if (_error is null)
+                    {
+                        return;
+                    }
+                    response = $$"""{"jsonrpc":"2.0","id":{{id.GetRawText()}},"error":{{_error}}}""";
+                }
+                else
+                {
+                    var result = method switch
+                    {
+                        "connect" => """{"ok":true,"protocolVersion":3,"version":"test"}""",
+                        "ping" => """{"message":"pong"}""",
+                        _ => throw new InvalidOperationException($"Unexpected method: {method}"),
+                    };
+                    response = $$"""{"jsonrpc":"2.0","id":{{id.GetRawText()}},"result":{{result}}}""";
+                }
+                var body = Encoding.UTF8.GetBytes(response);
+                var header = Encoding.ASCII.GetBytes($"Content-Length: {body.Length}\r\n\r\n");
+                await stream.WriteAsync(header, _cts.Token);
+                await stream.WriteAsync(body, _cts.Token);
+            }
+        }
+
+        private static async Task<JsonDocument?> ReadMessageAsync(Stream stream, CancellationToken cancellationToken)
+        {
+            var header = new List<byte>();
+            var buffer = new byte[1];
+            while (true)
+            {
+                if (await stream.ReadAsync(buffer, cancellationToken) == 0)
+                {
+                    return null;
+                }
+                header.Add(buffer[0]);
+                if (header.Count >= 4 && header[^4] == '\r' && header[^3] == '\n' &&
+                    header[^2] == '\r' && header[^1] == '\n')
+                {
+                    break;
+                }
+            }
+            var length = Encoding.ASCII.GetString([.. header])
+                .Split("\r\n", StringSplitOptions.RemoveEmptyEntries)
+                .Select(line => line.Split(':', 2))
+                .Where(parts => parts[0].Equals("Content-Length", StringComparison.OrdinalIgnoreCase))
+                .Select(parts => int.Parse(parts[1].Trim(), CultureInfo.InvariantCulture))
+                .Single();
+            var body = new byte[length];
+            await stream.ReadExactlyAsync(body, cancellationToken);
+            return JsonDocument.Parse(body);
+        }
+    }
+#endif
+}
diff --git a/dotnet/test/Unit/SerializationTests.cs b/dotnet/test/Unit/SerializationTests.cs
index 843c3b7e01..09f212cd7e 100644
--- a/dotnet/test/Unit/SerializationTests.cs
+++ b/dotnet/test/Unit/SerializationTests.cs
@@ -987,6 +987,7 @@ public void McpHttpServerConfig_CanSerializeOauthOptions_WithSdkOptions()
             OauthClientId = "client-id",
             OauthPublicClient = false,
             OauthGrantType = McpHttpServerConfigOauthGrantType.ClientCredentials,
+            OauthScopes = ["configured.read", "configured.write"],
             Tools = ["*"],
             Timeout = 3000
         };
@@ -1000,6 +1001,9 @@ public void McpHttpServerConfig_CanSerializeOauthOptions_WithSdkOptions()
         Assert.Equal("client-id", root.GetProperty("oauthClientId").GetString());
         Assert.False(root.GetProperty("oauthPublicClient").GetBoolean());
         Assert.Equal("client_credentials", root.GetProperty("oauthGrantType").GetString());
+        Assert.Equal(
+            ["configured.read", "configured.write"],
+            root.GetProperty("oauthScopes").EnumerateArray().Select(scope => scope.GetString()));
         Assert.Equal("*", root.GetProperty("tools")[0].GetString());
         Assert.Equal(3000, root.GetProperty("timeout").GetInt32());
 
@@ -1010,6 +1014,7 @@ public void McpHttpServerConfig_CanSerializeOauthOptions_WithSdkOptions()
         Assert.Equal("client-id", httpConfig.OauthClientId);
         Assert.False(httpConfig.OauthPublicClient);
         Assert.Equal(McpHttpServerConfigOauthGrantType.ClientCredentials, httpConfig.OauthGrantType);
+        Assert.Equal(["configured.read", "configured.write"], httpConfig.OauthScopes);
         Assert.Equal("*", Assert.Single(httpConfig.Tools!));
         Assert.Equal(3000, httpConfig.Timeout);
     }
diff --git a/dotnet/test/Unit/SessionEventSerializationTests.cs b/dotnet/test/Unit/SessionEventSerializationTests.cs
index 4d5c041051..85752af88b 100644
--- a/dotnet/test/Unit/SessionEventSerializationTests.cs
+++ b/dotnet/test/Unit/SessionEventSerializationTests.cs
@@ -360,6 +360,7 @@ public void SessionEvent_Deserializes_AutoTierSwitchFailed_WithNullRequestedTier
                         ClientSecret = "static-secret",
                         GrantType = "client_credentials",
                         PublicClient = false,
+                        Scope = "configured.read",
                     },
                     WwwAuthenticateParams = new McpOauthWWWAuthenticateParams
                     {
@@ -495,6 +496,12 @@ public void SessionEvent_ToJson_RoundTrips_JsonElementBackedPayloads(SessionEven
                         .GetProperty("staticClientConfig")
                         .GetProperty("clientSecret")
                         .GetString());
+                Assert.Equal(
+                    "configured.read",
+                    root.GetProperty("data")
+                        .GetProperty("staticClientConfig")
+                        .GetProperty("scope")
+                        .GetString());
                 Assert.Equal(
                     """{"resource":"https://example.com/mcp"}""",
                     root.GetProperty("data")
diff --git a/go/README.md b/go/README.md
index 57023128f4..34bf9d4ac3 100644
--- a/go/README.md
+++ b/go/README.md
@@ -17,11 +17,7 @@ go get github.com/github/copilot-sdk/go
 
 ## Run the Sample
 
-Try the interactive chat sample from the SDK root (`src/sdk` when nested).
-In the runtime repository, first run `pnpm run build:cli` from the runtime root
-to prepare the same-checkout executable, then return to `src/sdk`.
-Building the Go SDK alone does not build the runtime. For dependency
-prerequisites, see [development setup](#development).
+Try the interactive chat sample (from the repo root):
 
 ```bash
 cd nodejs
@@ -101,6 +97,42 @@ tool name is `<server-key>-<tool-name>`. For `AvailableTools` and
 `mcp:<server-key>-<tool-name>`. For `CustomAgents[].Tools` and
 `DefaultAgent.ExcludedTools`, use `<server-key>-<tool-name>` directly.
 
+## JSON-RPC errors
+
+Use `errors.As` to inspect a runtime error without parsing its message, including
+errors wrapped by SDK operations:
+
+```go
+var rpcErr *copilot.RPCError
+if errors.As(err, &rpcErr) {
+    fmt.Printf("RPC error %d: %s\n", rpcErr.Code, rpcErr.Message)
+    if rpcErr.Data != nil {
+        // Decode into an application-specific type when the payload schema is known.
+        var details map[string]json.RawMessage
+        if err := json.Unmarshal(rpcErr.Data, &details); err != nil {
+            // The payload may be an array or scalar rather than an object.
+            log.Printf("Error data is not an object: %v", err)
+        }
+    }
+}
+```
+
+This example uses the standard `errors`, `encoding/json`, `fmt`, and `log` packages.
+`RPCError.Data` is a `json.RawMessage` containing the original JSON value:
+objects, arrays, strings, numbers, and booleans are preserved. Omitted `data`
+is `nil`; explicit JSON null is the non-nil JSON text `null`. Empty values,
+zero, and false are not treated as absent. Ordinary connection and local
+precondition failures do not match `*copilot.RPCError`. The transport also uses
+this type for locally synthesized inline-response callback failures, so matching
+it does not prove that the runtime sent an error response.
+
+`RPCError` aliases the existing transport error, so error identity, wrapping,
+and `Error()` messages are unchanged. The error string does not include the
+payload; accessing or logging it is an explicit application choice.
+Avoid logging it indiscriminately: server-provided data may contain sensitive
+information. Its fields and data bytes are shared with the wrapped error; copy
+them before mutation.
+
 ## Distributing your application with an embedded GitHub Copilot CLI
 
 The SDK supports bundling, using Go's `embed` package, the Copilot CLI binary within your application's distribution.
@@ -306,6 +338,8 @@ whitespace, change case, or remove an existing prefix.
 Source is independent of delivery `Mode` and `AgentMode`; it does not replace the
 session's `SystemMessage` configuration. `SendAndWait` accepts the same options
 and still waits for session idle, returning `nil` if no assistant message arrives.
+Sub-agent events remain visible to listeners but do not complete the wait or
+supply its reply.
 
 ### Helper Functions
 
@@ -1099,21 +1133,20 @@ Communicates with CLI via TCP socket. Useful for distributed scenarios.
 
 ## Development
 
-Follow [SDK development setup](../CONTRIBUTING.md#developing-an-sdk) for Go,
-golangci-lint, and the Node/replay-harness dependencies. From the SDK root
-(`src/sdk` in the runtime repository, or the standalone repository root):
+Tests require a supported [Node.js version](../nodejs/README.md#prerequisites). From the repository root:
 
 ```bash
-npm run build:go
-npm run test:go
-npm run check:go
+cd nodejs
+npm ci
 ```
 
-For focused tests, use `go test` selectors from `go/` after
-[preparing the runtime](../CONTRIBUTING.md#testing-an-unreleased-runtime-api).
-The existing race-enabled native test script is also available there:
+```bash
+cd test/harness
+npm ci
+```
 
 ```bash
+cd go
 ./test.sh
 ```
 
diff --git a/go/client.go b/go/client.go
index 5399662aa0..228436de00 100644
--- a/go/client.go
+++ b/go/client.go
@@ -912,6 +912,7 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 	req.SessionLimits = config.SessionLimits
 	req.IsExperimentalMode = config.EnableExperimentalMode
 	req.SkipCustomInstructions = config.SkipCustomInstructions
+	req.RefreshCustomInstructions = config.RefreshCustomInstructions
 	req.CustomAgentsLocalOnly = config.CustomAgentsLocalOnly
 	req.CoauthorEnabled = config.CoauthorEnabled
 	req.ManageScheduleEnabled = config.ManageScheduleEnabled
@@ -919,6 +920,7 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 	req.WorkingDirectory = config.WorkingDirectory
 	req.AdditionalDirectories = config.AdditionalDirectories
 	req.MCPServers = config.MCPServers
+	req.Diagnostics = config.Diagnostics
 	req.MCPOAuthTokenStorage = config.MCPOAuthTokenStorage
 	req.AuthClientIDMetadataURL = config.AuthClientIDMetadataURL
 	req.EnvValueMode = "direct"
@@ -1088,10 +1090,6 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 			s.registerBearerTokenProviders(bearerTokenProviders)
 		}
 
-		c.sessionsMux.Lock()
-		c.sessions[sessionID] = s
-		c.sessionsMux.Unlock()
-
 		if c.options.SessionFS != nil {
 			if config.CreateSessionFSProvider == nil {
 				unregisterSession(sessionID, s)
@@ -1106,6 +1104,10 @@ func (c *Client) CreateSession(ctx context.Context, config *SessionConfig) (*Ses
 			}
 			s.clientSessionAPIs.SessionFS = newSessionFSAdapter(provider)
 		}
+
+		c.sessionsMux.Lock()
+		c.sessions[sessionID] = s
+		c.sessionsMux.Unlock()
 		return s, nil
 	}
 
@@ -1339,6 +1341,7 @@ func (c *Client) ResumeSessionWithOptions(ctx context.Context, sessionID string,
 	}
 	req.ContinuePendingWork = config.ContinuePendingWork
 	req.MCPServers = config.MCPServers
+	req.Diagnostics = config.Diagnostics
 	req.MCPOAuthTokenStorage = config.MCPOAuthTokenStorage
 	req.AuthClientIDMetadataURL = config.AuthClientIDMetadataURL
 	req.EnvValueMode = "direct"
@@ -1445,6 +1448,23 @@ func (c *Client) ResumeSessionWithOptions(ctx context.Context, sessionID string,
 		session.registerBearerTokenProviders(bearerTokenProviders)
 	}
 
+	if c.options.SessionFS != nil {
+		if config.CreateSessionFSProvider == nil {
+			session.stopEventProcessing()
+			return nil, fmt.Errorf("CreateSessionFSProvider is required in session config when SessionFS is enabled in client options")
+		}
+		provider := config.CreateSessionFSProvider(session)
+		if c.options.SessionFS.Capabilities != nil && c.options.SessionFS.Capabilities.Sqlite {
+			if _, ok := provider.(SessionFSSqliteProvider); !ok {
+				session.stopEventProcessing()
+				return nil, fmt.Errorf("SessionFS capabilities declare SQLite support but the provider does not implement SessionFSSqliteProvider")
+			}
+		}
+		session.clientSessionAPIs.SessionFS = newSessionFSAdapter(provider)
+	}
+
+	// Publish only fully initialized handlers: the runtime may still be issuing
+	// SessionFS callbacks for the previous session while its replacement is built.
 	c.sessionsMux.Lock()
 	replacedSession := c.sessions[sessionID]
 	c.sessions[sessionID] = session
@@ -1468,21 +1488,6 @@ func (c *Client) ResumeSessionWithOptions(ctx context.Context, sessionID string,
 		session.stopEventProcessing()
 	}
 
-	if c.options.SessionFS != nil {
-		if config.CreateSessionFSProvider == nil {
-			restoreReplacedSession()
-			return nil, fmt.Errorf("CreateSessionFSProvider is required in session config when SessionFS is enabled in client options")
-		}
-		provider := config.CreateSessionFSProvider(session)
-		if c.options.SessionFS.Capabilities != nil && c.options.SessionFS.Capabilities.Sqlite {
-			if _, ok := provider.(SessionFSSqliteProvider); !ok {
-				restoreReplacedSession()
-				return nil, fmt.Errorf("SessionFS capabilities declare SQLite support but the provider does not implement SessionFSSqliteProvider")
-			}
-		}
-		session.clientSessionAPIs.SessionFS = newSessionFSAdapter(provider)
-	}
-
 	result, err := c.client.Request(ctx, "session.resume", req)
 	if err != nil {
 		restoreReplacedSession()
diff --git a/go/client_test.go b/go/client_test.go
index 1613c3b394..9cf8d4e095 100644
--- a/go/client_test.go
+++ b/go/client_test.go
@@ -685,6 +685,80 @@ func TestClient_ForwardsCapiOptionsToSessionRequests(t *testing.T) {
 	}
 }
 
+func TestClient_RefreshCustomInstructionsIsCreateOnly(t *testing.T) {
+	if _, ok := reflect.TypeOf(ResumeSessionConfig{}).FieldByName("RefreshCustomInstructions"); ok {
+		t.Fatal("ResumeSessionConfig must not expose RefreshCustomInstructions")
+	}
+
+	for _, tt := range []struct {
+		name    string
+		refresh *bool
+	}{
+		{"true", Bool(true)},
+		{"false", Bool(false)},
+		{"omitted", nil},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			rpcClient, server, _ := newRuntimeShutdownRpcPair(t)
+			t.Cleanup(server.Stop)
+			client := &Client{
+				client:   rpcClient,
+				RPC:      rpc.NewServerRPC(rpcClient),
+				sessions: make(map[string]*Session),
+			}
+			server.SetRequestHandler("session.detach", func(params json.RawMessage) (json.RawMessage, *jsonrpc2.Error) {
+				return []byte(`{"success":true}`), nil
+			})
+			t.Cleanup(func() {
+				if err := client.Stop(); err != nil {
+					t.Errorf("Stop failed: %v", err)
+				}
+			})
+			captured := make(chan json.RawMessage, 1)
+			for _, method := range []string{"session.create", "session.resume"} {
+				server.SetRequestHandler(method, func(params json.RawMessage) (json.RawMessage, *jsonrpc2.Error) {
+					captured <- append(json.RawMessage(nil), params...)
+					sessionID := sessionIDFromParams(t, params)
+					return []byte(`{"sessionId":"` + sessionID + `"}`), nil
+				})
+			}
+
+			session, err := client.CreateSession(t.Context(), &SessionConfig{
+				RefreshCustomInstructions: tt.refresh,
+			})
+			if err != nil {
+				t.Fatalf("CreateSession failed: %v", err)
+			}
+			var createParams map[string]any
+			if err := json.Unmarshal(<-captured, &createParams); err != nil {
+				t.Fatal(err)
+			}
+			got, present := createParams["refreshCustomInstructions"]
+			if tt.refresh == nil {
+				if present {
+					t.Errorf("refreshCustomInstructions = %v, want omitted", got)
+				}
+			} else if got != *tt.refresh {
+				t.Errorf("refreshCustomInstructions = %v, want %v", got, *tt.refresh)
+			}
+
+			if err := session.Disconnect(); err != nil {
+				t.Fatalf("Disconnect failed: %v", err)
+			}
+			if _, err := client.ResumeSession(t.Context(), session.SessionID, nil); err != nil {
+				t.Fatalf("ResumeSession failed: %v", err)
+			}
+			var resumeParams map[string]any
+			if err := json.Unmarshal(<-captured, &resumeParams); err != nil {
+				t.Fatal(err)
+			}
+			if got, present := resumeParams["refreshCustomInstructions"]; present {
+				t.Errorf("resume refreshCustomInstructions = %v, want omitted", got)
+			}
+		})
+	}
+}
+
 func TestClient_ForwardsAskUserVariantToSessionRequests(t *testing.T) {
 	rpcClient, server, _ := newRuntimeShutdownRpcPair(t)
 	t.Cleanup(server.Stop)
@@ -731,6 +805,83 @@ func TestClient_ForwardsAskUserVariantToSessionRequests(t *testing.T) {
 	assertAskUserVariant(t, <-resumeParams, "")
 }
 
+func TestClient_ForwardsDiagnosticsToSessionRequests(t *testing.T) {
+	rpcClient, server, _ := newRuntimeShutdownRpcPair(t)
+	t.Cleanup(server.Stop)
+	client := &Client{
+		client:   rpcClient,
+		RPC:      rpc.NewServerRPC(rpcClient),
+		sessions: make(map[string]*Session),
+	}
+
+	createParams := make(chan json.RawMessage, 2)
+	server.SetRequestHandler("session.create", func(params json.RawMessage) (json.RawMessage, *jsonrpc2.Error) {
+		createParams <- append(json.RawMessage(nil), params...)
+		sessionID := sessionIDFromParams(t, params)
+		return []byte(`{"sessionId":"` + sessionID + `","workspacePath":"/workspace"}`), nil
+	})
+	resumeParams := make(chan json.RawMessage, 2)
+	server.SetRequestHandler("session.resume", func(params json.RawMessage) (json.RawMessage, *jsonrpc2.Error) {
+		resumeParams <- append(json.RawMessage(nil), params...)
+		sessionID := sessionIDFromParams(t, params)
+		return []byte(`{"sessionId":"` + sessionID + `","workspacePath":"/workspace"}`), nil
+	})
+
+	if _, err := client.CreateSession(t.Context(), &SessionConfig{
+		SessionID:   "diagnostics-create",
+		Diagnostics: diagnosticsConfiguration(rpc.DiagnosticLogLevelDebug),
+	}); err != nil {
+		t.Fatalf("CreateSession failed: %v", err)
+	}
+	if _, err := client.ResumeSession(t.Context(), "diagnostics-resume", &ResumeSessionConfig{
+		Diagnostics: diagnosticsConfiguration(rpc.DiagnosticLogLevelTrace),
+	}); err != nil {
+		t.Fatalf("ResumeSession failed: %v", err)
+	}
+	if _, err := client.CreateSession(t.Context(), &SessionConfig{SessionID: "diagnostics-default-create"}); err != nil {
+		t.Fatalf("CreateSession with default failed: %v", err)
+	}
+	if _, err := client.ResumeSession(t.Context(), "diagnostics-default-resume", nil); err != nil {
+		t.Fatalf("ResumeSession with default failed: %v", err)
+	}
+
+	assertDiagnostics(t, <-createParams, "debug")
+	assertDiagnostics(t, <-resumeParams, "trace")
+	assertDiagnostics(t, <-createParams, "")
+	assertDiagnostics(t, <-resumeParams, "")
+}
+
+func diagnosticsConfiguration(level rpc.DiagnosticLogLevel) *rpc.DiagnosticsConfiguration {
+	return &rpc.DiagnosticsConfiguration{
+		Sources: rpc.DiagnosticSourcesConfiguration{
+			MCP: &rpc.MCPDiagnosticSourceConfiguration{Level: level},
+		},
+	}
+}
+
+func assertDiagnostics(t *testing.T, params json.RawMessage, want string) {
+	t.Helper()
+	var payload map[string]any
+	if err := json.Unmarshal(params, &payload); err != nil {
+		t.Fatalf("failed to decode request params: %v", err)
+	}
+	got, present := payload["diagnostics"]
+	if want == "" {
+		if present {
+			t.Fatalf("diagnostics = %v, want omitted", got)
+		}
+		return
+	}
+	wantConfiguration := map[string]any{
+		"sources": map[string]any{
+			"mcp": map[string]any{"level": want},
+		},
+	}
+	if !reflect.DeepEqual(got, wantConfiguration) {
+		t.Fatalf("diagnostics = %v, want %v", got, wantConfiguration)
+	}
+}
+
 func TestClient_RejectsInvalidAskUserVariant(t *testing.T) {
 	client := &Client{}
 
@@ -1200,6 +1351,69 @@ func TestClient_ResumeSessionInitializationFailureClosesRegisteredSession(t *tes
 	assertSessionNotRegistered(t, client, "resumed-session-fs")
 }
 
+func TestClient_SessionFSProviderInitializationKeepsRegisteredHandlers(t *testing.T) {
+	for _, method := range []string{"session.create", "session.resume"} {
+		t.Run(method, func(t *testing.T) {
+			rpcClient, server, _ := newRuntimeShutdownRpcPair(t)
+			t.Cleanup(server.Stop)
+			const sessionID = "session-fs-initializing"
+			previous := newSession(sessionID, rpcClient, "", false)
+			previous.clientSessionAPIs.SessionFS = newSessionFSAdapter(noSQLiteSessionFSProvider{})
+			t.Cleanup(previous.stopEventProcessing)
+			client := &Client{
+				client:   rpcClient,
+				RPC:      rpc.NewServerRPC(rpcClient),
+				sessions: map[string]*Session{sessionID: previous},
+				options:  ClientOptions{SessionFS: &SessionFSConfig{}},
+			}
+			client.setupNotificationHandler()
+			readFile := func() error {
+				_, err := server.Request(t.Context(), "sessionFs.readFile", map[string]any{
+					"sessionId": sessionID,
+					"path":      "/events.jsonl",
+				})
+				return err
+			}
+			server.SetRequestHandler(method, func(json.RawMessage) (json.RawMessage, *jsonrpc2.Error) {
+				if err := readFile(); err != nil {
+					return nil, &jsonrpc2.Error{Code: -32603, Message: err.Error()}
+				}
+				return json.RawMessage(`{"sessionId":"session-fs-initializing"}`), nil
+			})
+
+			// Outstanding runtime callbacks can arrive while the replacement provider is constructed.
+			var duringInitialization error
+			providerCalled := false
+			provider := func(session *Session) SessionFSProvider {
+				providerCalled = true
+				t.Cleanup(session.stopEventProcessing)
+				duringInitialization = readFile()
+				return noSQLiteSessionFSProvider{}
+			}
+			var err error
+			if method == "session.create" {
+				_, err = client.CreateSession(t.Context(), &SessionConfig{
+					SessionID:               sessionID,
+					CreateSessionFSProvider: provider,
+				})
+			} else {
+				_, err = client.ResumeSession(t.Context(), sessionID, &ResumeSessionConfig{
+					CreateSessionFSProvider: provider,
+				})
+			}
+			if !providerCalled {
+				t.Fatal("CreateSessionFSProvider was not called")
+			}
+			if duringInitialization != nil {
+				t.Errorf("existing SessionFS callback failed during provider initialization: %v", duringInitialization)
+			}
+			if err != nil {
+				t.Fatalf("%s failed: %v", method, err)
+			}
+		})
+	}
+}
+
 func assertSessionEventChannelClosed(t *testing.T, session *Session) {
 	t.Helper()
 	select {
diff --git a/go/connectors_rpc_test.go b/go/connectors_rpc_test.go
new file mode 100644
index 0000000000..ff92a1b29a
--- /dev/null
+++ b/go/connectors_rpc_test.go
@@ -0,0 +1,309 @@
+package copilot
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"reflect"
+	"testing"
+
+	"github.com/github/copilot-sdk/go/internal/jsonrpc2"
+	"github.com/github/copilot-sdk/go/rpc"
+)
+
+const (
+	connectorAccountID    = "opaque-account-selection"
+	connectorStatusResult = `{
+	"accountId":"` + connectorAccountID + `",
+	"apiVersion":1,
+	"availability":"enabled",
+	"catalog":{
+		"connectors":[{
+			"description":"Calendar and mail",
+			"displayName":"Outlook",
+			"name":"outlook",
+			"runtimeServerIds":["connector-outlook"],
+			"status":"connected"
+		}],
+		"refreshedAtMs":1700000000000,
+		"revision":7
+	},
+	"pendingConnections":2,
+	"runtimeServers":[{
+		"connectorName":"outlook",
+		"runtimeServerId":"connector-outlook",
+		"status":"connected"
+	}]
+}`
+)
+
+func TestSessionRPCConnectors(t *testing.T) {
+	clientConn, serverConn := net.Pipe()
+	client := jsonrpc2.NewClient(clientConn, clientConn)
+	server := jsonrpc2.NewClient(serverConn, serverConn)
+	client.Start()
+	server.Start()
+	t.Cleanup(func() {
+		client.Stop()
+		server.Stop()
+		_ = clientConn.Close()
+		_ = serverConn.Close()
+	})
+
+	session := newSession("session-1", client, "", false)
+	t.Cleanup(session.stopEventProcessing)
+	if session.RPC == nil || session.RPC.Connectors == nil {
+		t.Fatal("session.RPC.Connectors is not initialized")
+	}
+
+	t.Run("get capabilities", func(t *testing.T) {
+		expectConnectorRPC(t, server, "session.connectors.getCapabilities", map[string]any{
+			"sessionId": "session-1",
+		}, `{
+			"apiVersion":1,
+			"availability":"enabled",
+			"consentContinuation":true,
+			"maxDeadlineMs":60000,
+			"maxPollAttempts":10,
+			"maxPollIntervalMs":5000,
+			"opaqueAccountSelection":true
+		}`)
+
+		result, err := session.RPC.Connectors.GetCapabilities(t.Context())
+		if err != nil {
+			t.Fatalf("GetCapabilities: %v", err)
+		}
+		if result.APIVersion != 1 ||
+			result.Availability != rpc.ConnectorAvailabilityEnabled ||
+			!result.ConsentContinuation ||
+			result.MaxDeadlineMs != 60000 ||
+			result.MaxPollAttempts != 10 ||
+			result.MaxPollIntervalMs != 5000 ||
+			!result.OpaqueAccountSelection {
+			t.Fatalf("GetCapabilities result = %#v", result)
+		}
+	})
+
+	t.Run("get status", func(t *testing.T) {
+		expectConnectorRPC(t, server, "session.connectors.getStatus", map[string]any{
+			"sessionId": "session-1",
+		}, connectorStatusResult)
+
+		result, err := session.RPC.Connectors.GetStatus(t.Context())
+		if err != nil {
+			t.Fatalf("GetStatus: %v", err)
+		}
+		assertConnectorStatus(t, result)
+	})
+
+	t.Run("list", func(t *testing.T) {
+		expectConnectorRPC(t, server, "session.connectors.list", map[string]any{
+			"accountId": connectorAccountID,
+			"sessionId": "session-1",
+		}, `{
+			"connectors":[{
+				"description":"Calendar and mail",
+				"displayName":"Outlook",
+				"name":"outlook",
+				"runtimeServerIds":["connector-outlook"],
+				"status":"connected"
+			}],
+			"refreshedAtMs":1700000000000,
+			"revision":7
+		}`)
+
+		result, err := session.RPC.Connectors.List(t.Context(), &rpc.ConnectorAccountRequest{
+			AccountID: connectorAccountID,
+		})
+		if err != nil {
+			t.Fatalf("List: %v", err)
+		}
+		assertConnectorCatalog(t, result, 7, rpc.ConnectorCatalogStatusConnected)
+	})
+
+	t.Run("refresh", func(t *testing.T) {
+		expectConnectorRPC(t, server, "session.connectors.refresh", map[string]any{
+			"accountId": connectorAccountID,
+			"sessionId": "session-1",
+		}, `{
+			"connectors":[{
+				"displayName":"Outlook",
+				"name":"outlook",
+				"runtimeServerIds":[],
+				"status":"not_connected"
+			}],
+			"refreshedAtMs":1700000000100,
+			"revision":8
+		}`)
+
+		result, err := session.RPC.Connectors.Refresh(t.Context(), &rpc.ConnectorAccountRequest{
+			AccountID: connectorAccountID,
+		})
+		if err != nil {
+			t.Fatalf("Refresh: %v", err)
+		}
+		assertConnectorCatalog(t, result, 8, rpc.ConnectorCatalogStatusNotConnected)
+	})
+
+	t.Run("connect", func(t *testing.T) {
+		expectConnectorRPC(t, server, "session.connectors.connect", map[string]any{
+			"accountId":     connectorAccountID,
+			"connectorName": "outlook",
+			"sessionId":     "session-1",
+		}, `{
+			"kind":"consent_required",
+			"consentUrl":"https://example.com/consent",
+			"continuationId":"continuation-1"
+		}`)
+
+		result, err := session.RPC.Connectors.Connect(t.Context(), &rpc.ConnectorConnectRequest{
+			AccountID:     connectorAccountID,
+			ConnectorName: "outlook",
+		})
+		if err != nil {
+			t.Fatalf("Connect: %v", err)
+		}
+		consent, ok := result.(*rpc.ConnectorConnectResultConsentRequired)
+		if !ok || consent.ConsentURL != "https://example.com/consent" || consent.ContinuationID != "continuation-1" {
+			t.Fatalf("Connect result = %#v", result)
+		}
+	})
+
+	t.Run("reconnect", func(t *testing.T) {
+		expectConnectorRPC(t, server, "session.connectors.reconnect", map[string]any{
+			"accountId":     connectorAccountID,
+			"connectorName": "outlook",
+			"sessionId":     "session-1",
+		}, `{"kind":"pending","continuationId":"continuation-2"}`)
+
+		result, err := session.RPC.Connectors.Reconnect(t.Context(), &rpc.ConnectorConnectRequest{
+			AccountID:     connectorAccountID,
+			ConnectorName: "outlook",
+		})
+		if err != nil {
+			t.Fatalf("Reconnect: %v", err)
+		}
+		pending, ok := result.(*rpc.ConnectorConnectResultPending)
+		if !ok || pending.ContinuationID != "continuation-2" {
+			t.Fatalf("Reconnect result = %#v", result)
+		}
+	})
+
+	t.Run("continue connection", func(t *testing.T) {
+		expectConnectorRPC(t, server, "session.connectors.continueConnection", map[string]any{
+			"continuationId": "continuation-2",
+			"deadlineMs":     float64(30000),
+			"maxAttempts":    float64(4),
+			"pollIntervalMs": float64(500),
+			"sessionId":      "session-1",
+		}, `{"kind":"connected","status":`+connectorStatusResult+`}`)
+
+		result, err := session.RPC.Connectors.ContinueConnection(t.Context(), &rpc.ConnectorContinueRequest{
+			ContinuationID: "continuation-2",
+			DeadlineMs:     30000,
+			MaxAttempts:    4,
+			PollIntervalMs: 500,
+		})
+		if err != nil {
+			t.Fatalf("ContinueConnection: %v", err)
+		}
+		connected, ok := result.(*rpc.ConnectorConnectResultConnected)
+		if !ok {
+			t.Fatalf("ContinueConnection result = %T", result)
+		}
+		assertConnectorStatus(t, &connected.Status)
+	})
+
+	t.Run("disconnect", func(t *testing.T) {
+		expectConnectorRPC(t, server, "session.connectors.disconnect", map[string]any{
+			"accountId":     connectorAccountID,
+			"connectorName": "outlook",
+			"sessionId":     "session-1",
+		}, `{"disconnected":true,"status":`+connectorStatusResult+`}`)
+
+		result, err := session.RPC.Connectors.Disconnect(t.Context(), &rpc.ConnectorConnectRequest{
+			AccountID:     connectorAccountID,
+			ConnectorName: "outlook",
+		})
+		if err != nil {
+			t.Fatalf("Disconnect: %v", err)
+		}
+		if !result.Disconnected {
+			t.Fatalf("Disconnect result = %#v", result)
+		}
+		assertConnectorStatus(t, &result.Status)
+	})
+
+	t.Run("reconcile", func(t *testing.T) {
+		expectConnectorRPC(t, server, "session.connectors.reconcile", map[string]any{
+			"accountId":      connectorAccountID,
+			"refreshCatalog": true,
+			"sessionId":      "session-1",
+		}, connectorStatusResult)
+
+		result, err := session.RPC.Connectors.Reconcile(t.Context(), &rpc.ConnectorReconcileRequest{
+			AccountID:      connectorAccountID,
+			RefreshCatalog: Bool(true),
+		})
+		if err != nil {
+			t.Fatalf("Reconcile: %v", err)
+		}
+		assertConnectorStatus(t, result)
+	})
+}
+
+func expectConnectorRPC(t *testing.T, server *jsonrpc2.Client, method string, wantParams map[string]any, result string) {
+	t.Helper()
+	wantJSON, err := json.Marshal(wantParams)
+	if err != nil {
+		t.Fatalf("marshal expected %s params: %v", method, err)
+	}
+	var want any
+	if err := json.Unmarshal(wantJSON, &want); err != nil {
+		t.Fatalf("normalize expected %s params: %v", method, err)
+	}
+
+	server.SetRequestHandler(method, func(params json.RawMessage) (json.RawMessage, *jsonrpc2.Error) {
+		var got any
+		if err := json.Unmarshal(params, &got); err != nil {
+			return nil, &jsonrpc2.Error{Code: -32602, Message: err.Error()}
+		}
+		if !reflect.DeepEqual(got, want) {
+			return nil, &jsonrpc2.Error{
+				Code:    -32602,
+				Message: fmt.Sprintf("%s params = %s, want %s", method, params, wantJSON),
+			}
+		}
+		return json.RawMessage(result), nil
+	})
+}
+
+func assertConnectorCatalog(t *testing.T, catalog *rpc.ConnectorCatalogResult, revision int64, status rpc.ConnectorCatalogStatus) {
+	t.Helper()
+	if catalog.Revision != revision || len(catalog.Connectors) != 1 {
+		t.Fatalf("catalog = %#v", catalog)
+	}
+	connector := catalog.Connectors[0]
+	if connector.Name != "outlook" || connector.DisplayName != "Outlook" || connector.Status != status {
+		t.Fatalf("connector = %#v", connector)
+	}
+}
+
+func assertConnectorStatus(t *testing.T, status *rpc.ConnectorStatus) {
+	t.Helper()
+	if status.AccountID == nil ||
+		*status.AccountID != connectorAccountID ||
+		status.APIVersion != 1 ||
+		status.Availability != rpc.ConnectorAvailabilityEnabled ||
+		status.PendingConnections != 2 ||
+		len(status.RuntimeServers) != 1 {
+		t.Fatalf("status = %#v", status)
+	}
+	assertConnectorCatalog(t, status.Catalog, 7, rpc.ConnectorCatalogStatusConnected)
+	runtimeServer := status.RuntimeServers[0]
+	if runtimeServer.ConnectorName != "outlook" ||
+		runtimeServer.RuntimeServerID != "connector-outlook" ||
+		runtimeServer.Status != rpc.ConnectorMCPStatusConnected {
+		t.Fatalf("runtime server = %#v", runtimeServer)
+	}
+}
diff --git a/go/errors.go b/go/errors.go
new file mode 100644
index 0000000000..f0b8f446b3
--- /dev/null
+++ b/go/errors.go
@@ -0,0 +1,20 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+
+package copilot
+
+import "github.com/github/copilot-sdk/go/internal/jsonrpc2"
+
+// RPCError is the SDK's JSON-RPC transport error.
+// Use errors.As to retrieve it from errors wrapped by SDK operations.
+// It represents remote error responses and locally synthesized errors when an
+// inline response callback fails; its type alone does not establish provenance.
+//
+// Code and Message contain the JSON-RPC error code and message. Data contains
+// the optional JSON value, which can be an object, array, or scalar. Omitted
+// data is nil; explicit JSON null is the JSON text "null". Error() does not
+// include Data.
+//
+// RPCError is an alias of the transport error, preserving its identity and
+// existing wrapping behavior. Its exported fields are part of the public API.
+// The fields and Data bytes are shared with the error chain; copy before mutation.
+type RPCError = jsonrpc2.Error
diff --git a/go/errors_test.go b/go/errors_test.go
new file mode 100644
index 0000000000..4fed77d7f6
--- /dev/null
+++ b/go/errors_test.go
@@ -0,0 +1,219 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+
+package copilot_test
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	copilot "github.com/github/copilot-sdk/go"
+)
+
+func TestRPCErrorData(t *testing.T) {
+	payloads := []struct {
+		name string
+		data string
+	}{
+		{"object", `{"reason":"private detail","nested":{"values":[1,null,false]}}`},
+		{"non-canonical object", "{ \"escaped\" : \"\\u0061\", \"items\" : [ 1, false, null ] }"},
+		{"array", `[1,"private detail",{"nested":true}]`},
+		{"string", `"private detail"`},
+		{"integer", `9007199254740993`},
+		{"fraction", `1.25`},
+		{"zero", `0`},
+		{"true", `true`},
+		{"false", `false`},
+		{"empty object", `{}`},
+		{"empty array", `[]`},
+		{"empty string", `""`},
+		{"omitted", ``},
+		{"null", `null`},
+	}
+
+	for _, payload := range payloads {
+		t.Run(payload.name, func(t *testing.T) {
+			client := newRPCErrorClient(t, payload.data)
+			ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+			defer cancel()
+
+			for _, method := range []string{"status.get", "session.create", "models.list"} {
+				var err error
+				switch method {
+				case "session.create":
+					_, err = client.CreateSession(ctx, &copilot.SessionConfig{})
+				case "status.get":
+					_, err = client.GetStatus(ctx)
+				case "models.list":
+					_, err = client.RPC.Models.List(ctx, nil)
+				}
+
+				var rpcErr *copilot.RPCError
+				if !errors.As(err, &rpcErr) {
+					t.Fatalf("%s: expected RPCError, got %T: %v", method, err, err)
+				}
+				if rpcErr.Code != -32000 || rpcErr.Message != "request rejected" {
+					t.Fatalf("unexpected RPC error: %+v", rpcErr)
+				}
+				if string(rpcErr.Data) != payload.data {
+					t.Fatalf("data = %s, want %s", rpcErr.Data, payload.data)
+				}
+				if (rpcErr.Data == nil) != (payload.data == "") {
+					t.Fatalf("data presence = %v, want %v", rpcErr.Data != nil, payload.data != "")
+				}
+				want := "JSON-RPC Error -32000: request rejected"
+				if rpcErr.Error() != want {
+					t.Fatalf("RPC error string = %q, want %q", rpcErr.Error(), want)
+				}
+				if method == "session.create" {
+					want = "failed to create session: " + want
+					if errors.Unwrap(err) != rpcErr {
+						t.Fatal("SDK wrapper did not preserve the RPC error identity")
+					}
+				} else if err != rpcErr {
+					t.Fatal("direct call changed the RPC error identity")
+				}
+				if err.Error() != want {
+					t.Fatalf("error string = %q, want %q", err.Error(), want)
+				}
+				outer := fmt.Errorf("application context: %w", err)
+				var recovered *copilot.RPCError
+				if !errors.As(outer, &recovered) || recovered != rpcErr {
+					t.Fatal("application wrapper did not preserve errors.As access")
+				}
+			}
+
+			response, err := client.Ping(ctx, "still connected")
+			if err != nil || response.Message != "still connected" {
+				t.Fatalf("successful response after RPC errors: response=%+v, err=%v", response, err)
+			}
+		})
+	}
+}
+
+func TestRPCErrorNonRPCFailure(t *testing.T) {
+	client := copilot.NewClient(&copilot.ClientOptions{})
+	_, err := client.GetStatus(t.Context())
+	var rpcErr *copilot.RPCError
+	if err == nil || errors.As(err, &rpcErr) {
+		t.Fatalf("expected a non-RPC error, got %T: %v", err, err)
+	}
+}
+
+// Use a raw framed peer so these tests exercise the public API without importing
+// the SDK's internal transport or re-encoding the error through RPCError.
+func newRPCErrorClient(t *testing.T, data string) *copilot.Client {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	done := make(chan error, 1)
+	go func() {
+		done <- serveRPCErrorPeer(listener, data)
+	}()
+	t.Cleanup(func() {
+		listener.Close()
+		select {
+		case err := <-done:
+			if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, net.ErrClosed) {
+				t.Errorf("RPC peer: %v", err)
+			}
+		case <-time.After(10 * time.Second):
+			t.Error("RPC peer did not stop")
+		}
+	})
+
+	client := copilot.NewClient(&copilot.ClientOptions{
+		Connection: copilot.URIConnection{URL: listener.Addr().String()},
+	})
+	t.Cleanup(client.ForceStop)
+	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
+	defer cancel()
+	if err := client.Start(ctx); err != nil {
+		t.Fatal(err)
+	}
+	return client
+}
+
+func serveRPCErrorPeer(listener net.Listener, data string) error {
+	conn, err := listener.Accept()
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	reader := bufio.NewReader(conn)
+	for {
+		if err := conn.SetDeadline(time.Now().Add(10 * time.Second)); err != nil {
+			return err
+		}
+		body, err := readRPCErrorFrame(reader)
+		if err != nil {
+			return err
+		}
+		var request struct {
+			ID     json.RawMessage `json:"id"`
+			Method string          `json:"method"`
+		}
+		if err := json.Unmarshal(body, &request); err != nil {
+			return err
+		}
+		if len(request.ID) == 0 {
+			continue
+		}
+		var response string
+		switch request.Method {
+		case "connect":
+			response = `"result":{"ok":true,"protocolVersion":3,"version":"test"}`
+		case "status.get", "session.create", "models.list":
+			response = `"error":{"code":-32000,"message":"request rejected"`
+			if data != "" {
+				response += `,"data":` + data
+			}
+			response += `}`
+		case "ping":
+			response = `"result":{"message":"still connected","timestamp":"2026-01-01T00:00:00Z"}`
+		default:
+			return fmt.Errorf("unexpected method %q", request.Method)
+		}
+		frame := fmt.Sprintf(`{"jsonrpc":"2.0","id":%s,%s}`, request.ID, response)
+		if _, err := fmt.Fprintf(conn, "Content-Length: %d\r\n\r\n%s", len(frame), frame); err != nil {
+			return err
+		}
+	}
+}
+
+func readRPCErrorFrame(reader *bufio.Reader) ([]byte, error) {
+	length := 0
+	for {
+		line, err := reader.ReadString('\n')
+		if err != nil {
+			return nil, err
+		}
+		line = strings.TrimSpace(line)
+		if line == "" {
+			break
+		}
+		name, value, ok := strings.Cut(line, ":")
+		if ok && name == "Content-Length" {
+			length, err = strconv.Atoi(strings.TrimSpace(value))
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	if length <= 0 || length > 1024*1024 {
+		return nil, fmt.Errorf("invalid Content-Length %d", length)
+	}
+	body := make([]byte, length)
+	_, err := io.ReadFull(reader, body)
+	return body, err
+}
diff --git a/go/internal/e2e/permissions_e2e_test.go b/go/internal/e2e/permissions_e2e_test.go
index 1b3cf7aeb1..d46599fa86 100644
--- a/go/internal/e2e/permissions_e2e_test.go
+++ b/go/internal/e2e/permissions_e2e_test.go
@@ -240,6 +240,9 @@ func TestPermissionsE2E(t *testing.T) {
 		if _, err = session1.SendAndWait(t.Context(), copilot.MessageOptions{Prompt: "What is 1+1?"}); err != nil {
 			t.Fatalf("Failed to send message: %v", err)
 		}
+		if err := session1.Disconnect(); err != nil {
+			t.Fatalf("Failed to disconnect session: %v", err)
+		}
 
 		session2, err := client.ResumeSession(t.Context(), sessionID, &copilot.ResumeSessionConfig{
 			OnPermissionRequest: func(request copilot.PermissionRequest, invocation copilot.PermissionInvocation) (rpc.PermissionDecision, error) {
diff --git a/go/internal/e2e/session_e2e_test.go b/go/internal/e2e/session_e2e_test.go
index 941015ed37..43487f1e79 100644
--- a/go/internal/e2e/session_e2e_test.go
+++ b/go/internal/e2e/session_e2e_test.go
@@ -743,31 +743,73 @@ func TestSessionE2E(t *testing.T) {
 
 		var receivedEvents []copilot.SessionEvent
 		var receivedEventsMu sync.Mutex
-		idle := make(chan bool, 1)
+		idleEntered := make(chan struct{})
+		idleRelease := make(chan struct{})
+		idleCompleted := make(chan struct{})
+		releaseIdle := sync.OnceFunc(func() { close(idleRelease) })
+		defer releaseIdle()
 
-		session.On(func(event copilot.SessionEvent) {
+		unsubscribe := session.On(func(event copilot.SessionEvent) {
 			receivedEventsMu.Lock()
 			receivedEvents = append(receivedEvents, event)
 			receivedEventsMu.Unlock()
-			if event.Type() == "session.idle" {
-				select {
-				case idle <- true:
-				default:
+			if data, ok := event.Data.(*copilot.SessionIdleData); ok {
+				if (event.AgentID != nil && *event.AgentID != "") ||
+					(data.Mode != nil && *data.Mode == copilot.SessionModeAutopilot) {
+					return
 				}
+				close(idleEntered)
+				<-idleRelease
+				close(idleCompleted)
 			}
 		})
+		defer unsubscribe()
 
-		// Send a message to trigger events
-		_, err = session.Send(t.Context(), copilot.MessageOptions{Prompt: "What is 100+200?"})
-		if err != nil {
-			t.Fatalf("Failed to send message: %v", err)
+		type sendResult struct {
+			message *copilot.SessionEvent
+			err     error
+		}
+		result := make(chan sendResult, 1)
+		sendCtx, cancel := context.WithTimeout(t.Context(), 60*time.Second)
+		defer cancel()
+		go func() {
+			message, err := session.SendAndWait(sendCtx, copilot.MessageOptions{Prompt: "What is 100+200?"})
+			result <- sendResult{message, err}
+		}()
+
+		select {
+		case <-idleEntered:
+		case got := <-result:
+			t.Fatalf("SendAndWait returned before the root idle listener entered: %v", got.err)
+		case <-sendCtx.Done():
+			t.Fatal("Timed out waiting for the root idle listener")
 		}
 
-		// Wait for session to become idle
+		// Hold the earlier subscriber inside root-idle processing and give the
+		// waiter a bounded opportunity to return incorrectly on another goroutine.
+		select {
+		case got := <-result:
+			t.Fatalf("SendAndWait returned while the root idle listener was active: %v", got.err)
+		case <-time.After(100 * time.Millisecond):
+		}
+		releaseIdle()
+
+		select {
+		case got := <-result:
+			if got.err != nil {
+				t.Fatalf("SendAndWait failed: %v", got.err)
+			}
+			if got.message == nil || got.message.Type() != "assistant.message" {
+				t.Fatalf("Expected final assistant message, got %v", got.message)
+			}
+		case <-sendCtx.Done():
+			t.Fatal("Timed out waiting for SendAndWait")
+		}
+		// Do not wait for the subscriber after SendAndWait: it must be done already.
 		select {
-		case <-idle:
-		case <-time.After(60 * time.Second):
-			t.Fatal("Timed out waiting for session.idle")
+		case <-idleCompleted:
+		default:
+			t.Fatal("SendAndWait returned before the root idle listener completed")
 		}
 
 		// Should have received multiple events
diff --git a/go/internal/e2e/session_fs_sqlite_e2e_test.go b/go/internal/e2e/session_fs_sqlite_e2e_test.go
index 8042614496..fc8b05154d 100644
--- a/go/internal/e2e/session_fs_sqlite_e2e_test.go
+++ b/go/internal/e2e/session_fs_sqlite_e2e_test.go
@@ -31,15 +31,52 @@ type inMemorySqliteProvider struct {
 	files       map[string]string
 	dirs        map[string]bool
 	hadQuery    bool
-	sqliteCalls *[]sqliteCall
+	sqliteCalls []sqliteCall
 }
 
-func newInMemorySqliteProvider(sessionID string, calls *[]sqliteCall) *inMemorySqliteProvider {
+func newInMemorySqliteProvider(sessionID string) *inMemorySqliteProvider {
 	return &inMemorySqliteProvider{
-		sessionID:   sessionID,
-		files:       make(map[string]string),
-		dirs:        map[string]bool{"/": true},
-		sqliteCalls: calls,
+		sessionID: sessionID,
+		files:     make(map[string]string),
+		dirs:      map[string]bool{"/": true},
+	}
+}
+
+func (p *inMemorySqliteProvider) recordedCalls() []sqliteCall {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return append([]sqliteCall(nil), p.sqliteCalls...)
+}
+
+func TestInMemorySqliteProviderConcurrentCalls(t *testing.T) {
+	provider := newInMemorySqliteProvider("concurrent-sqlite")
+	start := make(chan struct{})
+	var workers sync.WaitGroup
+	workers.Add(2)
+	go func() {
+		defer workers.Done()
+		<-start
+		for range 100 {
+			if _, err := provider.SqliteQuery(rpc.SessionFSSqliteQueryTypeExec, "CREATE TABLE items (id TEXT)", nil); err != nil {
+				t.Errorf("SqliteQuery: %v", err)
+			}
+		}
+	}()
+	go func() {
+		defer workers.Done()
+		<-start
+		for range 100 {
+			for _, call := range provider.recordedCalls() {
+				if call.SessionID != "concurrent-sqlite" || call.QueryType != "exec" {
+					t.Errorf("Unexpected recorded call: %+v", call)
+				}
+			}
+		}
+	}()
+	close(start)
+	workers.Wait()
+	if got := len(provider.recordedCalls()); got != 100 {
+		t.Fatalf("Expected 100 recorded calls, got %d", got)
 	}
 }
 
@@ -220,7 +257,7 @@ func (p *inMemorySqliteProvider) SqliteTransaction(statements []rpc.SessionFSSql
 // Callers must hold p.mu.
 func (p *inMemorySqliteProvider) runQueryLocked(queryType rpc.SessionFSSqliteQueryType, query string) *copilot.SessionFSSqliteQueryResult {
 	p.hadQuery = true
-	*p.sqliteCalls = append(*p.sqliteCalls, sqliteCall{
+	p.sqliteCalls = append(p.sqliteCalls, sqliteCall{
 		SessionID: p.sessionID,
 		QueryType: string(queryType),
 		Query:     query,
@@ -283,14 +320,21 @@ func TestSessionFSSqliteE2E(t *testing.T) {
 		Capabilities:            &copilot.SessionFSCapabilities{Sqlite: true},
 	}
 
-	var sqliteCalls []sqliteCall
 	var providers sync.Map
 
 	createSessionFSHandler := func(session *copilot.Session) copilot.SessionFSProvider {
-		p := newInMemorySqliteProvider(session.SessionID, &sqliteCalls)
+		p := newInMemorySqliteProvider(session.SessionID)
 		providers.Store(session.SessionID, p)
 		return p
 	}
+	recordedProvider := func(t *testing.T, sessionID string) *inMemorySqliteProvider {
+		t.Helper()
+		value, ok := providers.Load(sessionID)
+		if !ok {
+			t.Fatal("Provider not found for session")
+		}
+		return value.(*inMemorySqliteProvider)
+	}
 
 	client := ctx.NewClient(func(opts *copilot.ClientOptions) {
 		opts.SessionFS = sessionFSConfig
@@ -299,7 +343,6 @@ func TestSessionFSSqliteE2E(t *testing.T) {
 
 	t.Run("should route sql queries through the sessionfs sqlite handler", func(t *testing.T) {
 		ctx.ConfigureForTest(t)
-		sqliteCalls = nil
 
 		session, err := client.CreateSession(t.Context(), &copilot.SessionConfig{
 			OnPermissionRequest:     copilot.PermissionHandler.ApproveAll,
@@ -319,7 +362,7 @@ func TestSessionFSSqliteE2E(t *testing.T) {
 		_ = msg
 
 		// Verify sqlite handler was called
-		sessionCalls := filterCalls(sqliteCalls, session.SessionID)
+		sessionCalls := recordedProvider(t, session.SessionID).recordedCalls()
 		if len(sessionCalls) == 0 {
 			t.Fatal("Expected sqlite handler to be called")
 		}
@@ -337,7 +380,6 @@ func TestSessionFSSqliteE2E(t *testing.T) {
 
 	t.Run("should allow subagents to use sql tool via inherited sessionfs", func(t *testing.T) {
 		ctx.ConfigureForTest(t)
-		sqliteCalls = nil
 
 		session, err := client.CreateSession(t.Context(), &copilot.SessionConfig{
 			OnPermissionRequest:     copilot.PermissionHandler.ApproveAll,
@@ -361,18 +403,14 @@ func TestSessionFSSqliteE2E(t *testing.T) {
 		}
 
 		// Verify INSERT calls were routed
-		sessionCalls := filterCalls(sqliteCalls, session.SessionID)
+		provider := recordedProvider(t, session.SessionID)
+		sessionCalls := provider.recordedCalls()
 		insertCalls := filterByQuery(sessionCalls, "INSERT")
 		if len(insertCalls) == 0 {
 			t.Fatal("Expected INSERT calls from subagent")
 		}
 
 		// Read events.jsonl from in-memory FS
-		val, ok := providers.Load(session.SessionID)
-		if !ok {
-			t.Fatal("Provider not found for session")
-		}
-		provider := val.(*inMemorySqliteProvider)
 		eventsPath := sessionStatePath + "/events.jsonl"
 		content, err := provider.ReadFile(eventsPath)
 		if err != nil {
@@ -407,16 +445,6 @@ func TestSessionFSSqliteE2E(t *testing.T) {
 	})
 }
 
-func filterCalls(calls []sqliteCall, sessionID string) []sqliteCall {
-	var result []sqliteCall
-	for _, c := range calls {
-		if c.SessionID == sessionID {
-			result = append(result, c)
-		}
-	}
-	return result
-}
-
 func filterByQuery(calls []sqliteCall, keyword string) []sqliteCall {
 	var result []sqliteCall
 	for _, c := range calls {
diff --git a/go/rpc/zrpc.go b/go/rpc/zrpc.go
index bb4f7b1e1e..42550be80e 100644
--- a/go/rpc/zrpc.go
+++ b/go/rpc/zrpc.go
@@ -3338,6 +3338,83 @@ type DebugCollectLogsSkippedEntry struct {
 	Reason string `json:"reason"`
 }
 
+// Experimental: DiagnosticEntry is part of an experimental API and may change or be removed.
+type DiagnosticEntry struct {
+	// Agent identifier for a subagent host. Omitted for the root agent.
+	AgentID *string `json:"agentId,omitempty"`
+	// Typed MCP diagnostic detail.
+	Details MCPDiagnosticDetails `json:"details"`
+	// Severity of this emitted diagnostic record.
+	Level DiagnosticSeverity `json:"level"`
+	// Human-readable diagnostic summary.
+	Message string `json:"message"`
+	// Original byte count when a known-size message or data value was truncated.
+	OriginalBytes *int64 `json:"originalBytes,omitempty"`
+	// Diagnostic source identifying the typed details payload.
+	Source DiagnosticEntrySource `json:"source"`
+	// UTC RFC 3339 timestamp captured at the diagnostic source.
+	Timestamp string `json:"timestamp"`
+	// Whether message or data was truncated to the record-size bound.
+	Truncated *bool `json:"truncated,omitempty"`
+}
+
+// Per-source session diagnostics configuration.
+// Experimental: DiagnosticsConfiguration is part of an experimental API and may change or
+// be removed.
+type DiagnosticsConfiguration struct {
+	// Diagnostic thresholds keyed by supported source.
+	Sources DiagnosticSourcesConfiguration `json:"sources"`
+}
+
+// Patch session diagnostic thresholds for explicitly supplied sources.
+// Experimental: DiagnosticsConfigureRequest is part of an experimental API and may change
+// or be removed.
+type DiagnosticsConfigureRequest struct {
+	// Sources to configure. At least one supported source must be supplied.
+	Sources DiagnosticSourcesConfiguration `json:"sources"`
+}
+
+// Typed diagnostic source configuration. At least one source is required by diagnostics
+// configuration methods.
+// Experimental: DiagnosticSourcesConfiguration is part of an experimental API and may
+// change or be removed.
+type DiagnosticSourcesConfiguration struct {
+	// MCP diagnostic capture threshold. Omit to leave the current threshold unchanged.
+	MCP *MCPDiagnosticSourceConfiguration `json:"mcp,omitempty"`
+}
+
+// Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the
+// default waitMs is zero (maximum 30000).
+// Experimental: DiagnosticsReadRequest is part of an experimental API and may change or be
+// removed.
+type DiagnosticsReadRequest struct {
+	// Opaque cursor returned by an earlier read. Omit to start at the oldest retained record.
+	Cursor *string `json:"cursor,omitempty"`
+	// Maximum number of records to return, from 1 through 500. Omit for 100.
+	Max *int64 `json:"max,omitempty"`
+	// Nonempty selection of sources to read. Each source may be listed once.
+	Sources []DiagnosticSource `json:"sources"`
+	// Maximum time in milliseconds to wait for a new record, from 0 through 30000.
+	WaitMs *int32 `json:"waitMs,omitempty"`
+}
+
+// One cursor-addressed page of retained session diagnostics.
+// Experimental: DiagnosticsReadResult is part of an experimental API and may change or be
+// removed.
+type DiagnosticsReadResult struct {
+	// Opaque cursor for the next independent read.
+	Cursor string `json:"cursor"`
+	// Whether the requested cursor remained within the retained buffer window.
+	CursorStatus DiagnosticCursorStatus `json:"cursorStatus"`
+	// Number of records lost before this page when known. Omitted when a buffer generation
+	// change makes the count unknowable.
+	DroppedCount *int64 `json:"droppedCount,omitempty"`
+	// Retained records beginning at the requested cursor.
+	Entries []DiagnosticEntry `json:"entries"`
+	// Whether additional retained records follow this page.
+	HasMore bool `json:"hasMore"`
+}
+
 // Canvas available in the current session.
 // Experimental: DiscoveredCanvas is part of an experimental API and may change or be
 // removed.
@@ -6214,6 +6291,30 @@ type MCPConfigureGitHubResult struct {
 	Changed bool `json:"changed"`
 }
 
+// MCP-specific detail for a source-discriminated diagnostic entry.
+// Experimental: MCPDiagnosticDetails is part of an experimental API and may change or be
+// removed.
+type MCPDiagnosticDetails struct {
+	// Fresh identifier for the MCP connection attempt, including failed starts.
+	ConnectionID string `json:"connectionId"`
+	// Serialized diagnostic detail. Protocol and HTTP records use JSON when detail is present.
+	Data *string `json:"data,omitempty"`
+	// Protocol-frame direction when kind is protocol.
+	Direction *MCPDiagnosticDirection `json:"direction,omitempty"`
+	// Diagnostic record category.
+	Kind MCPDiagnosticKind `json:"kind"`
+	// Configured MCP server name.
+	ServerName string `json:"serverName"`
+}
+
+// MCP diagnostic source configuration.
+// Experimental: MCPDiagnosticSourceConfiguration is part of an experimental API and may
+// change or be removed.
+type MCPDiagnosticSourceConfiguration struct {
+	// Threshold to apply to MCP diagnostic producers in this session.
+	Level DiagnosticLogLevel `json:"level"`
+}
+
 // Name of the MCP server to disable for the session.
 // Experimental: MCPDisableRequest is part of an experimental API and may change or be
 // removed.
@@ -7448,6 +7549,11 @@ type MCPServerConfigHTTP struct {
 	OauthGrantType *MCPServerConfigHTTPOauthGrantType `json:"oauthGrantType,omitempty"`
 	// Whether the configured OAuth client is public and does not require a client secret.
 	OauthPublicClient *bool `json:"oauthPublicClient,omitempty"`
+	// Non-empty array of valid RFC 6749 scope-token strings to request for the statically
+	// configured OAuth client when the server challenge omits scope or provides an empty scope.
+	// Requires a non-empty oauthClientId. These scopes take precedence over protected-resource
+	// metadata.
+	OauthScopes []string `json:"oauthScopes,omitzero"`
 	// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
 	Oidc MCPServerAuthConfig `json:"oidc,omitempty"`
 	// Telemetry-obfuscation policy for this server's tools.
@@ -11373,6 +11479,12 @@ type QueuePendingItems struct {
 	// Stable identity of the queued user message. Present for message rows and absent for slash
 	// commands and model changes.
 	MessageID *string `json:"messageId,omitempty"`
+	// Optional source tag associated with this pending queue entry. This is an open string, not
+	// authenticated authorship. In particular, `user` does not prove that a person typed the
+	// message. If the source is absent or unrecognized, consumers must not infer human or agent
+	// authorship and should handle the entry neutrally. Consumers should tolerate future source
+	// values.
+	Source *string `json:"source,omitempty"`
 }
 
 // Snapshot of the session's pending queued items and immediate-steering messages.
@@ -11389,6 +11501,12 @@ type QueuePendingItemsResult struct {
 	// Display text for messages currently in the immediate steering queue (interjections sent
 	// during a running turn).
 	SteeringMessages []string `json:"steeringMessages"`
+	// ID of the running turn's user message while the model has not answered it, so
+	// `withdrawMessage` can still take it back once nothing sent after it is pending. A message
+	// leaves `items` when its turn starts, before its `user.message` is recorded; this tells
+	// that message apart from one that was removed. Absent when no turn prompt can be taken
+	// back.
+	WithdrawableTurnMessageID *string `json:"withdrawableTurnMessageId,omitempty"`
 }
 
 // Parameters for removing a queued item by stable id.
@@ -11481,8 +11599,8 @@ type QueueUpdateTextResult struct {
 	Updated bool `json:"updated"`
 }
 
-// Conditional withdrawal of a single user message, before the runtime claims it for
-// delivery.
+// Conditional withdrawal of a single user message, from its queue or from the running turn
+// it started.
 // Experimental: QueueWithdrawMessageRequest is part of an experimental API and may change
 // or be removed.
 type QueueWithdrawMessageRequest struct {
@@ -11493,6 +11611,18 @@ type QueueWithdrawMessageRequest struct {
 	MessageID string `json:"messageId"`
 }
 
+// Result of withdrawing a user message.
+// Experimental: QueueWithdrawMessageResult is part of an experimental API and may change or
+// be removed.
+type QueueWithdrawMessageResult struct {
+	// True when the running turn was interrupted to withdraw the message. With removed false,
+	// the turn was interrupted but its events could not be removed, for example because the
+	// model answered first, so the message stays in the interrupted turn.
+	Interrupted bool `json:"interrupted"`
+	// True when the message left the queue or, for a running turn, history.
+	Removed bool `json:"removed"`
+}
+
 // Event type to register consumer interest for, used by runtime gating logic.
 // Experimental: RegisterEventInterestParams is part of an experimental API and may change
 // or be removed.
@@ -11987,6 +12117,64 @@ type SandboxEnforcementStatus struct {
 	Required bool `json:"required"`
 }
 
+// Whether this host can run one sandbox policy feature. A session whose effective policy
+// uses an unsupported feature fails each sandboxed command with `reason`.
+// Experimental: SandboxHostCapability is part of an experimental API and may change or be
+// removed.
+type SandboxHostCapability struct {
+	// The policy feature, as an extensible string: ignore names you do not recognize. Known
+	// values: `network` (sandboxed commands can reach the network; on Linux this needs the
+	// tooling for Bubblewrap's private network namespace, such as slirp4netns),
+	// `network_filtering` (host rules and the sandbox proxy; on Linux this needs the same
+	// tooling as `network`; on Windows it needs Process Security Environment 1.1 host-loopback
+	// support, and a policy that uses it must also set `network.allowLocalNetwork`),
+	// `denied_paths` (native enforcement of `filesystem.deniedPaths`), and `shell` (shell
+	// commands inside the sandbox; on Windows this needs Process Security Environment 1.1
+	// filesystem enumeration support).
+	Name string `json:"name"`
+	// Human-readable reason and remedy when the feature is unsupported, such as a package to
+	// install or an OS update. Present only when `supported` is false.
+	Reason *string `json:"reason,omitempty"`
+	// Whether this host can run the feature.
+	Supported bool `json:"supported"`
+}
+
+// Extensible identifier of a sandbox policy feature whose availability varies between
+// hosts. A plain string, so an older client decodes a name added by a newer runtime; ignore
+// names you do not recognize. Known values: `network` — sandboxed commands can reach the
+// network (`network.allowOutbound`, on by default); on Linux this needs the tooling for
+// Bubblewrap's private network namespace, such as slirp4netns. `network_filtering` — host
+// rules and the sandbox proxy (`network.allowedHosts`, `network.blockedHosts`,
+// `network.proxy`); on Linux this needs the same tooling as `network`; on Windows it needs
+// a version with Process Security Environment 1.1 host-loopback support, and a policy that
+// uses it must also set `network.allowLocalNetwork`, because Windows reaches the local
+// proxy only together with private-network access. `denied_paths` — native enforcement of
+// `filesystem.deniedPaths`; on Windows this needs a version whose sandbox contract reports
+// denied-path support. `shell` — shell commands inside the sandbox: bash on macOS and
+// Linux, PowerShell on Windows; on Windows this needs a version with Process Security
+// Environment 1.1 filesystem enumeration support.
+// Experimental: SandboxHostCapabilityName is part of an experimental API and may change or
+// be removed.
+type SandboxHostCapabilityName string
+
+// Whether the host running this runtime can run the command sandbox. The runtime checks
+// `supported` once per process. A capability answer can change while the process runs, for
+// example after the user installs a missing package.
+// Experimental: SandboxHostSupport is part of an experimental API and may change or be
+// removed.
+type SandboxHostSupport struct {
+	// Sandbox policy features whose availability varies between hosts that can run the backend.
+	// Empty when `supported` is false, because no feature can run without a backend. Later
+	// runtimes can add entries; ignore an entry whose `name` you do not recognize.
+	Capabilities []SandboxHostCapability `json:"capabilities"`
+	// Human-readable reason the sandbox cannot run on this host. Present only when `supported`
+	// is false.
+	Reason *string `json:"reason,omitempty"`
+	// Whether a process-containment backend is usable on this host: Seatbelt on macOS,
+	// Bubblewrap on Linux, or ProcessContainer on Windows.
+	Supported bool `json:"supported"`
+}
+
 // Register an absolute-time scheduled prompt.
 // Experimental: ScheduleAddAtRequest is part of an experimental API and may change or be
 // removed.
@@ -13152,6 +13340,11 @@ type SessionInstalledPluginSourceURL struct {
 	URL string `json:"url"`
 }
 
+// Experimental: SessionInstructionsReloadResult is part of an experimental API and may
+// change or be removed.
+type SessionInstructionsReloadResult struct {
+}
+
 // Baseline data provenance for a prediction.
 // Experimental: SessionLimitPredictionBaselineData is part of an experimental API and may
 // change or be removed.
@@ -19751,6 +19944,74 @@ const (
 	DebugCollectLogsSourceShellLog DebugCollectLogsSource = "shell-log"
 )
 
+// Whether the supplied diagnostic cursor remained within the retained buffer window.
+// Experimental: DiagnosticCursorStatus is part of an experimental API and may change or be
+// removed.
+type DiagnosticCursorStatus string
+
+const (
+	// The cursor no longer addresses retained records; reading resumes at the oldest retained
+	// record.
+	DiagnosticCursorStatusExpired DiagnosticCursorStatus = "expired"
+	// The cursor is valid for the current retained window.
+	DiagnosticCursorStatusOk DiagnosticCursorStatus = "ok"
+)
+
+// Diagnostic source identifying the typed details payload.
+type DiagnosticEntrySource string
+
+const (
+	DiagnosticEntrySourceMCP DiagnosticEntrySource = "mcp"
+)
+
+// Session-scoped diagnostic threshold. Capture is disabled by default and is never
+// persisted with the session.
+// Experimental: DiagnosticLogLevel is part of an experimental API and may change or be
+// removed.
+type DiagnosticLogLevel string
+
+const (
+	// Capture protocol frames and launch diagnostics.
+	DiagnosticLogLevelDebug DiagnosticLogLevel = "debug"
+	// Capture failures only.
+	DiagnosticLogLevelError DiagnosticLogLevel = "error"
+	// Capture lifecycle diagnostics.
+	DiagnosticLogLevelInfo DiagnosticLogLevel = "info"
+	// Disable capture and clear retained diagnostics.
+	DiagnosticLogLevelOff DiagnosticLogLevel = "off"
+	// Capture HTTP metadata in addition to debug diagnostics.
+	DiagnosticLogLevelTrace DiagnosticLogLevel = "trace"
+	// Capture failures, warnings, and stderr.
+	DiagnosticLogLevelWarning DiagnosticLogLevel = "warning"
+)
+
+// Severity of an emitted diagnostic record.
+// Experimental: DiagnosticSeverity is part of an experimental API and may change or be
+// removed.
+type DiagnosticSeverity string
+
+const (
+	// Protocol-frame or launch diagnostic.
+	DiagnosticSeverityDebug DiagnosticSeverity = "debug"
+	// Failure that prevented or interrupted communication.
+	DiagnosticSeverityError DiagnosticSeverity = "error"
+	// Lifecycle transition.
+	DiagnosticSeverityInfo DiagnosticSeverity = "info"
+	// HTTP metadata diagnostic.
+	DiagnosticSeverityTrace DiagnosticSeverity = "trace"
+	// A recoverable warning or server standard-error output.
+	DiagnosticSeverityWarning DiagnosticSeverity = "warning"
+)
+
+// A supported diagnostic source.
+// Experimental: DiagnosticSource is part of an experimental API and may change or be
+// removed.
+type DiagnosticSource string
+
+const (
+	DiagnosticSourceMCP DiagnosticSource = "mcp"
+)
+
 // Effective extension loading and agent-management mode
 // Experimental: DiscoveredExtensionMode is part of an experimental API and may change or be
 // removed.
@@ -20489,6 +20750,34 @@ const (
 	MCPAppsSetHostContextDetailsThemeLight MCPAppsSetHostContextDetailsTheme = "light"
 )
 
+// Direction of an observed MCP protocol frame.
+// Experimental: MCPDiagnosticDirection is part of an experimental API and may change or be
+// removed.
+type MCPDiagnosticDirection string
+
+const (
+	// Frame emitted by the Copilot MCP client.
+	MCPDiagnosticDirectionClientToServer MCPDiagnosticDirection = "client-to-server"
+	// Frame received from the MCP server.
+	MCPDiagnosticDirectionServerToClient MCPDiagnosticDirection = "server-to-client"
+)
+
+// Category for an MCP diagnostic record.
+// Experimental: MCPDiagnosticKind is part of an experimental API and may change or be
+// removed.
+type MCPDiagnosticKind string
+
+const (
+	// HTTP request or response metadata.
+	MCPDiagnosticKindHTTP MCPDiagnosticKind = "http"
+	// Connection lifecycle transition or failure.
+	MCPDiagnosticKindLifecycle MCPDiagnosticKind = "lifecycle"
+	// JSON-RPC protocol frame.
+	MCPDiagnosticKindProtocol MCPDiagnosticKind = "protocol"
+	// Local MCP server standard-error output.
+	MCPDiagnosticKindStderr MCPDiagnosticKind = "stderr"
+)
+
 // Structured MCP elicitation mode.
 // Experimental: MCPElicitationFormMode is part of an experimental API and may change or be
 // removed.
@@ -24001,6 +24290,29 @@ func (a *ServerRuntimeAPI) Shutdown(ctx context.Context) (*RuntimeShutdownResult
 	return &result, nil
 }
 
+// Experimental: ServerSandboxAPI contains experimental APIs that may change or be removed.
+type ServerSandboxAPI serverAPI
+
+// GetHostSupport reports whether the host running this runtime can run the command sandbox,
+// without starting a session or spawning a sandboxed command.
+//
+// RPC method: sandbox.getHostSupport.
+//
+// Returns: Whether the host running this runtime can run the command sandbox. The runtime
+// checks `supported` once per process. A capability answer can change while the process
+// runs, for example after the user installs a missing package.
+func (a *ServerSandboxAPI) GetHostSupport(ctx context.Context) (*SandboxHostSupport, error) {
+	raw, err := a.client.Request(ctx, "sandbox.getHostSupport", nil)
+	if err != nil {
+		return nil, err
+	}
+	var result SandboxHostSupport
+	if err := json.Unmarshal(raw, &result); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
 // Experimental: ServerSecretsAPI contains experimental APIs that may change or be removed.
 type ServerSecretsAPI serverAPI
 
@@ -24805,6 +25117,7 @@ type ServerRPC struct {
 	Models          *ServerModelsAPI
 	Plugins         *ServerPluginsAPI
 	Runtime         *ServerRuntimeAPI
+	Sandbox         *ServerSandboxAPI
 	Secrets         *ServerSecretsAPI
 	SessionFS       *ServerSessionFSAPI
 	Sessions        *ServerSessionsAPI
@@ -24870,6 +25183,7 @@ func NewServerRPC(client *jsonrpc2.Client) *ServerRPC {
 	r.Models = (*ServerModelsAPI)(&r.common)
 	r.Plugins = (*ServerPluginsAPI)(&r.common)
 	r.Runtime = (*ServerRuntimeAPI)(&r.common)
+	r.Sandbox = (*ServerSandboxAPI)(&r.common)
 	r.Secrets = (*ServerSecretsAPI)(&r.common)
 	r.SessionFS = (*ServerSessionFSAPI)(&r.common)
 	r.Sessions = (*ServerSessionsAPI)(&r.common)
@@ -25865,6 +26179,30 @@ func (a *ContentExclusionAPI) CheckPaths(ctx context.Context, params *ContentExc
 	return &result, nil
 }
 
+// Experimental: CustomizationsAPI contains experimental APIs that may change or be removed.
+type CustomizationsAPI sessionAPI
+
+// Reloads all repository and user customizations for the active session: instructions,
+// plugins and their MCP servers and hooks, custom agents, extensions, and skills. Returns
+// diagnostics from the final skill reload.
+//
+// RPC method: session.customizations.reload.
+//
+// Returns: Diagnostics from reloading skill definitions, with warnings and errors as
+// separate lists.
+func (a *CustomizationsAPI) Reload(ctx context.Context) (*SkillsLoadDiagnostics, error) {
+	req := map[string]any{"sessionId": a.sessionID}
+	raw, err := a.client.Request(ctx, "session.customizations.reload", req)
+	if err != nil {
+		return nil, err
+	}
+	var result SkillsLoadDiagnostics
+	if err := json.Unmarshal(raw, &result); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
 // Experimental: DebugAPI contains experimental APIs that may change or be removed.
 type DebugAPI sessionAPI
 
@@ -25901,6 +26239,68 @@ func (a *DebugAPI) CollectLogs(ctx context.Context, params *DebugCollectLogsRequ
 	return &result, nil
 }
 
+// Experimental: DiagnosticsAPI contains experimental APIs that may change or be removed.
+type DiagnosticsAPI sessionAPI
+
+// Configure patches configured session diagnostic sources without restarting their
+// producers. Setting a source level to off clears its retained diagnostics and invalidates
+// cursors selecting that source.
+//
+// RPC method: session.diagnostics.configure.
+//
+// Parameters: Patch session diagnostic thresholds for explicitly supplied sources.
+//
+// Returns: Per-source session diagnostics configuration.
+func (a *DiagnosticsAPI) Configure(ctx context.Context, params *DiagnosticsConfigureRequest) (*DiagnosticsConfiguration, error) {
+	req := map[string]any{"sessionId": a.sessionID}
+	if params != nil {
+		req["sources"] = params.Sources
+	}
+	raw, err := a.client.Request(ctx, "session.diagnostics.configure", req)
+	if err != nil {
+		return nil, err
+	}
+	var result DiagnosticsConfiguration
+	if err := json.Unmarshal(raw, &result); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+// Reads a bounded batch of retained session diagnostics for the selected sources. Records
+// are never consumed and each reader advances independently through its opaque cursor.
+//
+// RPC method: session.diagnostics.read.
+//
+// Parameters: Cursor-based request for session diagnostics. The default limit is 100
+// (maximum 500); the default waitMs is zero (maximum 30000).
+//
+// Returns: One cursor-addressed page of retained session diagnostics.
+func (a *DiagnosticsAPI) Read(ctx context.Context, params *DiagnosticsReadRequest) (*DiagnosticsReadResult, error) {
+	req := map[string]any{"sessionId": a.sessionID}
+	if params != nil {
+		if params.Cursor != nil {
+			req["cursor"] = *params.Cursor
+		}
+		if params.Max != nil {
+			req["max"] = *params.Max
+		}
+		req["sources"] = params.Sources
+		if params.WaitMs != nil {
+			req["waitMs"] = *params.WaitMs
+		}
+	}
+	raw, err := a.client.Request(ctx, "session.diagnostics.read", req)
+	if err != nil {
+		return nil, err
+	}
+	var result DiagnosticsReadResult
+	if err := json.Unmarshal(raw, &result); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
 // Experimental: EventLogAPI contains experimental APIs that may change or be removed.
 type EventLogAPI sessionAPI
 
@@ -26787,6 +27187,23 @@ func (a *InstructionsAPI) GetSources(ctx context.Context) (*InstructionsGetSourc
 	return &result, nil
 }
 
+// Reload invalidates cached custom-instruction discovery so subsequent turns and source
+// reads observe instruction files currently on disk.
+//
+// RPC method: session.instructions.reload.
+func (a *InstructionsAPI) Reload(ctx context.Context) (*SessionInstructionsReloadResult, error) {
+	req := map[string]any{"sessionId": a.sessionID}
+	raw, err := a.client.Request(ctx, "session.instructions.reload", req)
+	if err != nil {
+		return nil, err
+	}
+	var result SessionInstructionsReloadResult
+	if err := json.Unmarshal(raw, &result); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
 // Experimental: LimitPredictionAPI contains experimental APIs that may change or be removed.
 type LimitPredictionAPI sessionAPI
 
@@ -29870,17 +30287,19 @@ func (a *QueueAPI) UpdateText(ctx context.Context, params *QueueUpdateTextReques
 	return &result, nil
 }
 
-// WithdrawMessage atomically withdraws an unchanged, unconsumed user message from the local
-// queued or steering lane. A client retaining the original draft may restore it only when
-// removed is true. Does not interrupt the running turn.
+// WithdrawMessage atomically withdraws an unchanged user message of a local session: from
+// the queued or steering lane while unconsumed, or from the running turn it started while
+// the model has not answered it and nothing the user sent after it is pending. Withdrawing
+// from the running turn interrupts that turn and removes its events from history. A client
+// retaining the original draft may restore it only when removed is true.
 //
 // RPC method: session.queue.withdrawMessage.
 //
-// Parameters: Conditional withdrawal of a single user message, before the runtime claims it
-// for delivery.
+// Parameters: Conditional withdrawal of a single user message, from its queue or from the
+// running turn it started.
 //
-// Returns: Result of removing a queued item.
-func (a *QueueAPI) WithdrawMessage(ctx context.Context, params *QueueWithdrawMessageRequest) (*QueueRemoveAtResult, error) {
+// Returns: Result of withdrawing a user message.
+func (a *QueueAPI) WithdrawMessage(ctx context.Context, params *QueueWithdrawMessageRequest) (*QueueWithdrawMessageResult, error) {
 	req := map[string]any{"sessionId": a.sessionID}
 	if params != nil {
 		req["expectedPrompt"] = params.ExpectedPrompt
@@ -29890,7 +30309,7 @@ func (a *QueueAPI) WithdrawMessage(ctx context.Context, params *QueueWithdrawMes
 	if err != nil {
 		return nil, err
 	}
-	var result QueueRemoveAtResult
+	var result QueueWithdrawMessageResult
 	if err := json.Unmarshal(raw, &result); err != nil {
 		return nil, err
 	}
@@ -32038,7 +32457,9 @@ type SessionRPC struct {
 	Completions        *CompletionsAPI
 	Connectors         *ConnectorsAPI
 	ContentExclusion   *ContentExclusionAPI
+	Customizations     *CustomizationsAPI
 	Debug              *DebugAPI
+	Diagnostics        *DiagnosticsAPI
 	EventLog           *EventLogAPI
 	Extensions         *ExtensionsAPI
 	Factory            *FactoryAPI
@@ -32373,7 +32794,9 @@ func NewSessionRPC(client *jsonrpc2.Client, sessionID string) *SessionRPC {
 	r.Completions = (*CompletionsAPI)(&r.common)
 	r.Connectors = (*ConnectorsAPI)(&r.common)
 	r.ContentExclusion = (*ContentExclusionAPI)(&r.common)
+	r.Customizations = (*CustomizationsAPI)(&r.common)
 	r.Debug = (*DebugAPI)(&r.common)
+	r.Diagnostics = (*DiagnosticsAPI)(&r.common)
 	r.EventLog = (*EventLogAPI)(&r.common)
 	r.Extensions = (*ExtensionsAPI)(&r.common)
 	r.Factory = (*FactoryAPI)(&r.common)
diff --git a/go/rpc/zrpc_encoding.go b/go/rpc/zrpc_encoding.go
index 28d192afb2..97d51702da 100644
--- a/go/rpc/zrpc_encoding.go
+++ b/go/rpc/zrpc_encoding.go
@@ -2854,6 +2854,7 @@ func (r *MCPServerConfigHTTP) UnmarshalJSON(data []byte) error {
 		OauthClientID             *string                            `json:"oauthClientId,omitempty"`
 		OauthGrantType            *MCPServerConfigHTTPOauthGrantType `json:"oauthGrantType,omitempty"`
 		OauthPublicClient         *bool                              `json:"oauthPublicClient,omitempty"`
+		OauthScopes               []string                           `json:"oauthScopes,omitzero"`
 		Oidc                      json.RawMessage                    `json:"oidc,omitempty"`
 		SafeForTelemetry          json.RawMessage                    `json:"safeForTelemetry,omitempty"`
 		SlowConnectionThresholdMs *int64                             `json:"slowConnectionThresholdMs,omitempty"`
@@ -2899,6 +2900,7 @@ func (r *MCPServerConfigHTTP) UnmarshalJSON(data []byte) error {
 	r.OauthClientID = raw.OauthClientID
 	r.OauthGrantType = raw.OauthGrantType
 	r.OauthPublicClient = raw.OauthPublicClient
+	r.OauthScopes = raw.OauthScopes
 	if raw.Oidc != nil {
 		value, err := unmarshalMCPServerAuthConfig(raw.Oidc)
 		if err != nil {
diff --git a/go/rpc/zsession_events.go b/go/rpc/zsession_events.go
index 0364530a17..3d341cb51e 100644
--- a/go/rpc/zsession_events.go
+++ b/go/rpc/zsession_events.go
@@ -2148,7 +2148,7 @@ type UserMessageData struct {
 	NativeDocumentPathFallbackPaths []string `json:"nativeDocumentPathFallbackPaths,omitzero"`
 	// Parent agent task ID for background telemetry correlated to this user turn
 	ParentAgentTaskID *string `json:"parentAgentTaskId,omitempty"`
-	// Responses reasoning settings anchored before this model-facing message, for cache-stable history replay
+	// Provider reasoning settings anchored before this model-facing message for cache-stable replay; the historical responsesReasoning name is retained for compatibility
 	ResponsesReasoning *ResponsesReasoning `json:"responsesReasoning,omitempty"`
 	// Origin of this message, used for timeline filtering and attribution (e.g., `skill-pdf` for hidden skill injection or `agent-<agent-id>` for an inter-agent prompt)
 	Source *string `json:"source,omitempty"`
@@ -2668,9 +2668,11 @@ func (*SessionResumeData) Type() SessionEventType { return SessionEventTypeSessi
 
 // Session rewind details including target event and count of removed events
 type SessionSnapshotRewindData struct {
+	// The removed events, starting with `upToEventId`. Later events not listed were kept, such as a background agent's events that interleaved with a withdrawn turn
+	EventIDs []string `json:"eventIds,omitzero"`
 	// Number of events that were removed by the rewind
 	EventsRemoved int64 `json:"eventsRemoved"`
-	// Event ID that was rewound to; this event and all after it were removed
+	// First removed event. Without `eventIds`, it and every event after it were removed
 	UpToEventID string `json:"upToEventId"`
 }
 
@@ -2961,7 +2963,7 @@ type SystemNotificationData struct {
 	Content string `json:"content"`
 	// Structured metadata identifying what triggered this notification
 	Kind SystemNotification `json:"kind"`
-	// Responses reasoning settings anchored before this model-facing message, for cache-stable history replay
+	// Provider reasoning settings anchored before this model-facing message for cache-stable replay; the historical responsesReasoning name is retained for compatibility
 	ResponsesReasoning *ResponsesReasoning `json:"responsesReasoning,omitempty"`
 }
 
@@ -3693,6 +3695,8 @@ type FusionAttribution struct {
 	ConversationScope *string `json:"conversationScope,omitempty"`
 	// Stable identifier for the HydraFusion turn that produced the event.
 	FusionID string `json:"fusionId"`
+	// Whether this model request consumed a user steering message rather than only internal Fusion work.
+	HasUserSteering *bool `json:"hasUserSteering,omitempty"`
 	// HydraFusion orchestration pattern selected for the turn.
 	Pattern string `json:"pattern"`
 	// Identifier of the concrete phase that produced the event.
@@ -3854,6 +3858,8 @@ type MCPOauthRequiredStaticClientConfig struct {
 	GrantType *MCPOauthRequiredStaticClientConfigGrantType `json:"grantType,omitempty"`
 	// Whether this is a public OAuth client
 	PublicClient *bool `json:"publicClient,omitempty"`
+	// Configured OAuth scope string used when the server challenge omits scope or provides an empty scope
+	Scope *string `json:"scope,omitempty"`
 }
 
 // OAuth WWW-Authenticate parameters parsed from an MCP auth challenge
@@ -4826,7 +4832,7 @@ func (r PersistedBinaryImage) Type() PersistedBinaryResultType {
 	return PersistedBinaryResultType(r.Discriminator)
 }
 
-// Original request-level and effective conversation reasoning effort for a Responses history boundary
+// Original request-level and effective conversation reasoning effort for a provider history boundary; the historical type name is retained for compatibility
 type ResponsesReasoning struct {
 	// Effective effort selected before this message, independent of the response-level reasoning field
 	Effort string `json:"effort"`
diff --git a/go/session.go b/go/session.go
index 4b279f3f98..f4e7696518 100644
--- a/go/session.go
+++ b/go/session.go
@@ -478,6 +478,10 @@ func (s *Session) SendPrompt(ctx context.Context, prompt string) (string, error)
 // has finished processing the message.
 //
 // Events are still delivered to handlers registered via [Session.On] while waiting.
+// Synchronous handlers registered before this call finish processing the completing
+// root session.idle event before it returns successfully.
+// This does not wait for asynchronous work started by a handler.
+// Sub-agent events with a non-empty AgentID do not complete the wait or supply its reply.
 //
 // Parameters:
 //   - options: The message options including the prompt and optional attachments.
@@ -516,6 +520,9 @@ func (s *Session) SendAndWait(ctx context.Context, options MessageOptions) (*Ses
 	var mu sync.Mutex
 
 	unsubscribe := s.On(func(event SessionEvent) {
+		if event.AgentID != nil && *event.AgentID != "" {
+			return
+		}
 		switch d := event.Data.(type) {
 		case *AssistantMessageData:
 			mu.Lock()
@@ -1518,6 +1525,7 @@ func (s *Session) handleBroadcastEvent(event SessionEvent) {
 				ClientSecret: d.StaticClientConfig.ClientSecret,
 				GrantType:    grantType,
 				PublicClient: d.StaticClientConfig.PublicClient,
+				Scope:        d.StaticClientConfig.Scope,
 			}
 		}
 		request := MCPAuthRequest{
diff --git a/go/session_test.go b/go/session_test.go
index c3ab144afe..60e51308e6 100644
--- a/go/session_test.go
+++ b/go/session_test.go
@@ -262,6 +262,7 @@ func TestSession_MCPAuthRequestSendsHostToken(t *testing.T) {
 	clientSecret := "static-secret"
 	grantType := rpc.MCPOauthRequiredStaticClientConfigGrantTypeClientCredentials
 	publicClient := false
+	scope := "configured.read"
 	session.handleBroadcastEvent(SessionEvent{
 		Data: &MCPOauthRequiredData{
 			RequestID:        "oauth-request",
@@ -274,6 +275,7 @@ func TestSession_MCPAuthRequestSendsHostToken(t *testing.T) {
 				ClientSecret: &clientSecret,
 				GrantType:    &grantType,
 				PublicClient: &publicClient,
+				Scope:        &scope,
 			},
 			WwwAuthenticateParams: &MCPOauthWwwAuthenticateParams{
 				ResourceMetadataURL: &resourceMetadataURL,
@@ -298,6 +300,9 @@ func TestSession_MCPAuthRequestSendsHostToken(t *testing.T) {
 	if observedRequest.StaticClientConfig.GrantType == nil || *observedRequest.StaticClientConfig.GrantType != "client_credentials" {
 		t.Fatalf("expected static client grant type to be propagated, got %#v", observedRequest.StaticClientConfig.GrantType)
 	}
+	if observedRequest.StaticClientConfig.Scope == nil || *observedRequest.StaticClientConfig.Scope != "configured.read" {
+		t.Fatalf("expected static client scope to be propagated, got %#v", observedRequest.StaticClientConfig.Scope)
+	}
 
 	select {
 	case params := <-paramsCh:
@@ -351,7 +356,8 @@ func TestMCPOauthRequiredDataAllowsOptionalMetadata(t *testing.T) {
 		"staticClientConfig": {
 		    "clientId": "static-client",
 		    "clientSecret": "static-secret",
-		    "publicClient": false
+		    "publicClient": false,
+		    "scope": "configured.read"
 		}
 	}`), &withMetadata); err != nil {
 		t.Fatal(err)
@@ -365,6 +371,9 @@ func TestMCPOauthRequiredDataAllowsOptionalMetadata(t *testing.T) {
 	if withMetadata.StaticClientConfig == nil || withMetadata.StaticClientConfig.ClientSecret == nil || *withMetadata.StaticClientConfig.ClientSecret != "static-secret" {
 		t.Fatalf("expected static client secret, got %#v", withMetadata.StaticClientConfig)
 	}
+	if withMetadata.StaticClientConfig.Scope == nil || *withMetadata.StaticClientConfig.Scope != "configured.read" {
+		t.Fatalf("expected static client scope, got %#v", withMetadata.StaticClientConfig)
+	}
 
 	var withoutMetadata rpc.MCPOauthRequiredData
 	if err := json.Unmarshal([]byte(`{
@@ -512,7 +521,16 @@ func readTestJSONRPCFrame(r io.Reader) ([]byte, error) {
 	return data, err
 }
 
-func TestSession_SendAndWaitSkipsAutopilotContinuationIdle(t *testing.T) {
+func TestSession_SendAndWaitSkipsSubagentAndAutopilotContinuationIdle(t *testing.T) {
+	t.Run("with root reply", func(t *testing.T) {
+		checkSendAndWaitSkipsSubagentAndAutopilotContinuationIdle(t, true)
+	})
+	t.Run("without root reply", func(t *testing.T) {
+		checkSendAndWaitSkipsSubagentAndAutopilotContinuationIdle(t, false)
+	})
+}
+
+func checkSendAndWaitSkipsSubagentAndAutopilotContinuationIdle(t *testing.T, rootReplies bool) {
 	stdinR, stdinW := io.Pipe()
 	stdoutR, stdoutW := io.Pipe()
 	defer stdinR.Close()
@@ -593,7 +611,21 @@ func TestSession_SendAndWaitSkipsAutopilotContinuationIdle(t *testing.T) {
 	}
 
 	continuationIdleProcessed := make(chan struct{})
+	childMessageProcessed := make(chan struct{})
+	childErrorProcessed := make(chan struct{})
+	childIdleProcessed := make(chan struct{})
+	childID := "child-1"
 	unsubscribe := session.On(func(event SessionEvent) {
+		if event.AgentID != nil && *event.AgentID == childID {
+			switch event.Data.(type) {
+			case *AssistantMessageData:
+				close(childMessageProcessed)
+			case *SessionErrorData:
+				close(childErrorProcessed)
+			case *SessionIdleData:
+				close(childIdleProcessed)
+			}
+		}
 		if idle, ok := event.Data.(*SessionIdleData); ok &&
 			idle.Mode != nil && *idle.Mode == SessionModeAutopilot {
 			close(continuationIdleProcessed)
@@ -601,11 +633,22 @@ func TestSession_SendAndWaitSkipsAutopilotContinuationIdle(t *testing.T) {
 	})
 	defer unsubscribe()
 
-	autopilot := SessionModeAutopilot
-	session.dispatchEvent(SessionEvent{Data: &AssistantMessageData{
-		Content:   "intermediate",
-		MessageID: "assistant-1",
+	session.dispatchEvent(SessionEvent{AgentID: &childID, Data: &AssistantMessageData{
+		Content:   "child reply",
+		MessageID: "child-message",
 	}})
+	session.dispatchEvent(SessionEvent{AgentID: &childID, Data: &SessionErrorData{
+		Message: "child failed",
+	}})
+	session.dispatchEvent(SessionEvent{AgentID: &childID, Data: &SessionIdleData{}})
+
+	autopilot := SessionModeAutopilot
+	if rootReplies {
+		session.dispatchEvent(SessionEvent{Data: &AssistantMessageData{
+			Content:   "intermediate",
+			MessageID: "assistant-1",
+		}})
+	}
 	session.dispatchEvent(SessionEvent{Data: &SessionIdleData{Mode: &autopilot}})
 
 	select {
@@ -615,22 +658,46 @@ func TestSession_SendAndWaitSkipsAutopilotContinuationIdle(t *testing.T) {
 	case <-time.After(2 * time.Second):
 		t.Fatal("timed out waiting for autopilot continuation idle")
 	}
+	for name, delivered := range map[string]<-chan struct{}{
+		"child assistant message": childMessageProcessed,
+		"child session error":     childErrorProcessed,
+		"child session idle":      childIdleProcessed,
+	} {
+		select {
+		case <-delivered:
+		default:
+			t.Fatalf("%s was not delivered to subscribers", name)
+		}
+	}
 
 	select {
 	case <-resultCh:
-		t.Fatal("SendAndWait returned at an autopilot continuation idle")
+		t.Fatal("SendAndWait returned at a child or autopilot continuation idle")
+	case err := <-errCh:
+		t.Fatalf("SendAndWait failed on a child error: %v", err)
 	default:
 	}
 
 	interactive := SessionModeInteractive
-	session.dispatchEvent(SessionEvent{Data: &AssistantMessageData{
-		Content:   "final",
-		MessageID: "assistant-2",
-	}})
+	if rootReplies {
+		session.dispatchEvent(SessionEvent{Data: &AssistantMessageData{
+			Content:   "final",
+			MessageID: "assistant-2",
+		}})
+	}
 	session.dispatchEvent(SessionEvent{Data: &SessionIdleData{Mode: &interactive}})
 
 	select {
 	case result := <-resultCh:
+		if !rootReplies {
+			if result != nil {
+				t.Fatalf("child reply supplied the parent result: %+v", result)
+			}
+			return
+		}
+		if result == nil {
+			t.Fatal("expected root assistant message, got nil")
+		}
 		message, ok := result.Data.(*AssistantMessageData)
 		if !ok {
 			t.Fatalf("expected assistant message, got %T", result.Data)
diff --git a/go/types.go b/go/types.go
index e9d9c9a684..3ee067a3f1 100644
--- a/go/types.go
+++ b/go/types.go
@@ -525,6 +525,7 @@ type MCPAuthStaticClientConfig struct {
 	ClientSecret *string `json:"clientSecret,omitempty"`
 	GrantType    *string `json:"grantType,omitempty"`
 	PublicClient *bool   `json:"publicClient,omitempty"`
+	Scope        *string `json:"scope,omitempty"`
 }
 
 // MCPAuthRequest describes an MCP OAuth request that the SDK host can satisfy with a token.
@@ -1124,10 +1125,14 @@ func (c MCPStdioServerConfig) MarshalJSON() ([]byte, error) {
 //
 // See [MCPStdioServerConfig] for the semantics of the Tools field.
 type MCPHTTPServerConfig struct {
-	Tools   []string          `json:"tools,omitzero"`
-	Timeout int               `json:"timeout,omitempty"`
-	URL     string            `json:"url"`
-	Headers map[string]string `json:"headers,omitzero"`
+	Tools             []string                               `json:"tools,omitzero"`
+	Timeout           int                                    `json:"timeout,omitempty"`
+	URL               string                                 `json:"url"`
+	Headers           map[string]string                      `json:"headers,omitzero"`
+	OAuthClientID     *string                                `json:"oauthClientId,omitempty"`
+	OAuthScopes       []string                               `json:"oauthScopes,omitzero"`
+	OAuthPublicClient *bool                                  `json:"oauthPublicClient,omitempty"`
+	OAuthGrantType    *rpc.MCPServerConfigHTTPOauthGrantType `json:"oauthGrantType,omitempty"`
 }
 
 func (MCPHTTPServerConfig) mcpServerConfig() {}
@@ -1496,6 +1501,11 @@ type SessionConfig struct {
 	// SkipCustomInstructions, when non-nil, controls whether the runtime loads
 	// custom instruction files. See also [ClientOptions.Mode] = [ModeEmpty].
 	SkipCustomInstructions *bool
+	// RefreshCustomInstructions, when true, invalidates the process-wide custom-instruction
+	// discovery cache before constructing this new session. Nil or false retains the cache.
+	// Other sessions in this runtime may observe updated instructions on later turns
+	// or discovery. It does not watch files or enable disabled instruction loading.
+	RefreshCustomInstructions *bool
 	// CustomAgentsLocalOnly, when non-nil, restricts custom agents to those
 	// defined locally. See also [ClientOptions.Mode] = [ModeEmpty].
 	CustomAgentsLocalOnly *bool
@@ -1511,6 +1521,10 @@ type SessionConfig struct {
 	ModelCapabilities *rpc.ModelCapabilitiesOverride
 	// MCPServers configures MCP servers for the session
 	MCPServers map[string]MCPServerConfig
+	// Diagnostics enables explicitly configured session diagnostic sources.
+	// Diagnostics can contain MCP payloads, tool arguments, paths, and server
+	// stderr, so hosts must not upload or export them automatically.
+	Diagnostics *rpc.DiagnosticsConfiguration
 	// MCPOAuthTokenStorage controls how MCP OAuth tokens are stored for this session.
 	// When empty, the runtime default ("in-memory") is used.
 	MCPOAuthTokenStorage string
@@ -2074,6 +2088,9 @@ type ResumeSessionConfig struct {
 	IncludeSubAgentStreamingEvents *bool
 	// MCPServers configures MCP servers for the session
 	MCPServers map[string]MCPServerConfig
+	// Diagnostics updates explicitly configured sources. Leave it nil on a
+	// resident resume to preserve the current settings.
+	Diagnostics *rpc.DiagnosticsConfiguration
 	// MCPOAuthTokenStorage controls how MCP OAuth tokens are stored for this session.
 	// When empty, the runtime default ("in-memory") is used.
 	MCPOAuthTokenStorage string
@@ -2659,6 +2676,7 @@ type createSessionRequest struct {
 	SessionLimits                      *rpc.SessionLimitsConfig               `json:"sessionLimits,omitempty"`
 	IsExperimentalMode                 *bool                                  `json:"isExperimentalMode,omitempty"`
 	SkipCustomInstructions             *bool                                  `json:"skipCustomInstructions,omitempty"`
+	RefreshCustomInstructions          *bool                                  `json:"refreshCustomInstructions,omitempty"`
 	CustomAgentsLocalOnly              *bool                                  `json:"customAgentsLocalOnly,omitempty"`
 	CoauthorEnabled                    *bool                                  `json:"coauthorEnabled,omitempty"`
 	ManageScheduleEnabled              *bool                                  `json:"manageScheduleEnabled,omitempty"`
@@ -2675,6 +2693,7 @@ type createSessionRequest struct {
 	IncludeSubAgentStreamingEvents     *bool                                  `json:"includeSubAgentStreamingEvents,omitempty"`
 	EnableGitHubTelemetryForwarding    *bool                                  `json:"enableGitHubTelemetryForwarding,omitempty"`
 	MCPServers                         map[string]MCPServerConfig             `json:"mcpServers,omitempty"`
+	Diagnostics                        *rpc.DiagnosticsConfiguration          `json:"diagnostics,omitempty"`
 	MCPOAuthTokenStorage               string                                 `json:"mcpOAuthTokenStorage,omitempty"`
 	AuthClientIDMetadataURL            string                                 `json:"authClientIdMetadataUrl,omitempty"`
 	EnvValueMode                       string                                 `json:"envValueMode,omitempty"`
@@ -2787,6 +2806,7 @@ type resumeSessionRequest struct {
 	IncludeSubAgentStreamingEvents     *bool                                  `json:"includeSubAgentStreamingEvents,omitempty"`
 	EnableGitHubTelemetryForwarding    *bool                                  `json:"enableGitHubTelemetryForwarding,omitempty"`
 	MCPServers                         map[string]MCPServerConfig             `json:"mcpServers,omitempty"`
+	Diagnostics                        *rpc.DiagnosticsConfiguration          `json:"diagnostics,omitempty"`
 	MCPOAuthTokenStorage               string                                 `json:"mcpOAuthTokenStorage,omitempty"`
 	AuthClientIDMetadataURL            string                                 `json:"authClientIdMetadataUrl,omitempty"`
 	EnvValueMode                       string                                 `json:"envValueMode,omitempty"`
diff --git a/go/types_test.go b/go/types_test.go
index 4195464b33..ad7972fe15 100644
--- a/go/types_test.go
+++ b/go/types_test.go
@@ -3,6 +3,8 @@ package copilot
 import (
 	"encoding/json"
 	"testing"
+
+	"github.com/github/copilot-sdk/go/rpc"
 )
 
 func TestUserPromptTransformedHookOutput_PreservesEmptyReplacement(t *testing.T) {
@@ -45,6 +47,47 @@ func TestProviderConfig_JSONIncludesHeaders(t *testing.T) {
 	}
 }
 
+func TestMCPHTTPServerConfig_JSONIncludesOAuthConfiguration(t *testing.T) {
+	grantType := rpc.MCPServerConfigHTTPOauthGrantTypeClientCredentials
+	config := MCPHTTPServerConfig{
+		URL:               "https://example.com/mcp",
+		OAuthClientID:     String("client-id"),
+		OAuthScopes:       []string{"mcp:read", "mcp:write"},
+		OAuthPublicClient: Bool(false),
+		OAuthGrantType:    &grantType,
+	}
+
+	data, err := json.Marshal(config)
+	if err != nil {
+		t.Fatalf("failed to marshal MCP HTTP server config: %v", err)
+	}
+
+	var decoded map[string]any
+	if err := json.Unmarshal(data, &decoded); err != nil {
+		t.Fatalf("failed to unmarshal MCP HTTP server config: %v", err)
+	}
+
+	if decoded["type"] != "http" {
+		t.Errorf("expected type 'http', got %v", decoded["type"])
+	}
+	if decoded["oauthClientId"] != "client-id" {
+		t.Errorf("expected oauthClientId 'client-id', got %v", decoded["oauthClientId"])
+	}
+	if decoded["oauthPublicClient"] != false {
+		t.Errorf("expected oauthPublicClient false, got %v", decoded["oauthPublicClient"])
+	}
+	if decoded["oauthGrantType"] != "client_credentials" {
+		t.Errorf("expected oauthGrantType 'client_credentials', got %v", decoded["oauthGrantType"])
+	}
+	scopes, ok := decoded["oauthScopes"].([]any)
+	if !ok {
+		t.Fatalf("expected oauthScopes array, got %T", decoded["oauthScopes"])
+	}
+	if len(scopes) != 2 || scopes[0] != "mcp:read" || scopes[1] != "mcp:write" {
+		t.Errorf("expected OAuth scopes to round-trip, got %v", scopes)
+	}
+}
+
 func TestSessionSendRequest_JSONIncludesRequestHeaders(t *testing.T) {
 	req := sessionSendRequest{
 		SessionID:      "session-1",
diff --git a/java/README.md b/java/README.md
index 80ace2320d..2df6547446 100644
--- a/java/README.md
+++ b/java/README.md
@@ -234,7 +234,11 @@ system prompt.
 
 Agent sources serialize as `agent-<id>`. Pass the agent ID without adding a
 prefix. The SDK preserves its case and whitespace and rejects null IDs.
-`sendAndWait` accepts the same source values as `send`.
+`sendAndWait` accepts the same source values as `send`. Sub-agent events remain
+visible to listeners but do not complete the wait or supply its reply.
+Synchronous listeners registered before `sendAndWait` finish processing the root
+`session.idle` event before its future completes. Event listeners run in
+registration order.
 
 ## Structured output (experimental)
 
@@ -493,6 +497,69 @@ var resumed = client.resumeSession(sessionId, new ResumeSessionConfig()
 
 When `memory` is left unset, no memory configuration is sent and the runtime default applies. In the default `CopilotClientMode.COPILOT_CLI` the SDK leaves `memory` unset so the runtime applies its own default, while `CopilotClientMode.EMPTY` defaults `memory` to disabled unless you set it explicitly.
 
+## JSON-RPC error handling
+
+Server error responses surface as `com.github.copilot.JsonRpcException`, a
+`RuntimeException` with `getCode()`, `getMessage()`, and `getData()`. The data is a
+Jackson `JsonNode`: objects, arrays, strings, numbers, and booleans retain their
+JSON types, including empty values, zero, and false. Numeric fidelity follows
+Jackson's existing parser. Omitted data returns Java `null`; explicit JSON `null`
+returns a `NullNode` (`data.isNull()` is true).
+
+Future wrapping is unchanged. With `get()`, inspect the cause of
+`ExecutionException`:
+
+```java
+import com.github.copilot.JsonRpcException;
+import java.util.concurrent.ExecutionException;
+
+try {
+    client.ping("hello").get();
+} catch (ExecutionException ex) {
+    if (ex.getCause() instanceof JsonRpcException rpcError) {
+        System.err.println("RPC " + rpcError.getCode() + ": " + rpcError.getMessage());
+        var data = rpcError.getData();
+        if (data != null && !data.isNull()) {
+            // Inspect data according to the server's error contract.
+        }
+    } else {
+        throw ex; // Transport and local failures are not JSON-RPC error responses.
+    }
+}
+```
+
+The enclosing method must handle or declare both `InterruptedException` and the
+rethrown `ExecutionException`.
+With `join()`, the wrapper is `CompletionException` instead:
+
+```java
+import java.util.concurrent.CompletionException;
+
+try {
+    client.ping("hello").join();
+} catch (CompletionException ex) {
+    if (ex.getCause() instanceof JsonRpcException rpcError) {
+        System.err.println("RPC " + rpcError.getCode() + ": " + rpcError.getMessage());
+        var data = rpcError.getData();
+        if (data == null) {
+            // The data member was omitted.
+        } else if (data.isNull()) {
+            // The server explicitly supplied JSON null.
+        } else {
+            // Inspect data according to the server's error contract.
+        }
+    } else {
+        throw ex;
+    }
+}
+```
+
+Error data is not appended to `getMessage()` or `toString()`. Avoid logging it
+indiscriminately: server-provided data may contain sensitive information.
+`getData()` returns the shared Jackson node, not an immutable snapshot. Use
+`deepCopy()` before modifying a container node, particularly when multiple
+observers share the failed future.
+
 ## Using experimental APIs
 
 Some SDK APIs are marked as experimental with `@CopilotExperimental`. These APIs may change or be removed in future versions without notice.
@@ -613,59 +680,41 @@ The gate also applies to individual methods annotated with `@CopilotExperimental
 
 ### Development Setup
 
-Follow [SDK development setup](../CONTRIBUTING.md#developing-an-sdk) for JDK 25+
-and Node.js. Use the checked-in Maven wrapper (`./mvnw`, or `.\mvnw.cmd` on Windows)
-instead of installing Maven separately. From the SDK root (`src/sdk` in the
-runtime repository, or the standalone repository root):
-
-```bash
-npm run build:java
-npm run test:java
-npm run check:java
-```
-
-In the runtime layout, build/test tasks prepare the checked-out Java projection
-and host CLI. Maven installs its Node and replay-harness dependencies during the
-test lifecycle. For focused integration tests after
-[preparing the runtime](../CONTRIBUTING.md#testing-an-unreleased-runtime-api),
-run from `java/`, replacing `<TestClass>` and `<testMethod>` with your test:
+Requires JDK 25 or later and a supported [Node.js version](../nodejs/README.md#prerequisites) for development. The following steps validate the artifact built with JDK 25 runs on both 25 and 17, preserving the MR-JAR behavior.
 
 ```bash
-./mvnw -pl sdk verify -Dit.test="<TestClass>#<testMethod>" -Dcopilot.cli.path="$COPILOT_CLI_PATH"
-```
-
-To reproduce JDK compatibility coverage, build on JDK 25 and run that artifact
-on both 25 and 17. From `java/`, with the runtime prepared:
+# Clone the repository
+git clone https://github.com/github/copilot-sdk.git
+cd copilot-sdk/java
 
-```bash
 # Build and test with JDK 25
-./mvnw test-compile jar:jar
-./mvnw -pl sdk verify -Dskip.test.harness=true -Dcopilot.cli.path="$COPILOT_CLI_PATH"
+mvn test-compile jar:jar
+mvn verify -Dskip.test.harness=true
 
-# Select JDK 17 using JAVA_HOME/PATH; do not recompile the JDK 25-built jar.
-./mvnw -pl sdk jacoco:prepare-agent@wire-up-coverage-instrumentation antrun:run@print-test-jdk-banner surefire:test failsafe:integration-test failsafe:verify jacoco:report@build-coverage-report-from-tests -Denforcer.skip=true -Dcopilot.cli.path="$COPILOT_CLI_PATH"
+# Set your paths for JDK 17
+# Run the JDK 25 built jar with JDK 17 JVM for tests. Do not re-compile the jar.
+mvn jacoco:prepare-agent@wire-up-coverage-instrumentation antrun:run@print-test-jdk-banner surefire:test failsafe:integration-test failsafe:verify jacoco:report@build-coverage-report-from-tests -Denforcer.skip=true
 ```
 
 #### Formatting and linting
 
-From the SDK root, run `npm run format:java` to apply formatting or
-`npm run check:java` for formatting and Maven verification, including tests.
+From the repository root, run `just format-java` to apply formatting and `just lint-java` to check formatting and Javadoc. These recipes are also included in `just format` and `just lint`.
 
-For just formatting and Javadoc checks, run from `java/`:
+Without `just`, run the equivalent Maven commands from `java/`:
 
 ```bash
 # Apply formatting
-./mvnw -pl sdk spotless:apply
+mvn -pl sdk spotless:apply
 
 # Check formatting and Javadoc
-./mvnw -pl sdk spotless:check checkstyle:check
+mvn -pl sdk spotless:check checkstyle:check
 ```
 
-CI enforces both checks. Spotless runs explicitly in CI; `./mvnw verify` alone does not check formatting.
+CI enforces both checks. Spotless runs explicitly in CI; `mvn verify` alone does not check formatting.
 
 #### Development Setup for native embedding
 
-Run native-runtime Maven commands from the `java` directory. Native packaging requires Node.js in addition to JDK 25 and the Maven wrapper. In a standalone SDK checkout, `copilot-native/scripts/fetch-native.mjs` retrieves the pinned runtime package from the corresponding GitHub release. When the SDK is nested in `copilot-agent-runtime`, it instead stages the same-checkout artifacts from `dist-cli`; run `pnpm run build:cli` from the runtime repository first.
+Run native-runtime Maven commands from the `java` directory. Native packaging requires Node.js in addition to JDK 25 and Maven. In a standalone SDK checkout, `copilot-native/scripts/fetch-native.mjs` retrieves the pinned runtime package from the corresponding GitHub release. When the SDK is nested in `copilot-agent-runtime`, it instead stages the same-checkout artifacts from `dist-cli`; run `pnpm run build:cli` from the runtime repository first.
 
 On a native Linux glibc host, Maven activates `native-linux-x64` or `native-linux-arm64` for the matching architecture when `copilot.native.libc=glibc` is set. On a Linux musl x64 host, Maven activates `native-linuxmusl-x64` when `copilot.native.libc=musl` is set. On Windows x64, Windows ARM64, Intel macOS, and Apple Silicon macOS, Maven activates `native-win32-x64`, `native-win32-arm64`, `native-darwin-x64`, or `native-darwin-arm64` automatically. The matching profile validates the host, runs the native script tests, stages the platform package during `generate-resources`, packages the classifier JAR during `package`, and verifies its native contents.
 
@@ -673,40 +722,40 @@ Before opting in, validate that Node.js reports glibc for the build host:
 
 ```bash
 node copilot-native/scripts/validate-native-host.mjs linux-x64
-./mvnw -pl copilot-native clean verify -Dcopilot.native.libc=glibc
+mvn -pl copilot-native clean verify -Dcopilot.native.libc=glibc
 ```
 
 The `inprocess` test profile performs the same validation and native packaging automatically, so the full in-process test command remains:
 
 ```bash
-./mvnw -Pinprocess clean verify
+mvn -Pinprocess clean verify
 ```
 
 On Windows x64 or ARM64 PowerShell, initialize Java and run the same profile:
 
 ```powershell
-.\mvnw.cmd -Pinprocess clean verify
+mvn -Pinprocess clean verify
 ```
 
 The same command validates in-process mode on macOS; use the classifier for the host architecture:
 
 ```bash
 node copilot-native/scripts/validate-native-host.mjs darwin-x64 # Use darwin-arm64 on Apple Silicon
-./mvnw -Pinprocess clean verify
+mvn -Pinprocess clean verify
 ```
 
 The same command validates in-process mode on Linux ARM64:
 
 ```bash
 node copilot-native/scripts/validate-native-host.mjs linux-arm64
-./mvnw -Pinprocess clean verify -Dcopilot.native.libc=glibc
+mvn -Pinprocess clean verify -Dcopilot.native.libc=glibc
 ```
 
 The same command validates in-process mode on Linux musl x64:
 
 ```bash
 node copilot-native/scripts/validate-native-host.mjs linuxmusl-x64
-./mvnw -Pinprocess clean verify -Dcopilot.native.libc=musl
+mvn -Pinprocess clean verify -Dcopilot.native.libc=musl
 ```
 
 On Linux musl ARM64 and other unsupported hosts, do not set `copilot.native.libc`. A normal build produces only the OS-neutral primary, sources, and Javadoc JARs; it does not run native script tests, download or stage native files, or produce a platform classifier JAR.
@@ -714,17 +763,17 @@ On Linux musl ARM64 and other unsupported hosts, do not set `copilot.native.libc
 To build only the OS-neutral artifacts on any host, or override the glibc opt-in, disable native download and packaging:
 
 ```bash
-./mvnw -pl copilot-native clean package -DskipTests -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=true
+mvn -pl copilot-native clean package -DskipTests -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=true
 ```
 
 The verified Linux x64 checks are:
 
 ```bash
 node --test copilot-native/scripts/fetch-native.test.mjs copilot-native/scripts/validate-native-host.test.mjs
-./mvnw -pl copilot-native help:active-profiles -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=false
-./mvnw -pl copilot-native test -Dcopilot.native.libc=glibc
-./mvnw clean verify -Dcopilot.native.libc=glibc
-./mvnw clean package -pl copilot-native -DskipTests -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=true
+mvn -pl copilot-native help:active-profiles -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=false
+mvn -pl copilot-native test -Dcopilot.native.libc=glibc
+mvn clean verify -Dcopilot.native.libc=glibc
+mvn clean package -pl copilot-native -DskipTests -Dcopilot.native.libc=glibc -Dcopilot.native.skip.download=true
 ```
 
 Each classifier JAR includes `runtime.node`, `platform.properties`, and `copilot-runtime` (or `copilot-runtime.exe`) under its `native/<classifier>` directory. It does not contain the legacy `copilot` SEA. The placeholder JAR remains OS-neutral and contains no native binaries. Unsupported hosts retain the placeholder-only behavior.
@@ -745,7 +794,7 @@ Because there is no `maven-release-plugin` and no `release:prepare` ceremony, th
 
 ```bash
 # Build and verify with an explicit version, without touching the POM
-./mvnw clean verify -Drevision=1.2.3
+mvn clean verify -Drevision=1.2.3
 
 # Inspect the generated flattened POMs for the literal version (no ${revision})
 cat sdk/.flattened-pom.xml copilot-native/.flattened-pom.xml
diff --git a/java/copilot-native/scripts/fetch-native.mjs b/java/copilot-native/scripts/fetch-native.mjs
index 3063d53293..dd1e235c1c 100644
--- a/java/copilot-native/scripts/fetch-native.mjs
+++ b/java/copilot-native/scripts/fetch-native.mjs
@@ -134,18 +134,6 @@ if (process.env.COPILOT_CLI_RELEASE_TARBALL) {
   stageArchive(archive);
 }
 
-function stageResource(destinationRelative, content, mode) {
-  const destination = path.resolve(resourceDir, destinationRelative);
-  const resourceRoot = `${path.resolve(resourceDir)}${path.sep}`;
-  if (!destination.startsWith(resourceRoot)) {
-    throw new Error(`Runtime package entry escapes staging directory: ${destinationRelative}`);
-  }
-  fs.mkdirSync(path.dirname(destination), { recursive: true });
-  fs.writeFileSync(destination, content);
-  fs.chmodSync(destination, mode);
-  inventory.push(`${mode.toString(8)}\t${destinationRelative.split(path.sep).join('/')}`);
-}
-
 function stageResourceFile(destinationRelative, source, mode) {
   const destination = path.resolve(resourceDir, destinationRelative);
   const resourceRoot = `${path.resolve(resourceDir)}${path.sep}`;
@@ -171,27 +159,49 @@ function stageArchive(archive) {
   const members = execFileSync('tar', ['-tzf', '-'], { encoding: 'utf8', input: archive })
     .split(/\r?\n/)
     .filter(Boolean);
-  for (const member of members) {
+  const listings = execFileSync('tar', ['-tvzf', '-'], { encoding: 'utf8', input: archive })
+    .split(/\r?\n/)
+    .filter(Boolean);
+  if (members.length !== listings.length) {
+    throw new Error(`Inconsistent archive listings for ${assetName}`);
+  }
+  const files = [];
+  for (const [index, member] of members.entries()) {
     const destinationRelative = hostlessRuntimePath(member, classifier);
     if (destinationRelative === null) {
       continue;
     }
-    const listing = execFileSync('tar', ['-tvzf', '-', member], {
-      encoding: 'utf8',
-      input: archive,
-    }).trim();
+    const listing = listings[index];
     if (listing.startsWith('d')) {
       continue;
     }
-    if (!listing.startsWith('-')) {
+    // BusyBox renders hard links as regular files with an appended arrow.
+    if (!listing.startsWith('-') || listing.includes(`${member} -> `)) {
       throw new Error(`Unsupported runtime package entry: ${member}`);
     }
-    const content = execFileSync('tar', ['-xOzf', '-', member], {
-      encoding: null,
-      input: archive,
-      maxBuffer: 512 * 1024 * 1024,
+    files.push({
+      member,
+      destinationRelative,
+      mode: listing.slice(0, 10).includes('x') ? 0o755 : 0o644,
     });
-    stageResource(destinationRelative, content, listing.slice(0, 10).includes('x') ? 0o755 : 0o644);
+  }
+
+  const scratch = fs.mkdtempSync(path.resolve(outDir, '.archive-'));
+  try {
+    const extracted = path.join(scratch, 'files');
+    const selection = path.join(scratch, 'members');
+    fs.mkdirSync(extracted);
+    // Newline-delimited lists work with BusyBox tar and avoid Windows' command-line limit.
+    fs.writeFileSync(selection, files.map(({ member }) => `${member}\n`).join(''));
+    if (files.length > 0) {
+      // Pass native Windows paths through cwd rather than tar's argument parser.
+      execFileSync('tar', ['-xzf', '-', '-T', '../members'], { input: archive, cwd: extracted });
+    }
+    for (const { member, destinationRelative, mode } of files) {
+      stageResourceFile(destinationRelative, path.join(extracted, member), mode);
+    }
+  } finally {
+    fs.rmSync(scratch, { recursive: true, force: true });
   }
 }
 
diff --git a/java/copilot-native/scripts/fetch-native.test.mjs b/java/copilot-native/scripts/fetch-native.test.mjs
index 8b3fd54bb3..2a70bc8b29 100644
--- a/java/copilot-native/scripts/fetch-native.test.mjs
+++ b/java/copilot-native/scripts/fetch-native.test.mjs
@@ -75,7 +75,7 @@ for (const classifier of ['linux-x64', 'linux-arm64', 'linuxmusl-x64', 'win32-x6
   });
 }
 
-test('stages retained package assets and excludes CLI-only content', (t) => {
+test('stages retained package assets with a bounded number of archive passes', (t) => {
   const classifier = 'linux-x64';
   const fixture = createFixture(t, classifier);
   const packageRoot = path.join(fixture.repoRoot, 'package-root', 'package');
@@ -88,6 +88,11 @@ test('stages retained package assets and excludes CLI-only content', (t) => {
   fs.writeFileSync(path.join(packageRoot, 'ripgrep', 'bin', classifier, 'rg'), 'ripgrep content');
   fs.chmodSync(path.join(packageRoot, 'ripgrep', 'bin', classifier, 'rg'), 0o755);
   fs.writeFileSync(path.join(packageRoot, 'definitions', 'future.json'), '{}');
+  const longName = `${'long-name-'.repeat(9)}with spaces.json`;
+  fs.writeFileSync(path.join(packageRoot, 'definitions', longName), 'long name content');
+  for (let i = 0; i < 32; i++) {
+    fs.writeFileSync(path.join(packageRoot, 'definitions', `${i}.json`), `${i}`);
+  }
   fs.writeFileSync(path.join(packageRoot, 'app.js'), 'excluded');
   fs.writeFileSync(path.join(packageRoot, 'LICENSE.md'), 'excluded');
   fs.writeFileSync(path.join(packageRoot, 'README.md'), 'excluded');
@@ -102,22 +107,91 @@ test('stages retained package assets and excludes CLI-only content', (t) => {
   );
   fs.rmSync(path.join(fixture.stagingDir, classifier), { recursive: true, force: true });
 
+  const trace = `data:text/javascript,${encodeURIComponent(`
+    import childProcess from 'node:child_process';
+    import { syncBuiltinESMExports } from 'node:module';
+    import path from 'node:path';
+    const original = childProcess.execFileSync;
+    childProcess.execFileSync = (file, ...args) => {
+      if (file === 'tar') {
+        console.log('archive-pass');
+        // Match the BusyBox tar interface used by musl CI.
+        if (args[0].includes('--null')) throw new Error('tar: unrecognized option: null');
+        if (args[0].some((arg) => path.isAbsolute(arg))) {
+          throw new Error('tar: native absolute paths are not portable');
+        }
+      }
+      return original(file, ...args);
+    };
+    syncBuiltinESMExports();
+  `)}`;
   const result = runScript(fixture, {
     COPILOT_CLI_RELEASE_TARBALL: tarball,
     COPILOT_CLI_RELEASE_SHA256: packageChecksum,
+    NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --import=${trace}`,
   });
 
   assert.equal(result.status, 0, result.stderr);
   const resourceDir = path.join(fixture.stagingDir, classifier, 'native', classifier);
   assert.equal(fs.readFileSync(path.join(resourceDir, 'ripgrep', 'bin', classifier, 'rg'), 'utf8'), 'ripgrep content');
   assert.equal(fs.readFileSync(path.join(resourceDir, 'definitions', 'future.json'), 'utf8'), '{}');
+  assert.equal(fs.readFileSync(path.join(resourceDir, 'definitions', longName), 'utf8'), 'long name content');
+  for (let i = 0; i < 32; i++) {
+    assert.equal(fs.readFileSync(path.join(resourceDir, 'definitions', `${i}.json`), 'utf8'), `${i}`);
+  }
+  assert.equal(fs.readFileSync(fixture.runtimePath, 'utf8'), runtimeContent);
+  assert.equal(fs.readFileSync(fixture.wrapperPath, 'utf8'), wrapperContent);
   assert.equal(fs.existsSync(path.join(resourceDir, 'app.js')), false);
   assert.equal(fs.existsSync(path.join(resourceDir, 'copilot')), false);
   assert.equal(fs.existsSync(path.join(resourceDir, 'LICENSE.md')), false);
   assert.equal(fs.existsSync(path.join(resourceDir, 'README.md')), false);
   assert.match(fs.readFileSync(path.join(resourceDir, 'runtime-assets.list'), 'utf8'), /ripgrep\/bin\/linux-x64\/rg/);
+  if (process.platform !== 'win32') {
+    assert.match(fs.readFileSync(path.join(resourceDir, 'runtime-assets.list'), 'utf8'), /755\tripgrep\/bin\/linux-x64\/rg/);
+    assert.equal(fs.statSync(path.join(resourceDir, 'ripgrep', 'bin', classifier, 'rg')).mode & 0o777, 0o755);
+  }
+  const passes = result.stdout.split(/\r?\n/).filter((line) => line === 'archive-pass').length;
+  assert.ok(passes <= 3, `Expected at most three archive passes, received ${passes}`);
+  assert.deepEqual(fs.readdirSync(path.join(fixture.stagingDir, classifier)).sort(), ['.version', 'native']);
 });
 
+for (const listingFormat of ['host', 'busybox']) {
+  test(`rejects retained hard links with ${listingFormat} listings instead of extracting them`, (t) => {
+    const fixture = createFixture(t, 'linux-x64');
+    const packageRoot = path.join(fixture.repoRoot, 'package');
+    fs.mkdirSync(path.join(packageRoot, 'definitions'), { recursive: true });
+    const original = path.join(packageRoot, 'definitions', 'original.json');
+    fs.writeFileSync(original, '{}');
+    fs.linkSync(original, path.join(packageRoot, 'definitions', 'linked.json'));
+    const tarball = path.join(fixture.repoRoot, 'fixture.tgz');
+    execFileSync('tar', ['-czf', path.basename(tarball), 'package'], { cwd: fixture.repoRoot });
+    const busyboxListing = `data:text/javascript,${encodeURIComponent(`
+      import childProcess from 'node:child_process';
+      import { syncBuiltinESMExports } from 'node:module';
+      const original = childProcess.execFileSync;
+      childProcess.execFileSync = (file, args, options) => {
+        const result = original(file, args, options);
+        // BusyBox uses a regular-file mode and an arrow for hard links.
+        return file === 'tar' && args.includes('-tvzf')
+          ? result.replace(/^h(.*) link to /gm, '-$1 -> ')
+          : result;
+      };
+      syncBuiltinESMExports();
+    `)}`;
+    const result = runScript(fixture, {
+      COPILOT_CLI_RELEASE_TARBALL: tarball,
+      COPILOT_CLI_RELEASE_SHA256: createHash('sha256').update(fs.readFileSync(tarball)).digest('hex'),
+      ...(listingFormat === 'busybox'
+        ? { NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --import=${busyboxListing}` }
+        : {}),
+    });
+
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /Unsupported runtime package entry: package\/definitions\//);
+    assert.deepEqual(fs.readdirSync(path.join(fixture.stagingDir, fixture.classifier)), ['native']);
+  });
+}
+
 test('stages a same-checkout runtime without downloading a release', (t) => {
   const classifier = 'darwin-arm64';
   const fixture = createRuntimeCheckoutFixture(t, classifier);
diff --git a/java/scripts/codegen/java.test.ts b/java/scripts/codegen/java.test.ts
index 7ab5bb0222..14899ffbdc 100644
--- a/java/scripts/codegen/java.test.ts
+++ b/java/scripts/codegen/java.test.ts
@@ -7,6 +7,7 @@ import type { JSONSchema7 } from "json-schema";
 
 import {
     collectNestedDiscriminatedUnionTypeNames,
+    generateRpcClass,
     isMainModule,
     renderEventVariantClass,
     renderRpcTypes,
@@ -14,6 +15,26 @@ import {
 } from "./java.js";
 import { RPC_VARIANT_OWNERS } from "./rpc-variant-owners.js";
 
+test("preserves diagnostics configuration for session create and resume", async () => {
+    const files = await renderRpcTypes({
+        definitions: {
+            DiagnosticsConfiguration: {
+                type: "object",
+                properties: { sources: { $ref: "#/definitions/DiagnosticSourcesConfiguration" } },
+                required: ["sources"],
+            },
+            DiagnosticSourcesConfiguration: {
+                type: "object",
+                properties: { mcp: { type: "string" } },
+            },
+        },
+    }, {});
+    const configuration = [...files].find(([file]) => file.endsWith("/DiagnosticsConfiguration.java"));
+    assert.ok(configuration, "startup diagnostics must have a named generated configuration");
+    assert.match(configuration[1], /DiagnosticSourcesConfiguration sources/);
+    assert.ok([...files.keys()].some((file) => file.endsWith("/DiagnosticSourcesConfiguration.java")));
+});
+
 test("recognizes an entrypoint reached through a linked directory", (t) => {
     const root = fs.mkdtempSync(path.join(os.tmpdir(), "copilot-java-codegen-entrypoint-"));
     t.after(() => fs.rmSync(root, { recursive: true, force: true }));
@@ -223,6 +244,26 @@ function rpcSource(files: Map<string, string>, name: string): string {
     return source;
 }
 
+test("static OAuth config preserves the legacy four-argument constructor", () => {
+    const typeName = "McpOauthRequiredStaticClientConfig";
+    const source = generateRpcClass(typeName, {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+            clientId: { type: "string" },
+            clientSecret: { type: ["string", "null"] },
+            publicClient: { type: ["boolean", "null"] },
+            grantType: { type: ["string", "null"] },
+            scope: { type: ["string", "null"] },
+        },
+        required: ["clientId"],
+    }, new Map(), "com.github.copilot.generated").code;
+    assert.match(
+        source,
+        /public McpOauthRequiredStaticClientConfig\(\s*String clientId,\s*String clientSecret,\s*Boolean publicClient,\s*String grantType\s*\) \{\s*this\(clientId, clientSecret, publicClient, grantType, null\);/s
+    );
+});
+
 for (const roots of [
     ["FirstResult", "HistoricalResult"],
     ["FirstResult", "HistoricalResult", "LastResult"],
diff --git a/java/scripts/codegen/java.ts b/java/scripts/codegen/java.ts
index 472eedfd61..d701043be6 100644
--- a/java/scripts/codegen/java.ts
+++ b/java/scripts/codegen/java.ts
@@ -30,6 +30,19 @@ function isSchemaInternal(schema: JSONSchema7 | null | undefined): boolean {
         (schema as Record<string, unknown>).visibility === "internal";
 }
 
+function isSchemaExperimental(schema: JSONSchema7 | null | undefined): boolean {
+    return typeof schema === "object" &&
+        schema !== null &&
+        (schema as Record<string, unknown>).stability === "experimental";
+}
+
+function appendExperimentalTypeApiNote(lines: string[], schema: JSONSchema7): void {
+    if (isSchemaExperimental(schema)) {
+        lines.push(` *`);
+        lines.push(` * @apiNote This type is experimental and may change in a future version.`);
+    }
+}
+
 const AUTO_GENERATED_HEADER = `// AUTO-GENERATED FILE - DO NOT EDIT`;
 const GENERATED_FROM_SESSION_EVENTS = `// Generated from: session-events.schema.json`;
 const GENERATED_FROM_API = `// Generated from: api.schema.json`;
@@ -526,6 +539,7 @@ async function generatePolymorphicResultClass(
     const anyOf = schema.anyOf as JSONSchema7[];
     const variants = resolveAnyOfVariants(anyOf);
     const discriminator = findDiscriminator(variants);
+    const experimental = isSchemaExperimental(schema);
 
     if (!discriminator) {
         console.warn(`[codegen] Cannot find discriminator for ${className} — skipping polymorphic generation`);
@@ -573,11 +587,15 @@ async function generatePolymorphicResultClass(
     baseLines.push(`import com.fasterxml.jackson.annotation.JsonIgnoreProperties;`);
     baseLines.push(`import com.fasterxml.jackson.annotation.JsonSubTypes;`);
     baseLines.push(`import com.fasterxml.jackson.annotation.JsonTypeInfo;`);
+    if (experimental) {
+        baseLines.push(`import com.github.copilot.CopilotExperimental;`);
+    }
     baseLines.push(`import javax.annotation.processing.Generated;`);
     baseLines.push("");
-    if (schema.description) {
+    if (schema.description || experimental) {
         baseLines.push(`/**`);
-        baseLines.push(` * ${schema.description}`);
+        baseLines.push(` * ${schema.description ?? `Polymorphic result type {@code ${className}}.`}`);
+        appendExperimentalTypeApiNote(baseLines, schema);
         baseLines.push(` *`);
         baseLines.push(` * @since 1.0.0`);
         baseLines.push(` */`);
@@ -593,6 +611,9 @@ async function generatePolymorphicResultClass(
         baseLines.push(`    @JsonSubTypes.Type(value = ${v.variantClassName}.class, name = "${v.discriminatorValue}")${comma}`);
     }
     baseLines.push(`})`);
+    if (experimental) {
+        baseLines.push(`@CopilotExperimental`);
+    }
     baseLines.push(`@JsonIgnoreProperties(ignoreUnknown = true)`);
     baseLines.push(GENERATED_ANNOTATION);
     baseLines.push(`public abstract class ${className} {`);
@@ -626,12 +647,16 @@ async function generatePolymorphicVariantClass(
     packageName: string,
     packageDir: string
 ): Promise<void> {
+    const experimental = isSchemaExperimental(schema);
     const allImports = new Set<string>([
         "com.fasterxml.jackson.annotation.JsonIgnoreProperties",
         "com.fasterxml.jackson.annotation.JsonInclude",
         "com.fasterxml.jackson.annotation.JsonProperty",
         "javax.annotation.processing.Generated",
     ]);
+    if (experimental) {
+        allImports.add("com.github.copilot.CopilotExperimental");
+    }
     const nestedTypes = new Map<string, JavaClassDef>();
 
     // Collect fields (excluding the discriminator property)
@@ -676,16 +701,21 @@ async function generatePolymorphicVariantClass(
     if (schema.description) {
         lines.push(`/**`);
         lines.push(` * ${schema.description}`);
+        appendExperimentalTypeApiNote(lines, schema);
         lines.push(` *`);
         lines.push(` * @since 1.0.0`);
         lines.push(` */`);
     } else {
         lines.push(`/**`);
         lines.push(` * Variant {@code ${discriminatorValue}} of {@link ${baseClassName}}.`);
+        appendExperimentalTypeApiNote(lines, schema);
         lines.push(` *`);
         lines.push(` * @since 1.0.0`);
         lines.push(` */`);
     }
+    if (experimental) {
+        lines.push(`@CopilotExperimental`);
+    }
     lines.push(`@JsonIgnoreProperties(ignoreUnknown = true)`);
     lines.push(`@JsonInclude(JsonInclude.Include.NON_NULL)`);
     lines.push(GENERATED_ANNOTATION);
@@ -1432,6 +1462,7 @@ async function generateStandaloneEnum(
     headerComment: string
 ): Promise<void> {
     const values = schema.enum as string[];
+    const experimental = isSchemaExperimental(schema);
     const lines: string[] = [];
     lines.push(COPYRIGHT);
     lines.push("");
@@ -1440,15 +1471,22 @@ async function generateStandaloneEnum(
     lines.push("");
     lines.push(`package ${packageName};`);
     lines.push("");
+    if (experimental) {
+        lines.push(`import com.github.copilot.CopilotExperimental;`);
+    }
     lines.push(`import javax.annotation.processing.Generated;`);
     lines.push("");
-    if (schema.description) {
+    if (schema.description || experimental) {
         lines.push(`/**`);
-        lines.push(` * ${schema.description}`);
+        lines.push(` * ${schema.description ?? `Values for {@code ${name}}.`}`);
+        appendExperimentalTypeApiNote(lines, schema);
         lines.push(` *`);
         lines.push(` * @since 1.0.0`);
         lines.push(` */`);
     }
+    if (experimental) {
+        lines.push(`@CopilotExperimental`);
+    }
     lines.push(GENERATED_ANNOTATION);
     lines.push(`public enum ${name} {`);
     for (let i = 0; i < values.length; i++) {
@@ -1484,6 +1522,7 @@ async function generateStandaloneRecord(
 ): Promise<void> {
     const nestedTypes = new Map<string, { code: string }>();
     const { code, imports } = generateRpcClass(name, schema, nestedTypes, packageName);
+    const experimental = isSchemaExperimental(schema);
 
     const lines: string[] = [];
     lines.push(COPYRIGHT);
@@ -1501,19 +1540,26 @@ async function generateStandaloneRecord(
         "javax.annotation.processing.Generated",
         ...imports,
     ]);
+    if (experimental) {
+        allImports.add("com.github.copilot.CopilotExperimental");
+    }
     const sortedImports = [...allImports].sort();
     for (const imp of sortedImports) {
         lines.push(`import ${imp};`);
     }
     lines.push("");
 
-    if (schema.description) {
+    if (schema.description || experimental) {
         lines.push(`/**`);
-        lines.push(` * ${schema.description}`);
+        lines.push(` * ${schema.description ?? `Data type {@code ${name}}.`}`);
+        appendExperimentalTypeApiNote(lines, schema);
         lines.push(` *`);
         lines.push(` * @since 1.0.0`);
         lines.push(` */`);
     }
+    if (experimental) {
+        lines.push(`@CopilotExperimental`);
+    }
     lines.push(GENERATED_ANNOTATION);
     lines.push(code);
     lines.push("");
@@ -1565,7 +1611,7 @@ function schemaAllowsNull(schema: JSONSchema7): boolean {
 }
 
 /** Generate a Java record for a JSON Schema object type. Returns the class content. */
-function generateRpcClass(
+export function generateRpcClass(
     className: string,
     schema: JSONSchema7,
     _nestedTypes: Map<string, { code: string }>,
@@ -1621,6 +1667,43 @@ function generateRpcClass(
     }
 
     if (localNestedTypes.size > 0 && lines[lines.length - 1] === "") lines.pop();
+    const legacyFieldNames =
+        className === "McpOauthRequiredStaticClientConfig"
+            ? ["clientId", "clientSecret", "publicClient", "grantType"]
+            : undefined;
+    if (legacyFieldNames) {
+        const legacyFields = legacyFieldNames.map((fieldName) => {
+            const field = fields.find((candidate) => candidate.javaName === fieldName);
+            if (!field) {
+                throw new Error(`Missing legacy field ${className}.${fieldName}`);
+            }
+            return field;
+        });
+        const omittedFields = fields.filter((field) => !legacyFieldNames.includes(field.javaName));
+        if (omittedFields.length !== 1 || omittedFields[0].javaName !== "scope") {
+            throw new Error(`Unexpected compatibility fields for ${className}`);
+        }
+
+        lines.push(``);
+        lines.push(`    /**`);
+        lines.push(`     * Creates a static OAuth client configuration without an explicit scope.`);
+        lines.push(`     *`);
+        for (const field of legacyFields) {
+            const description = (field.description || field.propName)
+                .replace(/\s+/g, " ")
+                .replaceAll("*/", "* /");
+            lines.push(`     * @param ${field.javaName} ${description}`);
+        }
+        lines.push(`     */`);
+        lines.push(`    public ${className}(`);
+        legacyFields.forEach((field, index) => {
+            lines.push(`        ${field.javaType} ${field.javaName}${index < legacyFields.length - 1 ? "," : ""}`);
+        });
+        lines.push(`    ) {`);
+        lines.push(`        this(${legacyFieldNames.join(", ")}, null);`);
+        lines.push(`    }`);
+    }
+
     lines.push(`}`);
 
     return { code: lines.join("\n"), imports };
@@ -1681,6 +1764,10 @@ async function collectRpcTypes(schema: RpcSchema): Promise<void> {
     currentDefinitions = schema.definitions ?? {};
     pendingStandaloneTypes.clear();
     promotedNestedUnionTypes.clear();
+    // Session create/resume consumes this named type, not the method-specific result wrapper.
+    if (currentDefinitions.DiagnosticsConfiguration) {
+        pendingStandaloneTypes.set("DiagnosticsConfiguration", currentDefinitions.DiagnosticsConfiguration);
+    }
     const packageName = "com.github.copilot.generated.rpc";
     const packageDir = `sdk/src/generated/java/com/github/copilot/generated/rpc`;
 
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/AssistantMessageReasoningBlocks.java b/java/sdk/src/generated/java/com/github/copilot/generated/AssistantMessageReasoningBlocks.java
index ee9c5fd485..3603e09f1e 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/AssistantMessageReasoningBlocks.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/AssistantMessageReasoningBlocks.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * Neutral provider-tagged reasoning content blocks preserved verbatim for round-tripping
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/AssistantMessageServerTools.java b/java/sdk/src/generated/java/com/github/copilot/generated/AssistantMessageServerTools.java
index 6d67f6ecbe..eb75a75121 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/AssistantMessageServerTools.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/AssistantMessageServerTools.java
@@ -10,6 +10,7 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import java.util.Map;
 import javax.annotation.processing.Generated;
@@ -17,8 +18,11 @@
 /**
  * Neutral provider-tagged server-side tool-use payload (tool search, advisor) for verbatim round-tripping
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/CanvasRegistryChangedCanvas.java b/java/sdk/src/generated/java/com/github/copilot/generated/CanvasRegistryChangedCanvas.java
index 12518491e8..b0f2a8d23e 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/CanvasRegistryChangedCanvas.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/CanvasRegistryChangedCanvas.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * A single canvas declaration in `session.canvas.registry_changed`, including provider IDs, display metadata, input schema, and actions.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/CanvasRegistryChangedCanvasAction.java b/java/sdk/src/generated/java/com/github/copilot/generated/CanvasRegistryChangedCanvasAction.java
index 99c390efb2..68fe3a6444 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/CanvasRegistryChangedCanvasAction.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/CanvasRegistryChangedCanvasAction.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * A single action within a canvas declaration, with its name, optional description, and optional input schema.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/CitableSource.java b/java/sdk/src/generated/java/com/github/copilot/generated/CitableSource.java
index c66809fc15..6f11f99bc1 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/CitableSource.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/CitableSource.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * A source supplied by a tool that should be made available to the model as citable content.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/CitationProvider.java b/java/sdk/src/generated/java/com/github/copilot/generated/CitationProvider.java
index 46a02b2561..4122059df8 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/CitationProvider.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/CitationProvider.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * The system that produced a citation.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum CitationProvider {
     /** The {@code anthropic} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/CitationReference.java b/java/sdk/src/generated/java/com/github/copilot/generated/CitationReference.java
index e9ad222c10..db15713df4 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/CitationReference.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/CitationReference.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * A single citation occurrence linking a span of generated text to a supporting source.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/CitationSource.java b/java/sdk/src/generated/java/com/github/copilot/generated/CitationSource.java
index 561c5eced7..a1daf7def4 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/CitationSource.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/CitationSource.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * A source that backs one or more cited spans in the assistant's response.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/CitationSpan.java b/java/sdk/src/generated/java/com/github/copilot/generated/CitationSpan.java
index aaa8647a64..6aeb1d994c 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/CitationSpan.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/CitationSpan.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * A contiguous span of generated assistant text and the source references that support it.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/Citations.java b/java/sdk/src/generated/java/com/github/copilot/generated/Citations.java
index c153c39a7b..c18758e87e 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/Citations.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/Citations.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * Provider-agnostic citations linking spans of the assistant's response to their supporting sources.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionAttribution.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionAttribution.java
index 8e4ae7e937..87d60a047b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionAttribution.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionAttribution.java
@@ -10,17 +10,23 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Experimental attribution linking an ordinary event to the HydraFusion turn, phase, and concrete source that produced it.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
 public record FusionAttribution(
+    /** Whether this model request consumed a user steering message rather than only internal Fusion work. */
+    @JsonProperty("hasUserSteering") Boolean hasUserSteering,
     /** Stable identifier for the HydraFusion turn that produced the event. */
     @JsonProperty("fusionId") String fusionId,
     /** Idempotency identifier for the authoritative commit, when the event belongs to the selected output. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionConversationScope.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionConversationScope.java
index d38381ed48..702c43ea7e 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionConversationScope.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionConversationScope.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Conversation scope in which a HydraFusion phase executes.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum FusionConversationScope {
     /** The {@code root} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionFollowUpAction.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionFollowUpAction.java
index e54bf4604f..e9ec06aff8 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionFollowUpAction.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionFollowUpAction.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Server-recommended routing behavior for a later HydraFusion turn.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum FusionFollowUpAction {
     /** The {@code reuse_primary} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionFollowUpRecommendation.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionFollowUpRecommendation.java
index 101d497fb2..f2678d9373 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionFollowUpRecommendation.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionFollowUpRecommendation.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Durable server recommendation for subsequent HydraFusion turns.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPattern.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPattern.java
index d37ef4ee83..ed9a2391a6 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPattern.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPattern.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Validated HydraFusion execution pattern.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum FusionPattern {
     /** The {@code single} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseActivityKind.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseActivityKind.java
index a95a08cf91..e0b10db828 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseActivityKind.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseActivityKind.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Content-safe activity observed while a HydraFusion phase is running.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum FusionPhaseActivityKind {
     /** The {@code model_output} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseKind.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseKind.java
index ead79b75fc..512ea698ef 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseKind.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseKind.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * HydraFusion phase kind.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum FusionPhaseKind {
     /** The {@code primary} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhasePlanStep.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhasePlanStep.java
index cfb07a789a..de40eaf0ac 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhasePlanStep.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhasePlanStep.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Presentation-neutral phase planned for a HydraFusion turn.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseStatus.java
index f670332b5c..88f8a751aa 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseStatus.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Durable outcome status of a HydraFusion phase.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum FusionPhaseStatus {
     /** The {@code succeeded} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseUsage.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseUsage.java
index 4a707bb69e..a21ece2845 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseUsage.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionPhaseUsage.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Aggregate concrete-model usage for one HydraFusion phase.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionProjectionMode.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionProjectionMode.java
index 9681efc0ba..ef705b48d2 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionProjectionMode.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionProjectionMode.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * How a durable phase checkpoint contributes its exact message to canonical root history.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum FusionProjectionMode {
     /** The {@code append} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionScores.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionScores.java
index eefb8190a1..ae2b219d9d 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionScores.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionScores.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Validated HydraFusion routing capability scores.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionStagedTerminal.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionStagedTerminal.java
index 262c8c664b..297a4325d4 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionStagedTerminal.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionStagedTerminal.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Internal durable terminal request staged by a HydraFusion phase until an idempotent final commit selects it.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/FusionTurnKind.java b/java/sdk/src/generated/java/com/github/copilot/generated/FusionTurnKind.java
index 24e39b976c..ec55bab2bb 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/FusionTurnKind.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/FusionTurnKind.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Kind of turn for which HydraFusion routing is running.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum FusionTurnKind {
     /** The {@code user} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/McpOauthRequiredStaticClientConfig.java b/java/sdk/src/generated/java/com/github/copilot/generated/McpOauthRequiredStaticClientConfig.java
index 5f42ec90c4..19816c43b9 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/McpOauthRequiredStaticClientConfig.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/McpOauthRequiredStaticClientConfig.java
@@ -28,6 +28,25 @@ public record McpOauthRequiredStaticClientConfig(
     /** Whether this is a public OAuth client */
     @JsonProperty("publicClient") Boolean publicClient,
     /** Optional non-default OAuth grant type. When set to 'client_credentials', the OAuth flow runs headlessly using the client_id + keychain-stored secret (no browser, no callback server). */
-    @JsonProperty("grantType") String grantType
+    @JsonProperty("grantType") String grantType,
+    /** Configured OAuth scope string used when the server challenge omits scope or provides an empty scope */
+    @JsonProperty("scope") String scope
 ) {
+
+    /**
+     * Creates a static OAuth client configuration without an explicit scope.
+     *
+     * @param clientId OAuth client ID for the server
+     * @param clientSecret Optional OAuth client secret for confidential static clients, when the runtime can resolve one
+     * @param publicClient Whether this is a public OAuth client
+     * @param grantType Optional non-default OAuth grant type. When set to 'client_credentials', the OAuth flow runs headlessly using the client_id + keychain-stored secret (no browser, no callback server).
+     */
+    public McpOauthRequiredStaticClientConfig(
+        String clientId,
+        String clientSecret,
+        Boolean publicClient,
+        String grantType
+    ) {
+        this(clientId, clientSecret, publicClient, grantType, null);
+    }
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationPolarity.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationPolarity.java
index 14bc8e2895..e142238e7b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationPolarity.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMessageAuthorizationPolarity.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Which direction a message-backed authorization claim moves authority in.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum PermissionMessageAuthorizationPolarity {
     /** The {@code grant} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMode.java b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMode.java
index 421ad76139..fec188d66e 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMode.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/PermissionMode.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Permission mode for the session.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum PermissionMode {
     /** The {@code manual} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/ResponsesReasoning.java b/java/sdk/src/generated/java/com/github/copilot/generated/ResponsesReasoning.java
index 764284ac2c..88379865d5 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/ResponsesReasoning.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/ResponsesReasoning.java
@@ -13,7 +13,7 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Original request-level and effective conversation reasoning effort for a Responses history boundary
+ * Original request-level and effective conversation reasoning effort for a provider history boundary; the historical type name is retained for compatibility
  *
  * @since 1.0.0
  */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/SessionSnapshotRewindEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/SessionSnapshotRewindEvent.java
index 0eb678adbf..d507f4de0e 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/SessionSnapshotRewindEvent.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/SessionSnapshotRewindEvent.java
@@ -10,6 +10,7 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
@@ -34,10 +35,12 @@ public final class SessionSnapshotRewindEvent extends SessionEvent {
     @JsonIgnoreProperties(ignoreUnknown = true)
     @JsonInclude(JsonInclude.Include.NON_NULL)
     public record SessionSnapshotRewindEventData(
-        /** Event ID that was rewound to; this event and all after it were removed */
+        /** First removed event. Without `eventIds`, it and every event after it were removed */
         @JsonProperty("upToEventId") String upToEventId,
         /** Number of events that were removed by the rewind */
-        @JsonProperty("eventsRemoved") Long eventsRemoved
+        @JsonProperty("eventsRemoved") Long eventsRemoved,
+        /** The removed events, starting with `upToEventId`. Later events not listed were kept, such as a background agent's events that interleaved with a withdrawn turn */
+        @JsonProperty("eventIds") List<String> eventIds
     ) {
     }
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/SystemNotificationEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/SystemNotificationEvent.java
index c2e1e55706..21e2abbafc 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/SystemNotificationEvent.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/SystemNotificationEvent.java
@@ -38,7 +38,7 @@ public record SystemNotificationEventData(
         @JsonProperty("content") String content,
         /** Structured metadata identifying what triggered this notification */
         @JsonProperty("kind") Object kind,
-        /** Responses reasoning settings anchored before this model-facing message, for cache-stable history replay */
+        /** Provider reasoning settings anchored before this model-facing message for cache-stable replay; the historical responsesReasoning name is retained for compatibility */
         @JsonProperty("responsesReasoning") ResponsesReasoning responsesReasoning
     ) {
     }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/TaskBlocker.java b/java/sdk/src/generated/java/com/github/copilot/generated/TaskBlocker.java
index 54b9495d91..d1093a8839 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/TaskBlocker.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/TaskBlocker.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Structured reason that the task cannot continue without intervention
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/ToolExecutionCompleteShellExecution.java b/java/sdk/src/generated/java/com/github/copilot/generated/ToolExecutionCompleteShellExecution.java
index e08ac623f9..4c9a304c40 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/ToolExecutionCompleteShellExecution.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/ToolExecutionCompleteShellExecution.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Experimental shell completion facts retained independently of the full tool result.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/UIEphemeralQueryPhase.java b/java/sdk/src/generated/java/com/github/copilot/generated/UIEphemeralQueryPhase.java
index 7798c159eb..63a53aa0bb 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/UIEphemeralQueryPhase.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/UIEphemeralQueryPhase.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Lifecycle phase for a Rust-owned ephemeral query stream.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum UIEphemeralQueryPhase {
     /** The {@code started} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/UserMessageEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/UserMessageEvent.java
index aca76d26d8..3b68529dbc 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/UserMessageEvent.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/UserMessageEvent.java
@@ -37,7 +37,7 @@ public final class UserMessageEvent extends SessionEvent {
     public record UserMessageEventData(
         /** The user's message text as displayed in the timeline */
         @JsonProperty("content") String content,
-        /** Responses reasoning settings anchored before this model-facing message, for cache-stable history replay */
+        /** Provider reasoning settings anchored before this model-facing message for cache-stable replay; the historical responsesReasoning name is retained for compatibility */
         @JsonProperty("responsesReasoning") ResponsesReasoning responsesReasoning,
         /** Stable identity of the logical user message, matching the ID returned by send and retained by pending queue snapshots */
         @JsonProperty("messageId") String messageId,
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveCreditLimit.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveCreditLimit.java
index d3f6a585b8..776e25273a 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveCreditLimit.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveCreditLimit.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Current per-window credit limit and consumption for an autopilot objective.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveState.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveState.java
index 657884c4f6..3b2c3002fa 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveState.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveState.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Public, persistence-independent projection of an autopilot objective.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveStatus.java
index b50cf2072c..024ca37c43 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/AutopilotObjectiveStatus.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Current normalized autopilot objective lifecycle status.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum AutopilotObjectiveStatus {
     /** The {@code active} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolDescriptor.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolDescriptor.java
index 057498fb98..e36268609f 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolDescriptor.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolDescriptor.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Rust-owned metadata and input schema for a built-in tool.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolFormat.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolFormat.java
index 7af5ef2d45..c03c92afc4 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolFormat.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolFormat.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Custom grammar input format accepted by a built-in tool.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolFormatType.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolFormatType.java
index 6239493671..fcb277e6c9 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolFormatType.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolFormatType.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Custom input-format kind.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum BuiltinToolFormatType {
     /** The {@code grammar} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolInputSchema.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolInputSchema.java
index 764450b37e..277eba0751 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolInputSchema.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolInputSchema.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * JSON Schema object accepted by a built-in tool.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolInputSchemaType.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolInputSchemaType.java
index 729f3329b5..d935afb4a6 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolInputSchemaType.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/BuiltinToolInputSchemaType.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Root JSON Schema type for a built-in tool input.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum BuiltinToolInputSchemaType {
     /** The {@code object} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasAction.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasAction.java
index 36554ed767..b31f9d6fdb 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasAction.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasAction.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Canvas action that the agent or host can invoke. To discover the input schema for a particular action, call the list_canvas_capabilities tool.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasHostContext.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasHostContext.java
index 8dba8156e4..cf09ce5679 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasHostContext.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasHostContext.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Host context supplied by the runtime.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasHostContextCapabilities.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasHostContextCapabilities.java
index a8118eeebf..c3133d0099 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasHostContextCapabilities.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasHostContextCapabilities.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Host capabilities
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasSessionContext.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasSessionContext.java
index 422d32e542..d3c5c75bde 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasSessionContext.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CanvasSessionContext.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Session context supplied by the runtime.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CommandsInvocationEffectOutcome.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CommandsInvocationEffectOutcome.java
index 79f3be8baf..65293f1219 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CommandsInvocationEffectOutcome.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/CommandsInvocationEffectOutcome.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Whether a pending slash-command invocation effect was applied or cancelled by the host.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum CommandsInvocationEffectOutcome {
     /** The {@code applied} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAuthorizationRequirement.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAuthorizationRequirement.java
index ed48dc4bae..8e4479da72 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAuthorizationRequirement.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAuthorizationRequirement.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Account-targeted authorization update required by the Connector service. The account ID is an opaque host routing identifier; no credential is included.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAuthorizationScope.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAuthorizationScope.java
index 7b0f1a7b15..762c455778 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAuthorizationScope.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAuthorizationScope.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Stable OAuth scope whose absence prevents Connector management.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum ConnectorAuthorizationScope {
     /** The {@code write_plugin_gateway_connections} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAvailability.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAvailability.java
index 2b2b19dc53..00f11aed79 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAvailability.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorAvailability.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Availability of the EXPERIMENTAL session connector API.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum ConnectorAvailability {
     /** The {@code enabled} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogEntry.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogEntry.java
index 612dd11f8b..53c3750792 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogEntry.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogEntry.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * Credential-free Connector catalog entry.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogResult.java
index 2e4102daf9..2d10c7ad93 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogResult.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * Validated Connector catalog snapshot cached by the session.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogStatus.java
index 50f4ede020..7be156a58b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorCatalogStatus.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Authoritative service connection state for one Connector.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum ConnectorCatalogStatus {
     /** The {@code not_connected} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResult.java
index 53a6cd0884..3598e407d1 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResult.java
@@ -10,11 +10,14 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonSubTypes;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Typed result of initiating or continuing a Connector connection.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
 @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "kind", visible = true)
@@ -23,6 +26,7 @@
     @JsonSubTypes.Type(value = ConnectorConnectResultConsentRequired.class, name = "consent_required"),
     @JsonSubTypes.Type(value = ConnectorConnectResultPending.class, name = "pending")
 })
+@CopilotExperimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public abstract class ConnectorConnectResult {
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultConnected.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultConnected.java
index 4eb5f6f63f..cf5051e62c 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultConnected.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultConnected.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * The service is connected and the session MCP graph was reconciled.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultConsentRequired.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultConsentRequired.java
index c501753aaf..3552bdc9e3 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultConsentRequired.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultConsentRequired.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Host-owned consent is required before bounded continuation can complete.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultPending.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultPending.java
index 8ef1f4f608..a31a009382 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultPending.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorConnectResultPending.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * The service is still completing the connection without a consent URL.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorMcpStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorMcpStatus.java
index 97fbf5a9bf..d517230f4f 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorMcpStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorMcpStatus.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Live MCP status of one Connector-owned runtime server.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum ConnectorMcpStatus {
     /** The {@code connected} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorRuntimeStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorRuntimeStatus.java
index 61f01b82fa..af01caaba8 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorRuntimeStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorRuntimeStatus.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Live status of one session-owned MCP projection.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorStatus.java
index f1008008b6..29d6d33a3c 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ConnectorStatus.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * Authoritative session connector state. Account IDs are opaque routing identifiers and credentials are never included.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ContentExclusionPathCheck.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ContentExclusionPathCheck.java
index ba48326c2e..5dd0809887 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ContentExclusionPathCheck.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ContentExclusionPathCheck.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Content-exclusion decision for one requested path.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticCursorStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticCursorStatus.java
new file mode 100644
index 0000000000..ebe0429ac5
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticCursorStatus.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Whether the supplied diagnostic cursor remained within the retained buffer window.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum DiagnosticCursorStatus {
+    /** The {@code ok} variant. */
+    OK("ok"),
+    /** The {@code expired} variant. */
+    EXPIRED("expired");
+
+    private final String value;
+    DiagnosticCursorStatus(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static DiagnosticCursorStatus fromValue(String value) {
+        for (DiagnosticCursorStatus v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown DiagnosticCursorStatus value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticLogLevel.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticLogLevel.java
new file mode 100644
index 0000000000..5edd3b16c5
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticLogLevel.java
@@ -0,0 +1,43 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Session-scoped diagnostic threshold. Capture is disabled by default and is never persisted with the session.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum DiagnosticLogLevel {
+    /** The {@code off} variant. */
+    OFF("off"),
+    /** The {@code error} variant. */
+    ERROR("error"),
+    /** The {@code warning} variant. */
+    WARNING("warning"),
+    /** The {@code info} variant. */
+    INFO("info"),
+    /** The {@code debug} variant. */
+    DEBUG("debug"),
+    /** The {@code trace} variant. */
+    TRACE("trace");
+
+    private final String value;
+    DiagnosticLogLevel(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static DiagnosticLogLevel fromValue(String value) {
+        for (DiagnosticLogLevel v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown DiagnosticLogLevel value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticSeverity.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticSeverity.java
new file mode 100644
index 0000000000..4a3f74cc59
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticSeverity.java
@@ -0,0 +1,41 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Severity of an emitted diagnostic record.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum DiagnosticSeverity {
+    /** The {@code error} variant. */
+    ERROR("error"),
+    /** The {@code warning} variant. */
+    WARNING("warning"),
+    /** The {@code info} variant. */
+    INFO("info"),
+    /** The {@code debug} variant. */
+    DEBUG("debug"),
+    /** The {@code trace} variant. */
+    TRACE("trace");
+
+    private final String value;
+    DiagnosticSeverity(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static DiagnosticSeverity fromValue(String value) {
+        for (DiagnosticSeverity v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown DiagnosticSeverity value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticSource.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticSource.java
new file mode 100644
index 0000000000..8b53d2bd71
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticSource.java
@@ -0,0 +1,33 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * A supported diagnostic source.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum DiagnosticSource {
+    /** The {@code mcp} variant. */
+    MCP("mcp");
+
+    private final String value;
+    DiagnosticSource(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static DiagnosticSource fromValue(String value) {
+        for (DiagnosticSource v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown DiagnosticSource value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticSourcesConfiguration.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticSourcesConfiguration.java
new file mode 100644
index 0000000000..761517f51c
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticSourcesConfiguration.java
@@ -0,0 +1,27 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Typed diagnostic source configuration. At least one source is required by diagnostics configuration methods.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record DiagnosticSourcesConfiguration(
+    /** MCP diagnostic capture threshold. Omit to leave the current threshold unchanged. */
+    @JsonProperty("mcp") McpDiagnosticSourceConfiguration mcp
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticsConfiguration.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticsConfiguration.java
new file mode 100644
index 0000000000..1d94937413
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiagnosticsConfiguration.java
@@ -0,0 +1,31 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import javax.annotation.processing.Generated;
+
+/**
+ * Per-source session diagnostics configuration.
+ *
+ * @apiNote This type is experimental and may change in a future version.
+ *
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record DiagnosticsConfiguration(
+    /** Diagnostic thresholds keyed by supported source. */
+    @JsonProperty("sources") DiagnosticSourcesConfiguration sources
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiscoveredCanvas.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiscoveredCanvas.java
index 0b0c518040..ce8759ee33 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiscoveredCanvas.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/DiscoveredCanvas.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * Canvas available in the current session.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ExtensionLaunchProfile.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ExtensionLaunchProfile.java
index e7590c7f9e..a2c5bb7ed2 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ExtensionLaunchProfile.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ExtensionLaunchProfile.java
@@ -10,6 +10,7 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import java.util.Map;
 import javax.annotation.processing.Generated;
@@ -17,8 +18,11 @@
 /**
  * Opaque integrator-owned process launch profile for one extension entrypoint.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ExtensionLaunchProviderResolveRequest.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ExtensionLaunchProviderResolveRequest.java
index 7b520f9067..d33956d10d 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ExtensionLaunchProviderResolveRequest.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ExtensionLaunchProviderResolveRequest.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * A discovered extension entrypoint that the registered integrator may classify and resolve to an opaque launch profile.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryAgentOptions.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryAgentOptions.java
index 51b9077ba1..35470e7199 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryAgentOptions.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryAgentOptions.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Options for one factory-scoped subagent call.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryAgentSummary.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryAgentSummary.java
index d1bd2329b2..d063fc9c6b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryAgentSummary.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryAgentSummary.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Prompt-safe durable identity and live status for a direct factory agent.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryCurrentPhase.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryCurrentPhase.java
index e0a30f51a6..c15631835d 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryCurrentPhase.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryCurrentPhase.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Current factory phase identity.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryDeclaredLimits.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryDeclaredLimits.java
index 7fa99b005b..7e2e4e6b5b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryDeclaredLimits.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryDeclaredLimits.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Declared or approved factory resource ceilings.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryLogLine.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryLogLine.java
index 28a9690450..1f7afdd583 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryLogLine.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryLogLine.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * One ordered factory progress line.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryPhaseObservation.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryPhaseObservation.java
index aa96e0cb90..167766885c 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryPhaseObservation.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryPhaseObservation.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Durable lifecycle and timing for one factory phase.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryPhaseStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryPhaseStatus.java
index d9fea0bc36..8432507176 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryPhaseStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryPhaseStatus.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Derived lifecycle state of a factory phase.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum FactoryPhaseStatus {
     /** The {@code pending} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryProgressLine.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryProgressLine.java
index 3a26b67d79..c9ed149610 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryProgressLine.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryProgressLine.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * One durable factory progress record.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryProgressPage.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryProgressPage.java
index 76278a1585..935140612e 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryProgressPage.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryProgressPage.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * A bidirectional page of factory progress.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunConsumed.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunConsumed.java
index a492db26f6..5ffc43435d 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunConsumed.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunConsumed.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Durable factory resource consumption.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunLimits.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunLimits.java
index 79304772a0..300e4977b3 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunLimits.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunLimits.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Wire-only per-invocation factory resource ceiling overrides.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunSummary.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunSummary.java
index e58b774bcb..56d1f91763 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunSummary.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunSummary.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Durable factory run summary with read-time live overlays.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunTerminal.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunTerminal.java
index 0123e19793..0b0db7d9b7 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunTerminal.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryRunTerminal.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Prompt-safe terminal factory outcome.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryToolRunOptions.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryToolRunOptions.java
index cc3e7c8da1..e2444c7053 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryToolRunOptions.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/FactoryToolRunOptions.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Options for an internal tool-originated factory invocation.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryClientInfo.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryClientInfo.java
index b6bef1bffd..513fa2ec98 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryClientInfo.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryClientInfo.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Client environment metadata describing the process that produced a telemetry event.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryEvent.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryEvent.java
index efbf920b4f..58c550af05 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryEvent.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryEvent.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.Map;
 import javax.annotation.processing.Generated;
 
 /**
  * A single telemetry event in the runtime's native GitHub-shaped telemetry format, forwarded verbatim to opted-in hosts. The `restricted` flag on the enclosing GitHubTelemetryNotification distinguishes standard from restricted events; the payload shape is identical for both.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryNotification.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryNotification.java
index 6059f1ff6c..7d1cf5b1a3 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryNotification.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTelemetryNotification.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Payload for a `gitHubTelemetry.event` notification: a single GitHub telemetry event the runtime forwards to a host connection that opted into telemetry forwarding during the `server.connect` handshake.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTokenAcquireRequest.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTokenAcquireRequest.java
index 59ba9d8ed5..890af9a526 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTokenAcquireRequest.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTokenAcquireRequest.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Asks the SDK client to acquire a GitHub access token from an opaque callback registration.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTokenAcquireResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTokenAcquireResult.java
index a20724c337..f0d0b2d3ee 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTokenAcquireResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/GitHubTokenAcquireResult.java
@@ -10,11 +10,14 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonSubTypes;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * SDK host response to a GitHub credential request.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
 @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, property = "kind", visible = true)
@@ -22,6 +25,7 @@
     @JsonSubTypes.Type(value = GitHubTokenAcquireResultToken.class, name = "token"),
     @JsonSubTypes.Type(value = GitHubTokenAcquireResultCancelled.class, name = "cancelled")
 })
+@CopilotExperimental
 @JsonIgnoreProperties(ignoreUnknown = true)
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public abstract class GitHubTokenAcquireResult {
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticDetails.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticDetails.java
new file mode 100644
index 0000000000..1833ddbbe3
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticDetails.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * MCP-specific detail for a source-discriminated diagnostic entry.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record McpDiagnosticDetails(
+    /** Diagnostic record category. */
+    @JsonProperty("kind") McpDiagnosticKind kind,
+    /** Configured MCP server name. */
+    @JsonProperty("serverName") String serverName,
+    /** Fresh identifier for the MCP connection attempt, including failed starts. */
+    @JsonProperty("connectionId") String connectionId,
+    /** Protocol-frame direction when kind is protocol. */
+    @JsonProperty("direction") McpDiagnosticDirection direction,
+    /** Serialized diagnostic detail. Protocol and HTTP records use JSON when detail is present. */
+    @JsonProperty("data") String data
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticDirection.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticDirection.java
new file mode 100644
index 0000000000..9fd63a3075
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticDirection.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Direction of an observed MCP protocol frame.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum McpDiagnosticDirection {
+    /** The {@code client-to-server} variant. */
+    CLIENT_TO_SERVER("client-to-server"),
+    /** The {@code server-to-client} variant. */
+    SERVER_TO_CLIENT("server-to-client");
+
+    private final String value;
+    McpDiagnosticDirection(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static McpDiagnosticDirection fromValue(String value) {
+        for (McpDiagnosticDirection v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown McpDiagnosticDirection value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticKind.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticKind.java
new file mode 100644
index 0000000000..cf14ff4198
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticKind.java
@@ -0,0 +1,39 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import javax.annotation.processing.Generated;
+
+/**
+ * Category for an MCP diagnostic record.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public enum McpDiagnosticKind {
+    /** The {@code lifecycle} variant. */
+    LIFECYCLE("lifecycle"),
+    /** The {@code protocol} variant. */
+    PROTOCOL("protocol"),
+    /** The {@code http} variant. */
+    HTTP("http"),
+    /** The {@code stderr} variant. */
+    STDERR("stderr");
+
+    private final String value;
+    McpDiagnosticKind(String value) { this.value = value; }
+    @com.fasterxml.jackson.annotation.JsonValue
+    public String getValue() { return value; }
+    @com.fasterxml.jackson.annotation.JsonCreator
+    public static McpDiagnosticKind fromValue(String value) {
+        for (McpDiagnosticKind v : values()) {
+            if (v.value.equals(value)) return v;
+        }
+        throw new IllegalArgumentException("Unknown McpDiagnosticKind value: " + value);
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticSourceConfiguration.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticSourceConfiguration.java
new file mode 100644
index 0000000000..be20b77e98
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpDiagnosticSourceConfiguration.java
@@ -0,0 +1,27 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * MCP diagnostic source configuration.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record McpDiagnosticSourceConfiguration(
+    /** Threshold to apply to MCP diagnostic producers in this session. */
+    @JsonProperty("level") DiagnosticLogLevel level
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpExecuteSamplingResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpExecuteSamplingResult.java
index 18a838d30c..07b07ab376 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpExecuteSamplingResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/McpExecuteSamplingResult.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * MCP CreateMessageResult payload (with optional 'tools' extension), present when action='success'. Treated as opaque at the schema layer; consumers should construct/consume it per the MCP CreateMessageResult shape.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ModelSwitchAutoTierStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ModelSwitchAutoTierStatus.java
index e4a1baed5e..f3f607dbfd 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ModelSwitchAutoTierStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ModelSwitchAutoTierStatus.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Whether the requested preference was already effective or was accepted for later transactional activation.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum ModelSwitchAutoTierStatus {
     /** The {@code unchanged} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/OpenCanvasInstance.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/OpenCanvasInstance.java
index f38ba82c4f..d84108e62b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/OpenCanvasInstance.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/OpenCanvasInstance.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Open canvas instance snapshot.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionMode.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionMode.java
index 1f4ea9b6bc..ddbd006872 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionMode.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionMode.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Current or requested permission mode.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum PermissionMode {
     /** The {@code manual} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionModeSource.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionModeSource.java
index 107ac3f6d9..52f3e6cea3 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionModeSource.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/PermissionModeSource.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Optional source for permission-mode telemetry. Defaults to `rpc` when omitted for SDK callers.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum PermissionModeSource {
     /** The {@code cli_flag} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProtocolExternalToolDefer.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProtocolExternalToolDefer.java
index 58f1ec24d5..0129cf4091 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProtocolExternalToolDefer.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProtocolExternalToolDefer.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Controls whether the runtime may defer loading an external tool definition.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum ProtocolExternalToolDefer {
     /** The {@code auto} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProtocolExternalToolDefinition.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProtocolExternalToolDefinition.java
index 5e7095700c..27d0c23a9b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProtocolExternalToolDefinition.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProtocolExternalToolDefinition.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.Map;
 import javax.annotation.processing.Generated;
 
 /**
  * Serializable definition of a caller-implemented tool whose execution is handled over the SDK connection.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProviderConfig.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProviderConfig.java
index 25cc365ab0..22c7414996 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProviderConfig.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ProviderConfig.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.Map;
 import javax.annotation.processing.Generated;
 
 /**
  * Custom model-provider configuration (BYOK).
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/QueuePendingItems.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/QueuePendingItems.java
index f815f565f5..40c3f8a8c6 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/QueuePendingItems.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/QueuePendingItems.java
@@ -30,6 +30,8 @@ public record QueuePendingItems(
     /** Human-readable text to display for this queue entry in the UI */
     @JsonProperty("displayText") String displayText,
     /** Agent mode stored on this queued entry, as stamped when it was enqueued. Items without an explicit mode report interactive. This is not necessarily the mode that will constrain the turn: a plan or autopilot session applies its own write gate, continuation loop and permission posture to every drained item regardless of the mode stored here. */
-    @JsonProperty("agentMode") SendAgentMode agentMode
+    @JsonProperty("agentMode") SendAgentMode agentMode,
+    /** Optional source tag associated with this pending queue entry. This is an open string, not authenticated authorship. In particular, `user` does not prove that a person typed the message. If the source is absent or unrecognized, consumers must not infer human or agent authorship and should handle the entry neutrally. Consumers should tolerate future source values. */
+    @JsonProperty("source") String source
 ) {
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/RunOptions.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/RunOptions.java
index 11ac51827a..ae535af8cf 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/RunOptions.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/RunOptions.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Options controlling factory invocation.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxConfig.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxConfig.java
index dd522f7a34..0b02851782 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxConfig.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxConfig.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Resolved sandbox configuration.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxGetHostSupportResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxGetHostSupportResult.java
new file mode 100644
index 0000000000..d6f1413882
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxGetHostSupportResult.java
@@ -0,0 +1,35 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SandboxGetHostSupportResult(
+    /** Whether a process-containment backend is usable on this host: Seatbelt on macOS, Bubblewrap on Linux, or ProcessContainer on Windows. */
+    @JsonProperty("supported") Boolean supported,
+    /** Human-readable reason the sandbox cannot run on this host. Present only when `supported` is false. */
+    @JsonProperty("reason") String reason,
+    /** Sandbox policy features whose availability varies between hosts that can run the backend. Empty when `supported` is false, because no feature can run without a backend. Later runtimes can add entries; ignore an entry whose `name` you do not recognize. */
+    @JsonProperty("capabilities") List<SandboxHostCapability> capabilities
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxHostCapability.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxHostCapability.java
new file mode 100644
index 0000000000..000628e137
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SandboxHostCapability.java
@@ -0,0 +1,31 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import javax.annotation.processing.Generated;
+
+/**
+ * Whether this host can run one sandbox policy feature. A session whose effective policy uses an unsupported feature fails each sandboxed command with `reason`.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SandboxHostCapability(
+    /** The policy feature, as an extensible string: ignore names you do not recognize. Known values: `network` (sandboxed commands can reach the network; on Linux this needs the tooling for Bubblewrap's private network namespace, such as slirp4netns), `network_filtering` (host rules and the sandbox proxy; on Linux this needs the same tooling as `network`; on Windows it needs Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set `network.allowLocalNetwork`), `denied_paths` (native enforcement of `filesystem.deniedPaths`), and `shell` (shell commands inside the sandbox; on Windows this needs Process Security Environment 1.1 filesystem enumeration support). */
+    @JsonProperty("name") String name,
+    /** Whether this host can run the feature. */
+    @JsonProperty("supported") Boolean supported,
+    /** Human-readable reason and remedy when the feature is unsupported, such as a package to install or an OS update. Present only when `supported` is false. */
+    @JsonProperty("reason") String reason
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerRpc.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerRpc.java
index caa7f92d07..05e6347107 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerRpc.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerRpc.java
@@ -29,6 +29,8 @@ public final class ServerRpc {
     public final ServerHooksApi hooks;
     /** API methods for the {@code models} namespace. */
     public final ServerModelsApi models;
+    /** API methods for the {@code sandbox} namespace. */
+    public final ServerSandboxApi sandbox;
     /** API methods for the {@code tools} namespace. */
     public final ServerToolsApi tools;
     /** API methods for the {@code account} namespace. */
@@ -75,6 +77,7 @@ public ServerRpc(RpcCaller caller) {
         this.caller = caller;
         this.hooks = new ServerHooksApi(caller);
         this.models = new ServerModelsApi(caller);
+        this.sandbox = new ServerSandboxApi(caller);
         this.tools = new ServerToolsApi(caller);
         this.account = new ServerAccountApi(caller);
         this.secrets = new ServerSecretsApi(caller);
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerSandboxApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerSandboxApi.java
new file mode 100644
index 0000000000..9c33cda35c
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ServerSandboxApi.java
@@ -0,0 +1,40 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.github.copilot.CopilotExperimental;
+import java.util.concurrent.CompletableFuture;
+import javax.annotation.processing.Generated;
+
+/**
+ * API methods for the {@code sandbox} namespace.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class ServerSandboxApi {
+
+    private final RpcCaller caller;
+
+    /** @param caller the RPC transport function */
+    ServerSandboxApi(RpcCaller caller) {
+        this.caller = caller;
+    }
+
+    /**
+     * Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package.
+     *
+     * @apiNote This method is experimental and may change in a future version.
+     * @since 1.0.0
+     */
+    @CopilotExperimental
+    public CompletableFuture<SandboxGetHostSupportResult> getHostSupport() {
+        return caller.invoke("sandbox.getHostSupport", java.util.Map.of(), SandboxGetHostSupportResult.class);
+    }
+
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionCustomizationsApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionCustomizationsApi.java
new file mode 100644
index 0000000000..18d27db9b5
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionCustomizationsApi.java
@@ -0,0 +1,42 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.github.copilot.CopilotExperimental;
+import java.util.concurrent.CompletableFuture;
+import javax.annotation.processing.Generated;
+
+/**
+ * API methods for the {@code customizations} namespace.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class SessionCustomizationsApi {
+
+    private final RpcCaller caller;
+    private final String sessionId;
+
+    /** @param caller the RPC transport function */
+    SessionCustomizationsApi(RpcCaller caller, String sessionId) {
+        this.caller = caller;
+        this.sessionId = sessionId;
+    }
+
+    /**
+     * Identifies the target session.
+     *
+     * @apiNote This method is experimental and may change in a future version.
+     * @since 1.0.0
+     */
+    @CopilotExperimental
+    public CompletableFuture<SessionCustomizationsReloadResult> reload() {
+        return caller.invoke("session.customizations.reload", java.util.Map.of("sessionId", this.sessionId), SessionCustomizationsReloadResult.class);
+    }
+
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionCustomizationsReloadParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionCustomizationsReloadParams.java
new file mode 100644
index 0000000000..372ede1383
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionCustomizationsReloadParams.java
@@ -0,0 +1,30 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import javax.annotation.processing.Generated;
+
+/**
+ * Identifies the target session.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SessionCustomizationsReloadParams(
+    /** Target session identifier */
+    @JsonProperty("sessionId") String sessionId
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionCustomizationsReloadResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionCustomizationsReloadResult.java
new file mode 100644
index 0000000000..5f6fa34306
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionCustomizationsReloadResult.java
@@ -0,0 +1,33 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * Diagnostics from reloading skill definitions, with warnings and errors as separate lists.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SessionCustomizationsReloadResult(
+    /** Warnings emitted while loading skills (e.g. skills that loaded but had issues) */
+    @JsonProperty("warnings") List<String> warnings,
+    /** Errors emitted while loading skills (e.g. skills that failed to load entirely) */
+    @JsonProperty("errors") List<String> errors
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsApi.java
new file mode 100644
index 0000000000..af4c57837b
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsApi.java
@@ -0,0 +1,65 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.github.copilot.CopilotExperimental;
+import java.util.concurrent.CompletableFuture;
+import javax.annotation.processing.Generated;
+
+/**
+ * API methods for the {@code diagnostics} namespace.
+ *
+ * @since 1.0.0
+ */
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+public final class SessionDiagnosticsApi {
+
+    private static final com.fasterxml.jackson.databind.ObjectMapper MAPPER = RpcMapper.INSTANCE;
+
+    private final RpcCaller caller;
+    private final String sessionId;
+
+    /** @param caller the RPC transport function */
+    SessionDiagnosticsApi(RpcCaller caller, String sessionId) {
+        this.caller = caller;
+        this.sessionId = sessionId;
+    }
+
+    /**
+     * Patch session diagnostic thresholds for explicitly supplied sources.
+     * <p>
+     * Note: the {@code sessionId} field in the params record is overridden
+     * by the session-scoped wrapper; any value provided is ignored.
+     *
+     * @apiNote This method is experimental and may change in a future version.
+     * @since 1.0.0
+     */
+    @CopilotExperimental
+    public CompletableFuture<SessionDiagnosticsConfigureResult> configure(SessionDiagnosticsConfigureParams params) {
+        com.fasterxml.jackson.databind.node.ObjectNode _p = MAPPER.valueToTree(params);
+        _p.put("sessionId", this.sessionId);
+        return caller.invoke("session.diagnostics.configure", _p, SessionDiagnosticsConfigureResult.class);
+    }
+
+    /**
+     * Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the default waitMs is zero (maximum 30000).
+     * <p>
+     * Note: the {@code sessionId} field in the params record is overridden
+     * by the session-scoped wrapper; any value provided is ignored.
+     *
+     * @apiNote This method is experimental and may change in a future version.
+     * @since 1.0.0
+     */
+    @CopilotExperimental
+    public CompletableFuture<SessionDiagnosticsReadResult> read(SessionDiagnosticsReadParams params) {
+        com.fasterxml.jackson.databind.node.ObjectNode _p = MAPPER.valueToTree(params);
+        _p.put("sessionId", this.sessionId);
+        return caller.invoke("session.diagnostics.read", _p, SessionDiagnosticsReadResult.class);
+    }
+
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsConfigureParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsConfigureParams.java
new file mode 100644
index 0000000000..0c38e08c4f
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsConfigureParams.java
@@ -0,0 +1,32 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import javax.annotation.processing.Generated;
+
+/**
+ * Patch session diagnostic thresholds for explicitly supplied sources.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SessionDiagnosticsConfigureParams(
+    /** Target session identifier */
+    @JsonProperty("sessionId") String sessionId,
+    /** Sources to configure. At least one supported source must be supplied. */
+    @JsonProperty("sources") DiagnosticSourcesConfiguration sources
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsConfigureResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsConfigureResult.java
new file mode 100644
index 0000000000..602b44ccf5
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsConfigureResult.java
@@ -0,0 +1,30 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import javax.annotation.processing.Generated;
+
+/**
+ * Per-source session diagnostics configuration.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SessionDiagnosticsConfigureResult(
+    /** Diagnostic thresholds keyed by supported source. */
+    @JsonProperty("sources") DiagnosticSourcesConfiguration sources
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsReadParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsReadParams.java
new file mode 100644
index 0000000000..c76ca16f88
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsReadParams.java
@@ -0,0 +1,39 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the default waitMs is zero (maximum 30000).
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SessionDiagnosticsReadParams(
+    /** Target session identifier */
+    @JsonProperty("sessionId") String sessionId,
+    /** Nonempty selection of sources to read. Each source may be listed once. */
+    @JsonProperty("sources") List<DiagnosticSource> sources,
+    /** Opaque cursor returned by an earlier read. Omit to start at the oldest retained record. */
+    @JsonProperty("cursor") String cursor,
+    /** Maximum number of records to return, from 1 through 500. Omit for 100. */
+    @JsonProperty("max") Long max,
+    /** Maximum time in milliseconds to wait for a new record, from 0 through 30000. */
+    @JsonProperty("waitMs") Long waitMs
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsReadResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsReadResult.java
new file mode 100644
index 0000000000..280f8b3f4c
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionDiagnosticsReadResult.java
@@ -0,0 +1,61 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import java.util.List;
+import javax.annotation.processing.Generated;
+
+/**
+ * One cursor-addressed page of retained session diagnostics.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SessionDiagnosticsReadResult(
+    /** Retained records beginning at the requested cursor. */
+    @JsonProperty("entries") List<SessionDiagnosticsReadResultEntriesItem> entries,
+    /** Opaque cursor for the next independent read. */
+    @JsonProperty("cursor") String cursor,
+    /** Whether the requested cursor remained within the retained buffer window. */
+    @JsonProperty("cursorStatus") DiagnosticCursorStatus cursorStatus,
+    /** Number of records lost before this page when known. Omitted when a buffer generation change makes the count unknowable. */
+    @JsonProperty("droppedCount") Long droppedCount,
+    /** Whether additional retained records follow this page. */
+    @JsonProperty("hasMore") Boolean hasMore
+) {
+
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public record SessionDiagnosticsReadResultEntriesItem(
+        /** UTC RFC 3339 timestamp captured at the diagnostic source. */
+        @JsonProperty("timestamp") String timestamp,
+        /** Severity of this emitted diagnostic record. */
+        @JsonProperty("level") DiagnosticSeverity level,
+        /** Agent identifier for a subagent host. Omitted for the root agent. */
+        @JsonProperty("agentId") String agentId,
+        /** Human-readable diagnostic summary. */
+        @JsonProperty("message") String message,
+        /** Whether message or data was truncated to the record-size bound. */
+        @JsonProperty("truncated") Boolean truncated,
+        /** Original byte count when a known-size message or data value was truncated. */
+        @JsonProperty("originalBytes") Long originalBytes,
+        /** Typed MCP diagnostic detail. */
+        @JsonProperty("details") McpDiagnosticDetails details,
+        /** Diagnostic source identifying the typed details payload. */
+        @JsonProperty("source") String source
+    ) {
+    }
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFsSqliteTransactionError.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFsSqliteTransactionError.java
index e25eaed867..6fb780a3aa 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFsSqliteTransactionError.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFsSqliteTransactionError.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Classified SQLite transaction failure. busyOrLocked guarantees rollback; postCommitAmbiguous must never be retried.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFsSqliteTransactionStatement.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFsSqliteTransactionStatement.java
index f56f268ba1..2d21d0a52c 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFsSqliteTransactionStatement.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionFsSqliteTransactionStatement.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.Map;
 import javax.annotation.processing.Generated;
 
 /**
  * One statement in an atomic SQLite transaction.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionInstructionsApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionInstructionsApi.java
index 92490f8639..d5971f70fe 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionInstructionsApi.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionInstructionsApi.java
@@ -39,4 +39,15 @@ public CompletableFuture<SessionInstructionsGetSourcesResult> getSources() {
         return caller.invoke("session.instructions.getSources", java.util.Map.of("sessionId", this.sessionId), SessionInstructionsGetSourcesResult.class);
     }
 
+    /**
+     * Identifies the target session.
+     *
+     * @apiNote This method is experimental and may change in a future version.
+     * @since 1.0.0
+     */
+    @CopilotExperimental
+    public CompletableFuture<Void> reload() {
+        return caller.invoke("session.instructions.reload", java.util.Map.of("sessionId", this.sessionId), Void.class);
+    }
+
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionInstructionsReloadParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionInstructionsReloadParams.java
new file mode 100644
index 0000000000..7186854ea8
--- /dev/null
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionInstructionsReloadParams.java
@@ -0,0 +1,30 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+// AUTO-GENERATED FILE - DO NOT EDIT
+// Generated from: api.schema.json
+
+package com.github.copilot.generated.rpc;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
+import javax.annotation.processing.Generated;
+
+/**
+ * Identifies the target session.
+ *
+ * @apiNote This method is experimental and may change in a future version.
+ * @since 1.0.0
+ */
+@CopilotExperimental
+@javax.annotation.processing.Generated("copilot-sdk-codegen")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+public record SessionInstructionsReloadParams(
+    /** Target session identifier */
+    @JsonProperty("sessionId") String sessionId
+) {
+}
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueApi.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueApi.java
index 9b8f333825..5e6d67690c 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueApi.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueApi.java
@@ -117,7 +117,7 @@ public CompletableFuture<SessionQueueUpdateTextResult> updateText(SessionQueueUp
     }
 
     /**
-     * Conditional withdrawal of a single user message, before the runtime claims it for delivery.
+     * Conditional withdrawal of a single user message, from its queue or from the running turn it started.
      * <p>
      * Note: the {@code sessionId} field in the params record is overridden
      * by the session-scoped wrapper; any value provided is ignored.
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueuePendingItemsResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueuePendingItemsResult.java
index a74d54e245..ea93bacb84 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueuePendingItemsResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueuePendingItemsResult.java
@@ -30,6 +30,8 @@ public record SessionQueuePendingItemsResult(
     /** Display text for messages currently in the immediate steering queue (interjections sent during a running turn). */
     @JsonProperty("steeringMessages") List<String> steeringMessages,
     /** How many leading entries of `steeringMessages` have already been folded into the running turn (and so have an emitted `user.message`), as opposed to still waiting for one. Absent for hosts that do not distinguish the two. */
-    @JsonProperty("inFlightSteeringCount") Long inFlightSteeringCount
+    @JsonProperty("inFlightSteeringCount") Long inFlightSteeringCount,
+    /** ID of the running turn's user message while the model has not answered it, so `withdrawMessage` can still take it back once nothing sent after it is pending. A message leaves `items` when its turn starts, before its `user.message` is recorded; this tells that message apart from one that was removed. Absent when no turn prompt can be taken back. */
+    @JsonProperty("withdrawableTurnMessageId") String withdrawableTurnMessageId
 ) {
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueWithdrawMessageParams.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueWithdrawMessageParams.java
index 3f90ba10c4..e2c7fa62c1 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueWithdrawMessageParams.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueWithdrawMessageParams.java
@@ -14,7 +14,7 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Conditional withdrawal of a single user message, before the runtime claims it for delivery.
+ * Conditional withdrawal of a single user message, from its queue or from the running turn it started.
  *
  * @apiNote This method is experimental and may change in a future version.
  * @since 1.0.0
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueWithdrawMessageResult.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueWithdrawMessageResult.java
index 2208472b94..32d4b6d3ca 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueWithdrawMessageResult.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionQueueWithdrawMessageResult.java
@@ -14,7 +14,7 @@
 import javax.annotation.processing.Generated;
 
 /**
- * Result of removing a queued item.
+ * Result of withdrawing a user message.
  *
  * @apiNote This method is experimental and may change in a future version.
  * @since 1.0.0
@@ -24,7 +24,9 @@
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
 public record SessionQueueWithdrawMessageResult(
-    /** True when the addressed item was removed. */
-    @JsonProperty("removed") Boolean removed
+    /** True when the message left the queue or, for a running turn, history. */
+    @JsonProperty("removed") Boolean removed,
+    /** True when the running turn was interrupted to withdraw the message. With removed false, the turn was interrupted but its events could not be removed, for example because the model answered first, so the message stays in the interrupted turn. */
+    @JsonProperty("interrupted") Boolean interrupted
 ) {
 }
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionRpc.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionRpc.java
index ceb0993c66..5f3f359551 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionRpc.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/SessionRpc.java
@@ -57,6 +57,8 @@ public final class SessionRpc {
     public final SessionCompletionsApi completions;
     /** API methods for the {@code instructions} namespace. */
     public final SessionInstructionsApi instructions;
+    /** API methods for the {@code customizations} namespace. */
+    public final SessionCustomizationsApi customizations;
     /** API methods for the {@code fleet} namespace. */
     public final SessionFleetApi fleet;
     /** API methods for the {@code agent} namespace. */
@@ -67,6 +69,8 @@ public final class SessionRpc {
     public final SessionSkillsApi skills;
     /** API methods for the {@code mcp} namespace. */
     public final SessionMcpApi mcp;
+    /** API methods for the {@code diagnostics} namespace. */
+    public final SessionDiagnosticsApi diagnostics;
     /** API methods for the {@code connectors} namespace. */
     public final SessionConnectorsApi connectors;
     /** API methods for the {@code managedSettings} namespace. */
@@ -139,11 +143,13 @@ public SessionRpc(RpcCaller caller, String sessionId) {
         this.autopilotObjective = new SessionAutopilotObjectiveApi(caller, sessionId);
         this.completions = new SessionCompletionsApi(caller, sessionId);
         this.instructions = new SessionInstructionsApi(caller, sessionId);
+        this.customizations = new SessionCustomizationsApi(caller, sessionId);
         this.fleet = new SessionFleetApi(caller, sessionId);
         this.agent = new SessionAgentApi(caller, sessionId);
         this.tasks = new SessionTasksApi(caller, sessionId);
         this.skills = new SessionSkillsApi(caller, sessionId);
         this.mcp = new SessionMcpApi(caller, sessionId);
+        this.diagnostics = new SessionDiagnosticsApi(caller, sessionId);
         this.connectors = new SessionConnectorsApi(caller, sessionId);
         this.managedSettings = new SessionManagedSettingsApi(caller, sessionId);
         this.plugins = new SessionPluginsApi(caller, sessionId);
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ShellCredentials.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ShellCredentials.java
index 53567c98db..01251b5a13 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ShellCredentials.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ShellCredentials.java
@@ -10,6 +10,7 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
@@ -30,9 +31,12 @@ retained between spawns, replacing the session credential (`session.gitHubAuth.s
 presents, not about what the agent may touch, and it works on every platform whether or not
 an OS sandboxing backend is available. `sandboxConfig.auth` remains the sandbox-scoped
 spelling and is additive with this one.
+ *
+ * @apiNote This type is experimental and may change in a future version.
  *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/TaskBlocker.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/TaskBlocker.java
index c54d63865d..bc61d79fa0 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/TaskBlocker.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/TaskBlocker.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Structured reason that the task cannot continue without intervention
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultExpanded.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultExpanded.java
index 47527cfec8..db2160eecb 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultExpanded.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultExpanded.java
@@ -10,6 +10,7 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import java.util.Map;
 import javax.annotation.processing.Generated;
@@ -17,8 +18,11 @@
 /**
  * Expanded canonical result returned by a session tool.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultNewMessage.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultNewMessage.java
index da203a0e98..59cc14d57a 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultNewMessage.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultNewMessage.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * A message injected by a tool result.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultType.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultType.java
index bc3b5ae2ac..5b045c5f56 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultType.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/ToolResultType.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Execution outcome classification.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum ToolResultType {
     /** The {@code success} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowAgentOptions.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowAgentOptions.java
index d3774baf0c..4287f6016b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowAgentOptions.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowAgentOptions.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Options for one workflow-scoped subagent call.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowAgentSummary.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowAgentSummary.java
index 17546d7c57..f486169cee 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowAgentSummary.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowAgentSummary.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Prompt-safe durable identity and live status for a direct workflow agent.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowCurrentPhase.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowCurrentPhase.java
index d89ec13e47..420a08e491 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowCurrentPhase.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowCurrentPhase.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Current workflow phase identity.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowDeclaredLimits.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowDeclaredLimits.java
index d5caca470a..c211952f22 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowDeclaredLimits.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowDeclaredLimits.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Declared or approved workflow resource ceilings.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowLogLine.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowLogLine.java
index 3338b9670f..d83d88bde8 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowLogLine.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowLogLine.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * One ordered workflow progress line.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowPhaseObservation.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowPhaseObservation.java
index 1848365d8e..ad1f8dc888 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowPhaseObservation.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowPhaseObservation.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Durable lifecycle and timing for one workflow phase.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowPhaseStatus.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowPhaseStatus.java
index 9029a3f410..5fc22b716b 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowPhaseStatus.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowPhaseStatus.java
@@ -7,13 +7,17 @@
 
 package com.github.copilot.generated.rpc;
 
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Derived lifecycle state of a workflow phase.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 public enum WorkflowPhaseStatus {
     /** The {@code pending} variant. */
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowProgressLine.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowProgressLine.java
index bed10aebe1..df06764ba6 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowProgressLine.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowProgressLine.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * One durable workflow progress record.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowProgressPage.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowProgressPage.java
index 733c0cfb86..fc18be0b47 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowProgressPage.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowProgressPage.java
@@ -10,14 +10,18 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import java.util.List;
 import javax.annotation.processing.Generated;
 
 /**
  * A bidirectional page of workflow progress.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunConsumed.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunConsumed.java
index db72711af2..4da97259b7 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunConsumed.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunConsumed.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Durable workflow resource consumption.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunLimits.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunLimits.java
index 1bdf9dc877..d4578878d1 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunLimits.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunLimits.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Wire-only per-invocation workflow resource ceiling overrides.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunOptions.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunOptions.java
index 2ab3115d4a..f57fd13760 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunOptions.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunOptions.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Options controlling workflow invocation.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunSummary.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunSummary.java
index 6c0288d616..8ad1bfecac 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunSummary.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunSummary.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Durable workflow run summary with read-time live overlays.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunTerminal.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunTerminal.java
index 6563df4001..055cb4f358 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunTerminal.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowRunTerminal.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Prompt-safe terminal workflow outcome.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowToolRunOptions.java b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowToolRunOptions.java
index a14a606554..3a0f5099cf 100644
--- a/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowToolRunOptions.java
+++ b/java/sdk/src/generated/java/com/github/copilot/generated/rpc/WorkflowToolRunOptions.java
@@ -10,13 +10,17 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.github.copilot.CopilotExperimental;
 import javax.annotation.processing.Generated;
 
 /**
  * Options for an internal tool-originated workflow invocation.
  *
+ * @apiNote This type is experimental and may change in a future version.
+ *
  * @since 1.0.0
  */
+@CopilotExperimental
 @javax.annotation.processing.Generated("copilot-sdk-codegen")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 @JsonIgnoreProperties(ignoreUnknown = true)
diff --git a/java/sdk/src/main/java/com/github/copilot/CopilotSession.java b/java/sdk/src/main/java/com/github/copilot/CopilotSession.java
index 12662bfa95..eac5d9763c 100644
--- a/java/sdk/src/main/java/com/github/copilot/CopilotSession.java
+++ b/java/sdk/src/main/java/com/github/copilot/CopilotSession.java
@@ -13,6 +13,7 @@
 import java.util.Set;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.CopyOnWriteArraySet;
 import java.util.concurrent.Executor;
 import java.util.concurrent.RejectedExecutionException;
 import java.util.concurrent.ScheduledExecutorService;
@@ -188,7 +189,7 @@ public final class CopilotSession implements AutoCloseable {
     private final SessionUiApi ui;
     private final JsonRpcClient rpc;
     private volatile SessionRpc sessionRpc;
-    private final Set<Consumer<SessionEvent>> eventHandlers = ConcurrentHashMap.newKeySet();
+    private final Set<Consumer<SessionEvent>> eventHandlers = new CopyOnWriteArraySet<>();
     private final Map<String, ToolDefinition> toolHandlers = new ConcurrentHashMap<>();
     private final Map<String, PendingExternalTool> pendingExternalTools = new ConcurrentHashMap<>();
     private boolean externalToolsClosed;
@@ -586,6 +587,11 @@ public CompletableFuture<String> send(MessageOptions options) {
      * the future completes with {@link java.util.concurrent.CancellationException}.
      * If the timeout expires first, the future completes exceptionally with a
      * {@link TimeoutException}.
+     * <p>
+     * Sub-agent events with a non-empty agentId remain visible to subscribers but
+     * cannot complete this wait or supply its reply. Synchronous listeners
+     * registered before this call finish processing the root idle event before this
+     * wait completes.
      *
      * @param options
      *            the message options containing the prompt and attachments
@@ -611,6 +617,8 @@ public CompletableFuture<AssistantMessageEvent> sendAndWait(MessageOptions optio
         var firstAssistantMessageLogged = new java.util.concurrent.atomic.AtomicBoolean(false);
 
         Consumer<SessionEvent> handler = evt -> {
+            if (evt.getAgentId() != null && !evt.getAgentId().isEmpty())
+                return;
             if (evt instanceof AssistantMessageEvent msg) {
                 lastAssistantMessage.set(msg);
                 if (firstAssistantMessageLogged.compareAndSet(false, true)) {
@@ -667,15 +675,8 @@ public CompletableFuture<AssistantMessageEvent> sendAndWait(MessageOptions optio
             }
         }
 
-        // When inner future completes, run cleanup and propagate to result.
-        // Use whenCompleteAsync so that result.complete(r) is not called
-        // synchronously on the event-dispatch thread while dispatchEvent() is
-        // still iterating over handlers. Without async dispatch, a caller that
-        // registered its own session.on() listener before calling sendAndWait()
-        // could see its listener invoked *after* result.get() returned, because
-        // sendAndWait's internal handler would complete the future mid-loop. By
-        // submitting the completion to timeoutScheduler we allow the current
-        // dispatch loop to finish calling all other handlers first.
+        // Keep completion continuations off the event-dispatch thread. The ordered
+        // handler set, not this executor hop, ensures earlier listeners finish first.
         final ScheduledFuture<?> taskToCancel = timeoutTask;
         future.whenCompleteAsync((r, ex) -> {
             try {
diff --git a/java/sdk/src/main/java/com/github/copilot/JsonRpcClient.java b/java/sdk/src/main/java/com/github/copilot/JsonRpcClient.java
index 2258963b14..fc10946829 100644
--- a/java/sdk/src/main/java/com/github/copilot/JsonRpcClient.java
+++ b/java/sdk/src/main/java/com/github/copilot/JsonRpcClient.java
@@ -385,7 +385,8 @@ private void handleMessage(String content) {
                                 ? errorNode.get("message").asText()
                                 : "Unknown error";
                         int errorCode = errorNode.has("code") ? errorNode.get("code").asInt() : -1;
-                        future.completeExceptionally(new JsonRpcException(errorCode, errorMessage));
+                        future.completeExceptionally(
+                                new JsonRpcException(errorCode, errorMessage, errorNode.get("data")));
                     } else {
                         future.complete(node.get("result"));
                     }
diff --git a/java/sdk/src/main/java/com/github/copilot/JsonRpcException.java b/java/sdk/src/main/java/com/github/copilot/JsonRpcException.java
index 1786466bdd..ea501b25fd 100644
--- a/java/sdk/src/main/java/com/github/copilot/JsonRpcException.java
+++ b/java/sdk/src/main/java/com/github/copilot/JsonRpcException.java
@@ -4,18 +4,29 @@
 
 package com.github.copilot;
 
+import com.fasterxml.jackson.databind.JsonNode;
+
 /**
  * Exception thrown when a JSON-RPC error occurs during communication with the
  * Copilot CLI server.
  * <p>
  * This exception wraps error responses from the JSON-RPC protocol, including
- * the error code and message returned by the server.
+ * the error code, message, and optional raw JSON data returned by the server.
+ * Calls to {@link java.util.concurrent.CompletableFuture#get()} wrap this
+ * exception in an {@link java.util.concurrent.ExecutionException}; calls to
+ * {@link java.util.concurrent.CompletableFuture#join()} wrap it in a
+ * {@link java.util.concurrent.CompletionException}.
  *
- * @since 1.0.0
+ * @since 1.0.15-preview.1
  */
-final class JsonRpcException extends RuntimeException {
+public final class JsonRpcException extends RuntimeException {
+
+    // Preserve exceptions serialized before this class became public and gained
+    // data.
+    private static final long serialVersionUID = -2127886082879272410L;
 
     private final int code;
+    private final JsonNode data;
 
     /**
      * Creates a new JSON-RPC exception.
@@ -26,8 +37,26 @@ final class JsonRpcException extends RuntimeException {
      *            the error message from the server
      */
     public JsonRpcException(int code, String message) {
+        this(code, message, null);
+    }
+
+    /**
+     * Creates a new JSON-RPC exception with optional raw JSON error data.
+     *
+     * @param code
+     *            the JSON-RPC error code
+     * @param message
+     *            the error message from the server
+     * @param data
+     *            the error data, or {@code null} if omitted; a JSON null is
+     *            represented by a
+     *            {@link com.fasterxml.jackson.databind.node.NullNode}
+     * @since 1.0.15-preview.1
+     */
+    public JsonRpcException(int code, String message, JsonNode data) {
         super(message);
         this.code = code;
+        this.data = data;
     }
 
     /**
@@ -47,4 +76,21 @@ public JsonRpcException(int code, String message) {
     public int getCode() {
         return code;
     }
+
+    /**
+     * Returns the raw JSON error data without converting its value or shape.
+     * <p>
+     * An omitted data member is represented by Java {@code null}. An explicit JSON
+     * null is represented by a
+     * {@link com.fasterxml.jackson.databind.node.NullNode}. This value is not
+     * included in the exception's message or string representation. The node is
+     * shared, not defensively copied; callers that modify container nodes should
+     * first use {@link JsonNode#deepCopy()}.
+     *
+     * @return the error data, or {@code null} if the server omitted it
+     * @since 1.0.15-preview.1
+     */
+    public JsonNode getData() {
+        return data;
+    }
 }
diff --git a/java/sdk/src/main/java/com/github/copilot/SessionRequestBuilder.java b/java/sdk/src/main/java/com/github/copilot/SessionRequestBuilder.java
index b336e70472..04e3a48792 100644
--- a/java/sdk/src/main/java/com/github/copilot/SessionRequestBuilder.java
+++ b/java/sdk/src/main/java/com/github/copilot/SessionRequestBuilder.java
@@ -148,6 +148,7 @@ static CreateSessionRequest buildCreateRequest(SessionConfig config, String sess
         }
         config.getIncludeSubAgentStreamingEvents().ifPresent(request::setIncludeSubAgentStreamingEvents);
         request.setMcpServers(config.getMcpServers());
+        request.setDiagnostics(config.getDiagnostics());
         request.setMcpOAuthTokenStorage(config.getMcpOAuthTokenStorage());
         request.setAuthClientIdMetadataUrl(config.getAuthClientIdMetadataUrl());
         request.setCustomAgents(config.getCustomAgents());
@@ -171,6 +172,7 @@ static CreateSessionRequest buildCreateRequest(SessionConfig config, String sess
             request.setOrganizationCustomInstructions(config.getOrganizationCustomInstructions());
         }
         config.getEnableOnDemandInstructionDiscovery().ifPresent(request::setEnableOnDemandInstructionDiscovery);
+        config.getRefreshCustomInstructions().ifPresent(request::setRefreshCustomInstructions);
         config.getEnableFileHooks().ifPresent(request::setEnableFileHooks);
         config.getEnableHostGitOperations().ifPresent(request::setEnableHostGitOperations);
         config.getEnableSessionStore().ifPresent(request::setEnableSessionStore);
@@ -304,6 +306,7 @@ static ResumeSessionRequest buildResumeRequest(String sessionId, ResumeSessionCo
         }
         config.getIncludeSubAgentStreamingEvents().ifPresent(request::setIncludeSubAgentStreamingEvents);
         request.setMcpServers(config.getMcpServers());
+        request.setDiagnostics(config.getDiagnostics());
         request.setMcpOAuthTokenStorage(config.getMcpOAuthTokenStorage());
         request.setAuthClientIdMetadataUrl(config.getAuthClientIdMetadataUrl());
         request.setCustomAgents(config.getCustomAgents());
diff --git a/java/sdk/src/main/java/com/github/copilot/rpc/CreateSessionRequest.java b/java/sdk/src/main/java/com/github/copilot/rpc/CreateSessionRequest.java
index b7fc219258..d8ab62af95 100644
--- a/java/sdk/src/main/java/com/github/copilot/rpc/CreateSessionRequest.java
+++ b/java/sdk/src/main/java/com/github/copilot/rpc/CreateSessionRequest.java
@@ -12,6 +12,7 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 
 import com.github.copilot.CopilotExperimental;
+import com.github.copilot.generated.rpc.DiagnosticsConfiguration;
 import com.github.copilot.generated.rpc.SessionLimitsConfig;
 
 /**
@@ -119,6 +120,9 @@ public final class CreateSessionRequest {
     @JsonProperty("mcpOAuthTokenStorage")
     private String mcpOAuthTokenStorage;
 
+    @JsonProperty("diagnostics")
+    private DiagnosticsConfiguration diagnostics;
+
     @JsonProperty("authClientIdMetadataUrl")
     private String authClientIdMetadataUrl;
 
@@ -182,6 +186,9 @@ public final class CreateSessionRequest {
     @JsonInclude(JsonInclude.Include.NON_NULL)
     private Boolean enableOnDemandInstructionDiscovery;
 
+    @JsonProperty("refreshCustomInstructions")
+    private Boolean refreshCustomInstructions;
+
     @JsonProperty("enableFileHooks")
     @JsonInclude(JsonInclude.Include.NON_NULL)
     private Boolean enableFileHooks;
@@ -599,6 +606,19 @@ public String getMcpOAuthTokenStorage() {
         return mcpOAuthTokenStorage;
     }
 
+    /**
+     * Gets the diagnostics configuration. @return the level, or {@code null} when
+     * unset
+     */
+    public DiagnosticsConfiguration getDiagnostics() {
+        return diagnostics;
+    }
+
+    /** Sets the diagnostics configuration. @param diagnostics the level */
+    public void setDiagnostics(DiagnosticsConfiguration diagnostics) {
+        this.diagnostics = diagnostics;
+    }
+
     /**
      * Sets MCP OAuth token storage mode. @param mcpOAuthTokenStorage the storage
      * mode
@@ -846,6 +866,31 @@ public void clearEnableOnDemandInstructionDiscovery() {
         this.enableOnDemandInstructionDiscovery = null;
     }
 
+    /**
+     * Gets the instruction discovery cache invalidation flag.
+     *
+     * @return the flag
+     */
+    public Boolean getRefreshCustomInstructions() {
+        return refreshCustomInstructions;
+    }
+
+    /**
+     * Sets the instruction discovery cache invalidation flag.
+     *
+     * @param refreshCustomInstructions
+     *            the flag
+     * @see SessionConfig#setRefreshCustomInstructions(boolean)
+     */
+    public void setRefreshCustomInstructions(boolean refreshCustomInstructions) {
+        this.refreshCustomInstructions = refreshCustomInstructions;
+    }
+
+    /** Clears the instruction discovery cache invalidation flag. */
+    public void clearRefreshCustomInstructions() {
+        this.refreshCustomInstructions = null;
+    }
+
     /** Gets enable file hooks flag. @return the flag */
     public Boolean getEnableFileHooks() {
         return enableFileHooks;
diff --git a/java/sdk/src/main/java/com/github/copilot/rpc/McpHttpServerConfig.java b/java/sdk/src/main/java/com/github/copilot/rpc/McpHttpServerConfig.java
index 83a42a88f8..8146aeddcb 100644
--- a/java/sdk/src/main/java/com/github/copilot/rpc/McpHttpServerConfig.java
+++ b/java/sdk/src/main/java/com/github/copilot/rpc/McpHttpServerConfig.java
@@ -41,6 +41,18 @@ public final class McpHttpServerConfig extends McpServerConfig {
     @JsonProperty("headers")
     private Map<String, String> headers;
 
+    @JsonProperty("oauthClientId")
+    private String oauthClientId;
+
+    @JsonProperty("oauthScopes")
+    private List<String> oauthScopes;
+
+    @JsonProperty("oauthPublicClient")
+    private Boolean oauthPublicClient;
+
+    @JsonProperty("oauthGrantType")
+    private String oauthGrantType;
+
     /**
      * Gets the server type discriminator.
      *
@@ -92,6 +104,91 @@ public McpHttpServerConfig setHeaders(Map<String, String> headers) {
         return this;
     }
 
+    /**
+     * Gets the statically configured OAuth client ID.
+     *
+     * @return the OAuth client ID, or {@code null}
+     */
+    public String getOauthClientId() {
+        return oauthClientId;
+    }
+
+    /**
+     * Sets the statically configured OAuth client ID.
+     *
+     * @param oauthClientId
+     *            the non-empty OAuth client ID
+     * @return this config for method chaining
+     */
+    public McpHttpServerConfig setOauthClientId(String oauthClientId) {
+        this.oauthClientId = oauthClientId;
+        return this;
+    }
+
+    /**
+     * Gets the configured OAuth scopes.
+     *
+     * @return the OAuth scopes, or {@code null}
+     */
+    public List<String> getOauthScopes() {
+        return oauthScopes == null ? null : Collections.unmodifiableList(oauthScopes);
+    }
+
+    /**
+     * Sets the OAuth scopes to request when the server challenge omits scope or
+     * provides an empty scope.
+     *
+     * @param oauthScopes
+     *            the non-empty list of RFC 6749 scope-token strings
+     * @return this config for method chaining
+     */
+    public McpHttpServerConfig setOauthScopes(List<String> oauthScopes) {
+        this.oauthScopes = oauthScopes;
+        return this;
+    }
+
+    /**
+     * Gets whether the configured OAuth client is public.
+     *
+     * @return whether the client is public, or {@code null}
+     */
+    public Boolean getOauthPublicClient() {
+        return oauthPublicClient;
+    }
+
+    /**
+     * Sets whether the configured OAuth client is public.
+     *
+     * @param oauthPublicClient
+     *            whether the client is public
+     * @return this config for method chaining
+     */
+    public McpHttpServerConfig setOauthPublicClient(Boolean oauthPublicClient) {
+        this.oauthPublicClient = oauthPublicClient;
+        return this;
+    }
+
+    /**
+     * Gets the configured OAuth grant type.
+     *
+     * @return the OAuth grant type, or {@code null}
+     */
+    public String getOauthGrantType() {
+        return oauthGrantType;
+    }
+
+    /**
+     * Sets the OAuth grant type.
+     *
+     * @param oauthGrantType
+     *            the OAuth grant type
+     * @return this config for method chaining
+     */
+    public McpHttpServerConfig setOauthGrantType(String oauthGrantType) {
+        this.oauthGrantType = oauthGrantType;
+        return this;
+    }
+
     @Override
     public McpHttpServerConfig setTools(List<String> tools) {
         super.setTools(tools);
diff --git a/java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionConfig.java b/java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionConfig.java
index ec31562323..9f4bf818d0 100644
--- a/java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionConfig.java
+++ b/java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionConfig.java
@@ -16,6 +16,7 @@
 
 import com.github.copilot.CopilotExperimental;
 import com.github.copilot.generated.SessionEvent;
+import com.github.copilot.generated.rpc.DiagnosticsConfiguration;
 import com.github.copilot.generated.rpc.SessionLimitsConfig;
 
 /**
@@ -85,6 +86,7 @@ public class ResumeSessionConfig {
     private boolean streaming;
     private Boolean includeSubAgentStreamingEvents;
     private Map<String, McpServerConfig> mcpServers;
+    private DiagnosticsConfiguration diagnostics;
     private String mcpOAuthTokenStorage;
     private String authClientIdMetadataUrl;
     private List<CustomAgentConfig> customAgents;
@@ -1397,6 +1399,28 @@ public ResumeSessionConfig setMcpServers(Map<String, McpServerConfig> mcpServers
         return this;
     }
 
+    /**
+     * Gets the session-scoped diagnostics configuration.
+     *
+     * @return the diagnostic level, or {@code null} to preserve the current level
+     */
+    public DiagnosticsConfiguration getDiagnostics() {
+        return diagnostics;
+    }
+
+    /**
+     * Sets the session-scoped diagnostics configuration. Leave it unset when
+     * resuming a resident session to preserve its current diagnostic level.
+     *
+     * @param diagnostics
+     *            the diagnostic level
+     * @return this config for method chaining
+     */
+    public ResumeSessionConfig setDiagnostics(DiagnosticsConfiguration diagnostics) {
+        this.diagnostics = diagnostics;
+        return this;
+    }
+
     /**
      * Gets the MCP OAuth token storage mode.
      *
@@ -2143,6 +2167,7 @@ public ResumeSessionConfig clone() {
         copy.streaming = this.streaming;
         copy.includeSubAgentStreamingEvents = this.includeSubAgentStreamingEvents;
         copy.mcpServers = this.mcpServers != null ? new java.util.HashMap<>(this.mcpServers) : null;
+        copy.diagnostics = this.diagnostics;
         copy.mcpOAuthTokenStorage = this.mcpOAuthTokenStorage;
         copy.authClientIdMetadataUrl = this.authClientIdMetadataUrl;
         copy.customAgents = this.customAgents != null ? new ArrayList<>(this.customAgents) : null;
diff --git a/java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionRequest.java b/java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionRequest.java
index 42d0ee536d..0f53bf5ce5 100644
--- a/java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionRequest.java
+++ b/java/sdk/src/main/java/com/github/copilot/rpc/ResumeSessionRequest.java
@@ -12,6 +12,7 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 
 import com.github.copilot.CopilotExperimental;
+import com.github.copilot.generated.rpc.DiagnosticsConfiguration;
 import com.github.copilot.generated.rpc.SessionLimitsConfig;
 
 /**
@@ -162,6 +163,9 @@ public final class ResumeSessionRequest {
     @JsonProperty("mcpOAuthTokenStorage")
     private String mcpOAuthTokenStorage;
 
+    @JsonProperty("diagnostics")
+    private DiagnosticsConfiguration diagnostics;
+
     @JsonProperty("authClientIdMetadataUrl")
     private String authClientIdMetadataUrl;
 
@@ -825,6 +829,19 @@ public String getMcpOAuthTokenStorage() {
         return mcpOAuthTokenStorage;
     }
 
+    /**
+     * Gets the diagnostics configuration. @return the level, or {@code null} when
+     * unset
+     */
+    public DiagnosticsConfiguration getDiagnostics() {
+        return diagnostics;
+    }
+
+    /** Sets the diagnostics configuration. @param diagnostics the level */
+    public void setDiagnostics(DiagnosticsConfiguration diagnostics) {
+        this.diagnostics = diagnostics;
+    }
+
     /**
      * Sets MCP OAuth token storage mode. @param mcpOAuthTokenStorage the storage
      * mode
diff --git a/java/sdk/src/main/java/com/github/copilot/rpc/SessionConfig.java b/java/sdk/src/main/java/com/github/copilot/rpc/SessionConfig.java
index d77642c103..836b972ae2 100644
--- a/java/sdk/src/main/java/com/github/copilot/rpc/SessionConfig.java
+++ b/java/sdk/src/main/java/com/github/copilot/rpc/SessionConfig.java
@@ -16,6 +16,7 @@
 
 import com.github.copilot.CopilotExperimental;
 import com.github.copilot.generated.SessionEvent;
+import com.github.copilot.generated.rpc.DiagnosticsConfiguration;
 import com.github.copilot.generated.rpc.SessionLimitsConfig;
 
 /**
@@ -74,6 +75,7 @@ public class SessionConfig {
     private boolean streaming;
     private Boolean includeSubAgentStreamingEvents;
     private Map<String, McpServerConfig> mcpServers;
+    private DiagnosticsConfiguration diagnostics;
     private String mcpOAuthTokenStorage;
     private String authClientIdMetadataUrl;
     private List<CustomAgentConfig> customAgents;
@@ -94,6 +96,7 @@ public class SessionConfig {
     private Boolean skipEmbeddingRetrieval;
     private String organizationCustomInstructions;
     private Boolean enableOnDemandInstructionDiscovery;
+    private Boolean refreshCustomInstructions;
     private Boolean enableFileHooks;
     private Boolean enableHostGitOperations;
     private Boolean enableSessionStore;
@@ -1050,6 +1053,30 @@ public SessionConfig setMcpServers(Map<String, McpServerConfig> mcpServers) {
         return this;
     }
 
+    /**
+     * Gets the session-scoped diagnostics configuration.
+     *
+     * @return the diagnostic level, or {@code null} when diagnostics are disabled
+     */
+    public DiagnosticsConfiguration getDiagnostics() {
+        return diagnostics;
+    }
+
+    /**
+     * Sets the session-scoped diagnostics configuration. Diagnostics are off by
+     * default. Debug and trace entries can contain MCP payloads, tool arguments,
+     * paths, and server stderr. Do not upload entries as telemetry or export them
+     * without deliberate host action.
+     *
+     * @param diagnostics
+     *            the diagnostic level
+     * @return this config for method chaining
+     */
+    public SessionConfig setDiagnostics(DiagnosticsConfiguration diagnostics) {
+        this.diagnostics = diagnostics;
+        return this;
+    }
+
     /**
      * Gets the MCP OAuth token storage mode.
      *
@@ -1556,6 +1583,43 @@ public SessionConfig clearEnableOnDemandInstructionDiscovery() {
         return this;
     }
 
+    /**
+     * Gets whether to invalidate process-wide instruction discovery caches before
+     * constructing the new session.
+     *
+     * @return an optional flag; {@code false} or empty reuses cached discovery
+     */
+    @JsonIgnore
+    public Optional<Boolean> getRefreshCustomInstructions() {
+        return Optional.ofNullable(refreshCustomInstructions);
+    }
+
+    /**
+     * Sets whether to invalidate process-wide instruction discovery caches before
+     * constructing the new session. Defaults to {@code false}, reusing cached
+     * discovery. Other sessions in this runtime may observe updated instructions on
+     * later turns or discovery. This does not watch files or override instruction
+     * loading policy.
+     *
+     * @param refreshCustomInstructions
+     *            {@code true} to invalidate caches, {@code false} to reuse them
+     * @return this config instance for method chaining
+     */
+    public SessionConfig setRefreshCustomInstructions(boolean refreshCustomInstructions) {
+        this.refreshCustomInstructions = refreshCustomInstructions;
+        return this;
+    }
+
+    /**
+     * Clears the refreshCustomInstructions setting, restoring default cache reuse.
+     *
+     * @return this config instance for method chaining
+     */
+    public SessionConfig clearRefreshCustomInstructions() {
+        this.refreshCustomInstructions = null;
+        return this;
+    }
+
     /**
      * Gets whether file-based hooks are enabled.
      *
@@ -2272,6 +2336,7 @@ public SessionConfig clone() {
         copy.streaming = this.streaming;
         copy.includeSubAgentStreamingEvents = this.includeSubAgentStreamingEvents;
         copy.mcpServers = this.mcpServers != null ? new java.util.HashMap<>(this.mcpServers) : null;
+        copy.diagnostics = this.diagnostics;
         copy.mcpOAuthTokenStorage = this.mcpOAuthTokenStorage;
         copy.authClientIdMetadataUrl = this.authClientIdMetadataUrl;
         copy.customAgents = this.customAgents != null ? new ArrayList<>(this.customAgents) : null;
@@ -2296,6 +2361,7 @@ public SessionConfig clone() {
         copy.skipEmbeddingRetrieval = this.skipEmbeddingRetrieval;
         copy.organizationCustomInstructions = this.organizationCustomInstructions;
         copy.enableOnDemandInstructionDiscovery = this.enableOnDemandInstructionDiscovery;
+        copy.refreshCustomInstructions = this.refreshCustomInstructions;
         copy.enableFileHooks = this.enableFileHooks;
         copy.enableHostGitOperations = this.enableHostGitOperations;
         copy.enableSessionStore = this.enableSessionStore;
diff --git a/java/sdk/src/test/java/com/github/copilot/ClientOptionsE2ETest.java b/java/sdk/src/test/java/com/github/copilot/ClientOptionsE2ETest.java
index a2561434d8..04afa58596 100644
--- a/java/sdk/src/test/java/com/github/copilot/ClientOptionsE2ETest.java
+++ b/java/sdk/src/test/java/com/github/copilot/ClientOptionsE2ETest.java
@@ -14,6 +14,9 @@
 import java.util.concurrent.TimeUnit;
 
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullSource;
+import org.junit.jupiter.params.provider.ValueSource;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -28,6 +31,47 @@ class ClientOptionsE2ETest {
 
     private static final ObjectMapper MAPPER = new ObjectMapper();
 
+    @ParameterizedTest
+    @NullSource
+    @ValueSource(booleans = {true, false})
+    void testShouldForwardRefreshCustomInstructionsOnlyOnSessionCreation(Boolean refresh) throws Exception {
+        try (var fake = FakeStdioCli.create()) {
+            var config = new SessionConfig().setOnPermissionRequest(PermissionHandler.APPROVE_ALL);
+            if (refresh != null) {
+                config.setRefreshCustomInstructions(refresh);
+            }
+
+            try (var client = fake.createClient()) {
+                var session = client.createSession(config).get(30, TimeUnit.SECONDS);
+                session.close();
+                var resumed = client
+                        .resumeSession(session.getSessionId(),
+                                new ResumeSessionConfig().setOnPermissionRequest(PermissionHandler.APPROVE_ALL))
+                        .get(30, TimeUnit.SECONDS);
+                resumed.close();
+            }
+
+            var create = fake.capturedRequest("session.create").path("params");
+            if (refresh == null) {
+                assertFalse(create.has("refreshCustomInstructions"), create.toString());
+            } else {
+                assertEquals(MAPPER.valueToTree(refresh), create.get("refreshCustomInstructions"));
+            }
+            var resume = fake.capturedRequest("session.resume").path("params");
+            assertFalse(resume.has("refreshCustomInstructions"), resume.toString());
+        }
+    }
+
+    @Test
+    void testRefreshCustomInstructionsIsNotExposedOnResumeConfig() {
+        assertThrows(NoSuchMethodException.class,
+                () -> ResumeSessionConfig.class.getMethod("getRefreshCustomInstructions"));
+        assertThrows(NoSuchMethodException.class,
+                () -> ResumeSessionConfig.class.getMethod("setRefreshCustomInstructions", boolean.class));
+        assertThrows(NoSuchMethodException.class,
+                () -> ResumeSessionConfig.class.getMethod("clearRefreshCustomInstructions"));
+    }
+
     @Test
     void testShouldForwardAdvancedSessionCreationOptionsToTheCli() throws Exception {
         try (var fake = FakeStdioCli.create()) {
diff --git a/java/sdk/src/test/java/com/github/copilot/ConfigCloneTest.java b/java/sdk/src/test/java/com/github/copilot/ConfigCloneTest.java
index 2433e5f67a..8f937fcb99 100644
--- a/java/sdk/src/test/java/com/github/copilot/ConfigCloneTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/ConfigCloneTest.java
@@ -10,10 +10,14 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.CompletableFuture;
 import java.util.function.Consumer;
 
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullSource;
+import org.junit.jupiter.params.provider.ValueSource;
 
 import com.github.copilot.generated.SessionEvent;
 import com.github.copilot.generated.rpc.SessionLimitsConfig;
@@ -143,6 +147,23 @@ void sessionConfigCloneBasic() {
         assertEquals(original.isStreaming(), cloned.isStreaming());
     }
 
+    @ParameterizedTest
+    @NullSource
+    @ValueSource(booleans = {true, false})
+    void sessionConfigRefreshCustomInstructionsCloned(Boolean refresh) {
+        var original = new SessionConfig();
+        assertTrue(original.getRefreshCustomInstructions().isEmpty());
+        if (refresh != null) {
+            assertSame(original, original.setRefreshCustomInstructions(refresh));
+        }
+
+        var cloned = original.clone();
+        assertEquals(Optional.ofNullable(refresh), cloned.getRefreshCustomInstructions());
+        assertSame(cloned, cloned.clearRefreshCustomInstructions());
+        assertTrue(cloned.getRefreshCustomInstructions().isEmpty());
+        assertEquals(Optional.ofNullable(refresh), original.getRefreshCustomInstructions());
+    }
+
     @Test
     void sessionConfigListIndependence() {
         SessionConfig original = new SessionConfig();
diff --git a/java/sdk/src/test/java/com/github/copilot/CopilotExperimentalProcessorTest.java b/java/sdk/src/test/java/com/github/copilot/CopilotExperimentalProcessorTest.java
index b7005c5d52..3715235bc1 100644
--- a/java/sdk/src/test/java/com/github/copilot/CopilotExperimentalProcessorTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/CopilotExperimentalProcessorTest.java
@@ -114,6 +114,27 @@ void failsByDefault_whenExtendingExperimentalType() {
                 "Expected compile error for extending experimental type, got: " + diagnostics.getDiagnostics());
     }
 
+    @Test
+    void failsByDefault_whenUsingGeneratedExperimentalConnectorTypes() {
+        for (String type : List.of("ConnectorAvailability", "ConnectorStatus", "ConnectorConnectResult",
+                "ConnectorConnectResultConnected")) {
+            String source = """
+                    package consumer;
+                    import com.github.copilot.generated.rpc.%s;
+                    public class Consumer {
+                        private %s value;
+                    }
+                    """.formatted(type, type);
+            DiagnosticCollector<JavaFileObject> diagnostics = compile(
+                    List.of(inMemorySource("consumer.Consumer", source)), Collections.emptyList());
+
+            boolean hasError = diagnostics.getDiagnostics().stream().anyMatch(
+                    d -> d.getKind() == Diagnostic.Kind.ERROR && d.getMessage(null).contains("experimental API"));
+            assertTrue(hasError, "Expected compile error for generated experimental type " + type + ", got: "
+                    + diagnostics.getDiagnostics());
+        }
+    }
+
     @Test
     void passes_whenAllowAnnotationIsOnType() {
         DiagnosticCollector<JavaFileObject> diagnostics = compile(
diff --git a/java/sdk/src/test/java/com/github/copilot/DataObjectCoverageTest.java b/java/sdk/src/test/java/com/github/copilot/DataObjectCoverageTest.java
index c0b0324e3c..03652bc755 100644
--- a/java/sdk/src/test/java/com/github/copilot/DataObjectCoverageTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/DataObjectCoverageTest.java
@@ -296,15 +296,28 @@ void permissionRequestResultSetRules() {
     void mcpHttpServerConfigCoversGettersAndFluentSetters() {
         var headers = java.util.Map.of("Authorization", "Bearer token");
         var tools = java.util.List.of("*", "search");
+        var oauthScopes = java.util.List.of("tools:read", "resources:read");
 
         var cfg = new McpHttpServerConfig().setUrl("https://mcp.example.com/sse").setHeaders(headers).setTools(tools)
-                .setTimeout(45);
+                .setTimeout(45).setOauthClientId("static-client").setOauthScopes(oauthScopes).setOauthPublicClient(true)
+                .setOauthGrantType("authorization_code");
 
         assertEquals("http", cfg.getType());
         assertEquals("https://mcp.example.com/sse", cfg.getUrl());
         assertEquals("Bearer token", cfg.getHeaders().get("Authorization"));
         assertEquals(tools, cfg.getTools());
         assertEquals(45, cfg.getTimeout());
+        assertEquals("static-client", cfg.getOauthClientId());
+        assertEquals(oauthScopes, cfg.getOauthScopes());
+        assertTrue(cfg.getOauthPublicClient());
+        assertEquals("authorization_code", cfg.getOauthGrantType());
+
+        var json = new ObjectMapper().valueToTree(cfg);
+        assertEquals("static-client", json.path("oauthClientId").asText());
+        assertEquals("tools:read", json.path("oauthScopes").get(0).asText());
+        assertEquals("resources:read", json.path("oauthScopes").get(1).asText());
+        assertTrue(json.path("oauthPublicClient").asBoolean());
+        assertEquals("authorization_code", json.path("oauthGrantType").asText());
     }
 
     @Test
diff --git a/java/sdk/src/test/java/com/github/copilot/ExtensionLaunchProviderTest.java b/java/sdk/src/test/java/com/github/copilot/ExtensionLaunchProviderTest.java
index 5785b0cf60..18e2dd028b 100644
--- a/java/sdk/src/test/java/com/github/copilot/ExtensionLaunchProviderTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/ExtensionLaunchProviderTest.java
@@ -94,23 +94,24 @@ CompletableFuture<ExtensionLaunchProviderResolveResult> resolveResult() {
         private void acceptLoop() {
             try {
                 Socket socket = serverSocket.accept();
-                JsonRpcClient server = JsonRpcClient.fromSocket(socket);
-                server.registerMethodHandler("connect", (id, params) -> respond(server, id,
-                        Map.of("ok", true, "protocolVersion", 3, "version", "test")));
-                server.registerMethodHandler("registerExtensionLaunchProvider", (id, params) -> {
-                    registrationCount.incrementAndGet();
-                    server.invoke("extensionLaunchProvider.resolve",
-                            Map.of("id", "project:java-e2e", "name", "java-e2e", "modulePath",
-                                    "/extensions/java-e2e.jar", "source", "project"),
-                            ExtensionLaunchProviderResolveResult.class).whenComplete((result, error) -> {
-                                if (error != null) {
-                                    resolveResult.completeExceptionally(error);
-                                    sendError(server, id, error);
-                                    return;
-                                }
-                                resolveResult.complete(result);
-                                respond(server, id, Map.of());
-                            });
+                JsonRpcClient server = JsonRpcClient.fromSocket(socket, rpc -> {
+                    rpc.registerMethodHandler("connect", (id, params) -> respond(rpc, id,
+                            Map.of("ok", true, "protocolVersion", 3, "version", "test")));
+                    rpc.registerMethodHandler("registerExtensionLaunchProvider", (id, params) -> {
+                        registrationCount.incrementAndGet();
+                        rpc.invoke("extensionLaunchProvider.resolve",
+                                Map.of("id", "project:java-e2e", "name", "java-e2e", "modulePath",
+                                        "/extensions/java-e2e.jar", "source", "project"),
+                                ExtensionLaunchProviderResolveResult.class).whenComplete((result, error) -> {
+                                    if (error != null) {
+                                        resolveResult.completeExceptionally(error);
+                                        sendError(rpc, id, error);
+                                        return;
+                                    }
+                                    resolveResult.complete(result);
+                                    respond(rpc, id, Map.of());
+                                });
+                    });
                 });
                 ready.complete(server);
             } catch (IOException e) {
diff --git a/java/sdk/src/test/java/com/github/copilot/HttpResponseForwardingTest.java b/java/sdk/src/test/java/com/github/copilot/HttpResponseForwardingTest.java
index 52607a4950..9938972fec 100644
--- a/java/sdk/src/test/java/com/github/copilot/HttpResponseForwardingTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/HttpResponseForwardingTest.java
@@ -46,6 +46,19 @@ class HttpResponseForwardingTest {
 
     private static final Duration DEADLINE = Duration.ofSeconds(5);
 
+    @Test
+    void recordsAcknowledgementBeforeReleasingWriter() throws Exception {
+        RecordingCaller caller = new RecordingCaller();
+        CompletableFuture<Object> write = caller.invoke("llmInference.httpResponseChunk",
+                new LlmInferenceHttpResponseChunkParams("test", "first", false, false, null), Object.class);
+        CompletableFuture<Void> observed = write.thenRun(() -> assertEquals(0, caller.outstandingData.get()));
+
+        PendingCall call = caller.calls.poll(DEADLINE.toMillis(), TimeUnit.MILLISECONDS);
+        assertNotNull(call);
+        call.result().complete(null);
+        observed.get(DEADLINE.toMillis(), TimeUnit.MILLISECONDS);
+    }
+
     @Test
     void readsAheadAndCoalescesUnderOneWithheldAck() throws Exception {
         try (TestFlow flow = new TestFlow()) {
@@ -267,14 +280,15 @@ private static final class RecordingCaller implements RpcCaller {
         @Override
         public <T> CompletableFuture<T> invoke(String method, Object params, Class<T> resultType) {
             CompletableFuture<Object> result = new CompletableFuture<>();
+            CompletableFuture<Object> acknowledged = result;
             if (params instanceof LlmInferenceHttpResponseChunkParams chunk && !chunk.end()) {
                 int outstanding = outstandingData.incrementAndGet();
                 maximumOutstandingData.accumulateAndGet(outstanding, Math::max);
-                result.whenComplete((ignored, error) -> outstandingData.decrementAndGet());
+                acknowledged = result.whenComplete((ignored, error) -> outstandingData.decrementAndGet());
             }
             calls.add(new PendingCall(method, params, result));
             @SuppressWarnings("unchecked")
-            CompletableFuture<T> typed = (CompletableFuture<T>) (CompletableFuture<?>) result;
+            CompletableFuture<T> typed = (CompletableFuture<T>) (CompletableFuture<?>) acknowledged;
             return typed;
         }
     }
diff --git a/java/sdk/src/test/java/com/github/copilot/PermissionsTest.java b/java/sdk/src/test/java/com/github/copilot/PermissionsTest.java
index 6f10f353c2..1a3bf9c822 100644
--- a/java/sdk/src/test/java/com/github/copilot/PermissionsTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/PermissionsTest.java
@@ -207,6 +207,7 @@ void testResumeSessionWithPermissionHandler(TestInfo testInfo) throws Exception
                     .createSession(new SessionConfig().setOnPermissionRequest(PermissionHandler.APPROVE_ALL)).get();
             String sessionId = session1.getSessionId();
             session1.sendAndWait(new MessageOptions().setPrompt("What is 1+1?")).get(60, TimeUnit.SECONDS);
+            session1.close();
 
             // Resume with permission handler
             var resumeConfig = new ResumeSessionConfig().setOnPermissionRequest((request, invocation) -> {
@@ -342,6 +343,7 @@ void testShouldDenyToolOperationsWhenHandlerExplicitlyDeniesAfterResume(TestInfo
             CopilotSession session1 = client.createSession(config).get();
             String sessionId = session1.getSessionId();
             session1.sendAndWait(new MessageOptions().setPrompt("What is 1+1?")).get(60, TimeUnit.SECONDS);
+            session1.close();
 
             CopilotSession session2 = client.resumeSession(sessionId, new ResumeSessionConfig()
                     .setOnPermissionRequest((request, invocation) -> CompletableFuture.completedFuture(
diff --git a/java/sdk/src/test/java/com/github/copilot/RpcSurfaceParityE2ETest.java b/java/sdk/src/test/java/com/github/copilot/RpcSurfaceParityE2ETest.java
index 49bb8e10d1..43f07d2315 100644
--- a/java/sdk/src/test/java/com/github/copilot/RpcSurfaceParityE2ETest.java
+++ b/java/sdk/src/test/java/com/github/copilot/RpcSurfaceParityE2ETest.java
@@ -41,8 +41,8 @@ class RpcSurfaceParityE2ETest {
 
     private static final ObjectMapper MAPPER = new ObjectMapper();
     private static final long TIMEOUT_SECONDS = 30;
-    private static final int EXPECTED_RPC_METHOD_COUNT = 415;
-    private static final String EXPECTED_RPC_SIGNATURE_SHA256 = "0f923cec163411c42e63405870b8bdc489e1f9d2f6c4dbb69a5cea7dbd99e597";
+    private static final int EXPECTED_RPC_METHOD_COUNT = 420;
+    private static final String EXPECTED_RPC_SIGNATURE_SHA256 = "b060cc39689fb59c658ddc1d073e23c3fc16f08abf719e9102a7f54b26a99166";
     private static final Map<String, Integer> EXPECTED_METHODS_BY_DECLARING_TYPE = Map.ofEntries(
             Map.entry("RpcCaller", 2), Map.entry("ServerAccountApi", 6), Map.entry("ServerAgentRegistryApi", 1),
             Map.entry("ServerAgentsApi", 2), Map.entry("ServerCatalogApi", 2), Map.entry("ServerCommandsApi", 1),
@@ -51,19 +51,21 @@ class RpcSurfaceParityE2ETest {
             Map.entry("ServerMcpApi", 2), Map.entry("ServerMcpConfigApi", 7), Map.entry("ServerModelsApi", 3),
             Map.entry("ServerPluginsApi", 7), Map.entry("ServerPluginsBuiltinApi", 1),
             Map.entry("ServerPluginsMarketplacesApi", 6), Map.entry("ServerRpc", 3), Map.entry("ServerRuntimeApi", 1),
-            Map.entry("ServerSecretsApi", 1), Map.entry("ServerSessionFsApi", 1), Map.entry("ServerSessionsApi", 34),
-            Map.entry("ServerSkillsApi", 2), Map.entry("ServerSkillsConfigApi", 2), Map.entry("ServerToolsApi", 1),
-            Map.entry("ServerUserSettingsApi", 3), Map.entry("SessionAgentApi", 7),
+            Map.entry("ServerSandboxApi", 1), Map.entry("ServerSecretsApi", 1), Map.entry("ServerSessionFsApi", 1),
+            Map.entry("ServerSessionsApi", 34), Map.entry("ServerSkillsApi", 2), Map.entry("ServerSkillsConfigApi", 2),
+            Map.entry("ServerToolsApi", 1), Map.entry("ServerUserSettingsApi", 3), Map.entry("SessionAgentApi", 7),
             Map.entry("SessionAutopilotObjectiveApi", 1), Map.entry("SessionCanvasActionApi", 1),
             Map.entry("SessionCanvasApi", 4), Map.entry("SessionCanvasProviderApi", 2),
             Map.entry("SessionCommandsApi", 8), Map.entry("SessionCompletionsApi", 2),
             Map.entry("SessionConnectorsApi", 11), Map.entry("SessionContentExclusionApi", 1),
-            Map.entry("SessionDebugApi", 1), Map.entry("SessionEventLogApi", 4), Map.entry("SessionExtensionsApi", 5),
+            Map.entry("SessionCustomizationsApi", 1), Map.entry("SessionDebugApi", 1),
+            Map.entry("SessionEventLogApi", 4), Map.entry("SessionExtensionsApi", 5),
             Map.entry("SessionFactoryApi", 13), Map.entry("SessionFactoryJournalApi", 2),
             Map.entry("SessionFleetApi", 1), Map.entry("SessionGitHubAuthApi", 10), Map.entry("SessionHistoryApi", 10),
-            Map.entry("SessionInstructionsApi", 1), Map.entry("SessionLimitPredictionApi", 2),
+            Map.entry("SessionInstructionsApi", 2), Map.entry("SessionLimitPredictionApi", 2),
             Map.entry("SessionManagedSettingsApi", 1), Map.entry("SessionLspApi", 1), Map.entry("SessionMcpApi", 18),
-            Map.entry("SessionMcpAppsApi", 6), Map.entry("SessionMcpHeadersApi", 1), Map.entry("SessionMcpOauthApi", 5),
+            Map.entry("SessionDiagnosticsApi", 2), Map.entry("SessionMcpAppsApi", 6),
+            Map.entry("SessionMcpHeadersApi", 1), Map.entry("SessionMcpOauthApi", 5),
             Map.entry("SessionMcpResourcesApi", 3), Map.entry("SessionMetadataApi", 11), Map.entry("SessionModeApi", 2),
             Map.entry("SessionModelApi", 8), Map.entry("SessionNameApi", 3), Map.entry("SessionOptionsApi", 1),
             Map.entry("SessionPermissionsApi", 10), Map.entry("SessionPermissionsFolderTrustApi", 2),
diff --git a/java/sdk/src/test/java/com/github/copilot/RpcWrappersTest.java b/java/sdk/src/test/java/com/github/copilot/RpcWrappersTest.java
index 022e07de2b..396d076ff5 100644
--- a/java/sdk/src/test/java/com/github/copilot/RpcWrappersTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/RpcWrappersTest.java
@@ -20,6 +20,19 @@
 import com.github.copilot.generated.rpc.RpcCaller;
 import com.github.copilot.generated.rpc.ServerRpc;
 import com.github.copilot.generated.rpc.SessionAgentSelectParams;
+import com.github.copilot.generated.rpc.SessionConnectorsConnectParams;
+import com.github.copilot.generated.rpc.SessionConnectorsContinueConnectionParams;
+import com.github.copilot.generated.rpc.SessionConnectorsDisconnectParams;
+import com.github.copilot.generated.rpc.SessionConnectorsDisconnectResult;
+import com.github.copilot.generated.rpc.SessionConnectorsGetCapabilitiesResult;
+import com.github.copilot.generated.rpc.SessionConnectorsGetStatusResult;
+import com.github.copilot.generated.rpc.SessionConnectorsListParams;
+import com.github.copilot.generated.rpc.SessionConnectorsListResult;
+import com.github.copilot.generated.rpc.SessionConnectorsReconcileParams;
+import com.github.copilot.generated.rpc.SessionConnectorsReconcileResult;
+import com.github.copilot.generated.rpc.SessionConnectorsReconnectParams;
+import com.github.copilot.generated.rpc.SessionConnectorsRefreshParams;
+import com.github.copilot.generated.rpc.SessionConnectorsRefreshResult;
 import com.github.copilot.generated.rpc.SessionModelSwitchToParams;
 import com.github.copilot.generated.rpc.SessionRpc;
 
@@ -43,7 +56,7 @@ class RpcWrappersTest {
      */
     private static final class StubCaller implements RpcCaller {
 
-        static record Call(String method, Object params) {
+        static record Call(String method, Object params, Class<?> resultType) {
         }
 
         final List<Call> calls = new ArrayList<>();
@@ -52,7 +65,7 @@ static record Call(String method, Object params) {
         @Override
         @SuppressWarnings("unchecked")
         public <T> CompletableFuture<T> invoke(String method, Object params, Class<T> resultType) {
-            calls.add(new Call(method, params));
+            calls.add(new Call(method, params, resultType));
             return CompletableFuture.completedFuture((T) nextResult);
         }
     }
@@ -181,6 +194,61 @@ void sessionRpc_instantiates_with_all_namespace_fields() {
         assertNotNull(session.shell);
         assertNotNull(session.history);
         assertNotNull(session.usage);
+        assertNotNull(session.connectors);
+    }
+
+    @Test
+    @AllowCopilotExperimental
+    void sessionRpc_connectors_exposes_host_lifecycle_methods() {
+        var stub = new StubCaller();
+        var session = new SessionRpc(stub, "sess-connectors");
+
+        session.connectors.getCapabilities();
+        session.connectors.getStatus();
+        session.connectors.list(new SessionConnectorsListParams("ignored-session", "account-1"));
+        session.connectors.refresh(new SessionConnectorsRefreshParams("ignored-session", "account-1"));
+        session.connectors.connect(new SessionConnectorsConnectParams("ignored-session", "account-1", "outlook"));
+        session.connectors.reconnect(new SessionConnectorsReconnectParams("ignored-session", "account-1", "outlook"));
+        session.connectors.continueConnection(new SessionConnectorsContinueConnectionParams("ignored-session",
+                "continuation-1", 3L, 1_000L, 30_000L));
+        session.connectors.disconnect(new SessionConnectorsDisconnectParams("ignored-session", "account-1", "outlook"));
+        session.connectors.reconcile(new SessionConnectorsReconcileParams("ignored-session", "account-1", true));
+
+        assertEquals(9, stub.calls.size());
+        assertConnectorCall(stub.calls.get(0), "session.connectors.getCapabilities",
+                SessionConnectorsGetCapabilitiesResult.class);
+        assertConnectorCall(stub.calls.get(1), "session.connectors.getStatus", SessionConnectorsGetStatusResult.class);
+
+        var listParams = assertConnectorCall(stub.calls.get(2), "session.connectors.list",
+                SessionConnectorsListResult.class);
+        assertEquals("account-1", listParams.get("accountId").asText());
+
+        var refreshParams = assertConnectorCall(stub.calls.get(3), "session.connectors.refresh",
+                SessionConnectorsRefreshResult.class);
+        assertEquals("account-1", refreshParams.get("accountId").asText());
+
+        var connectParams = assertConnectorCall(stub.calls.get(4), "session.connectors.connect",
+                com.github.copilot.generated.rpc.ConnectorConnectResult.class);
+        assertEquals("outlook", connectParams.get("connectorName").asText());
+
+        var reconnectParams = assertConnectorCall(stub.calls.get(5), "session.connectors.reconnect",
+                com.github.copilot.generated.rpc.ConnectorConnectResult.class);
+        assertEquals("outlook", reconnectParams.get("connectorName").asText());
+
+        var continueParams = assertConnectorCall(stub.calls.get(6), "session.connectors.continueConnection",
+                com.github.copilot.generated.rpc.ConnectorConnectResult.class);
+        assertEquals("continuation-1", continueParams.get("continuationId").asText());
+        assertEquals(3L, continueParams.get("maxAttempts").asLong());
+        assertEquals(1_000L, continueParams.get("pollIntervalMs").asLong());
+        assertEquals(30_000L, continueParams.get("deadlineMs").asLong());
+
+        var disconnectParams = assertConnectorCall(stub.calls.get(7), "session.connectors.disconnect",
+                SessionConnectorsDisconnectResult.class);
+        assertEquals("outlook", disconnectParams.get("connectorName").asText());
+
+        var reconcileParams = assertConnectorCall(stub.calls.get(8), "session.connectors.reconcile",
+                SessionConnectorsReconcileResult.class);
+        assertTrue(reconcileParams.get("refreshCatalog").asBoolean());
     }
 
     @Test
@@ -362,6 +430,7 @@ void copilotSession_getRpc_all_namespace_fields_present() throws Exception {
             assertNotNull(sessionRpc.permissions);
             assertNotNull(sessionRpc.commands);
             assertNotNull(sessionRpc.ui);
+            assertNotNull(sessionRpc.connectors);
         }
     }
 
@@ -462,6 +531,15 @@ void sessionRpc_mcp_apps_callTool_returns_jsonNode_payload() throws Exception {
         assertEquals(false, result.get("isError").asBoolean());
     }
 
+    private static com.fasterxml.jackson.databind.JsonNode assertConnectorCall(StubCaller.Call call,
+            String expectedMethod, Class<?> expectedResultType) {
+        assertEquals(expectedMethod, call.method());
+        assertEquals(expectedResultType, call.resultType());
+        var params = new ObjectMapper().valueToTree(call.params());
+        assertEquals("sess-connectors", params.get("sessionId").asText());
+        return params;
+    }
+
     /**
      * Helper that creates a loopback socket pair. The client side is used by
      * {@link JsonRpcClient}; the server side can be read to inspect outbound
diff --git a/java/sdk/src/test/java/com/github/copilot/SessionEventHandlingTest.java b/java/sdk/src/test/java/com/github/copilot/SessionEventHandlingTest.java
index a3891849ae..30b04fd972 100644
--- a/java/sdk/src/test/java/com/github/copilot/SessionEventHandlingTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/SessionEventHandlingTest.java
@@ -32,6 +32,7 @@
 import com.github.copilot.generated.ExternalToolCompletedEvent;
 import com.github.copilot.generated.ExternalToolRequestedEvent;
 import com.github.copilot.generated.SessionIdleEvent;
+import com.github.copilot.generated.SessionErrorEvent;
 import com.github.copilot.generated.SessionMode;
 import com.github.copilot.generated.SessionStartEvent;
 import com.github.copilot.generated.rpc.SessionToolsGetCurrentMetadataResult;
@@ -226,6 +227,41 @@ void testSendAndWaitSkipsAutopilotContinuationIdle() throws Exception {
         }
     }
 
+    @Test
+    void testSendAndWaitIgnoresChildEvents() throws Exception {
+        var rpc = mock(JsonRpcClient.class);
+        when(rpc.invoke(eq("session.send"), any(), eq(SendMessageResponse.class)))
+                .thenReturn(CompletableFuture.completedFuture(new SendMessageResponse("message-1")));
+        when(rpc.invoke(eq("session.detach"), any(), eq(CopilotSession.SessionDetachResponse.class)))
+                .thenReturn(CompletableFuture.completedFuture(new CopilotSession.SessionDetachResponse(true, null)));
+        session = new CopilotSession("test-session-id", rpc);
+
+        try {
+            var received = new ArrayList<SessionEvent>();
+            session.on(received::add);
+            var pending = session.sendAndWait(new MessageOptions().setPrompt("delegate"));
+
+            var childMessage = createAssistantMessageEvent("child reply");
+            childMessage.setAgentId("child-1");
+            dispatchEvent(childMessage);
+            var childError = new SessionErrorEvent();
+            childError.setAgentId("child-1");
+            childError.setData(new SessionErrorEvent.SessionErrorEventData("query", null, null, "child failed", null,
+                    null, null, null, null, null));
+            dispatchEvent(childError);
+            var childIdle = createSessionIdleEvent();
+            childIdle.setAgentId("child-1");
+            dispatchEvent(childIdle);
+            assertEquals(List.of(childMessage, childError, childIdle), received);
+            assertFalse(pending.isDone(), "Child events must not complete the parent wait");
+
+            dispatchEvent(createSessionIdleEvent());
+            assertNull(pending.get(5, TimeUnit.SECONDS), "Child reply must not supply the parent result");
+        } finally {
+            session.close();
+        }
+    }
+
     @Test
     void testMultipleTypedHandlers() {
         var messages = new ArrayList<AssistantMessageEvent>();
diff --git a/java/sdk/src/test/java/com/github/copilot/SessionEventsE2ETest.java b/java/sdk/src/test/java/com/github/copilot/SessionEventsE2ETest.java
index dad75db528..8c8fc154aa 100644
--- a/java/sdk/src/test/java/com/github/copilot/SessionEventsE2ETest.java
+++ b/java/sdk/src/test/java/com/github/copilot/SessionEventsE2ETest.java
@@ -6,12 +6,16 @@
 
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
+import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
@@ -192,7 +196,8 @@ void testShouldReceiveSessionEvents_assistantUsageEvent() throws Exception {
     }
 
     /**
-     * Verifies that session.idle event is emitted after message completion.
+     * Verifies that an earlier synchronous root-idle listener finishes before
+     * sendAndWait completes.
      *
      * @see Snapshot: session/should_receive_session_events
      */
@@ -202,15 +207,41 @@ void testShouldReceiveSessionEvents_sessionIdleAfterMessage() throws Exception {
         ctx.configureForTest("session", "should_receive_session_events");
 
         var allEvents = new ArrayList<SessionEvent>();
+        var idleEntered = new CountDownLatch(1);
+        var releaseIdle = new CountDownLatch(1);
+        var idleCallbackCompleted = new AtomicBoolean();
 
         try (CopilotClient client = ctx.createClient()) {
             CopilotSession session = client
                     .createSession(new SessionConfig().setOnPermissionRequest(PermissionHandler.APPROVE_ALL)).get();
 
-            session.on(event -> allEvents.add(event));
-
-            // Use prompt that matches the snapshot
-            session.sendAndWait(new MessageOptions().setPrompt("What is 100+200?")).get(60, TimeUnit.SECONDS);
+            try (var subscription = session.on(event -> {
+                allEvents.add(event);
+                if (event instanceof SessionIdleEvent && (event.getAgentId() == null || event.getAgentId().isEmpty())) {
+                    idleEntered.countDown();
+                    try {
+                        if (!releaseIdle.await(10, TimeUnit.SECONDS)) {
+                            throw new IllegalStateException("Timed out waiting to release the idle listener");
+                        }
+                    } catch (InterruptedException e) {
+                        Thread.currentThread().interrupt();
+                        throw new IllegalStateException(e);
+                    }
+                    idleCallbackCompleted.set(true);
+                }
+            })) {
+                var response = session.sendAndWait(new MessageOptions().setPrompt("What is 100+200?"));
+                try {
+                    assertTrue(idleEntered.await(30, TimeUnit.SECONDS), "Root-idle listener should run");
+                    assertThrows(TimeoutException.class, () -> response.get(200, TimeUnit.MILLISECONDS),
+                            "sendAndWait must not complete while the earlier listener is blocked");
+                } finally {
+                    releaseIdle.countDown();
+                }
+                assertNotNull(response.get(60, TimeUnit.SECONDS));
+                // No separate subscriber wait after sendAndWait completes.
+                assertTrue(idleCallbackCompleted.get(), "Root-idle listener should have finished");
+            }
 
             // Verify session.idle is emitted after assistant.message
             assertTrue(allEvents.stream().anyMatch(e -> e instanceof SessionIdleEvent),
@@ -244,12 +275,7 @@ void testInvokesBuiltInTools_eventOrderDuringToolExecution() throws Exception {
         ctx.configureForTest("tools", "invokes_built_in_tools");
 
         var eventTypes = new ArrayList<String>();
-        // Use a separate completion signal so we know when THIS handler has seen
-        // session.idle, rather than relying on sendAndWait's internal subscription.
-        // sendAndWait also listens for session.idle internally. Because eventHandlers
-        // is a ConcurrentHashMap Set (non-deterministic iteration order), the
-        // sendAndWait handler can fire BEFORE this listener and unblock the test
-        // thread before session.idle has been added to eventTypes — a race condition.
+        // Track this listener's receipt of session.idle explicitly.
         var idleReceived = new java.util.concurrent.CompletableFuture<Void>();
 
         try (CopilotClient client = ctx.createClient()) {
@@ -273,9 +299,7 @@ void testInvokesBuiltInTools_eventOrderDuringToolExecution() throws Exception {
             session.sendAndWait(new MessageOptions().setPrompt("What's the first line of README.md in this directory?"))
                     .get(60, TimeUnit.SECONDS);
 
-            // Wait for this listener to also receive session.idle. sendAndWait can return
-            // slightly before our listener sees the event due to concurrent dispatch
-            // ordering.
+            // Verify this listener also received session.idle.
             idleReceived.get(5, TimeUnit.SECONDS);
 
             // Verify expected event types are present
diff --git a/java/sdk/src/test/java/com/github/copilot/SessionRequestBuilderTest.java b/java/sdk/src/test/java/com/github/copilot/SessionRequestBuilderTest.java
index edc40175d0..74d178e076 100644
--- a/java/sdk/src/test/java/com/github/copilot/SessionRequestBuilderTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/SessionRequestBuilderTest.java
@@ -12,6 +12,10 @@
 
 import org.junit.jupiter.api.Test;
 
+import com.github.copilot.generated.rpc.DiagnosticLogLevel;
+import com.github.copilot.generated.rpc.DiagnosticSourcesConfiguration;
+import com.github.copilot.generated.rpc.DiagnosticsConfiguration;
+import com.github.copilot.generated.rpc.McpDiagnosticSourceConfiguration;
 import com.github.copilot.generated.rpc.SessionLimitsConfig;
 import com.github.copilot.rpc.AskUserVariant;
 import com.github.copilot.rpc.AutoModeSwitchResponse;
@@ -107,6 +111,34 @@ void askUserVariantDefaultsToOmittedLegacyBehavior() throws Exception {
         assertFalse(mapper.readTree(mapper.writeValueAsBytes(resumeRequest)).has("askUserVariant"));
     }
 
+    @Test
+    void diagnosticsAreForwardedAndOmittedForCreateAndColdResume() throws Exception {
+        var mapper = JsonRpcClient.getObjectMapper();
+        var createRequest = SessionRequestBuilder.buildCreateRequest(
+                new SessionConfig().setDiagnostics(diagnostics(DiagnosticLogLevel.DEBUG)).clone(),
+                "diagnostics-create");
+        var resumeRequest = SessionRequestBuilder.buildResumeRequest("diagnostics-resume",
+                new ResumeSessionConfig().setDiagnostics(diagnostics(DiagnosticLogLevel.TRACE)).clone());
+        var defaultCreateRequest = SessionRequestBuilder.buildCreateRequest(new SessionConfig(),
+                "diagnostics-default-create");
+        var defaultResumeRequest = SessionRequestBuilder.buildResumeRequest("diagnostics-default-resume",
+                new ResumeSessionConfig());
+
+        assertEquals(DiagnosticLogLevel.DEBUG, createRequest.getDiagnostics().sources().mcp().level());
+        assertEquals("debug", mapper.readTree(mapper.writeValueAsBytes(createRequest)).path("diagnostics")
+                .path("sources").path("mcp").path("level").asText());
+        assertEquals(DiagnosticLogLevel.TRACE, resumeRequest.getDiagnostics().sources().mcp().level());
+        assertEquals("trace", mapper.readTree(mapper.writeValueAsBytes(resumeRequest)).path("diagnostics")
+                .path("sources").path("mcp").path("level").asText());
+        assertFalse(mapper.readTree(mapper.writeValueAsBytes(defaultCreateRequest)).has("diagnostics"));
+        assertFalse(mapper.readTree(mapper.writeValueAsBytes(defaultResumeRequest)).has("diagnostics"));
+    }
+
+    private static DiagnosticsConfiguration diagnostics(DiagnosticLogLevel level) {
+        return new DiagnosticsConfiguration(
+                new DiagnosticSourcesConfiguration(new McpDiagnosticSourceConfiguration(level)));
+    }
+
     @Test
     void askUserVariantAcceptsOnlySupportedWireValues() {
         assertEquals(AskUserVariant.LEGACY, AskUserVariant.fromValue("legacy"));
diff --git a/java/sdk/src/test/java/com/github/copilot/consumer/JsonRpcErrorDataTest.java b/java/sdk/src/test/java/com/github/copilot/consumer/JsonRpcErrorDataTest.java
new file mode 100644
index 0000000000..e6ec845464
--- /dev/null
+++ b/java/sdk/src/test/java/com/github/copilot/consumer/JsonRpcErrorDataTest.java
@@ -0,0 +1,268 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+package com.github.copilot.consumer;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.EOFException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.OutputStream;
+import java.net.InetAddress;
+import java.net.ServerSocket;
+import java.net.Socket;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullSource;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.github.copilot.CopilotClient;
+import com.github.copilot.JsonRpcException;
+import com.github.copilot.rpc.CopilotClientOptions;
+
+@Timeout(15)
+class JsonRpcErrorDataTest {
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+    private static final int ERROR_CODE = -32001;
+    private static final String ERROR_MESSAGE = "Request failed";
+
+    @ParameterizedTest
+    @NullSource
+    @ValueSource(strings = {"{\"reason\":\"details-not-in-message\",\"nested\":{\"items\":[1,false,null]}}",
+            "[{\"nested\":[\"value\"]},2,false,null]", "\"detail — unicode\"", "42", "9007199254740993", "1.25", "0",
+            "true", "false", "{}", "[]", "\"\"", "null"})
+    void preservesRawDataThroughPublicClient(String dataJson) throws Exception {
+        try (var server = new FramedServer(Reply.ERROR, dataJson);
+                var client = new CopilotClient(new CopilotClientOptions().setCliUrl(server.url()))) {
+            client.start().get(5, TimeUnit.SECONDS);
+            var future = client.ping("error");
+
+            var getFailure = assertThrows(ExecutionException.class, () -> future.get(5, TimeUnit.SECONDS));
+            var error = assertInstanceOf(JsonRpcException.class, getFailure.getCause());
+            assertEquals(ERROR_CODE, error.getCode());
+            assertEquals(ERROR_MESSAGE, error.getMessage());
+            assertEquals("com.github.copilot.JsonRpcException: Request failed", error.toString());
+            if (dataJson == null) {
+                assertNull(error.getData());
+            } else {
+                assertEquals(MAPPER.readTree(dataJson), error.getData());
+            }
+
+            var joinFailure = assertThrows(CompletionException.class, future::join);
+            assertSame(error, joinFailure.getCause());
+        }
+    }
+
+    @Test
+    void preservesSuccessfulResponses() throws Exception {
+        try (var server = new FramedServer(Reply.SUCCESS, null);
+                var client = new CopilotClient(new CopilotClientOptions().setCliUrl(server.url()))) {
+            client.start().get(5, TimeUnit.SECONDS);
+            assertEquals("hello", client.ping("hello").get(5, TimeUnit.SECONDS).message());
+        }
+    }
+
+    @Test
+    void localFailuresRemainDistinctFromRemoteErrors() {
+        try (var client = new CopilotClient(new CopilotClientOptions().setAutoStart(false))) {
+            RuntimeException failure = assertThrows(IllegalStateException.class, () -> client.ping("not connected"));
+            assertEquals("Client not connected. Call start() first.", failure.getMessage());
+            assertFalse(failure instanceof JsonRpcException);
+        }
+    }
+
+    @Test
+    void preservesConstructorCompatibility() throws Exception {
+        var withoutData = new JsonRpcException(ERROR_CODE, ERROR_MESSAGE);
+        assertNull(withoutData.getData());
+        assertEquals(ERROR_CODE, withoutData.getCode());
+        assertEquals(ERROR_MESSAGE, withoutData.getMessage());
+        var data = MAPPER.readTree("{\"detail\":false}");
+        var withData = new JsonRpcException(ERROR_CODE, ERROR_MESSAGE, data);
+        assertSame(data, withData.getData());
+        assertEquals(withoutData.toString(), withData.toString());
+    }
+
+    @Test
+    void readsExceptionSerializedBeforePublicDataApi() throws Exception {
+        // Serialized with the pre-data, package-private class and an empty stack trace.
+        var serialized = Base64.getDecoder().decode(
+                "rO0ABXNyACNjb20uZ2l0aHViLmNvcGlsb3QuSnNvblJwY0V4Y2VwdGlvbuJ4OuGze8omAgABSQAEY29kZXhyABpqYXZhLmxhbmcuUnVudGltZUV4Y2VwdGlvbp5fBkcKNIPlAgAAeHIAE2phdmEubGFuZy5FeGNlcHRpb27Q/R8+GjscxAIAAHhyABNqYXZhLmxhbmcuVGhyb3dhYmxl1cY1Jzl3uMsDAARMAAVjYXVzZXQAFUxqYXZhL2xhbmcvVGhyb3dhYmxlO0wADWRldGFpbE1lc3NhZ2V0ABJMamF2YS9sYW5nL1N0cmluZztbAApzdGFja1RyYWNldAAeW0xqYXZhL2xhbmcvU3RhY2tUcmFjZUVsZW1lbnQ7TAAUc3VwcHJlc3NlZEV4Y2VwdGlvbnN0ABBMamF2YS91dGlsL0xpc3Q7eHBxAH4ACHQADlJlcXVlc3QgZmFpbGVkdXIAHltMamF2YS5sYW5nLlN0YWNrVHJhY2VFbGVtZW50OwJGKjw8/SI5AgAAeHAAAAAAc3IAH2phdmEudXRpbC5Db2xsZWN0aW9ucyRFbXB0eUxpc3R6uBe0PKee3gIAAHhweP//gv8=");
+        try (var input = new ObjectInputStream(new ByteArrayInputStream(serialized))) {
+            var error = assertInstanceOf(JsonRpcException.class, input.readObject());
+            assertEquals(ERROR_CODE, error.getCode());
+            assertEquals(ERROR_MESSAGE, error.getMessage());
+            assertNull(error.getData());
+        }
+    }
+
+    @Test
+    void serializationPreservesErrorData() throws Exception {
+        var data = MAPPER.readTree("{\"detail\":[false,null]}");
+        var bytes = new ByteArrayOutputStream();
+        try (var output = new ObjectOutputStream(bytes)) {
+            output.writeObject(new JsonRpcException(ERROR_CODE, ERROR_MESSAGE, data));
+        }
+        try (var input = new ObjectInputStream(new ByteArrayInputStream(bytes.toByteArray()))) {
+            var error = assertInstanceOf(JsonRpcException.class, input.readObject());
+            assertEquals(ERROR_CODE, error.getCode());
+            assertEquals(ERROR_MESSAGE, error.getMessage());
+            assertEquals(data, error.getData());
+        }
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"not-a-number", "2147483648"})
+    void framedPeerReportsMalformedLength(String length) {
+        // Fixture diagnostics, not coverage of the SDK's independent frame parser.
+        var frame = ("Content-Length: " + length + "\r\n\r\n").getBytes(StandardCharsets.US_ASCII);
+        var error = assertThrows(IOException.class, () -> FramedServer.readFrame(new ByteArrayInputStream(frame)));
+        assertEquals("Invalid Content-Length: " + length, error.getMessage());
+        assertInstanceOf(NumberFormatException.class, error.getCause());
+    }
+
+    private enum Reply {
+        ERROR, SUCCESS
+    }
+
+    /**
+     * A framed loopback peer that uses no SDK internals or CLI runtime.
+     */
+    private static final class FramedServer implements AutoCloseable {
+
+        private final ServerSocket listener;
+        private final Thread worker;
+        private final CompletableFuture<Void> finished = new CompletableFuture<>();
+        private volatile Socket socket;
+        private volatile boolean closing;
+
+        FramedServer(Reply reply, String dataJson) throws IOException {
+            listener = new ServerSocket(0, 1, InetAddress.getByName("127.0.0.1"));
+            worker = new Thread(() -> serve(reply, dataJson), "json-rpc-error-data-peer");
+            worker.setDaemon(true);
+            worker.start();
+        }
+
+        String url() {
+            return "127.0.0.1:" + listener.getLocalPort();
+        }
+
+        private void serve(Reply reply, String dataJson) {
+            try (var accepted = listener.accept()) {
+                socket = accepted;
+                while (!closing) {
+                    JsonNode request = readFrame(accepted.getInputStream());
+                    if (request == null) {
+                        break;
+                    }
+                    if (!request.has("id")) {
+                        continue;
+                    }
+                    var response = MAPPER.createObjectNode().put("jsonrpc", "2.0");
+                    response.set("id", request.get("id"));
+                    switch (request.path("method").asText()) {
+                        case "connect" -> response.putObject("result").put("protocolVersion", 2);
+                        case "ping" -> {
+                            if (reply == Reply.SUCCESS) {
+                                response.putObject("result")
+                                        .put("message", request.path("params").path("message").asText())
+                                        .put("protocolVersion", 2);
+                            } else {
+                                var error = response.putObject("error").put("code", ERROR_CODE).put("message",
+                                        ERROR_MESSAGE);
+                                if (dataJson != null) {
+                                    error.set("data", MAPPER.readTree(dataJson));
+                                }
+                            }
+                        }
+                        case "runtime.shutdown" -> response.putObject("result");
+                        default -> throw new IOException("Unexpected method: " + request.path("method"));
+                    }
+                    writeFrame(accepted.getOutputStream(), response);
+                }
+            } catch (IOException ex) {
+                if (!closing) {
+                    finished.completeExceptionally(ex);
+                    return;
+                }
+            } catch (RuntimeException | Error ex) {
+                finished.completeExceptionally(ex);
+                return;
+            }
+            finished.complete(null);
+        }
+
+        private static JsonNode readFrame(InputStream input) throws IOException {
+            var header = new StringBuilder();
+            while (!header.toString().endsWith("\r\n\r\n")) {
+                int value = input.read();
+                if (value < 0) {
+                    if (header.isEmpty()) {
+                        return null;
+                    }
+                    throw new EOFException("Incomplete frame header");
+                }
+                header.append((char) value);
+                if (header.length() > 1024) {
+                    throw new IOException("Frame header too large");
+                }
+            }
+            int length = -1;
+            for (String line : header.toString().split("\r\n")) {
+                if (line.startsWith("Content-Length:")) {
+                    var value = line.substring("Content-Length:".length()).trim();
+                    try {
+                        length = Integer.parseInt(value);
+                    } catch (NumberFormatException ex) {
+                        throw new IOException("Invalid Content-Length: " + value, ex);
+                    }
+                }
+            }
+            if (length < 0 || length > 65536) {
+                throw new IOException("Invalid frame length: " + length);
+            }
+            byte[] body = input.readNBytes(length);
+            if (body.length != length) {
+                throw new EOFException("Incomplete frame body");
+            }
+            return MAPPER.readTree(body);
+        }
+
+        private static void writeFrame(OutputStream output, JsonNode response) throws IOException {
+            byte[] body = MAPPER.writeValueAsBytes(response);
+            output.write(("Content-Length: " + body.length + "\r\n\r\n").getBytes(StandardCharsets.US_ASCII));
+            output.write(body);
+            output.flush();
+        }
+
+        @Override
+        public void close() throws Exception {
+            closing = true;
+            listener.close();
+            Socket accepted = socket;
+            if (accepted != null) {
+                accepted.close();
+            }
+            worker.join(5000);
+            assertFalse(worker.isAlive(), "Framed peer must terminate");
+            finished.get(5, TimeUnit.SECONDS);
+        }
+    }
+}
diff --git a/java/sdk/src/test/java/com/github/copilot/generated/rpc/ConnectorSerializationTest.java b/java/sdk/src/test/java/com/github/copilot/generated/rpc/ConnectorSerializationTest.java
new file mode 100644
index 0000000000..281569b8f1
--- /dev/null
+++ b/java/sdk/src/test/java/com/github/copilot/generated/rpc/ConnectorSerializationTest.java
@@ -0,0 +1,94 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+package com.github.copilot.generated.rpc;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import org.junit.jupiter.api.Test;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.github.copilot.AllowCopilotExperimental;
+
+@AllowCopilotExperimental
+class ConnectorSerializationTest {
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    @Test
+    void connectorConnectResult_roundTrips_all_variants() throws Exception {
+        var connected = roundTrip("""
+                {
+                  "kind": "connected",
+                  "status": {
+                    "apiVersion": 1,
+                    "availability": "enabled",
+                    "accountId": "account-1",
+                    "catalog": {
+                      "revision": 7,
+                      "refreshedAtMs": 1000,
+                      "connectors": [{
+                        "name": "outlook",
+                        "displayName": "Outlook",
+                        "description": "Mail and calendar",
+                        "status": "connected",
+                        "runtimeServerIds": ["connector-outlook"]
+                      }]
+                    },
+                    "runtimeServers": [{
+                      "runtimeServerId": "connector-outlook",
+                      "connectorName": "outlook",
+                      "status": "connected"
+                    }],
+                    "pendingConnections": 0
+                  }
+                }
+                """, ConnectorConnectResultConnected.class);
+        assertEquals(ConnectorAvailability.ENABLED, connected.getStatus().availability());
+        assertEquals(ConnectorCatalogStatus.CONNECTED, connected.getStatus().catalog().connectors().get(0).status());
+        assertEquals(ConnectorMcpStatus.CONNECTED, connected.getStatus().runtimeServers().get(0).status());
+
+        var consentRequired = roundTrip("""
+                {
+                  "kind": "consent_required",
+                  "consentUrl": "https://example.com/consent",
+                  "continuationId": "continuation-1"
+                }
+                """, ConnectorConnectResultConsentRequired.class);
+        assertEquals("https://example.com/consent", consentRequired.getConsentUrl());
+        assertEquals("continuation-1", consentRequired.getContinuationId());
+
+        var pending = roundTrip("""
+                {
+                  "kind": "pending",
+                  "continuationId": "continuation-2"
+                }
+                """, ConnectorConnectResultPending.class);
+        assertEquals("continuation-2", pending.getContinuationId());
+    }
+
+    @Test
+    void connectorGeneratedRecords_preserve_wire_names_and_null_omission() throws Exception {
+        var params = new SessionConnectorsContinueConnectionParams(null, "continuation-1", 4L, 500L, 10_000L);
+
+        var json = MAPPER.readTree(MAPPER.writeValueAsString(params));
+
+        assertFalse(json.has("sessionId"));
+        assertEquals("continuation-1", json.get("continuationId").asText());
+        assertEquals(4L, json.get("maxAttempts").asLong());
+        assertEquals(500L, json.get("pollIntervalMs").asLong());
+        assertEquals(10_000L, json.get("deadlineMs").asLong());
+        assertEquals(params, MAPPER.treeToValue(json, SessionConnectorsContinueConnectionParams.class));
+    }
+
+    private static <T extends ConnectorConnectResult> T roundTrip(String json, Class<T> expectedType) throws Exception {
+        var result = MAPPER.readValue(json, ConnectorConnectResult.class);
+        var typedResult = assertInstanceOf(expectedType, result);
+        assertEquals(typedResult.getKind(),
+                MAPPER.readTree(MAPPER.writeValueAsString(typedResult)).get("kind").asText());
+
+        var serialized = MAPPER.writeValueAsString(typedResult);
+        return assertInstanceOf(expectedType, MAPPER.readValue(serialized, ConnectorConnectResult.class));
+    }
+}
diff --git a/java/sdk/src/test/java/com/github/copilot/generated/rpc/GeneratedRpcApiCoverageTest.java b/java/sdk/src/test/java/com/github/copilot/generated/rpc/GeneratedRpcApiCoverageTest.java
index ed5150a1a5..c738d6673d 100644
--- a/java/sdk/src/test/java/com/github/copilot/generated/rpc/GeneratedRpcApiCoverageTest.java
+++ b/java/sdk/src/test/java/com/github/copilot/generated/rpc/GeneratedRpcApiCoverageTest.java
@@ -74,6 +74,12 @@ static Stream<Arguments> newRpcDispatches() {
                 dispatch("session.managedSettings.get", SessionManagedSettingsGetResult.class, """
                         {"sessionId":"bound-session"}
                         """, (server, session) -> session.managedSettings.get()),
+                dispatch("session.instructions.reload", Void.class, """
+                        {"sessionId":"bound-session"}
+                        """, (server, session) -> session.instructions.reload()),
+                dispatch("session.customizations.reload", SessionCustomizationsReloadResult.class, """
+                        {"sessionId":"bound-session"}
+                        """, (server, session) -> session.customizations.reload()),
                 dispatch("session.plugins.install", SessionPluginsInstallResult.class, """
                         {"sessionId":"bound-session","source":"plugin@market"}
                         """,
diff --git a/nodejs/README.md b/nodejs/README.md
index 7ecaac4b28..b89fce6331 100644
--- a/nodejs/README.md
+++ b/nodejs/README.md
@@ -18,11 +18,6 @@ The checked-in `copilotCliVersion` in `package.json` and compiled metadata in
 `src/cliVersion.ts` use a development placeholder. The public SDK snapshot
 replaces both with the CLI version published for that snapshot.
 
-Do not change these pins for runtime-repository development. If they contain
-`0.0.0-dev`, use the same-checkout runtime; release snapshot export owns replacing
-development placeholders with a published CLI version. See
-[checkout preparation](../CONTRIBUTING.md#testing-an-unreleased-runtime-api).
-
 `npm run pack:release` builds the main package and all platform packages. Set
 `COPILOT_CLI_DOWNLOAD_BASE_URL` to use a release mirror while packaging.
 Release workflows instead set `COPILOT_SDK_RUNTIME_PACKAGE_DIR` to a directory
@@ -44,11 +39,7 @@ npm install @github/copilot-sdk
 
 ## Run the Sample
 
-Try the interactive chat sample from the SDK root (`src/sdk` when nested).
-In the runtime repository, first run `pnpm run build:cli` from the runtime root
-to prepare the same-checkout executable, then return to `src/sdk`.
-Building the Node SDK alone does not build the runtime. For dependency
-prerequisites, see [development setup](#development).
+Try the interactive chat sample (from the repo root):
 
 ```bash
 cd nodejs
@@ -172,6 +163,7 @@ Create a new conversation session.
 - `systemMessage?: SystemMessageConfig` - System message customization (see below)
 - `infiniteSessions?: InfiniteSessionConfig` - Configure automatic context compaction (see below)
 - `workingDirectory?: string` - Working directory for the session (default: runtime process cwd).
+- `refreshCustomInstructions?: boolean` - Invalidates the process-wide custom-instruction discovery cache before creating this session, so instruction-file edits made in the same runtime are read again. Defaults to `false` (cache reuse). Other sessions in this runtime may observe updated instructions on later turns or discovery. This does not watch files or enable disabled instruction loading. Available on `SessionConfig`, not `ResumeSessionConfig`.
 - `enableSessionStore?: boolean` - Enables the cross-session store for search and retrieval across sessions. When unset in `"copilot-cli"` mode, the runtime default applies (enabled). In `"empty"` mode, defaults to disabled.
 - `gitHubTokenProvider?: GitHubTokenProvider` - Acquires rotating, session-scoped GitHub tokens. Token results require a positive `expiresIn` value in seconds remaining when the callback completes; production tokens typically last eight hours. Cannot be combined with `gitHubToken`.
 - `provider?: ProviderConfig` - Custom API provider configuration (BYOK - Bring Your Own Key). See [Custom Providers](#custom-providers) section.
@@ -309,6 +301,7 @@ Source is independent of delivery mode. Leaving it unset preserves the existing
 ##### `sendAndWait(options: MessageOptions, timeout?: number): Promise<AssistantMessageEvent | undefined>`
 
 Send a message and wait until the session becomes idle.
+Sub-agent events are still delivered to listeners, but do not complete the wait or supply its reply.
 
 **Options:**
 
@@ -1288,28 +1281,19 @@ try {
 
 ## Development
 
-Follow [SDK development setup](../CONTRIBUTING.md#developing-an-sdk) first,
-including the harness and corrections-script dependencies. From the SDK root
-(`src/sdk` in the runtime repository, or the standalone repository root):
+From the repository root:
 
 ```bash
-npm run build:nodejs
-npm run test:nodejs
-npm run check:nodejs
+cd test/harness
+npm ci
 ```
 
-In the runtime layout, these build/test commands refresh the projection and
-prepare the checked-out runtime for tests. For focused unit tests after
-installing Node dependencies:
-
 ```bash
-npm --prefix nodejs run test:unit
+cd nodejs
+npm ci
+npm test
 ```
 
-For native Vitest selectors on E2Es, use the
-[prepared-runtime instructions](../CONTRIBUTING.md#testing-an-unreleased-runtime-api);
-the SDK facade does not forward selectors.
-
 ## License
 
 MIT
diff --git a/nodejs/package.json b/nodejs/package.json
index 98398c857d..f6187b73d8 100644
--- a/nodejs/package.json
+++ b/nodejs/package.json
@@ -5,7 +5,7 @@
         "url": "https://github.com/github/copilot-sdk.git"
     },
     "version": "0.0.0-dev",
-    "copilotCliVersion": "1.0.89-1",
+    "copilotCliVersion": "1.0.89-3",
     "description": "TypeScript SDK for programmatic control of GitHub Copilot CLI via JSON-RPC",
     "main": "./dist/cjs/index.js",
     "types": "./dist/index.d.ts",
diff --git a/nodejs/samples/package-lock.json b/nodejs/samples/package-lock.json
index 03cdb82911..3215d8b297 100644
--- a/nodejs/samples/package-lock.json
+++ b/nodejs/samples/package-lock.json
@@ -1713,7 +1713,9 @@
             "license": "BSD-3-Clause"
         },
         "../node_modules/js-yaml": {
-            "version": "4.2.0",
+            "version": "4.3.2",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+            "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
             "dev": true,
             "funding": [
                 {
diff --git a/nodejs/src/cliVersion.ts b/nodejs/src/cliVersion.ts
index d5908055ad..a2c01fa144 100644
--- a/nodejs/src/cliVersion.ts
+++ b/nodejs/src/cliVersion.ts
@@ -1,3 +1,3 @@
-export const COPILOT_CLI_VERSION = "1.0.89-1";
+export const COPILOT_CLI_VERSION = "1.0.89-3";
 
 export const COPILOT_CLI_USE_NPM_PACKAGE = false;
diff --git a/nodejs/src/client.ts b/nodejs/src/client.ts
index c99af602e0..f4f911c273 100644
--- a/nodejs/src/client.ts
+++ b/nodejs/src/client.ts
@@ -1700,6 +1700,7 @@ export class CopilotClient {
                     ? { enableGitHubTelemetryForwarding: true }
                     : {}),
                 mcpServers: toWireMcpServers(config.mcpServers),
+                ...(config.diagnostics !== undefined ? { diagnostics: config.diagnostics } : {}),
                 mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
                 authClientIdMetadataUrl: config.authClientIdMetadataUrl,
                 envValueMode: "direct",
@@ -1709,6 +1710,7 @@ export class CopilotClient {
                 agent: config.agent,
                 configDir: config.configDirectory,
                 enableConfigDiscovery: config.enableConfigDiscovery,
+                refreshCustomInstructions: config.refreshCustomInstructions,
                 skipEmbeddingRetrieval: config.skipEmbeddingRetrieval,
                 embeddingCacheStorage: config.embeddingCacheStorage,
                 organizationCustomInstructions: config.organizationCustomInstructions,
@@ -2003,6 +2005,7 @@ export class CopilotClient {
                     ? { enableGitHubTelemetryForwarding: true }
                     : {}),
                 mcpServers: toWireMcpServers(config.mcpServers),
+                ...(config.diagnostics !== undefined ? { diagnostics: config.diagnostics } : {}),
                 mcpOAuthTokenStorage: config.mcpOAuthTokenStorage,
                 authClientIdMetadataUrl: config.authClientIdMetadataUrl,
                 envValueMode: "direct",
diff --git a/nodejs/src/generated/rpc.ts b/nodejs/src/generated/rpc.ts
index da14db8f03..16f5b1695a 100644
--- a/nodejs/src/generated/rpc.ts
+++ b/nodejs/src/generated/rpc.ts
@@ -1271,6 +1271,127 @@ export type DebugCollectLogsResultKind =
   | "archive"
   /** A directory containing the collected files was written. */
   | "directory";
+/**
+ * Whether the supplied diagnostic cursor remained within the retained buffer window.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticCursorStatus".
+ */
+/** @experimental */
+export type DiagnosticCursorStatus =
+  /** The cursor is valid for the current retained window. */
+  | "ok"
+  /** The cursor no longer addresses retained records; reading resumes at the oldest retained record. */
+  | "expired";
+/**
+ * One retained session-scoped diagnostic record. Potentially content-bearing diagnostic data is opt-in and must not be exported automatically as telemetry.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticEntry".
+ */
+/** @experimental */
+export type DiagnosticEntry = {
+  /**
+   * UTC RFC 3339 timestamp captured at the diagnostic source.
+   */
+  timestamp: string;
+  level: DiagnosticSeverity;
+  /**
+   * Agent identifier for a subagent host. Omitted for the root agent.
+   */
+  agentId?: string;
+  /**
+   * Human-readable diagnostic summary.
+   */
+  message: string;
+  /**
+   * Whether message or data was truncated to the record-size bound.
+   */
+  truncated?: boolean;
+  /**
+   * Original byte count when a known-size message or data value was truncated.
+   */
+  originalBytes?: number;
+  details: McpDiagnosticDetails;
+  /**
+   * Diagnostic source identifying the typed details payload.
+   */
+  source: "mcp";
+};
+/**
+ * Severity of an emitted diagnostic record.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticSeverity".
+ */
+/** @experimental */
+export type DiagnosticSeverity =
+  /** Failure that prevented or interrupted communication. */
+  | "error"
+  /** A recoverable warning or server standard-error output. */
+  | "warning"
+  /** Lifecycle transition. */
+  | "info"
+  /** Protocol-frame or launch diagnostic. */
+  | "debug"
+  /** HTTP metadata diagnostic. */
+  | "trace";
+/**
+ * Category for an MCP diagnostic record.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpDiagnosticKind".
+ */
+/** @experimental */
+export type McpDiagnosticKind =
+  /** Connection lifecycle transition or failure. */
+  | "lifecycle"
+  /** JSON-RPC protocol frame. */
+  | "protocol"
+  /** HTTP request or response metadata. */
+  | "http"
+  /** Local MCP server standard-error output. */
+  | "stderr";
+/**
+ * Direction of an observed MCP protocol frame.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpDiagnosticDirection".
+ */
+/** @experimental */
+export type McpDiagnosticDirection =
+  /** Frame emitted by the Copilot MCP client. */
+  | "client-to-server"
+  /** Frame received from the MCP server. */
+  | "server-to-client";
+/**
+ * Session-scoped diagnostic threshold. Capture is disabled by default and is never persisted with the session.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticLogLevel".
+ */
+/** @experimental */
+export type DiagnosticLogLevel =
+  /** Disable capture and clear retained diagnostics. */
+  | "off"
+  /** Capture failures only. */
+  | "error"
+  /** Capture failures, warnings, and stderr. */
+  | "warning"
+  /** Capture lifecycle diagnostics. */
+  | "info"
+  /** Capture protocol frames and launch diagnostics. */
+  | "debug"
+  /** Capture HTTP metadata in addition to debug diagnostics. */
+  | "trace";
+/**
+ * A supported diagnostic source.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticSource".
+ */
+/** @experimental */
+export type DiagnosticSource = "mcp";
 /**
  * Persisted extension discovery source
  *
@@ -3502,6 +3623,14 @@ export type SandboxConfigSource =
   | "unsupported_host"
   /** A repository policy selected the sandbox state. */
   | "repository_policy";
+/**
+ * Extensible identifier of a sandbox policy feature whose availability varies between hosts. A plain string, so an older client decodes a name added by a newer runtime; ignore names you do not recognize. Known values: `network` — sandboxed commands can reach the network (`network.allowOutbound`, on by default); on Linux this needs the tooling for Bubblewrap's private network namespace, such as slirp4netns. `network_filtering` — host rules and the sandbox proxy (`network.allowedHosts`, `network.blockedHosts`, `network.proxy`); on Linux this needs the same tooling as `network`; on Windows it needs a version with Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set `network.allowLocalNetwork`, because Windows reaches the local proxy only together with private-network access. `denied_paths` — native enforcement of `filesystem.deniedPaths`; on Windows this needs a version whose sandbox contract reports denied-path support. `shell` — shell commands inside the sandbox: bash on macOS and Linux, PowerShell on Windows; on Windows this needs a version with Process Security Environment 1.1 filesystem enumeration support.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxHostCapabilityName".
+ */
+/** @experimental */
+export type SandboxHostCapabilityName = string;
 /**
  * A session-scoped sandbox transition applied while handling a slash command
  *
@@ -8586,6 +8715,120 @@ export interface DebugCollectLogsSkippedEntry {
    */
   reason: string;
 }
+/**
+ * MCP-specific detail for a source-discriminated diagnostic entry.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpDiagnosticDetails".
+ */
+/** @experimental */
+export interface McpDiagnosticDetails {
+  kind: McpDiagnosticKind;
+  /**
+   * Configured MCP server name.
+   */
+  serverName: string;
+  /**
+   * Fresh identifier for the MCP connection attempt, including failed starts.
+   */
+  connectionId: string;
+  direction?: McpDiagnosticDirection;
+  /**
+   * Serialized diagnostic detail. Protocol and HTTP records use JSON when detail is present.
+   */
+  data?: string;
+}
+/**
+ * Per-source session diagnostics configuration.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticsConfiguration".
+ */
+/** @experimental */
+export interface DiagnosticsConfiguration {
+  sources: DiagnosticSourcesConfiguration;
+}
+/**
+ * Typed diagnostic source configuration. At least one source is required by diagnostics configuration methods.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticSourcesConfiguration".
+ */
+/** @experimental */
+export interface DiagnosticSourcesConfiguration {
+  mcp?: McpDiagnosticSourceConfiguration;
+}
+/**
+ * MCP diagnostic source configuration.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "McpDiagnosticSourceConfiguration".
+ */
+/** @experimental */
+export interface McpDiagnosticSourceConfiguration {
+  level: DiagnosticLogLevel;
+}
+/**
+ * Patch session diagnostic thresholds for explicitly supplied sources.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticsConfigureRequest".
+ */
+/** @experimental */
+export interface DiagnosticsConfigureRequest {
+  sources: DiagnosticSourcesConfiguration;
+}
+/**
+ * Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the default waitMs is zero (maximum 30000).
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticsReadRequest".
+ */
+/** @experimental */
+export interface DiagnosticsReadRequest {
+  /**
+   * Nonempty selection of sources to read. Each source may be listed once.
+   */
+  sources: DiagnosticSource[];
+  /**
+   * Opaque cursor returned by an earlier read. Omit to start at the oldest retained record.
+   */
+  cursor?: string;
+  /**
+   * Maximum number of records to return, from 1 through 500. Omit for 100.
+   */
+  max?: number;
+  /**
+   * Maximum time in milliseconds to wait for a new record, from 0 through 30000.
+   */
+  waitMs?: number;
+}
+/**
+ * One cursor-addressed page of retained session diagnostics.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "DiagnosticsReadResult".
+ */
+/** @experimental */
+export interface DiagnosticsReadResult {
+  /**
+   * Retained records beginning at the requested cursor.
+   */
+  entries: DiagnosticEntry[];
+  /**
+   * Opaque cursor for the next independent read.
+   */
+  cursor: string;
+  cursorStatus: DiagnosticCursorStatus;
+  /**
+   * Number of records lost before this page when known. Omitted when a buffer generation change makes the count unknowable.
+   */
+  droppedCount?: number;
+  /**
+   * Whether additional retained records follow this page.
+   */
+  hasMore: boolean;
+}
 /**
  * Discovered extension metadata and persistent enablement state.
  *
@@ -12420,6 +12663,10 @@ export interface McpServerConfigHttp {
    * OAuth client ID for a pre-registered remote MCP OAuth client.
    */
   oauthClientId?: string;
+  /**
+   * Non-empty array of valid RFC 6749 scope-token strings to request for the statically configured OAuth client when the server challenge omits scope or provides an empty scope. Requires a non-empty oauthClientId. These scopes take precedence over protected-resource metadata.
+   */
+  oauthScopes?: string[];
   /**
    * Whether the configured OAuth client is public and does not require a client secret.
    */
@@ -18323,6 +18570,10 @@ export interface QueuePendingItems {
    */
   displayText: string;
   agentMode: SendAgentMode;
+  /**
+   * Optional source tag associated with this pending queue entry. This is an open string, not authenticated authorship. In particular, `user` does not prove that a person typed the message. If the source is absent or unrecognized, consumers must not infer human or agent authorship and should handle the entry neutrally. Consumers should tolerate future source values.
+   */
+  source?: string;
 }
 /**
  * Snapshot of the session's pending queued items and immediate-steering messages.
@@ -18344,6 +18595,10 @@ export interface QueuePendingItemsResult {
    * How many leading entries of `steeringMessages` have already been folded into the running turn (and so have an emitted `user.message`), as opposed to still waiting for one. Absent for hosts that do not distinguish the two.
    */
   inFlightSteeringCount?: number;
+  /**
+   * ID of the running turn's user message while the model has not answered it, so `withdrawMessage` can still take it back once nothing sent after it is pending. A message leaves `items` when its turn starts, before its `user.message` is recorded; this tells that message apart from one that was removed. Absent when no turn prompt can be taken back.
+   */
+  withdrawableTurnMessageId?: string;
 }
 /**
  * Parameters for removing a queued item by stable id.
@@ -18487,7 +18742,7 @@ export interface QueueUpdateTextResult {
   updated: boolean;
 }
 /**
- * Conditional withdrawal of a single user message, before the runtime claims it for delivery.
+ * Conditional withdrawal of a single user message, from its queue or from the running turn it started.
  *
  * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
  * via the `definition` "QueueWithdrawMessageRequest".
@@ -18503,6 +18758,23 @@ export interface QueueWithdrawMessageRequest {
    */
   expectedPrompt: string;
 }
+/**
+ * Result of withdrawing a user message.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "QueueWithdrawMessageResult".
+ */
+/** @experimental */
+export interface QueueWithdrawMessageResult {
+  /**
+   * True when the message left the queue or, for a running turn, history.
+   */
+  removed: boolean;
+  /**
+   * True when the running turn was interrupted to withdraw the message. With removed false, the turn was interrupted but its events could not be removed, for example because the model answered first, so the message stays in the interrupted turn.
+   */
+  interrupted: boolean;
+}
 /**
  * Event type to register consumer interest for, used by runtime gating logic.
  *
@@ -19117,6 +19389,45 @@ export interface SandboxEnforcementStatus {
    */
   reason?: string;
 }
+/**
+ * Whether this host can run one sandbox policy feature. A session whose effective policy uses an unsupported feature fails each sandboxed command with `reason`.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxHostCapability".
+ */
+/** @experimental */
+export interface SandboxHostCapability {
+  name: SandboxHostCapabilityName;
+  /**
+   * Whether this host can run the feature.
+   */
+  supported: boolean;
+  /**
+   * Human-readable reason and remedy when the feature is unsupported, such as a package to install or an OS update. Present only when `supported` is false.
+   */
+  reason?: string;
+}
+/**
+ * Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package.
+ *
+ * This interface was referenced by `_RpcSchemaRoot`'s JSON-Schema
+ * via the `definition` "SandboxHostSupport".
+ */
+/** @experimental */
+export interface SandboxHostSupport {
+  /**
+   * Whether a process-containment backend is usable on this host: Seatbelt on macOS, Bubblewrap on Linux, or ProcessContainer on Windows.
+   */
+  supported: boolean;
+  /**
+   * Human-readable reason the sandbox cannot run on this host. Present only when `supported` is false.
+   */
+  reason?: string;
+  /**
+   * Sandbox policy features whose availability varies between hosts that can run the backend. Empty when `supported` is false, because no feature can run without a backend. Later runtimes can add entries; ignore an entry whose `name` you do not recognize.
+   */
+  capabilities: SandboxHostCapability[];
+}
 /**
  * Register an absolute-time scheduled prompt.
  *
@@ -26963,6 +27274,16 @@ export function createServerRpc(connection: MessageConnection) {
                 connection.sendRequest("models.getBuiltInCatalog", {}),
         },
         /** @experimental */
+        sandbox: {
+            /**
+             * Reports whether the host running this runtime can run the command sandbox, without starting a session or spawning a sandboxed command.
+             *
+             * @returns Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package.
+             */
+            getHostSupport: async (): Promise<SandboxHostSupport> =>
+                connection.sendRequest("sandbox.getHostSupport", {}),
+        },
+        /** @experimental */
         tools: {
             /**
              * Lists built-in tools available for a model.
@@ -28499,6 +28820,21 @@ export function createSessionRpc(connection: MessageConnection, sessionId: strin
              */
             getSources: async (): Promise<InstructionsGetSourcesResult> =>
                 connection.sendRequest("session.instructions.getSources", { sessionId }),
+            /**
+             * Invalidates cached custom-instruction discovery so subsequent turns and source reads observe instruction files currently on disk.
+             */
+            reload: async (): Promise<void> =>
+                connection.sendRequest("session.instructions.reload", { sessionId }),
+        },
+        /** @experimental */
+        customizations: {
+            /**
+             * Reloads all repository and user customizations for the active session: instructions, plugins and their MCP servers and hooks, custom agents, extensions, and skills. Returns diagnostics from the final skill reload.
+             *
+             * @returns Diagnostics from reloading skill definitions, with warnings and errors as separate lists.
+             */
+            reload: async (): Promise<SkillsLoadDiagnostics> =>
+                connection.sendRequest("session.customizations.reload", { sessionId }),
         },
         /** @experimental */
         fleet: {
@@ -28963,6 +29299,27 @@ export function createSessionRpc(connection: MessageConnection, sessionId: strin
             },
         },
         /** @experimental */
+        diagnostics: {
+            /**
+             * Patches configured session diagnostic sources without restarting their producers. Setting a source level to off clears its retained diagnostics and invalidates cursors selecting that source.
+             *
+             * @param params Patch session diagnostic thresholds for explicitly supplied sources.
+             *
+             * @returns Per-source session diagnostics configuration.
+             */
+            configure: async (params: DiagnosticsConfigureRequest): Promise<DiagnosticsConfiguration> =>
+                connection.sendRequest("session.diagnostics.configure", { sessionId, ...params }),
+            /**
+             * Reads a bounded batch of retained session diagnostics for the selected sources. Records are never consumed and each reader advances independently through its opaque cursor.
+             *
+             * @param params Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the default waitMs is zero (maximum 30000).
+             *
+             * @returns One cursor-addressed page of retained session diagnostics.
+             */
+            read: async (params: DiagnosticsReadRequest): Promise<DiagnosticsReadResult> =>
+                connection.sendRequest("session.diagnostics.read", { sessionId, ...params }),
+        },
+        /** @experimental */
         connectors: {
             /**
              * Returns feature availability and bounded polling limits for the EXPERIMENTAL session connector API. This method never performs a Connector service request.
@@ -29952,13 +30309,13 @@ export function createSessionRpc(connection: MessageConnection, sessionId: strin
             updateText: async (params: QueueUpdateTextRequest): Promise<QueueUpdateTextResult> =>
                 connection.sendRequest("session.queue.updateText", { sessionId, ...params }),
             /**
-             * Atomically withdraws an unchanged, unconsumed user message from the local queued or steering lane. A client retaining the original draft may restore it only when removed is true. Does not interrupt the running turn.
+             * Atomically withdraws an unchanged user message of a local session: from the queued or steering lane while unconsumed, or from the running turn it started while the model has not answered it and nothing the user sent after it is pending. Withdrawing from the running turn interrupts that turn and removes its events from history. A client retaining the original draft may restore it only when removed is true.
              *
-             * @param params Conditional withdrawal of a single user message, before the runtime claims it for delivery.
+             * @param params Conditional withdrawal of a single user message, from its queue or from the running turn it started.
              *
-             * @returns Result of removing a queued item.
+             * @returns Result of withdrawing a user message.
              */
-            withdrawMessage: async (params: QueueWithdrawMessageRequest): Promise<QueueRemoveAtResult> =>
+            withdrawMessage: async (params: QueueWithdrawMessageRequest): Promise<QueueWithdrawMessageResult> =>
                 connection.sendRequest("session.queue.withdrawMessage", { sessionId, ...params }),
             /**
              * Atomically appends text and attachments to an unchanged, unconsumed local steering message. Returns updated=false if delivery or withdrawal already claimed the message.
diff --git a/nodejs/src/generated/session-events.ts b/nodejs/src/generated/session-events.ts
index 2f3cefbc5d..3b484f9e8c 100644
--- a/nodejs/src/generated/session-events.ts
+++ b/nodejs/src/generated/session-events.ts
@@ -2917,12 +2917,16 @@ export interface SnapshotRewindEvent {
  * Session rewind details including target event and count of removed events
  */
 export interface SnapshotRewindData {
+  /**
+   * The removed events, starting with `upToEventId`. Later events not listed were kept, such as a background agent's events that interleaved with a withdrawn turn
+   */
+  eventIds?: string[];
   /**
    * Number of events that were removed by the rewind
    */
   eventsRemoved: number;
   /**
-   * Event ID that was rewound to; this event and all after it were removed
+   * First removed event. Without `eventIds`, it and every event after it were removed
    */
   upToEventId: string;
 }
@@ -3628,7 +3632,7 @@ export interface CompactionCompleteCompactionTokensUsedCopilotUsageTokenDetail {
   tokenType: string;
 }
 /**
- * Original request-level and effective conversation reasoning effort for a Responses history boundary
+ * Original request-level and effective conversation reasoning effort for a provider history boundary; the historical type name is retained for compatibility
  */
 export interface ResponsesReasoning {
   /**
@@ -5725,6 +5729,10 @@ export interface FusionAttribution {
    * Stable identifier for the HydraFusion turn that produced the event.
    */
   fusionId: string;
+  /**
+   * Whether this model request consumed a user steering message rather than only internal Fusion work.
+   */
+  hasUserSteering?: boolean;
   /**
    * HydraFusion orchestration pattern selected for the turn.
    */
@@ -10854,6 +10862,10 @@ export interface McpOauthRequiredStaticClientConfig {
    * Whether this is a public OAuth client
    */
   publicClient?: boolean;
+  /**
+   * Configured OAuth scope string used when the server challenge omits scope or provides an empty scope
+   */
+  scope?: string;
 }
 /**
  * OAuth WWW-Authenticate parameters parsed from an MCP auth challenge
diff --git a/nodejs/src/index.ts b/nodejs/src/index.ts
index 42adbe30f6..c46742d853 100644
--- a/nodejs/src/index.ts
+++ b/nodejs/src/index.ts
@@ -61,6 +61,20 @@ export type {
     CanvasProviderIdentity,
     CloudSessionOptions,
     CloudSessionRepository,
+    ConnectorAccountRequest,
+    ConnectorAvailability,
+    ConnectorCapabilities,
+    ConnectorCatalogEntry,
+    ConnectorCatalogResult,
+    ConnectorCatalogStatus,
+    ConnectorConnectRequest,
+    ConnectorConnectResult,
+    ConnectorContinueRequest,
+    ConnectorDisconnectResult,
+    ConnectorMcpStatus,
+    ConnectorReconcileRequest,
+    ConnectorRuntimeStatus,
+    ConnectorStatus,
     AutoModeSwitchHandler,
     AutoModeSwitchRequest,
     AutoModeSwitchResponse,
diff --git a/nodejs/src/session.ts b/nodejs/src/session.ts
index 97c073f64d..43b2128625 100644
--- a/nodejs/src/session.ts
+++ b/nodejs/src/session.ts
@@ -1156,6 +1156,7 @@ export class CopilotSession {
      * assistant has finished processing the message.
      *
      * Events are still delivered to handlers registered via {@link on} while waiting.
+     * Sub-agent events with a non-empty `agentId` do not complete the wait or supply its reply.
      * With a schema as the second argument, returns its parsed, validated result.
      * Structured waits select only root-agent output originating from this send;
      * other queued work may delay session.idle but cannot replace the result.
@@ -1238,6 +1239,7 @@ export class CopilotSession {
         // Register event handler BEFORE calling send to avoid race condition
         // where session.idle fires before we start listening
         const unsubscribe = this.on((event) => {
+            if (event.agentId) return;
             if (event.type === "assistant.message") {
                 lastAssistantMessage = event;
             } else if (event.type === "session.idle" && event.data.mode !== "autopilot") {
diff --git a/nodejs/src/types.ts b/nodejs/src/types.ts
index 6a19116a37..98e594356c 100644
--- a/nodejs/src/types.ts
+++ b/nodejs/src/types.ts
@@ -28,6 +28,7 @@ import type {
     GitHubTokenAcquireResult,
     GitHubTelemetryNotification,
     ModelBillingTokenPrices,
+    DiagnosticsConfiguration,
     OpenCanvasInstance,
     RemoteSessionMode,
     CurrentToolMetadata,
@@ -36,6 +37,20 @@ import type { ToolSet } from "./toolSet.js";
 export type { RemoteSessionMode } from "./generated/rpc.js";
 export type { CurrentToolMetadata } from "./generated/rpc.js";
 export type {
+    ConnectorAccountRequest,
+    ConnectorAvailability,
+    ConnectorCapabilities,
+    ConnectorCatalogEntry,
+    ConnectorCatalogResult,
+    ConnectorCatalogStatus,
+    ConnectorConnectRequest,
+    ConnectorConnectResult,
+    ConnectorContinueRequest,
+    ConnectorDisconnectResult,
+    ConnectorMcpStatus,
+    ConnectorReconcileRequest,
+    ConnectorRuntimeStatus,
+    ConnectorStatus,
     ExtensionLaunchProfile,
     ExtensionLaunchProviderResolveRequest,
     ExtensionLaunchProviderResolveResult,
@@ -2055,6 +2070,8 @@ export interface McpAuthStaticClientConfig {
     grantType?: "client_credentials";
     /** Whether this is a public OAuth client. */
     publicClient?: boolean;
+    /** Configured OAuth scope string used when the server challenge omits scope. */
+    scope?: string;
 }
 
 /** MCP OAuth request that the SDK host can satisfy with a host-acquired token. */
@@ -2379,6 +2396,17 @@ export interface SessionConfigBase {
      */
     contextTier?: ContextTier;
 
+    /**
+     * Enables session-scoped MCP diagnostic capture at the requested level.
+     *
+     * Diagnostics are off by default. At `"debug"` and `"trace"` levels, entries
+     * can contain MCP payloads, tool arguments, paths, and server stderr. Do not
+     * upload entries as telemetry or export them without deliberate host action.
+     * Omit this option when resuming a resident session to preserve its current
+     * diagnostic level.
+     */
+    diagnostics?: DiagnosticsConfiguration;
+
     /** Per-property overrides for model capabilities, deep-merged over runtime defaults. */
     modelCapabilities?: ModelCapabilitiesOverride;
 
@@ -3011,6 +3039,15 @@ export interface SessionConfig extends SessionConfigBase {
      */
     sessionId?: string;
 
+    /**
+     * Invalidates the process-wide custom-instruction discovery cache before
+     * creating this session. Use when instruction files changed in the same runtime.
+     * Other sessions in this runtime may observe updated instructions on later turns
+     * or discovery. This does not watch files or enable disabled instruction loading.
+     * @default false
+     */
+    refreshCustomInstructions?: boolean;
+
     /**
      * Creates a remote session in the cloud instead of a local session.
      * The optional repository is associated with the cloud session.
diff --git a/nodejs/test/client.test.ts b/nodejs/test/client.test.ts
index 8175b4b5ab..3cb97160c9 100644
--- a/nodejs/test/client.test.ts
+++ b/nodejs/test/client.test.ts
@@ -332,6 +332,7 @@ describe("CopilotClient", () => {
                 clientSecret: "static-secret",
                 grantType: "client_credentials",
                 publicClient: false,
+                scope: "configured.read",
             },
         });
 
@@ -341,6 +342,7 @@ describe("CopilotClient", () => {
             clientSecret: "static-secret",
             grantType: "client_credentials",
             publicClient: false,
+            scope: "configured.read",
         });
         expect(sendRequest).toHaveBeenCalledWith("session.mcp.oauth.handlePendingRequest", {
             sessionId: "session-1",
@@ -1136,6 +1138,7 @@ describe("CopilotClient", () => {
             enableFileChangeTracking: true,
             excludedBuiltinAgents: ["explore"],
             sessionLimits: { maxAiCredits: 30 },
+            diagnostics: { sources: { mcp: { level: "debug" } } },
         });
         await client.resumeSession(session.sessionId, {
             onPermissionRequest: approveAll,
@@ -1143,6 +1146,7 @@ describe("CopilotClient", () => {
             enableFileChangeTracking: false,
             excludedBuiltinAgents: ["task"],
             sessionLimits: { maxAiCredits: 15 },
+            diagnostics: { sources: { mcp: { level: "trace" } } },
         });
 
         const createPayload = spy.mock.calls.find(
@@ -1155,10 +1159,39 @@ describe("CopilotClient", () => {
         expect(createPayload.enableFileChangeTracking).toBe(true);
         expect(createPayload.excludedBuiltinAgents).toEqual(["explore"]);
         expect(createPayload.sessionLimits).toEqual({ maxAiCredits: 30 });
+        expect(createPayload.diagnostics).toEqual({ sources: { mcp: { level: "debug" } } });
         expect(resumePayload.enableCitations).toBe(false);
         expect(resumePayload.enableFileChangeTracking).toBe(false);
         expect(resumePayload.excludedBuiltinAgents).toEqual(["task"]);
         expect(resumePayload.sessionLimits).toEqual({ maxAiCredits: 15 });
+        expect(resumePayload.diagnostics).toEqual({ sources: { mcp: { level: "trace" } } });
+    });
+
+    it("omits diagnostics when they are not configured", async () => {
+        const client = new CopilotClient();
+        await client.start();
+        onTestFinished(() => stopClient(client));
+
+        const spy = vi
+            .spyOn((client as any).connection!, "sendRequest")
+            .mockImplementation(async (method: string, params: any) => {
+                if (method === "session.create" || method === "session.resume") {
+                    return { sessionId: params.sessionId };
+                }
+                throw new Error(`Unexpected method: ${method}`);
+            });
+
+        const session = await client.createSession({ onPermissionRequest: approveAll });
+        await client.resumeSession(session.sessionId, { onPermissionRequest: approveAll });
+
+        const createPayload = spy.mock.calls.find(
+            ([method]) => method === "session.create"
+        )![1] as Record<string, unknown>;
+        const resumePayload = spy.mock.calls.find(
+            ([method]) => method === "session.resume"
+        )![1] as Record<string, unknown>;
+        expect(createPayload).not.toHaveProperty("diagnostics");
+        expect(resumePayload).not.toHaveProperty("diagnostics");
     });
 
     it("opts into GitHub telemetry forwarding when onGitHubTelemetry is provided", async () => {
@@ -1821,6 +1854,37 @@ describe("CopilotClient", () => {
         spy.mockRestore();
     });
 
+    it.each([true, false, undefined])(
+        "serializes refreshCustomInstructions=%s only on session.create",
+        async (refresh) => {
+            const client = new CopilotClient();
+            await client.start();
+            onTestFinished(() => stopClient(client));
+
+            const spy = vi.spyOn((client as any).connection!, "sendRequest");
+            const config = {
+                onPermissionRequest: approveAll,
+                refreshCustomInstructions: refresh,
+            };
+            const session = await client.createSession(config);
+            const createRequest = spy.mock.calls.find(([method]) => method === "session.create");
+            expect(createRequest).toBeDefined();
+            const payload = JSON.parse(JSON.stringify(createRequest![1]));
+            if (refresh === undefined) {
+                expect(payload).not.toHaveProperty("refreshCustomInstructions");
+            } else {
+                expect(payload).toHaveProperty("refreshCustomInstructions", refresh);
+            }
+
+            await client.resumeSession(session.sessionId, config);
+            const resumeRequest = spy.mock.calls.find(([method]) => method === "session.resume");
+            expect(resumeRequest).toBeDefined();
+            expect(JSON.parse(JSON.stringify(resumeRequest![1]))).not.toHaveProperty(
+                "refreshCustomInstructions"
+            );
+        }
+    );
+
     it("forwards enableOnDemandInstructionDiscovery in session.create request", async () => {
         const client = new CopilotClient();
         await client.start();
diff --git a/nodejs/test/connectors.test.ts b/nodejs/test/connectors.test.ts
new file mode 100644
index 0000000000..b6046a434d
--- /dev/null
+++ b/nodejs/test/connectors.test.ts
@@ -0,0 +1,147 @@
+import { describe, expect, it, vi } from "vitest";
+import type { MessageConnection } from "vscode-jsonrpc";
+
+import { CopilotSession } from "../src/session.js";
+
+describe("session Connector RPC", () => {
+    it("exposes the host-owned experimental Connector lifecycle", async () => {
+        const sendRequest = vi.fn(async (method: string) => {
+            if (method === "session.connectors.getCapabilities") {
+                return {
+                    apiVersion: 1,
+                    availability: "enabled",
+                    consentContinuation: true,
+                    opaqueAccountSelection: true,
+                    maxPollAttempts: 30,
+                    maxPollIntervalMs: 2_000,
+                    maxDeadlineMs: 60_000,
+                };
+            }
+            if (method === "session.connectors.list" || method === "session.connectors.refresh") {
+                return { revision: 1, refreshedAtMs: 1, connectors: [] };
+            }
+            if (method === "session.connectors.connect") {
+                return {
+                    kind: "consent_required",
+                    consentUrl: "https://example.com/consent",
+                    continuationId: "continuation-1",
+                };
+            }
+            if (
+                method === "session.connectors.reconnect" ||
+                method === "session.connectors.continueConnection"
+            ) {
+                return { kind: "pending", continuationId: "continuation-1" };
+            }
+            if (method === "session.connectors.disconnect") {
+                return { disconnected: true, status: connectorStatus() };
+            }
+            return connectorStatus();
+        });
+        const session = new CopilotSession("session-1", {
+            sendRequest,
+        } as unknown as MessageConnection);
+
+        expect(await session.rpc.connectors.getCapabilities()).toMatchObject({
+            apiVersion: 1,
+            availability: "enabled",
+        });
+        expect(await session.rpc.connectors.getStatus()).toEqual(connectorStatus());
+        expect(await session.rpc.connectors.list({ accountId: "account-1" })).toMatchObject({
+            revision: 1,
+        });
+        expect(await session.rpc.connectors.refresh({ accountId: "account-1" })).toMatchObject({
+            revision: 1,
+        });
+        expect(
+            await session.rpc.connectors.connect({
+                accountId: "account-1",
+                connectorName: "calendar",
+            })
+        ).toMatchObject({ kind: "consent_required" });
+        expect(
+            await session.rpc.connectors.reconnect({
+                accountId: "account-1",
+                connectorName: "calendar",
+            })
+        ).toMatchObject({ kind: "pending" });
+        expect(
+            await session.rpc.connectors.continueConnection({
+                continuationId: "continuation-1",
+                maxAttempts: 3,
+                pollIntervalMs: 100,
+                deadlineMs: 1_000,
+            })
+        ).toMatchObject({ kind: "pending" });
+        expect(
+            await session.rpc.connectors.disconnect({
+                accountId: "account-1",
+                connectorName: "calendar",
+            })
+        ).toMatchObject({ disconnected: true });
+        expect(
+            await session.rpc.connectors.reconcile({
+                accountId: "account-1",
+                refreshCatalog: true,
+            })
+        ).toEqual(connectorStatus());
+
+        expect(sendRequest.mock.calls).toEqual([
+            ["session.connectors.getCapabilities", { sessionId: "session-1" }],
+            ["session.connectors.getStatus", { sessionId: "session-1" }],
+            ["session.connectors.list", { sessionId: "session-1", accountId: "account-1" }],
+            ["session.connectors.refresh", { sessionId: "session-1", accountId: "account-1" }],
+            [
+                "session.connectors.connect",
+                {
+                    sessionId: "session-1",
+                    accountId: "account-1",
+                    connectorName: "calendar",
+                },
+            ],
+            [
+                "session.connectors.reconnect",
+                {
+                    sessionId: "session-1",
+                    accountId: "account-1",
+                    connectorName: "calendar",
+                },
+            ],
+            [
+                "session.connectors.continueConnection",
+                {
+                    sessionId: "session-1",
+                    continuationId: "continuation-1",
+                    maxAttempts: 3,
+                    pollIntervalMs: 100,
+                    deadlineMs: 1_000,
+                },
+            ],
+            [
+                "session.connectors.disconnect",
+                {
+                    sessionId: "session-1",
+                    accountId: "account-1",
+                    connectorName: "calendar",
+                },
+            ],
+            [
+                "session.connectors.reconcile",
+                {
+                    sessionId: "session-1",
+                    accountId: "account-1",
+                    refreshCatalog: true,
+                },
+            ],
+        ]);
+    });
+});
+
+function connectorStatus() {
+    return {
+        apiVersion: 1,
+        availability: "enabled" as const,
+        runtimeServers: [],
+        pendingConnections: 0,
+    };
+}
diff --git a/nodejs/test/csharp-codegen.test.ts b/nodejs/test/csharp-codegen.test.ts
index a0c802ac49..2f666be125 100644
--- a/nodejs/test/csharp-codegen.test.ts
+++ b/nodejs/test/csharp-codegen.test.ts
@@ -421,7 +421,7 @@ describe("C# RPC codegen", () => {
 
             expect(code).toContain("public sealed partial class SystemMessage");
             expect(code).toContain(
-                "[Experimental(Diagnostics.Experimental)]\n[JsonConverter(typeof(Converter))]\npublic sealed partial class SystemMessage"
+                "[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]\n[JsonConverter(typeof(Converter))]\npublic sealed partial class SystemMessage"
             );
             expect(code).toContain("System message configuration.");
             expect(code).toContain("public SystemMessage? SystemMessage");
diff --git a/nodejs/test/e2e/permissions.e2e.test.ts b/nodejs/test/e2e/permissions.e2e.test.ts
index 6de6c4a516..565719e0a4 100644
--- a/nodejs/test/e2e/permissions.e2e.test.ts
+++ b/nodejs/test/e2e/permissions.e2e.test.ts
@@ -177,6 +177,7 @@ describe("Permission callbacks", async () => {
         const session1 = await client.createSession({ onPermissionRequest: approveAll });
         const sessionId = session1.sessionId;
         await session1.sendAndWait({ prompt: "What is 1+1?" });
+        await session1.disconnect();
 
         const session2 = await client.resumeSession(sessionId, {
             onPermissionRequest: () => ({
diff --git a/nodejs/test/e2e/rpc_event_log.e2e.test.ts b/nodejs/test/e2e/rpc_event_log.e2e.test.ts
index 399a41de54..4b4dd5fac8 100644
--- a/nodejs/test/e2e/rpc_event_log.e2e.test.ts
+++ b/nodejs/test/e2e/rpc_event_log.e2e.test.ts
@@ -4,7 +4,7 @@
 
 import { randomUUID } from "node:crypto";
 import { describe, expect, it } from "vitest";
-import { approveAll, type SessionEvent } from "../../src/index.js";
+import { approveAll } from "../../src/index.js";
 import { createSdkTestContext } from "./harness/sdkTestContext.js";
 import { waitForCondition } from "./harness/sdkTestHelper.js";
 
@@ -50,27 +50,31 @@ describe("Session event log RPC", async () => {
     it("should return tail cursor and read empty when no new events", async () => {
         const session = await client.createSession({ onPermissionRequest: approveAll });
         try {
-            let tail: Awaited<ReturnType<typeof session.rpc.eventLog.tail>> | undefined;
-            let read: Awaited<ReturnType<typeof session.rpc.eventLog.read>> | undefined;
-            await waitForCondition(
-                async () => {
-                    tail = await session.rpc.eventLog.tail();
-                    read = await session.rpc.eventLog.read({
-                        cursor: tail.cursor,
-                        max: 10,
-                        waitMs: 0,
-                    });
-                    return read.cursorStatus === "ok" && read.events.length === 0;
-                },
-                {
-                    timeoutMessage:
-                        "Timed out waiting for a stable event-log tail cursor with no immediately available events.",
-                }
-            );
+            const tail = await session.rpc.eventLog.tail();
+            await session.log("Ephemeral event after tail", { ephemeral: true });
+            const request = {
+                cursor: tail.cursor,
+                max: 10,
+                waitMs: 0,
+                includeEphemeral: false,
+            };
+            const read = await session.rpc.eventLog.read(request);
+
+            expect(tail.cursor.trim()).toBeTruthy();
+            expect(read.cursorStatus).toBe("ok");
+            expect(read.events).toEqual([]);
+            expect(read.hasMore).toBe(false);
 
-            expect(tail!.cursor.trim()).toBeTruthy();
-            expect(read!.events).toEqual([]);
-            expect(read!.hasMore).toBe(false);
+            await session.rpc.plan.update({ content: "# Durable event after tail" });
+            await client.rpc.sessions.save({ sessionId: session.sessionId });
+            const durableRead = await session.rpc.eventLog.read(request);
+            expect(durableRead.cursorStatus).toBe("ok");
+            expect(durableRead.events).toContainEqual(
+                expect.objectContaining({
+                    type: "session.plan_changed",
+                    data: expect.objectContaining({ operation: "create" }),
+                })
+            );
         } finally {
             await session.disconnect();
         }
@@ -110,14 +114,39 @@ describe("Session event log RPC", async () => {
                 types: ["session.title_changed"],
             });
 
+            await session.rpc.plan.update({ content: "# Unrelated event during a filtered read" });
+            let read = await readTask;
+            expect(read.events).toEqual([]);
             await session.rpc.name.set({ name: expectedTitle });
-            const read = await readTask;
 
-            expect(read.cursorStatus).toBe("ok");
+            // An unrelated event can wake a filtered read with an empty page.
+            await waitForCondition(
+                async () => {
+                    expect(read.cursorStatus).toBe("ok");
+                    expect(
+                        read.events.every((event) => event.type === "session.title_changed")
+                    ).toBe(true);
+                    if (
+                        read.events.some(
+                            (event) =>
+                                event.type === "session.title_changed" &&
+                                event.data.title === expectedTitle
+                        )
+                    ) {
+                        return true;
+                    }
+                    read = await session.rpc.eventLog.read({
+                        cursor: read.cursor,
+                        max: 10,
+                        waitMs: 5_000,
+                        types: ["session.title_changed"],
+                    });
+                    return false;
+                },
+                { timeoutMessage: "Timed out waiting for the filtered title changed event." }
+            );
+
             expect(read.events.length).toBeGreaterThan(0);
-            expect(
-                read.events.every((event: SessionEvent) => event.type === "session.title_changed")
-            ).toBe(true);
             expect(read.events).toContainEqual(
                 expect.objectContaining({
                     type: "session.title_changed",
diff --git a/nodejs/test/e2e/rpc_mcp_and_skills.e2e.test.ts b/nodejs/test/e2e/rpc_mcp_and_skills.e2e.test.ts
index 4025dc444c..9b0460c61d 100644
--- a/nodejs/test/e2e/rpc_mcp_and_skills.e2e.test.ts
+++ b/nodejs/test/e2e/rpc_mcp_and_skills.e2e.test.ts
@@ -116,6 +116,107 @@ describe("Session MCP and skills RPC", async () => {
         });
     }
 
+    it("captures opt-in MCP diagnostics without exposing configured credentials", async () => {
+        const defaultSession = await client.createSession({ onPermissionRequest: approveAll });
+        try {
+            const defaultLogs = await defaultSession.rpc.diagnostics.read({ sources: ["mcp"] });
+            expect(defaultLogs.entries).toEqual([]);
+        } finally {
+            await defaultSession.disconnect();
+        }
+
+        const credentialCanary = "mcp-diagnostics-credential-canary";
+        const stderrSentinel = "mcp-diagnostics-stderr-sentinel";
+        const session = await client.createSession({
+            onPermissionRequest: approveAll,
+            diagnostics: { sources: { mcp: { level: "debug" } } },
+            mcpServers: {
+                diagnostics: {
+                    type: "stdio",
+                    command: "node",
+                    args: [
+                        TEST_MCP_SERVER,
+                        "--diagnostic-stderr",
+                        `${stderrSentinel} ${credentialCanary}`,
+                    ],
+                    env: { MCP_API_KEY: credentialCanary },
+                    workingDirectory: TEST_HARNESS_DIR,
+                    tools: ["*"],
+                } as MCPStdioServerConfig,
+            },
+        });
+
+        try {
+            try {
+                await session.rpc.mcp.startServer({ serverName: "diagnostics" });
+            } catch (error) {
+                const kind = error instanceof Error ? error.name : typeof error;
+                throw new Error(`MCP diagnostics server start failed (${kind})`);
+            }
+
+            let startupLogs: Awaited<ReturnType<typeof session.rpc.diagnostics.read>> | undefined;
+            await expect
+                .poll(
+                    async () => {
+                        startupLogs = await session.rpc.diagnostics.read({
+                            sources: ["mcp"],
+                            max: 500,
+                            waitMs: 0,
+                        });
+                        const server = (await session.rpc.mcp.list()).servers.find(
+                            (candidate) => candidate.name === "diagnostics"
+                        );
+                        return {
+                            serverStatus: server?.status ?? "<not listed>",
+                            entryCount: startupLogs.entries.length,
+                            entries: startupLogs.entries.map((entry) => ({
+                                connectionId: entry.details.connectionId,
+                                kind: entry.details.kind,
+                                level: entry.level,
+                                serverName: entry.details.serverName,
+                            })),
+                            hasDiagnosticsServer: startupLogs.entries.some(
+                                (entry) => entry.details.serverName === "diagnostics"
+                            ),
+                            hasProtocol: startupLogs.entries.some(
+                                (entry) => entry.details.kind === "protocol"
+                            ),
+                            hasStderr: startupLogs.entries.some(
+                                (entry) => entry.details.kind === "stderr"
+                            ),
+                        };
+                    },
+                    { interval: 200, timeout: 9_000 }
+                )
+                .toMatchObject({
+                    hasDiagnosticsServer: true,
+                    hasProtocol: true,
+                    hasStderr: true,
+                });
+
+            if (!startupLogs) {
+                throw new Error("MCP diagnostics polling completed without a read result");
+            }
+            expect(JSON.stringify(startupLogs.entries)).not.toContain(credentialCanary);
+            expect(JSON.stringify(startupLogs.entries)).toContain(stderrSentinel);
+            expect(JSON.stringify(startupLogs.entries)).toContain("[REDACTED]");
+
+            const info = await session.rpc.diagnostics.configure({
+                sources: { mcp: { level: "info" } },
+            });
+            expect(info.sources.mcp?.level).toBe("info");
+
+            const off = await session.rpc.diagnostics.configure({
+                sources: { mcp: { level: "off" } },
+            });
+            expect(off.sources.mcp?.level).toBe("off");
+            const clearedLogs = await session.rpc.diagnostics.read({ sources: ["mcp"] });
+            expect(clearedLogs.entries).toEqual([]);
+        } finally {
+            await session.disconnect();
+        }
+    });
+
     it("should list and toggle session skills", async () => {
         const skillName = `session-rpc-skill-${Date.now()}-${Math.random().toString(36).slice(2)}`;
         const skillsDir = createSkillDirectory(skillName, "Session skill controlled by RPC.");
diff --git a/nodejs/test/e2e/rpc_server.e2e.test.ts b/nodejs/test/e2e/rpc_server.e2e.test.ts
index cf08f916a2..7bab043a1a 100644
--- a/nodejs/test/e2e/rpc_server.e2e.test.ts
+++ b/nodejs/test/e2e/rpc_server.e2e.test.ts
@@ -217,6 +217,28 @@ describe("Server-scoped RPC", async () => {
         expect(result.ok).toBe(true);
     });
 
+    it("should report sandbox host support", async () => {
+        await client.start();
+        const host = await client.rpc.sandbox.getHostSupport();
+        expect(host.reason === undefined).toBe(host.supported);
+        expect(host.capabilities.map((capability) => capability.name).sort()).toEqual(
+            host.supported ? ["denied_paths", "network", "network_filtering", "shell"] : []
+        );
+        for (const capability of host.capabilities) {
+            expect(capability.reason === undefined).toBe(capability.supported);
+        }
+
+        const unsupportedClient = createClientWithEnv({
+            COPILOT_CLI_SANDBOX_SUPPORT_OVERRIDE: "unsupported",
+        });
+        await unsupportedClient.start();
+        expect(await unsupportedClient.rpc.sandbox.getHostSupport()).toEqual({
+            supported: false,
+            reason: "COPILOT_CLI_SANDBOX_SUPPORT_OVERRIDE=unsupported",
+            capabilities: [],
+        });
+    });
+
     it("should list, find, and inspect persisted session state", async () => {
         const sessionId = randomUUID();
         const missingTaskId = `missing-task-${randomUUID()}`;
diff --git a/nodejs/test/e2e/rpc_surface_coverage.e2e.test.ts b/nodejs/test/e2e/rpc_surface_coverage.e2e.test.ts
index 30fe80d38b..3f017f07cc 100644
--- a/nodejs/test/e2e/rpc_surface_coverage.e2e.test.ts
+++ b/nodejs/test/e2e/rpc_surface_coverage.e2e.test.ts
@@ -313,7 +313,7 @@ describe("Generated RPC surface coverage", () => {
             ...collectRuntimeFunctions(session.rpc, "session"),
         ]);
 
-        expect(inventory).toHaveLength(350);
+        expect(inventory).toHaveLength(355);
         expect([...runtimeFunctions.keys()].sort()).toEqual(
             inventory.map((method) => `${method.scope}.${method.path}`)
         );
diff --git a/nodejs/test/e2e/session.e2e.test.ts b/nodejs/test/e2e/session.e2e.test.ts
index 1337410386..d9f1124291 100644
--- a/nodejs/test/e2e/session.e2e.test.ts
+++ b/nodejs/test/e2e/session.e2e.test.ts
@@ -984,12 +984,18 @@ describe("Send Blocking Behavior", async () => {
         await using session = await client.createSession({ onPermissionRequest: approveAll });
 
         const events: string[] = [];
+        let rootIdleCallbackCompleted = false;
         session.on((event) => {
             events.push(event.type);
+            if (event.type === "session.idle" && !event.agentId) {
+                rootIdleCallbackCompleted = true;
+            }
         });
 
         const response = await session.sendAndWait({ prompt: "What is 2+2?" });
 
+        // No separate subscriber wait: the earlier synchronous callback must be done.
+        expect(rootIdleCallbackCompleted).toBe(true);
         expect(response).toBeDefined();
         expect(response?.type).toBe("assistant.message");
         expect(response?.data.content).toContain("4");
diff --git a/nodejs/test/e2e/session_config.e2e.test.ts b/nodejs/test/e2e/session_config.e2e.test.ts
index 8d041f1ec8..de81e8be1d 100644
--- a/nodejs/test/e2e/session_config.e2e.test.ts
+++ b/nodejs/test/e2e/session_config.e2e.test.ts
@@ -693,6 +693,68 @@ describe("Session Configuration", async () => {
         await session1.disconnect();
     });
 
+    it("should refresh cached custom instructions only when creating with opt-in", async () => {
+        const projectDir = join(workDir, "instruction-refresh-project");
+        const instructionDir = join(workDir, "refresh-instructions");
+        const instructionFilesDir = join(instructionDir, ".github", "instructions");
+        const instructionFile = join(instructionFilesDir, "refresh.instructions.md");
+        const original = "TS_ORIGINAL_INSTRUCTION_CONTENT";
+        const updated = "TS_UPDATED_INSTRUCTION_CONTENT";
+        await mkdir(projectDir, { recursive: true });
+        await mkdir(instructionFilesDir, { recursive: true });
+        await writeFile(instructionFile, `Always include ${original}.`);
+
+        const handler = new RecordingRequestHandler();
+        const refreshClient = new CopilotClient({
+            connection: RuntimeConnection.forStdio({ path: process.env.COPILOT_CLI_PATH }),
+            workingDirectory: projectDir,
+            env,
+            gitHubToken: DEFAULT_GITHUB_TOKEN,
+            requestHandler: handler,
+        });
+
+        async function readInstructions(refreshCustomInstructions?: boolean): Promise<string> {
+            const session = await refreshClient.createSession({
+                onPermissionRequest: approveAll,
+                workingDirectory: projectDir,
+                instructionDirectories: [instructionDir],
+                model: "claude-sonnet-5",
+                provider: createAnthropicProvider(),
+                refreshCustomInstructions,
+            });
+            try {
+                const before = handler.inferenceRequests().length;
+                const response = await session.sendAndWait({ prompt: "Say OK." });
+                expect(response?.data.content).toBe("OK from the synthetic stream.");
+                const requests = handler.inferenceRequests().slice(before);
+                expect(requests).toHaveLength(1);
+                const body = JSON.parse(requests[0].body) as { system: unknown };
+                expect(body.system).toBeDefined();
+                return JSON.stringify(body.system);
+            } finally {
+                await session.disconnect();
+            }
+        }
+
+        try {
+            expect(await readInstructions()).toContain(original);
+            await writeFile(instructionFile, `Always include ${updated}.`);
+
+            for (const refresh of [undefined, false]) {
+                const instructions = await readInstructions(refresh);
+                expect(instructions).toContain(original);
+                expect(instructions).not.toContain(updated);
+            }
+
+            const refreshed = await readInstructions(true);
+            expect(refreshed).toContain(updated);
+            expect(refreshed).not.toContain(original);
+            expect(await readInstructions()).toContain(updated);
+        } finally {
+            expect(await refreshClient.stop()).toEqual([]);
+        }
+    });
+
     it("should forward clientName in user-agent", async () => {
         const session = await client.createSession({
             onPermissionRequest: approveAll,
diff --git a/nodejs/test/e2e/skills.e2e.test.ts b/nodejs/test/e2e/skills.e2e.test.ts
index 973e2f329e..850a8444df 100644
--- a/nodejs/test/e2e/skills.e2e.test.ts
+++ b/nodejs/test/e2e/skills.e2e.test.ts
@@ -43,6 +43,63 @@ IMPORTANT: You MUST include the exact text "${SKILL_MARKER}" somewhere in EVERY
     }
 
     describe("Skill Behavior", () => {
+        it("discovers a new skill on the next turn and makes it available to a subagent", async () => {
+            const lateSkillsDir = path.join(workDir, ".late_skills");
+            const skillResults: { sessionId: string; text: string }[] = [];
+            const session = await client.createSession({
+                onPermissionRequest: approveAll,
+                enableConfigDiscovery: false,
+                skillDirectories: [lateSkillsDir],
+                hooks: {
+                    onPostToolUse: (input) => {
+                        if (
+                            input.toolName === "skill" &&
+                            input.toolResult.resultType === "success"
+                        ) {
+                            skillResults.push({
+                                sessionId: input.sessionId,
+                                text: input.toolResult.textResultForLlm,
+                            });
+                        }
+                    },
+                },
+            });
+
+            try {
+                const first = await session.sendAndWait({ prompt: "Reply with READY." });
+                expect(first?.data.content).toContain("READY");
+                expect(skillResults).toEqual([]);
+
+                const skillDir = path.join(lateSkillsDir, "late-skill");
+                fs.mkdirSync(skillDir, { recursive: true });
+                fs.writeFileSync(
+                    path.join(skillDir, "SKILL.md"),
+                    "---\nname: late-skill\ndescription: Reports a unique verification word.\n---\n\nThe verification word is ORCHID_SAPPHIRE_73.\n"
+                );
+
+                const second = await session.sendAndWait({
+                    prompt: "Use the skill tool to load late-skill, then use the task tool to ask a task agent to load late-skill with the skill tool and report its verification word. Report the agent's word.",
+                });
+                expect(second?.data.content).toContain("ORCHID_SAPPHIRE_73");
+                expect(
+                    skillResults.some(
+                        (result) =>
+                            result.sessionId === session.sessionId &&
+                            result.text.includes("loaded successfully")
+                    )
+                ).toBe(true);
+                expect(
+                    skillResults.some(
+                        (result) =>
+                            result.sessionId !== session.sessionId &&
+                            result.text.includes("loaded successfully")
+                    )
+                ).toBe(true);
+            } finally {
+                await session.disconnect();
+            }
+        }, 120_000);
+
         it("should load and apply skill from skillDirectories", async () => {
             const skillsDir = createSkillDir();
             const session = await client.createSession({
diff --git a/nodejs/test/session-config-types.test.ts b/nodejs/test/session-config-types.test.ts
new file mode 100644
index 0000000000..af1e3c4719
--- /dev/null
+++ b/nodejs/test/session-config-types.test.ts
@@ -0,0 +1,14 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+import { expectTypeOf, it } from "vitest";
+import type { ResumeSessionConfig, SessionConfig } from "../src/index.js";
+
+// Included in tsconfig.test.json so these public API assertions are compile-checked.
+it("exposes refreshCustomInstructions only on the creation config", () => {
+    expectTypeOf<SessionConfig>()
+        .toHaveProperty("refreshCustomInstructions")
+        .toEqualTypeOf<boolean | undefined>();
+    expectTypeOf<ResumeSessionConfig>().not.toHaveProperty("refreshCustomInstructions");
+});
diff --git a/nodejs/test/session-send-and-wait.test.ts b/nodejs/test/session-send-and-wait.test.ts
index d88b80c896..0ea065d098 100644
--- a/nodejs/test/session-send-and-wait.test.ts
+++ b/nodejs/test/session-send-and-wait.test.ts
@@ -145,6 +145,26 @@ describe("sendAndWait", () => {
         await expect(pending).resolves.toBeUndefined();
     });
 
+    it("ignores child messages, errors, and idle while waiting for the root", async () => {
+        const { session, sendStarted, resolveSend } = controlledSession();
+        const received: SessionEvent[] = [];
+        session.on((event) => received.push(event));
+        const pending = session.sendAndWait({ prompt: "delegate" });
+        await sendStarted;
+        resolveSend();
+
+        const childMessage = { ...assistantMessage("child reply"), agentId: "child-1" };
+        const childError = { ...errorEvent("child failed"), agentId: "child-1" };
+        const childIdle = { ...sessionEvent("session.idle"), agentId: "child-1" };
+        session._dispatchEvent(childMessage);
+        session._dispatchEvent(childError);
+        session._dispatchEvent(childIdle);
+        expect(received).toEqual([childMessage, childError, childIdle]);
+
+        session._dispatchEvent(sessionEvent("session.idle"));
+        await expect(pending).resolves.toBeUndefined();
+    });
+
     it("preserves the send rejection when a session error arrives first", async () => {
         const { session, sendStarted, rejectSend } = controlledSession();
         const pending = session.sendAndWait({ prompt: "hi" });
diff --git a/nodejs/tsconfig.test.json b/nodejs/tsconfig.test.json
index 33490b84a8..b3bda3f2b0 100644
--- a/nodejs/tsconfig.test.json
+++ b/nodejs/tsconfig.test.json
@@ -11,6 +11,7 @@
         "test/copilot-request-handler.test.ts",
         "test/ffiRuntimeHost.test.ts",
         "test/session-event-types.test.ts",
+        "test/session-config-types.test.ts",
         "test/message-source.test.ts"
     ],
     "exclude": ["node_modules", "dist"]
diff --git a/python/README.md b/python/README.md
index efe960a7f5..a4f34e7f03 100644
--- a/python/README.md
+++ b/python/README.md
@@ -64,16 +64,11 @@ not download a second runtime artifact.
 
 ## Run the Sample
 
-Try the interactive chat sample from the SDK root (`src/sdk` when nested).
-In the runtime repository, first run `pnpm run build:cli` from the runtime root,
-then return to `src/sdk`. A Python source install does not pin a downloadable
-runtime, so select the prepared executable explicitly. Run the sample in the
-project's uv environment; see [development setup](#development) for prerequisites.
+Try the interactive chat sample (from the repo root):
 
 ```bash
-npm --prefix nodejs ci --ignore-scripts
-export COPILOT_CLI_PATH="$(npm --prefix nodejs run --silent prepare:runtime -- --print-path)"
-uv run --project python python python/samples/chat.py
+cd python/samples
+python chat.py
 ```
 
 ## Quick Start
@@ -139,6 +134,8 @@ Use `"user"` when you need to set it explicitly. Source is independent of delive
 mode and does not replace the session's `system_message` configuration, set billing
 flags, or use the notification API. `send_and_wait` can return `None` when the
 session goes idle without an assistant message; errors still propagate.
+Sub-agent events remain visible to listeners but do not complete the wait
+or supply its reply.
 
 ### Manual Resource Management
 
@@ -1266,22 +1263,22 @@ When `on_elicitation_request` is provided, the SDK automatically:
 
 ## Development
 
-Follow [SDK development setup](../CONTRIBUTING.md#developing-an-sdk) for Python,
-uv, and the Node/replay-harness dependencies. From the SDK root (`src/sdk` in
-the runtime repository, or the standalone repository root):
+Install [uv](https://docs.astral.sh/uv/) and a supported [Node.js version](../nodejs/README.md#prerequisites), then from the repository root:
 
 ```bash
-npm run build:python
-npm run test:python
-npm run check:python
+cd nodejs
+npm ci
 ```
 
-The build task runs `uv sync --all-extras --dev`. For focused tests after
-[preparing the runtime](../CONTRIBUTING.md#testing-an-unreleased-runtime-api),
-run the native runner from `python/`:
+```bash
+cd test/harness
+npm ci
+```
 
 ```bash
-uv run pytest "<test-file>"
+cd python
+uv sync
+uv run pytest
 ```
 
 Signal-based E2E failures from `pytest-timeout` include an **Async timeout diagnostics** report
diff --git a/python/copilot/client.py b/python/copilot/client.py
index 7e91bee7e8..058f7a9788 100644
--- a/python/copilot/client.py
+++ b/python/copilot/client.py
@@ -74,6 +74,7 @@
 from .generated.rpc import (
     ClientGlobalApiHandlers,
     ClientSessionApiHandlers,
+    DiagnosticsConfiguration,
     ExtensionLaunchProviderHandler,
     GitHubTelemetryNotification,
     GitHubTokenAcquireReason,
@@ -2306,6 +2307,7 @@ async def create_session(
         excluded_builtin_agents: list[str] | None = None,
         session_limits: SessionLimitsConfig | None = None,
         skip_custom_instructions: bool | None = None,
+        refresh_custom_instructions: bool | None = None,
         custom_agents_local_only: bool | None = None,
         coauthor_enabled: bool | None = None,
         manage_schedule_enabled: bool | None = None,
@@ -2313,6 +2315,7 @@ async def create_session(
         streaming: bool | None = None,
         include_sub_agent_streaming_events: bool | None = None,
         mcp_servers: dict[str, MCPServerConfig] | None = None,
+        diagnostics: DiagnosticsConfiguration | None = None,
         mcp_oauth_token_storage: Literal["persistent", "in-memory"] | None = None,
         auth_client_id_metadata_url: str | None = None,
         embedding_cache_storage: Literal["persistent", "in-memory"] | None = None,
@@ -2439,6 +2442,11 @@ async def create_session(
                 name is configured.
             session_limits: **Experimental.** Limits applied to this session's
                 current accounting window.
+            refresh_custom_instructions: When True, invalidates the process-wide
+                custom-instruction discovery cache before constructing this new
+                session. Omitted or False retains the cache. Other sessions in this
+                runtime may observe updated instructions on later turns or discovery.
+                This does not watch files or enable disabled instruction loading.
             model_capabilities: Override individual model capabilities resolved by the runtime.
             streaming: Whether to enable streaming responses.
             include_sub_agent_streaming_events: Whether to include sub-agent streaming
@@ -2749,6 +2757,8 @@ async def create_session(
             payload["excludedBuiltinAgents"] = excluded_builtin_agents
         if session_limits is not None:
             payload["sessionLimits"] = _session_limits_to_wire(session_limits)
+        if refresh_custom_instructions is not None:
+            payload["refreshCustomInstructions"] = refresh_custom_instructions
 
         # Add model capabilities override if provided
         if model_capabilities:
@@ -2757,6 +2767,8 @@ async def create_session(
         # Add MCP servers configuration if provided
         if mcp_servers:
             payload["mcpServers"] = _mcp_servers_to_wire(mcp_servers)
+        if diagnostics is not None:
+            payload["diagnostics"] = diagnostics.to_dict()
         # Mode "empty" defaults MCP OAuth token storage to in-memory; caller wins.
         mcp_oauth_token_storage = _mcp_oauth_token_storage_default(mode, mcp_oauth_token_storage)
         if mcp_oauth_token_storage is not None:
@@ -3100,6 +3112,7 @@ async def resume_session(
         streaming: bool | None = None,
         include_sub_agent_streaming_events: bool | None = None,
         mcp_servers: dict[str, MCPServerConfig] | None = None,
+        diagnostics: DiagnosticsConfiguration | None = None,
         mcp_oauth_token_storage: Literal["persistent", "in-memory"] | None = None,
         auth_client_id_metadata_url: str | None = None,
         embedding_cache_storage: Literal["persistent", "in-memory"] | None = None,
@@ -3540,6 +3553,8 @@ async def resume_session(
         # TODO: disable_resume is not a keyword arg yet; keeping for future use
         if mcp_servers:
             payload["mcpServers"] = _mcp_servers_to_wire(mcp_servers)
+        if diagnostics is not None:
+            payload["diagnostics"] = diagnostics.to_dict()
         # Mode "empty" defaults MCP OAuth token storage to in-memory; caller wins.
         mcp_oauth_token_storage = _mcp_oauth_token_storage_default(mode, mcp_oauth_token_storage)
         if mcp_oauth_token_storage is not None:
diff --git a/python/copilot/generated/rpc.py b/python/copilot/generated/rpc.py
index c7c9016899..12de08401e 100644
--- a/python/copilot/generated/rpc.py
+++ b/python/copilot/generated/rpc.py
@@ -12,7 +12,7 @@
     from .._jsonrpc import JsonRpcClient
 
 from collections.abc import Callable
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import datetime
 from enum import Enum
 from typing import Any, Protocol, TypeVar, cast
@@ -2887,6 +2887,58 @@ def to_dict(self) -> dict:
             result["path"] = from_union([from_str, from_none], self.path)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPDiagnosticDirection(Enum):
+    """Protocol-frame direction when kind is protocol.
+
+    Direction of an observed MCP protocol frame.
+    """
+    CLIENT_TO_SERVER = "client-to-server"
+    SERVER_TO_CLIENT = "server-to-client"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class MCPDiagnosticKind(Enum):
+    """Diagnostic record category.
+
+    Category for an MCP diagnostic record.
+    """
+    HTTP = "http"
+    LIFECYCLE = "lifecycle"
+    PROTOCOL = "protocol"
+    STDERR = "stderr"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class DiagnosticSeverity(Enum):
+    """Severity of this emitted diagnostic record.
+
+    Severity of an emitted diagnostic record.
+    """
+    DEBUG = "debug"
+    ERROR = "error"
+    INFO = "info"
+    TRACE = "trace"
+    WARNING = "warning"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class DiagnosticSource(Enum):
+    """A supported diagnostic source."""
+
+    MCP = "mcp"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+class DiagnosticLogLevel(Enum):
+    """Session-scoped diagnostic threshold. Capture is disabled by default and is never
+    persisted with the session.
+
+    Threshold to apply to MCP diagnostic producers in this session.
+    """
+    DEBUG = "debug"
+    ERROR = "error"
+    INFO = "info"
+    OFF = "off"
+    TRACE = "trace"
+    WARNING = "warning"
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class DiscoveredExtensionPlugin:
@@ -8132,9 +8184,6 @@ class PermissionDecisionApproveForLocationApprovalExtensionPermissionAccessKind(
 class PermissionDecisionApproveForLocationApprovalFactoryKind(Enum):
     FACTORY = "factory"
 
-class PermissionDecisionApproveForLocationApprovalMCPKind(Enum):
-    MCP = "mcp"
-
 class PermissionDecisionApproveForLocationApprovalMCPSamplingKind(Enum):
     MCP_SAMPLING = "mcp-sampling"
 
@@ -10161,8 +10210,8 @@ def to_dict(self) -> dict:
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class QueueWithdrawMessageRequest:
-    """Conditional withdrawal of a single user message, before the runtime claims it for
-    delivery.
+    """Conditional withdrawal of a single user message, from its queue or from the running turn
+    it started.
     """
     expected_prompt: str
     """The prompt originally sent. A message edited since submission is not withdrawn, so an
@@ -10184,6 +10233,32 @@ def to_dict(self) -> dict:
         result["messageId"] = from_str(self.message_id)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class QueueWithdrawMessageResult:
+    """Result of withdrawing a user message."""
+
+    interrupted: bool
+    """True when the running turn was interrupted to withdraw the message. With removed false,
+    the turn was interrupted but its events could not be removed, for example because the
+    model answered first, so the message stays in the interrupted turn.
+    """
+    removed: bool
+    """True when the message left the queue or, for a running turn, history."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'QueueWithdrawMessageResult':
+        assert isinstance(obj, dict)
+        interrupted = from_bool(obj.get("interrupted"))
+        removed = from_bool(obj.get("removed"))
+        return QueueWithdrawMessageResult(interrupted, removed)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["interrupted"] = from_bool(self.interrupted)
+        result["removed"] = from_bool(self.removed)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class QueuedCommandHandled:
@@ -10809,6 +10884,47 @@ def to_dict(self) -> dict:
             result["reason"] = from_union([from_str, from_none], self.reason)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class SandboxHostCapability:
+    """Whether this host can run one sandbox policy feature. A session whose effective policy
+    uses an unsupported feature fails each sandboxed command with `reason`.
+    """
+    name: str
+    """The policy feature, as an extensible string: ignore names you do not recognize. Known
+    values: `network` (sandboxed commands can reach the network; on Linux this needs the
+    tooling for Bubblewrap's private network namespace, such as slirp4netns),
+    `network_filtering` (host rules and the sandbox proxy; on Linux this needs the same
+    tooling as `network`; on Windows it needs Process Security Environment 1.1 host-loopback
+    support, and a policy that uses it must also set `network.allowLocalNetwork`),
+    `denied_paths` (native enforcement of `filesystem.deniedPaths`), and `shell` (shell
+    commands inside the sandbox; on Windows this needs Process Security Environment 1.1
+    filesystem enumeration support).
+    """
+    supported: bool
+    """Whether this host can run the feature."""
+
+    reason: str | None = None
+    """Human-readable reason and remedy when the feature is unsupported, such as a package to
+    install or an OS update. Present only when `supported` is false.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'SandboxHostCapability':
+        assert isinstance(obj, dict)
+        name = from_str(obj.get("name"))
+        supported = from_bool(obj.get("supported"))
+        reason = from_union([from_str, from_none], obj.get("reason"))
+        return SandboxHostCapability(name, supported, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["name"] = from_str(self.name)
+        result["supported"] = from_bool(self.supported)
+        if self.reason is not None:
+            result["reason"] = from_union([from_str, from_none], self.reason)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 class SandboxSessionChange(Enum):
     """A session-scoped sandbox transition applied while handling a slash command
@@ -18955,6 +19071,195 @@ def to_dict(self) -> dict:
             result["outputDirectory"] = from_union([from_str, from_none], self.output_directory)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPDiagnosticDetails:
+    """Typed MCP diagnostic detail.
+
+    MCP-specific detail for a source-discriminated diagnostic entry.
+    """
+    connection_id: str
+    """Fresh identifier for the MCP connection attempt, including failed starts."""
+
+    kind: MCPDiagnosticKind
+    """Diagnostic record category."""
+
+    server_name: str
+    """Configured MCP server name."""
+
+    data: str | None = None
+    """Serialized diagnostic detail. Protocol and HTTP records use JSON when detail is present."""
+
+    direction: MCPDiagnosticDirection | None = None
+    """Protocol-frame direction when kind is protocol."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPDiagnosticDetails':
+        assert isinstance(obj, dict)
+        connection_id = from_str(obj.get("connectionId"))
+        kind = MCPDiagnosticKind(obj.get("kind"))
+        server_name = from_str(obj.get("serverName"))
+        data = from_union([from_str, from_none], obj.get("data"))
+        direction = from_union([MCPDiagnosticDirection, from_none], obj.get("direction"))
+        return MCPDiagnosticDetails(connection_id, kind, server_name, data, direction)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["connectionId"] = from_str(self.connection_id)
+        result["kind"] = to_enum(MCPDiagnosticKind, self.kind)
+        result["serverName"] = from_str(self.server_name)
+        if self.data is not None:
+            result["data"] = from_union([from_str, from_none], self.data)
+        if self.direction is not None:
+            result["direction"] = from_union([lambda x: to_enum(MCPDiagnosticDirection, x), from_none], self.direction)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class DiagnosticsReadRequest:
+    """Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the
+    default waitMs is zero (maximum 30000).
+    """
+    sources: list[DiagnosticSource]
+    """Nonempty selection of sources to read. Each source may be listed once."""
+
+    cursor: str | None = None
+    """Opaque cursor returned by an earlier read. Omit to start at the oldest retained record."""
+
+    max: int | None = None
+    """Maximum number of records to return, from 1 through 500. Omit for 100."""
+
+    wait_ms: int | None = None
+    """Maximum time in milliseconds to wait for a new record, from 0 through 30000."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'DiagnosticsReadRequest':
+        assert isinstance(obj, dict)
+        sources = from_list(DiagnosticSource, obj.get("sources"))
+        cursor = from_union([from_str, from_none], obj.get("cursor"))
+        max = from_union([from_int, from_none], obj.get("max"))
+        wait_ms = from_union([from_int, from_none], obj.get("waitMs"))
+        return DiagnosticsReadRequest(sources, cursor, max, wait_ms)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["sources"] = from_list(lambda x: to_enum(DiagnosticSource, x), self.sources)
+        if self.cursor is not None:
+            result["cursor"] = from_union([from_str, from_none], self.cursor)
+        if self.max is not None:
+            result["max"] = from_union([from_int, from_none], self.max)
+        if self.wait_ms is not None:
+            result["waitMs"] = from_union([from_int, from_none], self.wait_ms)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class PermissionDecisionApproveForLocationApprovalMCP:
+    """Location-scoped approval details for an MCP server tool, or all tools on the server when
+    `toolName` is null.
+    """
+    kind: ClassVar[str] = "mcp"
+    """Approval covering an MCP tool."""
+
+    server_name: str
+    """MCP server name."""
+
+    tool_name: str | None = None
+    """MCP tool name, or null to cover every tool on the server."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'PermissionDecisionApproveForLocationApprovalMCP':
+        assert isinstance(obj, dict)
+        server_name = from_str(obj.get("serverName"))
+        tool_name = from_union([from_none, from_str], obj.get("toolName"))
+        return PermissionDecisionApproveForLocationApprovalMCP(server_name, tool_name)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["serverName"] = from_str(self.server_name)
+        result["toolName"] = from_union([from_none, from_str], self.tool_name)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class PermissionDecisionApproveForSessionApprovalMCP:
+    """Session-scoped approval details for an MCP server tool, or all tools on the server when
+    `toolName` is null.
+    """
+    kind: ClassVar[str] = "mcp"
+    """Approval covering an MCP tool."""
+
+    server_name: str
+    """MCP server name."""
+
+    tool_name: str | None = None
+    """MCP tool name, or null to cover every tool on the server."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'PermissionDecisionApproveForSessionApprovalMCP':
+        assert isinstance(obj, dict)
+        server_name = from_str(obj.get("serverName"))
+        tool_name = from_union([from_none, from_str], obj.get("toolName"))
+        return PermissionDecisionApproveForSessionApprovalMCP(server_name, tool_name)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["serverName"] = from_str(self.server_name)
+        result["toolName"] = from_union([from_none, from_str], self.tool_name)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class PermissionsLocationsAddToolApprovalDetailsMCP:
+    """Location-persisted tool approval details for an MCP server tool, or all tools when
+    `toolName` is null.
+    """
+    kind: ClassVar[str] = "mcp"
+    """Approval covering an MCP tool."""
+
+    server_name: str
+    """MCP server name."""
+
+    tool_name: str | None = None
+    """MCP tool name, or null to cover every tool on the server."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'PermissionsLocationsAddToolApprovalDetailsMCP':
+        assert isinstance(obj, dict)
+        server_name = from_str(obj.get("serverName"))
+        tool_name = from_union([from_none, from_str], obj.get("toolName"))
+        return PermissionsLocationsAddToolApprovalDetailsMCP(server_name, tool_name)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["kind"] = self.kind
+        result["serverName"] = from_str(self.server_name)
+        result["toolName"] = from_union([from_none, from_str], self.tool_name)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class MCPDiagnosticSourceConfiguration:
+    """MCP diagnostic capture threshold. Omit to leave the current threshold unchanged.
+
+    MCP diagnostic source configuration.
+    """
+    level: DiagnosticLogLevel
+    """Threshold to apply to MCP diagnostic producers in this session."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'MCPDiagnosticSourceConfiguration':
+        assert isinstance(obj, dict)
+        level = DiagnosticLogLevel(obj.get("level"))
+        return MCPDiagnosticSourceConfiguration(level)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["level"] = to_enum(DiagnosticLogLevel, self.level)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class DiscoveredExtension:
@@ -23335,93 +23640,6 @@ def to_dict(self) -> dict:
             result["approvalKey"] = from_union([from_str, from_none], self.approval_key)
         return result
 
-# Experimental: this type is part of an experimental API and may change or be removed.
-@dataclass
-class PermissionDecisionApproveForLocationApprovalMCP:
-    """Location-scoped approval details for an MCP server tool, or all tools on the server when
-    `toolName` is null.
-    """
-    kind: ClassVar[str] = "mcp"
-    """Approval covering an MCP tool."""
-
-    server_name: str
-    """MCP server name."""
-
-    tool_name: str | None = None
-    """MCP tool name, or null to cover every tool on the server."""
-
-    @staticmethod
-    def from_dict(obj: Any) -> 'PermissionDecisionApproveForLocationApprovalMCP':
-        assert isinstance(obj, dict)
-        server_name = from_str(obj.get("serverName"))
-        tool_name = from_union([from_none, from_str], obj.get("toolName"))
-        return PermissionDecisionApproveForLocationApprovalMCP(server_name, tool_name)
-
-    def to_dict(self) -> dict:
-        result: dict = {}
-        result["kind"] = self.kind
-        result["serverName"] = from_str(self.server_name)
-        result["toolName"] = from_union([from_none, from_str], self.tool_name)
-        return result
-
-# Experimental: this type is part of an experimental API and may change or be removed.
-@dataclass
-class PermissionDecisionApproveForSessionApprovalMCP:
-    """Session-scoped approval details for an MCP server tool, or all tools on the server when
-    `toolName` is null.
-    """
-    kind: ClassVar[str] = "mcp"
-    """Approval covering an MCP tool."""
-
-    server_name: str
-    """MCP server name."""
-
-    tool_name: str | None = None
-    """MCP tool name, or null to cover every tool on the server."""
-
-    @staticmethod
-    def from_dict(obj: Any) -> 'PermissionDecisionApproveForSessionApprovalMCP':
-        assert isinstance(obj, dict)
-        server_name = from_str(obj.get("serverName"))
-        tool_name = from_union([from_none, from_str], obj.get("toolName"))
-        return PermissionDecisionApproveForSessionApprovalMCP(server_name, tool_name)
-
-    def to_dict(self) -> dict:
-        result: dict = {}
-        result["kind"] = self.kind
-        result["serverName"] = from_str(self.server_name)
-        result["toolName"] = from_union([from_none, from_str], self.tool_name)
-        return result
-
-# Experimental: this type is part of an experimental API and may change or be removed.
-@dataclass
-class PermissionsLocationsAddToolApprovalDetailsMCP:
-    """Location-persisted tool approval details for an MCP server tool, or all tools when
-    `toolName` is null.
-    """
-    kind: ClassVar[str] = "mcp"
-    """Approval covering an MCP tool."""
-
-    server_name: str
-    """MCP server name."""
-
-    tool_name: str | None = None
-    """MCP tool name, or null to cover every tool on the server."""
-
-    @staticmethod
-    def from_dict(obj: Any) -> 'PermissionsLocationsAddToolApprovalDetailsMCP':
-        assert isinstance(obj, dict)
-        server_name = from_str(obj.get("serverName"))
-        tool_name = from_union([from_none, from_str], obj.get("toolName"))
-        return PermissionsLocationsAddToolApprovalDetailsMCP(server_name, tool_name)
-
-    def to_dict(self) -> dict:
-        result: dict = {}
-        result["kind"] = self.kind
-        result["serverName"] = from_str(self.server_name)
-        result["toolName"] = from_union([from_none, from_str], self.tool_name)
-        return result
-
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class PermissionDecisionApproveForLocationApprovalMCPSampling:
@@ -25744,6 +25962,13 @@ class QueuePendingItems:
     """Stable identity of the queued user message. Present for message rows and absent for slash
     commands and model changes.
     """
+    source: str | None = None
+    """Optional source tag associated with this pending queue entry. This is an open string, not
+    authenticated authorship. In particular, `user` does not prove that a person typed the
+    message. If the source is absent or unrecognized, consumers must not infer human or agent
+    authorship and should handle the entry neutrally. Consumers should tolerate future source
+    values.
+    """
 
     @staticmethod
     def from_dict(obj: Any) -> 'QueuePendingItems':
@@ -25753,7 +25978,8 @@ def from_dict(obj: Any) -> 'QueuePendingItems':
         id = from_str(obj.get("id"))
         kind = QueuePendingItemsKind(obj.get("kind"))
         message_id = from_union([from_str, from_none], obj.get("messageId"))
-        return QueuePendingItems(agent_mode, display_text, id, kind, message_id)
+        source = from_union([from_str, from_none], obj.get("source"))
+        return QueuePendingItems(agent_mode, display_text, id, kind, message_id, source)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -25763,6 +25989,8 @@ def to_dict(self) -> dict:
         result["kind"] = to_enum(QueuePendingItemsKind, self.kind)
         if self.message_id is not None:
             result["messageId"] = from_union([from_str, from_none], self.message_id)
+        if self.source is not None:
+            result["source"] = from_union([from_str, from_none], self.source)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -26072,6 +26300,43 @@ def to_dict(self) -> dict:
             result["proxy"] = from_union([lambda x: to_class(SandboxConfigUserPolicyNetworkProxy, x), from_none], self.proxy)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class SandboxHostSupport:
+    """Whether the host running this runtime can run the command sandbox. The runtime checks
+    `supported` once per process. A capability answer can change while the process runs, for
+    example after the user installs a missing package.
+    """
+    capabilities: list[SandboxHostCapability]
+    """Sandbox policy features whose availability varies between hosts that can run the backend.
+    Empty when `supported` is false, because no feature can run without a backend. Later
+    runtimes can add entries; ignore an entry whose `name` you do not recognize.
+    """
+    supported: bool
+    """Whether a process-containment backend is usable on this host: Seatbelt on macOS,
+    Bubblewrap on Linux, or ProcessContainer on Windows.
+    """
+    reason: str | None = None
+    """Human-readable reason the sandbox cannot run on this host. Present only when `supported`
+    is false.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'SandboxHostSupport':
+        assert isinstance(obj, dict)
+        capabilities = from_list(SandboxHostCapability.from_dict, obj.get("capabilities"))
+        supported = from_bool(obj.get("supported"))
+        reason = from_union([from_str, from_none], obj.get("reason"))
+        return SandboxHostSupport(capabilities, supported, reason)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["capabilities"] = from_list(lambda x: to_class(SandboxHostCapability, x), self.capabilities)
+        result["supported"] = from_bool(self.supported)
+        if self.reason is not None:
+            result["reason"] = from_union([from_str, from_none], self.reason)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class SlashCommandTextResult:
@@ -29761,6 +30026,89 @@ def to_dict(self) -> dict:
             result["skippedEntries"] = from_union([lambda x: from_list(lambda x: to_class(DebugCollectLogsSkippedEntry, x), x), from_none], self.skipped_entries)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class DiagnosticEntry:
+    """One retained session-scoped diagnostic record. Potentially content-bearing diagnostic
+    data is opt-in and must not be exported automatically as telemetry.
+    """
+    details: MCPDiagnosticDetails
+    """Typed MCP diagnostic detail."""
+
+    level: DiagnosticSeverity
+    """Severity of this emitted diagnostic record."""
+
+    message: str
+    """Human-readable diagnostic summary."""
+
+    source: DiagnosticSource
+    """Diagnostic source identifying the typed details payload."""
+
+    timestamp: str
+    """UTC RFC 3339 timestamp captured at the diagnostic source."""
+
+    agent_id: str | None = None
+    """Agent identifier for a subagent host. Omitted for the root agent."""
+
+    original_bytes: int | None = None
+    """Original byte count when a known-size message or data value was truncated."""
+
+    truncated: bool | None = None
+    """Whether message or data was truncated to the record-size bound."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'DiagnosticEntry':
+        assert isinstance(obj, dict)
+        details = MCPDiagnosticDetails.from_dict(obj.get("details"))
+        level = DiagnosticSeverity(obj.get("level"))
+        message = from_str(obj.get("message"))
+        source = DiagnosticSource(obj.get("source"))
+        timestamp = from_str(obj.get("timestamp"))
+        agent_id = from_union([from_str, from_none], obj.get("agentId"))
+        original_bytes = from_union([from_int, from_none], obj.get("originalBytes"))
+        truncated = from_union([from_bool, from_none], obj.get("truncated"))
+        return DiagnosticEntry(details, level, message, source, timestamp, agent_id, original_bytes, truncated)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["details"] = to_class(MCPDiagnosticDetails, self.details)
+        result["level"] = to_enum(DiagnosticSeverity, self.level)
+        result["message"] = from_str(self.message)
+        result["source"] = to_enum(DiagnosticSource, self.source)
+        result["timestamp"] = from_str(self.timestamp)
+        if self.agent_id is not None:
+            result["agentId"] = from_union([from_str, from_none], self.agent_id)
+        if self.original_bytes is not None:
+            result["originalBytes"] = from_union([from_int, from_none], self.original_bytes)
+        if self.truncated is not None:
+            result["truncated"] = from_union([from_bool, from_none], self.truncated)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class DiagnosticSourcesConfiguration:
+    """Diagnostic thresholds keyed by supported source.
+
+    Typed diagnostic source configuration. At least one source is required by diagnostics
+    configuration methods.
+
+    Sources to configure. At least one supported source must be supplied.
+    """
+    mcp: MCPDiagnosticSourceConfiguration | None = None
+    """MCP diagnostic capture threshold. Omit to leave the current threshold unchanged."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'DiagnosticSourcesConfiguration':
+        assert isinstance(obj, dict)
+        mcp = from_union([MCPDiagnosticSourceConfiguration.from_dict, from_none], obj.get("mcp"))
+        return DiagnosticSourcesConfiguration(mcp)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        if self.mcp is not None:
+            result["mcp"] = from_union([lambda x: to_class(MCPDiagnosticSourceConfiguration, x), from_none], self.mcp)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class DiscoveredExtensions:
@@ -32465,6 +32813,13 @@ class QueuePendingItemsResult:
     turn (and so have an emitted `user.message`), as opposed to still waiting for one. Absent
     for hosts that do not distinguish the two.
     """
+    withdrawable_turn_message_id: str | None = None
+    """ID of the running turn's user message while the model has not answered it, so
+    `withdrawMessage` can still take it back once nothing sent after it is pending. A message
+    leaves `items` when its turn starts, before its `user.message` is recorded; this tells
+    that message apart from one that was removed. Absent when no turn prompt can be taken
+    back.
+    """
 
     @staticmethod
     def from_dict(obj: Any) -> 'QueuePendingItemsResult':
@@ -32472,7 +32827,8 @@ def from_dict(obj: Any) -> 'QueuePendingItemsResult':
         items = from_list(QueuePendingItems.from_dict, obj.get("items"))
         steering_messages = from_list(from_str, obj.get("steeringMessages"))
         in_flight_steering_count = from_union([from_int, from_none], obj.get("inFlightSteeringCount"))
-        return QueuePendingItemsResult(items, steering_messages, in_flight_steering_count)
+        withdrawable_turn_message_id = from_union([from_str, from_none], obj.get("withdrawableTurnMessageId"))
+        return QueuePendingItemsResult(items, steering_messages, in_flight_steering_count, withdrawable_turn_message_id)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -32480,6 +32836,8 @@ def to_dict(self) -> dict:
         result["steeringMessages"] = from_list(from_str, self.steering_messages)
         if self.in_flight_steering_count is not None:
             result["inFlightSteeringCount"] = from_union([from_int, from_none], self.in_flight_steering_count)
+        if self.withdrawable_turn_message_id is not None:
+            result["withdrawableTurnMessageId"] = from_union([from_str, from_none], self.withdrawable_turn_message_id)
         return result
 
 # Experimental: this type is part of an experimental API and may change or be removed.
@@ -34081,6 +34439,12 @@ class MCPSerializableServerConfig:
     oauth_public_client: bool | None = None
     """Whether the configured OAuth client is public and does not require a client secret."""
 
+    oauth_scopes: list[str] | None = None
+    """Non-empty array of valid RFC 6749 scope-token strings to request for the statically
+    configured OAuth client when the server challenge omits scope or provides an empty scope.
+    Requires a non-empty oauthClientId. These scopes take precedence over protected-resource
+    metadata.
+    """
     url: str | None = None
     """URL of the remote MCP server endpoint."""
 
@@ -34118,8 +34482,9 @@ def from_dict(obj: Any) -> 'MCPSerializableServerConfig':
         oauth_client_id = from_union([from_str, from_none], obj.get("oauthClientId"))
         oauth_grant_type = from_union([MCPGrantType, from_none], obj.get("oauthGrantType"))
         oauth_public_client = from_union([from_bool, from_none], obj.get("oauthPublicClient"))
+        oauth_scopes = from_union([lambda x: from_list(from_str, x), from_none], obj.get("oauthScopes"))
         url = from_union([from_str, from_none], obj.get("url"))
-        return MCPSerializableServerConfig(args, auth, command, config_warnings, cwd, defer_tools, disable_secret_masking, disable_tool_cache, display_name, env, events, exclude_tools, filter_mapping, is_default_server, notifications, oidc, safe_for_telemetry, slow_connection_threshold_ms, source, source_path, source_plugin, source_plugin_spec, source_plugin_version, timeout, tools, type, headers, headers_refresh_ttl_ms, oauth_client_id, oauth_grant_type, oauth_public_client, url)
+        return MCPSerializableServerConfig(args, auth, command, config_warnings, cwd, defer_tools, disable_secret_masking, disable_tool_cache, display_name, env, events, exclude_tools, filter_mapping, is_default_server, notifications, oidc, safe_for_telemetry, slow_connection_threshold_ms, source, source_path, source_plugin, source_plugin_spec, source_plugin_version, timeout, tools, type, headers, headers_refresh_ttl_ms, oauth_client_id, oauth_grant_type, oauth_public_client, oauth_scopes, url)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -34185,6 +34550,8 @@ def to_dict(self) -> dict:
             result["oauthGrantType"] = from_union([lambda x: to_enum(MCPGrantType, x), from_none], self.oauth_grant_type)
         if self.oauth_public_client is not None:
             result["oauthPublicClient"] = from_union([from_bool, from_none], self.oauth_public_client)
+        if self.oauth_scopes is not None:
+            result["oauthScopes"] = from_union([lambda x: from_list(from_str, x), from_none], self.oauth_scopes)
         if self.url is not None:
             result["url"] = from_union([from_str, from_none], self.url)
         return result
@@ -34249,6 +34616,12 @@ class MCPServerConfigHTTP:
     oauth_public_client: bool | None = None
     """Whether the configured OAuth client is public and does not require a client secret."""
 
+    oauth_scopes: list[str] | None = field(default=None, kw_only=True)
+    """Non-empty array of valid RFC 6749 scope-token strings to request for the statically
+    configured OAuth client when the server challenge omits scope or provides an empty scope.
+    Requires a non-empty oauthClientId. These scopes take precedence over protected-resource
+    metadata.
+    """
     oidc: bool | MCPServerAuthConfigRedirectPort | None = None
     """Set to `true` to use defaults, or provide an object with additional auth or OIDC settings."""
 
@@ -34304,6 +34677,7 @@ def from_dict(obj: Any) -> 'MCPServerConfigHTTP':
         oauth_client_id = from_union([from_str, from_none], obj.get("oauthClientId"))
         oauth_grant_type = from_union([MCPGrantType, from_none], obj.get("oauthGrantType"))
         oauth_public_client = from_union([from_bool, from_none], obj.get("oauthPublicClient"))
+        oauth_scopes = from_union([lambda x: from_list(from_str, x), from_none], obj.get("oauthScopes"))
         oidc = from_union([from_bool, MCPServerAuthConfigRedirectPort.from_dict, from_none], obj.get("oidc"))
         safe_for_telemetry = from_union([from_bool, MCPSafeForTelemetryFields.from_dict, from_none], obj.get("safeForTelemetry"))
         slow_connection_threshold_ms = from_union([from_int, from_none], obj.get("slowConnectionThresholdMs"))
@@ -34315,7 +34689,7 @@ def from_dict(obj: Any) -> 'MCPServerConfigHTTP':
         timeout = from_union([from_int, from_none], obj.get("timeout"))
         tools = from_union([lambda x: from_list(from_str, x), from_none], obj.get("tools"))
         type = from_union([MCPServerConfigHTTPType, from_none], obj.get("type"))
-        return MCPServerConfigHTTP(url, auth, config_warnings, defer_tools, disable_secret_masking, disable_tool_cache, display_name, events, exclude_tools, filter_mapping, headers, headers_refresh_ttl_ms, is_default_server, notifications, oauth_client_id, oauth_grant_type, oauth_public_client, oidc, safe_for_telemetry, slow_connection_threshold_ms, source, source_path, source_plugin, source_plugin_spec, source_plugin_version, timeout, tools, type)
+        return MCPServerConfigHTTP(url, auth, config_warnings, defer_tools, disable_secret_masking, disable_tool_cache, display_name, events, exclude_tools, filter_mapping, headers, headers_refresh_ttl_ms, is_default_server, notifications, oauth_client_id, oauth_grant_type, oauth_public_client, oidc, safe_for_telemetry, slow_connection_threshold_ms, source, source_path, source_plugin, source_plugin_spec, source_plugin_version, timeout, tools, type, oauth_scopes=oauth_scopes)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -34352,6 +34726,8 @@ def to_dict(self) -> dict:
             result["oauthGrantType"] = from_union([lambda x: to_enum(MCPGrantType, x), from_none], self.oauth_grant_type)
         if self.oauth_public_client is not None:
             result["oauthPublicClient"] = from_union([from_bool, from_none], self.oauth_public_client)
+        if self.oauth_scopes is not None:
+            result["oauthScopes"] = from_union([lambda x: from_list(from_str, x), from_none], self.oauth_scopes)
         if self.oidc is not None:
             result["oidc"] = from_union([from_bool, lambda x: to_class(MCPServerAuthConfigRedirectPort, x), from_none], self.oidc)
         if self.safe_for_telemetry is not None:
@@ -34997,6 +35373,44 @@ def to_dict(self) -> dict:
             result["session"] = from_union([lambda x: to_class(CanvasSessionContext, x), from_none], self.session)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class DiagnosticsConfiguration:
+    """Per-source session diagnostics configuration."""
+
+    sources: DiagnosticSourcesConfiguration
+    """Diagnostic thresholds keyed by supported source."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'DiagnosticsConfiguration':
+        assert isinstance(obj, dict)
+        sources = DiagnosticSourcesConfiguration.from_dict(obj.get("sources"))
+        return DiagnosticsConfiguration(sources)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["sources"] = to_class(DiagnosticSourcesConfiguration, self.sources)
+        return result
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class DiagnosticsConfigureRequest:
+    """Patch session diagnostic thresholds for explicitly supplied sources."""
+
+    sources: DiagnosticSourcesConfiguration
+    """Sources to configure. At least one supported source must be supplied."""
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'DiagnosticsConfigureRequest':
+        assert isinstance(obj, dict)
+        sources = DiagnosticSourcesConfiguration.from_dict(obj.get("sources"))
+        return DiagnosticsConfigureRequest(sources)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["sources"] = to_class(DiagnosticSourcesConfiguration, self.sources)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class HandlePendingToolCallRequest:
@@ -37983,6 +38397,73 @@ def to_dict(self) -> dict:
             result["namespacedName"] = from_union([from_str, from_none], self.namespaced_name)
         return result
 
+# Experimental: this type is part of an experimental API and may change or be removed.
+class CursorStatus(Enum):
+    """Whether the supplied diagnostic cursor remained within the retained buffer window.
+
+    Whether the requested cursor remained within the retained buffer window.
+
+    Cursor status: 'ok' means the read succeeded against the requested history; 'expired'
+    means the requested continuation is unavailable. Recovery is endpoint-specific:
+    session.eventLog.read returns a boundary window of remaining active history that may
+    overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page
+    and never switches journal generations. An expired persisted read is not successful
+    completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.
+
+    Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read,
+    'expired' means the cursor referred to an event that no longer exists in active history
+    and the read fell back to a boundary of the remaining history: the beginning for a
+    forward read or the newest window for a backward read. That fallback may overlap already
+    rendered events, so active-session consumers should reset, rebase, or deduplicate before
+    continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired'
+    returns an empty terminal page and never switches to a replacement journal generation.
+    Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry.
+    """
+    EXPIRED = "expired"
+    OK = "ok"
+
+# Experimental: this type is part of an experimental API and may change or be removed.
+@dataclass
+class DiagnosticsReadResult:
+    """One cursor-addressed page of retained session diagnostics."""
+
+    cursor: str
+    """Opaque cursor for the next independent read."""
+
+    cursor_status: CursorStatus
+    """Whether the requested cursor remained within the retained buffer window."""
+
+    entries: list[DiagnosticEntry]
+    """Retained records beginning at the requested cursor."""
+
+    has_more: bool
+    """Whether additional retained records follow this page."""
+
+    dropped_count: int | None = None
+    """Number of records lost before this page when known. Omitted when a buffer generation
+    change makes the count unknowable.
+    """
+
+    @staticmethod
+    def from_dict(obj: Any) -> 'DiagnosticsReadResult':
+        assert isinstance(obj, dict)
+        cursor = from_str(obj.get("cursor"))
+        cursor_status = CursorStatus(obj.get("cursorStatus"))
+        entries = from_list(DiagnosticEntry.from_dict, obj.get("entries"))
+        has_more = from_bool(obj.get("hasMore"))
+        dropped_count = from_union([from_int, from_none], obj.get("droppedCount"))
+        return DiagnosticsReadResult(cursor, cursor_status, entries, has_more, dropped_count)
+
+    def to_dict(self) -> dict:
+        result: dict = {}
+        result["cursor"] = from_str(self.cursor)
+        result["cursorStatus"] = to_enum(CursorStatus, self.cursor_status)
+        result["entries"] = from_list(lambda x: to_class(DiagnosticEntry, x), self.entries)
+        result["hasMore"] = from_bool(self.has_more)
+        if self.dropped_count is not None:
+            result["droppedCount"] = from_union([from_int, from_none], self.dropped_count)
+        return result
+
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class EnvAuthInfo:
@@ -38034,27 +38515,6 @@ def to_dict(self) -> dict:
             result["login"] = from_union([from_str, from_none], self.login)
         return result
 
-# Experimental: this type is part of an experimental API and may change or be removed.
-class EventsCursorStatus(Enum):
-    """Cursor status: 'ok' means the read succeeded against the requested history; 'expired'
-    means the requested continuation is unavailable. Recovery is endpoint-specific:
-    session.eventLog.read returns a boundary window of remaining active history that may
-    overlap prior pages, while sessions.readPersistedEvents returns an empty terminal page
-    and never switches journal generations. An expired persisted read is not successful
-    completion; a complete persisted snapshot requires cursorStatus 'ok' and hasMore false.
-
-    Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read,
-    'expired' means the cursor referred to an event that no longer exists in active history
-    and the read fell back to a boundary of the remaining history: the beginning for a
-    forward read or the newest window for a backward read. That fallback may overlap already
-    rendered events, so active-session consumers should reset, rebase, or deduplicate before
-    continuing. sessions.readPersistedEvents has stricter snapshot semantics: 'expired'
-    returns an empty terminal page and never switches to a replacement journal generation.
-    Other persisted-read I/O failures are RPC errors with diagnostics, not cursor expiry.
-    """
-    EXPIRED = "expired"
-    OK = "ok"
-
 # Experimental: this type is part of an experimental API and may change or be removed.
 @dataclass
 class EventsReadResult:
@@ -38066,7 +38526,7 @@ class EventsReadResult:
     backward read this cursor pages toward OLDER events; keep passing `direction: backward`
     with it (the cursor is also self-describing, so backward paging continues correctly).
     """
-    cursor_status: EventsCursorStatus
+    cursor_status: CursorStatus
     """Cursor status: 'ok' means the cursor was applied successfully. For session.eventLog.read,
     'expired' means the cursor referred to an event that no longer exists in active history
     and the read fell back to a boundary of the remaining history: the beginning for a
@@ -38095,7 +38555,7 @@ class EventsReadResult:
     def from_dict(obj: Any) -> 'EventsReadResult':
         assert isinstance(obj, dict)
         cursor = from_str(obj.get("cursor"))
-        cursor_status = EventsCursorStatus(obj.get("cursorStatus"))
+        cursor_status = CursorStatus(obj.get("cursorStatus"))
         events = from_list(SessionEvent.from_dict, obj.get("events"))
         has_more = from_bool(obj.get("hasMore"))
         return EventsReadResult(cursor, cursor_status, events, has_more)
@@ -38103,7 +38563,7 @@ def from_dict(obj: Any) -> 'EventsReadResult':
     def to_dict(self) -> dict:
         result: dict = {}
         result["cursor"] = from_str(self.cursor)
-        result["cursorStatus"] = to_enum(EventsCursorStatus, self.cursor_status)
+        result["cursorStatus"] = to_enum(CursorStatus, self.cursor_status)
         result["events"] = from_list(lambda x: to_class(SessionEvent, x), self.events)
         result["hasMore"] = from_bool(self.has_more)
         return result
@@ -38774,6 +39234,12 @@ class MCPServerConfig:
     oauth_public_client: bool | None = None
     """Whether the configured OAuth client is public and does not require a client secret."""
 
+    oauth_scopes: list[str] | None = None
+    """Non-empty array of valid RFC 6749 scope-token strings to request for the statically
+    configured OAuth client when the server challenge omits scope or provides an empty scope.
+    Requires a non-empty oauthClientId. These scopes take precedence over protected-resource
+    metadata.
+    """
     url: str | None = None
     """URL of the remote MCP server endpoint."""
 
@@ -38814,9 +39280,10 @@ def from_dict(obj: Any) -> 'MCPServerConfig':
         oauth_client_id = from_union([from_str, from_none], obj.get("oauthClientId"))
         oauth_grant_type = from_union([MCPGrantType, from_none], obj.get("oauthGrantType"))
         oauth_public_client = from_union([from_bool, from_none], obj.get("oauthPublicClient"))
+        oauth_scopes = from_union([lambda x: from_list(from_str, x), from_none], obj.get("oauthScopes"))
         url = from_union([from_str, from_none], obj.get("url"))
         server_instance = obj.get("serverInstance")
-        return MCPServerConfig(args, auth, command, config_warnings, cwd, defer_tools, disable_secret_masking, disable_tool_cache, display_name, env, events, exclude_tools, filter_mapping, is_default_server, notifications, oidc, safe_for_telemetry, slow_connection_threshold_ms, source, source_path, source_plugin, source_plugin_spec, source_plugin_version, timeout, tools, type, headers, headers_refresh_ttl_ms, oauth_client_id, oauth_grant_type, oauth_public_client, url, server_instance)
+        return MCPServerConfig(args, auth, command, config_warnings, cwd, defer_tools, disable_secret_masking, disable_tool_cache, display_name, env, events, exclude_tools, filter_mapping, is_default_server, notifications, oidc, safe_for_telemetry, slow_connection_threshold_ms, source, source_path, source_plugin, source_plugin_spec, source_plugin_version, timeout, tools, type, headers, headers_refresh_ttl_ms, oauth_client_id, oauth_grant_type, oauth_public_client, oauth_scopes, url, server_instance)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -38882,6 +39349,8 @@ def to_dict(self) -> dict:
             result["oauthGrantType"] = from_union([lambda x: to_enum(MCPGrantType, x), from_none], self.oauth_grant_type)
         if self.oauth_public_client is not None:
             result["oauthPublicClient"] = from_union([from_bool, from_none], self.oauth_public_client)
+        if self.oauth_scopes is not None:
+            result["oauthScopes"] = from_union([lambda x: from_list(from_str, x), from_none], self.oauth_scopes)
         if self.url is not None:
             result["url"] = from_union([from_str, from_none], self.url)
         if self.server_instance is not None:
@@ -41973,6 +42442,16 @@ class RPC:
     debug_collect_logs_result_kind: DebugCollectLogsResultKind
     debug_collect_logs_skipped_entry: DebugCollectLogsSkippedEntry
     debug_collect_logs_source: DebugCollectLogsSource
+    diagnostic_cursor_status: CursorStatus
+    diagnostic_entry: DiagnosticEntry
+    diagnostic_log_level: DiagnosticLogLevel
+    diagnostics_configuration: DiagnosticsConfiguration
+    diagnostics_configure_request: DiagnosticsConfigureRequest
+    diagnostic_severity: DiagnosticSeverity
+    diagnostic_source: DiagnosticSource
+    diagnostic_sources_configuration: DiagnosticSourcesConfiguration
+    diagnostics_read_request: DiagnosticsReadRequest
+    diagnostics_read_result: DiagnosticsReadResult
     discovered_canvas: DiscoveredCanvas
     discovered_extension: DiscoveredExtension
     discovered_extension_mode: DiscoveredExtensionMode
@@ -41992,7 +42471,7 @@ class RPC:
     event_log_tail_result: EventLogTailResult
     event_log_types: list[str] | EventLogTypes
     events_agent_scope: EventsAgentScope
-    events_cursor_status: EventsCursorStatus
+    events_cursor_status: CursorStatus
     events_read_direction: EventsReadDirection
     events_read_result: EventsReadResult
     execute_command_params: ExecuteCommandParams
@@ -42192,6 +42671,10 @@ class RPC:
     mcp_config_update_request: MCPConfigUpdateRequest
     mcp_configure_git_hub_request: MCPConfigureGitHubRequest
     mcp_configure_git_hub_result: MCPConfigureGitHubResult
+    mcp_diagnostic_details: MCPDiagnosticDetails
+    mcp_diagnostic_direction: MCPDiagnosticDirection
+    mcp_diagnostic_kind: MCPDiagnosticKind
+    mcp_diagnostic_source_configuration: MCPDiagnosticSourceConfiguration
     mcp_disable_request: MCPDisableRequest
     mcp_discover_request: MCPDiscoverRequest
     mcp_discover_result: MCPDiscoverResult
@@ -42603,6 +43086,7 @@ class RPC:
     queue_update_text_request: QueueUpdateTextRequest
     queue_update_text_result: QueueUpdateTextResult
     queue_withdraw_message_request: QueueWithdrawMessageRequest
+    queue_withdraw_message_result: QueueWithdrawMessageResult
     register_event_interest_params: RegisterEventInterestParams
     register_event_interest_result: RegisterEventInterestResult
     release_event_interest_params: ReleaseEventInterestParams
@@ -42642,6 +43126,9 @@ class RPC:
     sandbox_disable_for_session_request: SandboxDisableForSessionRequest
     sandbox_disable_for_session_result: SandboxDisableForSessionResult
     sandbox_enforcement_status: SandboxEnforcementStatus
+    sandbox_host_capability: SandboxHostCapability
+    sandbox_host_capability_name: str
+    sandbox_host_support: SandboxHostSupport
     sandbox_session_change: SandboxSessionChange
     schedule_add_at_request: ScheduleAddAtRequest
     schedule_add_cron_request: ScheduleAddCronRequest
@@ -43350,6 +43837,16 @@ def from_dict(obj: Any) -> 'RPC':
         debug_collect_logs_result_kind = DebugCollectLogsResultKind(obj.get("DebugCollectLogsResultKind"))
         debug_collect_logs_skipped_entry = DebugCollectLogsSkippedEntry.from_dict(obj.get("DebugCollectLogsSkippedEntry"))
         debug_collect_logs_source = DebugCollectLogsSource(obj.get("DebugCollectLogsSource"))
+        diagnostic_cursor_status = CursorStatus(obj.get("DiagnosticCursorStatus"))
+        diagnostic_entry = DiagnosticEntry.from_dict(obj.get("DiagnosticEntry"))
+        diagnostic_log_level = DiagnosticLogLevel(obj.get("DiagnosticLogLevel"))
+        diagnostics_configuration = DiagnosticsConfiguration.from_dict(obj.get("DiagnosticsConfiguration"))
+        diagnostics_configure_request = DiagnosticsConfigureRequest.from_dict(obj.get("DiagnosticsConfigureRequest"))
+        diagnostic_severity = DiagnosticSeverity(obj.get("DiagnosticSeverity"))
+        diagnostic_source = DiagnosticSource(obj.get("DiagnosticSource"))
+        diagnostic_sources_configuration = DiagnosticSourcesConfiguration.from_dict(obj.get("DiagnosticSourcesConfiguration"))
+        diagnostics_read_request = DiagnosticsReadRequest.from_dict(obj.get("DiagnosticsReadRequest"))
+        diagnostics_read_result = DiagnosticsReadResult.from_dict(obj.get("DiagnosticsReadResult"))
         discovered_canvas = DiscoveredCanvas.from_dict(obj.get("DiscoveredCanvas"))
         discovered_extension = DiscoveredExtension.from_dict(obj.get("DiscoveredExtension"))
         discovered_extension_mode = DiscoveredExtensionMode(obj.get("DiscoveredExtensionMode"))
@@ -43369,7 +43866,7 @@ def from_dict(obj: Any) -> 'RPC':
         event_log_tail_result = EventLogTailResult.from_dict(obj.get("EventLogTailResult"))
         event_log_types = from_union([lambda x: from_list(from_str, x), EventLogTypes], obj.get("EventLogTypes"))
         events_agent_scope = EventsAgentScope(obj.get("EventsAgentScope"))
-        events_cursor_status = EventsCursorStatus(obj.get("EventsCursorStatus"))
+        events_cursor_status = CursorStatus(obj.get("EventsCursorStatus"))
         events_read_direction = EventsReadDirection(obj.get("EventsReadDirection"))
         events_read_result = EventsReadResult.from_dict(obj.get("EventsReadResult"))
         execute_command_params = ExecuteCommandParams.from_dict(obj.get("ExecuteCommandParams"))
@@ -43569,6 +44066,10 @@ def from_dict(obj: Any) -> 'RPC':
         mcp_config_update_request = MCPConfigUpdateRequest.from_dict(obj.get("McpConfigUpdateRequest"))
         mcp_configure_git_hub_request = MCPConfigureGitHubRequest.from_dict(obj.get("McpConfigureGitHubRequest"))
         mcp_configure_git_hub_result = MCPConfigureGitHubResult.from_dict(obj.get("McpConfigureGitHubResult"))
+        mcp_diagnostic_details = MCPDiagnosticDetails.from_dict(obj.get("McpDiagnosticDetails"))
+        mcp_diagnostic_direction = MCPDiagnosticDirection(obj.get("McpDiagnosticDirection"))
+        mcp_diagnostic_kind = MCPDiagnosticKind(obj.get("McpDiagnosticKind"))
+        mcp_diagnostic_source_configuration = MCPDiagnosticSourceConfiguration.from_dict(obj.get("McpDiagnosticSourceConfiguration"))
         mcp_disable_request = MCPDisableRequest.from_dict(obj.get("McpDisableRequest"))
         mcp_discover_request = MCPDiscoverRequest.from_dict(obj.get("McpDiscoverRequest"))
         mcp_discover_result = MCPDiscoverResult.from_dict(obj.get("McpDiscoverResult"))
@@ -43980,6 +44481,7 @@ def from_dict(obj: Any) -> 'RPC':
         queue_update_text_request = QueueUpdateTextRequest.from_dict(obj.get("QueueUpdateTextRequest"))
         queue_update_text_result = QueueUpdateTextResult.from_dict(obj.get("QueueUpdateTextResult"))
         queue_withdraw_message_request = QueueWithdrawMessageRequest.from_dict(obj.get("QueueWithdrawMessageRequest"))
+        queue_withdraw_message_result = QueueWithdrawMessageResult.from_dict(obj.get("QueueWithdrawMessageResult"))
         register_event_interest_params = RegisterEventInterestParams.from_dict(obj.get("RegisterEventInterestParams"))
         register_event_interest_result = RegisterEventInterestResult.from_dict(obj.get("RegisterEventInterestResult"))
         release_event_interest_params = ReleaseEventInterestParams.from_dict(obj.get("ReleaseEventInterestParams"))
@@ -44019,6 +44521,9 @@ def from_dict(obj: Any) -> 'RPC':
         sandbox_disable_for_session_request = SandboxDisableForSessionRequest.from_dict(obj.get("SandboxDisableForSessionRequest"))
         sandbox_disable_for_session_result = SandboxDisableForSessionResult.from_dict(obj.get("SandboxDisableForSessionResult"))
         sandbox_enforcement_status = SandboxEnforcementStatus.from_dict(obj.get("SandboxEnforcementStatus"))
+        sandbox_host_capability = SandboxHostCapability.from_dict(obj.get("SandboxHostCapability"))
+        sandbox_host_capability_name = from_str(obj.get("SandboxHostCapabilityName"))
+        sandbox_host_support = SandboxHostSupport.from_dict(obj.get("SandboxHostSupport"))
         sandbox_session_change = SandboxSessionChange(obj.get("SandboxSessionChange"))
         schedule_add_at_request = ScheduleAddAtRequest.from_dict(obj.get("ScheduleAddAtRequest"))
         schedule_add_cron_request = ScheduleAddCronRequest.from_dict(obj.get("ScheduleAddCronRequest"))
@@ -44481,7 +44986,7 @@ def from_dict(obj: Any) -> 'RPC':
         subagent_settings = from_union([SubagentSettings.from_dict, from_none], obj.get("SubagentSettings"))
         task_progress = from_union([TaskProgress.from_dict, from_none], obj.get("TaskProgress"))
         workspace_summary = from_union([WorkspaceSummary.from_dict, from_none], obj.get("WorkspaceSummary"))
-        return RPC(abort_request, abort_result, accepted_enqueue_command_result, account_all_users, account_get_all_users_result, account_get_current_auth_result, account_get_quota_request, account_get_quota_result, account_login_request, account_login_result, account_logout_request, account_logout_result, account_quota_snapshot, adaptive_thinking_support, agent_discovery_path, agent_discovery_path_list, agent_discovery_path_scope, agent_get_current_result, agent_info, agent_info_source, agent_list, agent_list_request, agent_registry_live_target_entry, agent_registry_live_target_entry_attention_kind, agent_registry_live_target_entry_kind, agent_registry_live_target_entry_last_terminal_event, agent_registry_live_target_entry_status, agent_registry_log_capture, agent_registry_log_capture_open_error_reason, agent_registry_spawn_error, agent_registry_spawn_permission_mode, agent_registry_spawn_registry_timeout, agent_registry_spawn_request, agent_registry_spawn_result, agent_registry_spawn_spawned, agent_registry_spawn_validation_error, agent_registry_spawn_validation_error_field, agent_registry_spawn_validation_error_reason, agent_reload_result, agents_discover_request, agent_select_request, agent_select_result, agent_set_prompt_request, agents_get_discovery_paths_request, api_key_auth_info, auth_identity, auth_info, auth_info_type, auth_validation_error, auth_validation_errors, autopilot_objective_credit_limit, autopilot_objective_get_state_result, autopilot_objective_state, autopilot_objective_status, built_in_model_catalog, built_in_model_catalog_entry, builtin_tool_descriptor, builtin_tool_format, builtin_tool_format_type, builtin_tool_input_schema, builtin_tool_input_schema_type, builtin_tool_safe_for_telemetry, builtin_tool_safe_telemetry_fields, cancel_user_requested_shell_command_result, canvas_action, canvas_action_invoke_request, canvas_action_invoke_result, canvas_close_request, canvas_host_context, canvas_host_context_capabilities, canvas_json_schema, canvas_list, canvas_list_open_result, canvas_open_request, canvas_provider_close_request, canvas_provider_invoke_action_request, canvas_provider_open_request, canvas_provider_open_result, canvas_provider_register_request, canvas_provider_unregister_request, canvas_session_context, capi_session_options, card_digest, card_digest_algorithm, card_digest_value, catalog_agent_plugin_candidate, catalog_agent_plugin_candidate_kind, catalog_agent_plugin_candidate_provenance, catalog_agent_plugin_compatibility_tag, catalog_agent_plugin_media_type, catalog_ai_skill_candidate, catalog_ai_skill_candidate_kind, catalog_ai_skill_candidate_provenance, catalog_ai_skill_installability, catalog_ai_skill_media_type, catalog_authentication_required_error, catalog_authentication_required_reason, catalog_candidate, catalog_candidate_kind, catalog_candidate_source, catalog_candidate_source_embedded, catalog_candidate_source_url, catalog_capability, catalog_capability_id, catalog_client_contract, catalog_contract_violation_error, catalog_contract_violation_reason, catalog_handle_rejected_error, catalog_handle_rejection_reason, catalog_handle_type, catalog_invalid_request_error, catalog_invalid_request_field, catalog_malformed_card_error, catalog_malformed_card_reason, catalog_mcp_server_candidate, catalog_mcp_server_candidate_kind, catalog_mcp_server_candidate_provenance, catalog_mcp_server_installability, catalog_media_type, catalog_negotiated_contract, catalog_negotiation_refused_error, catalog_negotiation_refused_reason, catalog_network_failure_error, catalog_network_failure_reason, catalog_not_installable_error, catalog_not_installable_reason, catalog_plugin_repository_source, catalog_policy_rejected_error, catalog_resource_identity, catalog_resource_version, catalog_search_page, catalog_search_pagination, catalog_search_request, catalog_search_result, catalog_search_succeeded, catalog_search_total_count_relation, catalog_selection_cancelled, catalog_selection_decision, catalog_selection_declined, catalog_selection_foreign, catalog_selection_invalid, catalog_selection_replayed, catalog_selection_request, catalog_selection_result, catalog_selection_selected, catalog_selection_stale, catalog_selection_timed_out, catalog_selection_wrong_kind, catalog_trust_eligibility, catalog_trust_provenance, catalog_trust_snapshot, catalog_trust_snapshot_absent, catalog_trust_snapshot_absent_status, catalog_trust_snapshot_current, catalog_trust_snapshot_current_status, catalog_trust_snapshot_downgraded, catalog_trust_snapshot_downgraded_status, catalog_trust_snapshot_malformed, catalog_trust_snapshot_malformed_status, catalog_trust_snapshot_revoked, catalog_trust_snapshot_revoked_status, catalog_trust_snapshot_schema_version, catalog_trust_snapshot_stale, catalog_trust_snapshot_stale_status, catalog_trust_snapshot_unsupported, catalog_trust_snapshot_unsupported_status, catalog_trust_source, catalog_trust_tier, catalog_unavailable_error, catalog_unavailable_reason, catalog_unavailable_transport_error, catalog_unavailable_transport_reason, catalog_unsafe_retrieval_error, catalog_unsafe_retrieval_reason, catalog_unsupported_kind_error, client_metadata, client_task_cancel_reason, client_task_cancel_request, client_task_cancel_result, command_list, commands_finalize_invocation_effect_request, commands_finalize_invocation_effect_result, commands_handle_pending_command_request, commands_handle_pending_command_result, commands_invocation_effect_outcome, commands_invocation_origin, commands_invoke_request, commands_list_request, commands_respond_to_queued_command_request, commands_respond_to_queued_command_result, completions_get_trigger_characters_result, completions_request_request, completions_request_result, configure_session_extensions_params, connect_client_info, connected_remote_session_metadata, connected_remote_session_metadata_kind, connected_remote_session_metadata_repository, connector_account_request, connector_authorization_requirement, connector_authorization_scope, connector_availability, connector_capabilities, connector_catalog_entry, connector_catalog_result, connector_catalog_status, connector_connect_request, connector_connect_result, connector_continue_request, connector_disconnect_result, connector_mcp_status, connector_reconcile_request, connector_runtime_status, connector_status, connect_remote_session_params, connect_request, connect_result, content_exclusion_check_paths_request, content_exclusion_check_paths_result, content_exclusion_path_check, content_filter_mode, context_heaviest_message, copilot_api_token_auth_info, copilot_user_response, copilot_user_response_endpoints, copilot_user_response_quota_snapshots, copilot_user_response_quota_snapshots_chat, copilot_user_response_quota_snapshots_completions, copilot_user_response_quota_snapshots_premium_interactions, current_model, current_tool_metadata, debug_collect_logs_collected_entry, debug_collect_logs_destination, debug_collect_logs_entry, debug_collect_logs_entry_kind, debug_collect_logs_include, debug_collect_logs_redaction, debug_collect_logs_request, debug_collect_logs_result, debug_collect_logs_result_kind, debug_collect_logs_skipped_entry, debug_collect_logs_source, discovered_canvas, discovered_extension, discovered_extension_mode, discovered_extension_plugin, discovered_extensions, discovered_extensions_disable_request, discovered_extensions_enable_request, discovered_extension_source, discovered_hook, discovered_mcp_server, discovered_mcp_server_type, enqueue_command_params, enqueue_command_result, env_auth_info, event_log_read_request, event_log_release_interest_result, event_log_tail_result, event_log_types, events_agent_scope, events_cursor_status, events_read_direction, events_read_result, execute_command_params, execute_command_result, extension, extension_context_push_input, extension_launch_profile, extension_launch_provider_resolve_request, extension_launch_provider_resolve_result, extension_list, extensions_disable_request, extensions_enable_request, extension_source, extension_status, external_tool_result, external_tool_text_result_for_llm, external_tool_text_result_for_llm_binary_results_for_llm, external_tool_text_result_for_llm_binary_results_for_llm_type, external_tool_text_result_for_llm_content, external_tool_text_result_for_llm_content_audio, external_tool_text_result_for_llm_content_image, external_tool_text_result_for_llm_content_resource, external_tool_text_result_for_llm_content_resource_details, external_tool_text_result_for_llm_content_resource_link, external_tool_text_result_for_llm_content_resource_link_icon, external_tool_text_result_for_llm_content_resource_link_icon_theme, external_tool_text_result_for_llm_content_shell_exit, external_tool_text_result_for_llm_content_terminal, external_tool_text_result_for_llm_content_text, factory_abort_request, factory_ack_result, factory_agent_options, factory_agent_request, factory_agent_result, factory_agent_summary, factory_cancel_request, factory_current_phase, factory_declared_limits, factory_durable_operation, factory_execute_request, factory_execute_result, factory_get_run_progress_request, factory_get_run_request, factory_journal_get_request, factory_journal_get_result, factory_journal_put_request, factory_list_runs_request, factory_list_runs_result, factory_log_line, factory_log_line_kind, factory_log_request, factory_pause_checkpoint_action, factory_pause_checkpoint_request, factory_pause_checkpoint_result, factory_pause_info, factory_pause_request, factory_phase_observation, factory_phase_status, factory_progress_line, factory_progress_page, factory_resume_request, factory_resume_result, factory_run_consumed, factory_run_detail, factory_run_failure, factory_run_failure_kind, factory_run_limits, factory_run_request, factory_run_result, factory_run_status, factory_run_summary, factory_run_terminal, factory_tool_resume_request, factory_tool_run_options, factory_tool_run_request, filter_mapping, fleet_start_request, fleet_start_result, folder_trust_add_params, folder_trust_check_params, folder_trust_check_result, gh_cli_auth_info, git_hub_telemetry_client_info, git_hub_telemetry_event, git_hub_telemetry_notification, git_hub_token_acquire_reason, git_hub_token_acquire_request, git_hub_token_acquire_result, handle_pending_tool_call_request, handle_pending_tool_call_result, history_abort_manual_compaction_result, history_cancel_background_compaction_result, history_clear_context_request, history_clear_context_result, history_compact_context_window, history_compact_request, history_compact_result, history_file_restore_skip_reason, history_list_rewind_points_result, history_preview_rewind_request, history_preview_rewind_result, history_rewind_change_type, history_rewind_file_preview, history_rewind_mode, history_rewind_outcome, history_rewind_point, history_rewind_request, history_rewind_result, history_rewind_unavailable_reason, history_skipped_file_restore, history_summarize_for_handoff_result, history_truncate_request, history_truncate_result, hmac_auth_info, hook_invoke_request, hook_invoke_response, hook_origin, hooks_discover_request, hooks_discover_result, hook_type, installed_plugin, installed_plugin_info, installed_plugin_source, installed_plugin_source_git_hub, installed_plugin_source_local, installed_plugin_source_url, instruction_discovery_path, instruction_discovery_path_kind, instruction_discovery_path_list, instruction_discovery_path_location, instructions_discover_request, instructions_get_discovery_paths_request, instructions_get_sources_result, instruction_source, instruction_source_location, instruction_source_type, interrupt_main_turn_request, interrupt_main_turn_result, json_schema_response_format, llm_inference_headers, llm_inference_http_request_chunk_request, llm_inference_http_request_chunk_result, llm_inference_http_request_start_request, llm_inference_http_request_start_result, llm_inference_http_request_start_transport, llm_inference_http_response_chunk_error, llm_inference_http_response_chunk_request, llm_inference_http_response_chunk_result, llm_inference_http_response_start_request, llm_inference_http_response_start_result, llm_inference_set_provider_result, local_session_metadata_value, log_request, log_result, lsp_initialize_request, managed_mcp_server_config, managed_settings_read_result, managed_settings_resolved_data, marketplace_add_result, marketplace_browse_result, marketplace_info, marketplace_list_result, marketplace_plugin_info, marketplace_refresh_entry, marketplace_refresh_result, marketplace_remove_result, mcp_allowed_server, mcp_apps_call_tool_request, mcp_apps_diagnose_capability, mcp_apps_diagnose_request, mcp_apps_diagnose_result, mcp_apps_diagnose_server, mcp_apps_host_context, mcp_apps_host_context_details, mcp_apps_host_context_details_available_display_mode, mcp_apps_host_context_details_display_mode, mcp_apps_host_context_details_platform, mcp_apps_host_context_details_theme, mcp_apps_list_tools_request, mcp_apps_list_tools_result, mcp_apps_read_resource_request, mcp_apps_read_resource_result, mcp_apps_resource_content, mcp_apps_set_host_context_details, mcp_apps_set_host_context_details_available_display_mode, mcp_apps_set_host_context_details_display_mode, mcp_apps_set_host_context_details_platform, mcp_apps_set_host_context_details_theme, mcp_apps_set_host_context_request, mcp_cancel_sampling_execution_params, mcp_cancel_sampling_execution_result, mcp_config_add_request, mcp_config_disable_request, mcp_config_enable_request, mcp_config_list, mcp_config_remove_request, mcp_config_update_request, mcp_configure_git_hub_request, mcp_configure_git_hub_result, mcp_disable_request, mcp_discover_request, mcp_discover_result, mcp_elicitation_form_mode, mcp_enable_request, mcp_execute_sampling_params, mcp_execute_sampling_request, mcp_execute_sampling_result, mcp_failed_server, mcp_filtered_server, mcp_headers_handle_pending_headers_refresh_request, mcp_headers_handle_pending_headers_refresh_request_request, mcp_headers_handle_pending_headers_refresh_request_result, mcp_host_state, mcp_install_plan, mcp_is_server_running_request, mcp_is_server_running_result, mcp_list_tools_request, mcp_list_tools_result, mcp_oauth_authentication_state_changed_request, mcp_oauth_handle_pending_request, mcp_oauth_handle_pending_result, mcp_oauth_login_grant_type, mcp_oauth_login_request, mcp_oauth_login_result, mcp_oauth_pending_request_response, mcp_oauth_probe_needs_auth_reason, mcp_oauth_probe_request, mcp_oauth_probe_result, mcp_oauth_respond_request, mcp_oauth_respond_result, mcp_plan_configuration_change, mcp_plan_configuration_operation, mcp_plan_enum_value_type, mcp_plan_install_planned, mcp_plan_install_request, mcp_plan_install_result, mcp_plan_install_source, mcp_plan_install_source_candidate, mcp_plan_install_source_candidate_kind, mcp_plan_install_source_card, mcp_plan_install_source_card_kind, mcp_plan_package_install_method, mcp_plan_package_transport, mcp_plan_policy_decision, mcp_plan_policy_result, mcp_plan_policy_source, mcp_plan_provenance, mcp_plan_remote_install_method, mcp_plan_remote_transport, mcp_plan_required_value, mcp_plan_required_value_enum, mcp_plan_required_value_enum_kind, mcp_plan_required_value_scalar, mcp_plan_required_value_scalar_kind, mcp_plan_resource_identity, mcp_plan_scalar_value_type, mcp_plan_scope, mcp_plan_secret_placeholder, mcp_plan_secret_reference, mcp_plan_target, mcp_plan_transport_choice, mcp_plan_transport_choice_package, mcp_plan_transport_choice_remote, mcp_plan_value_category, mcp_register_external_client_request, mcp_reload_config, mcp_reload_with_config_request, mcp_remove_git_hub_result, mcp_resource, mcp_resource_annotations, mcp_resource_content, mcp_resource_icon, mcp_resources_list_request, mcp_resources_list_result, mcp_resources_list_templates_request, mcp_resources_list_templates_result, mcp_resources_read_request, mcp_resources_read_result, mcp_resource_template, mcp_restart_server_request, mcp_safe_for_telemetry, mcp_safe_for_telemetry_fields, mcp_sampling_execution_action, mcp_sampling_execution_result, mcp_serializable_server_config, mcp_server, mcp_server_auth_config, mcp_server_auth_config_redirect_port, mcp_server_card_embedded, mcp_server_card_embedded_kind, mcp_server_card_media_type, mcp_server_card_reference, mcp_server_card_url, mcp_server_card_url_kind, mcp_server_config, mcp_server_config_defer_tools, mcp_server_config_http, mcp_server_config_http_oauth_grant_type, mcp_server_config_http_type, mcp_server_config_memory, mcp_server_config_memory_type, mcp_server_config_stdio, mcp_server_config_stdio_type, mcp_server_failure_info, mcp_server_list, mcp_server_needs_auth_info, mcp_set_env_value_mode_details, mcp_set_env_value_mode_params, mcp_set_env_value_mode_result, mcp_source_file, mcp_source_plugin, mcp_source_ref, mcp_start_server_request, mcp_start_servers_result, mcp_stop_server_request, mcp_task_metadata, mcp_tools, mcp_tool_ui, mcp_tool_ui_visibility, mcp_unregister_external_client_request, memory_configuration, metadata_context_attribution_result, metadata_context_heaviest_messages_request, metadata_context_heaviest_messages_result, metadata_context_info_request, metadata_context_info_result, metadata_is_processing_result, metadata_recompute_context_tokens_request, metadata_recompute_context_tokens_result, metadata_record_context_change_request, metadata_record_context_change_result, metadata_set_working_directory_request, metadata_set_working_directory_result, metadata_snapshot_current_mode, metadata_snapshot_remote_metadata, metadata_snapshot_remote_metadata_repository, metadata_snapshot_remote_metadata_task_type, metadata_update_client_metadata_request, model, model_apply_startup_overlay_request, model_billing, model_billing_promo, model_billing_token_prices, model_billing_token_prices_long_context, model_capabilities, model_capabilities_limits, model_capabilities_limits_vision, model_capabilities_override, model_capabilities_override_limits, model_capabilities_override_limits_vision, model_capabilities_override_supports, model_capabilities_supports, model_list, model_list_request, model_message, model_picker_category, model_picker_persistence_request, model_picker_price_category, model_picker_settings_context, model_policy, model_policy_state, model_set_allowed_models_request, model_set_allowed_models_result, model_set_reasoning_effort_request, model_set_reasoning_effort_result, models_list_request, model_switch_auto_tier_request, model_switch_auto_tier_result, model_switch_auto_tier_status, model_switch_confirmation, model_switch_to_request, model_switch_to_result, model_warning_text, mode_set_request, mode_set_result, move_mcp_loading_to_background_result, named_provider_config, name_get_result, name_set_auto_request, name_set_auto_result, name_set_request, open_canvas_instance, options_update_additional_content_exclusion_policy, options_update_additional_content_exclusion_policy_rule, options_update_additional_content_exclusion_policy_rule_source, options_update_additional_content_exclusion_policy_scope, options_update_context_tier, options_update_env_value_mode, options_update_reasoning_summary, options_update_tool_filter_precedence, pending_permission_request, pending_permission_request_list, permission_decision, permission_decision_approved, permission_decision_approved_for_location, permission_decision_approved_for_session, permission_decision_approve_for_location, permission_decision_approve_for_location_approval, permission_decision_approve_for_location_approval_commands, permission_decision_approve_for_location_approval_custom_tool, permission_decision_approve_for_location_approval_extension_env_access, permission_decision_approve_for_location_approval_extension_management, permission_decision_approve_for_location_approval_extension_permission_access, permission_decision_approve_for_location_approval_factory, permission_decision_approve_for_location_approval_mcp, permission_decision_approve_for_location_approval_mcp_sampling, permission_decision_approve_for_location_approval_memory, permission_decision_approve_for_location_approval_read, permission_decision_approve_for_location_approval_write, permission_decision_approve_for_session, permission_decision_approve_for_session_approval, permission_decision_approve_for_session_approval_commands, permission_decision_approve_for_session_approval_custom_tool, permission_decision_approve_for_session_approval_extension_env_access, permission_decision_approve_for_session_approval_extension_management, permission_decision_approve_for_session_approval_extension_permission_access, permission_decision_approve_for_session_approval_factory, permission_decision_approve_for_session_approval_mcp, permission_decision_approve_for_session_approval_mcp_sampling, permission_decision_approve_for_session_approval_memory, permission_decision_approve_for_session_approval_read, permission_decision_approve_for_session_approval_write, permission_decision_approve_once, permission_decision_approve_permanently, permission_decision_cancelled, permission_decision_context, permission_decision_denied_by_content_exclusion_policy, permission_decision_denied_by_permission_request_hook, permission_decision_denied_by_rules, permission_decision_denied_interactively_by_user, permission_decision_denied_no_approval_rule_and_could_not_request_from_user, permission_decision_outcome, permission_decision_reject, permission_decision_request, permission_decision_surface, permission_decision_user_not_available, permission_location_add_tool_approval_params, permission_location_apply_params, permission_location_apply_result, permission_location_resolve_params, permission_location_resolve_result, permission_location_type, permission_mode_source, permission_paths_add_params, permission_paths_allowed_check_params, permission_paths_allowed_check_result, permission_paths_config, permission_paths_list, permission_paths_update_primary_params, permission_paths_workspace_check_params, permission_paths_workspace_check_result, permission_prompt_shown_notification, permission_request_result, permission_response_capability, permission_rules_set, permissions_configure_additional_content_exclusion_policy, permissions_configure_additional_content_exclusion_policy_rule, permissions_configure_additional_content_exclusion_policy_rule_source, permissions_configure_additional_content_exclusion_policy_scope, permissions_configure_params, permissions_configure_result, permissions_folder_trust_add_trusted_result, permissions_get_mode_request, permissions_get_mode_result, permissions_locations_add_tool_approval_details, permissions_locations_add_tool_approval_details_commands, permissions_locations_add_tool_approval_details_custom_tool, permissions_locations_add_tool_approval_details_extension_env_access, permissions_locations_add_tool_approval_details_extension_management, permissions_locations_add_tool_approval_details_extension_permission_access, permissions_locations_add_tool_approval_details_factory, permissions_locations_add_tool_approval_details_mcp, permissions_locations_add_tool_approval_details_mcp_sampling, permissions_locations_add_tool_approval_details_memory, permissions_locations_add_tool_approval_details_read, permissions_locations_add_tool_approval_details_write, permissions_locations_add_tool_approval_result, permissions_modify_rules_params, permissions_modify_rules_result, permissions_modify_rules_scope, permissions_notify_prompt_shown_result, permissions_paths_add_result, permissions_paths_list_request, permissions_paths_update_primary_result, permissions_pending_requests_request, permissions_reset_session_approvals_request, permissions_reset_session_approvals_result, permissions_set_approve_all_request, permissions_set_approve_all_result, permissions_set_approve_all_source, permissions_set_mode_request, permissions_set_mode_result, permissions_set_required_request, permissions_set_required_result, permissions_urls_set_unrestricted_mode_result, permission_urls_config, permission_urls_set_unrestricted_mode_params, ping_request, ping_result, plan_read_result, plan_read_sql_todos_result, plan_read_sql_todos_with_dependencies_result, plan_sql_todo_dependency, plan_sql_todos_row, plan_update_request, plugin, plugin_install_result, plugin_install_staging_mode, plugin_list, plugin_list_result, plugins_builtin_set_request, plugins_disable_request, plugins_enable_request, plugins_install_request, plugins_marketplaces_add_request, plugins_marketplaces_browse_request, plugins_marketplaces_refresh_request, plugins_marketplaces_remove_request, plugins_reload_request, plugins_uninstall_request, plugins_update_request, plugin_update_all_entry, plugin_update_all_result, plugin_update_result, protocol_append_mode, protocol_customize_mode, protocol_external_tool_defer, protocol_external_tool_definition, protocol_marker_section_override, protocol_replace_mode, protocol_section_override, protocol_static_section_action, protocol_static_section_override, protocol_system_message_append_config, protocol_system_message_config, protocol_system_message_customize_config, protocol_system_message_replace_config, provider_add_request, provider_add_result, provider_config, provider_config_azure, provider_config_transport, provider_config_type, provider_config_wire_api, provider_endpoint, provider_endpoint_transport, provider_endpoint_type, provider_endpoint_wire_api, provider_get_endpoint_request, provider_model_config, provider_session_token, provider_sync_request, provider_sync_result, provider_token_acquire_request, provider_token_acquire_result, push_attachment, push_attachment_blob, push_attachment_directory, push_attachment_file, push_attachment_file_line_range, push_attachment_git_hub_actions_job, push_attachment_git_hub_commit, push_attachment_git_hub_file, push_attachment_git_hub_file_diff, push_attachment_git_hub_file_diff_side, push_attachment_git_hub_reference, push_attachment_git_hub_reference_type, push_attachment_git_hub_release, push_attachment_git_hub_repository, push_attachment_git_hub_snippet, push_attachment_git_hub_tree_comparison, push_attachment_git_hub_tree_comparison_side, push_attachment_git_hub_url, push_attachment_selection, push_attachment_selection_details, push_attachment_selection_details_end, push_attachment_selection_details_start, push_git_hub_repo_ref, queue_append_steering_request, queue_begin_deferred_idle_drain_request, queue_begin_deferred_idle_drain_result, queue_consume_system_notifications_request, queued_command_handled, queued_command_not_handled, queued_command_result, queue_defer_session_idle_request, queue_duplicate_at_request, queue_duplicate_at_result, queue_enqueue_resume_pending_result, queue_finish_deferred_idle_drain_request, queue_finish_deferred_idle_drain_result, queue_has_pending_result, queue_insert_at_request, queue_insert_at_result, queue_insert_message, queue_move_item_request, queue_move_item_result, queue_pending_items, queue_pending_items_kind, queue_pending_items_result, queue_remove_at_request, queue_remove_at_result, queue_remove_most_recent_result, queue_send_now_request, queue_send_now_result, queue_set_drain_paused_request, queue_snapshot_result, queue_update_text_request, queue_update_text_result, queue_withdraw_message_request, register_event_interest_params, register_event_interest_result, release_event_interest_params, remote_control_config, remote_control_config_existing_mc_session, remote_control_status, remote_control_status_active, remote_control_status_connecting, remote_control_status_error, remote_control_status_off, remote_control_status_result, remote_control_stop_result, remote_control_transfer_result, remote_enable_request, remote_enable_result, remote_notify_steerable_changed_request, remote_notify_steerable_changed_result, remote_session_connection_result, remote_session_host_status, remote_session_metadata_repository, remote_session_metadata_task_type, remote_session_metadata_value, remote_session_mode, remote_session_repository, response_format, run_options, sandbox_config, sandbox_config_auth, sandbox_config_source, sandbox_config_user_policy, sandbox_config_user_policy_experimental, sandbox_config_user_policy_experimental_seatbelt, sandbox_config_user_policy_filesystem, sandbox_config_user_policy_network, sandbox_config_user_policy_network_proxy, sandbox_config_user_policy_seatbelt, sandbox_disable_for_session_request, sandbox_disable_for_session_result, sandbox_enforcement_status, sandbox_session_change, schedule_add_at_request, schedule_add_cron_request, schedule_add_request, schedule_add_result, schedule_add_self_paced_request, schedule_entry, schedule_has_self_paced_result, schedule_list, schedule_rearm_self_paced_request, schedule_stop_request, schedule_stop_result, secrets_add_filter_values_request, secrets_add_filter_values_result, send_agent_mode, send_attachments_to_message_params, send_message_item, send_messages_request, send_messages_result, send_mode, send_request, send_result, send_system_notification_request, server_agent_list, server_instruction_source_list, server_skill, server_skill_list, session_activity, session_agent_list_request, session_auth_login_request, session_auth_logout_user_request, session_auth_status, session_auth_switch_request, session_bulk_delete_result, session_cancel_all_background_agents_result, session_capability, session_commands_list_request, session_completion_item, session_context, session_context_host_type, session_enrich_metadata_result, session_factory_pause_at_checkpoint_result, session_fs_append_file_request, session_fs_error, session_fs_error_code, session_fs_exists_request, session_fs_exists_result, session_fs_mkdir_request, session_fs_readdir_request, session_fs_readdir_result, session_fs_readdir_with_types_entry, session_fs_readdir_with_types_entry_type, session_fs_readdir_with_types_request, session_fs_readdir_with_types_result, session_fs_read_file_request, session_fs_read_file_result, session_fs_rename_request, session_fs_rm_request, session_fs_set_provider_capabilities, session_fs_set_provider_conventions, session_fs_set_provider_request, session_fs_set_provider_result, session_fs_sqlite_exists_request, session_fs_sqlite_exists_result, session_fs_sqlite_query_request, session_fs_sqlite_query_result, session_fs_sqlite_query_type, session_fs_sqlite_transaction_error, session_fs_sqlite_transaction_error_class, session_fs_sqlite_transaction_request, session_fs_sqlite_transaction_result, session_fs_sqlite_transaction_statement, session_fs_stat_request, session_fs_stat_result, session_fs_write_file_request, session_git_hub_auth_get_all_auth_available_result, session_git_hub_auth_logout_result, session_git_hub_auth_logout_user_result, session_history_compact_request, session_installed_plugin, session_installed_plugin_source, session_installed_plugin_source_git_hub, session_installed_plugin_source_local, session_installed_plugin_source_url, session_limit_prediction_baseline_data, session_limit_prediction_client_type, session_limit_prediction_details, session_limit_prediction_predict_request, session_limit_prediction_request, session_limit_prediction_result, session_limit_prediction_source, session_limit_prediction_tier, session_limit_prediction_tier_option, session_limit_prediction_unavailable_reason, session_list, session_list_entry, session_list_filter, session_load_deferred_repo_hooks_result, session_log_level, session_managed_permissions, session_managed_settings, session_mcp_apps_call_tool_result, session_metadata_snapshot, session_mode, session_model_list, session_model_list_request, session_model_price_category, session_open_options, session_open_options_additional_content_exclusion_policy, session_open_options_additional_content_exclusion_policy_rule, session_open_options_additional_content_exclusion_policy_rule_source, session_open_options_additional_content_exclusion_policy_scope, session_open_options_env_value_mode, session_open_options_reasoning_summary, session_open_params, session_open_result, session_plugins_disable_request, session_plugins_enable_request, session_plugins_install_request, session_plugins_marketplaces_refresh_request, session_plugins_reload_request, session_provider_get_endpoint_request, session_prune_result, sessions_bulk_delete_request, sessions_check_in_use_request, sessions_check_in_use_result, sessions_client_metadata_entry, sessions_close_request, sessions_close_result, sessions_delete_request, sessions_enrich_metadata_request, session_set_credentials_params, session_set_credentials_result, session_settings_built_in_tool_availability_snapshot, session_settings_evaluate_predicate_request, session_settings_evaluate_predicate_result, session_settings_job_snapshot, session_settings_model_snapshot, session_settings_online_evaluation_snapshot, session_settings_predicate_name, session_settings_repo_snapshot, session_settings_snapshot, session_settings_validation_snapshot, sessions_find_by_prefix_request, sessions_find_by_prefix_result, sessions_find_by_task_id_request, sessions_find_by_task_id_result, sessions_fork_request, sessions_fork_result, sessions_get_board_entry_count_request, sessions_get_board_entry_count_result, sessions_get_client_metadata_request, sessions_get_client_metadata_result, sessions_get_event_file_path_request, sessions_get_event_file_path_result, sessions_get_last_for_context_request, sessions_get_last_for_context_result, sessions_get_metadata_request, sessions_get_metadata_result, sessions_get_persisted_remote_steerable_request, sessions_get_persisted_remote_steerable_result, session_sizes, sessions_list_non_empty_session_ids_request, sessions_list_non_empty_session_ids_result, sessions_list_request, sessions_load_deferred_repo_hooks_request, sessions_open_attach, sessions_open_cloud, sessions_open_create, sessions_open_handoff, sessions_open_handoff_task_type, sessions_open_progress, sessions_open_progress_status, sessions_open_progress_step, sessions_open_remote, sessions_open_resume, sessions_open_resume_last, sessions_open_status, session_source, sessions_prune_old_request, sessions_read_persisted_events_request, sessions_release_lock_request, sessions_release_lock_result, sessions_reload_plugin_hooks_request, sessions_reload_plugin_hooks_result, sessions_save_request, sessions_save_result, sessions_set_additional_plugins_request, sessions_set_additional_plugins_result, sessions_set_remote_control_steering_request, sessions_start_remote_control_request, sessions_stop_remote_control_request, sessions_transfer_remote_control_request, session_telemetry_engagement, session_update_options_params, session_update_options_result, session_visibility_status, session_workflow_pause_at_checkpoint_result, session_working_directory_context, session_working_directory_context_host_type, settable_auth_info, settable_token_auth_info, shell_cancel_user_requested_request, shell_credentials, shell_exec_request, shell_exec_result, shell_execute_user_requested_request, shell_init_profile, shell_init_script, shell_init_script_shell, shell_kill_request, shell_kill_result, shell_kill_signal, shell_options, shutdown_request, skill, skill_discovery_path, skill_discovery_path_list, skill_discovery_scope, skill_list, skill_provider_descriptor, skill_provider_list_request, skill_provider_list_result, skill_provider_read_request, skill_provider_read_result, skills_config_set_disabled_skills_request, skills_config_set_skill_disabled_request, skills_disable_request, skills_discover_request, skills_enable_request, skills_get_discovery_paths_request, skills_get_invoked_result, skills_invoked_skill, skills_load_diagnostics, slash_command_add_timeline_entry_result, slash_command_agent_prompt_result, slash_command_completed_result, slash_command_info, slash_command_input, slash_command_input_choice, slash_command_input_completion, slash_command_invocation_result, slash_command_kind, slash_command_model_picker_dialog, slash_command_select_subcommand_option, slash_command_select_subcommand_result, slash_command_set_model_result, slash_command_set_plan_model_result, slash_command_show_dialog_result, slash_command_text_result, slash_command_timeline_entry, subagent_settings_entry, subagent_settings_entry_context_tier, system_message_block, task_agent_info, task_agent_progress, task_client_active_status, task_client_execution_mode, task_client_info, task_client_owner, task_client_owner_kind, task_client_owner_presence, task_client_progress, task_client_status, task_client_type, task_client_update, task_complete_data, task_completion_decision, task_execution_mode, task_info, task_kind, task_list, task_progress_line, tasks_cancel_request, tasks_cancel_result, tasks_get_current_promotable_result, tasks_get_progress_request, tasks_get_progress_result, task_shell_info, task_shell_info_attachment_mode, task_shell_progress, tasks_promote_current_to_background_result, tasks_promote_to_background_request, tasks_promote_to_background_result, tasks_refresh_result, tasks_register_request, tasks_register_result, tasks_remove_request, tasks_remove_result, tasks_send_message_request, tasks_send_message_result, tasks_start_agent_request, tasks_start_agent_result, task_status, tasks_update_request, tasks_update_result, tasks_wait_for_pending_result, telemetry_set_feature_overrides_request, token_auth_info, token_provider_auth_info, tool, tool_list, tool_result, tool_result_expanded, tool_result_new_message, tool_result_type, tools_execute_request, tools_get_builtin_descriptors_request, tools_get_builtin_descriptors_result, tools_get_current_metadata_result, tools_initialize_and_validate_result, tools_list_request, tools_set_request, tools_set_result, tools_shell_descriptor_config, tools_task_complete_event_data_request, tools_update_subagent_settings_result, ui_auto_mode_switch_response, ui_elicitation_array_any_of_field, ui_elicitation_array_any_of_field_items, ui_elicitation_array_any_of_field_items_any_of, ui_elicitation_array_enum_field, ui_elicitation_array_enum_field_items, ui_elicitation_field_value, ui_elicitation_request, ui_elicitation_response, ui_elicitation_response_action, ui_elicitation_response_content, ui_elicitation_result, ui_elicitation_schema, ui_elicitation_schema_property, ui_elicitation_schema_property_boolean, ui_elicitation_schema_property_number, ui_elicitation_schema_property_number_type, ui_elicitation_schema_property_string, ui_elicitation_schema_property_string_format, ui_elicitation_string_enum_field, ui_elicitation_string_one_of_field, ui_elicitation_string_one_of_field_one_of, ui_ephemeral_query_request, ui_ephemeral_query_result, ui_exit_plan_mode_action, ui_exit_plan_mode_response, ui_handle_pending_auto_mode_switch_request, ui_handle_pending_elicitation_request, ui_handle_pending_exit_plan_mode_request, ui_handle_pending_result, ui_handle_pending_sampling_request, ui_handle_pending_sampling_response, ui_handle_pending_session_limits_exhausted_request, ui_handle_pending_user_input_request, ui_register_direct_auto_mode_switch_handler_result, ui_session_limits_exhausted_response, ui_session_limits_exhausted_response_action, ui_unregister_direct_auto_mode_switch_handler_request, ui_unregister_direct_auto_mode_switch_handler_result, ui_user_input_response, unsupported_enqueue_command_result, update_subagent_settings_request, usage_get_metrics_result, usage_metrics_agent_metric, usage_metrics_code_changes, usage_metrics_model_metric, usage_metrics_model_metric_requests, usage_metrics_model_metric_token_detail, usage_metrics_model_metric_usage, usage_metrics_token_detail, user_auth_info, user_requested_shell_command_result, user_setting_metadata, user_settings_get_result, user_settings_set_request, user_settings_set_result, visibility_get_result, visibility_set_request, visibility_set_result, workflow_abort_request, workflow_ack_result, workflow_agent_options, workflow_agent_request, workflow_agent_result, workflow_agent_summary, workflow_cancel_request, workflow_current_phase, workflow_declared_limits, workflow_durable_operation, workflow_execute_request, workflow_execute_result, workflow_get_run_progress_request, workflow_get_run_request, workflow_journal_get_request, workflow_journal_get_result, workflow_journal_put_request, workflow_list_runs_request, workflow_list_runs_result, workflow_log_line, workflow_log_line_kind, workflow_log_request, workflow_pause_checkpoint_action, workflow_pause_checkpoint_request, workflow_pause_checkpoint_result, workflow_pause_info, workflow_pause_request, workflow_phase_observation, workflow_phase_status, workflow_progress_line, workflow_progress_page, workflow_resume_request, workflow_resume_result, workflow_run_consumed, workflow_run_detail, workflow_run_failure, workflow_run_failure_kind, workflow_run_limits, workflow_run_options, workflow_run_request, workflow_run_result, workflow_run_status, workflow_run_summary, workflow_run_terminal, workflow_tool_resume_request, workflow_tool_run_options, workflow_tool_run_request, workspace_diff_file_change, workspace_diff_file_change_type, workspace_diff_mode, workspace_diff_result, workspaces_add_summary_request, workspaces_add_summary_result, workspaces_autopilot_objective_exists_result, workspaces_checkpoints, workspaces_create_directory_request, workspaces_create_file_request, workspaces_delete_autopilot_objective_result, workspaces_diff_request, workspaces_ensure_request, workspaces_get_workspace_result, workspaces_list_checkpoints_result, workspaces_list_files_result, workspaces_read_autopilot_objective_result, workspaces_read_checkpoint_request, workspaces_read_checkpoint_result, workspaces_read_file_request, workspaces_read_file_result, workspaces_remove_path_request, workspaces_rename_path_request, workspaces_save_large_paste_request, workspaces_save_large_paste_result, workspaces_stat_file_request, workspaces_stat_file_result, workspaces_truncate_summaries_request, workspace_summary_host_type, workspaces_update_metadata_request, workspaces_workspace_details_host_type, workspaces_write_autopilot_objective_request, workspaces_write_autopilot_objective_result, session_auth_info_result, session_context_attribution, session_context_info, subagent_settings, task_progress, workspace_summary)
+        return RPC(abort_request, abort_result, accepted_enqueue_command_result, account_all_users, account_get_all_users_result, account_get_current_auth_result, account_get_quota_request, account_get_quota_result, account_login_request, account_login_result, account_logout_request, account_logout_result, account_quota_snapshot, adaptive_thinking_support, agent_discovery_path, agent_discovery_path_list, agent_discovery_path_scope, agent_get_current_result, agent_info, agent_info_source, agent_list, agent_list_request, agent_registry_live_target_entry, agent_registry_live_target_entry_attention_kind, agent_registry_live_target_entry_kind, agent_registry_live_target_entry_last_terminal_event, agent_registry_live_target_entry_status, agent_registry_log_capture, agent_registry_log_capture_open_error_reason, agent_registry_spawn_error, agent_registry_spawn_permission_mode, agent_registry_spawn_registry_timeout, agent_registry_spawn_request, agent_registry_spawn_result, agent_registry_spawn_spawned, agent_registry_spawn_validation_error, agent_registry_spawn_validation_error_field, agent_registry_spawn_validation_error_reason, agent_reload_result, agents_discover_request, agent_select_request, agent_select_result, agent_set_prompt_request, agents_get_discovery_paths_request, api_key_auth_info, auth_identity, auth_info, auth_info_type, auth_validation_error, auth_validation_errors, autopilot_objective_credit_limit, autopilot_objective_get_state_result, autopilot_objective_state, autopilot_objective_status, built_in_model_catalog, built_in_model_catalog_entry, builtin_tool_descriptor, builtin_tool_format, builtin_tool_format_type, builtin_tool_input_schema, builtin_tool_input_schema_type, builtin_tool_safe_for_telemetry, builtin_tool_safe_telemetry_fields, cancel_user_requested_shell_command_result, canvas_action, canvas_action_invoke_request, canvas_action_invoke_result, canvas_close_request, canvas_host_context, canvas_host_context_capabilities, canvas_json_schema, canvas_list, canvas_list_open_result, canvas_open_request, canvas_provider_close_request, canvas_provider_invoke_action_request, canvas_provider_open_request, canvas_provider_open_result, canvas_provider_register_request, canvas_provider_unregister_request, canvas_session_context, capi_session_options, card_digest, card_digest_algorithm, card_digest_value, catalog_agent_plugin_candidate, catalog_agent_plugin_candidate_kind, catalog_agent_plugin_candidate_provenance, catalog_agent_plugin_compatibility_tag, catalog_agent_plugin_media_type, catalog_ai_skill_candidate, catalog_ai_skill_candidate_kind, catalog_ai_skill_candidate_provenance, catalog_ai_skill_installability, catalog_ai_skill_media_type, catalog_authentication_required_error, catalog_authentication_required_reason, catalog_candidate, catalog_candidate_kind, catalog_candidate_source, catalog_candidate_source_embedded, catalog_candidate_source_url, catalog_capability, catalog_capability_id, catalog_client_contract, catalog_contract_violation_error, catalog_contract_violation_reason, catalog_handle_rejected_error, catalog_handle_rejection_reason, catalog_handle_type, catalog_invalid_request_error, catalog_invalid_request_field, catalog_malformed_card_error, catalog_malformed_card_reason, catalog_mcp_server_candidate, catalog_mcp_server_candidate_kind, catalog_mcp_server_candidate_provenance, catalog_mcp_server_installability, catalog_media_type, catalog_negotiated_contract, catalog_negotiation_refused_error, catalog_negotiation_refused_reason, catalog_network_failure_error, catalog_network_failure_reason, catalog_not_installable_error, catalog_not_installable_reason, catalog_plugin_repository_source, catalog_policy_rejected_error, catalog_resource_identity, catalog_resource_version, catalog_search_page, catalog_search_pagination, catalog_search_request, catalog_search_result, catalog_search_succeeded, catalog_search_total_count_relation, catalog_selection_cancelled, catalog_selection_decision, catalog_selection_declined, catalog_selection_foreign, catalog_selection_invalid, catalog_selection_replayed, catalog_selection_request, catalog_selection_result, catalog_selection_selected, catalog_selection_stale, catalog_selection_timed_out, catalog_selection_wrong_kind, catalog_trust_eligibility, catalog_trust_provenance, catalog_trust_snapshot, catalog_trust_snapshot_absent, catalog_trust_snapshot_absent_status, catalog_trust_snapshot_current, catalog_trust_snapshot_current_status, catalog_trust_snapshot_downgraded, catalog_trust_snapshot_downgraded_status, catalog_trust_snapshot_malformed, catalog_trust_snapshot_malformed_status, catalog_trust_snapshot_revoked, catalog_trust_snapshot_revoked_status, catalog_trust_snapshot_schema_version, catalog_trust_snapshot_stale, catalog_trust_snapshot_stale_status, catalog_trust_snapshot_unsupported, catalog_trust_snapshot_unsupported_status, catalog_trust_source, catalog_trust_tier, catalog_unavailable_error, catalog_unavailable_reason, catalog_unavailable_transport_error, catalog_unavailable_transport_reason, catalog_unsafe_retrieval_error, catalog_unsafe_retrieval_reason, catalog_unsupported_kind_error, client_metadata, client_task_cancel_reason, client_task_cancel_request, client_task_cancel_result, command_list, commands_finalize_invocation_effect_request, commands_finalize_invocation_effect_result, commands_handle_pending_command_request, commands_handle_pending_command_result, commands_invocation_effect_outcome, commands_invocation_origin, commands_invoke_request, commands_list_request, commands_respond_to_queued_command_request, commands_respond_to_queued_command_result, completions_get_trigger_characters_result, completions_request_request, completions_request_result, configure_session_extensions_params, connect_client_info, connected_remote_session_metadata, connected_remote_session_metadata_kind, connected_remote_session_metadata_repository, connector_account_request, connector_authorization_requirement, connector_authorization_scope, connector_availability, connector_capabilities, connector_catalog_entry, connector_catalog_result, connector_catalog_status, connector_connect_request, connector_connect_result, connector_continue_request, connector_disconnect_result, connector_mcp_status, connector_reconcile_request, connector_runtime_status, connector_status, connect_remote_session_params, connect_request, connect_result, content_exclusion_check_paths_request, content_exclusion_check_paths_result, content_exclusion_path_check, content_filter_mode, context_heaviest_message, copilot_api_token_auth_info, copilot_user_response, copilot_user_response_endpoints, copilot_user_response_quota_snapshots, copilot_user_response_quota_snapshots_chat, copilot_user_response_quota_snapshots_completions, copilot_user_response_quota_snapshots_premium_interactions, current_model, current_tool_metadata, debug_collect_logs_collected_entry, debug_collect_logs_destination, debug_collect_logs_entry, debug_collect_logs_entry_kind, debug_collect_logs_include, debug_collect_logs_redaction, debug_collect_logs_request, debug_collect_logs_result, debug_collect_logs_result_kind, debug_collect_logs_skipped_entry, debug_collect_logs_source, diagnostic_cursor_status, diagnostic_entry, diagnostic_log_level, diagnostics_configuration, diagnostics_configure_request, diagnostic_severity, diagnostic_source, diagnostic_sources_configuration, diagnostics_read_request, diagnostics_read_result, discovered_canvas, discovered_extension, discovered_extension_mode, discovered_extension_plugin, discovered_extensions, discovered_extensions_disable_request, discovered_extensions_enable_request, discovered_extension_source, discovered_hook, discovered_mcp_server, discovered_mcp_server_type, enqueue_command_params, enqueue_command_result, env_auth_info, event_log_read_request, event_log_release_interest_result, event_log_tail_result, event_log_types, events_agent_scope, events_cursor_status, events_read_direction, events_read_result, execute_command_params, execute_command_result, extension, extension_context_push_input, extension_launch_profile, extension_launch_provider_resolve_request, extension_launch_provider_resolve_result, extension_list, extensions_disable_request, extensions_enable_request, extension_source, extension_status, external_tool_result, external_tool_text_result_for_llm, external_tool_text_result_for_llm_binary_results_for_llm, external_tool_text_result_for_llm_binary_results_for_llm_type, external_tool_text_result_for_llm_content, external_tool_text_result_for_llm_content_audio, external_tool_text_result_for_llm_content_image, external_tool_text_result_for_llm_content_resource, external_tool_text_result_for_llm_content_resource_details, external_tool_text_result_for_llm_content_resource_link, external_tool_text_result_for_llm_content_resource_link_icon, external_tool_text_result_for_llm_content_resource_link_icon_theme, external_tool_text_result_for_llm_content_shell_exit, external_tool_text_result_for_llm_content_terminal, external_tool_text_result_for_llm_content_text, factory_abort_request, factory_ack_result, factory_agent_options, factory_agent_request, factory_agent_result, factory_agent_summary, factory_cancel_request, factory_current_phase, factory_declared_limits, factory_durable_operation, factory_execute_request, factory_execute_result, factory_get_run_progress_request, factory_get_run_request, factory_journal_get_request, factory_journal_get_result, factory_journal_put_request, factory_list_runs_request, factory_list_runs_result, factory_log_line, factory_log_line_kind, factory_log_request, factory_pause_checkpoint_action, factory_pause_checkpoint_request, factory_pause_checkpoint_result, factory_pause_info, factory_pause_request, factory_phase_observation, factory_phase_status, factory_progress_line, factory_progress_page, factory_resume_request, factory_resume_result, factory_run_consumed, factory_run_detail, factory_run_failure, factory_run_failure_kind, factory_run_limits, factory_run_request, factory_run_result, factory_run_status, factory_run_summary, factory_run_terminal, factory_tool_resume_request, factory_tool_run_options, factory_tool_run_request, filter_mapping, fleet_start_request, fleet_start_result, folder_trust_add_params, folder_trust_check_params, folder_trust_check_result, gh_cli_auth_info, git_hub_telemetry_client_info, git_hub_telemetry_event, git_hub_telemetry_notification, git_hub_token_acquire_reason, git_hub_token_acquire_request, git_hub_token_acquire_result, handle_pending_tool_call_request, handle_pending_tool_call_result, history_abort_manual_compaction_result, history_cancel_background_compaction_result, history_clear_context_request, history_clear_context_result, history_compact_context_window, history_compact_request, history_compact_result, history_file_restore_skip_reason, history_list_rewind_points_result, history_preview_rewind_request, history_preview_rewind_result, history_rewind_change_type, history_rewind_file_preview, history_rewind_mode, history_rewind_outcome, history_rewind_point, history_rewind_request, history_rewind_result, history_rewind_unavailable_reason, history_skipped_file_restore, history_summarize_for_handoff_result, history_truncate_request, history_truncate_result, hmac_auth_info, hook_invoke_request, hook_invoke_response, hook_origin, hooks_discover_request, hooks_discover_result, hook_type, installed_plugin, installed_plugin_info, installed_plugin_source, installed_plugin_source_git_hub, installed_plugin_source_local, installed_plugin_source_url, instruction_discovery_path, instruction_discovery_path_kind, instruction_discovery_path_list, instruction_discovery_path_location, instructions_discover_request, instructions_get_discovery_paths_request, instructions_get_sources_result, instruction_source, instruction_source_location, instruction_source_type, interrupt_main_turn_request, interrupt_main_turn_result, json_schema_response_format, llm_inference_headers, llm_inference_http_request_chunk_request, llm_inference_http_request_chunk_result, llm_inference_http_request_start_request, llm_inference_http_request_start_result, llm_inference_http_request_start_transport, llm_inference_http_response_chunk_error, llm_inference_http_response_chunk_request, llm_inference_http_response_chunk_result, llm_inference_http_response_start_request, llm_inference_http_response_start_result, llm_inference_set_provider_result, local_session_metadata_value, log_request, log_result, lsp_initialize_request, managed_mcp_server_config, managed_settings_read_result, managed_settings_resolved_data, marketplace_add_result, marketplace_browse_result, marketplace_info, marketplace_list_result, marketplace_plugin_info, marketplace_refresh_entry, marketplace_refresh_result, marketplace_remove_result, mcp_allowed_server, mcp_apps_call_tool_request, mcp_apps_diagnose_capability, mcp_apps_diagnose_request, mcp_apps_diagnose_result, mcp_apps_diagnose_server, mcp_apps_host_context, mcp_apps_host_context_details, mcp_apps_host_context_details_available_display_mode, mcp_apps_host_context_details_display_mode, mcp_apps_host_context_details_platform, mcp_apps_host_context_details_theme, mcp_apps_list_tools_request, mcp_apps_list_tools_result, mcp_apps_read_resource_request, mcp_apps_read_resource_result, mcp_apps_resource_content, mcp_apps_set_host_context_details, mcp_apps_set_host_context_details_available_display_mode, mcp_apps_set_host_context_details_display_mode, mcp_apps_set_host_context_details_platform, mcp_apps_set_host_context_details_theme, mcp_apps_set_host_context_request, mcp_cancel_sampling_execution_params, mcp_cancel_sampling_execution_result, mcp_config_add_request, mcp_config_disable_request, mcp_config_enable_request, mcp_config_list, mcp_config_remove_request, mcp_config_update_request, mcp_configure_git_hub_request, mcp_configure_git_hub_result, mcp_diagnostic_details, mcp_diagnostic_direction, mcp_diagnostic_kind, mcp_diagnostic_source_configuration, mcp_disable_request, mcp_discover_request, mcp_discover_result, mcp_elicitation_form_mode, mcp_enable_request, mcp_execute_sampling_params, mcp_execute_sampling_request, mcp_execute_sampling_result, mcp_failed_server, mcp_filtered_server, mcp_headers_handle_pending_headers_refresh_request, mcp_headers_handle_pending_headers_refresh_request_request, mcp_headers_handle_pending_headers_refresh_request_result, mcp_host_state, mcp_install_plan, mcp_is_server_running_request, mcp_is_server_running_result, mcp_list_tools_request, mcp_list_tools_result, mcp_oauth_authentication_state_changed_request, mcp_oauth_handle_pending_request, mcp_oauth_handle_pending_result, mcp_oauth_login_grant_type, mcp_oauth_login_request, mcp_oauth_login_result, mcp_oauth_pending_request_response, mcp_oauth_probe_needs_auth_reason, mcp_oauth_probe_request, mcp_oauth_probe_result, mcp_oauth_respond_request, mcp_oauth_respond_result, mcp_plan_configuration_change, mcp_plan_configuration_operation, mcp_plan_enum_value_type, mcp_plan_install_planned, mcp_plan_install_request, mcp_plan_install_result, mcp_plan_install_source, mcp_plan_install_source_candidate, mcp_plan_install_source_candidate_kind, mcp_plan_install_source_card, mcp_plan_install_source_card_kind, mcp_plan_package_install_method, mcp_plan_package_transport, mcp_plan_policy_decision, mcp_plan_policy_result, mcp_plan_policy_source, mcp_plan_provenance, mcp_plan_remote_install_method, mcp_plan_remote_transport, mcp_plan_required_value, mcp_plan_required_value_enum, mcp_plan_required_value_enum_kind, mcp_plan_required_value_scalar, mcp_plan_required_value_scalar_kind, mcp_plan_resource_identity, mcp_plan_scalar_value_type, mcp_plan_scope, mcp_plan_secret_placeholder, mcp_plan_secret_reference, mcp_plan_target, mcp_plan_transport_choice, mcp_plan_transport_choice_package, mcp_plan_transport_choice_remote, mcp_plan_value_category, mcp_register_external_client_request, mcp_reload_config, mcp_reload_with_config_request, mcp_remove_git_hub_result, mcp_resource, mcp_resource_annotations, mcp_resource_content, mcp_resource_icon, mcp_resources_list_request, mcp_resources_list_result, mcp_resources_list_templates_request, mcp_resources_list_templates_result, mcp_resources_read_request, mcp_resources_read_result, mcp_resource_template, mcp_restart_server_request, mcp_safe_for_telemetry, mcp_safe_for_telemetry_fields, mcp_sampling_execution_action, mcp_sampling_execution_result, mcp_serializable_server_config, mcp_server, mcp_server_auth_config, mcp_server_auth_config_redirect_port, mcp_server_card_embedded, mcp_server_card_embedded_kind, mcp_server_card_media_type, mcp_server_card_reference, mcp_server_card_url, mcp_server_card_url_kind, mcp_server_config, mcp_server_config_defer_tools, mcp_server_config_http, mcp_server_config_http_oauth_grant_type, mcp_server_config_http_type, mcp_server_config_memory, mcp_server_config_memory_type, mcp_server_config_stdio, mcp_server_config_stdio_type, mcp_server_failure_info, mcp_server_list, mcp_server_needs_auth_info, mcp_set_env_value_mode_details, mcp_set_env_value_mode_params, mcp_set_env_value_mode_result, mcp_source_file, mcp_source_plugin, mcp_source_ref, mcp_start_server_request, mcp_start_servers_result, mcp_stop_server_request, mcp_task_metadata, mcp_tools, mcp_tool_ui, mcp_tool_ui_visibility, mcp_unregister_external_client_request, memory_configuration, metadata_context_attribution_result, metadata_context_heaviest_messages_request, metadata_context_heaviest_messages_result, metadata_context_info_request, metadata_context_info_result, metadata_is_processing_result, metadata_recompute_context_tokens_request, metadata_recompute_context_tokens_result, metadata_record_context_change_request, metadata_record_context_change_result, metadata_set_working_directory_request, metadata_set_working_directory_result, metadata_snapshot_current_mode, metadata_snapshot_remote_metadata, metadata_snapshot_remote_metadata_repository, metadata_snapshot_remote_metadata_task_type, metadata_update_client_metadata_request, model, model_apply_startup_overlay_request, model_billing, model_billing_promo, model_billing_token_prices, model_billing_token_prices_long_context, model_capabilities, model_capabilities_limits, model_capabilities_limits_vision, model_capabilities_override, model_capabilities_override_limits, model_capabilities_override_limits_vision, model_capabilities_override_supports, model_capabilities_supports, model_list, model_list_request, model_message, model_picker_category, model_picker_persistence_request, model_picker_price_category, model_picker_settings_context, model_policy, model_policy_state, model_set_allowed_models_request, model_set_allowed_models_result, model_set_reasoning_effort_request, model_set_reasoning_effort_result, models_list_request, model_switch_auto_tier_request, model_switch_auto_tier_result, model_switch_auto_tier_status, model_switch_confirmation, model_switch_to_request, model_switch_to_result, model_warning_text, mode_set_request, mode_set_result, move_mcp_loading_to_background_result, named_provider_config, name_get_result, name_set_auto_request, name_set_auto_result, name_set_request, open_canvas_instance, options_update_additional_content_exclusion_policy, options_update_additional_content_exclusion_policy_rule, options_update_additional_content_exclusion_policy_rule_source, options_update_additional_content_exclusion_policy_scope, options_update_context_tier, options_update_env_value_mode, options_update_reasoning_summary, options_update_tool_filter_precedence, pending_permission_request, pending_permission_request_list, permission_decision, permission_decision_approved, permission_decision_approved_for_location, permission_decision_approved_for_session, permission_decision_approve_for_location, permission_decision_approve_for_location_approval, permission_decision_approve_for_location_approval_commands, permission_decision_approve_for_location_approval_custom_tool, permission_decision_approve_for_location_approval_extension_env_access, permission_decision_approve_for_location_approval_extension_management, permission_decision_approve_for_location_approval_extension_permission_access, permission_decision_approve_for_location_approval_factory, permission_decision_approve_for_location_approval_mcp, permission_decision_approve_for_location_approval_mcp_sampling, permission_decision_approve_for_location_approval_memory, permission_decision_approve_for_location_approval_read, permission_decision_approve_for_location_approval_write, permission_decision_approve_for_session, permission_decision_approve_for_session_approval, permission_decision_approve_for_session_approval_commands, permission_decision_approve_for_session_approval_custom_tool, permission_decision_approve_for_session_approval_extension_env_access, permission_decision_approve_for_session_approval_extension_management, permission_decision_approve_for_session_approval_extension_permission_access, permission_decision_approve_for_session_approval_factory, permission_decision_approve_for_session_approval_mcp, permission_decision_approve_for_session_approval_mcp_sampling, permission_decision_approve_for_session_approval_memory, permission_decision_approve_for_session_approval_read, permission_decision_approve_for_session_approval_write, permission_decision_approve_once, permission_decision_approve_permanently, permission_decision_cancelled, permission_decision_context, permission_decision_denied_by_content_exclusion_policy, permission_decision_denied_by_permission_request_hook, permission_decision_denied_by_rules, permission_decision_denied_interactively_by_user, permission_decision_denied_no_approval_rule_and_could_not_request_from_user, permission_decision_outcome, permission_decision_reject, permission_decision_request, permission_decision_surface, permission_decision_user_not_available, permission_location_add_tool_approval_params, permission_location_apply_params, permission_location_apply_result, permission_location_resolve_params, permission_location_resolve_result, permission_location_type, permission_mode_source, permission_paths_add_params, permission_paths_allowed_check_params, permission_paths_allowed_check_result, permission_paths_config, permission_paths_list, permission_paths_update_primary_params, permission_paths_workspace_check_params, permission_paths_workspace_check_result, permission_prompt_shown_notification, permission_request_result, permission_response_capability, permission_rules_set, permissions_configure_additional_content_exclusion_policy, permissions_configure_additional_content_exclusion_policy_rule, permissions_configure_additional_content_exclusion_policy_rule_source, permissions_configure_additional_content_exclusion_policy_scope, permissions_configure_params, permissions_configure_result, permissions_folder_trust_add_trusted_result, permissions_get_mode_request, permissions_get_mode_result, permissions_locations_add_tool_approval_details, permissions_locations_add_tool_approval_details_commands, permissions_locations_add_tool_approval_details_custom_tool, permissions_locations_add_tool_approval_details_extension_env_access, permissions_locations_add_tool_approval_details_extension_management, permissions_locations_add_tool_approval_details_extension_permission_access, permissions_locations_add_tool_approval_details_factory, permissions_locations_add_tool_approval_details_mcp, permissions_locations_add_tool_approval_details_mcp_sampling, permissions_locations_add_tool_approval_details_memory, permissions_locations_add_tool_approval_details_read, permissions_locations_add_tool_approval_details_write, permissions_locations_add_tool_approval_result, permissions_modify_rules_params, permissions_modify_rules_result, permissions_modify_rules_scope, permissions_notify_prompt_shown_result, permissions_paths_add_result, permissions_paths_list_request, permissions_paths_update_primary_result, permissions_pending_requests_request, permissions_reset_session_approvals_request, permissions_reset_session_approvals_result, permissions_set_approve_all_request, permissions_set_approve_all_result, permissions_set_approve_all_source, permissions_set_mode_request, permissions_set_mode_result, permissions_set_required_request, permissions_set_required_result, permissions_urls_set_unrestricted_mode_result, permission_urls_config, permission_urls_set_unrestricted_mode_params, ping_request, ping_result, plan_read_result, plan_read_sql_todos_result, plan_read_sql_todos_with_dependencies_result, plan_sql_todo_dependency, plan_sql_todos_row, plan_update_request, plugin, plugin_install_result, plugin_install_staging_mode, plugin_list, plugin_list_result, plugins_builtin_set_request, plugins_disable_request, plugins_enable_request, plugins_install_request, plugins_marketplaces_add_request, plugins_marketplaces_browse_request, plugins_marketplaces_refresh_request, plugins_marketplaces_remove_request, plugins_reload_request, plugins_uninstall_request, plugins_update_request, plugin_update_all_entry, plugin_update_all_result, plugin_update_result, protocol_append_mode, protocol_customize_mode, protocol_external_tool_defer, protocol_external_tool_definition, protocol_marker_section_override, protocol_replace_mode, protocol_section_override, protocol_static_section_action, protocol_static_section_override, protocol_system_message_append_config, protocol_system_message_config, protocol_system_message_customize_config, protocol_system_message_replace_config, provider_add_request, provider_add_result, provider_config, provider_config_azure, provider_config_transport, provider_config_type, provider_config_wire_api, provider_endpoint, provider_endpoint_transport, provider_endpoint_type, provider_endpoint_wire_api, provider_get_endpoint_request, provider_model_config, provider_session_token, provider_sync_request, provider_sync_result, provider_token_acquire_request, provider_token_acquire_result, push_attachment, push_attachment_blob, push_attachment_directory, push_attachment_file, push_attachment_file_line_range, push_attachment_git_hub_actions_job, push_attachment_git_hub_commit, push_attachment_git_hub_file, push_attachment_git_hub_file_diff, push_attachment_git_hub_file_diff_side, push_attachment_git_hub_reference, push_attachment_git_hub_reference_type, push_attachment_git_hub_release, push_attachment_git_hub_repository, push_attachment_git_hub_snippet, push_attachment_git_hub_tree_comparison, push_attachment_git_hub_tree_comparison_side, push_attachment_git_hub_url, push_attachment_selection, push_attachment_selection_details, push_attachment_selection_details_end, push_attachment_selection_details_start, push_git_hub_repo_ref, queue_append_steering_request, queue_begin_deferred_idle_drain_request, queue_begin_deferred_idle_drain_result, queue_consume_system_notifications_request, queued_command_handled, queued_command_not_handled, queued_command_result, queue_defer_session_idle_request, queue_duplicate_at_request, queue_duplicate_at_result, queue_enqueue_resume_pending_result, queue_finish_deferred_idle_drain_request, queue_finish_deferred_idle_drain_result, queue_has_pending_result, queue_insert_at_request, queue_insert_at_result, queue_insert_message, queue_move_item_request, queue_move_item_result, queue_pending_items, queue_pending_items_kind, queue_pending_items_result, queue_remove_at_request, queue_remove_at_result, queue_remove_most_recent_result, queue_send_now_request, queue_send_now_result, queue_set_drain_paused_request, queue_snapshot_result, queue_update_text_request, queue_update_text_result, queue_withdraw_message_request, queue_withdraw_message_result, register_event_interest_params, register_event_interest_result, release_event_interest_params, remote_control_config, remote_control_config_existing_mc_session, remote_control_status, remote_control_status_active, remote_control_status_connecting, remote_control_status_error, remote_control_status_off, remote_control_status_result, remote_control_stop_result, remote_control_transfer_result, remote_enable_request, remote_enable_result, remote_notify_steerable_changed_request, remote_notify_steerable_changed_result, remote_session_connection_result, remote_session_host_status, remote_session_metadata_repository, remote_session_metadata_task_type, remote_session_metadata_value, remote_session_mode, remote_session_repository, response_format, run_options, sandbox_config, sandbox_config_auth, sandbox_config_source, sandbox_config_user_policy, sandbox_config_user_policy_experimental, sandbox_config_user_policy_experimental_seatbelt, sandbox_config_user_policy_filesystem, sandbox_config_user_policy_network, sandbox_config_user_policy_network_proxy, sandbox_config_user_policy_seatbelt, sandbox_disable_for_session_request, sandbox_disable_for_session_result, sandbox_enforcement_status, sandbox_host_capability, sandbox_host_capability_name, sandbox_host_support, sandbox_session_change, schedule_add_at_request, schedule_add_cron_request, schedule_add_request, schedule_add_result, schedule_add_self_paced_request, schedule_entry, schedule_has_self_paced_result, schedule_list, schedule_rearm_self_paced_request, schedule_stop_request, schedule_stop_result, secrets_add_filter_values_request, secrets_add_filter_values_result, send_agent_mode, send_attachments_to_message_params, send_message_item, send_messages_request, send_messages_result, send_mode, send_request, send_result, send_system_notification_request, server_agent_list, server_instruction_source_list, server_skill, server_skill_list, session_activity, session_agent_list_request, session_auth_login_request, session_auth_logout_user_request, session_auth_status, session_auth_switch_request, session_bulk_delete_result, session_cancel_all_background_agents_result, session_capability, session_commands_list_request, session_completion_item, session_context, session_context_host_type, session_enrich_metadata_result, session_factory_pause_at_checkpoint_result, session_fs_append_file_request, session_fs_error, session_fs_error_code, session_fs_exists_request, session_fs_exists_result, session_fs_mkdir_request, session_fs_readdir_request, session_fs_readdir_result, session_fs_readdir_with_types_entry, session_fs_readdir_with_types_entry_type, session_fs_readdir_with_types_request, session_fs_readdir_with_types_result, session_fs_read_file_request, session_fs_read_file_result, session_fs_rename_request, session_fs_rm_request, session_fs_set_provider_capabilities, session_fs_set_provider_conventions, session_fs_set_provider_request, session_fs_set_provider_result, session_fs_sqlite_exists_request, session_fs_sqlite_exists_result, session_fs_sqlite_query_request, session_fs_sqlite_query_result, session_fs_sqlite_query_type, session_fs_sqlite_transaction_error, session_fs_sqlite_transaction_error_class, session_fs_sqlite_transaction_request, session_fs_sqlite_transaction_result, session_fs_sqlite_transaction_statement, session_fs_stat_request, session_fs_stat_result, session_fs_write_file_request, session_git_hub_auth_get_all_auth_available_result, session_git_hub_auth_logout_result, session_git_hub_auth_logout_user_result, session_history_compact_request, session_installed_plugin, session_installed_plugin_source, session_installed_plugin_source_git_hub, session_installed_plugin_source_local, session_installed_plugin_source_url, session_limit_prediction_baseline_data, session_limit_prediction_client_type, session_limit_prediction_details, session_limit_prediction_predict_request, session_limit_prediction_request, session_limit_prediction_result, session_limit_prediction_source, session_limit_prediction_tier, session_limit_prediction_tier_option, session_limit_prediction_unavailable_reason, session_list, session_list_entry, session_list_filter, session_load_deferred_repo_hooks_result, session_log_level, session_managed_permissions, session_managed_settings, session_mcp_apps_call_tool_result, session_metadata_snapshot, session_mode, session_model_list, session_model_list_request, session_model_price_category, session_open_options, session_open_options_additional_content_exclusion_policy, session_open_options_additional_content_exclusion_policy_rule, session_open_options_additional_content_exclusion_policy_rule_source, session_open_options_additional_content_exclusion_policy_scope, session_open_options_env_value_mode, session_open_options_reasoning_summary, session_open_params, session_open_result, session_plugins_disable_request, session_plugins_enable_request, session_plugins_install_request, session_plugins_marketplaces_refresh_request, session_plugins_reload_request, session_provider_get_endpoint_request, session_prune_result, sessions_bulk_delete_request, sessions_check_in_use_request, sessions_check_in_use_result, sessions_client_metadata_entry, sessions_close_request, sessions_close_result, sessions_delete_request, sessions_enrich_metadata_request, session_set_credentials_params, session_set_credentials_result, session_settings_built_in_tool_availability_snapshot, session_settings_evaluate_predicate_request, session_settings_evaluate_predicate_result, session_settings_job_snapshot, session_settings_model_snapshot, session_settings_online_evaluation_snapshot, session_settings_predicate_name, session_settings_repo_snapshot, session_settings_snapshot, session_settings_validation_snapshot, sessions_find_by_prefix_request, sessions_find_by_prefix_result, sessions_find_by_task_id_request, sessions_find_by_task_id_result, sessions_fork_request, sessions_fork_result, sessions_get_board_entry_count_request, sessions_get_board_entry_count_result, sessions_get_client_metadata_request, sessions_get_client_metadata_result, sessions_get_event_file_path_request, sessions_get_event_file_path_result, sessions_get_last_for_context_request, sessions_get_last_for_context_result, sessions_get_metadata_request, sessions_get_metadata_result, sessions_get_persisted_remote_steerable_request, sessions_get_persisted_remote_steerable_result, session_sizes, sessions_list_non_empty_session_ids_request, sessions_list_non_empty_session_ids_result, sessions_list_request, sessions_load_deferred_repo_hooks_request, sessions_open_attach, sessions_open_cloud, sessions_open_create, sessions_open_handoff, sessions_open_handoff_task_type, sessions_open_progress, sessions_open_progress_status, sessions_open_progress_step, sessions_open_remote, sessions_open_resume, sessions_open_resume_last, sessions_open_status, session_source, sessions_prune_old_request, sessions_read_persisted_events_request, sessions_release_lock_request, sessions_release_lock_result, sessions_reload_plugin_hooks_request, sessions_reload_plugin_hooks_result, sessions_save_request, sessions_save_result, sessions_set_additional_plugins_request, sessions_set_additional_plugins_result, sessions_set_remote_control_steering_request, sessions_start_remote_control_request, sessions_stop_remote_control_request, sessions_transfer_remote_control_request, session_telemetry_engagement, session_update_options_params, session_update_options_result, session_visibility_status, session_workflow_pause_at_checkpoint_result, session_working_directory_context, session_working_directory_context_host_type, settable_auth_info, settable_token_auth_info, shell_cancel_user_requested_request, shell_credentials, shell_exec_request, shell_exec_result, shell_execute_user_requested_request, shell_init_profile, shell_init_script, shell_init_script_shell, shell_kill_request, shell_kill_result, shell_kill_signal, shell_options, shutdown_request, skill, skill_discovery_path, skill_discovery_path_list, skill_discovery_scope, skill_list, skill_provider_descriptor, skill_provider_list_request, skill_provider_list_result, skill_provider_read_request, skill_provider_read_result, skills_config_set_disabled_skills_request, skills_config_set_skill_disabled_request, skills_disable_request, skills_discover_request, skills_enable_request, skills_get_discovery_paths_request, skills_get_invoked_result, skills_invoked_skill, skills_load_diagnostics, slash_command_add_timeline_entry_result, slash_command_agent_prompt_result, slash_command_completed_result, slash_command_info, slash_command_input, slash_command_input_choice, slash_command_input_completion, slash_command_invocation_result, slash_command_kind, slash_command_model_picker_dialog, slash_command_select_subcommand_option, slash_command_select_subcommand_result, slash_command_set_model_result, slash_command_set_plan_model_result, slash_command_show_dialog_result, slash_command_text_result, slash_command_timeline_entry, subagent_settings_entry, subagent_settings_entry_context_tier, system_message_block, task_agent_info, task_agent_progress, task_client_active_status, task_client_execution_mode, task_client_info, task_client_owner, task_client_owner_kind, task_client_owner_presence, task_client_progress, task_client_status, task_client_type, task_client_update, task_complete_data, task_completion_decision, task_execution_mode, task_info, task_kind, task_list, task_progress_line, tasks_cancel_request, tasks_cancel_result, tasks_get_current_promotable_result, tasks_get_progress_request, tasks_get_progress_result, task_shell_info, task_shell_info_attachment_mode, task_shell_progress, tasks_promote_current_to_background_result, tasks_promote_to_background_request, tasks_promote_to_background_result, tasks_refresh_result, tasks_register_request, tasks_register_result, tasks_remove_request, tasks_remove_result, tasks_send_message_request, tasks_send_message_result, tasks_start_agent_request, tasks_start_agent_result, task_status, tasks_update_request, tasks_update_result, tasks_wait_for_pending_result, telemetry_set_feature_overrides_request, token_auth_info, token_provider_auth_info, tool, tool_list, tool_result, tool_result_expanded, tool_result_new_message, tool_result_type, tools_execute_request, tools_get_builtin_descriptors_request, tools_get_builtin_descriptors_result, tools_get_current_metadata_result, tools_initialize_and_validate_result, tools_list_request, tools_set_request, tools_set_result, tools_shell_descriptor_config, tools_task_complete_event_data_request, tools_update_subagent_settings_result, ui_auto_mode_switch_response, ui_elicitation_array_any_of_field, ui_elicitation_array_any_of_field_items, ui_elicitation_array_any_of_field_items_any_of, ui_elicitation_array_enum_field, ui_elicitation_array_enum_field_items, ui_elicitation_field_value, ui_elicitation_request, ui_elicitation_response, ui_elicitation_response_action, ui_elicitation_response_content, ui_elicitation_result, ui_elicitation_schema, ui_elicitation_schema_property, ui_elicitation_schema_property_boolean, ui_elicitation_schema_property_number, ui_elicitation_schema_property_number_type, ui_elicitation_schema_property_string, ui_elicitation_schema_property_string_format, ui_elicitation_string_enum_field, ui_elicitation_string_one_of_field, ui_elicitation_string_one_of_field_one_of, ui_ephemeral_query_request, ui_ephemeral_query_result, ui_exit_plan_mode_action, ui_exit_plan_mode_response, ui_handle_pending_auto_mode_switch_request, ui_handle_pending_elicitation_request, ui_handle_pending_exit_plan_mode_request, ui_handle_pending_result, ui_handle_pending_sampling_request, ui_handle_pending_sampling_response, ui_handle_pending_session_limits_exhausted_request, ui_handle_pending_user_input_request, ui_register_direct_auto_mode_switch_handler_result, ui_session_limits_exhausted_response, ui_session_limits_exhausted_response_action, ui_unregister_direct_auto_mode_switch_handler_request, ui_unregister_direct_auto_mode_switch_handler_result, ui_user_input_response, unsupported_enqueue_command_result, update_subagent_settings_request, usage_get_metrics_result, usage_metrics_agent_metric, usage_metrics_code_changes, usage_metrics_model_metric, usage_metrics_model_metric_requests, usage_metrics_model_metric_token_detail, usage_metrics_model_metric_usage, usage_metrics_token_detail, user_auth_info, user_requested_shell_command_result, user_setting_metadata, user_settings_get_result, user_settings_set_request, user_settings_set_result, visibility_get_result, visibility_set_request, visibility_set_result, workflow_abort_request, workflow_ack_result, workflow_agent_options, workflow_agent_request, workflow_agent_result, workflow_agent_summary, workflow_cancel_request, workflow_current_phase, workflow_declared_limits, workflow_durable_operation, workflow_execute_request, workflow_execute_result, workflow_get_run_progress_request, workflow_get_run_request, workflow_journal_get_request, workflow_journal_get_result, workflow_journal_put_request, workflow_list_runs_request, workflow_list_runs_result, workflow_log_line, workflow_log_line_kind, workflow_log_request, workflow_pause_checkpoint_action, workflow_pause_checkpoint_request, workflow_pause_checkpoint_result, workflow_pause_info, workflow_pause_request, workflow_phase_observation, workflow_phase_status, workflow_progress_line, workflow_progress_page, workflow_resume_request, workflow_resume_result, workflow_run_consumed, workflow_run_detail, workflow_run_failure, workflow_run_failure_kind, workflow_run_limits, workflow_run_options, workflow_run_request, workflow_run_result, workflow_run_status, workflow_run_summary, workflow_run_terminal, workflow_tool_resume_request, workflow_tool_run_options, workflow_tool_run_request, workspace_diff_file_change, workspace_diff_file_change_type, workspace_diff_mode, workspace_diff_result, workspaces_add_summary_request, workspaces_add_summary_result, workspaces_autopilot_objective_exists_result, workspaces_checkpoints, workspaces_create_directory_request, workspaces_create_file_request, workspaces_delete_autopilot_objective_result, workspaces_diff_request, workspaces_ensure_request, workspaces_get_workspace_result, workspaces_list_checkpoints_result, workspaces_list_files_result, workspaces_read_autopilot_objective_result, workspaces_read_checkpoint_request, workspaces_read_checkpoint_result, workspaces_read_file_request, workspaces_read_file_result, workspaces_remove_path_request, workspaces_rename_path_request, workspaces_save_large_paste_request, workspaces_save_large_paste_result, workspaces_stat_file_request, workspaces_stat_file_result, workspaces_truncate_summaries_request, workspace_summary_host_type, workspaces_update_metadata_request, workspaces_workspace_details_host_type, workspaces_write_autopilot_objective_request, workspaces_write_autopilot_objective_result, session_auth_info_result, session_context_attribution, session_context_info, subagent_settings, task_progress, workspace_summary)
 
     def to_dict(self) -> dict:
         result: dict = {}
@@ -44727,6 +45232,16 @@ def to_dict(self) -> dict:
         result["DebugCollectLogsResultKind"] = to_enum(DebugCollectLogsResultKind, self.debug_collect_logs_result_kind)
         result["DebugCollectLogsSkippedEntry"] = to_class(DebugCollectLogsSkippedEntry, self.debug_collect_logs_skipped_entry)
         result["DebugCollectLogsSource"] = to_enum(DebugCollectLogsSource, self.debug_collect_logs_source)
+        result["DiagnosticCursorStatus"] = to_enum(CursorStatus, self.diagnostic_cursor_status)
+        result["DiagnosticEntry"] = to_class(DiagnosticEntry, self.diagnostic_entry)
+        result["DiagnosticLogLevel"] = to_enum(DiagnosticLogLevel, self.diagnostic_log_level)
+        result["DiagnosticsConfiguration"] = to_class(DiagnosticsConfiguration, self.diagnostics_configuration)
+        result["DiagnosticsConfigureRequest"] = to_class(DiagnosticsConfigureRequest, self.diagnostics_configure_request)
+        result["DiagnosticSeverity"] = to_enum(DiagnosticSeverity, self.diagnostic_severity)
+        result["DiagnosticSource"] = to_enum(DiagnosticSource, self.diagnostic_source)
+        result["DiagnosticSourcesConfiguration"] = to_class(DiagnosticSourcesConfiguration, self.diagnostic_sources_configuration)
+        result["DiagnosticsReadRequest"] = to_class(DiagnosticsReadRequest, self.diagnostics_read_request)
+        result["DiagnosticsReadResult"] = to_class(DiagnosticsReadResult, self.diagnostics_read_result)
         result["DiscoveredCanvas"] = to_class(DiscoveredCanvas, self.discovered_canvas)
         result["DiscoveredExtension"] = to_class(DiscoveredExtension, self.discovered_extension)
         result["DiscoveredExtensionMode"] = to_enum(DiscoveredExtensionMode, self.discovered_extension_mode)
@@ -44746,7 +45261,7 @@ def to_dict(self) -> dict:
         result["EventLogTailResult"] = to_class(EventLogTailResult, self.event_log_tail_result)
         result["EventLogTypes"] = from_union([lambda x: from_list(from_str, x), lambda x: to_enum(EventLogTypes, x)], self.event_log_types)
         result["EventsAgentScope"] = to_enum(EventsAgentScope, self.events_agent_scope)
-        result["EventsCursorStatus"] = to_enum(EventsCursorStatus, self.events_cursor_status)
+        result["EventsCursorStatus"] = to_enum(CursorStatus, self.events_cursor_status)
         result["EventsReadDirection"] = to_enum(EventsReadDirection, self.events_read_direction)
         result["EventsReadResult"] = to_class(EventsReadResult, self.events_read_result)
         result["ExecuteCommandParams"] = to_class(ExecuteCommandParams, self.execute_command_params)
@@ -44946,6 +45461,10 @@ def to_dict(self) -> dict:
         result["McpConfigUpdateRequest"] = to_class(MCPConfigUpdateRequest, self.mcp_config_update_request)
         result["McpConfigureGitHubRequest"] = to_class(MCPConfigureGitHubRequest, self.mcp_configure_git_hub_request)
         result["McpConfigureGitHubResult"] = to_class(MCPConfigureGitHubResult, self.mcp_configure_git_hub_result)
+        result["McpDiagnosticDetails"] = to_class(MCPDiagnosticDetails, self.mcp_diagnostic_details)
+        result["McpDiagnosticDirection"] = to_enum(MCPDiagnosticDirection, self.mcp_diagnostic_direction)
+        result["McpDiagnosticKind"] = to_enum(MCPDiagnosticKind, self.mcp_diagnostic_kind)
+        result["McpDiagnosticSourceConfiguration"] = to_class(MCPDiagnosticSourceConfiguration, self.mcp_diagnostic_source_configuration)
         result["McpDisableRequest"] = to_class(MCPDisableRequest, self.mcp_disable_request)
         result["McpDiscoverRequest"] = to_class(MCPDiscoverRequest, self.mcp_discover_request)
         result["McpDiscoverResult"] = to_class(MCPDiscoverResult, self.mcp_discover_result)
@@ -45357,6 +45876,7 @@ def to_dict(self) -> dict:
         result["QueueUpdateTextRequest"] = to_class(QueueUpdateTextRequest, self.queue_update_text_request)
         result["QueueUpdateTextResult"] = to_class(QueueUpdateTextResult, self.queue_update_text_result)
         result["QueueWithdrawMessageRequest"] = to_class(QueueWithdrawMessageRequest, self.queue_withdraw_message_request)
+        result["QueueWithdrawMessageResult"] = to_class(QueueWithdrawMessageResult, self.queue_withdraw_message_result)
         result["RegisterEventInterestParams"] = to_class(RegisterEventInterestParams, self.register_event_interest_params)
         result["RegisterEventInterestResult"] = to_class(RegisterEventInterestResult, self.register_event_interest_result)
         result["ReleaseEventInterestParams"] = to_class(ReleaseEventInterestParams, self.release_event_interest_params)
@@ -45396,6 +45916,9 @@ def to_dict(self) -> dict:
         result["SandboxDisableForSessionRequest"] = to_class(SandboxDisableForSessionRequest, self.sandbox_disable_for_session_request)
         result["SandboxDisableForSessionResult"] = to_class(SandboxDisableForSessionResult, self.sandbox_disable_for_session_result)
         result["SandboxEnforcementStatus"] = to_class(SandboxEnforcementStatus, self.sandbox_enforcement_status)
+        result["SandboxHostCapability"] = to_class(SandboxHostCapability, self.sandbox_host_capability)
+        result["SandboxHostCapabilityName"] = from_str(self.sandbox_host_capability_name)
+        result["SandboxHostSupport"] = to_class(SandboxHostSupport, self.sandbox_host_support)
         result["SandboxSessionChange"] = to_enum(SandboxSessionChange, self.sandbox_session_change)
         result["ScheduleAddAtRequest"] = to_class(ScheduleAddAtRequest, self.schedule_add_at_request)
         result["ScheduleAddCronRequest"] = to_class(ScheduleAddCronRequest, self.schedule_add_cron_request)
@@ -46275,6 +46798,8 @@ def _load_TaskInfo(obj: Any) -> "TaskInfo":
 CatalogResourceVersion = str
 ClientMetadata = dict
 CommandsListRequest = Any
+DiagnosticCursorStatus = CursorStatus
+EventsCursorStatus = CursorStatus
 ExternalToolResult = ExternalToolTextResultForLlm
 ExternalToolTextResultForLlmContentResourceLinkIconTheme = Theme
 FactoryDurableOperation = DurableOperation
@@ -46327,6 +46852,7 @@ def _load_TaskInfo(obj: Any) -> "TaskInfo":
 ProviderEndpointWireApi = ProviderWireAPI
 ProviderGetEndpointRequest = Any
 RemoteSessionMetadataTaskType = TaskType
+SandboxHostCapabilityName = str
 SessionAuthInfoResult = AuthIdentity
 SessionCancelAllBackgroundAgentsResult = int
 SessionContextHostType = HostType
@@ -46408,6 +46934,16 @@ async def get_built_in_catalog(self, *, timeout: float | None = None) -> BuiltIn
         return BuiltInModelCatalog.from_dict(await self._client.request("models.getBuiltInCatalog", {}, **_timeout_kwargs(timeout)))
 
 
+# Experimental: this API group is experimental and may change or be removed.
+class ServerSandboxApi:
+    def __init__(self, client: "JsonRpcClient"):
+        self._client = client
+
+    async def get_host_support(self, *, timeout: float | None = None) -> SandboxHostSupport:
+        "Reports whether the host running this runtime can run the command sandbox, without starting a session or spawning a sandboxed command.\n\nReturns:\n    Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package."
+        return SandboxHostSupport.from_dict(await self._client.request("sandbox.getHostSupport", {}, **_timeout_kwargs(timeout)))
+
+
 # Experimental: this API group is experimental and may change or be removed.
 class ServerToolsApi:
     def __init__(self, client: "JsonRpcClient"):
@@ -46935,6 +47471,7 @@ def __init__(self, client: "JsonRpcClient"):
         self._client = client
         self.hooks = ServerHooksApi(client)
         self.models = ServerModelsApi(client)
+        self.sandbox = ServerSandboxApi(client)
         self.tools = ServerToolsApi(client)
         self.account = ServerAccountApi(client)
         self.secrets = ServerSecretsApi(client)
@@ -47542,6 +48079,21 @@ async def get_sources(self, *, timeout: float | None = None) -> InstructionsGetS
         "Gets instruction sources loaded for the session.\n\nReturns:\n    Instruction sources loaded for the session, in merge order."
         return InstructionsGetSourcesResult.from_dict(await self._client.request("session.instructions.getSources", {"sessionId": self._session_id}, **_timeout_kwargs(timeout)))
 
+    async def reload(self, *, timeout: float | None = None) -> None:
+        "Invalidates cached custom-instruction discovery so subsequent turns and source reads observe instruction files currently on disk."
+        await self._client.request("session.instructions.reload", {"sessionId": self._session_id}, **_timeout_kwargs(timeout))
+
+
+# Experimental: this API group is experimental and may change or be removed.
+class CustomizationsApi:
+    def __init__(self, client: "JsonRpcClient", session_id: str):
+        self._client = client
+        self._session_id = session_id
+
+    async def reload(self, *, timeout: float | None = None) -> SkillsLoadDiagnostics:
+        "Reloads all repository and user customizations for the active session: instructions, plugins and their MCP servers and hooks, custom agents, extensions, and skills. Returns diagnostics from the final skill reload.\n\nReturns:\n    Diagnostics from reloading skill definitions, with warnings and errors as separate lists."
+        return SkillsLoadDiagnostics.from_dict(await self._client.request("session.customizations.reload", {"sessionId": self._session_id}, **_timeout_kwargs(timeout)))
+
 
 # Experimental: this API group is experimental and may change or be removed.
 class FleetApi:
@@ -47906,6 +48458,25 @@ async def is_server_running(self, params: MCPIsServerRunningRequest, *, timeout:
         return MCPIsServerRunningResult.from_dict(await self._client.request("session.mcp.isServerRunning", params_dict, **_timeout_kwargs(timeout)))
 
 
+# Experimental: this API group is experimental and may change or be removed.
+class DiagnosticsApi:
+    def __init__(self, client: "JsonRpcClient", session_id: str):
+        self._client = client
+        self._session_id = session_id
+
+    async def configure(self, params: DiagnosticsConfigureRequest, *, timeout: float | None = None) -> DiagnosticsConfiguration:
+        "Patches configured session diagnostic sources without restarting their producers. Setting a source level to off clears its retained diagnostics and invalidates cursors selecting that source.\n\nArgs:\n    params: Patch session diagnostic thresholds for explicitly supplied sources.\n\nReturns:\n    Per-source session diagnostics configuration."
+        params_dict: dict[str, Any] = {k: v for k, v in params.to_dict().items() if v is not None}
+        params_dict["sessionId"] = self._session_id
+        return DiagnosticsConfiguration.from_dict(await self._client.request("session.diagnostics.configure", params_dict, **_timeout_kwargs(timeout)))
+
+    async def read(self, params: DiagnosticsReadRequest, *, timeout: float | None = None) -> DiagnosticsReadResult:
+        "Reads a bounded batch of retained session diagnostics for the selected sources. Records are never consumed and each reader advances independently through its opaque cursor.\n\nArgs:\n    params: Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the default waitMs is zero (maximum 30000).\n\nReturns:\n    One cursor-addressed page of retained session diagnostics."
+        params_dict: dict[str, Any] = {k: v for k, v in params.to_dict().items() if v is not None}
+        params_dict["sessionId"] = self._session_id
+        return DiagnosticsReadResult.from_dict(await self._client.request("session.diagnostics.read", params_dict, **_timeout_kwargs(timeout)))
+
+
 # Experimental: this API group is experimental and may change or be removed.
 class ConnectorsApi:
     def __init__(self, client: "JsonRpcClient", session_id: str):
@@ -48670,11 +49241,11 @@ async def update_text(self, params: QueueUpdateTextRequest, *, timeout: float |
         params_dict["sessionId"] = self._session_id
         return QueueUpdateTextResult.from_dict(await self._client.request("session.queue.updateText", params_dict, **_timeout_kwargs(timeout)))
 
-    async def withdraw_message(self, params: QueueWithdrawMessageRequest, *, timeout: float | None = None) -> QueueRemoveAtResult:
-        "Atomically withdraws an unchanged, unconsumed user message from the local queued or steering lane. A client retaining the original draft may restore it only when removed is true. Does not interrupt the running turn.\n\nArgs:\n    params: Conditional withdrawal of a single user message, before the runtime claims it for delivery.\n\nReturns:\n    Result of removing a queued item."
+    async def withdraw_message(self, params: QueueWithdrawMessageRequest, *, timeout: float | None = None) -> QueueWithdrawMessageResult:
+        "Atomically withdraws an unchanged user message of a local session: from the queued or steering lane while unconsumed, or from the running turn it started while the model has not answered it and nothing the user sent after it is pending. Withdrawing from the running turn interrupts that turn and removes its events from history. A client retaining the original draft may restore it only when removed is true.\n\nArgs:\n    params: Conditional withdrawal of a single user message, from its queue or from the running turn it started.\n\nReturns:\n    Result of withdrawing a user message."
         params_dict: dict[str, Any] = {k: v for k, v in params.to_dict().items() if v is not None}
         params_dict["sessionId"] = self._session_id
-        return QueueRemoveAtResult.from_dict(await self._client.request("session.queue.withdrawMessage", params_dict, **_timeout_kwargs(timeout)))
+        return QueueWithdrawMessageResult.from_dict(await self._client.request("session.queue.withdrawMessage", params_dict, **_timeout_kwargs(timeout)))
 
     async def append_steering(self, params: QueueAppendSteeringRequest, *, timeout: float | None = None) -> QueueUpdateTextResult:
         "Atomically appends text and attachments to an unchanged, unconsumed local steering message. Returns updated=false if delivery or withdrawal already claimed the message.\n\nArgs:\n    params: Append to one pending steering message without changing its identity or delivery position.\n\nReturns:\n    Result of editing a queued message."
@@ -48838,11 +49409,13 @@ def __init__(self, client: "JsonRpcClient", session_id: str):
         self.autopilot_objective = AutopilotObjectiveApi(client, session_id)
         self.completions = CompletionsApi(client, session_id)
         self.instructions = InstructionsApi(client, session_id)
+        self.customizations = CustomizationsApi(client, session_id)
         self.fleet = FleetApi(client, session_id)
         self.agent = AgentApi(client, session_id)
         self.tasks = TasksApi(client, session_id)
         self.skills = SkillsApi(client, session_id)
         self.mcp = McpApi(client, session_id)
+        self.diagnostics = DiagnosticsApi(client, session_id)
         self.connectors = ConnectorsApi(client, session_id)
         self.managed_settings = ManagedSettingsApi(client, session_id)
         self.plugins = PluginsApi(client, session_id)
@@ -49873,6 +50446,8 @@ async def handle_git_hub_token_get_token(params: dict) -> dict | None:
     "CopilotUserResponseQuotaSnapshotsPremiumInteractions",
     "CurrentModel",
     "CurrentToolMetadata",
+    "CursorStatus",
+    "CustomizationsApi",
     "DebugApi",
     "DebugCollectLogsCollectedEntry",
     "DebugCollectLogsDestination",
@@ -49885,6 +50460,17 @@ async def handle_git_hub_token_get_token(params: dict) -> dict | None:
     "DebugCollectLogsResultKind",
     "DebugCollectLogsSkippedEntry",
     "DebugCollectLogsSource",
+    "DiagnosticCursorStatus",
+    "DiagnosticEntry",
+    "DiagnosticLogLevel",
+    "DiagnosticSeverity",
+    "DiagnosticSource",
+    "DiagnosticSourcesConfiguration",
+    "DiagnosticsApi",
+    "DiagnosticsConfiguration",
+    "DiagnosticsConfigureRequest",
+    "DiagnosticsReadRequest",
+    "DiagnosticsReadResult",
     "DiscoveredCanvas",
     "DiscoveredExtension",
     "DiscoveredExtensionMode",
@@ -50122,6 +50708,10 @@ async def handle_git_hub_token_get_token(params: dict) -> dict | None:
     "MCPConfigUpdateRequest",
     "MCPConfigureGitHubRequest",
     "MCPConfigureGitHubResult",
+    "MCPDiagnosticDetails",
+    "MCPDiagnosticDirection",
+    "MCPDiagnosticKind",
+    "MCPDiagnosticSourceConfiguration",
     "MCPDisableRequest",
     "MCPDiscoverRequest",
     "MCPDiscoverResult",
@@ -50382,7 +50972,6 @@ async def handle_git_hub_token_get_token(params: dict) -> dict | None:
     "PermissionDecisionApproveForLocationApprovalFactory",
     "PermissionDecisionApproveForLocationApprovalFactoryKind",
     "PermissionDecisionApproveForLocationApprovalMCP",
-    "PermissionDecisionApproveForLocationApprovalMCPKind",
     "PermissionDecisionApproveForLocationApprovalMCPSampling",
     "PermissionDecisionApproveForLocationApprovalMCPSamplingKind",
     "PermissionDecisionApproveForLocationApprovalMemory",
@@ -50638,6 +51227,7 @@ async def handle_git_hub_token_get_token(params: dict) -> dict | None:
     "QueueUpdateTextRequest",
     "QueueUpdateTextResult",
     "QueueWithdrawMessageRequest",
+    "QueueWithdrawMessageResult",
     "QueuedCommandHandled",
     "QueuedCommandNotHandled",
     "QueuedCommandResult",
@@ -50690,6 +51280,9 @@ async def handle_git_hub_token_get_token(params: dict) -> dict | None:
     "SandboxDisableForSessionRequest",
     "SandboxDisableForSessionResult",
     "SandboxEnforcementStatus",
+    "SandboxHostCapability",
+    "SandboxHostCapabilityName",
+    "SandboxHostSupport",
     "SandboxSessionChange",
     "Saved",
     "ScheduleAddAtRequest",
@@ -50735,6 +51328,7 @@ async def handle_git_hub_token_get_token(params: dict) -> dict | None:
     "ServerPluginsMarketplacesApi",
     "ServerRpc",
     "ServerRuntimeApi",
+    "ServerSandboxApi",
     "ServerSecretsApi",
     "ServerSessionFsApi",
     "ServerSessionsApi",
diff --git a/python/copilot/generated/session_events.py b/python/copilot/generated/session_events.py
index 8aa8d802c6..6fef3e2ac2 100644
--- a/python/copilot/generated/session_events.py
+++ b/python/copilot/generated/session_events.py
@@ -1205,6 +1205,7 @@ class FusionAttribution:
     synthetic_model: str
     commit_id: str | None = None
     conversation_scope: str | None = None
+    has_user_steering: bool | None = None
     phase_id: str | None = None
     phase_kind: str | None = None
     role: str | None = None
@@ -1220,6 +1221,7 @@ def from_dict(obj: Any) -> "FusionAttribution":
         synthetic_model = from_str(obj.get("syntheticModel"))
         commit_id = from_union([from_none, from_str], obj.get("commitId"))
         conversation_scope = from_union([from_none, from_str], obj.get("conversationScope"))
+        has_user_steering = from_union([from_none, from_bool], obj.get("hasUserSteering"))
         phase_id = from_union([from_none, from_str], obj.get("phaseId"))
         phase_kind = from_union([from_none, from_str], obj.get("phaseKind"))
         role = from_union([from_none, from_str], obj.get("role"))
@@ -1232,6 +1234,7 @@ def from_dict(obj: Any) -> "FusionAttribution":
             synthetic_model=synthetic_model,
             commit_id=commit_id,
             conversation_scope=conversation_scope,
+            has_user_steering=has_user_steering,
             phase_id=phase_id,
             phase_kind=phase_kind,
             role=role,
@@ -1249,6 +1252,8 @@ def to_dict(self) -> dict:
             result["commitId"] = from_union([from_none, from_str], self.commit_id)
         if self.conversation_scope is not None:
             result["conversationScope"] = from_union([from_none, from_str], self.conversation_scope)
+        if self.has_user_steering is not None:
+            result["hasUserSteering"] = from_union([from_none, from_bool], self.has_user_steering)
         if self.phase_id is not None:
             result["phaseId"] = from_union([from_none, from_str], self.phase_id)
         if self.phase_kind is not None:
@@ -5632,6 +5637,7 @@ class McpOauthRequiredStaticClientConfig:
     client_secret: str | None = None
     grant_type: str | None = None
     public_client: bool | None = None
+    scope: str | None = None
 
     @staticmethod
     def from_dict(obj: Any) -> "McpOauthRequiredStaticClientConfig":
@@ -5640,11 +5646,13 @@ def from_dict(obj: Any) -> "McpOauthRequiredStaticClientConfig":
         client_secret = from_union([from_none, from_str], obj.get("clientSecret"))
         grant_type = from_union([from_none, from_str], obj.get("grantType"))
         public_client = from_union([from_none, from_bool], obj.get("publicClient"))
+        scope = from_union([from_none, from_str], obj.get("scope"))
         return McpOauthRequiredStaticClientConfig(
             client_id=client_id,
             client_secret=client_secret,
             grant_type=grant_type,
             public_client=public_client,
+            scope=scope,
         )
 
     def to_dict(self) -> dict:
@@ -5656,6 +5664,8 @@ def to_dict(self) -> dict:
             result["grantType"] = from_union([from_none, from_str], self.grant_type)
         if self.public_client is not None:
             result["publicClient"] = from_union([from_none, from_bool], self.public_client)
+        if self.scope is not None:
+            result["scope"] = from_union([from_none, from_str], self.scope)
         return result
 
 
@@ -8133,7 +8143,7 @@ def to_dict(self) -> dict:
 
 @dataclass
 class ResponsesReasoning:
-    "Original request-level and effective conversation reasoning effort for a Responses history boundary"
+    "Original request-level and effective conversation reasoning effort for a provider history boundary; the historical type name is retained for compatibility"
     effort: str
     initial_effort: str
     model: str
@@ -9886,21 +9896,26 @@ class SessionSnapshotRewindData:
     "Session rewind details including target event and count of removed events"
     events_removed: int
     up_to_event_id: str
+    event_ids: list[str] | None = None
 
     @staticmethod
     def from_dict(obj: Any) -> "SessionSnapshotRewindData":
         assert isinstance(obj, dict)
         events_removed = from_int(obj.get("eventsRemoved"))
         up_to_event_id = from_str(obj.get("upToEventId"))
+        event_ids = from_union([from_none, lambda x: from_list(from_str, x)], obj.get("eventIds"))
         return SessionSnapshotRewindData(
             events_removed=events_removed,
             up_to_event_id=up_to_event_id,
+            event_ids=event_ids,
         )
 
     def to_dict(self) -> dict:
         result: dict = {}
         result["eventsRemoved"] = to_int(self.events_removed)
         result["upToEventId"] = from_str(self.up_to_event_id)
+        if self.event_ids is not None:
+            result["eventIds"] = from_union([from_none, lambda x: from_list(from_str, x)], self.event_ids)
         return result
 
 
diff --git a/python/copilot/session.py b/python/copilot/session.py
index 6534e4cbae..9610c8ea21 100644
--- a/python/copilot/session.py
+++ b/python/copilot/session.py
@@ -526,6 +526,7 @@ class McpAuthStaticClientConfig(TypedDict, total=False):
     clientSecret: str
     grantType: Literal["client_credentials"]
     publicClient: bool
+    scope: str
 
 
 class McpAuthRequest(TypedDict, total=False):
@@ -1867,6 +1868,11 @@ async def send_and_wait(
         has finished processing the message.
 
         Events are still delivered to handlers registered via :meth:`on` while waiting.
+        Synchronous handlers registered before this call finish processing the
+        completing root session.idle event before it returns successfully.
+        This does not wait for asynchronous work started by a handler.
+        Sub-agent events with a non-empty ``agent_id`` do not complete the wait
+        or supply its reply.
 
         Args:
             prompt: The message text to send.
@@ -1923,6 +1929,8 @@ async def send_and_wait(
 
         def handler(event: SessionEventTypeAlias) -> None:
             nonlocal first_assistant_message_logged, last_assistant_message, error_event
+            if event.agent_id:
+                return
             match event.data:
                 case AssistantMessageData():
                     last_assistant_message = event
@@ -2303,6 +2311,8 @@ def _handle_broadcast_event(self, event: SessionEvent) -> None:
                         static_client_config["publicClient"] = (
                             data.static_client_config.public_client
                         )
+                    if data.static_client_config.scope is not None:
+                        static_client_config["scope"] = data.static_client_config.scope
                     request["staticClientConfig"] = static_client_config
                 asyncio.ensure_future(self._execute_mcp_auth_and_respond(request, handler))
 
diff --git a/python/e2e/test_pending_work_resume_e2e.py b/python/e2e/test_pending_work_resume_e2e.py
index 0a09c37c59..f0ac9c5481 100644
--- a/python/e2e/test_pending_work_resume_e2e.py
+++ b/python/e2e/test_pending_work_resume_e2e.py
@@ -486,26 +486,26 @@ async def blocking_external_tool(args):
                 assert isinstance(tool_event.data, ExternalToolRequestedData)
                 assert (await asyncio.wait_for(tool_started, PENDING_WORK_TIMEOUT)) == "beta"
 
-                if disconnect_original_client:
-                    # force_stop closes the local socket before the server necessarily
-                    # processes that disconnect. Observe the session lock from another
-                    # runtime so resume cannot race the server's active-session cleanup.
-                    lock_observer = _make_subprocess_client(ctx)
-                    await lock_observer.start()
+                # Resume must observe the established session owner, not race the
+                # server's asynchronous acquisition or release of its session lock.
+                lock_observer = _make_subprocess_client(ctx)
+                await lock_observer.start()
+
+                async def session_lock_is_held() -> bool:
+                    result = await lock_observer.rpc.sessions.check_in_use(
+                        SessionsCheckInUseRequest(session_ids=[session_id])
+                    )
+                    return session_id in result.in_use
 
-                    async def session_lock_is_held() -> bool:
-                        result = await lock_observer.rpc.sessions.check_in_use(
-                            SessionsCheckInUseRequest(session_ids=[session_id])
-                        )
-                        return session_id in result.in_use
+                await wait_for_condition(
+                    session_lock_is_held,
+                    timeout=PENDING_WORK_TIMEOUT,
+                    timeout_message=(
+                        f"Timed out waiting for session '{session_id}' to acquire its lock."
+                    ),
+                )
 
-                    await wait_for_condition(
-                        session_lock_is_held,
-                        timeout=PENDING_WORK_TIMEOUT,
-                        timeout_message=(
-                            f"Timed out waiting for session '{session_id}' to acquire its lock."
-                        ),
-                    )
+                if disconnect_original_client:
                     await suspended_client.force_stop()
 
                     async def session_lock_is_released() -> bool:
@@ -521,6 +521,9 @@ async def session_lock_is_released() -> bool:
                             f"Timed out waiting for session '{session_id}' to release its lock."
                         ),
                     )
+                else:
+                    await _safe_force_stop(lock_observer)
+                    lock_observer = None
 
                 resumed_client = CopilotClient(
                     connection=RuntimeConnection.for_uri(
diff --git a/python/e2e/test_permissions_e2e.py b/python/e2e/test_permissions_e2e.py
index 82a232ac17..62537583b5 100644
--- a/python/e2e/test_permissions_e2e.py
+++ b/python/e2e/test_permissions_e2e.py
@@ -141,6 +141,7 @@ async def test_should_deny_tool_operations_when_handler_explicitly_denies_after_
         )
         session_id = session1.session_id
         await session1.send_and_wait("What is 1+1?")
+        await session1.disconnect()
 
         def deny_all(request, invocation):
             return PermissionDecisionUserNotAvailable()
diff --git a/python/e2e/test_rpc_event_log_e2e.py b/python/e2e/test_rpc_event_log_e2e.py
index 5e5cc39095..f17e940f46 100644
--- a/python/e2e/test_rpc_event_log_e2e.py
+++ b/python/e2e/test_rpc_event_log_e2e.py
@@ -6,6 +6,7 @@
 import time
 import uuid
 from collections.abc import Awaitable, Callable
+from typing import TYPE_CHECKING
 
 import pytest
 
@@ -16,6 +17,7 @@
     PlanUpdateRequest,
     RegisterEventInterestParams,
     ReleaseEventInterestParams,
+    SessionsSaveRequest,
 )
 from copilot.session import PermissionHandler
 from copilot.session_events import (
@@ -24,7 +26,8 @@
     SessionTitleChangedData,
 )
 
-from .testharness import E2ETestContext
+if TYPE_CHECKING:
+    from .testharness import E2ETestContext
 
 pytestmark = pytest.mark.asyncio(loop_scope="module")
 
@@ -89,14 +92,27 @@ async def test_should_return_tail_cursor_and_read_empty_when_no_new_events(
         )
         try:
             tail = await session.rpc.event_log.tail()
-            read = await session.rpc.event_log.read(
-                EventLogReadRequest(cursor=tail.cursor, max=10, wait_ms=0)
+            await session.log("Ephemeral event after tail", ephemeral=True)
+            request = EventLogReadRequest(
+                cursor=tail.cursor, max=10, wait_ms=0, include_ephemeral=False
             )
+            read = await session.rpc.event_log.read(request)
 
             assert tail.cursor
             assert read.cursor_status == EventsCursorStatus.OK
             assert read.events == []
             assert read.has_more is False
+
+            await session.rpc.plan.update(PlanUpdateRequest(content="# Durable event after tail"))
+            await ctx.client.rpc.sessions.save(SessionsSaveRequest(session_id=session.session_id))
+            read = await session.rpc.event_log.read(request)
+            assert read.cursor_status == EventsCursorStatus.OK
+            assert any(
+                isinstance(evt.data, SessionPlanChangedData)
+                and evt.data.operation == PlanChangedOperation.CREATE
+                and evt.ephemeral is not True
+                for evt in read.events
+            )
         finally:
             await session.disconnect()
 
@@ -133,25 +149,43 @@ async def test_should_long_poll_with_types_filter_for_title_changed_event(
         try:
             expected_title = f"EventLogTitle-{uuid.uuid4().hex}"
             tail = await session.rpc.event_log.tail()
-            read_task = asyncio.create_task(
-                session.rpc.event_log.read(
-                    EventLogReadRequest(
-                        cursor=tail.cursor,
-                        max=10,
-                        wait_ms=5000,
-                        types=["session.title_changed"],
+            last_read = None
+
+            async def read_until_title():
+                nonlocal last_read
+                cursor = tail.cursor
+                while True:
+                    last_read = await session.rpc.event_log.read(
+                        EventLogReadRequest(
+                            cursor=cursor,
+                            max=10,
+                            wait_ms=5000,
+                            types=["session.title_changed"],
+                        )
                     )
-                )
-            )
-
-            await session.rpc.name.set(NameSetRequest(name=expected_title))
-            read = await asyncio.wait_for(read_task, timeout=10.0)
-
-            assert read.cursor_status == EventsCursorStatus.OK
-            assert all(evt.type.value == "session.title_changed" for evt in read.events)
-            assert any(
-                isinstance(evt.data, SessionTitleChangedData) and evt.data.title == expected_title
-                for evt in read.events
-            )
+                    assert last_read.cursor_status == EventsCursorStatus.OK
+                    assert all(
+                        evt.type.value == "session.title_changed" for evt in last_read.events
+                    )
+                    if any(
+                        isinstance(evt.data, SessionTitleChangedData)
+                        and evt.data.title == expected_title
+                        for evt in last_read.events
+                    ):
+                        return
+                    # Any new event can wake a long poll, even if the filter removes it.
+                    cursor = last_read.cursor
+
+            read_task = asyncio.create_task(read_until_title())
+            try:
+                await session.rpc.name.set(NameSetRequest(name=expected_title))
+                try:
+                    await asyncio.wait_for(read_task, timeout=10.0)
+                except TimeoutError as exc:
+                    exc.add_note(f"Expected title {expected_title!r}; last batch: {last_read!r}")
+                    raise
+            finally:
+                read_task.cancel()
+                await asyncio.gather(read_task, return_exceptions=True)
         finally:
             await session.disconnect()
diff --git a/python/e2e/test_session_e2e.py b/python/e2e/test_session_e2e.py
index 160d627a0d..5cd163c9f2 100644
--- a/python/e2e/test_session_e2e.py
+++ b/python/e2e/test_session_e2e.py
@@ -1029,21 +1029,44 @@ def on_event(event):
     async def test_sendandwait_blocks_until_session_idle_and_returns_final_assistant_message(
         self, ctx: E2ETestContext
     ):
-        """`send_and_wait` blocks until idle and returns the final assistant message."""
+        """The synchronous root-idle listener finishes before `send_and_wait` returns."""
+        import asyncio
+
         session = await ctx.client.create_session(
             on_permission_request=PermissionHandler.approve_all,
         )
         events: list[str] = []
-        session.on(lambda evt: events.append(evt.type.value))
+        ordering: list[str] = []
+        waiter_pending: list[bool] = []
+        listener_loops = []
+        loop = asyncio.get_running_loop()
 
-        response = await session.send_and_wait("What is 2+2?")
-        assert response is not None
-        assert response.type.value == "assistant.message"
-        assert "4" in (response.data.content or "")
-        assert "session.idle" in events
-        assert "assistant.message" in events
+        def on_event(event):
+            events.append(event.type.value)
+            if event.type.value == "session.idle" and not event.agent_id:
+                ordering.append("listener entered")
+                listener_loops.append(asyncio.get_running_loop())
+                waiter_pending.append(not send_task.done())
+                # Dispatch is synchronous on the asyncio loop, even though the
+                # JSON-RPC reader is a thread. A blocking gate would deadlock it.
+                ordering.append("listener completed")
 
-        await session.disconnect()
+        unsubscribe = session.on(on_event)
+        try:
+            send_task = asyncio.create_task(session.send_and_wait("What is 2+2?"))
+            response = await send_task
+            ordering.append("wait returned")
+            assert ordering == ["listener entered", "listener completed", "wait returned"]
+            assert waiter_pending == [True]
+            assert listener_loops == [loop]
+            assert response is not None
+            assert response.type.value == "assistant.message"
+            assert "4" in (response.data.content or "")
+            assert "session.idle" in events
+            assert "assistant.message" in events
+        finally:
+            unsubscribe()
+            await session.disconnect()
 
     async def test_sendandwait_throws_on_timeout(self, ctx: E2ETestContext):
         """`send_and_wait` raises TimeoutError when the session does not become idle."""
diff --git a/python/test_client.py b/python/test_client.py
index 775d54a5db..f90b1a1865 100644
--- a/python/test_client.py
+++ b/python/test_client.py
@@ -41,6 +41,12 @@
     ModelSupports,
 )
 from copilot.generated.rpc import AutoTier as AutoTierEnum
+from copilot.generated.rpc import (
+    DiagnosticLogLevel,
+    DiagnosticsConfiguration,
+    DiagnosticSourcesConfiguration,
+    MCPDiagnosticSourceConfiguration,
+)
 from copilot.session import CopilotSession, PermissionHandler
 from copilot.session_events import (
     McpOauthRequestReason,
@@ -296,6 +302,53 @@ async def test_resume_session_allows_none_permission_handler(self):
 
 
 class TestCreateSessionConfig:
+    @pytest.mark.asyncio
+    async def test_diagnostics_forwarded_and_omitted_on_create_and_cold_resume(self):
+        client = CopilotClient(connection=RuntimeConnection.for_stdio(path=CLI_PATH))
+        await client.start()
+        try:
+            captured: list[tuple[str, dict]] = []
+
+            async def mock_request(method, params, **kwargs):
+                captured.append((method, params))
+                result = {"sessionId": params["sessionId"], "workspacePath": None}
+                callback = kwargs.get("on_response_inline")
+                if callback is not None:
+                    callback(result)
+                return result
+
+            client._client.request = mock_request
+            await client.create_session(
+                session_id="diagnostics-create",
+                diagnostics=DiagnosticsConfiguration(
+                    sources=DiagnosticSourcesConfiguration(
+                        mcp=MCPDiagnosticSourceConfiguration(level=DiagnosticLogLevel.DEBUG)
+                    )
+                ),
+            )
+            await client.resume_session(
+                "diagnostics-resume",
+                diagnostics=DiagnosticsConfiguration(
+                    sources=DiagnosticSourcesConfiguration(
+                        mcp=MCPDiagnosticSourceConfiguration(level=DiagnosticLogLevel.TRACE)
+                    )
+                ),
+            )
+            await client.create_session(session_id="diagnostics-default-create")
+            await client.resume_session("diagnostics-default-resume")
+
+            payloads = {(method, params["sessionId"]): params for method, params in captured}
+            assert payloads[("session.create", "diagnostics-create")]["diagnostics"] == {
+                "sources": {"mcp": {"level": "debug"}}
+            }
+            assert payloads[("session.resume", "diagnostics-resume")]["diagnostics"] == {
+                "sources": {"mcp": {"level": "trace"}}
+            }
+            assert "diagnostics" not in payloads[("session.create", "diagnostics-default-create")]
+            assert "diagnostics" not in payloads[("session.resume", "diagnostics-default-resume")]
+        finally:
+            await client.force_stop()
+
     @pytest.mark.asyncio
     async def test_ask_user_variant_forwarded_on_create_and_cold_resume(self):
         client = CopilotClient(connection=RuntimeConnection.for_stdio(path=CLI_PATH))
@@ -623,6 +676,7 @@ def handle_mcp_auth_request(request, invocation):
                             client_secret="static-secret",
                             grant_type="client_credentials",
                             public_client=False,
+                            scope="configured.read",
                         ),
                     ),
                     id="evt-1",
@@ -648,6 +702,7 @@ def handle_mcp_auth_request(request, invocation):
                 "clientSecret": "static-secret",
                 "grantType": "client_credentials",
                 "publicClient": False,
+                "scope": "configured.read",
             }
             assert captured == [
                 (
diff --git a/python/test_connectors.py b/python/test_connectors.py
new file mode 100644
index 0000000000..9c7e63a435
--- /dev/null
+++ b/python/test_connectors.py
@@ -0,0 +1,148 @@
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+
+from copilot.generated.rpc import (
+    ConnectorAccountRequest,
+    ConnectorAvailability,
+    ConnectorConnectRequest,
+    ConnectorConnectResultKind,
+    ConnectorContinueRequest,
+    ConnectorReconcileRequest,
+)
+from copilot.session import CopilotSession
+
+
+@pytest.mark.asyncio
+async def test_session_connectors_exposes_host_lifecycle_api():
+    transport = Mock()
+    transport.request = AsyncMock(side_effect=connector_response)
+    session = CopilotSession("session-1", transport)
+
+    capabilities = await session.rpc.connectors.get_capabilities()
+    assert capabilities.availability is ConnectorAvailability.ENABLED
+    assert (await session.rpc.connectors.get_status()).api_version == 1
+    assert (
+        await session.rpc.connectors.list(ConnectorAccountRequest(account_id="account-1"))
+    ).revision == 1
+    assert (
+        await session.rpc.connectors.refresh(ConnectorAccountRequest(account_id="account-1"))
+    ).revision == 1
+
+    request = ConnectorConnectRequest(account_id="account-1", connector_name="calendar")
+    consent = await session.rpc.connectors.connect(request)
+    assert consent.kind is ConnectorConnectResultKind.CONSENT_REQUIRED
+    assert consent.consent_url == "https://example.com/consent"
+    assert consent.continuation_id == "continuation-1"
+
+    reconnect = await session.rpc.connectors.reconnect(request)
+    assert reconnect.kind is ConnectorConnectResultKind.PENDING
+    assert reconnect.continuation_id == "continuation-1"
+
+    continued = await session.rpc.connectors.continue_connection(
+        ConnectorContinueRequest(
+            continuation_id="continuation-1",
+            max_attempts=3,
+            poll_interval_ms=100,
+            deadline_ms=1_000,
+        )
+    )
+    assert continued.kind is ConnectorConnectResultKind.PENDING
+    assert continued.continuation_id == "continuation-1"
+
+    assert (await session.rpc.connectors.disconnect(request)).disconnected
+    assert (
+        await session.rpc.connectors.reconcile(
+            ConnectorReconcileRequest(account_id="account-1", refresh_catalog=True)
+        )
+    ).api_version == 1
+
+    assert [(call.args[0], call.args[1]) for call in transport.request.await_args_list] == [
+        ("session.connectors.getCapabilities", {"sessionId": "session-1"}),
+        ("session.connectors.getStatus", {"sessionId": "session-1"}),
+        (
+            "session.connectors.list",
+            {"accountId": "account-1", "sessionId": "session-1"},
+        ),
+        (
+            "session.connectors.refresh",
+            {"accountId": "account-1", "sessionId": "session-1"},
+        ),
+        (
+            "session.connectors.connect",
+            {
+                "accountId": "account-1",
+                "connectorName": "calendar",
+                "sessionId": "session-1",
+            },
+        ),
+        (
+            "session.connectors.reconnect",
+            {
+                "accountId": "account-1",
+                "connectorName": "calendar",
+                "sessionId": "session-1",
+            },
+        ),
+        (
+            "session.connectors.continueConnection",
+            {
+                "continuationId": "continuation-1",
+                "deadlineMs": 1_000,
+                "maxAttempts": 3,
+                "pollIntervalMs": 100,
+                "sessionId": "session-1",
+            },
+        ),
+        (
+            "session.connectors.disconnect",
+            {
+                "accountId": "account-1",
+                "connectorName": "calendar",
+                "sessionId": "session-1",
+            },
+        ),
+        (
+            "session.connectors.reconcile",
+            {
+                "accountId": "account-1",
+                "refreshCatalog": True,
+                "sessionId": "session-1",
+            },
+        ),
+    ]
+
+
+def connector_response(method, _params, **_kwargs):
+    if method == "session.connectors.getCapabilities":
+        return {
+            "apiVersion": 1,
+            "availability": "enabled",
+            "consentContinuation": True,
+            "opaqueAccountSelection": True,
+            "maxPollAttempts": 30,
+            "maxPollIntervalMs": 2_000,
+            "maxDeadlineMs": 60_000,
+        }
+    if method in ("session.connectors.list", "session.connectors.refresh"):
+        return {"revision": 1, "refreshedAtMs": 1, "connectors": []}
+    if method == "session.connectors.connect":
+        return {
+            "kind": "consent_required",
+            "consentUrl": "https://example.com/consent",
+            "continuationId": "continuation-1",
+        }
+    if method in ("session.connectors.reconnect", "session.connectors.continueConnection"):
+        return {"kind": "pending", "continuationId": "continuation-1"}
+    if method == "session.connectors.disconnect":
+        return {"disconnected": True, "status": connector_status()}
+    return connector_status()
+
+
+def connector_status():
+    return {
+        "apiVersion": 1,
+        "availability": "enabled",
+        "runtimeServers": [],
+        "pendingConnections": 0,
+    }
diff --git a/python/test_refresh_custom_instructions.py b/python/test_refresh_custom_instructions.py
new file mode 100644
index 0000000000..4d0ce4d21d
--- /dev/null
+++ b/python/test_refresh_custom_instructions.py
@@ -0,0 +1,39 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+import inspect
+from unittest.mock import AsyncMock, Mock
+
+import pytest
+
+from copilot import CopilotClient, RuntimeConnection
+
+
+@pytest.mark.parametrize("refresh", [True, False, None], ids=["true", "false", "omitted"])
+async def test_refresh_custom_instructions_is_create_only(refresh):
+    client = CopilotClient(connection=RuntimeConnection.for_uri("localhost:1234"))
+    request = AsyncMock(return_value={"sessionId": "refresh-instructions"})
+    client._client = Mock(request=request)
+
+    options = {} if refresh is None else {"refresh_custom_instructions": refresh}
+    await client.create_session(session_id="refresh-instructions", **options)
+
+    request.assert_awaited_once()
+    method, payload = request.call_args.args
+    assert method == "session.create"
+    if refresh is None:
+        assert "refreshCustomInstructions" not in payload
+    else:
+        assert payload.get("refreshCustomInstructions") is refresh
+
+    request.reset_mock()
+    await client.resume_session("refresh-instructions")
+
+    request.assert_awaited_once()
+    method, payload = request.call_args.args
+    assert method == "session.resume"
+    assert "refreshCustomInstructions" not in payload
+    assert (
+        "refresh_custom_instructions"
+        not in inspect.signature(CopilotClient.resume_session).parameters
+    )
diff --git a/python/test_rpc_event_log_fixture.py b/python/test_rpc_event_log_fixture.py
new file mode 100644
index 0000000000..fd3c97e0bb
--- /dev/null
+++ b/python/test_rpc_event_log_fixture.py
@@ -0,0 +1,184 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+
+"""Deterministic controls for the event-log E2E scenarios' background-event races."""
+
+import asyncio
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+
+import pytest
+
+from copilot.rpc import EventsCursorStatus, EventsReadResult, SessionsSaveRequest
+from copilot.session_events import (
+    PlanChangedOperation,
+    SessionEventType,
+    SessionPlanChangedData,
+    SessionTitleChangedData,
+)
+from e2e import test_rpc_event_log_e2e as scenario
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("ephemeral", [False, True])
+async def test_tail_scenario_ignores_only_background_ephemeral_events(ephemeral):
+    background = SimpleNamespace(
+        type=SessionEventType.SESSION_INDEXED_SEARCH,
+        ephemeral=ephemeral,
+    )
+    update_plan = AsyncMock()
+    save_session = AsyncMock()
+
+    async def read(request):
+        assert request.cursor == "tail-before-indexing"
+        if save_session.await_count:
+            update_plan.assert_awaited_once()
+            events = [
+                SimpleNamespace(
+                    type=SessionEventType.SESSION_PLAN_CHANGED,
+                    data=SessionPlanChangedData(operation=PlanChangedOperation.CREATE),
+                    ephemeral=False,
+                )
+            ]
+        else:
+            events = [] if ephemeral and request.include_ephemeral is False else [background]
+        return EventsReadResult(
+            cursor="tail-after-indexing",
+            cursor_status=EventsCursorStatus.OK,
+            events=events,
+            has_more=False,
+        )
+
+    session = SimpleNamespace(
+        session_id="tail-session",
+        log=AsyncMock(),
+        rpc=SimpleNamespace(
+            plan=SimpleNamespace(update=update_plan),
+            event_log=SimpleNamespace(
+                tail=AsyncMock(return_value=SimpleNamespace(cursor="tail-before-indexing")),
+                read=read,
+            ),
+        ),
+        disconnect=AsyncMock(),
+    )
+    ctx = SimpleNamespace(
+        client=SimpleNamespace(
+            create_session=AsyncMock(return_value=session),
+            rpc=SimpleNamespace(sessions=SimpleNamespace(save=save_session)),
+        )
+    )
+
+    run = (
+        scenario.TestRpcEventLog().test_should_return_tail_cursor_and_read_empty_when_no_new_events
+    )
+    if ephemeral:
+        await run(ctx)
+        update_plan.assert_awaited_once()
+        save_session.assert_awaited_once_with(SessionsSaveRequest(session_id="tail-session"))
+        session.log.assert_awaited_once_with("Ephemeral event after tail", ephemeral=True)
+    else:
+        with pytest.raises(AssertionError):
+            await run(ctx)
+
+    session.disconnect.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("background_wakeups", [0, 2])
+async def test_filtered_long_poll_scenario_continues_after_unmatched_events(background_wakeups):
+    expected_title = None
+    cursors = ["initial-tail", *[f"background-{i}" for i in range(background_wakeups)]]
+    reads = []
+
+    async def set_name(request):
+        nonlocal expected_title
+        expected_title = request.name
+
+    async def read(request):
+        index = len(reads)
+        assert request.cursor == cursors[index]
+        assert request.types == ["session.title_changed"]
+        assert request.wait_ms == 5000
+        reads.append(request)
+        if index < background_wakeups:
+            return EventsReadResult(
+                cursor=cursors[index + 1],
+                cursor_status=EventsCursorStatus.OK,
+                events=[],
+                has_more=False,
+            )
+        assert expected_title is not None
+        return EventsReadResult(
+            cursor="after-title",
+            cursor_status=EventsCursorStatus.OK,
+            events=[
+                SimpleNamespace(
+                    type=SessionEventType.SESSION_TITLE_CHANGED,
+                    data=SessionTitleChangedData(title=expected_title),
+                )
+            ],
+            has_more=False,
+        )
+
+    session = SimpleNamespace(
+        rpc=SimpleNamespace(
+            name=SimpleNamespace(set=set_name),
+            event_log=SimpleNamespace(
+                tail=AsyncMock(return_value=SimpleNamespace(cursor=cursors[0])),
+                read=read,
+            ),
+        ),
+        disconnect=AsyncMock(),
+    )
+    ctx = SimpleNamespace(client=SimpleNamespace(create_session=AsyncMock(return_value=session)))
+
+    await (
+        scenario.TestRpcEventLog().test_should_long_poll_with_types_filter_for_title_changed_event(
+            ctx
+        )
+    )
+
+    assert len(reads) == background_wakeups + 1
+    session.disconnect.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+async def test_filtered_long_poll_scenario_cancels_reader_on_name_set_failure():
+    read_started = asyncio.Event()
+    read_cancelled = asyncio.Event()
+    reader = None
+
+    async def read(_request):
+        nonlocal reader
+        reader = asyncio.current_task()
+        read_started.set()
+        try:
+            await asyncio.Future()
+        finally:
+            read_cancelled.set()
+
+    async def set_name(_request):
+        await read_started.wait()
+        raise RuntimeError("controlled name.set failure")
+
+    session = SimpleNamespace(
+        rpc=SimpleNamespace(
+            name=SimpleNamespace(set=set_name),
+            event_log=SimpleNamespace(
+                tail=AsyncMock(return_value=SimpleNamespace(cursor="tail")),
+                read=read,
+            ),
+        ),
+        disconnect=AsyncMock(),
+    )
+    ctx = SimpleNamespace(client=SimpleNamespace(create_session=AsyncMock(return_value=session)))
+
+    suite = scenario.TestRpcEventLog()
+    try:
+        with pytest.raises(RuntimeError, match="controlled name.set failure"):
+            await suite.test_should_long_poll_with_types_filter_for_title_changed_event(ctx)
+        assert read_cancelled.is_set()
+        session.disconnect.assert_awaited_once()
+    finally:
+        if reader is not None:
+            reader.cancel()
+            await asyncio.gather(reader, return_exceptions=True)
diff --git a/python/test_rpc_generated.py b/python/test_rpc_generated.py
index a21dcc0b6e..84979470c3 100644
--- a/python/test_rpc_generated.py
+++ b/python/test_rpc_generated.py
@@ -1,5 +1,6 @@
 """Tests for generated RPC method behavior."""
 
+import inspect
 import json
 from unittest.mock import AsyncMock
 
@@ -11,6 +12,7 @@
     CommandsInvokeRequest,
     CommandsRespondToQueuedCommandRequest,
     LocalSessionMetadataValue,
+    MCPServerConfigHTTP,
     QueuedCommandHandled,
     QueuedCommandNotHandled,
     RemoteControlStatusOff,
@@ -32,6 +34,23 @@ def test_sandbox_config_round_trips_allow_bypass_and_omits_when_absent():
     assert SandboxConfig(enabled=True).to_dict() == {"enabled": True}
 
 
+def test_mcp_oauth_scopes_preserve_existing_positional_parameters():
+    parameters = inspect.signature(MCPServerConfigHTTP).parameters
+
+    assert parameters["oauth_scopes"].kind is inspect.Parameter.KEYWORD_ONLY
+    assert parameters["oidc"].kind is inspect.Parameter.POSITIONAL_OR_KEYWORD
+
+    config = MCPServerConfigHTTP.from_dict(
+        {
+            "url": "https://example.test/mcp",
+            "oauthScopes": ["tools:read", "resources:read"],
+            "oidc": True,
+        }
+    )
+    assert config.oauth_scopes == ["tools:read", "resources:read"]
+    assert config.oidc is True
+
+
 @pytest.mark.asyncio
 async def test_commands_invoke_deserializes_slash_command_result():
     client = AsyncMock()
diff --git a/python/test_session.py b/python/test_session.py
index 5750364bb5..d194d68c11 100644
--- a/python/test_session.py
+++ b/python/test_session.py
@@ -453,6 +453,49 @@ async def test_send_and_wait_skips_autopilot_continuation_idle():
     assert result.data.content == "final"
 
 
+@pytest.mark.asyncio
+async def test_send_and_wait_ignores_child_events():
+    client = Mock()
+    sent = asyncio.Event()
+
+    async def respond(method, params):
+        assert method == "session.send"
+        sent.set()
+        return {"messageId": "message-1"}
+
+    client.request = AsyncMock(side_effect=respond)
+    session = CopilotSession("session-1", client)
+    received = []
+    session.on(received.append)
+    pending = asyncio.create_task(session.send_and_wait("delegate", timeout=1))
+    try:
+        await asyncio.wait_for(sent.wait(), timeout=1)
+
+        child_message = _event(
+            AssistantMessageData(content="child reply", message_id="child-message"),
+            SessionEventType.ASSISTANT_MESSAGE,
+        )
+        child_message.agent_id = "child-1"
+        child_error = _event(
+            SessionErrorData(error_type="query", message="child failed"),
+            SessionEventType.SESSION_ERROR,
+        )
+        child_error.agent_id = "child-1"
+        child_idle = _event(SessionIdleData(), SessionEventType.SESSION_IDLE)
+        child_idle.agent_id = "child-1"
+        for event in (child_message, child_error, child_idle):
+            session._dispatch_event(event)
+        assert received == [child_message, child_error, child_idle]
+        await asyncio.sleep(0)
+        assert not pending.done()
+
+        session._dispatch_event(_event(SessionIdleData(), SessionEventType.SESSION_IDLE))
+        assert await asyncio.wait_for(pending, timeout=1) is None
+    finally:
+        pending.cancel()
+        await asyncio.gather(pending, return_exceptions=True)
+
+
 @pytest.mark.asyncio
 async def test_external_tool_completed_cancels_blocked_handler():
     client = Mock()
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 052413f511..31d534820a 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -10,37 +10,22 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "anyhow"
-version = "1.0.102"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
-
-[[package]]
-name = "arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "async-trait"
-version = "0.1.89"
+version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -55,11 +40,23 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bitflags"
-version = "2.11.1"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "block-buffer"
@@ -72,27 +69,21 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
-
-[[package]]
-name = "byteorder"
-version = "1.5.0"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "bytes"
-version = "1.11.1"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cc"
-version = "1.2.61"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
+checksum = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -100,9 +91,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
 [[package]]
 name = "core-foundation"
@@ -131,19 +122,13 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.5.0"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
 dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
-
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -156,19 +141,18 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.11.0"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
 [[package]]
-name = "derive_arbitrary"
-version = "1.4.2"
+name = "der"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+checksum = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "pem-rfc7468",
+ "zeroize",
 ]
 
 [[package]]
@@ -204,13 +188,13 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -249,35 +233,35 @@ checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
 [[package]]
 name = "fastrand"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "filetime"
-version = "0.2.27"
+version = "0.2.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
 dependencies = [
  "cfg-if",
  "libc",
- "libredox",
 ]
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.9"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+checksum = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b"
 
 [[package]]
 name = "flate2"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -286,12 +270,6 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
-[[package]]
-name = "foldhash"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
-
 [[package]]
 name = "foldhash"
 version = "0.2.0"
@@ -324,24 +302,24 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
  "futures-core",
 ]
 
 [[package]]
 name = "futures-core"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -350,38 +328,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
 
 [[package]]
 name = "futures-task"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
 [[package]]
 name = "futures-util"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-core",
  "futures-io",
@@ -416,15 +394,25 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.4.2"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 5.3.0",
  "wasip2",
- "wasip3",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
 ]
 
 [[package]]
@@ -432,12 +420,12 @@ name = "github-copilot-sdk"
 version = "0.0.0-dev"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.23.1",
  "bytes",
  "dirs",
  "flate2",
  "futures-util",
- "getrandom 0.2.17",
+ "getrandom 0.4.3",
  "http",
  "indexmap",
  "libloading",
@@ -466,9 +454,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.15"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -483,31 +471,22 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.15.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash 0.1.5",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
- "foldhash 0.2.0",
+ "foldhash",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.17.0"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
- "foldhash 0.2.0",
+ "foldhash",
 ]
 
 [[package]]
@@ -516,20 +495,14 @@ version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a596f1b20ed2cc5ecac41a164aaebc7258057060f06c0cf7a2ba3991ee7990fb"
 dependencies = [
- "hashbrown 0.17.0",
+ "hashbrown 0.17.1",
 ]
 
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
 [[package]]
 name = "http"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
 dependencies = [
  "bytes",
  "itoa",
@@ -537,9 +510,9 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "1.0.1"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
  "bytes",
  "http",
@@ -547,9 +520,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.3"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
 dependencies = [
  "bytes",
  "futures-core",
@@ -566,9 +539,9 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "hyper"
-version = "1.10.1"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -587,9 +560,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.9"
+version = "0.27.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
 dependencies = [
  "http",
  "hyper",
@@ -622,7 +595,7 @@ version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-util",
@@ -641,9 +614,9 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -655,9 +628,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -668,9 +641,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -682,16 +655,17 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
 [[package]]
 name = "icu_properties"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
+ "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
@@ -702,15 +676,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.2.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -721,12 +695,6 @@ dependencies = [
  "zerovec",
 ]
 
-[[package]]
-name = "id-arena"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
-
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -750,21 +718,21 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.14.0"
+version = "2.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.0",
+ "hashbrown 0.17.1",
  "serde",
  "serde_core",
 ]
 
 [[package]]
 name = "ipnet"
-version = "2.12.0"
+version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "itoa"
@@ -774,32 +742,26 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.102"
+version = "0.3.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
+checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e"
 dependencies = [
  "cfg-if",
  "futures-util",
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libloading"
-version = "0.8.9"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+checksum = "754ca22de805bb5744484a5b151a9e1a8e837d5dc232c2d7d8c2e3492edc8b60"
 dependencies = [
  "cfg-if",
  "windows-link",
@@ -807,14 +769,11 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.16"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
+checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
 dependencies = [
- "bitflags",
  "libc",
- "plain",
- "redox_syscall 0.7.4",
 ]
 
 [[package]]
@@ -836,9 +795,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
 
 [[package]]
 name = "lock_api"
@@ -851,21 +810,21 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.9"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
 dependencies = [
  "adler2",
  "simd-adler32",
@@ -873,9 +832,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.0"
+version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
 dependencies = [
  "libc",
  "wasi",
@@ -927,7 +886,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -972,11 +931,20 @@ checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
 dependencies = [
  "cfg-if",
  "libc",
- "redox_syscall 0.5.18",
+ "redox_syscall",
  "smallvec",
  "windows-link",
 ]
 
+[[package]]
+name = "pem-rfc7468"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -991,21 +959,15 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
-
-[[package]]
-name = "plain"
-version = "0.2.3"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
 [[package]]
 name = "potential_utf"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
  "zerovec",
 ]
@@ -1019,34 +981,30 @@ dependencies = [
  "zerocopy",
 ]
 
-[[package]]
-name = "prettyplease"
-version = "0.2.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
-dependencies = [
- "proc-macro2",
- "syn",
-]
-
 [[package]]
 name = "proc-macro2"
-version = "1.0.106"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.45"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "r-efi"
 version = "6.0.0"
@@ -1055,20 +1013,19 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.8.6"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
- "libc",
  "rand_chacha",
  "rand_core",
 ]
 
 [[package]]
 name = "rand_chacha"
-version = "0.3.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
  "rand_core",
@@ -1076,11 +1033,11 @@ dependencies = [
 
 [[package]]
 name = "rand_core"
-version = "0.6.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
 dependencies = [
- "getrandom 0.2.17",
+ "getrandom 0.3.4",
 ]
 
 [[package]]
@@ -1092,15 +1049,6 @@ dependencies = [
  "bitflags",
 ]
 
-[[package]]
-name = "redox_syscall"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f450ad9c3b1da563fb6948a8e0fb0fb9269711c9c73d9ea1de5058c79c8d643a"
-dependencies = [
- "bitflags",
-]
-
 [[package]]
 name = "redox_users"
 version = "0.4.6"
@@ -1114,29 +1062,29 @@ dependencies = [
 
 [[package]]
 name = "ref-cast"
-version = "1.0.25"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.25"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1146,9 +1094,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1157,17 +1105,17 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "reqwest"
-version = "0.12.28"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "bytes",
  "futures-core",
  "futures-util",
@@ -1185,9 +1133,6 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
  "sync_wrapper",
  "tokio",
  "tokio-native-tls",
@@ -1223,7 +1168,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
 dependencies = [
  "hashbrown 0.16.1",
- "thiserror 2.0.18",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -1243,9 +1188,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
 dependencies = [
  "bitflags",
  "errno",
@@ -1256,9 +1201,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.40"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "once_cell",
  "rustls-pki-types",
@@ -1269,18 +1214,18 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.14.1"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
  "zeroize",
 ]
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -1289,24 +1234,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
-
-[[package]]
-name = "ryu"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
-
-[[package]]
-name = "scc"
-version = "2.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
-dependencies = [
- "sdd",
-]
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
 name = "schannel"
@@ -1319,9 +1249,9 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
 dependencies = [
  "dyn-clone",
  "ref-cast",
@@ -1332,14 +1262,14 @@ dependencies = [
 
 [[package]]
 name = "schemars_derive"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f"
+checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba"
 dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1348,12 +1278,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "sdd"
-version = "3.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
-
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -1377,17 +1301,11 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "semver"
-version = "1.0.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
-
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -1395,40 +1313,40 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "serde_derive_internals"
-version = "0.29.1"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
+checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
@@ -1437,49 +1355,36 @@ dependencies = [
  "zmij",
 ]
 
-[[package]]
-name = "serde_urlencoded"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
-dependencies = [
- "form_urlencoded",
- "itoa",
- "ryu",
- "serde",
-]
-
 [[package]]
 name = "serial_test"
-version = "3.4.0"
+version = "4.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
+checksum = "a6df5ed973ad8d834e09f824f9e9f449af6b9a3745f78dec7cc752770bd3bf11"
 dependencies = [
  "futures-executor",
  "futures-util",
  "log",
  "once_cell",
  "parking_lot",
- "scc",
  "serial_test_derive",
 ]
 
 [[package]]
 name = "serial_test_derive"
-version = "3.4.0"
+version = "4.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
+checksum = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "sha1"
-version = "0.10.6"
+version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
 dependencies = [
  "cfg-if",
  "cpufeatures",
@@ -1499,9 +1404,9 @@ dependencies = [
 
 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "signal-hook-registry"
@@ -1515,9 +1420,9 @@ dependencies = [
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.9"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
 
 [[package]]
 name = "slab"
@@ -1527,15 +1432,15 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
 
 [[package]]
 name = "socket2"
-version = "0.6.3"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
  "windows-sys 0.61.2",
@@ -1567,9 +1472,20 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.117"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1587,13 +1503,13 @@ dependencies = [
 
 [[package]]
 name = "synstructure"
-version = "0.13.2"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1614,7 +1530,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -1631,11 +1547,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "thiserror-impl 2.0.18",
+ "thiserror-impl 2.0.20",
 ]
 
 [[package]]
@@ -1646,25 +1562,25 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "tinystr"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -1672,9 +1588,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.52.1"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67dee974fe86fd92cc45b7a95fdd2f99a36a6d7b0d431a231178d3d670bbcc6"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
@@ -1688,13 +1604,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.7.0"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1709,9 +1625,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.4"
+version = "0.26.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+checksum = "b0c85f2c3ef0b1cd58b36682f4b17aaa995f0e5db534d85692b4903abce21f67"
 dependencies = [
  "rustls",
  "tokio",
@@ -1719,9 +1635,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -1731,9 +1647,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.24.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
 dependencies = [
  "futures-util",
  "log",
@@ -1745,13 +1661,14 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.18"
+version = "0.7.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
+ "libc",
  "pin-project-lite",
  "tokio",
 ]
@@ -1820,7 +1737,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1840,11 +1757,10 @@ checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
 name = "tungstenite"
-version = "0.24.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
 dependencies = [
- "byteorder",
  "bytes",
  "data-encoding",
  "http",
@@ -1853,27 +1769,27 @@ dependencies = [
  "native-tls",
  "rand",
  "sha1",
- "thiserror 1.0.69",
+ "thiserror 2.0.20",
  "utf-8",
 ]
 
 [[package]]
-name = "typenum"
-version = "1.20.0"
+name = "typed-path"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
 
 [[package]]
-name = "unicode-ident"
-version = "1.0.24"
+name = "typenum"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
-name = "unicode-xid"
-version = "0.2.6"
+name = "unicode-ident"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
 [[package]]
 name = "untrusted"
@@ -1883,15 +1799,31 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "ureq"
-version = "2.12.1"
+version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
+checksum = "9a7ac20be9b7726e0bbdbf974c059676d9acb1cd414961f570a4e8231cacd7fc"
 dependencies = [
- "base64",
+ "base64 0.23.1",
+ "der",
  "log",
  "native-tls",
- "once_cell",
- "url",
+ "percent-encoding",
+ "rustls-pki-types",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-root-certs",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f86fd172ccca569e458f61b6bdd6220965a9ef36e672a6852953b51a0e1583be"
+dependencies = [
+ "base64 0.23.1",
+ "http",
+ "httparse",
+ "log",
 ]
 
 [[package]]
@@ -1912,6 +1844,12 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -1920,11 +1858,11 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.23.1"
+version = "1.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
 dependencies = [
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
 ]
 
 [[package]]
@@ -1956,27 +1894,18 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.3+wasi-0.2.9"
+version = "1.0.4+wasi-0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
 dependencies = [
- "wit-bindgen 0.57.1",
-]
-
-[[package]]
-name = "wasip3"
-version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
-dependencies = [
- "wit-bindgen 0.51.0",
+ "wit-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.125"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
+checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -1987,9 +1916,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.75"
+version = "0.4.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "503b14d284f2c8dac03b819967e155ea753f573586193b2b2c95990cb5d69280"
+checksum = "6ef4c5d3d2cdf5c54f4231181768f5510842e350db025faf1f7163b1030ed928"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -1997,9 +1926,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.125"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
+checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -2007,53 +1936,31 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.125"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
+checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.125"
+version = "0.2.128"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
+checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e"
 dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "wasm-encoder"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
-dependencies = [
- "leb128fmt",
- "wasmparser",
-]
-
-[[package]]
-name = "wasm-metadata"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
-dependencies = [
- "anyhow",
- "indexmap",
- "wasm-encoder",
- "wasmparser",
-]
-
 [[package]]
 name = "wasm-streams"
-version = "0.4.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
 dependencies = [
  "futures-util",
  "js-sys",
@@ -2063,25 +1970,22 @@ dependencies = [
 ]
 
 [[package]]
-name = "wasmparser"
-version = "0.244.0"
+name = "web-sys"
+version = "0.3.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+checksum = "9fbddc4a036f00ec4f18c83445bd3115cb306a91da554919a099d9222fe4a7f8"
 dependencies = [
- "bitflags",
- "hashbrown 0.15.5",
- "indexmap",
- "semver",
+ "js-sys",
+ "wasm-bindgen",
 ]
 
 [[package]]
-name = "web-sys"
-version = "0.3.102"
+name = "webpki-root-certs"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
 dependencies = [
- "js-sys",
- "wasm-bindgen",
+ "rustls-pki-types",
 ]
 
 [[package]]
@@ -2238,105 +2142,17 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "wit-bindgen"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
-dependencies = [
- "wit-bindgen-rust-macro",
-]
-
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
-[[package]]
-name = "wit-bindgen-core"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
-dependencies = [
- "anyhow",
- "heck",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-bindgen-rust"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
-dependencies = [
- "anyhow",
- "heck",
- "indexmap",
- "prettyplease",
- "syn",
- "wasm-metadata",
- "wit-bindgen-core",
- "wit-component",
-]
-
-[[package]]
-name = "wit-bindgen-rust-macro"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
-dependencies = [
- "anyhow",
- "prettyplease",
- "proc-macro2",
- "quote",
- "syn",
- "wit-bindgen-core",
- "wit-bindgen-rust",
-]
-
-[[package]]
-name = "wit-component"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
-dependencies = [
- "anyhow",
- "bitflags",
- "indexmap",
- "log",
- "serde",
- "serde_derive",
- "serde_json",
- "wasm-encoder",
- "wasm-metadata",
- "wasmparser",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-parser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
-dependencies = [
- "anyhow",
- "id-arena",
- "indexmap",
- "log",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "unicode-xid",
- "wasmparser",
-]
-
 [[package]]
 name = "writeable"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
 [[package]]
 name = "xattr"
@@ -2350,9 +2166,9 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -2361,68 +2177,68 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+checksum = "33811428bee40dbceb6d545e95754741d17a6aef9a4849f0fd62e2ba4f412a78"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.52"
+version = "0.8.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+checksum = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.52"
+version = "0.8.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+checksum = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "zerofrom"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
  "synstructure",
 ]
 
 [[package]]
 name = "zeroize"
-version = "1.8.2"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
 [[package]]
 name = "zerotrie"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -2431,9 +2247,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.6"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -2442,37 +2258,40 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.3"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "zip"
-version = "2.4.2"
+version = "7.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
+checksum = "c42e33efc22a0650c311c2ef19115ce232583abbe80850bc8b66509ebef02de0"
 dependencies = [
- "arbitrary",
  "crc32fast",
- "crossbeam-utils",
- "displaydoc",
  "flate2",
  "indexmap",
  "memchr",
- "thiserror 2.0.18",
+ "typed-path",
  "zopfli",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
+
 [[package]]
 name = "zmij"
-version = "1.0.21"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
 [[package]]
 name = "zopfli"
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index dafa023b36..22cc081fd8 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -54,24 +54,24 @@ tokio-stream = { version = "0.1", features = ["sync"] }
 tokio-util = { version = "0.7", default-features = false }
 tracing = "0.1"
 dirs = "5"
-libloading = { version = "0.8", optional = true }
+libloading = { version = "0.9", optional = true }
 parking_lot = "0.12"
 regex = "1"
-getrandom = "0.2"
+getrandom = "0.4"
 uuid = { version = "1", default-features = false, features = ["v4"] }
 flate2 = { version = "1", optional = true }
 tar = { version = "0.4", optional = true }
 # LLM inference callback transport: idiomatic HTTP/WebSocket forwarding for the
 # `CopilotRequestHandler`, plus base64/byte/stream plumbing for the chunk protocol.
-base64 = "0.22"
+base64 = "0.23"
 bytes = "1"
 http = "1"
 futures-util = "0.3"
-reqwest = { version = "0.12", default-features = false, features = ["stream", "http2", "default-tls"] }
-tokio-tungstenite = { version = "0.24", default-features = false, features = ["connect", "native-tls"] }
+reqwest = { version = "0.13", default-features = false, features = ["stream", "http2", "native-tls"] }
+tokio-tungstenite = { version = "0.28.0", default-features = false, features = ["connect", "native-tls"] }
 
 [target.'cfg(windows)'.dependencies]
-zip = { version = "2", default-features = false, features = ["deflate"], optional = true }
+zip = { version = "7.2.0", default-features = false, features = ["deflate"], optional = true }
 windows-sys = { version = "0.61", default-features = false, features = [
     "Win32_Foundation",
     "Win32_System_Diagnostics_ToolHelp",
@@ -80,9 +80,10 @@ windows-sys = { version = "0.61", default-features = false, features = [
 ] }
 
 [dev-dependencies]
+ureq = { version = "3", default-features = false, features = ["native-tls"] }
 rusqlite = { version = "0.40", features = ["bundled"] }
 schemars = "1"
-serial_test = "3"
+serial_test = "4"
 tempfile = "3"
 tokio = { version = "1", features = ["rt-multi-thread"] }
 
@@ -126,9 +127,10 @@ required-features = ["test-support"]
 [build-dependencies]
 dirs = "5"
 flate2 = "1"
+native-tls = "0.2"
 serde_json = "1"
+# 0.11 adds a second digest/block-buffer stack beside the SDK's transitive 0.10.
 sha2 = "0.10"
 tar = "0.4"
-ureq = { version = "2", default-features = false, features = ["native-tls"] }
-native-tls = "0.2"
-zip = { version = "2", default-features = false, features = ["deflate"] }
+ureq = { version = "3", default-features = false, features = ["native-tls"] }
+zip = { version = "7.2.0", default-features = false, features = ["deflate"] }
diff --git a/rust/README.md b/rust/README.md
index 36d6ddff80..5c8f701216 100644
--- a/rust/README.md
+++ b/rust/README.md
@@ -722,9 +722,15 @@ When streaming is off (the default), only the final `assistant.message` and `ass
 
 #### Subscribing before the session starts
 
-`session.subscribe()` can only be called once the session exists, so any event the runtime emits while `session.create` / `session.resume` is still in flight is broadcast with no receiver installed and is not delivered. Ephemeral events such as `session.idle` are not written to the session log either, so `get_messages` can't recover them afterwards.
+`session.subscribe()` can only be called once the session exists. On create, events dispatched before a subscriber is installed are not delivered. Ephemeral events such as `session.idle` are not written to the session log either, so `get_messages` can't recover them afterwards.
 
-`Client::prepare_session` / `Client::prepare_resume_session` close that window. They return a `PreparedSession` that owns the session's broadcast channel up front:
+On resume with no active prepared subscriber, the SDK instead retains all routed startup events, durable and ephemeral, in an ordered bootstrap queue. The first `session.subscribe()` call claims that queue synchronously, even before the subscription is polled. It receives the complete prefix and any events dispatched while catching up, then atomically switches to bounded live delivery. Later subscribers receive newly dispatched live events immediately, even while the owner is draining.
+
+**The resume bootstrap is unbounded until its owner catches up.** Subscribe and drain promptly: a caller that never subscribes or cannot catch up can retain arbitrarily many events. Dropping the owner discards its unread backlog without transferring it to another subscriber. Stopping the session event loop releases an unclaimed backlog; a claimed backlog can still drain after shutdown without keeping the sender alive. This guarantee covers events routed to the session, not overflow in the bounded client-global notification router.
+
+For create and resume calls with a client-known session ID, the SDK starts its event loop before sending the RPC so it can answer session-scoped requests issued during startup. Cloud creates with a server-assigned ID register the loop after the response identifies the session.
+
+`Client::prepare_session` / `Client::prepare_resume_session` let observers subscribe before protocol activity begins, including multiple startup observers. They return a `PreparedSession` that owns the session's broadcast channel up front:
 
 ```rust,ignore
 let prepared = client.prepare_session(
@@ -744,11 +750,11 @@ let session = prepared.start().await?;
 
 `prepare_*` is synchronous and inert — it validates the buffer capacity, allocates a local channel and cancellation token, and touches neither the router nor the transport until `start()` is first polled. `start(self)` consumes the handle and `PreparedSession` is deliberately not `Clone`, so a prepared session can never spawn two event loops. Dropping an unstarted handle leaves no state and closes its subscriptions; dropping the `start()` future cancels the startup, unregisters the session, and lets a same-ID retry succeed. Cleanup removes only the exact registration that startup owned, so a retry started while an abandoned attempt is still unwinding is never evicted by it.
 
-The buffer is finite — `session::DEFAULT_EVENT_BUFFER_CAPACITY` (512) unless `event_buffer_capacity` overrides it, and `Some(0)` is rejected as `ErrorKind::InvalidConfig` rather than clamped. Subscribers that fall behind observe `RecvErrorKind::Lagged` with the skipped count instead of applying backpressure, so a consumer that needs a lossless view of a large startup burst must configure enough capacity or drain concurrently with `start()`.
+Prepared subscriptions and live delivery use a finite buffer — `session::DEFAULT_EVENT_BUFFER_CAPACITY` (512) unless `event_buffer_capacity` overrides it, and `Some(0)` is rejected as `ErrorKind::InvalidConfig` rather than clamped. Subscribers that fall behind observe `RecvErrorKind::Lagged` with the skipped count instead of applying backpressure, so a prepared consumer that needs a lossless view of a large startup burst must configure enough capacity or drain concurrently with `start()`. An active prepared subscriber disables the implicit resume bootstrap; a resume started without one uses the one-shot bootstrap described above.
 
 For cloud sessions where the server assigns the session ID, notifications can't be routed until the create response arrives; the guarantee is that *routed* events are never dropped for lack of a receiver. Pin `session_id` for full pre-response coverage.
 
-`create_session` / `resume_session` are unchanged wrappers over `prepare_*(...)?.start()`, with identical RPC sequences and error kinds.
+`create_session` / `resume_session` remain wrappers over `prepare_*(...)?.start()`, with unchanged RPC sequences and error kinds.
 
 ### Infinite Sessions
 
@@ -865,7 +871,7 @@ For fire-and-forget messaging where you need to block until the agent finishes:
 use std::time::Duration;
 use github_copilot_sdk::MessageOptions;
 
-// Sends a message and blocks until session.idle or session.error
+// Sends a message and blocks until the root session.idle or session.error
 session
     .send_and_wait(
         MessageOptions::new("Fix the bug").with_wait_timeout(Duration::from_secs(120)),
@@ -874,7 +880,11 @@ session
 ```
 
 Default timeout is 60 seconds. Only one unformatted `send_and_wait` can be active
-per session; it also prevents other sends until it completes.
+per session; it also prevents other sends until it completes. Events attributed
+to a sub-agent (with a non-empty `agentId`) are still delivered to subscribers,
+but cannot supply the reply or end the parent's wait.
+The terminal event is queued to existing subscriptions before the wait returns;
+subscribers consume their streams independently and do not delay completion.
 
 ### Structured output (experimental)
 
@@ -1033,10 +1043,10 @@ none of them are scheduled for removal.
   without string-splicing.
 - **`Client::prepare_session` / `prepare_resume_session`** — return an inert
   `PreparedSession` whose `subscribe()` installs an event receiver before any
-  protocol activity, so startup events (including ephemeral `session.idle`)
-  aren't dropped. Other SDKs register callbacks on a config object instead,
-  which sidesteps the problem in a way Rust's broadcast-based `subscribe()`
-  cannot.
+  protocol activity, including multiple startup observers, subject to bounded
+  delivery. Without a prepared observer, resume retains routed events for the
+  first `Session::subscribe()` owner until it catches up; create remains
+  live-only. Other SDKs install event callbacks before session startup.
 
 ## Layout
 
@@ -1278,21 +1288,19 @@ github-copilot-sdk = { version = "1", features = ["derive"] }
 
 ## Development
 
-Follow [SDK development setup](../CONTRIBUTING.md#developing-an-sdk) for this
-crate's pinned Rust toolchain, nightly formatter, and Node/replay-harness
-dependencies. From the SDK root (`src/sdk` in the runtime repository, or the
-standalone repository root):
+Tests require a supported [Node.js version](../nodejs/README.md#prerequisites). From the repository root:
+
+```bash
+cd nodejs
+npm ci
+```
 
 ```bash
-npm run build:rust
-npm run test:rust
-npm run check:rust
+cd test/harness
+npm ci
 ```
 
-The runtime layout builds this SDK through Bazel but runs tests through Cargo
-with this crate's toolchain and default features plus `test-support`. For
-non-default `derive` or in-process coverage, use the feature selections in the
-[Rust SDK workflow](../.github/workflows/sdk-rust.yml). Direct native commands bypass the
-facade's runtime preparation; see [AGENTS.md](AGENTS.md#development) for
-same-checkout feature selection and standalone Cargo commands. Runtime paths
-set by the facade do not persist in your shell.
+```bash
+cd rust
+cargo test --features test-support
+```
diff --git a/rust/bazel/BUILD.bazel b/rust/bazel/BUILD.bazel
index 79f3ae0314..2cd5e0eff5 100644
--- a/rust/bazel/BUILD.bazel
+++ b/rust/bazel/BUILD.bazel
@@ -22,7 +22,7 @@ crates_vendor(
         # workspace graph, but required by the Bazel all-features build.
         "sdk-libloading": crate.spec(
             package = "libloading",
-            version = "=0.8.9",
+            version = "=0.9.0",
         ),
     },
     repository_name = "sdk_vendor",
diff --git a/rust/bazel/crates/BUILD.aho-corasick-1.1.4.bazel b/rust/bazel/crates/BUILD.aho-corasick-1.1.5.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.aho-corasick-1.1.4.bazel
rename to rust/bazel/crates/BUILD.aho-corasick-1.1.5.bazel
index 66a3b7fab1..88050dbd89 100644
--- a/rust/bazel/crates/BUILD.aho-corasick-1.1.4.bazel
+++ b/rust/bazel/crates/BUILD.aho-corasick-1.1.5.bazel
@@ -62,8 +62,8 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.1.4",
+    version = "1.1.5",
     deps = [
-        "@sdk_vendor__memchr-2.8.0//:memchr",
+        "@sdk_vendor__memchr-2.8.3//:memchr",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.arbitrary-1.4.2.bazel b/rust/bazel/crates/BUILD.arbitrary-1.4.2.bazel
deleted file mode 100644
index e6cd4a240c..0000000000
--- a/rust/bazel/crates/BUILD.arbitrary-1.4.2.bazel
+++ /dev/null
@@ -1,62 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "arbitrary",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=arbitrary",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "1.4.2",
-)
diff --git a/rust/bazel/crates/BUILD.async-trait-0.1.89.bazel b/rust/bazel/crates/BUILD.async-trait-0.1.92.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.async-trait-0.1.89.bazel
rename to rust/bazel/crates/BUILD.async-trait-0.1.92.bazel
index 8c310dc54f..cdd5ed3f1b 100644
--- a/rust/bazel/crates/BUILD.async-trait-0.1.89.bazel
+++ b/rust/bazel/crates/BUILD.async-trait-0.1.92.bazel
@@ -58,10 +58,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.1.89",
+    version = "0.1.92",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.base64-0.23.1.bazel b/rust/bazel/crates/BUILD.base64-0.23.1.bazel
new file mode 100644
index 0000000000..175eddebad
--- /dev/null
+++ b/rust/bazel/crates/BUILD.base64-0.23.1.bazel
@@ -0,0 +1,68 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "base64",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "alloc",
+        "default",
+        "simd-unsafe",
+        "std",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=base64",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.23.1",
+)
diff --git a/rust/bazel/crates/BUILD.base64ct-1.8.3.bazel b/rust/bazel/crates/BUILD.base64ct-1.8.3.bazel
new file mode 100644
index 0000000000..148880ff04
--- /dev/null
+++ b/rust/bazel/crates/BUILD.base64ct-1.8.3.bazel
@@ -0,0 +1,65 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "base64ct",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "alloc",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2024",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=base64ct",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "1.8.3",
+)
diff --git a/rust/bazel/crates/BUILD.bazel b/rust/bazel/crates/BUILD.bazel
index 3ee3e9c870..9ffb64364d 100644
--- a/rust/bazel/crates/BUILD.bazel
+++ b/rust/bazel/crates/BUILD.bazel
@@ -32,38 +32,38 @@ filegroup(
 
 # Workspace Member Dependencies
 alias(
-    name = "async-trait-0.1.89",
-    actual = "@sdk_vendor__async-trait-0.1.89//:async_trait",
+    name = "async-trait-0.1.92",
+    actual = "@sdk_vendor__async-trait-0.1.92//:async_trait",
     tags = ["manual"],
 )
 
 alias(
     name = "async-trait",
-    actual = "@sdk_vendor__async-trait-0.1.89//:async_trait",
+    actual = "@sdk_vendor__async-trait-0.1.92//:async_trait",
     tags = ["manual"],
 )
 
 alias(
-    name = "base64-0.22.1",
-    actual = "@sdk_vendor__base64-0.22.1//:base64",
+    name = "base64-0.23.1",
+    actual = "@sdk_vendor__base64-0.23.1//:base64",
     tags = ["manual"],
 )
 
 alias(
     name = "base64",
-    actual = "@sdk_vendor__base64-0.22.1//:base64",
+    actual = "@sdk_vendor__base64-0.23.1//:base64",
     tags = ["manual"],
 )
 
 alias(
-    name = "bytes-1.11.1",
-    actual = "@sdk_vendor__bytes-1.11.1//:bytes",
+    name = "bytes-1.12.1",
+    actual = "@sdk_vendor__bytes-1.12.1//:bytes",
     tags = ["manual"],
 )
 
 alias(
     name = "bytes",
-    actual = "@sdk_vendor__bytes-1.11.1//:bytes",
+    actual = "@sdk_vendor__bytes-1.12.1//:bytes",
     tags = ["manual"],
 )
 
@@ -80,80 +80,80 @@ alias(
 )
 
 alias(
-    name = "flate2-1.1.9",
-    actual = "@sdk_vendor__flate2-1.1.9//:flate2",
+    name = "flate2-1.1.10",
+    actual = "@sdk_vendor__flate2-1.1.10//:flate2",
     tags = ["manual"],
 )
 
 alias(
     name = "flate2",
-    actual = "@sdk_vendor__flate2-1.1.9//:flate2",
+    actual = "@sdk_vendor__flate2-1.1.10//:flate2",
     tags = ["manual"],
 )
 
 alias(
-    name = "futures-util-0.3.32",
-    actual = "@sdk_vendor__futures-util-0.3.32//:futures_util",
+    name = "futures-util-0.3.34",
+    actual = "@sdk_vendor__futures-util-0.3.34//:futures_util",
     tags = ["manual"],
 )
 
 alias(
     name = "futures-util",
-    actual = "@sdk_vendor__futures-util-0.3.32//:futures_util",
+    actual = "@sdk_vendor__futures-util-0.3.34//:futures_util",
     tags = ["manual"],
 )
 
 alias(
-    name = "getrandom-0.2.17",
-    actual = "@sdk_vendor__getrandom-0.2.17//:getrandom",
+    name = "getrandom-0.4.3",
+    actual = "@sdk_vendor__getrandom-0.4.3//:getrandom",
     tags = ["manual"],
 )
 
 alias(
     name = "getrandom",
-    actual = "@sdk_vendor__getrandom-0.2.17//:getrandom",
+    actual = "@sdk_vendor__getrandom-0.4.3//:getrandom",
     tags = ["manual"],
 )
 
 alias(
-    name = "http-1.4.2",
-    actual = "@sdk_vendor__http-1.4.2//:http",
+    name = "http-1.5.0",
+    actual = "@sdk_vendor__http-1.5.0//:http",
     tags = ["manual"],
 )
 
 alias(
     name = "http",
-    actual = "@sdk_vendor__http-1.4.2//:http",
+    actual = "@sdk_vendor__http-1.5.0//:http",
     tags = ["manual"],
 )
 
 alias(
-    name = "indexmap-2.14.0",
-    actual = "@sdk_vendor__indexmap-2.14.0//:indexmap",
+    name = "indexmap-2.14.2",
+    actual = "@sdk_vendor__indexmap-2.14.2//:indexmap",
     tags = ["manual"],
 )
 
 alias(
     name = "indexmap",
-    actual = "@sdk_vendor__indexmap-2.14.0//:indexmap",
+    actual = "@sdk_vendor__indexmap-2.14.2//:indexmap",
     tags = ["manual"],
 )
 
 alias(
-    name = "libloading-0.8.9",
-    actual = "@sdk_vendor__libloading-0.8.9//:libloading",
+    name = "libloading-0.9.0",
+    actual = "@sdk_vendor__libloading-0.9.0//:libloading",
     tags = ["manual"],
 )
 
 alias(
-    name = "sdk_libloading-0.8.9",
-    actual = "@sdk_vendor__libloading-0.8.9//:libloading",
+    name = "sdk_libloading-0.9.0",
+    actual = "@sdk_vendor__libloading-0.9.0//:libloading",
     tags = ["manual"],
 )
 
 alias(
     name = "sdk_libloading",
-    actual = "@sdk_vendor__libloading-0.8.9//:libloading",
+    actual = "@sdk_vendor__libloading-0.9.0//:libloading",
     tags = ["manual"],
 )
 
@@ -182,26 +182,26 @@ alias(
 )
 
 alias(
-    name = "regex-1.12.3",
-    actual = "@sdk_vendor__regex-1.12.3//:regex",
+    name = "regex-1.13.1",
+    actual = "@sdk_vendor__regex-1.13.1//:regex",
     tags = ["manual"],
 )
 
 alias(
     name = "regex",
-    actual = "@sdk_vendor__regex-1.12.3//:regex",
+    actual = "@sdk_vendor__regex-1.13.1//:regex",
     tags = ["manual"],
 )
 
 alias(
-    name = "reqwest-0.12.28",
-    actual = "@sdk_vendor__reqwest-0.12.28//:reqwest",
+    name = "reqwest-0.13.5",
+    actual = "@sdk_vendor__reqwest-0.13.5//:reqwest",
     tags = ["manual"],
 )
 
 alias(
     name = "reqwest",
-    actual = "@sdk_vendor__reqwest-0.12.28//:reqwest",
+    actual = "@sdk_vendor__reqwest-0.13.5//:reqwest",
     tags = ["manual"],
 )
 
@@ -218,50 +218,50 @@ alias(
 )
 
 alias(
-    name = "schemars-1.2.1",
-    actual = "@sdk_vendor__schemars-1.2.1//:schemars",
+    name = "schemars-1.2.2",
+    actual = "@sdk_vendor__schemars-1.2.2//:schemars",
     tags = ["manual"],
 )
 
 alias(
     name = "schemars",
-    actual = "@sdk_vendor__schemars-1.2.1//:schemars",
+    actual = "@sdk_vendor__schemars-1.2.2//:schemars",
     tags = ["manual"],
 )
 
 alias(
-    name = "serde-1.0.228",
-    actual = "@sdk_vendor__serde-1.0.228//:serde",
+    name = "serde-1.0.229",
+    actual = "@sdk_vendor__serde-1.0.229//:serde",
     tags = ["manual"],
 )
 
 alias(
     name = "serde",
-    actual = "@sdk_vendor__serde-1.0.228//:serde",
+    actual = "@sdk_vendor__serde-1.0.229//:serde",
     tags = ["manual"],
 )
 
 alias(
-    name = "serde_json-1.0.149",
-    actual = "@sdk_vendor__serde_json-1.0.149//:serde_json",
+    name = "serde_json-1.0.151",
+    actual = "@sdk_vendor__serde_json-1.0.151//:serde_json",
     tags = ["manual"],
 )
 
 alias(
     name = "serde_json",
-    actual = "@sdk_vendor__serde_json-1.0.149//:serde_json",
+    actual = "@sdk_vendor__serde_json-1.0.151//:serde_json",
     tags = ["manual"],
 )
 
 alias(
-    name = "serial_test-3.4.0",
-    actual = "@sdk_vendor__serial_test-3.4.0//:serial_test",
+    name = "serial_test-4.0.1",
+    actual = "@sdk_vendor__serial_test-4.0.1//:serial_test",
     tags = ["manual"],
 )
 
 alias(
     name = "serial_test",
-    actual = "@sdk_vendor__serial_test-3.4.0//:serial_test",
+    actual = "@sdk_vendor__serial_test-4.0.1//:serial_test",
     tags = ["manual"],
 )
 
@@ -302,50 +302,50 @@ alias(
 )
 
 alias(
-    name = "tokio-1.52.1",
-    actual = "@sdk_vendor__tokio-1.52.1//:tokio",
+    name = "tokio-1.53.1",
+    actual = "@sdk_vendor__tokio-1.53.1//:tokio",
     tags = ["manual"],
 )
 
 alias(
     name = "tokio",
-    actual = "@sdk_vendor__tokio-1.52.1//:tokio",
+    actual = "@sdk_vendor__tokio-1.53.1//:tokio",
     tags = ["manual"],
 )
 
 alias(
-    name = "tokio-stream-0.1.18",
-    actual = "@sdk_vendor__tokio-stream-0.1.18//:tokio_stream",
+    name = "tokio-stream-0.1.19",
+    actual = "@sdk_vendor__tokio-stream-0.1.19//:tokio_stream",
     tags = ["manual"],
 )
 
 alias(
     name = "tokio-stream",
-    actual = "@sdk_vendor__tokio-stream-0.1.18//:tokio_stream",
+    actual = "@sdk_vendor__tokio-stream-0.1.19//:tokio_stream",
     tags = ["manual"],
 )
 
 alias(
-    name = "tokio-tungstenite-0.24.0",
-    actual = "@sdk_vendor__tokio-tungstenite-0.24.0//:tokio_tungstenite",
+    name = "tokio-tungstenite-0.28.0",
+    actual = "@sdk_vendor__tokio-tungstenite-0.28.0//:tokio_tungstenite",
     tags = ["manual"],
 )
 
 alias(
     name = "tokio-tungstenite",
-    actual = "@sdk_vendor__tokio-tungstenite-0.24.0//:tokio_tungstenite",
+    actual = "@sdk_vendor__tokio-tungstenite-0.28.0//:tokio_tungstenite",
     tags = ["manual"],
 )
 
 alias(
-    name = "tokio-util-0.7.18",
-    actual = "@sdk_vendor__tokio-util-0.7.18//:tokio_util",
+    name = "tokio-util-0.7.19",
+    actual = "@sdk_vendor__tokio-util-0.7.19//:tokio_util",
     tags = ["manual"],
 )
 
 alias(
     name = "tokio-util",
-    actual = "@sdk_vendor__tokio-util-0.7.18//:tokio_util",
+    actual = "@sdk_vendor__tokio-util-0.7.19//:tokio_util",
     tags = ["manual"],
 )
 
@@ -362,26 +362,26 @@ alias(
 )
 
 alias(
-    name = "ureq-2.12.1",
-    actual = "@sdk_vendor__ureq-2.12.1//:ureq",
+    name = "ureq-3.4.2",
+    actual = "@sdk_vendor__ureq-3.4.2//:ureq",
     tags = ["manual"],
 )
 
 alias(
     name = "ureq",
-    actual = "@sdk_vendor__ureq-2.12.1//:ureq",
+    actual = "@sdk_vendor__ureq-3.4.2//:ureq",
     tags = ["manual"],
 )
 
 alias(
-    name = "uuid-1.23.1",
-    actual = "@sdk_vendor__uuid-1.23.1//:uuid",
+    name = "uuid-1.26.1",
+    actual = "@sdk_vendor__uuid-1.26.1//:uuid",
     tags = ["manual"],
 )
 
 alias(
     name = "uuid",
-    actual = "@sdk_vendor__uuid-1.23.1//:uuid",
+    actual = "@sdk_vendor__uuid-1.26.1//:uuid",
     tags = ["manual"],
 )
 
@@ -398,13 +398,13 @@ alias(
 )
 
 alias(
-    name = "zip-2.4.2",
-    actual = "@sdk_vendor__zip-2.4.2//:zip",
+    name = "zip-7.2.0",
+    actual = "@sdk_vendor__zip-7.2.0//:zip",
     tags = ["manual"],
 )
 
 alias(
     name = "zip",
-    actual = "@sdk_vendor__zip-2.4.2//:zip",
+    actual = "@sdk_vendor__zip-7.2.0//:zip",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/BUILD.bitflags-2.11.1.bazel b/rust/bazel/crates/BUILD.bitflags-2.13.2.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.bitflags-2.11.1.bazel
rename to rust/bazel/crates/BUILD.bitflags-2.13.2.bazel
index d4e324b8e7..28a5bf0a53 100644
--- a/rust/bazel/crates/BUILD.bitflags-2.11.1.bazel
+++ b/rust/bazel/crates/BUILD.bitflags-2.13.2.bazel
@@ -73,5 +73,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.11.1",
+    version = "2.13.2",
 )
diff --git a/rust/bazel/crates/BUILD.bumpalo-3.20.2.bazel b/rust/bazel/crates/BUILD.bumpalo-3.20.3.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.bumpalo-3.20.2.bazel
rename to rust/bazel/crates/BUILD.bumpalo-3.20.3.bazel
index 8a791fcc54..bf8b7de2f4 100644
--- a/rust/bazel/crates/BUILD.bumpalo-3.20.2.bazel
+++ b/rust/bazel/crates/BUILD.bumpalo-3.20.3.bazel
@@ -61,5 +61,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "3.20.2",
+    version = "3.20.3",
 )
diff --git a/rust/bazel/crates/BUILD.bytes-1.11.1.bazel b/rust/bazel/crates/BUILD.bytes-1.12.1.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.bytes-1.11.1.bazel
rename to rust/bazel/crates/BUILD.bytes-1.12.1.bazel
index 825dbae3ca..9ae640537b 100644
--- a/rust/bazel/crates/BUILD.bytes-1.11.1.bazel
+++ b/rust/bazel/crates/BUILD.bytes-1.12.1.bazel
@@ -62,5 +62,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.11.1",
+    version = "1.12.1",
 )
diff --git a/rust/bazel/crates/BUILD.cc-1.2.61.bazel b/rust/bazel/crates/BUILD.cc-1.4.7.bazel
similarity index 92%
rename from rust/bazel/crates/BUILD.cc-1.2.61.bazel
rename to rust/bazel/crates/BUILD.cc-1.4.7.bazel
index a3f5e5cbb2..28b7e18170 100644
--- a/rust/bazel/crates/BUILD.cc-1.2.61.bazel
+++ b/rust/bazel/crates/BUILD.cc-1.4.7.bazel
@@ -35,7 +35,7 @@ rust_library(
         ],
     ),
     crate_root = "src/lib.rs",
-    edition = "2018",
+    edition = "2021",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -58,9 +58,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.2.61",
+    version = "1.4.7",
     deps = [
-        "@sdk_vendor__find-msvc-tools-0.1.9//:find_msvc_tools",
-        "@sdk_vendor__shlex-1.3.0//:shlex",
+        "@sdk_vendor__find-msvc-tools-0.1.13//:find_msvc_tools",
+        "@sdk_vendor__shlex-2.0.1//:shlex",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.cfg-if-1.0.4.bazel b/rust/bazel/crates/BUILD.cfg-if-1.0.5.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.cfg-if-1.0.4.bazel
rename to rust/bazel/crates/BUILD.cfg-if-1.0.5.bazel
index 67ca93d9c0..3790d0a8d7 100644
--- a/rust/bazel/crates/BUILD.cfg-if-1.0.4.bazel
+++ b/rust/bazel/crates/BUILD.cfg-if-1.0.5.bazel
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.4",
+    version = "1.0.5",
 )
diff --git a/rust/bazel/crates/BUILD.core-foundation-0.10.1.bazel b/rust/bazel/crates/BUILD.core-foundation-0.10.1.bazel
index 45d54e0fba..ab1230ea97 100644
--- a/rust/bazel/crates/BUILD.core-foundation-0.10.1.bazel
+++ b/rust/bazel/crates/BUILD.core-foundation-0.10.1.bazel
@@ -65,6 +65,6 @@ rust_library(
     version = "0.10.1",
     deps = [
         "@sdk_vendor__core-foundation-sys-0.8.7//:core_foundation_sys",
-        "@sdk_vendor__libc-0.2.186//:libc",
+        "@sdk_vendor__libc-0.2.189//:libc",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.cpufeatures-0.2.17.bazel b/rust/bazel/crates/BUILD.cpufeatures-0.2.17.bazel
index c9b5112108..d244ce9774 100644
--- a/rust/bazel/crates/BUILD.cpufeatures-0.2.17.bazel
+++ b/rust/bazel/crates/BUILD.cpufeatures-0.2.17.bazel
@@ -61,10 +61,10 @@ rust_library(
     version = "0.2.17",
     deps = select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(all(target_arch = "aarch64", target_vendor = "apple"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(all(target_arch = "aarch64", target_vendor = "apple"))
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(all(target_arch = "aarch64", target_os = "linux"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(all(target_arch = "aarch64", target_os = "linux"))
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.crc32fast-1.5.0.bazel b/rust/bazel/crates/BUILD.crc32fast-1.5.2.bazel
similarity index 97%
rename from rust/bazel/crates/BUILD.crc32fast-1.5.0.bazel
rename to rust/bazel/crates/BUILD.crc32fast-1.5.2.bazel
index 6ac8816955..ad9c2b6d75 100644
--- a/rust/bazel/crates/BUILD.crc32fast-1.5.0.bazel
+++ b/rust/bazel/crates/BUILD.crc32fast-1.5.2.bazel
@@ -66,10 +66,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.5.0",
+    version = "1.5.2",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
     ],
 )
 
@@ -129,7 +129,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.5.0",
+    version = "1.5.2",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.crossbeam-utils-0.8.21.bazel b/rust/bazel/crates/BUILD.crossbeam-utils-0.8.21.bazel
deleted file mode 100644
index bc9e99ca74..0000000000
--- a/rust/bazel/crates/BUILD.crossbeam-utils-0.8.21.bazel
+++ /dev/null
@@ -1,131 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load(
-    "@rules_rust//cargo:defs.bzl",
-    "cargo_build_script",
-    "cargo_toml_env_vars",
-)
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "crossbeam_utils",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=crossbeam-utils",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.8.21",
-    deps = [
-        ":build_script_build",
-    ],
-)
-
-cargo_build_script(
-    name = "_bs",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    build_script_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            "**/*.rs",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_name = "build_script_build",
-    crate_root = "build.rs",
-    data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    edition = "2021",
-    emit_warnings = False,
-    pkg_name = "crossbeam-utils",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=crossbeam-utils",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    version = "0.8.21",
-    visibility = ["//visibility:private"],
-)
-
-alias(
-    name = "build_script_build",
-    actual = ":_bs",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/BUILD.crypto-common-0.1.7.bazel b/rust/bazel/crates/BUILD.crypto-common-0.1.7.bazel
index 439b180f6d..b59ff4a0e6 100644
--- a/rust/bazel/crates/BUILD.crypto-common-0.1.7.bazel
+++ b/rust/bazel/crates/BUILD.crypto-common-0.1.7.bazel
@@ -64,6 +64,6 @@ rust_library(
     version = "0.1.7",
     deps = [
         "@sdk_vendor__generic-array-0.14.7//:generic_array",
-        "@sdk_vendor__typenum-1.20.0//:typenum",
+        "@sdk_vendor__typenum-1.20.1//:typenum",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.data-encoding-2.11.0.bazel b/rust/bazel/crates/BUILD.data-encoding-2.11.1.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.data-encoding-2.11.0.bazel
rename to rust/bazel/crates/BUILD.data-encoding-2.11.1.bazel
index b12c36b489..761f6cb4e9 100644
--- a/rust/bazel/crates/BUILD.data-encoding-2.11.0.bazel
+++ b/rust/bazel/crates/BUILD.data-encoding-2.11.1.bazel
@@ -63,5 +63,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.11.0",
+    version = "2.11.1",
 )
diff --git a/rust/bazel/crates/BUILD.der-0.8.2.bazel b/rust/bazel/crates/BUILD.der-0.8.2.bazel
new file mode 100644
index 0000000000..8476478002
--- /dev/null
+++ b/rust/bazel/crates/BUILD.der-0.8.2.bazel
@@ -0,0 +1,72 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "der",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "alloc",
+        "pem",
+        "std",
+        "zeroize",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2024",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=der",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.8.2",
+    deps = [
+        "@sdk_vendor__pem-rfc7468-1.0.0//:pem_rfc7468",
+        "@sdk_vendor__zeroize-1.9.0//:zeroize",
+    ],
+)
diff --git a/rust/bazel/crates/BUILD.derive_arbitrary-1.4.2.bazel b/rust/bazel/crates/BUILD.derive_arbitrary-1.4.2.bazel
deleted file mode 100644
index 9eacffbe33..0000000000
--- a/rust/bazel/crates/BUILD.derive_arbitrary-1.4.2.bazel
+++ /dev/null
@@ -1,67 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_proc_macro")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_proc_macro(
-    name = "derive_arbitrary",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=derive_arbitrary",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "1.4.2",
-    deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.dirs-sys-0.4.1.bazel b/rust/bazel/crates/BUILD.dirs-sys-0.4.1.bazel
index 004d6eda90..78879db33a 100644
--- a/rust/bazel/crates/BUILD.dirs-sys-0.4.1.bazel
+++ b/rust/bazel/crates/BUILD.dirs-sys-0.4.1.bazel
@@ -63,22 +63,22 @@ rust_library(
         "@sdk_vendor__option-ext-0.2.0//:option_ext",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.48.0//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.48.0//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.displaydoc-0.2.5.bazel b/rust/bazel/crates/BUILD.displaydoc-0.2.7.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.displaydoc-0.2.5.bazel
rename to rust/bazel/crates/BUILD.displaydoc-0.2.7.bazel
index 6fa1180913..0195bab38f 100644
--- a/rust/bazel/crates/BUILD.displaydoc-0.2.5.bazel
+++ b/rust/bazel/crates/BUILD.displaydoc-0.2.7.bazel
@@ -58,10 +58,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.2.5",
+    version = "0.2.7",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.errno-0.3.14.bazel b/rust/bazel/crates/BUILD.errno-0.3.14.bazel
index 2e4e5ba648..9b8f50f97f 100644
--- a/rust/bazel/crates/BUILD.errno-0.3.14.bazel
+++ b/rust/bazel/crates/BUILD.errno-0.3.14.bazel
@@ -65,22 +65,22 @@ rust_library(
     version = "0.3.14",
     deps = select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.fastrand-2.4.1.bazel b/rust/bazel/crates/BUILD.fastrand-2.5.0.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.fastrand-2.4.1.bazel
rename to rust/bazel/crates/BUILD.fastrand-2.5.0.bazel
index 477bf3dbd9..f12ce30c86 100644
--- a/rust/bazel/crates/BUILD.fastrand-2.4.1.bazel
+++ b/rust/bazel/crates/BUILD.fastrand-2.5.0.bazel
@@ -63,5 +63,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.4.1",
+    version = "2.5.0",
 )
diff --git a/rust/bazel/crates/BUILD.filetime-0.2.27.bazel b/rust/bazel/crates/BUILD.filetime-0.2.29.bazel
similarity index 87%
rename from rust/bazel/crates/BUILD.filetime-0.2.27.bazel
rename to rust/bazel/crates/BUILD.filetime-0.2.29.bazel
index f87bd7ce6a..ccae6d0b97 100644
--- a/rust/bazel/crates/BUILD.filetime-0.2.27.bazel
+++ b/rust/bazel/crates/BUILD.filetime-0.2.29.bazel
@@ -58,21 +58,21 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.2.27",
+    version = "0.2.29",
     deps = [
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.find-msvc-tools-0.1.9.bazel b/rust/bazel/crates/BUILD.find-msvc-tools-0.1.13.bazel
similarity index 97%
rename from rust/bazel/crates/BUILD.find-msvc-tools-0.1.9.bazel
rename to rust/bazel/crates/BUILD.find-msvc-tools-0.1.13.bazel
index d52978f8b1..d899d851ab 100644
--- a/rust/bazel/crates/BUILD.find-msvc-tools-0.1.9.bazel
+++ b/rust/bazel/crates/BUILD.find-msvc-tools-0.1.13.bazel
@@ -35,7 +35,7 @@ rust_library(
         ],
     ),
     crate_root = "src/lib.rs",
-    edition = "2018",
+    edition = "2021",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.1.9",
+    version = "0.1.13",
 )
diff --git a/rust/bazel/crates/BUILD.flate2-1.1.9.bazel b/rust/bazel/crates/BUILD.flate2-1.1.10.bazel
similarity index 88%
rename from rust/bazel/crates/BUILD.flate2-1.1.9.bazel
rename to rust/bazel/crates/BUILD.flate2-1.1.10.bazel
index 0b018785a7..e5378d25f3 100644
--- a/rust/bazel/crates/BUILD.flate2-1.1.9.bazel
+++ b/rust/bazel/crates/BUILD.flate2-1.1.10.bazel
@@ -36,9 +36,12 @@ rust_library(
     ),
     crate_features = [
         "any_impl",
+        "any_zlib",
         "default",
         "miniz_oxide",
+        "runtime_detection",
         "rust_backend",
+        "zlib-rs",
     ],
     crate_root = "src/lib.rs",
     edition = "2018",
@@ -64,9 +67,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.1.9",
+    version = "1.1.10",
     deps = [
-        "@sdk_vendor__crc32fast-1.5.0//:crc32fast",
-        "@sdk_vendor__miniz_oxide-0.8.9//:miniz_oxide",
+        "@sdk_vendor__crc32fast-1.5.2//:crc32fast",
+        "@sdk_vendor__miniz_oxide-0.9.1//:miniz_oxide",
+        "@sdk_vendor__zlib-rs-0.6.8//:zlib_rs",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.foldhash-0.1.5.bazel b/rust/bazel/crates/BUILD.foldhash-0.1.5.bazel
deleted file mode 100644
index bdf58b3058..0000000000
--- a/rust/bazel/crates/BUILD.foldhash-0.1.5.bazel
+++ /dev/null
@@ -1,62 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "foldhash",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=foldhash",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.1.5",
-)
diff --git a/rust/bazel/crates/BUILD.form_urlencoded-1.2.2.bazel b/rust/bazel/crates/BUILD.form_urlencoded-1.2.2.bazel
index c3334503a5..22d97e4a76 100644
--- a/rust/bazel/crates/BUILD.form_urlencoded-1.2.2.bazel
+++ b/rust/bazel/crates/BUILD.form_urlencoded-1.2.2.bazel
@@ -36,7 +36,6 @@ rust_library(
     ),
     crate_features = [
         "alloc",
-        "default",
         "std",
     ],
     crate_root = "src/lib.rs",
diff --git a/rust/bazel/crates/BUILD.futures-channel-0.3.32.bazel b/rust/bazel/crates/BUILD.futures-channel-0.3.34.bazel
similarity index 95%
rename from rust/bazel/crates/BUILD.futures-channel-0.3.32.bazel
rename to rust/bazel/crates/BUILD.futures-channel-0.3.34.bazel
index 47097307bd..55e783c9e6 100644
--- a/rust/bazel/crates/BUILD.futures-channel-0.3.32.bazel
+++ b/rust/bazel/crates/BUILD.futures-channel-0.3.34.bazel
@@ -63,8 +63,8 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.32",
+    version = "0.3.34",
     deps = [
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.futures-core-0.3.32.bazel b/rust/bazel/crates/BUILD.futures-core-0.3.34.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.futures-core-0.3.32.bazel
rename to rust/bazel/crates/BUILD.futures-core-0.3.34.bazel
index 45074064d0..20c4a075c4 100644
--- a/rust/bazel/crates/BUILD.futures-core-0.3.32.bazel
+++ b/rust/bazel/crates/BUILD.futures-core-0.3.34.bazel
@@ -63,5 +63,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.32",
+    version = "0.3.34",
 )
diff --git a/rust/bazel/crates/BUILD.futures-executor-0.3.32.bazel b/rust/bazel/crates/BUILD.futures-executor-0.3.34.bazel
similarity index 90%
rename from rust/bazel/crates/BUILD.futures-executor-0.3.32.bazel
rename to rust/bazel/crates/BUILD.futures-executor-0.3.34.bazel
index 3842e42971..e328134ab6 100644
--- a/rust/bazel/crates/BUILD.futures-executor-0.3.32.bazel
+++ b/rust/bazel/crates/BUILD.futures-executor-0.3.34.bazel
@@ -61,10 +61,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.32",
+    version = "0.3.34",
     deps = [
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
-        "@sdk_vendor__futures-task-0.3.32//:futures_task",
-        "@sdk_vendor__futures-util-0.3.32//:futures_util",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
+        "@sdk_vendor__futures-task-0.3.34//:futures_task",
+        "@sdk_vendor__futures-util-0.3.34//:futures_util",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.futures-io-0.3.32.bazel b/rust/bazel/crates/BUILD.futures-io-0.3.34.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.futures-io-0.3.32.bazel
rename to rust/bazel/crates/BUILD.futures-io-0.3.34.bazel
index 394ec04dfb..d7418bbeb1 100644
--- a/rust/bazel/crates/BUILD.futures-io-0.3.32.bazel
+++ b/rust/bazel/crates/BUILD.futures-io-0.3.34.bazel
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.32",
+    version = "0.3.34",
 )
diff --git a/rust/bazel/crates/BUILD.futures-macro-0.3.32.bazel b/rust/bazel/crates/BUILD.futures-macro-0.3.34.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.futures-macro-0.3.32.bazel
rename to rust/bazel/crates/BUILD.futures-macro-0.3.34.bazel
index 1cd23bc809..84382aa919 100644
--- a/rust/bazel/crates/BUILD.futures-macro-0.3.32.bazel
+++ b/rust/bazel/crates/BUILD.futures-macro-0.3.34.bazel
@@ -58,10 +58,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.32",
+    version = "0.3.34",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.futures-sink-0.3.32.bazel b/rust/bazel/crates/BUILD.futures-sink-0.3.34.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.futures-sink-0.3.32.bazel
rename to rust/bazel/crates/BUILD.futures-sink-0.3.34.bazel
index 84783cd03d..0abbccbd58 100644
--- a/rust/bazel/crates/BUILD.futures-sink-0.3.32.bazel
+++ b/rust/bazel/crates/BUILD.futures-sink-0.3.34.bazel
@@ -63,5 +63,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.32",
+    version = "0.3.34",
 )
diff --git a/rust/bazel/crates/BUILD.futures-task-0.3.32.bazel b/rust/bazel/crates/BUILD.futures-task-0.3.34.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.futures-task-0.3.32.bazel
rename to rust/bazel/crates/BUILD.futures-task-0.3.34.bazel
index 40aea26da7..1e9f15a0ed 100644
--- a/rust/bazel/crates/BUILD.futures-task-0.3.32.bazel
+++ b/rust/bazel/crates/BUILD.futures-task-0.3.34.bazel
@@ -62,5 +62,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.32",
+    version = "0.3.34",
 )
diff --git a/rust/bazel/crates/BUILD.futures-util-0.3.32.bazel b/rust/bazel/crates/BUILD.futures-util-0.3.34.bazel
similarity index 89%
rename from rust/bazel/crates/BUILD.futures-util-0.3.32.bazel
rename to rust/bazel/crates/BUILD.futures-util-0.3.34.bazel
index 3344920452..d0cd4b253f 100644
--- a/rust/bazel/crates/BUILD.futures-util-0.3.32.bazel
+++ b/rust/bazel/crates/BUILD.futures-util-0.3.34.bazel
@@ -48,7 +48,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2018",
     proc_macro_deps = [
-        "@sdk_vendor__futures-macro-0.3.32//:futures_macro",
+        "@sdk_vendor__futures-macro-0.3.34//:futures_macro",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -72,11 +72,11 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.32",
+    version = "0.3.34",
     deps = [
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
-        "@sdk_vendor__futures-sink-0.3.32//:futures_sink",
-        "@sdk_vendor__futures-task-0.3.32//:futures_task",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
+        "@sdk_vendor__futures-sink-0.3.34//:futures_sink",
+        "@sdk_vendor__futures-task-0.3.34//:futures_task",
         "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
         "@sdk_vendor__slab-0.4.12//:slab",
     ],
diff --git a/rust/bazel/crates/BUILD.generic-array-0.14.7.bazel b/rust/bazel/crates/BUILD.generic-array-0.14.7.bazel
index efbb487eaa..a991550812 100644
--- a/rust/bazel/crates/BUILD.generic-array-0.14.7.bazel
+++ b/rust/bazel/crates/BUILD.generic-array-0.14.7.bazel
@@ -68,7 +68,7 @@ rust_library(
     version = "0.14.7",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__typenum-1.20.0//:typenum",
+        "@sdk_vendor__typenum-1.20.1//:typenum",
     ],
 )
 
diff --git a/rust/bazel/crates/BUILD.getrandom-0.2.17.bazel b/rust/bazel/crates/BUILD.getrandom-0.2.17.bazel
index 87c8ed9b57..7dcc68ddda 100644
--- a/rust/bazel/crates/BUILD.getrandom-0.2.17.bazel
+++ b/rust/bazel/crates/BUILD.getrandom-0.2.17.bazel
@@ -34,9 +34,6 @@ rust_library(
             "WORKSPACE.bazel",
         ],
     ),
-    crate_features = [
-        "std",
-    ],
     crate_root = "src/lib.rs",
     edition = "2018",
     rustc_env_files = [
@@ -63,19 +60,19 @@ rust_library(
     }),
     version = "0.2.17",
     deps = [
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.anyhow-1.0.102.bazel b/rust/bazel/crates/BUILD.getrandom-0.3.4.bazel
similarity index 68%
rename from rust/bazel/crates/BUILD.anyhow-1.0.102.bazel
rename to rust/bazel/crates/BUILD.getrandom-0.3.4.bazel
index 2f72efd4c6..0b7f2c7441 100644
--- a/rust/bazel/crates/BUILD.anyhow-1.0.102.bazel
+++ b/rust/bazel/crates/BUILD.getrandom-0.3.4.bazel
@@ -21,7 +21,7 @@ cargo_toml_env_vars(
 )
 
 rust_library(
-    name = "anyhow",
+    name = "getrandom",
     srcs = glob(
         include = ["**/*.rs"],
         allow_empty = True,
@@ -39,7 +39,6 @@ rust_library(
         ],
     ),
     crate_features = [
-        "default",
         "std",
     ],
     crate_root = "src/lib.rs",
@@ -52,7 +51,7 @@ rust_library(
     ],
     tags = [
         "cargo-bazel",
-        "crate-name=anyhow",
+        "crate-name=getrandom",
         "manual",
         "noclippy",
         "norustfmt",
@@ -66,10 +65,25 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.102",
+    version = "0.3.4",
     deps = [
         ":build_script_build",
-    ],
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
+    ] + select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
+        ],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+        ],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
+        ],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+        ],
+        "//conditions:default": [],
+    }),
 )
 
 cargo_build_script(
@@ -95,7 +109,6 @@ cargo_build_script(
         ],
     ),
     crate_features = [
-        "default",
         "std",
     ],
     crate_name = "build_script_build",
@@ -114,7 +127,7 @@ cargo_build_script(
     ),
     edition = "2021",
     emit_warnings = False,
-    pkg_name = "anyhow",
+    pkg_name = "getrandom",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -123,12 +136,12 @@ cargo_build_script(
     ],
     tags = [
         "cargo-bazel",
-        "crate-name=anyhow",
+        "crate-name=getrandom",
         "manual",
         "noclippy",
         "norustfmt",
     ],
-    version = "1.0.102",
+    version = "0.3.4",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.getrandom-0.4.2.bazel b/rust/bazel/crates/BUILD.getrandom-0.4.3.bazel
similarity index 92%
rename from rust/bazel/crates/BUILD.getrandom-0.4.2.bazel
rename to rust/bazel/crates/BUILD.getrandom-0.4.3.bazel
index c93c73227a..50196b3ab3 100644
--- a/rust/bazel/crates/BUILD.getrandom-0.4.2.bazel
+++ b/rust/bazel/crates/BUILD.getrandom-0.4.3.bazel
@@ -62,22 +62,22 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.4.2",
+    version = "0.4.3",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(target_os = "macos", target_os = "openbsd", target_os = "vita", target_os = "emscripten"))
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(all(any(target_os = "linux", target_os = "android"), not(any(all(target_os = "linux", target_env = ""), getrandom_backend = "custom", getrandom_backend = "linux_raw", getrandom_backend = "rdrand", getrandom_backend = "rndr"))))
         ],
         "//conditions:default": [],
     }),
@@ -135,7 +135,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "0.4.2",
+    version = "0.4.3",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.h2-0.4.15.bazel b/rust/bazel/crates/BUILD.h2-0.4.19.bazel
similarity index 83%
rename from rust/bazel/crates/BUILD.h2-0.4.15.bazel
rename to rust/bazel/crates/BUILD.h2-0.4.19.bazel
index 79bd81c10e..fd0bfe1ebe 100644
--- a/rust/bazel/crates/BUILD.h2-0.4.15.bazel
+++ b/rust/bazel/crates/BUILD.h2-0.4.19.bazel
@@ -58,18 +58,18 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.4.15",
+    version = "0.4.19",
     deps = [
         "@sdk_vendor__atomic-waker-1.1.2//:atomic_waker",
-        "@sdk_vendor__bytes-1.11.1//:bytes",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
         "@sdk_vendor__fnv-1.0.7//:fnv",
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
-        "@sdk_vendor__futures-sink-0.3.32//:futures_sink",
-        "@sdk_vendor__http-1.4.2//:http",
-        "@sdk_vendor__indexmap-2.14.0//:indexmap",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
+        "@sdk_vendor__futures-sink-0.3.34//:futures_sink",
+        "@sdk_vendor__http-1.5.0//:http",
+        "@sdk_vendor__indexmap-2.14.2//:indexmap",
         "@sdk_vendor__slab-0.4.12//:slab",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
-        "@sdk_vendor__tokio-util-0.7.18//:tokio_util",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
+        "@sdk_vendor__tokio-util-0.7.19//:tokio_util",
         "@sdk_vendor__tracing-0.1.44//:tracing",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.hashbrown-0.17.0.bazel b/rust/bazel/crates/BUILD.hashbrown-0.17.1.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.hashbrown-0.17.0.bazel
rename to rust/bazel/crates/BUILD.hashbrown-0.17.1.bazel
index b7c9b0c8b8..a49ddd22c0 100644
--- a/rust/bazel/crates/BUILD.hashbrown-0.17.0.bazel
+++ b/rust/bazel/crates/BUILD.hashbrown-0.17.1.bazel
@@ -61,7 +61,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.17.0",
+    version = "0.17.1",
     deps = [
         "@sdk_vendor__foldhash-0.2.0//:foldhash",
     ],
diff --git a/rust/bazel/crates/BUILD.hashlink-0.12.2.bazel b/rust/bazel/crates/BUILD.hashlink-0.12.2.bazel
index e63a3df024..365e42262a 100644
--- a/rust/bazel/crates/BUILD.hashlink-0.12.2.bazel
+++ b/rust/bazel/crates/BUILD.hashlink-0.12.2.bazel
@@ -60,6 +60,6 @@ rust_library(
     }),
     version = "0.12.2",
     deps = [
-        "@sdk_vendor__hashbrown-0.17.0//:hashbrown",
+        "@sdk_vendor__hashbrown-0.17.1//:hashbrown",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.http-1.4.2.bazel b/rust/bazel/crates/BUILD.http-1.5.0.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.http-1.4.2.bazel
rename to rust/bazel/crates/BUILD.http-1.5.0.bazel
index 4c8b4ff60d..37e97b5c5c 100644
--- a/rust/bazel/crates/BUILD.http-1.4.2.bazel
+++ b/rust/bazel/crates/BUILD.http-1.5.0.bazel
@@ -62,9 +62,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.4.2",
+    version = "1.5.0",
     deps = [
-        "@sdk_vendor__bytes-1.11.1//:bytes",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
         "@sdk_vendor__itoa-1.0.18//:itoa",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.http-body-1.0.1.bazel b/rust/bazel/crates/BUILD.http-body-1.1.0.bazel
similarity index 94%
rename from rust/bazel/crates/BUILD.http-body-1.0.1.bazel
rename to rust/bazel/crates/BUILD.http-body-1.1.0.bazel
index eae1b824b1..0de87b6436 100644
--- a/rust/bazel/crates/BUILD.http-body-1.0.1.bazel
+++ b/rust/bazel/crates/BUILD.http-body-1.1.0.bazel
@@ -58,9 +58,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.1",
+    version = "1.1.0",
     deps = [
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__http-1.4.2//:http",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__http-1.5.0//:http",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.http-body-util-0.1.3.bazel b/rust/bazel/crates/BUILD.http-body-util-0.1.5.bazel
similarity index 89%
rename from rust/bazel/crates/BUILD.http-body-util-0.1.3.bazel
rename to rust/bazel/crates/BUILD.http-body-util-0.1.5.bazel
index cfedd3d7d3..5d8ac0808f 100644
--- a/rust/bazel/crates/BUILD.http-body-util-0.1.3.bazel
+++ b/rust/bazel/crates/BUILD.http-body-util-0.1.5.bazel
@@ -61,12 +61,12 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.1.3",
+    version = "0.1.5",
     deps = [
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
-        "@sdk_vendor__http-1.4.2//:http",
-        "@sdk_vendor__http-body-1.0.1//:http_body",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
+        "@sdk_vendor__http-1.5.0//:http",
+        "@sdk_vendor__http-body-1.1.0//:http_body",
         "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.hyper-1.10.1.bazel b/rust/bazel/crates/BUILD.hyper-1.11.1.bazel
similarity index 83%
rename from rust/bazel/crates/BUILD.hyper-1.10.1.bazel
rename to rust/bazel/crates/BUILD.hyper-1.11.1.bazel
index bb104c9dd9..df5ac24cbd 100644
--- a/rust/bazel/crates/BUILD.hyper-1.10.1.bazel
+++ b/rust/bazel/crates/BUILD.hyper-1.11.1.bazel
@@ -64,20 +64,20 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.10.1",
+    version = "1.11.1",
     deps = [
         "@sdk_vendor__atomic-waker-1.1.2//:atomic_waker",
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__futures-channel-0.3.32//:futures_channel",
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
-        "@sdk_vendor__h2-0.4.15//:h2",
-        "@sdk_vendor__http-1.4.2//:http",
-        "@sdk_vendor__http-body-1.0.1//:http_body",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__futures-channel-0.3.34//:futures_channel",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
+        "@sdk_vendor__h2-0.4.19//:h2",
+        "@sdk_vendor__http-1.5.0//:http",
+        "@sdk_vendor__http-body-1.1.0//:http_body",
         "@sdk_vendor__httparse-1.10.1//:httparse",
         "@sdk_vendor__itoa-1.0.18//:itoa",
         "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
-        "@sdk_vendor__smallvec-1.15.1//:smallvec",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
+        "@sdk_vendor__smallvec-1.16.1//:smallvec",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
         "@sdk_vendor__want-0.3.1//:want",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.hyper-rustls-0.27.9.bazel b/rust/bazel/crates/BUILD.hyper-rustls-0.27.10.bazel
similarity index 87%
rename from rust/bazel/crates/BUILD.hyper-rustls-0.27.9.bazel
rename to rust/bazel/crates/BUILD.hyper-rustls-0.27.10.bazel
index a01ee3adb2..a75c7766fb 100644
--- a/rust/bazel/crates/BUILD.hyper-rustls-0.27.9.bazel
+++ b/rust/bazel/crates/BUILD.hyper-rustls-0.27.10.bazel
@@ -58,14 +58,14 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.27.9",
+    version = "0.27.10",
     deps = [
-        "@sdk_vendor__http-1.4.2//:http",
-        "@sdk_vendor__hyper-1.10.1//:hyper",
+        "@sdk_vendor__http-1.5.0//:http",
+        "@sdk_vendor__hyper-1.11.1//:hyper",
         "@sdk_vendor__hyper-util-0.1.20//:hyper_util",
-        "@sdk_vendor__rustls-0.23.40//:rustls",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
-        "@sdk_vendor__tokio-rustls-0.26.4//:tokio_rustls",
+        "@sdk_vendor__rustls-0.23.45//:rustls",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
+        "@sdk_vendor__tokio-rustls-0.26.5//:tokio_rustls",
         "@sdk_vendor__tower-service-0.3.3//:tower_service",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.hyper-tls-0.6.0.bazel b/rust/bazel/crates/BUILD.hyper-tls-0.6.0.bazel
index 94c68f53a4..55cb4b6192 100644
--- a/rust/bazel/crates/BUILD.hyper-tls-0.6.0.bazel
+++ b/rust/bazel/crates/BUILD.hyper-tls-0.6.0.bazel
@@ -34,6 +34,9 @@ rust_library(
             "WORKSPACE.bazel",
         ],
     ),
+    crate_features = [
+        "alpn",
+    ],
     crate_root = "src/lib.rs",
     edition = "2018",
     rustc_env_files = [
@@ -60,12 +63,12 @@ rust_library(
     }),
     version = "0.6.0",
     deps = [
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__http-body-util-0.1.3//:http_body_util",
-        "@sdk_vendor__hyper-1.10.1//:hyper",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__http-body-util-0.1.5//:http_body_util",
+        "@sdk_vendor__hyper-1.11.1//:hyper",
         "@sdk_vendor__hyper-util-0.1.20//:hyper_util",
         "@sdk_vendor__native-tls-0.2.18//:native_tls",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
         "@sdk_vendor__tokio-native-tls-0.3.1//:tokio_native_tls",
         "@sdk_vendor__tower-service-0.3.3//:tower_service",
     ],
diff --git a/rust/bazel/crates/BUILD.hyper-util-0.1.20.bazel b/rust/bazel/crates/BUILD.hyper-util-0.1.20.bazel
index 48e5bc011b..b0348aaee1 100644
--- a/rust/bazel/crates/BUILD.hyper-util-0.1.20.bazel
+++ b/rust/bazel/crates/BUILD.hyper-util-0.1.20.bazel
@@ -70,18 +70,18 @@ rust_library(
     version = "0.1.20",
     deps = [
         "@sdk_vendor__base64-0.22.1//:base64",
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__futures-channel-0.3.32//:futures_channel",
-        "@sdk_vendor__futures-util-0.3.32//:futures_util",
-        "@sdk_vendor__http-1.4.2//:http",
-        "@sdk_vendor__http-body-1.0.1//:http_body",
-        "@sdk_vendor__hyper-1.10.1//:hyper",
-        "@sdk_vendor__ipnet-2.12.0//:ipnet",
-        "@sdk_vendor__libc-0.2.186//:libc",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__futures-channel-0.3.34//:futures_channel",
+        "@sdk_vendor__futures-util-0.3.34//:futures_util",
+        "@sdk_vendor__http-1.5.0//:http",
+        "@sdk_vendor__http-body-1.1.0//:http_body",
+        "@sdk_vendor__hyper-1.11.1//:hyper",
+        "@sdk_vendor__ipnet-2.12.2//:ipnet",
+        "@sdk_vendor__libc-0.2.189//:libc",
         "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",
         "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
-        "@sdk_vendor__socket2-0.6.3//:socket2",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
+        "@sdk_vendor__socket2-0.6.5//:socket2",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
         "@sdk_vendor__tower-service-0.3.3//:tower_service",
         "@sdk_vendor__tracing-0.1.44//:tracing",
     ],
diff --git a/rust/bazel/crates/BUILD.icu_collections-2.2.0.bazel b/rust/bazel/crates/BUILD.icu_collections-2.3.0.bazel
similarity index 86%
rename from rust/bazel/crates/BUILD.icu_collections-2.2.0.bazel
rename to rust/bazel/crates/BUILD.icu_collections-2.3.0.bazel
index debb7e95be..3633a9543a 100644
--- a/rust/bazel/crates/BUILD.icu_collections-2.2.0.bazel
+++ b/rust/bazel/crates/BUILD.icu_collections-2.3.0.bazel
@@ -35,9 +35,9 @@ rust_library(
         ],
     ),
     crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2024",
     proc_macro_deps = [
-        "@sdk_vendor__displaydoc-0.2.5//:displaydoc",
+        "@sdk_vendor__displaydoc-0.2.7//:displaydoc",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -61,12 +61,12 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.2.0",
+    version = "2.3.0",
     deps = [
-        "@sdk_vendor__potential_utf-0.1.5//:potential_utf",
+        "@sdk_vendor__potential_utf-0.1.6//:potential_utf",
         "@sdk_vendor__utf8_iter-1.0.4//:utf8_iter",
-        "@sdk_vendor__yoke-0.8.2//:yoke",
-        "@sdk_vendor__zerofrom-0.1.7//:zerofrom",
-        "@sdk_vendor__zerovec-0.11.6//:zerovec",
+        "@sdk_vendor__yoke-0.8.3//:yoke",
+        "@sdk_vendor__zerofrom-0.1.8//:zerofrom",
+        "@sdk_vendor__zerovec-0.11.8//:zerovec",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.icu_locale_core-2.2.0.bazel b/rust/bazel/crates/BUILD.icu_locale_core-2.3.0.bazel
similarity index 86%
rename from rust/bazel/crates/BUILD.icu_locale_core-2.2.0.bazel
rename to rust/bazel/crates/BUILD.icu_locale_core-2.3.0.bazel
index e88d66b703..4f36858d7d 100644
--- a/rust/bazel/crates/BUILD.icu_locale_core-2.2.0.bazel
+++ b/rust/bazel/crates/BUILD.icu_locale_core-2.3.0.bazel
@@ -38,9 +38,9 @@ rust_library(
         "zerovec",
     ],
     crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2024",
     proc_macro_deps = [
-        "@sdk_vendor__displaydoc-0.2.5//:displaydoc",
+        "@sdk_vendor__displaydoc-0.2.7//:displaydoc",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -64,11 +64,11 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.2.0",
+    version = "2.3.0",
     deps = [
-        "@sdk_vendor__litemap-0.8.2//:litemap",
-        "@sdk_vendor__tinystr-0.8.3//:tinystr",
-        "@sdk_vendor__writeable-0.6.3//:writeable",
-        "@sdk_vendor__zerovec-0.11.6//:zerovec",
+        "@sdk_vendor__litemap-0.8.3//:litemap",
+        "@sdk_vendor__tinystr-0.8.4//:tinystr",
+        "@sdk_vendor__writeable-0.6.4//:writeable",
+        "@sdk_vendor__zerovec-0.11.8//:zerovec",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.icu_normalizer-2.2.0.bazel b/rust/bazel/crates/BUILD.icu_normalizer-2.3.0.bazel
similarity index 84%
rename from rust/bazel/crates/BUILD.icu_normalizer-2.2.0.bazel
rename to rust/bazel/crates/BUILD.icu_normalizer-2.3.0.bazel
index 39566641c1..191281dd5e 100644
--- a/rust/bazel/crates/BUILD.icu_normalizer-2.2.0.bazel
+++ b/rust/bazel/crates/BUILD.icu_normalizer-2.3.0.bazel
@@ -38,7 +38,7 @@ rust_library(
         "compiled_data",
     ],
     crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2024",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -61,12 +61,12 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.2.0",
+    version = "2.3.0",
     deps = [
-        "@sdk_vendor__icu_collections-2.2.0//:icu_collections",
-        "@sdk_vendor__icu_normalizer_data-2.2.0//:icu_normalizer_data",
-        "@sdk_vendor__icu_provider-2.2.0//:icu_provider",
-        "@sdk_vendor__smallvec-1.15.1//:smallvec",
-        "@sdk_vendor__zerovec-0.11.6//:zerovec",
+        "@sdk_vendor__icu_collections-2.3.0//:icu_collections",
+        "@sdk_vendor__icu_normalizer_data-2.3.0//:icu_normalizer_data",
+        "@sdk_vendor__icu_provider-2.3.1//:icu_provider",
+        "@sdk_vendor__smallvec-1.16.1//:smallvec",
+        "@sdk_vendor__zerovec-0.11.8//:zerovec",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.icu_normalizer_data-2.2.0.bazel b/rust/bazel/crates/BUILD.icu_normalizer_data-2.3.0.bazel
similarity index 97%
rename from rust/bazel/crates/BUILD.icu_normalizer_data-2.2.0.bazel
rename to rust/bazel/crates/BUILD.icu_normalizer_data-2.3.0.bazel
index 620a82c395..dad9345924 100644
--- a/rust/bazel/crates/BUILD.icu_normalizer_data-2.2.0.bazel
+++ b/rust/bazel/crates/BUILD.icu_normalizer_data-2.3.0.bazel
@@ -39,7 +39,7 @@ rust_library(
         ],
     ),
     crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2024",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -62,7 +62,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.2.0",
+    version = "2.3.0",
     deps = [
         ":build_script_build",
     ],
@@ -104,7 +104,7 @@ cargo_build_script(
             "WORKSPACE.bazel",
         ],
     ),
-    edition = "2021",
+    edition = "2024",
     emit_warnings = False,
     pkg_name = "icu_normalizer_data",
     rustc_env_files = [
@@ -120,7 +120,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "2.2.0",
+    version = "2.3.0",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.icu_properties-2.2.0.bazel b/rust/bazel/crates/BUILD.icu_properties-2.3.0.bazel
similarity index 79%
rename from rust/bazel/crates/BUILD.icu_properties-2.2.0.bazel
rename to rust/bazel/crates/BUILD.icu_properties-2.3.0.bazel
index 978f5abf67..7354b44099 100644
--- a/rust/bazel/crates/BUILD.icu_properties-2.2.0.bazel
+++ b/rust/bazel/crates/BUILD.icu_properties-2.3.0.bazel
@@ -38,7 +38,10 @@ rust_library(
         "compiled_data",
     ],
     crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2024",
+    proc_macro_deps = [
+        "@sdk_vendor__displaydoc-0.2.7//:displaydoc",
+    ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -61,13 +64,13 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.2.0",
+    version = "2.3.0",
     deps = [
-        "@sdk_vendor__icu_collections-2.2.0//:icu_collections",
-        "@sdk_vendor__icu_locale_core-2.2.0//:icu_locale_core",
-        "@sdk_vendor__icu_properties_data-2.2.0//:icu_properties_data",
-        "@sdk_vendor__icu_provider-2.2.0//:icu_provider",
-        "@sdk_vendor__zerotrie-0.2.4//:zerotrie",
-        "@sdk_vendor__zerovec-0.11.6//:zerovec",
+        "@sdk_vendor__icu_collections-2.3.0//:icu_collections",
+        "@sdk_vendor__icu_locale_core-2.3.0//:icu_locale_core",
+        "@sdk_vendor__icu_properties_data-2.3.0//:icu_properties_data",
+        "@sdk_vendor__icu_provider-2.3.1//:icu_provider",
+        "@sdk_vendor__zerotrie-0.2.5//:zerotrie",
+        "@sdk_vendor__zerovec-0.11.8//:zerovec",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.icu_properties_data-2.2.0.bazel b/rust/bazel/crates/BUILD.icu_properties_data-2.3.0.bazel
similarity index 97%
rename from rust/bazel/crates/BUILD.icu_properties_data-2.2.0.bazel
rename to rust/bazel/crates/BUILD.icu_properties_data-2.3.0.bazel
index 79ebe751f2..1d26a27ac8 100644
--- a/rust/bazel/crates/BUILD.icu_properties_data-2.2.0.bazel
+++ b/rust/bazel/crates/BUILD.icu_properties_data-2.3.0.bazel
@@ -39,7 +39,7 @@ rust_library(
         ],
     ),
     crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2024",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -62,7 +62,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.2.0",
+    version = "2.3.0",
     deps = [
         ":build_script_build",
     ],
@@ -104,7 +104,7 @@ cargo_build_script(
             "WORKSPACE.bazel",
         ],
     ),
-    edition = "2021",
+    edition = "2024",
     emit_warnings = False,
     pkg_name = "icu_properties_data",
     rustc_env_files = [
@@ -120,7 +120,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "2.2.0",
+    version = "2.3.0",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.icu_provider-2.2.0.bazel b/rust/bazel/crates/BUILD.icu_provider-2.3.1.bazel
similarity index 82%
rename from rust/bazel/crates/BUILD.icu_provider-2.2.0.bazel
rename to rust/bazel/crates/BUILD.icu_provider-2.3.1.bazel
index f711740b96..d95cae9d47 100644
--- a/rust/bazel/crates/BUILD.icu_provider-2.2.0.bazel
+++ b/rust/bazel/crates/BUILD.icu_provider-2.3.1.bazel
@@ -38,9 +38,9 @@ rust_library(
         "baked",
     ],
     crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2024",
     proc_macro_deps = [
-        "@sdk_vendor__displaydoc-0.2.5//:displaydoc",
+        "@sdk_vendor__displaydoc-0.2.7//:displaydoc",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -64,13 +64,13 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.2.0",
+    version = "2.3.1",
     deps = [
-        "@sdk_vendor__icu_locale_core-2.2.0//:icu_locale_core",
-        "@sdk_vendor__writeable-0.6.3//:writeable",
-        "@sdk_vendor__yoke-0.8.2//:yoke",
-        "@sdk_vendor__zerofrom-0.1.7//:zerofrom",
-        "@sdk_vendor__zerotrie-0.2.4//:zerotrie",
-        "@sdk_vendor__zerovec-0.11.6//:zerovec",
+        "@sdk_vendor__icu_locale_core-2.3.0//:icu_locale_core",
+        "@sdk_vendor__writeable-0.6.4//:writeable",
+        "@sdk_vendor__yoke-0.8.3//:yoke",
+        "@sdk_vendor__zerofrom-0.1.8//:zerofrom",
+        "@sdk_vendor__zerotrie-0.2.5//:zerotrie",
+        "@sdk_vendor__zerovec-0.11.8//:zerovec",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.idna-1.1.0.bazel b/rust/bazel/crates/BUILD.idna-1.1.0.bazel
index f4f9d40202..e55039489c 100644
--- a/rust/bazel/crates/BUILD.idna-1.1.0.bazel
+++ b/rust/bazel/crates/BUILD.idna-1.1.0.bazel
@@ -66,7 +66,7 @@ rust_library(
     version = "1.1.0",
     deps = [
         "@sdk_vendor__idna_adapter-1.2.2//:idna_adapter",
-        "@sdk_vendor__smallvec-1.15.1//:smallvec",
+        "@sdk_vendor__smallvec-1.16.1//:smallvec",
         "@sdk_vendor__utf8_iter-1.0.4//:utf8_iter",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.idna_adapter-1.2.2.bazel b/rust/bazel/crates/BUILD.idna_adapter-1.2.2.bazel
index 86dafa6f73..df438b0357 100644
--- a/rust/bazel/crates/BUILD.idna_adapter-1.2.2.bazel
+++ b/rust/bazel/crates/BUILD.idna_adapter-1.2.2.bazel
@@ -63,7 +63,7 @@ rust_library(
     }),
     version = "1.2.2",
     deps = [
-        "@sdk_vendor__icu_normalizer-2.2.0//:icu_normalizer",
-        "@sdk_vendor__icu_properties-2.2.0//:icu_properties",
+        "@sdk_vendor__icu_normalizer-2.3.0//:icu_normalizer",
+        "@sdk_vendor__icu_properties-2.3.0//:icu_properties",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.indexmap-2.14.0.bazel b/rust/bazel/crates/BUILD.indexmap-2.14.2.bazel
similarity index 93%
rename from rust/bazel/crates/BUILD.indexmap-2.14.0.bazel
rename to rust/bazel/crates/BUILD.indexmap-2.14.2.bazel
index 221e971656..9a6fd31224 100644
--- a/rust/bazel/crates/BUILD.indexmap-2.14.0.bazel
+++ b/rust/bazel/crates/BUILD.indexmap-2.14.2.bazel
@@ -63,10 +63,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.14.0",
+    version = "2.14.2",
     deps = [
         "@sdk_vendor__equivalent-1.0.2//:equivalent",
-        "@sdk_vendor__hashbrown-0.17.0//:hashbrown",
-        "@sdk_vendor__serde_core-1.0.228//:serde_core",
+        "@sdk_vendor__hashbrown-0.17.1//:hashbrown",
+        "@sdk_vendor__serde_core-1.0.229//:serde_core",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.ipnet-2.12.0.bazel b/rust/bazel/crates/BUILD.ipnet-2.12.2.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.ipnet-2.12.0.bazel
rename to rust/bazel/crates/BUILD.ipnet-2.12.2.bazel
index 474b00f73a..b8b116b8b0 100644
--- a/rust/bazel/crates/BUILD.ipnet-2.12.0.bazel
+++ b/rust/bazel/crates/BUILD.ipnet-2.12.2.bazel
@@ -62,5 +62,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.12.0",
+    version = "2.12.2",
 )
diff --git a/rust/bazel/crates/BUILD.js-sys-0.3.102.bazel b/rust/bazel/crates/BUILD.js-sys-0.3.105.bazel
similarity index 93%
rename from rust/bazel/crates/BUILD.js-sys-0.3.102.bazel
rename to rust/bazel/crates/BUILD.js-sys-0.3.105.bazel
index b86c71a663..26e5af07e2 100644
--- a/rust/bazel/crates/BUILD.js-sys-0.3.102.bazel
+++ b/rust/bazel/crates/BUILD.js-sys-0.3.105.bazel
@@ -58,9 +58,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.102",
+    version = "0.3.105",
     deps = [
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
-        "@sdk_vendor__wasm-bindgen-0.2.125//:wasm_bindgen",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
+        "@sdk_vendor__wasm-bindgen-0.2.128//:wasm_bindgen",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.leb128fmt-0.1.0.bazel b/rust/bazel/crates/BUILD.leb128fmt-0.1.0.bazel
deleted file mode 100644
index d515ef7ef7..0000000000
--- a/rust/bazel/crates/BUILD.leb128fmt-0.1.0.bazel
+++ /dev/null
@@ -1,62 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "leb128fmt",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=leb128fmt",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.1.0",
-)
diff --git a/rust/bazel/crates/BUILD.libc-0.2.186.bazel b/rust/bazel/crates/BUILD.libc-0.2.189.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.libc-0.2.186.bazel
rename to rust/bazel/crates/BUILD.libc-0.2.189.bazel
index 25808e770a..7d211e327e 100644
--- a/rust/bazel/crates/BUILD.libc-0.2.186.bazel
+++ b/rust/bazel/crates/BUILD.libc-0.2.189.bazel
@@ -66,7 +66,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.2.186",
+    version = "0.2.189",
     deps = [
         ":build_script_build",
     ],
@@ -128,7 +128,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "0.2.186",
+    version = "0.2.189",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.libloading-0.8.9.bazel b/rust/bazel/crates/BUILD.libloading-0.9.0.bazel
similarity index 87%
rename from rust/bazel/crates/BUILD.libloading-0.8.9.bazel
rename to rust/bazel/crates/BUILD.libloading-0.9.0.bazel
index b6dd941ab8..78eb8c6877 100644
--- a/rust/bazel/crates/BUILD.libloading-0.8.9.bazel
+++ b/rust/bazel/crates/BUILD.libloading-0.9.0.bazel
@@ -34,8 +34,12 @@ rust_library(
             "WORKSPACE.bazel",
         ],
     ),
+    crate_features = [
+        "default",
+        "std",
+    ],
     crate_root = "src/lib.rs",
-    edition = "2015",
+    edition = "2021",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -58,25 +62,25 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.9",
+    version = "0.9.0",
     deps = select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__cfg-if-1.0.4//:cfg_if",  # cfg(unix)
+            "@sdk_vendor__cfg-if-1.0.5//:cfg_if",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__windows-link-0.2.1//:windows_link",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__cfg-if-1.0.4//:cfg_if",  # cfg(unix)
+            "@sdk_vendor__cfg-if-1.0.5//:cfg_if",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__cfg-if-1.0.4//:cfg_if",  # cfg(unix)
+            "@sdk_vendor__cfg-if-1.0.5//:cfg_if",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
             "@sdk_vendor__windows-link-0.2.1//:windows_link",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__cfg-if-1.0.4//:cfg_if",  # cfg(unix)
+            "@sdk_vendor__cfg-if-1.0.5//:cfg_if",  # cfg(unix)
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.libredox-0.1.16.bazel b/rust/bazel/crates/BUILD.libredox-0.1.16.bazel
deleted file mode 100644
index eca71e6a25..0000000000
--- a/rust/bazel/crates/BUILD.libredox-0.1.16.bazel
+++ /dev/null
@@ -1,65 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "libredox",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=libredox",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.1.16",
-    deps = [
-        "@sdk_vendor__redox_syscall-0.7.4//:syscall",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.heck-0.5.0.bazel b/rust/bazel/crates/BUILD.libredox-0.1.25.bazel
similarity index 95%
rename from rust/bazel/crates/BUILD.heck-0.5.0.bazel
rename to rust/bazel/crates/BUILD.libredox-0.1.25.bazel
index 2f25927c9c..11c96dafb8 100644
--- a/rust/bazel/crates/BUILD.heck-0.5.0.bazel
+++ b/rust/bazel/crates/BUILD.libredox-0.1.25.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )
 
 rust_library(
-    name = "heck",
+    name = "libredox",
     srcs = glob(
         include = ["**/*.rs"],
         allow_empty = True,
@@ -44,7 +44,7 @@ rust_library(
     ],
     tags = [
         "cargo-bazel",
-        "crate-name=heck",
+        "crate-name=libredox",
         "manual",
         "noclippy",
         "norustfmt",
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.5.0",
+    version = "0.1.25",
 )
diff --git a/rust/bazel/crates/BUILD.libsqlite3-sys-0.38.2.bazel b/rust/bazel/crates/BUILD.libsqlite3-sys-0.38.2.bazel
index d598292ed1..62d1d37529 100644
--- a/rust/bazel/crates/BUILD.libsqlite3-sys-0.38.2.bazel
+++ b/rust/bazel/crates/BUILD.libsqlite3-sys-0.38.2.bazel
@@ -142,8 +142,8 @@ cargo_build_script(
     version = "0.38.2",
     visibility = ["//visibility:private"],
     deps = [
-        "@sdk_vendor__cc-1.2.61//:cc",
-        "@sdk_vendor__pkg-config-0.3.33//:pkg_config",
+        "@sdk_vendor__cc-1.4.7//:cc",
+        "@sdk_vendor__pkg-config-0.3.34//:pkg_config",
         "@sdk_vendor__vcpkg-0.2.15//:vcpkg",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.litemap-0.8.2.bazel b/rust/bazel/crates/BUILD.litemap-0.8.3.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.litemap-0.8.2.bazel
rename to rust/bazel/crates/BUILD.litemap-0.8.3.bazel
index fe09a7f616..b7301c841e 100644
--- a/rust/bazel/crates/BUILD.litemap-0.8.2.bazel
+++ b/rust/bazel/crates/BUILD.litemap-0.8.3.bazel
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.2",
+    version = "0.8.3",
 )
diff --git a/rust/bazel/crates/BUILD.log-0.4.29.bazel b/rust/bazel/crates/BUILD.log-0.4.34.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.log-0.4.29.bazel
rename to rust/bazel/crates/BUILD.log-0.4.34.bazel
index 85b4562e1a..d18439b839 100644
--- a/rust/bazel/crates/BUILD.log-0.4.29.bazel
+++ b/rust/bazel/crates/BUILD.log-0.4.34.bazel
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.4.29",
+    version = "0.4.34",
 )
diff --git a/rust/bazel/crates/BUILD.memchr-2.8.0.bazel b/rust/bazel/crates/BUILD.memchr-2.8.3.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.memchr-2.8.0.bazel
rename to rust/bazel/crates/BUILD.memchr-2.8.3.bazel
index 1063a70eab..b07ce77f2d 100644
--- a/rust/bazel/crates/BUILD.memchr-2.8.0.bazel
+++ b/rust/bazel/crates/BUILD.memchr-2.8.3.bazel
@@ -63,5 +63,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.8.0",
+    version = "2.8.3",
 )
diff --git a/rust/bazel/crates/BUILD.miniz_oxide-0.8.9.bazel b/rust/bazel/crates/BUILD.miniz_oxide-0.9.1.bazel
similarity index 95%
rename from rust/bazel/crates/BUILD.miniz_oxide-0.8.9.bazel
rename to rust/bazel/crates/BUILD.miniz_oxide-0.9.1.bazel
index 8fe3a3759f..15f03fd204 100644
--- a/rust/bazel/crates/BUILD.miniz_oxide-0.8.9.bazel
+++ b/rust/bazel/crates/BUILD.miniz_oxide-0.9.1.bazel
@@ -35,6 +35,7 @@ rust_library(
         ],
     ),
     crate_features = [
+        "default",
         "simd",
         "simd-adler32",
         "with-alloc",
@@ -63,9 +64,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.9",
+    version = "0.9.1",
     deps = [
         "@sdk_vendor__adler2-2.0.1//:adler2",
-        "@sdk_vendor__simd-adler32-0.3.9//:simd_adler32",
+        "@sdk_vendor__simd-adler32-0.3.10//:simd_adler32",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.mio-1.2.0.bazel b/rust/bazel/crates/BUILD.mio-1.2.3.bazel
similarity index 90%
rename from rust/bazel/crates/BUILD.mio-1.2.0.bazel
rename to rust/bazel/crates/BUILD.mio-1.2.3.bazel
index 56d344c77b..dbe0bcb5ce 100644
--- a/rust/bazel/crates/BUILD.mio-1.2.0.bazel
+++ b/rust/bazel/crates/BUILD.mio-1.2.3.bazel
@@ -63,25 +63,25 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.2.0",
+    version = "1.2.3",
     deps = select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(unix, target_os = "hermit", target_os = "wasi"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(unix, target_os = "hermit", target_os = "wasi"))
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(unix, target_os = "hermit", target_os = "wasi"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(unix, target_os = "hermit", target_os = "wasi"))
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(unix, target_os = "hermit", target_os = "wasi"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(unix, target_os = "hermit", target_os = "wasi"))
         ],
         "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(unix, target_os = "hermit", target_os = "wasi"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(unix, target_os = "hermit", target_os = "wasi"))
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.native-tls-0.2.18.bazel b/rust/bazel/crates/BUILD.native-tls-0.2.18.bazel
index 470157deb2..088aafec5f 100644
--- a/rust/bazel/crates/BUILD.native-tls-0.2.18.bazel
+++ b/rust/bazel/crates/BUILD.native-tls-0.2.18.bazel
@@ -39,6 +39,7 @@ rust_library(
         ],
     ),
     crate_features = [
+        "alpn",
         "default",
     ],
     crate_root = "src/lib.rs",
@@ -70,7 +71,7 @@ rust_library(
         ":build_script_build",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(target_vendor = "apple")
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(target_vendor = "apple")
             "@sdk_vendor__security-framework-3.7.0//:security_framework",  # cfg(target_vendor = "apple")
             "@sdk_vendor__security-framework-sys-2.17.0//:security_framework_sys",  # cfg(target_vendor = "apple")
             "@sdk_vendor__tempfile-3.27.0//:tempfile",  # cfg(target_os = "macos")
@@ -79,13 +80,13 @@ rust_library(
             "@sdk_vendor__schannel-0.1.29//:schannel",  # cfg(target_os = "windows")
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__log-0.4.29//:log",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
+            "@sdk_vendor__log-0.4.34//:log",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
             "@sdk_vendor__openssl-0.10.81//:openssl",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
             "@sdk_vendor__openssl-probe-0.2.1//:openssl_probe",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
             "@sdk_vendor__openssl-sys-0.9.117//:openssl_sys",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(target_vendor = "apple")
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(target_vendor = "apple")
             "@sdk_vendor__security-framework-3.7.0//:security_framework",  # cfg(target_vendor = "apple")
             "@sdk_vendor__security-framework-sys-2.17.0//:security_framework_sys",  # cfg(target_vendor = "apple")
             "@sdk_vendor__tempfile-3.27.0//:tempfile",  # cfg(target_os = "macos")
@@ -94,7 +95,7 @@ rust_library(
             "@sdk_vendor__schannel-0.1.29//:schannel",  # cfg(target_os = "windows")
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__log-0.4.29//:log",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
+            "@sdk_vendor__log-0.4.34//:log",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
             "@sdk_vendor__openssl-0.10.81//:openssl",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
             "@sdk_vendor__openssl-probe-0.2.1//:openssl_probe",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
             "@sdk_vendor__openssl-sys-0.9.117//:openssl_sys",  # cfg(not(any(target_os = "windows", target_vendor = "apple")))
@@ -126,6 +127,7 @@ cargo_build_script(
         ],
     ),
     crate_features = [
+        "alpn",
         "default",
     ],
     crate_name = "build_script_build",
diff --git a/rust/bazel/crates/BUILD.openssl-0.10.81.bazel b/rust/bazel/crates/BUILD.openssl-0.10.81.bazel
index 7430a9f4e2..48176c64f1 100644
--- a/rust/bazel/crates/BUILD.openssl-0.10.81.bazel
+++ b/rust/bazel/crates/BUILD.openssl-0.10.81.bazel
@@ -74,10 +74,10 @@ rust_library(
     version = "0.10.81",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__bitflags-2.11.1//:bitflags",
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
+        "@sdk_vendor__bitflags-2.13.2//:bitflags",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
         "@sdk_vendor__foreign-types-0.3.2//:foreign_types",
-        "@sdk_vendor__libc-0.2.186//:libc",
+        "@sdk_vendor__libc-0.2.189//:libc",
         "@sdk_vendor__openssl-sys-0.9.117//:openssl_sys",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.openssl-macros-0.1.1.bazel b/rust/bazel/crates/BUILD.openssl-macros-0.1.1.bazel
index 0e7d9e9321..532a7aef6a 100644
--- a/rust/bazel/crates/BUILD.openssl-macros-0.1.1.bazel
+++ b/rust/bazel/crates/BUILD.openssl-macros-0.1.1.bazel
@@ -60,8 +60,8 @@ rust_proc_macro(
     }),
     version = "0.1.1",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-2.0.119//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.openssl-sys-0.9.117.bazel b/rust/bazel/crates/BUILD.openssl-sys-0.9.117.bazel
index a11836e789..597180fe46 100644
--- a/rust/bazel/crates/BUILD.openssl-sys-0.9.117.bazel
+++ b/rust/bazel/crates/BUILD.openssl-sys-0.9.117.bazel
@@ -65,7 +65,7 @@ rust_library(
     version = "0.9.117",
     deps = [
         ":build_script_main",
-        "@sdk_vendor__libc-0.2.186//:libc",
+        "@sdk_vendor__libc-0.2.189//:libc",
     ],
 )
 
@@ -132,8 +132,8 @@ cargo_build_script(
     version = "0.9.117",
     visibility = ["//visibility:private"],
     deps = [
-        "@sdk_vendor__cc-1.2.61//:cc",
-        "@sdk_vendor__pkg-config-0.3.33//:pkg_config",
+        "@sdk_vendor__cc-1.4.7//:cc",
+        "@sdk_vendor__pkg-config-0.3.34//:pkg_config",
         "@sdk_vendor__vcpkg-0.2.15//:vcpkg",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.parking_lot_core-0.9.12.bazel b/rust/bazel/crates/BUILD.parking_lot_core-0.9.12.bazel
index 0c7a0b0021..e93576c2b1 100644
--- a/rust/bazel/crates/BUILD.parking_lot_core-0.9.12.bazel
+++ b/rust/bazel/crates/BUILD.parking_lot_core-0.9.12.bazel
@@ -65,26 +65,26 @@ rust_library(
     version = "0.9.12",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
-        "@sdk_vendor__smallvec-1.15.1//:smallvec",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
+        "@sdk_vendor__smallvec-1.16.1//:smallvec",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__windows-link-0.2.1//:windows_link",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
             "@sdk_vendor__windows-link-0.2.1//:windows_link",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.pem-rfc7468-1.0.0.bazel b/rust/bazel/crates/BUILD.pem-rfc7468-1.0.0.bazel
new file mode 100644
index 0000000000..2e2f4cf569
--- /dev/null
+++ b/rust/bazel/crates/BUILD.pem-rfc7468-1.0.0.bazel
@@ -0,0 +1,68 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "pem_rfc7468",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "alloc",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2024",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=pem-rfc7468",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "1.0.0",
+    deps = [
+        "@sdk_vendor__base64ct-1.8.3//:base64ct",
+    ],
+)
diff --git a/rust/bazel/crates/BUILD.pkg-config-0.3.33.bazel b/rust/bazel/crates/BUILD.pkg-config-0.3.34.bazel
similarity index 97%
rename from rust/bazel/crates/BUILD.pkg-config-0.3.33.bazel
rename to rust/bazel/crates/BUILD.pkg-config-0.3.34.bazel
index e4a562ef7d..244e942b88 100644
--- a/rust/bazel/crates/BUILD.pkg-config-0.3.33.bazel
+++ b/rust/bazel/crates/BUILD.pkg-config-0.3.34.bazel
@@ -35,7 +35,7 @@ rust_library(
         ],
     ),
     crate_root = "src/lib.rs",
-    edition = "2018",
+    edition = "2021",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.33",
+    version = "0.3.34",
 )
diff --git a/rust/bazel/crates/BUILD.plain-0.2.3.bazel b/rust/bazel/crates/BUILD.plain-0.2.3.bazel
deleted file mode 100644
index f523d40323..0000000000
--- a/rust/bazel/crates/BUILD.plain-0.2.3.bazel
+++ /dev/null
@@ -1,62 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "plain",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2015",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=plain",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.2.3",
-)
diff --git a/rust/bazel/crates/BUILD.potential_utf-0.1.5.bazel b/rust/bazel/crates/BUILD.potential_utf-0.1.6.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.potential_utf-0.1.5.bazel
rename to rust/bazel/crates/BUILD.potential_utf-0.1.6.bazel
index 3884a5afeb..93238a3d00 100644
--- a/rust/bazel/crates/BUILD.potential_utf-0.1.5.bazel
+++ b/rust/bazel/crates/BUILD.potential_utf-0.1.6.bazel
@@ -61,8 +61,8 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.1.5",
+    version = "0.1.6",
     deps = [
-        "@sdk_vendor__zerovec-0.11.6//:zerovec",
+        "@sdk_vendor__zerovec-0.11.8//:zerovec",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.ppv-lite86-0.2.21.bazel b/rust/bazel/crates/BUILD.ppv-lite86-0.2.21.bazel
index 540a5879dc..8def97951a 100644
--- a/rust/bazel/crates/BUILD.ppv-lite86-0.2.21.bazel
+++ b/rust/bazel/crates/BUILD.ppv-lite86-0.2.21.bazel
@@ -64,6 +64,6 @@ rust_library(
     }),
     version = "0.2.21",
     deps = [
-        "@sdk_vendor__zerocopy-0.8.52//:zerocopy",
+        "@sdk_vendor__zerocopy-0.8.57//:zerocopy",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.prettyplease-0.2.37.bazel b/rust/bazel/crates/BUILD.prettyplease-0.2.37.bazel
deleted file mode 100644
index 472bdc64e9..0000000000
--- a/rust/bazel/crates/BUILD.prettyplease-0.2.37.bazel
+++ /dev/null
@@ -1,134 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load(
-    "@rules_rust//cargo:defs.bzl",
-    "cargo_build_script",
-    "cargo_toml_env_vars",
-)
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "prettyplease",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=prettyplease",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.2.37",
-    deps = [
-        ":build_script_build",
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__syn-2.0.117//:syn",
-    ],
-)
-
-cargo_build_script(
-    name = "_bs",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    build_script_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            "**/*.rs",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_name = "build_script_build",
-    crate_root = "build.rs",
-    data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    edition = "2021",
-    emit_warnings = False,
-    links = "prettyplease02",
-    pkg_name = "prettyplease",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=prettyplease",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    version = "0.2.37",
-    visibility = ["//visibility:private"],
-)
-
-alias(
-    name = "build_script_build",
-    actual = ":_bs",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/BUILD.proc-macro2-1.0.106.bazel b/rust/bazel/crates/BUILD.proc-macro2-1.0.107.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.proc-macro2-1.0.106.bazel
rename to rust/bazel/crates/BUILD.proc-macro2-1.0.107.bazel
index 98eaa51819..404fbc0dab 100644
--- a/rust/bazel/crates/BUILD.proc-macro2-1.0.106.bazel
+++ b/rust/bazel/crates/BUILD.proc-macro2-1.0.107.bazel
@@ -66,10 +66,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.106",
+    version = "1.0.107",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__unicode-ident-1.0.24//:unicode_ident",
+        "@sdk_vendor__unicode-ident-1.0.26//:unicode_ident",
     ],
 )
 
@@ -129,7 +129,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.0.106",
+    version = "1.0.107",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.quote-1.0.45.bazel b/rust/bazel/crates/BUILD.quote-1.0.47.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.quote-1.0.45.bazel
rename to rust/bazel/crates/BUILD.quote-1.0.47.bazel
index 442c00f645..8d3d0fcc38 100644
--- a/rust/bazel/crates/BUILD.quote-1.0.45.bazel
+++ b/rust/bazel/crates/BUILD.quote-1.0.47.bazel
@@ -66,10 +66,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.45",
+    version = "1.0.47",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
     ],
 )
 
@@ -129,7 +129,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.0.45",
+    version = "1.0.47",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.r-efi-5.3.0.bazel b/rust/bazel/crates/BUILD.r-efi-5.3.0.bazel
new file mode 100644
index 0000000000..1ecf1d8351
--- /dev/null
+++ b/rust/bazel/crates/BUILD.r-efi-5.3.0.bazel
@@ -0,0 +1,62 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "r_efi",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_root = "src/lib.rs",
+    edition = "2018",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=r-efi",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "5.3.0",
+)
diff --git a/rust/bazel/crates/BUILD.rand-0.9.5.bazel b/rust/bazel/crates/BUILD.rand-0.9.5.bazel
new file mode 100644
index 0000000000..baccd18f4c
--- /dev/null
+++ b/rust/bazel/crates/BUILD.rand-0.9.5.bazel
@@ -0,0 +1,75 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "rand",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "alloc",
+        "default",
+        "os_rng",
+        "small_rng",
+        "std",
+        "std_rng",
+        "thread_rng",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=rand",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.9.5",
+    deps = [
+        "@sdk_vendor__rand_chacha-0.9.0//:rand_chacha",
+        "@sdk_vendor__rand_core-0.9.5//:rand_core",
+    ],
+)
diff --git a/rust/bazel/crates/BUILD.rand_chacha-0.3.1.bazel b/rust/bazel/crates/BUILD.rand_chacha-0.9.0.bazel
similarity index 95%
rename from rust/bazel/crates/BUILD.rand_chacha-0.3.1.bazel
rename to rust/bazel/crates/BUILD.rand_chacha-0.9.0.bazel
index 61e6d5250a..8944bd61c6 100644
--- a/rust/bazel/crates/BUILD.rand_chacha-0.3.1.bazel
+++ b/rust/bazel/crates/BUILD.rand_chacha-0.9.0.bazel
@@ -38,7 +38,7 @@ rust_library(
         "std",
     ],
     crate_root = "src/lib.rs",
-    edition = "2018",
+    edition = "2021",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -61,9 +61,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.1",
+    version = "0.9.0",
     deps = [
         "@sdk_vendor__ppv-lite86-0.2.21//:ppv_lite86",
-        "@sdk_vendor__rand_core-0.6.4//:rand_core",
+        "@sdk_vendor__rand_core-0.9.5//:rand_core",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.rand_core-0.6.4.bazel b/rust/bazel/crates/BUILD.rand_core-0.9.5.bazel
similarity index 93%
rename from rust/bazel/crates/BUILD.rand_core-0.6.4.bazel
rename to rust/bazel/crates/BUILD.rand_core-0.9.5.bazel
index d04d3b30a1..5ea18d1058 100644
--- a/rust/bazel/crates/BUILD.rand_core-0.6.4.bazel
+++ b/rust/bazel/crates/BUILD.rand_core-0.9.5.bazel
@@ -35,12 +35,11 @@ rust_library(
         ],
     ),
     crate_features = [
-        "alloc",
-        "getrandom",
+        "os_rng",
         "std",
     ],
     crate_root = "src/lib.rs",
-    edition = "2018",
+    edition = "2021",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -63,8 +62,8 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.6.4",
+    version = "0.9.5",
     deps = [
-        "@sdk_vendor__getrandom-0.2.17//:getrandom",
+        "@sdk_vendor__getrandom-0.3.4//:getrandom",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.redox_syscall-0.5.18.bazel b/rust/bazel/crates/BUILD.redox_syscall-0.5.18.bazel
index ecafde152d..2d9bb96ac7 100644
--- a/rust/bazel/crates/BUILD.redox_syscall-0.5.18.bazel
+++ b/rust/bazel/crates/BUILD.redox_syscall-0.5.18.bazel
@@ -60,6 +60,6 @@ rust_library(
     }),
     version = "0.5.18",
     deps = [
-        "@sdk_vendor__bitflags-2.11.1//:bitflags",
+        "@sdk_vendor__bitflags-2.13.2//:bitflags",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.redox_syscall-0.7.4.bazel b/rust/bazel/crates/BUILD.redox_syscall-0.7.4.bazel
deleted file mode 100644
index b30a37b1e7..0000000000
--- a/rust/bazel/crates/BUILD.redox_syscall-0.7.4.bazel
+++ /dev/null
@@ -1,65 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "syscall",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=redox_syscall",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.7.4",
-    deps = [
-        "@sdk_vendor__bitflags-2.11.1//:bitflags",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.redox_users-0.4.6.bazel b/rust/bazel/crates/BUILD.redox_users-0.4.6.bazel
index 80881ec842..a2bcc91501 100644
--- a/rust/bazel/crates/BUILD.redox_users-0.4.6.bazel
+++ b/rust/bazel/crates/BUILD.redox_users-0.4.6.bazel
@@ -61,7 +61,7 @@ rust_library(
     version = "0.4.6",
     deps = [
         "@sdk_vendor__getrandom-0.2.17//:getrandom",
-        "@sdk_vendor__libredox-0.1.16//:libredox",
+        "@sdk_vendor__libredox-0.1.25//:libredox",
         "@sdk_vendor__thiserror-1.0.69//:thiserror",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.ref-cast-1.0.25.bazel b/rust/bazel/crates/BUILD.ref-cast-1.0.27.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.ref-cast-1.0.25.bazel
rename to rust/bazel/crates/BUILD.ref-cast-1.0.27.bazel
index b63d092ef0..fb02bb82d8 100644
--- a/rust/bazel/crates/BUILD.ref-cast-1.0.25.bazel
+++ b/rust/bazel/crates/BUILD.ref-cast-1.0.27.bazel
@@ -41,7 +41,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__ref-cast-impl-1.0.25//:ref_cast_impl",
+        "@sdk_vendor__ref-cast-impl-1.0.27//:ref_cast_impl",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -65,7 +65,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.25",
+    version = "1.0.27",
     deps = [
         ":build_script_build",
     ],
@@ -123,7 +123,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.0.25",
+    version = "1.0.27",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.ref-cast-impl-1.0.25.bazel b/rust/bazel/crates/BUILD.ref-cast-impl-1.0.27.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.ref-cast-impl-1.0.25.bazel
rename to rust/bazel/crates/BUILD.ref-cast-impl-1.0.27.bazel
index 3267ea01f5..4e254f08fa 100644
--- a/rust/bazel/crates/BUILD.ref-cast-impl-1.0.25.bazel
+++ b/rust/bazel/crates/BUILD.ref-cast-impl-1.0.27.bazel
@@ -58,10 +58,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.25",
+    version = "1.0.27",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.regex-1.12.3.bazel b/rust/bazel/crates/BUILD.regex-1.13.1.bazel
similarity index 89%
rename from rust/bazel/crates/BUILD.regex-1.12.3.bazel
rename to rust/bazel/crates/BUILD.regex-1.13.1.bazel
index cf81cb3061..f9291e0534 100644
--- a/rust/bazel/crates/BUILD.regex-1.12.3.bazel
+++ b/rust/bazel/crates/BUILD.regex-1.13.1.bazel
@@ -77,11 +77,11 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.12.3",
+    version = "1.13.1",
     deps = [
-        "@sdk_vendor__aho-corasick-1.1.4//:aho_corasick",
-        "@sdk_vendor__memchr-2.8.0//:memchr",
-        "@sdk_vendor__regex-automata-0.4.14//:regex_automata",
-        "@sdk_vendor__regex-syntax-0.8.10//:regex_syntax",
+        "@sdk_vendor__aho-corasick-1.1.5//:aho_corasick",
+        "@sdk_vendor__memchr-2.8.3//:memchr",
+        "@sdk_vendor__regex-automata-0.4.18//:regex_automata",
+        "@sdk_vendor__regex-syntax-0.8.11//:regex_syntax",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.regex-automata-0.4.14.bazel b/rust/bazel/crates/BUILD.regex-automata-0.4.18.bazel
similarity index 92%
rename from rust/bazel/crates/BUILD.regex-automata-0.4.14.bazel
rename to rust/bazel/crates/BUILD.regex-automata-0.4.18.bazel
index 5847d23214..8458ddecbe 100644
--- a/rust/bazel/crates/BUILD.regex-automata-0.4.14.bazel
+++ b/rust/bazel/crates/BUILD.regex-automata-0.4.18.bazel
@@ -82,10 +82,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.4.14",
+    version = "0.4.18",
     deps = [
-        "@sdk_vendor__aho-corasick-1.1.4//:aho_corasick",
-        "@sdk_vendor__memchr-2.8.0//:memchr",
-        "@sdk_vendor__regex-syntax-0.8.10//:regex_syntax",
+        "@sdk_vendor__aho-corasick-1.1.5//:aho_corasick",
+        "@sdk_vendor__memchr-2.8.3//:memchr",
+        "@sdk_vendor__regex-syntax-0.8.11//:regex_syntax",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.regex-syntax-0.8.10.bazel b/rust/bazel/crates/BUILD.regex-syntax-0.8.11.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.regex-syntax-0.8.10.bazel
rename to rust/bazel/crates/BUILD.regex-syntax-0.8.11.bazel
index bd1a460602..4b658d48d6 100644
--- a/rust/bazel/crates/BUILD.regex-syntax-0.8.10.bazel
+++ b/rust/bazel/crates/BUILD.regex-syntax-0.8.11.bazel
@@ -70,5 +70,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.10",
+    version = "0.8.11",
 )
diff --git a/rust/bazel/crates/BUILD.reqwest-0.12.28.bazel b/rust/bazel/crates/BUILD.reqwest-0.12.28.bazel
deleted file mode 100644
index bf2a76ea2d..0000000000
--- a/rust/bazel/crates/BUILD.reqwest-0.12.28.bazel
+++ /dev/null
@@ -1,169 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "reqwest",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    aliases = {
-        "@sdk_vendor__native-tls-0.2.18//:native_tls": "native_tls_crate",
-    },
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "__tls",
-        "default-tls",
-        "h2",
-        "http2",
-        "stream",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=reqwest",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.12.28",
-    deps = [
-        "@sdk_vendor__base64-0.22.1//:base64",
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
-        "@sdk_vendor__futures-util-0.3.32//:futures_util",
-        "@sdk_vendor__h2-0.4.15//:h2",
-        "@sdk_vendor__http-1.4.2//:http",
-        "@sdk_vendor__hyper-tls-0.6.0//:hyper_tls",
-        "@sdk_vendor__native-tls-0.2.18//:native_tls",
-        "@sdk_vendor__rustls-pki-types-1.14.1//:rustls_pki_types",
-        "@sdk_vendor__serde-1.0.228//:serde",
-        "@sdk_vendor__serde_urlencoded-0.7.1//:serde_urlencoded",
-        "@sdk_vendor__sync_wrapper-1.0.2//:sync_wrapper",
-        "@sdk_vendor__tokio-native-tls-0.3.1//:tokio_native_tls",
-        "@sdk_vendor__tokio-util-0.7.18//:tokio_util",
-        "@sdk_vendor__url-2.5.8//:url",
-    ] + select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__http-body-1.0.1//:http_body",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__http-body-util-0.1.3//:http_body_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-1.10.1//:hyper",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__log-0.4.29//:log",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tokio-1.52.1//:tokio",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(target_arch = "wasm32"))
-        ],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
-            "@sdk_vendor__http-body-1.0.1//:http_body",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__http-body-util-0.1.3//:http_body_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-1.10.1//:hyper",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__log-0.4.29//:log",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tokio-1.52.1//:tokio",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(target_arch = "wasm32"))
-        ],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__http-body-1.0.1//:http_body",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__http-body-util-0.1.3//:http_body_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-1.10.1//:hyper",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__log-0.4.29//:log",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tokio-1.52.1//:tokio",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(target_arch = "wasm32"))
-        ],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__http-body-1.0.1//:http_body",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__http-body-util-0.1.3//:http_body_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-1.10.1//:hyper",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__log-0.4.29//:log",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tokio-1.52.1//:tokio",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(target_arch = "wasm32"))
-        ],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
-            "@sdk_vendor__http-body-1.0.1//:http_body",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__http-body-util-0.1.3//:http_body_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-1.10.1//:hyper",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__log-0.4.29//:log",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tokio-1.52.1//:tokio",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(target_arch = "wasm32"))
-        ],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__http-body-1.0.1//:http_body",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__http-body-util-0.1.3//:http_body_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-1.10.1//:hyper",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__log-0.4.29//:log",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tokio-1.52.1//:tokio",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(target_arch = "wasm32"))
-            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(target_arch = "wasm32"))
-        ],
-        "//conditions:default": [],
-    }),
-)
diff --git a/rust/bazel/crates/BUILD.reqwest-0.13.5.bazel b/rust/bazel/crates/BUILD.reqwest-0.13.5.bazel
new file mode 100644
index 0000000000..e9faa7afbd
--- /dev/null
+++ b/rust/bazel/crates/BUILD.reqwest-0.13.5.bazel
@@ -0,0 +1,168 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "reqwest",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    aliases = {
+        "@sdk_vendor__native-tls-0.2.18//:native_tls": "native_tls_crate",
+    },
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "__native-tls",
+        "__native-tls-alpn",
+        "__tls",
+        "http2",
+        "native-tls",
+        "stream",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=reqwest",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.13.5",
+    deps = [
+        "@sdk_vendor__base64-0.23.1//:base64",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
+        "@sdk_vendor__futures-util-0.3.34//:futures_util",
+        "@sdk_vendor__h2-0.4.19//:h2",
+        "@sdk_vendor__http-1.5.0//:http",
+        "@sdk_vendor__hyper-tls-0.6.0//:hyper_tls",
+        "@sdk_vendor__native-tls-0.2.18//:native_tls",
+        "@sdk_vendor__rustls-pki-types-1.15.1//:rustls_pki_types",
+        "@sdk_vendor__sync_wrapper-1.0.2//:sync_wrapper",
+        "@sdk_vendor__tokio-native-tls-0.3.1//:tokio_native_tls",
+        "@sdk_vendor__tokio-util-0.7.19//:tokio_util",
+        "@sdk_vendor__url-2.5.8//:url",
+    ] + select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [
+            "@sdk_vendor__http-body-1.1.0//:http_body",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__http-body-util-0.1.5//:http_body_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-1.11.1//:hyper",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__log-0.4.34//:log",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tokio-1.53.1//:tokio",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+        ],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
+            "@sdk_vendor__http-body-1.1.0//:http_body",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__http-body-util-0.1.5//:http_body_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-1.11.1//:hyper",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__log-0.4.34//:log",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tokio-1.53.1//:tokio",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+        ],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
+            "@sdk_vendor__http-body-1.1.0//:http_body",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__http-body-util-0.1.5//:http_body_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-1.11.1//:hyper",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__log-0.4.34//:log",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tokio-1.53.1//:tokio",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+        ],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [
+            "@sdk_vendor__http-body-1.1.0//:http_body",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__http-body-util-0.1.5//:http_body_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-1.11.1//:hyper",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__log-0.4.34//:log",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tokio-1.53.1//:tokio",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+        ],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
+            "@sdk_vendor__http-body-1.1.0//:http_body",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__http-body-util-0.1.5//:http_body_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-1.11.1//:hyper",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__log-0.4.34//:log",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tokio-1.53.1//:tokio",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+        ],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
+            "@sdk_vendor__http-body-1.1.0//:http_body",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__http-body-util-0.1.5//:http_body_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-1.11.1//:hyper",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__hyper-util-0.1.20//:hyper_util",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__log-0.4.34//:log",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tokio-1.53.1//:tokio",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-0.5.3//:tower",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-http-0.6.11//:tower_http",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+            "@sdk_vendor__tower-service-0.3.3//:tower_service",  # cfg(not(all(target_arch = "wasm32", any(target_os = "unknown", target_os = "none"))))
+        ],
+        "//conditions:default": [],
+    }),
+)
diff --git a/rust/bazel/crates/BUILD.ring-0.17.14.bazel b/rust/bazel/crates/BUILD.ring-0.17.14.bazel
index 5f837b5a63..645dbd542a 100644
--- a/rust/bazel/crates/BUILD.ring-0.17.14.bazel
+++ b/rust/bazel/crates/BUILD.ring-0.17.14.bazel
@@ -65,18 +65,18 @@ rust_library(
     version = "0.17.14",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
         "@sdk_vendor__getrandom-0.2.17//:getrandom",
         "@sdk_vendor__untrusted-0.9.0//:untrusted",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(all(all(target_arch = "aarch64", target_endian = "little"), target_vendor = "apple", any(target_os = "ios", target_os = "macos", target_os = "tvos", target_os = "visionos", target_os = "watchos")))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(all(all(target_arch = "aarch64", target_endian = "little"), target_vendor = "apple", any(target_os = "ios", target_os = "macos", target_os = "tvos", target_os = "visionos", target_os = "watchos")))
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.52.0//:windows_sys",  # cfg(all(all(target_arch = "aarch64", target_endian = "little"), target_os = "windows"))
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(all(any(all(target_arch = "aarch64", target_endian = "little"), all(target_arch = "arm", target_endian = "little")), any(target_os = "android", target_os = "linux")))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(all(any(all(target_arch = "aarch64", target_endian = "little"), all(target_arch = "arm", target_endian = "little")), any(target_os = "android", target_os = "linux")))
         ],
         "//conditions:default": [],
     }),
@@ -138,7 +138,7 @@ cargo_build_script(
     version = "0.17.14",
     visibility = ["//visibility:private"],
     deps = [
-        "@sdk_vendor__cc-1.2.61//:cc",
+        "@sdk_vendor__cc-1.4.7//:cc",
     ],
 )
 
diff --git a/rust/bazel/crates/BUILD.rsqlite-vfs-0.1.1.bazel b/rust/bazel/crates/BUILD.rsqlite-vfs-0.1.1.bazel
index b4f6378e5b..2658f0027d 100644
--- a/rust/bazel/crates/BUILD.rsqlite-vfs-0.1.1.bazel
+++ b/rust/bazel/crates/BUILD.rsqlite-vfs-0.1.1.bazel
@@ -61,6 +61,6 @@ rust_library(
     version = "0.1.1",
     deps = [
         "@sdk_vendor__hashbrown-0.16.1//:hashbrown",
-        "@sdk_vendor__thiserror-2.0.18//:thiserror",
+        "@sdk_vendor__thiserror-2.0.20//:thiserror",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.rusqlite-0.40.2.bazel b/rust/bazel/crates/BUILD.rusqlite-0.40.2.bazel
index 6c2360438f..c978000d2a 100644
--- a/rust/bazel/crates/BUILD.rusqlite-0.40.2.bazel
+++ b/rust/bazel/crates/BUILD.rusqlite-0.40.2.bazel
@@ -68,11 +68,11 @@ rust_library(
     }),
     version = "0.40.2",
     deps = [
-        "@sdk_vendor__bitflags-2.11.1//:bitflags",
+        "@sdk_vendor__bitflags-2.13.2//:bitflags",
         "@sdk_vendor__fallible-iterator-0.3.0//:fallible_iterator",
         "@sdk_vendor__fallible-streaming-iterator-0.1.9//:fallible_streaming_iterator",
         "@sdk_vendor__hashlink-0.12.2//:hashlink",
         "@sdk_vendor__libsqlite3-sys-0.38.2//:libsqlite3_sys",
-        "@sdk_vendor__smallvec-1.15.1//:smallvec",
+        "@sdk_vendor__smallvec-1.16.1//:smallvec",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.rustix-1.1.4.bazel b/rust/bazel/crates/BUILD.rustix-1.1.5.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.rustix-1.1.4.bazel
rename to rust/bazel/crates/BUILD.rustix-1.1.5.bazel
index d69c885c4b..2279ae30d9 100644
--- a/rust/bazel/crates/BUILD.rustix-1.1.4.bazel
+++ b/rust/bazel/crates/BUILD.rustix-1.1.5.bazel
@@ -83,14 +83,14 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.1.4",
+    version = "1.1.5",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__bitflags-2.11.1//:bitflags",
+        "@sdk_vendor__bitflags-2.13.2//:bitflags",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
             "@sdk_vendor__errno-0.3.14//:errno",  # aarch64-apple-darwin, cfg(all(not(windows), any(rustix_use_libc, miri, not(all(target_os = "linux", any(target_endian = "little", any(target_arch = "s390x", target_arch = "powerpc")), any(target_arch = "arm", all(target_arch = "aarch64", target_pointer_width = "64"), target_arch = "riscv64", all(rustix_use_experimental_asm, target_arch = "powerpc"), all(rustix_use_experimental_asm, target_arch = "powerpc64"), all(rustix_use_experimental_asm, target_arch = "s390x"), all(rustix_use_experimental_asm, target_arch = "mips"), all(rustix_use_experimental_asm, target_arch = "mips32r6"), all(rustix_use_experimental_asm, target_arch = "mips64"), all(rustix_use_experimental_asm, target_arch = "mips64r6"), target_arch = "x86", all(target_arch = "x86_64", target_pointer_width = "64")))))))
-            "@sdk_vendor__libc-0.2.186//:libc",  # aarch64-apple-darwin, cfg(all(not(windows), any(rustix_use_libc, miri, not(all(target_os = "linux", any(target_endian = "little", any(target_arch = "s390x", target_arch = "powerpc")), any(target_arch = "arm", all(target_arch = "aarch64", target_pointer_width = "64"), target_arch = "riscv64", all(rustix_use_experimental_asm, target_arch = "powerpc"), all(rustix_use_experimental_asm, target_arch = "powerpc64"), all(rustix_use_experimental_asm, target_arch = "s390x"), all(rustix_use_experimental_asm, target_arch = "mips"), all(rustix_use_experimental_asm, target_arch = "mips32r6"), all(rustix_use_experimental_asm, target_arch = "mips64"), all(rustix_use_experimental_asm, target_arch = "mips64r6"), target_arch = "x86", all(target_arch = "x86_64", target_pointer_width = "64")))))))
+            "@sdk_vendor__libc-0.2.189//:libc",  # aarch64-apple-darwin, cfg(all(not(windows), any(rustix_use_libc, miri, not(all(target_os = "linux", any(target_endian = "little", any(target_arch = "s390x", target_arch = "powerpc")), any(target_arch = "arm", all(target_arch = "aarch64", target_pointer_width = "64"), target_arch = "riscv64", all(rustix_use_experimental_asm, target_arch = "powerpc"), all(rustix_use_experimental_asm, target_arch = "powerpc64"), all(rustix_use_experimental_asm, target_arch = "s390x"), all(rustix_use_experimental_asm, target_arch = "mips"), all(rustix_use_experimental_asm, target_arch = "mips32r6"), all(rustix_use_experimental_asm, target_arch = "mips64"), all(rustix_use_experimental_asm, target_arch = "mips64r6"), target_arch = "x86", all(target_arch = "x86_64", target_pointer_width = "64")))))))
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__errno-0.3.14//:errno",  # cfg(windows)
@@ -101,7 +101,7 @@ rust_library(
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
             "@sdk_vendor__errno-0.3.14//:errno",  # cfg(all(not(windows), any(rustix_use_libc, miri, not(all(target_os = "linux", any(target_endian = "little", any(target_arch = "s390x", target_arch = "powerpc")), any(target_arch = "arm", all(target_arch = "aarch64", target_pointer_width = "64"), target_arch = "riscv64", all(rustix_use_experimental_asm, target_arch = "powerpc"), all(rustix_use_experimental_asm, target_arch = "powerpc64"), all(rustix_use_experimental_asm, target_arch = "s390x"), all(rustix_use_experimental_asm, target_arch = "mips"), all(rustix_use_experimental_asm, target_arch = "mips32r6"), all(rustix_use_experimental_asm, target_arch = "mips64"), all(rustix_use_experimental_asm, target_arch = "mips64r6"), target_arch = "x86", all(target_arch = "x86_64", target_pointer_width = "64"))))))), x86_64-apple-darwin
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(all(not(windows), any(rustix_use_libc, miri, not(all(target_os = "linux", any(target_endian = "little", any(target_arch = "s390x", target_arch = "powerpc")), any(target_arch = "arm", all(target_arch = "aarch64", target_pointer_width = "64"), target_arch = "riscv64", all(rustix_use_experimental_asm, target_arch = "powerpc"), all(rustix_use_experimental_asm, target_arch = "powerpc64"), all(rustix_use_experimental_asm, target_arch = "s390x"), all(rustix_use_experimental_asm, target_arch = "mips"), all(rustix_use_experimental_asm, target_arch = "mips32r6"), all(rustix_use_experimental_asm, target_arch = "mips64"), all(rustix_use_experimental_asm, target_arch = "mips64r6"), target_arch = "x86", all(target_arch = "x86_64", target_pointer_width = "64"))))))), x86_64-apple-darwin
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(all(not(windows), any(rustix_use_libc, miri, not(all(target_os = "linux", any(target_endian = "little", any(target_arch = "s390x", target_arch = "powerpc")), any(target_arch = "arm", all(target_arch = "aarch64", target_pointer_width = "64"), target_arch = "riscv64", all(rustix_use_experimental_asm, target_arch = "powerpc"), all(rustix_use_experimental_asm, target_arch = "powerpc64"), all(rustix_use_experimental_asm, target_arch = "s390x"), all(rustix_use_experimental_asm, target_arch = "mips"), all(rustix_use_experimental_asm, target_arch = "mips32r6"), all(rustix_use_experimental_asm, target_arch = "mips64"), all(rustix_use_experimental_asm, target_arch = "mips64r6"), target_arch = "x86", all(target_arch = "x86_64", target_pointer_width = "64"))))))), x86_64-apple-darwin
         ],
         "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
             "@sdk_vendor__errno-0.3.14//:errno",  # cfg(windows)
@@ -172,7 +172,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.1.4",
+    version = "1.1.5",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.rustls-0.23.40.bazel b/rust/bazel/crates/BUILD.rustls-0.23.45.bazel
similarity index 92%
rename from rust/bazel/crates/BUILD.rustls-0.23.40.bazel
rename to rust/bazel/crates/BUILD.rustls-0.23.45.bazel
index f6bc904ec8..d6a0785944 100644
--- a/rust/bazel/crates/BUILD.rustls-0.23.40.bazel
+++ b/rust/bazel/crates/BUILD.rustls-0.23.45.bazel
@@ -27,7 +27,7 @@ rust_library(
         allow_empty = True,
     ),
     aliases = {
-        "@sdk_vendor__rustls-pki-types-1.14.1//:rustls_pki_types": "pki_types",
+        "@sdk_vendor__rustls-pki-types-1.15.1//:rustls_pki_types": "pki_types",
     },
     compile_data = glob(
         include = ["**"],
@@ -65,14 +65,14 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.23.40",
+    version = "0.23.45",
     deps = [
         ":build_script_build",
         "@sdk_vendor__once_cell-1.21.4//:once_cell",
-        "@sdk_vendor__rustls-pki-types-1.14.1//:rustls_pki_types",
-        "@sdk_vendor__rustls-webpki-0.103.13//:webpki",
+        "@sdk_vendor__rustls-pki-types-1.15.1//:rustls_pki_types",
+        "@sdk_vendor__rustls-webpki-0.103.15//:webpki",
         "@sdk_vendor__subtle-2.6.1//:subtle",
-        "@sdk_vendor__zeroize-1.8.2//:zeroize",
+        "@sdk_vendor__zeroize-1.9.0//:zeroize",
     ],
 )
 
@@ -128,7 +128,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "0.23.40",
+    version = "0.23.45",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.rustls-pki-types-1.14.1.bazel b/rust/bazel/crates/BUILD.rustls-pki-types-1.15.1.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.rustls-pki-types-1.14.1.bazel
rename to rust/bazel/crates/BUILD.rustls-pki-types-1.15.1.bazel
index 12c6491112..8f2c5ad84b 100644
--- a/rust/bazel/crates/BUILD.rustls-pki-types-1.14.1.bazel
+++ b/rust/bazel/crates/BUILD.rustls-pki-types-1.15.1.bazel
@@ -63,8 +63,8 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.14.1",
+    version = "1.15.1",
     deps = [
-        "@sdk_vendor__zeroize-1.8.2//:zeroize",
+        "@sdk_vendor__zeroize-1.9.0//:zeroize",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.rustls-webpki-0.103.13.bazel b/rust/bazel/crates/BUILD.rustls-webpki-0.103.15.bazel
similarity index 92%
rename from rust/bazel/crates/BUILD.rustls-webpki-0.103.13.bazel
rename to rust/bazel/crates/BUILD.rustls-webpki-0.103.15.bazel
index 817100ebfc..da80d098b9 100644
--- a/rust/bazel/crates/BUILD.rustls-webpki-0.103.13.bazel
+++ b/rust/bazel/crates/BUILD.rustls-webpki-0.103.15.bazel
@@ -23,7 +23,7 @@ rust_library(
         allow_empty = True,
     ),
     aliases = {
-        "@sdk_vendor__rustls-pki-types-1.14.1//:rustls_pki_types": "pki_types",
+        "@sdk_vendor__rustls-pki-types-1.15.1//:rustls_pki_types": "pki_types",
     },
     compile_data = glob(
         include = ["**"],
@@ -61,9 +61,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.103.13",
+    version = "0.103.15",
     deps = [
-        "@sdk_vendor__rustls-pki-types-1.14.1//:rustls_pki_types",
+        "@sdk_vendor__rustls-pki-types-1.15.1//:rustls_pki_types",
         "@sdk_vendor__untrusted-0.9.0//:untrusted",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.rustversion-1.0.22.bazel b/rust/bazel/crates/BUILD.rustversion-1.0.23.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.rustversion-1.0.22.bazel
rename to rust/bazel/crates/BUILD.rustversion-1.0.23.bazel
index 6d4db4679b..bb39f84d4b 100644
--- a/rust/bazel/crates/BUILD.rustversion-1.0.22.bazel
+++ b/rust/bazel/crates/BUILD.rustversion-1.0.23.bazel
@@ -62,7 +62,7 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.22",
+    version = "1.0.23",
     deps = [
         ":build_script_build",
     ],
@@ -120,7 +120,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.0.22",
+    version = "1.0.23",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.ryu-1.0.23.bazel b/rust/bazel/crates/BUILD.ryu-1.0.23.bazel
deleted file mode 100644
index 140c473c6c..0000000000
--- a/rust/bazel/crates/BUILD.ryu-1.0.23.bazel
+++ /dev/null
@@ -1,62 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "ryu",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=ryu",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "1.0.23",
-)
diff --git a/rust/bazel/crates/BUILD.scc-2.4.0.bazel b/rust/bazel/crates/BUILD.scc-2.4.0.bazel
deleted file mode 100644
index e1ca6c4495..0000000000
--- a/rust/bazel/crates/BUILD.scc-2.4.0.bazel
+++ /dev/null
@@ -1,65 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "scc",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=scc",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "2.4.0",
-    deps = [
-        "@sdk_vendor__sdd-3.0.10//:sdd",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.schemars-1.2.1.bazel b/rust/bazel/crates/BUILD.schemars-1.2.2.bazel
similarity index 89%
rename from rust/bazel/crates/BUILD.schemars-1.2.1.bazel
rename to rust/bazel/crates/BUILD.schemars-1.2.2.bazel
index 4dba2175c3..658ce81a05 100644
--- a/rust/bazel/crates/BUILD.schemars-1.2.1.bazel
+++ b/rust/bazel/crates/BUILD.schemars-1.2.2.bazel
@@ -43,7 +43,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__schemars_derive-1.2.1//:schemars_derive",
+        "@sdk_vendor__schemars_derive-1.2.2//:schemars_derive",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -67,11 +67,11 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.2.1",
+    version = "1.2.2",
     deps = [
         "@sdk_vendor__dyn-clone-1.0.20//:dyn_clone",
-        "@sdk_vendor__ref-cast-1.0.25//:ref_cast",
-        "@sdk_vendor__serde-1.0.228//:serde",
-        "@sdk_vendor__serde_json-1.0.149//:serde_json",
+        "@sdk_vendor__ref-cast-1.0.27//:ref_cast",
+        "@sdk_vendor__serde-1.0.229//:serde",
+        "@sdk_vendor__serde_json-1.0.151//:serde_json",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.schemars_derive-1.2.1.bazel b/rust/bazel/crates/BUILD.schemars_derive-1.2.2.bazel
similarity index 88%
rename from rust/bazel/crates/BUILD.schemars_derive-1.2.1.bazel
rename to rust/bazel/crates/BUILD.schemars_derive-1.2.2.bazel
index c43e27275c..d9efc7a22a 100644
--- a/rust/bazel/crates/BUILD.schemars_derive-1.2.1.bazel
+++ b/rust/bazel/crates/BUILD.schemars_derive-1.2.2.bazel
@@ -58,11 +58,11 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.2.1",
+    version = "1.2.2",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__serde_derive_internals-0.29.1//:serde_derive_internals",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__serde_derive_internals-0.30.0//:serde_derive_internals",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.sdd-3.0.10.bazel b/rust/bazel/crates/BUILD.sdd-3.0.10.bazel
deleted file mode 100644
index 2dfab71e58..0000000000
--- a/rust/bazel/crates/BUILD.sdd-3.0.10.bazel
+++ /dev/null
@@ -1,62 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "sdd",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=sdd",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "3.0.10",
-)
diff --git a/rust/bazel/crates/BUILD.security-framework-3.7.0.bazel b/rust/bazel/crates/BUILD.security-framework-3.7.0.bazel
index 705d49b6db..c7dfd661c4 100644
--- a/rust/bazel/crates/BUILD.security-framework-3.7.0.bazel
+++ b/rust/bazel/crates/BUILD.security-framework-3.7.0.bazel
@@ -66,10 +66,10 @@ rust_library(
     }),
     version = "3.7.0",
     deps = [
-        "@sdk_vendor__bitflags-2.11.1//:bitflags",
+        "@sdk_vendor__bitflags-2.13.2//:bitflags",
         "@sdk_vendor__core-foundation-0.10.1//:core_foundation",
         "@sdk_vendor__core-foundation-sys-0.8.7//:core_foundation_sys",
-        "@sdk_vendor__libc-0.2.186//:libc",
+        "@sdk_vendor__libc-0.2.189//:libc",
         "@sdk_vendor__security-framework-sys-2.17.0//:security_framework_sys",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.security-framework-sys-2.17.0.bazel b/rust/bazel/crates/BUILD.security-framework-sys-2.17.0.bazel
index 0957bbef93..f87d0f4a80 100644
--- a/rust/bazel/crates/BUILD.security-framework-sys-2.17.0.bazel
+++ b/rust/bazel/crates/BUILD.security-framework-sys-2.17.0.bazel
@@ -65,6 +65,6 @@ rust_library(
     version = "2.17.0",
     deps = [
         "@sdk_vendor__core-foundation-sys-0.8.7//:core_foundation_sys",
-        "@sdk_vendor__libc-0.2.186//:libc",
+        "@sdk_vendor__libc-0.2.189//:libc",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.semver-1.0.28.bazel b/rust/bazel/crates/BUILD.semver-1.0.28.bazel
deleted file mode 100644
index 506e87948a..0000000000
--- a/rust/bazel/crates/BUILD.semver-1.0.28.bazel
+++ /dev/null
@@ -1,62 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "semver",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=semver",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "1.0.28",
-)
diff --git a/rust/bazel/crates/BUILD.serde-1.0.228.bazel b/rust/bazel/crates/BUILD.serde-1.0.229.bazel
similarity index 95%
rename from rust/bazel/crates/BUILD.serde-1.0.228.bazel
rename to rust/bazel/crates/BUILD.serde-1.0.229.bazel
index 643fb968bd..eb5b48cad6 100644
--- a/rust/bazel/crates/BUILD.serde-1.0.228.bazel
+++ b/rust/bazel/crates/BUILD.serde-1.0.229.bazel
@@ -48,7 +48,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__serde_derive-1.0.228//:serde_derive",
+        "@sdk_vendor__serde_derive-1.0.229//:serde_derive",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -72,10 +72,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.228",
+    version = "1.0.229",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__serde_core-1.0.228//:serde_core",
+        "@sdk_vendor__serde_core-1.0.229//:serde_core",
     ],
 )
 
@@ -138,7 +138,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.0.228",
+    version = "1.0.229",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.serde_core-1.0.228.bazel b/rust/bazel/crates/BUILD.serde_core-1.0.229.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.serde_core-1.0.228.bazel
rename to rust/bazel/crates/BUILD.serde_core-1.0.229.bazel
index e44276de6c..8553bf7646 100644
--- a/rust/bazel/crates/BUILD.serde_core-1.0.228.bazel
+++ b/rust/bazel/crates/BUILD.serde_core-1.0.229.bazel
@@ -67,7 +67,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.228",
+    version = "1.0.229",
     deps = [
         ":build_script_build",
     ],
@@ -130,7 +130,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.0.228",
+    version = "1.0.229",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.serde_derive-1.0.228.bazel b/rust/bazel/crates/BUILD.serde_derive-1.0.229.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.serde_derive-1.0.228.bazel
rename to rust/bazel/crates/BUILD.serde_derive-1.0.229.bazel
index 9db040f8a9..314d7ce9a6 100644
--- a/rust/bazel/crates/BUILD.serde_derive-1.0.228.bazel
+++ b/rust/bazel/crates/BUILD.serde_derive-1.0.229.bazel
@@ -61,10 +61,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.228",
+    version = "1.0.229",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.serde_derive_internals-0.29.1.bazel b/rust/bazel/crates/BUILD.serde_derive_internals-0.30.0.bazel
similarity index 90%
rename from rust/bazel/crates/BUILD.serde_derive_internals-0.29.1.bazel
rename to rust/bazel/crates/BUILD.serde_derive_internals-0.30.0.bazel
index bd95c76bf5..653686e92d 100644
--- a/rust/bazel/crates/BUILD.serde_derive_internals-0.29.1.bazel
+++ b/rust/bazel/crates/BUILD.serde_derive_internals-0.30.0.bazel
@@ -35,7 +35,7 @@ rust_library(
         ],
     ),
     crate_root = "lib.rs",
-    edition = "2015",
+    edition = "2021",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -58,10 +58,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.29.1",
+    version = "0.30.0",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.serde_json-1.0.149.bazel b/rust/bazel/crates/BUILD.serde_json-1.0.151.bazel
similarity index 94%
rename from rust/bazel/crates/BUILD.serde_json-1.0.149.bazel
rename to rust/bazel/crates/BUILD.serde_json-1.0.151.bazel
index c4d8b22d89..e02e3ef934 100644
--- a/rust/bazel/crates/BUILD.serde_json-1.0.149.bazel
+++ b/rust/bazel/crates/BUILD.serde_json-1.0.151.bazel
@@ -67,13 +67,13 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.149",
+    version = "1.0.151",
     deps = [
         ":build_script_build",
         "@sdk_vendor__itoa-1.0.18//:itoa",
-        "@sdk_vendor__memchr-2.8.0//:memchr",
-        "@sdk_vendor__serde_core-1.0.228//:serde_core",
-        "@sdk_vendor__zmij-1.0.21//:zmij",
+        "@sdk_vendor__memchr-2.8.3//:memchr",
+        "@sdk_vendor__serde_core-1.0.229//:serde_core",
+        "@sdk_vendor__zmij-1.0.23//:zmij",
     ],
 )
 
@@ -134,7 +134,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.0.149",
+    version = "1.0.151",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.serde_urlencoded-0.7.1.bazel b/rust/bazel/crates/BUILD.serde_urlencoded-0.7.1.bazel
deleted file mode 100644
index 511f668d24..0000000000
--- a/rust/bazel/crates/BUILD.serde_urlencoded-0.7.1.bazel
+++ /dev/null
@@ -1,68 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "serde_urlencoded",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2018",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=serde_urlencoded",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.7.1",
-    deps = [
-        "@sdk_vendor__form_urlencoded-1.2.2//:form_urlencoded",
-        "@sdk_vendor__itoa-1.0.18//:itoa",
-        "@sdk_vendor__ryu-1.0.23//:ryu",
-        "@sdk_vendor__serde-1.0.228//:serde",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.serial_test-3.4.0.bazel b/rust/bazel/crates/BUILD.serial_test-4.0.1.bazel
similarity index 87%
rename from rust/bazel/crates/BUILD.serial_test-3.4.0.bazel
rename to rust/bazel/crates/BUILD.serial_test-4.0.1.bazel
index 1dc79b10e0..c772102494 100644
--- a/rust/bazel/crates/BUILD.serial_test-3.4.0.bazel
+++ b/rust/bazel/crates/BUILD.serial_test-4.0.1.bazel
@@ -42,7 +42,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2018",
     proc_macro_deps = [
-        "@sdk_vendor__serial_test_derive-3.4.0//:serial_test_derive",
+        "@sdk_vendor__serial_test_derive-4.0.1//:serial_test_derive",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -66,13 +66,12 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "3.4.0",
+    version = "4.0.1",
     deps = [
-        "@sdk_vendor__futures-executor-0.3.32//:futures_executor",
-        "@sdk_vendor__futures-util-0.3.32//:futures_util",
-        "@sdk_vendor__log-0.4.29//:log",
+        "@sdk_vendor__futures-executor-0.3.34//:futures_executor",
+        "@sdk_vendor__futures-util-0.3.34//:futures_util",
+        "@sdk_vendor__log-0.4.34//:log",
         "@sdk_vendor__once_cell-1.21.4//:once_cell",
         "@sdk_vendor__parking_lot-0.12.5//:parking_lot",
-        "@sdk_vendor__scc-2.4.0//:scc",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.serial_test_derive-3.4.0.bazel b/rust/bazel/crates/BUILD.serial_test_derive-4.0.1.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.serial_test_derive-3.4.0.bazel
rename to rust/bazel/crates/BUILD.serial_test_derive-4.0.1.bazel
index 2c1fbda0e9..92dbc0220c 100644
--- a/rust/bazel/crates/BUILD.serial_test_derive-3.4.0.bazel
+++ b/rust/bazel/crates/BUILD.serial_test_derive-4.0.1.bazel
@@ -62,10 +62,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "3.4.0",
+    version = "4.0.1",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.sha1-0.10.6.bazel b/rust/bazel/crates/BUILD.sha1-0.10.7.bazel
similarity index 97%
rename from rust/bazel/crates/BUILD.sha1-0.10.6.bazel
rename to rust/bazel/crates/BUILD.sha1-0.10.7.bazel
index b45388cbaf..48564906eb 100644
--- a/rust/bazel/crates/BUILD.sha1-0.10.6.bazel
+++ b/rust/bazel/crates/BUILD.sha1-0.10.7.bazel
@@ -62,9 +62,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.10.6",
+    version = "0.10.7",
     deps = [
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
         "@sdk_vendor__digest-0.10.7//:digest",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
diff --git a/rust/bazel/crates/BUILD.sha2-0.10.9.bazel b/rust/bazel/crates/BUILD.sha2-0.10.9.bazel
index 37ed8e0f58..d060611e95 100644
--- a/rust/bazel/crates/BUILD.sha2-0.10.9.bazel
+++ b/rust/bazel/crates/BUILD.sha2-0.10.9.bazel
@@ -64,7 +64,7 @@ rust_library(
     }),
     version = "0.10.9",
     deps = [
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
         "@sdk_vendor__digest-0.10.7//:digest",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
diff --git a/rust/bazel/crates/BUILD.shlex-1.3.0.bazel b/rust/bazel/crates/BUILD.shlex-2.0.1.bazel
similarity index 97%
rename from rust/bazel/crates/BUILD.shlex-1.3.0.bazel
rename to rust/bazel/crates/BUILD.shlex-2.0.1.bazel
index cb65f66f07..5a0efd6571 100644
--- a/rust/bazel/crates/BUILD.shlex-1.3.0.bazel
+++ b/rust/bazel/crates/BUILD.shlex-2.0.1.bazel
@@ -39,7 +39,7 @@ rust_library(
         "std",
     ],
     crate_root = "src/lib.rs",
-    edition = "2015",
+    edition = "2018",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -62,5 +62,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.3.0",
+    version = "2.0.1",
 )
diff --git a/rust/bazel/crates/BUILD.signal-hook-registry-1.4.8.bazel b/rust/bazel/crates/BUILD.signal-hook-registry-1.4.8.bazel
index e30aa7a69c..79aa34dd86 100644
--- a/rust/bazel/crates/BUILD.signal-hook-registry-1.4.8.bazel
+++ b/rust/bazel/crates/BUILD.signal-hook-registry-1.4.8.bazel
@@ -61,6 +61,6 @@ rust_library(
     version = "1.4.8",
     deps = [
         "@sdk_vendor__errno-0.3.14//:errno",
-        "@sdk_vendor__libc-0.2.186//:libc",
+        "@sdk_vendor__libc-0.2.189//:libc",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.simd-adler32-0.3.9.bazel b/rust/bazel/crates/BUILD.simd-adler32-0.3.10.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.simd-adler32-0.3.9.bazel
rename to rust/bazel/crates/BUILD.simd-adler32-0.3.10.bazel
index 21c2912e90..5c432b5376 100644
--- a/rust/bazel/crates/BUILD.simd-adler32-0.3.9.bazel
+++ b/rust/bazel/crates/BUILD.simd-adler32-0.3.10.bazel
@@ -61,5 +61,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.9",
+    version = "0.3.10",
 )
diff --git a/rust/bazel/crates/BUILD.smallvec-1.15.1.bazel b/rust/bazel/crates/BUILD.smallvec-1.16.1.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.smallvec-1.15.1.bazel
rename to rust/bazel/crates/BUILD.smallvec-1.16.1.bazel
index ee7bebd6a2..963cb3d186 100644
--- a/rust/bazel/crates/BUILD.smallvec-1.15.1.bazel
+++ b/rust/bazel/crates/BUILD.smallvec-1.16.1.bazel
@@ -62,5 +62,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.15.1",
+    version = "1.16.1",
 )
diff --git a/rust/bazel/crates/BUILD.socket2-0.6.3.bazel b/rust/bazel/crates/BUILD.socket2-0.6.5.bazel
similarity index 90%
rename from rust/bazel/crates/BUILD.socket2-0.6.3.bazel
rename to rust/bazel/crates/BUILD.socket2-0.6.5.bazel
index 3fc5cd58d8..2a5adaa796 100644
--- a/rust/bazel/crates/BUILD.socket2-0.6.3.bazel
+++ b/rust/bazel/crates/BUILD.socket2-0.6.5.bazel
@@ -61,25 +61,25 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.6.3",
+    version = "0.6.5",
     deps = select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(unix, target_os = "wasi"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(unix, target_os = "wasi"))
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(unix, target_os = "wasi"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(unix, target_os = "wasi"))
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(unix, target_os = "wasi"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(unix, target_os = "wasi"))
         ],
         "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(any(unix, target_os = "wasi"))
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(any(unix, target_os = "wasi"))
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.sqlite-wasm-rs-0.5.5.bazel b/rust/bazel/crates/BUILD.sqlite-wasm-rs-0.5.5.bazel
index 41f3b7d0c1..b89ab8cadd 100644
--- a/rust/bazel/crates/BUILD.sqlite-wasm-rs-0.5.5.bazel
+++ b/rust/bazel/crates/BUILD.sqlite-wasm-rs-0.5.5.bazel
@@ -65,9 +65,9 @@ rust_library(
     version = "0.5.5",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__js-sys-0.3.102//:js_sys",
+        "@sdk_vendor__js-sys-0.3.105//:js_sys",
         "@sdk_vendor__rsqlite-vfs-0.1.1//:rsqlite_vfs",
-        "@sdk_vendor__wasm-bindgen-0.2.125//:wasm_bindgen",
+        "@sdk_vendor__wasm-bindgen-0.2.128//:wasm_bindgen",
     ],
 )
 
@@ -127,7 +127,7 @@ cargo_build_script(
     version = "0.5.5",
     visibility = ["//visibility:private"],
     deps = [
-        "@sdk_vendor__cc-1.2.61//:cc",
+        "@sdk_vendor__cc-1.4.7//:cc",
     ],
 )
 
diff --git a/rust/bazel/crates/BUILD.syn-2.0.119.bazel b/rust/bazel/crates/BUILD.syn-2.0.119.bazel
new file mode 100644
index 0000000000..12aa084095
--- /dev/null
+++ b/rust/bazel/crates/BUILD.syn-2.0.119.bazel
@@ -0,0 +1,78 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "syn",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "clone-impls",
+        "default",
+        "derive",
+        "extra-traits",
+        "full",
+        "parsing",
+        "printing",
+        "proc-macro",
+        "visit-mut",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=syn",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "2.0.119",
+    deps = [
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__unicode-ident-1.0.26//:unicode_ident",
+    ],
+)
diff --git a/rust/bazel/crates/BUILD.syn-2.0.117.bazel b/rust/bazel/crates/BUILD.syn-3.0.6.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.syn-2.0.117.bazel
rename to rust/bazel/crates/BUILD.syn-3.0.6.bazel
index 8fdbd3424b..56744c6d81 100644
--- a/rust/bazel/crates/BUILD.syn-2.0.117.bazel
+++ b/rust/bazel/crates/BUILD.syn-3.0.6.bazel
@@ -71,10 +71,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.0.117",
+    version = "3.0.6",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__unicode-ident-1.0.24//:unicode_ident",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__unicode-ident-1.0.26//:unicode_ident",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.sync_wrapper-1.0.2.bazel b/rust/bazel/crates/BUILD.sync_wrapper-1.0.2.bazel
index 09dde55cc2..c8bb2f43ce 100644
--- a/rust/bazel/crates/BUILD.sync_wrapper-1.0.2.bazel
+++ b/rust/bazel/crates/BUILD.sync_wrapper-1.0.2.bazel
@@ -64,6 +64,6 @@ rust_library(
     }),
     version = "1.0.2",
     deps = [
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.synstructure-0.13.2.bazel b/rust/bazel/crates/BUILD.synstructure-0.14.0.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.synstructure-0.13.2.bazel
rename to rust/bazel/crates/BUILD.synstructure-0.14.0.bazel
index 2d858bf502..5e4c1423f4 100644
--- a/rust/bazel/crates/BUILD.synstructure-0.13.2.bazel
+++ b/rust/bazel/crates/BUILD.synstructure-0.14.0.bazel
@@ -62,10 +62,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.13.2",
+    version = "0.14.0",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.tar-0.4.46.bazel b/rust/bazel/crates/BUILD.tar-0.4.46.bazel
index 71ffe0fceb..2b5e79eb11 100644
--- a/rust/bazel/crates/BUILD.tar-0.4.46.bazel
+++ b/rust/bazel/crates/BUILD.tar-0.4.46.bazel
@@ -64,22 +64,22 @@ rust_library(
     }),
     version = "0.4.46",
     deps = [
-        "@sdk_vendor__filetime-0.2.27//:filetime",
+        "@sdk_vendor__filetime-0.2.29//:filetime",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
             "@sdk_vendor__xattr-1.6.1//:xattr",  # aarch64-apple-darwin
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
             "@sdk_vendor__xattr-1.6.1//:xattr",  # aarch64-unknown-linux-gnu
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
             "@sdk_vendor__xattr-1.6.1//:xattr",  # x86_64-apple-darwin
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # cfg(unix)
+            "@sdk_vendor__libc-0.2.189//:libc",  # cfg(unix)
             "@sdk_vendor__xattr-1.6.1//:xattr",  # x86_64-unknown-linux-gnu
         ],
         "//conditions:default": [],
diff --git a/rust/bazel/crates/BUILD.tempfile-3.27.0.bazel b/rust/bazel/crates/BUILD.tempfile-3.27.0.bazel
index 407ecfe585..7cf72c79cf 100644
--- a/rust/bazel/crates/BUILD.tempfile-3.27.0.bazel
+++ b/rust/bazel/crates/BUILD.tempfile-3.27.0.bazel
@@ -64,27 +64,27 @@ rust_library(
     }),
     version = "3.27.0",
     deps = [
-        "@sdk_vendor__fastrand-2.4.1//:fastrand",
-        "@sdk_vendor__getrandom-0.4.2//:getrandom",
+        "@sdk_vendor__fastrand-2.5.0//:fastrand",
+        "@sdk_vendor__getrandom-0.4.3//:getrandom",
         "@sdk_vendor__once_cell-1.21.4//:once_cell",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__rustix-1.1.4//:rustix",  # cfg(any(unix, target_os = "wasi"))
+            "@sdk_vendor__rustix-1.1.5//:rustix",  # cfg(any(unix, target_os = "wasi"))
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__rustix-1.1.4//:rustix",  # cfg(any(unix, target_os = "wasi"))
+            "@sdk_vendor__rustix-1.1.5//:rustix",  # cfg(any(unix, target_os = "wasi"))
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__rustix-1.1.4//:rustix",  # cfg(any(unix, target_os = "wasi"))
+            "@sdk_vendor__rustix-1.1.5//:rustix",  # cfg(any(unix, target_os = "wasi"))
         ],
         "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # cfg(windows)
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__rustix-1.1.4//:rustix",  # cfg(any(unix, target_os = "wasi"))
+            "@sdk_vendor__rustix-1.1.5//:rustix",  # cfg(any(unix, target_os = "wasi"))
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.thiserror-2.0.18.bazel b/rust/bazel/crates/BUILD.thiserror-2.0.20.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.thiserror-2.0.18.bazel
rename to rust/bazel/crates/BUILD.thiserror-2.0.20.bazel
index 74fcff1671..999d4dfcb8 100644
--- a/rust/bazel/crates/BUILD.thiserror-2.0.18.bazel
+++ b/rust/bazel/crates/BUILD.thiserror-2.0.20.bazel
@@ -45,7 +45,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__thiserror-impl-2.0.18//:thiserror_impl",
+        "@sdk_vendor__thiserror-impl-2.0.20//:thiserror_impl",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -69,7 +69,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.0.18",
+    version = "2.0.20",
     deps = [
         ":build_script_build",
     ],
@@ -131,7 +131,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "2.0.18",
+    version = "2.0.20",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.thiserror-impl-1.0.69.bazel b/rust/bazel/crates/BUILD.thiserror-impl-1.0.69.bazel
index 5fd2cb2c16..d72430d3b2 100644
--- a/rust/bazel/crates/BUILD.thiserror-impl-1.0.69.bazel
+++ b/rust/bazel/crates/BUILD.thiserror-impl-1.0.69.bazel
@@ -60,8 +60,8 @@ rust_proc_macro(
     }),
     version = "1.0.69",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-2.0.119//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.thiserror-impl-2.0.18.bazel b/rust/bazel/crates/BUILD.thiserror-impl-2.0.20.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.thiserror-impl-2.0.18.bazel
rename to rust/bazel/crates/BUILD.thiserror-impl-2.0.20.bazel
index 53eb5d320d..945349d86f 100644
--- a/rust/bazel/crates/BUILD.thiserror-impl-2.0.18.bazel
+++ b/rust/bazel/crates/BUILD.thiserror-impl-2.0.20.bazel
@@ -58,10 +58,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.0.18",
+    version = "2.0.20",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.tinystr-0.8.3.bazel b/rust/bazel/crates/BUILD.tinystr-0.8.4.bazel
similarity index 93%
rename from rust/bazel/crates/BUILD.tinystr-0.8.3.bazel
rename to rust/bazel/crates/BUILD.tinystr-0.8.4.bazel
index f55f07ff99..6d42b39c71 100644
--- a/rust/bazel/crates/BUILD.tinystr-0.8.3.bazel
+++ b/rust/bazel/crates/BUILD.tinystr-0.8.4.bazel
@@ -40,7 +40,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__displaydoc-0.2.5//:displaydoc",
+        "@sdk_vendor__displaydoc-0.2.7//:displaydoc",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -64,8 +64,8 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.3",
+    version = "0.8.4",
     deps = [
-        "@sdk_vendor__zerovec-0.11.6//:zerovec",
+        "@sdk_vendor__zerovec-0.11.8//:zerovec",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.tokio-1.52.1.bazel b/rust/bazel/crates/BUILD.tokio-1.53.1.bazel
similarity index 88%
rename from rust/bazel/crates/BUILD.tokio-1.52.1.bazel
rename to rust/bazel/crates/BUILD.tokio-1.53.1.bazel
index 262e130be3..c80392b942 100644
--- a/rust/bazel/crates/BUILD.tokio-1.52.1.bazel
+++ b/rust/bazel/crates/BUILD.tokio-1.53.1.bazel
@@ -63,7 +63,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__tokio-macros-2.7.0//:tokio_macros",
+        "@sdk_vendor__tokio-macros-2.7.2//:tokio_macros",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -87,33 +87,33 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.52.1",
+    version = "1.53.1",
     deps = [
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__mio-1.2.0//:mio",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__mio-1.2.3//:mio",
         "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
-        "@sdk_vendor__socket2-0.6.3//:socket2",
+        "@sdk_vendor__socket2-0.6.5//:socket2",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # aarch64-apple-darwin
+            "@sdk_vendor__libc-0.2.189//:libc",  # aarch64-apple-darwin
             "@sdk_vendor__signal-hook-registry-1.4.8//:signal_hook_registry",  # aarch64-apple-darwin
         ],
         "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # aarch64-pc-windows-msvc
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # aarch64-unknown-linux-gnu
+            "@sdk_vendor__libc-0.2.189//:libc",  # aarch64-unknown-linux-gnu
             "@sdk_vendor__signal-hook-registry-1.4.8//:signal_hook_registry",  # aarch64-unknown-linux-gnu
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # x86_64-apple-darwin
+            "@sdk_vendor__libc-0.2.189//:libc",  # x86_64-apple-darwin
             "@sdk_vendor__signal-hook-registry-1.4.8//:signal_hook_registry",  # x86_64-apple-darwin
         ],
         "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [
             "@sdk_vendor__windows-sys-0.61.2//:windows_sys",  # x86_64-pc-windows-msvc
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # x86_64-unknown-linux-gnu
+            "@sdk_vendor__libc-0.2.189//:libc",  # x86_64-unknown-linux-gnu
             "@sdk_vendor__signal-hook-registry-1.4.8//:signal_hook_registry",  # x86_64-unknown-linux-gnu
         ],
         "//conditions:default": [],
diff --git a/rust/bazel/crates/BUILD.tokio-macros-2.7.0.bazel b/rust/bazel/crates/BUILD.tokio-macros-2.7.2.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.tokio-macros-2.7.0.bazel
rename to rust/bazel/crates/BUILD.tokio-macros-2.7.2.bazel
index c34eaed5d7..d87ef9080d 100644
--- a/rust/bazel/crates/BUILD.tokio-macros-2.7.0.bazel
+++ b/rust/bazel/crates/BUILD.tokio-macros-2.7.2.bazel
@@ -58,10 +58,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.7.0",
+    version = "2.7.2",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.tokio-native-tls-0.3.1.bazel b/rust/bazel/crates/BUILD.tokio-native-tls-0.3.1.bazel
index 4e26d63148..0ad24909c2 100644
--- a/rust/bazel/crates/BUILD.tokio-native-tls-0.3.1.bazel
+++ b/rust/bazel/crates/BUILD.tokio-native-tls-0.3.1.bazel
@@ -61,6 +61,6 @@ rust_library(
     version = "0.3.1",
     deps = [
         "@sdk_vendor__native-tls-0.2.18//:native_tls",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.tokio-rustls-0.26.4.bazel b/rust/bazel/crates/BUILD.tokio-rustls-0.26.5.bazel
similarity index 93%
rename from rust/bazel/crates/BUILD.tokio-rustls-0.26.4.bazel
rename to rust/bazel/crates/BUILD.tokio-rustls-0.26.5.bazel
index 72ffe1949a..1c7e6bb80c 100644
--- a/rust/bazel/crates/BUILD.tokio-rustls-0.26.4.bazel
+++ b/rust/bazel/crates/BUILD.tokio-rustls-0.26.5.bazel
@@ -58,9 +58,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.26.4",
+    version = "0.26.5",
     deps = [
-        "@sdk_vendor__rustls-0.23.40//:rustls",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
+        "@sdk_vendor__rustls-0.23.45//:rustls",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.tokio-stream-0.1.18.bazel b/rust/bazel/crates/BUILD.tokio-stream-0.1.19.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.tokio-stream-0.1.18.bazel
rename to rust/bazel/crates/BUILD.tokio-stream-0.1.19.bazel
index e430c615bd..e3554e7af6 100644
--- a/rust/bazel/crates/BUILD.tokio-stream-0.1.18.bazel
+++ b/rust/bazel/crates/BUILD.tokio-stream-0.1.19.bazel
@@ -64,11 +64,11 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.1.18",
+    version = "0.1.19",
     deps = [
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
         "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
-        "@sdk_vendor__tokio-util-0.7.18//:tokio_util",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
+        "@sdk_vendor__tokio-util-0.7.19//:tokio_util",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.tokio-tungstenite-0.24.0.bazel b/rust/bazel/crates/BUILD.tokio-tungstenite-0.28.0.bazel
similarity index 90%
rename from rust/bazel/crates/BUILD.tokio-tungstenite-0.24.0.bazel
rename to rust/bazel/crates/BUILD.tokio-tungstenite-0.28.0.bazel
index a045431e51..47563b514f 100644
--- a/rust/bazel/crates/BUILD.tokio-tungstenite-0.24.0.bazel
+++ b/rust/bazel/crates/BUILD.tokio-tungstenite-0.28.0.bazel
@@ -69,13 +69,13 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.24.0",
+    version = "0.28.0",
     deps = [
-        "@sdk_vendor__futures-util-0.3.32//:futures_util",
-        "@sdk_vendor__log-0.4.29//:log",
+        "@sdk_vendor__futures-util-0.3.34//:futures_util",
+        "@sdk_vendor__log-0.4.34//:log",
         "@sdk_vendor__native-tls-0.2.18//:native_tls",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
         "@sdk_vendor__tokio-native-tls-0.3.1//:tokio_native_tls",
-        "@sdk_vendor__tungstenite-0.24.0//:tungstenite",
+        "@sdk_vendor__tungstenite-0.28.0//:tungstenite",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.tokio-util-0.7.18.bazel b/rust/bazel/crates/BUILD.tokio-util-0.7.18.bazel
deleted file mode 100644
index aceb549a2c..0000000000
--- a/rust/bazel/crates/BUILD.tokio-util-0.7.18.bazel
+++ /dev/null
@@ -1,74 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "tokio_util",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "codec",
-        "default",
-        "io",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=tokio-util",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.7.18",
-    deps = [
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
-        "@sdk_vendor__futures-sink-0.3.32//:futures_sink",
-        "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.rand-0.8.6.bazel b/rust/bazel/crates/BUILD.tokio-util-0.7.19.bazel
similarity index 76%
rename from rust/bazel/crates/BUILD.rand-0.8.6.bazel
rename to rust/bazel/crates/BUILD.tokio-util-0.7.19.bazel
index 345fe6ca4c..34fda84e77 100644
--- a/rust/bazel/crates/BUILD.rand-0.8.6.bazel
+++ b/rust/bazel/crates/BUILD.tokio-util-0.7.19.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )
 
 rust_library(
-    name = "rand",
+    name = "tokio_util",
     srcs = glob(
         include = ["**/*.rs"],
         allow_empty = True,
@@ -35,16 +35,13 @@ rust_library(
         ],
     ),
     crate_features = [
-        "alloc",
+        "codec",
         "default",
-        "getrandom",
+        "io",
         "libc",
-        "rand_chacha",
-        "std",
-        "std_rng",
     ],
     crate_root = "src/lib.rs",
-    edition = "2018",
+    edition = "2021",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -53,7 +50,7 @@ rust_library(
     ],
     tags = [
         "cargo-bazel",
-        "crate-name=rand",
+        "crate-name=tokio-util",
         "manual",
         "noclippy",
         "norustfmt",
@@ -67,22 +64,25 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.6",
+    version = "0.7.19",
     deps = [
-        "@sdk_vendor__rand_chacha-0.3.1//:rand_chacha",
-        "@sdk_vendor__rand_core-0.6.4//:rand_core",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
+        "@sdk_vendor__futures-sink-0.3.34//:futures_sink",
+        "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
     ] + select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # aarch64-apple-darwin
+            "@sdk_vendor__libc-0.2.189//:libc",  # aarch64-apple-darwin
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # aarch64-unknown-linux-gnu
+            "@sdk_vendor__libc-0.2.189//:libc",  # aarch64-unknown-linux-gnu
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # x86_64-apple-darwin
+            "@sdk_vendor__libc-0.2.189//:libc",  # x86_64-apple-darwin
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__libc-0.2.186//:libc",  # x86_64-unknown-linux-gnu
+            "@sdk_vendor__libc-0.2.189//:libc",  # x86_64-unknown-linux-gnu
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.tower-0.5.3.bazel b/rust/bazel/crates/BUILD.tower-0.5.3.bazel
index 73184ff179..37935e8156 100644
--- a/rust/bazel/crates/BUILD.tower-0.5.3.bazel
+++ b/rust/bazel/crates/BUILD.tower-0.5.3.bazel
@@ -70,11 +70,11 @@ rust_library(
     }),
     version = "0.5.3",
     deps = [
-        "@sdk_vendor__futures-core-0.3.32//:futures_core",
-        "@sdk_vendor__futures-util-0.3.32//:futures_util",
+        "@sdk_vendor__futures-core-0.3.34//:futures_core",
+        "@sdk_vendor__futures-util-0.3.34//:futures_util",
         "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
         "@sdk_vendor__sync_wrapper-1.0.2//:sync_wrapper",
-        "@sdk_vendor__tokio-1.52.1//:tokio",
+        "@sdk_vendor__tokio-1.53.1//:tokio",
         "@sdk_vendor__tower-layer-0.3.3//:tower_layer",
         "@sdk_vendor__tower-service-0.3.3//:tower_service",
     ],
diff --git a/rust/bazel/crates/BUILD.tower-http-0.6.11.bazel b/rust/bazel/crates/BUILD.tower-http-0.6.11.bazel
index 69e0de56ca..3188cf4752 100644
--- a/rust/bazel/crates/BUILD.tower-http-0.6.11.bazel
+++ b/rust/bazel/crates/BUILD.tower-http-0.6.11.bazel
@@ -65,11 +65,11 @@ rust_library(
     }),
     version = "0.6.11",
     deps = [
-        "@sdk_vendor__bitflags-2.11.1//:bitflags",
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__futures-util-0.3.32//:futures_util",
-        "@sdk_vendor__http-1.4.2//:http",
-        "@sdk_vendor__http-body-1.0.1//:http_body",
+        "@sdk_vendor__bitflags-2.13.2//:bitflags",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__futures-util-0.3.34//:futures_util",
+        "@sdk_vendor__http-1.5.0//:http",
+        "@sdk_vendor__http-body-1.1.0//:http_body",
         "@sdk_vendor__pin-project-lite-0.2.17//:pin_project_lite",
         "@sdk_vendor__tower-0.5.3//:tower",
         "@sdk_vendor__tower-layer-0.3.3//:tower_layer",
diff --git a/rust/bazel/crates/BUILD.tracing-attributes-0.1.31.bazel b/rust/bazel/crates/BUILD.tracing-attributes-0.1.31.bazel
index e29360249e..c54729a564 100644
--- a/rust/bazel/crates/BUILD.tracing-attributes-0.1.31.bazel
+++ b/rust/bazel/crates/BUILD.tracing-attributes-0.1.31.bazel
@@ -60,8 +60,8 @@ rust_proc_macro(
     }),
     version = "0.1.31",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-2.0.119//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.tungstenite-0.24.0.bazel b/rust/bazel/crates/BUILD.tungstenite-0.28.0.bazel
similarity index 83%
rename from rust/bazel/crates/BUILD.tungstenite-0.24.0.bazel
rename to rust/bazel/crates/BUILD.tungstenite-0.28.0.bazel
index dabc9d9ff0..70369674f7 100644
--- a/rust/bazel/crates/BUILD.tungstenite-0.24.0.bazel
+++ b/rust/bazel/crates/BUILD.tungstenite-0.28.0.bazel
@@ -47,7 +47,7 @@ rust_library(
         "sha1",
     ],
     crate_root = "src/lib.rs",
-    edition = "2018",
+    edition = "2021",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -70,18 +70,17 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.24.0",
+    version = "0.28.0",
     deps = [
-        "@sdk_vendor__byteorder-1.5.0//:byteorder",
-        "@sdk_vendor__bytes-1.11.1//:bytes",
-        "@sdk_vendor__data-encoding-2.11.0//:data_encoding",
-        "@sdk_vendor__http-1.4.2//:http",
+        "@sdk_vendor__bytes-1.12.1//:bytes",
+        "@sdk_vendor__data-encoding-2.11.1//:data_encoding",
+        "@sdk_vendor__http-1.5.0//:http",
         "@sdk_vendor__httparse-1.10.1//:httparse",
-        "@sdk_vendor__log-0.4.29//:log",
+        "@sdk_vendor__log-0.4.34//:log",
         "@sdk_vendor__native-tls-0.2.18//:native_tls",
-        "@sdk_vendor__rand-0.8.6//:rand",
-        "@sdk_vendor__sha1-0.10.6//:sha1",
-        "@sdk_vendor__thiserror-1.0.69//:thiserror",
+        "@sdk_vendor__rand-0.9.5//:rand",
+        "@sdk_vendor__sha1-0.10.7//:sha1",
+        "@sdk_vendor__thiserror-2.0.20//:thiserror",
         "@sdk_vendor__utf-8-0.7.6//:utf8",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.byteorder-1.5.0.bazel b/rust/bazel/crates/BUILD.typed-path-0.12.3.bazel
similarity index 95%
rename from rust/bazel/crates/BUILD.byteorder-1.5.0.bazel
rename to rust/bazel/crates/BUILD.typed-path-0.12.3.bazel
index cb6f98358b..a85a887c2f 100644
--- a/rust/bazel/crates/BUILD.byteorder-1.5.0.bazel
+++ b/rust/bazel/crates/BUILD.typed-path-0.12.3.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )
 
 rust_library(
-    name = "byteorder",
+    name = "typed_path",
     srcs = glob(
         include = ["**/*.rs"],
         allow_empty = True,
@@ -48,7 +48,7 @@ rust_library(
     ],
     tags = [
         "cargo-bazel",
-        "crate-name=byteorder",
+        "crate-name=typed-path",
         "manual",
         "noclippy",
         "norustfmt",
@@ -62,5 +62,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.5.0",
+    version = "0.12.3",
 )
diff --git a/rust/bazel/crates/BUILD.typenum-1.20.0.bazel b/rust/bazel/crates/BUILD.typenum-1.20.1.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.typenum-1.20.0.bazel
rename to rust/bazel/crates/BUILD.typenum-1.20.1.bazel
index 8daa9d646a..06c9386694 100644
--- a/rust/bazel/crates/BUILD.typenum-1.20.0.bazel
+++ b/rust/bazel/crates/BUILD.typenum-1.20.1.bazel
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.20.0",
+    version = "1.20.1",
 )
diff --git a/rust/bazel/crates/BUILD.unicode-ident-1.0.24.bazel b/rust/bazel/crates/BUILD.unicode-ident-1.0.26.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.unicode-ident-1.0.24.bazel
rename to rust/bazel/crates/BUILD.unicode-ident-1.0.26.bazel
index 38c745d535..08cb346372 100644
--- a/rust/bazel/crates/BUILD.unicode-ident-1.0.24.bazel
+++ b/rust/bazel/crates/BUILD.unicode-ident-1.0.26.bazel
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.24",
+    version = "1.0.26",
 )
diff --git a/rust/bazel/crates/BUILD.unicode-xid-0.2.6.bazel b/rust/bazel/crates/BUILD.unicode-xid-0.2.6.bazel
deleted file mode 100644
index 358cd8ff52..0000000000
--- a/rust/bazel/crates/BUILD.unicode-xid-0.2.6.bazel
+++ /dev/null
@@ -1,65 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "unicode_xid",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "default",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2015",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=unicode-xid",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.2.6",
-)
diff --git a/rust/bazel/crates/BUILD.ureq-2.12.1.bazel b/rust/bazel/crates/BUILD.ureq-3.4.2.bazel
similarity index 76%
rename from rust/bazel/crates/BUILD.ureq-2.12.1.bazel
rename to rust/bazel/crates/BUILD.ureq-3.4.2.bazel
index 1c56ab39f7..604b745e04 100644
--- a/rust/bazel/crates/BUILD.ureq-2.12.1.bazel
+++ b/rust/bazel/crates/BUILD.ureq-3.4.2.bazel
@@ -35,10 +35,13 @@ rust_library(
         ],
     ),
     crate_features = [
+        "_tls",
         "native-tls",
+        "native-tls-no-default",
+        "native-tls-webpki-roots",
     ],
     crate_root = "src/lib.rs",
-    edition = "2018",
+    edition = "2024",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -61,12 +64,16 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.12.1",
+    version = "3.4.2",
     deps = [
-        "@sdk_vendor__base64-0.22.1//:base64",
-        "@sdk_vendor__log-0.4.29//:log",
+        "@sdk_vendor__base64-0.23.1//:base64",
+        "@sdk_vendor__der-0.8.2//:der",
+        "@sdk_vendor__log-0.4.34//:log",
         "@sdk_vendor__native-tls-0.2.18//:native_tls",
-        "@sdk_vendor__once_cell-1.21.4//:once_cell",
-        "@sdk_vendor__url-2.5.8//:url",
+        "@sdk_vendor__percent-encoding-2.3.2//:percent_encoding",
+        "@sdk_vendor__rustls-pki-types-1.15.1//:rustls_pki_types",
+        "@sdk_vendor__ureq-proto-0.6.4//:ureq_proto",
+        "@sdk_vendor__utf8-zero-0.8.1//:utf8_zero",
+        "@sdk_vendor__webpki-root-certs-1.0.9//:webpki_root_certs",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.ureq-proto-0.6.4.bazel b/rust/bazel/crates/BUILD.ureq-proto-0.6.4.bazel
new file mode 100644
index 0000000000..f9f2664431
--- /dev/null
+++ b/rust/bazel/crates/BUILD.ureq-proto-0.6.4.bazel
@@ -0,0 +1,71 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "ureq_proto",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "client",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2024",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=ureq-proto",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.6.4",
+    deps = [
+        "@sdk_vendor__base64-0.23.1//:base64",
+        "@sdk_vendor__http-1.5.0//:http",
+        "@sdk_vendor__httparse-1.10.1//:httparse",
+        "@sdk_vendor__log-0.4.34//:log",
+    ],
+)
diff --git a/rust/bazel/crates/BUILD.id-arena-2.3.0.bazel b/rust/bazel/crates/BUILD.utf8-zero-0.8.1.bazel
similarity index 95%
rename from rust/bazel/crates/BUILD.id-arena-2.3.0.bazel
rename to rust/bazel/crates/BUILD.utf8-zero-0.8.1.bazel
index 3fb794c501..84a9ad3625 100644
--- a/rust/bazel/crates/BUILD.id-arena-2.3.0.bazel
+++ b/rust/bazel/crates/BUILD.utf8-zero-0.8.1.bazel
@@ -17,7 +17,7 @@ cargo_toml_env_vars(
 )
 
 rust_library(
-    name = "id_arena",
+    name = "utf8_zero",
     srcs = glob(
         include = ["**/*.rs"],
         allow_empty = True,
@@ -48,7 +48,7 @@ rust_library(
     ],
     tags = [
         "cargo-bazel",
-        "crate-name=id-arena",
+        "crate-name=utf8-zero",
         "manual",
         "noclippy",
         "norustfmt",
@@ -62,5 +62,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "2.3.0",
+    version = "0.8.1",
 )
diff --git a/rust/bazel/crates/BUILD.uuid-1.23.1.bazel b/rust/bazel/crates/BUILD.uuid-1.26.1.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.uuid-1.23.1.bazel
rename to rust/bazel/crates/BUILD.uuid-1.26.1.bazel
index 0f4dce5aac..fddb3887d4 100644
--- a/rust/bazel/crates/BUILD.uuid-1.23.1.bazel
+++ b/rust/bazel/crates/BUILD.uuid-1.26.1.bazel
@@ -62,8 +62,8 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.23.1",
+    version = "1.26.1",
     deps = [
-        "@sdk_vendor__getrandom-0.4.2//:getrandom",
+        "@sdk_vendor__getrandom-0.4.3//:getrandom",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.wasip2-1.0.3+wasi-0.2.9.bazel b/rust/bazel/crates/BUILD.wasip2-1.0.4+wasi-0.2.12.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.wasip2-1.0.3+wasi-0.2.9.bazel
rename to rust/bazel/crates/BUILD.wasip2-1.0.4+wasi-0.2.12.bazel
index 11171ce01f..b8374ad7ea 100644
--- a/rust/bazel/crates/BUILD.wasip2-1.0.3+wasi-0.2.9.bazel
+++ b/rust/bazel/crates/BUILD.wasip2-1.0.4+wasi-0.2.12.bazel
@@ -58,7 +58,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.3+wasi-0.2.9",
+    version = "1.0.4+wasi-0.2.12",
     deps = [
         "@sdk_vendor__wit-bindgen-0.57.1//:wit_bindgen",
     ],
diff --git a/rust/bazel/crates/BUILD.wasip3-0.4.0+wasi-0.3.0-rc-2026-01-06.bazel b/rust/bazel/crates/BUILD.wasip3-0.4.0+wasi-0.3.0-rc-2026-01-06.bazel
deleted file mode 100644
index 74259e8822..0000000000
--- a/rust/bazel/crates/BUILD.wasip3-0.4.0+wasi-0.3.0-rc-2026-01-06.bazel
+++ /dev/null
@@ -1,65 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "wasip3",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wasip3",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.4.0+wasi-0.3.0-rc-2026-01-06",
-    deps = [
-        "@sdk_vendor__wit-bindgen-0.51.0//:wit_bindgen",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.wasm-bindgen-0.2.125.bazel b/rust/bazel/crates/BUILD.wasm-bindgen-0.2.128.bazel
similarity index 89%
rename from rust/bazel/crates/BUILD.wasm-bindgen-0.2.125.bazel
rename to rust/bazel/crates/BUILD.wasm-bindgen-0.2.128.bazel
index 10e23f3945..579c0200ee 100644
--- a/rust/bazel/crates/BUILD.wasm-bindgen-0.2.125.bazel
+++ b/rust/bazel/crates/BUILD.wasm-bindgen-0.2.128.bazel
@@ -41,7 +41,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__wasm-bindgen-macro-0.2.125//:wasm_bindgen_macro",
+        "@sdk_vendor__wasm-bindgen-macro-0.2.128//:wasm_bindgen_macro",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -65,12 +65,12 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.2.125",
+    version = "0.2.128",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__cfg-if-1.0.4//:cfg_if",
+        "@sdk_vendor__cfg-if-1.0.5//:cfg_if",
         "@sdk_vendor__once_cell-1.21.4//:once_cell",
-        "@sdk_vendor__wasm-bindgen-shared-0.2.125//:wasm_bindgen_shared",
+        "@sdk_vendor__wasm-bindgen-shared-0.2.128//:wasm_bindgen_shared",
     ],
 )
 
@@ -81,7 +81,7 @@ cargo_build_script(
         allow_empty = True,
     ),
     aliases = {
-        "@sdk_vendor__rustversion-1.0.22//:rustversion": "rustversion_compat",
+        "@sdk_vendor__rustversion-1.0.23//:rustversion": "rustversion_compat",
     },
     build_script_env_files = [
         ":cargo_toml_env_vars",
@@ -116,11 +116,11 @@ cargo_build_script(
     edition = "2021",
     emit_warnings = False,
     link_deps = [
-        "@sdk_vendor__wasm-bindgen-shared-0.2.125//:wasm_bindgen_shared",
+        "@sdk_vendor__wasm-bindgen-shared-0.2.128//:wasm_bindgen_shared",
     ],
     pkg_name = "wasm-bindgen",
     proc_macro_deps = [
-        "@sdk_vendor__rustversion-1.0.22//:rustversion",
+        "@sdk_vendor__rustversion-1.0.23//:rustversion",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -135,7 +135,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "0.2.125",
+    version = "0.2.128",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.wasm-bindgen-futures-0.4.75.bazel b/rust/bazel/crates/BUILD.wasm-bindgen-futures-0.4.78.bazel
similarity index 93%
rename from rust/bazel/crates/BUILD.wasm-bindgen-futures-0.4.75.bazel
rename to rust/bazel/crates/BUILD.wasm-bindgen-futures-0.4.78.bazel
index c8e4f081c2..26f69ece36 100644
--- a/rust/bazel/crates/BUILD.wasm-bindgen-futures-0.4.75.bazel
+++ b/rust/bazel/crates/BUILD.wasm-bindgen-futures-0.4.78.bazel
@@ -58,9 +58,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.4.75",
+    version = "0.4.78",
     deps = [
-        "@sdk_vendor__js-sys-0.3.102//:js_sys",
-        "@sdk_vendor__wasm-bindgen-0.2.125//:wasm_bindgen",
+        "@sdk_vendor__js-sys-0.3.105//:js_sys",
+        "@sdk_vendor__wasm-bindgen-0.2.128//:wasm_bindgen",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.wasm-bindgen-macro-0.2.125.bazel b/rust/bazel/crates/BUILD.wasm-bindgen-macro-0.2.128.bazel
similarity index 93%
rename from rust/bazel/crates/BUILD.wasm-bindgen-macro-0.2.125.bazel
rename to rust/bazel/crates/BUILD.wasm-bindgen-macro-0.2.128.bazel
index 0ef86a5fdf..5fca8a6bf9 100644
--- a/rust/bazel/crates/BUILD.wasm-bindgen-macro-0.2.125.bazel
+++ b/rust/bazel/crates/BUILD.wasm-bindgen-macro-0.2.128.bazel
@@ -58,9 +58,9 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.2.125",
+    version = "0.2.128",
     deps = [
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__wasm-bindgen-macro-support-0.2.125//:wasm_bindgen_macro_support",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__wasm-bindgen-macro-support-0.2.128//:wasm_bindgen_macro_support",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.wasm-bindgen-macro-support-0.2.125.bazel b/rust/bazel/crates/BUILD.wasm-bindgen-macro-support-0.2.128.bazel
similarity index 86%
rename from rust/bazel/crates/BUILD.wasm-bindgen-macro-support-0.2.125.bazel
rename to rust/bazel/crates/BUILD.wasm-bindgen-macro-support-0.2.128.bazel
index b204571555..e055534b80 100644
--- a/rust/bazel/crates/BUILD.wasm-bindgen-macro-support-0.2.125.bazel
+++ b/rust/bazel/crates/BUILD.wasm-bindgen-macro-support-0.2.128.bazel
@@ -58,12 +58,12 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.2.125",
+    version = "0.2.128",
     deps = [
-        "@sdk_vendor__bumpalo-3.20.2//:bumpalo",
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
-        "@sdk_vendor__wasm-bindgen-shared-0.2.125//:wasm_bindgen_shared",
+        "@sdk_vendor__bumpalo-3.20.3//:bumpalo",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
+        "@sdk_vendor__wasm-bindgen-shared-0.2.128//:wasm_bindgen_shared",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.wasm-bindgen-shared-0.2.125.bazel b/rust/bazel/crates/BUILD.wasm-bindgen-shared-0.2.128.bazel
similarity index 96%
rename from rust/bazel/crates/BUILD.wasm-bindgen-shared-0.2.125.bazel
rename to rust/bazel/crates/BUILD.wasm-bindgen-shared-0.2.128.bazel
index c23ec7e3a9..b06eddfb36 100644
--- a/rust/bazel/crates/BUILD.wasm-bindgen-shared-0.2.125.bazel
+++ b/rust/bazel/crates/BUILD.wasm-bindgen-shared-0.2.128.bazel
@@ -62,10 +62,10 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.2.125",
+    version = "0.2.128",
     deps = [
         ":build_script_build",
-        "@sdk_vendor__unicode-ident-1.0.24//:unicode_ident",
+        "@sdk_vendor__unicode-ident-1.0.26//:unicode_ident",
     ],
 )
 
@@ -122,7 +122,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "0.2.125",
+    version = "0.2.128",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.wasm-encoder-0.244.0.bazel b/rust/bazel/crates/BUILD.wasm-encoder-0.244.0.bazel
deleted file mode 100644
index 2cc8a49ed9..0000000000
--- a/rust/bazel/crates/BUILD.wasm-encoder-0.244.0.bazel
+++ /dev/null
@@ -1,71 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "wasm_encoder",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "component-model",
-        "std",
-        "wasmparser",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wasm-encoder",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.244.0",
-    deps = [
-        "@sdk_vendor__leb128fmt-0.1.0//:leb128fmt",
-        "@sdk_vendor__wasmparser-0.244.0//:wasmparser",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.wasm-metadata-0.244.0.bazel b/rust/bazel/crates/BUILD.wasm-metadata-0.244.0.bazel
deleted file mode 100644
index 82c5bb031a..0000000000
--- a/rust/bazel/crates/BUILD.wasm-metadata-0.244.0.bazel
+++ /dev/null
@@ -1,68 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "wasm_metadata",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wasm-metadata",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.244.0",
-    deps = [
-        "@sdk_vendor__anyhow-1.0.102//:anyhow",
-        "@sdk_vendor__indexmap-2.14.0//:indexmap",
-        "@sdk_vendor__wasm-encoder-0.244.0//:wasm_encoder",
-        "@sdk_vendor__wasmparser-0.244.0//:wasmparser",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.wasm-streams-0.4.2.bazel b/rust/bazel/crates/BUILD.wasm-streams-0.5.0.bazel
similarity index 85%
rename from rust/bazel/crates/BUILD.wasm-streams-0.4.2.bazel
rename to rust/bazel/crates/BUILD.wasm-streams-0.5.0.bazel
index 86ec405d5c..2ade36706e 100644
--- a/rust/bazel/crates/BUILD.wasm-streams-0.4.2.bazel
+++ b/rust/bazel/crates/BUILD.wasm-streams-0.5.0.bazel
@@ -58,12 +58,12 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.4.2",
+    version = "0.5.0",
     deps = [
-        "@sdk_vendor__futures-util-0.3.32//:futures_util",
-        "@sdk_vendor__js-sys-0.3.102//:js_sys",
-        "@sdk_vendor__wasm-bindgen-0.2.125//:wasm_bindgen",
-        "@sdk_vendor__wasm-bindgen-futures-0.4.75//:wasm_bindgen_futures",
-        "@sdk_vendor__web-sys-0.3.102//:web_sys",
+        "@sdk_vendor__futures-util-0.3.34//:futures_util",
+        "@sdk_vendor__js-sys-0.3.105//:js_sys",
+        "@sdk_vendor__wasm-bindgen-0.2.128//:wasm_bindgen",
+        "@sdk_vendor__wasm-bindgen-futures-0.4.78//:wasm_bindgen_futures",
+        "@sdk_vendor__web-sys-0.3.105//:web_sys",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.wasmparser-0.244.0.bazel b/rust/bazel/crates/BUILD.wasmparser-0.244.0.bazel
deleted file mode 100644
index ed15b731e1..0000000000
--- a/rust/bazel/crates/BUILD.wasmparser-0.244.0.bazel
+++ /dev/null
@@ -1,76 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "wasmparser",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "component-model",
-        "features",
-        "hash-collections",
-        "simd",
-        "std",
-        "validate",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wasmparser",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.244.0",
-    deps = [
-        "@sdk_vendor__bitflags-2.11.1//:bitflags",
-        "@sdk_vendor__hashbrown-0.15.5//:hashbrown",
-        "@sdk_vendor__indexmap-2.14.0//:indexmap",
-        "@sdk_vendor__semver-1.0.28//:semver",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.web-sys-0.3.102.bazel b/rust/bazel/crates/BUILD.web-sys-0.3.105.bazel
similarity index 93%
rename from rust/bazel/crates/BUILD.web-sys-0.3.102.bazel
rename to rust/bazel/crates/BUILD.web-sys-0.3.105.bazel
index bc6928ebb8..45c228e93d 100644
--- a/rust/bazel/crates/BUILD.web-sys-0.3.102.bazel
+++ b/rust/bazel/crates/BUILD.web-sys-0.3.105.bazel
@@ -58,9 +58,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.3.102",
+    version = "0.3.105",
     deps = [
-        "@sdk_vendor__js-sys-0.3.102//:js_sys",
-        "@sdk_vendor__wasm-bindgen-0.2.125//:wasm_bindgen",
+        "@sdk_vendor__js-sys-0.3.105//:js_sys",
+        "@sdk_vendor__wasm-bindgen-0.2.128//:wasm_bindgen",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.hashbrown-0.15.5.bazel b/rust/bazel/crates/BUILD.webpki-root-certs-1.0.9.bazel
similarity index 86%
rename from rust/bazel/crates/BUILD.hashbrown-0.15.5.bazel
rename to rust/bazel/crates/BUILD.webpki-root-certs-1.0.9.bazel
index f9a82325ed..283b500dad 100644
--- a/rust/bazel/crates/BUILD.hashbrown-0.15.5.bazel
+++ b/rust/bazel/crates/BUILD.webpki-root-certs-1.0.9.bazel
@@ -17,11 +17,14 @@ cargo_toml_env_vars(
 )
 
 rust_library(
-    name = "hashbrown",
+    name = "webpki_root_certs",
     srcs = glob(
         include = ["**/*.rs"],
         allow_empty = True,
     ),
+    aliases = {
+        "@sdk_vendor__rustls-pki-types-1.15.1//:rustls_pki_types": "pki_types",
+    },
     compile_data = glob(
         include = ["**"],
         allow_empty = True,
@@ -34,9 +37,6 @@ rust_library(
             "WORKSPACE.bazel",
         ],
     ),
-    crate_features = [
-        "default-hasher",
-    ],
     crate_root = "src/lib.rs",
     edition = "2021",
     rustc_env_files = [
@@ -47,7 +47,7 @@ rust_library(
     ],
     tags = [
         "cargo-bazel",
-        "crate-name=hashbrown",
+        "crate-name=webpki-root-certs",
         "manual",
         "noclippy",
         "norustfmt",
@@ -61,8 +61,8 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.15.5",
+    version = "1.0.9",
     deps = [
-        "@sdk_vendor__foldhash-0.1.5//:foldhash",
+        "@sdk_vendor__rustls-pki-types-1.15.1//:rustls_pki_types",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.wit-bindgen-0.51.0.bazel b/rust/bazel/crates/BUILD.wit-bindgen-0.51.0.bazel
deleted file mode 100644
index d2e9e5e812..0000000000
--- a/rust/bazel/crates/BUILD.wit-bindgen-0.51.0.bazel
+++ /dev/null
@@ -1,131 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load(
-    "@rules_rust//cargo:defs.bzl",
-    "cargo_build_script",
-    "cargo_toml_env_vars",
-)
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "wit_bindgen",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2024",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wit-bindgen",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.51.0",
-    deps = [
-        ":build_script_build",
-    ],
-)
-
-cargo_build_script(
-    name = "_bs",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    build_script_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            "**/*.rs",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_name = "build_script_build",
-    crate_root = "build.rs",
-    data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    edition = "2024",
-    emit_warnings = False,
-    pkg_name = "wit-bindgen",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wit-bindgen",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    version = "0.51.0",
-    visibility = ["//visibility:private"],
-)
-
-alias(
-    name = "build_script_build",
-    actual = ":_bs",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/BUILD.wit-bindgen-core-0.51.0.bazel b/rust/bazel/crates/BUILD.wit-bindgen-core-0.51.0.bazel
deleted file mode 100644
index 646517ce30..0000000000
--- a/rust/bazel/crates/BUILD.wit-bindgen-core-0.51.0.bazel
+++ /dev/null
@@ -1,67 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "wit_bindgen_core",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2024",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wit-bindgen-core",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.51.0",
-    deps = [
-        "@sdk_vendor__anyhow-1.0.102//:anyhow",
-        "@sdk_vendor__heck-0.5.0//:heck",
-        "@sdk_vendor__wit-parser-0.244.0//:wit_parser",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.wit-bindgen-rust-0.51.0.bazel b/rust/bazel/crates/BUILD.wit-bindgen-rust-0.51.0.bazel
deleted file mode 100644
index 480f631863..0000000000
--- a/rust/bazel/crates/BUILD.wit-bindgen-rust-0.51.0.bazel
+++ /dev/null
@@ -1,142 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load(
-    "@rules_rust//cargo:defs.bzl",
-    "cargo_build_script",
-    "cargo_toml_env_vars",
-)
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "wit_bindgen_rust",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2024",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wit-bindgen-rust",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.51.0",
-    deps = [
-        ":build_script_build",
-        "@sdk_vendor__anyhow-1.0.102//:anyhow",
-        "@sdk_vendor__heck-0.5.0//:heck",
-        "@sdk_vendor__indexmap-2.14.0//:indexmap",
-        "@sdk_vendor__prettyplease-0.2.37//:prettyplease",
-        "@sdk_vendor__syn-2.0.117//:syn",
-        "@sdk_vendor__wasm-metadata-0.244.0//:wasm_metadata",
-        "@sdk_vendor__wit-bindgen-core-0.51.0//:wit_bindgen_core",
-        "@sdk_vendor__wit-component-0.244.0//:wit_component",
-    ],
-)
-
-cargo_build_script(
-    name = "_bs",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    build_script_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            "**/*.rs",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_name = "build_script_build",
-    crate_root = "build.rs",
-    data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    edition = "2024",
-    emit_warnings = False,
-    link_deps = [
-        "@sdk_vendor__prettyplease-0.2.37//:prettyplease",
-    ],
-    pkg_name = "wit-bindgen-rust",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wit-bindgen-rust",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    version = "0.51.0",
-    visibility = ["//visibility:private"],
-)
-
-alias(
-    name = "build_script_build",
-    actual = ":_bs",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/BUILD.wit-bindgen-rust-macro-0.51.0.bazel b/rust/bazel/crates/BUILD.wit-bindgen-rust-macro-0.51.0.bazel
deleted file mode 100644
index b6faba84b6..0000000000
--- a/rust/bazel/crates/BUILD.wit-bindgen-rust-macro-0.51.0.bazel
+++ /dev/null
@@ -1,141 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load(
-    "@rules_rust//cargo:defs.bzl",
-    "cargo_build_script",
-    "cargo_toml_env_vars",
-)
-load("@rules_rust//rust:defs.bzl", "rust_proc_macro")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_proc_macro(
-    name = "wit_bindgen_rust_macro",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2024",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wit-bindgen-rust-macro",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.51.0",
-    deps = [
-        ":build_script_build",
-        "@sdk_vendor__anyhow-1.0.102//:anyhow",
-        "@sdk_vendor__prettyplease-0.2.37//:prettyplease",
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
-        "@sdk_vendor__wit-bindgen-core-0.51.0//:wit_bindgen_core",
-        "@sdk_vendor__wit-bindgen-rust-0.51.0//:wit_bindgen_rust",
-    ],
-)
-
-cargo_build_script(
-    name = "_bs",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    build_script_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            "**/*.rs",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_name = "build_script_build",
-    crate_root = "build.rs",
-    data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    edition = "2024",
-    emit_warnings = False,
-    link_deps = [
-        "@sdk_vendor__prettyplease-0.2.37//:prettyplease",
-    ],
-    pkg_name = "wit-bindgen-rust-macro",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wit-bindgen-rust-macro",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    version = "0.51.0",
-    visibility = ["//visibility:private"],
-)
-
-alias(
-    name = "build_script_build",
-    actual = ":_bs",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/BUILD.wit-component-0.244.0.bazel b/rust/bazel/crates/BUILD.wit-component-0.244.0.bazel
deleted file mode 100644
index 36616db245..0000000000
--- a/rust/bazel/crates/BUILD.wit-component-0.244.0.bazel
+++ /dev/null
@@ -1,77 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "wit_component",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    proc_macro_deps = [
-        "@sdk_vendor__serde_derive-1.0.228//:serde_derive",
-    ],
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wit-component",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.244.0",
-    deps = [
-        "@sdk_vendor__anyhow-1.0.102//:anyhow",
-        "@sdk_vendor__bitflags-2.11.1//:bitflags",
-        "@sdk_vendor__indexmap-2.14.0//:indexmap",
-        "@sdk_vendor__log-0.4.29//:log",
-        "@sdk_vendor__serde-1.0.228//:serde",
-        "@sdk_vendor__serde_json-1.0.149//:serde_json",
-        "@sdk_vendor__wasm-encoder-0.244.0//:wasm_encoder",
-        "@sdk_vendor__wasm-metadata-0.244.0//:wasm_metadata",
-        "@sdk_vendor__wasmparser-0.244.0//:wasmparser",
-        "@sdk_vendor__wit-parser-0.244.0//:wit_parser",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.wit-parser-0.244.0.bazel b/rust/bazel/crates/BUILD.wit-parser-0.244.0.bazel
deleted file mode 100644
index 505cb69ce0..0000000000
--- a/rust/bazel/crates/BUILD.wit-parser-0.244.0.bazel
+++ /dev/null
@@ -1,82 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "wit_parser",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "decoding",
-        "default",
-        "serde",
-        "serde_json",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    proc_macro_deps = [
-        "@sdk_vendor__serde_derive-1.0.228//:serde_derive",
-    ],
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=wit-parser",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "0.244.0",
-    deps = [
-        "@sdk_vendor__anyhow-1.0.102//:anyhow",
-        "@sdk_vendor__id-arena-2.3.0//:id_arena",
-        "@sdk_vendor__indexmap-2.14.0//:indexmap",
-        "@sdk_vendor__log-0.4.29//:log",
-        "@sdk_vendor__semver-1.0.28//:semver",
-        "@sdk_vendor__serde-1.0.228//:serde",
-        "@sdk_vendor__serde_json-1.0.149//:serde_json",
-        "@sdk_vendor__unicode-xid-0.2.6//:unicode_xid",
-        "@sdk_vendor__wasmparser-0.244.0//:wasmparser",
-    ],
-)
diff --git a/rust/bazel/crates/BUILD.writeable-0.6.3.bazel b/rust/bazel/crates/BUILD.writeable-0.6.4.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.writeable-0.6.3.bazel
rename to rust/bazel/crates/BUILD.writeable-0.6.4.bazel
index a2ecee205a..02ad09d5d0 100644
--- a/rust/bazel/crates/BUILD.writeable-0.6.3.bazel
+++ b/rust/bazel/crates/BUILD.writeable-0.6.4.bazel
@@ -58,5 +58,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.6.3",
+    version = "0.6.4",
 )
diff --git a/rust/bazel/crates/BUILD.xattr-1.6.1.bazel b/rust/bazel/crates/BUILD.xattr-1.6.1.bazel
index 2c6dfc376a..c9dcd06aee 100644
--- a/rust/bazel/crates/BUILD.xattr-1.6.1.bazel
+++ b/rust/bazel/crates/BUILD.xattr-1.6.1.bazel
@@ -65,16 +65,16 @@ rust_library(
     version = "1.6.1",
     deps = select({
         "@rules_rust//rust/platform:aarch64-apple-darwin": [
-            "@sdk_vendor__rustix-1.1.4//:rustix",  # cfg(any(target_os = "android", target_os = "linux", target_os = "macos", target_os = "hurd"))
+            "@sdk_vendor__rustix-1.1.5//:rustix",  # cfg(any(target_os = "android", target_os = "linux", target_os = "macos", target_os = "hurd"))
         ],
         "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [
-            "@sdk_vendor__rustix-1.1.4//:rustix",  # cfg(any(target_os = "android", target_os = "linux", target_os = "macos", target_os = "hurd"))
+            "@sdk_vendor__rustix-1.1.5//:rustix",  # cfg(any(target_os = "android", target_os = "linux", target_os = "macos", target_os = "hurd"))
         ],
         "@rules_rust//rust/platform:x86_64-apple-darwin": [
-            "@sdk_vendor__rustix-1.1.4//:rustix",  # cfg(any(target_os = "android", target_os = "linux", target_os = "macos", target_os = "hurd"))
+            "@sdk_vendor__rustix-1.1.5//:rustix",  # cfg(any(target_os = "android", target_os = "linux", target_os = "macos", target_os = "hurd"))
         ],
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [
-            "@sdk_vendor__rustix-1.1.4//:rustix",  # cfg(any(target_os = "android", target_os = "linux", target_os = "macos", target_os = "hurd"))
+            "@sdk_vendor__rustix-1.1.5//:rustix",  # cfg(any(target_os = "android", target_os = "linux", target_os = "macos", target_os = "hurd"))
         ],
         "//conditions:default": [],
     }),
diff --git a/rust/bazel/crates/BUILD.yoke-0.8.2.bazel b/rust/bazel/crates/BUILD.yoke-0.8.3.bazel
similarity index 93%
rename from rust/bazel/crates/BUILD.yoke-0.8.2.bazel
rename to rust/bazel/crates/BUILD.yoke-0.8.3.bazel
index cf74466bcc..1f9d0f01e6 100644
--- a/rust/bazel/crates/BUILD.yoke-0.8.2.bazel
+++ b/rust/bazel/crates/BUILD.yoke-0.8.3.bazel
@@ -41,7 +41,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__yoke-derive-0.8.2//:yoke_derive",
+        "@sdk_vendor__yoke-derive-0.8.3//:yoke_derive",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -65,9 +65,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.2",
+    version = "0.8.3",
     deps = [
         "@sdk_vendor__stable_deref_trait-1.2.1//:stable_deref_trait",
-        "@sdk_vendor__zerofrom-0.1.7//:zerofrom",
+        "@sdk_vendor__zerofrom-0.1.8//:zerofrom",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.yoke-derive-0.8.2.bazel b/rust/bazel/crates/BUILD.yoke-derive-0.8.3.bazel
similarity index 88%
rename from rust/bazel/crates/BUILD.yoke-derive-0.8.2.bazel
rename to rust/bazel/crates/BUILD.yoke-derive-0.8.3.bazel
index 68d697cacc..5fcdd07559 100644
--- a/rust/bazel/crates/BUILD.yoke-derive-0.8.2.bazel
+++ b/rust/bazel/crates/BUILD.yoke-derive-0.8.3.bazel
@@ -58,11 +58,11 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.2",
+    version = "0.8.3",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
-        "@sdk_vendor__synstructure-0.13.2//:synstructure",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
+        "@sdk_vendor__synstructure-0.14.0//:synstructure",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.zerocopy-0.8.52.bazel b/rust/bazel/crates/BUILD.zerocopy-0.8.57.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.zerocopy-0.8.52.bazel
rename to rust/bazel/crates/BUILD.zerocopy-0.8.57.bazel
index 2b3d1115db..ddf317d2fc 100644
--- a/rust/bazel/crates/BUILD.zerocopy-0.8.52.bazel
+++ b/rust/bazel/crates/BUILD.zerocopy-0.8.57.bazel
@@ -65,7 +65,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.52",
+    version = "0.8.57",
     deps = [
         ":build_script_build",
     ],
@@ -126,7 +126,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "0.8.52",
+    version = "0.8.57",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.zerocopy-derive-0.8.52.bazel b/rust/bazel/crates/BUILD.zerocopy-derive-0.8.57.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.zerocopy-derive-0.8.52.bazel
rename to rust/bazel/crates/BUILD.zerocopy-derive-0.8.57.bazel
index 223b6451f8..39d55aa52b 100644
--- a/rust/bazel/crates/BUILD.zerocopy-derive-0.8.52.bazel
+++ b/rust/bazel/crates/BUILD.zerocopy-derive-0.8.57.bazel
@@ -58,10 +58,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.8.52",
+    version = "0.8.57",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-2.0.119//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.zerofrom-0.1.7.bazel b/rust/bazel/crates/BUILD.zerofrom-0.1.8.bazel
similarity index 95%
rename from rust/bazel/crates/BUILD.zerofrom-0.1.7.bazel
rename to rust/bazel/crates/BUILD.zerofrom-0.1.8.bazel
index 94730c7ba4..1ae58fb6d4 100644
--- a/rust/bazel/crates/BUILD.zerofrom-0.1.7.bazel
+++ b/rust/bazel/crates/BUILD.zerofrom-0.1.8.bazel
@@ -40,7 +40,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__zerofrom-derive-0.1.7//:zerofrom_derive",
+        "@sdk_vendor__zerofrom-derive-0.1.8//:zerofrom_derive",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -64,5 +64,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.1.7",
+    version = "0.1.8",
 )
diff --git a/rust/bazel/crates/BUILD.zerofrom-derive-0.1.7.bazel b/rust/bazel/crates/BUILD.zerofrom-derive-0.1.8.bazel
similarity index 88%
rename from rust/bazel/crates/BUILD.zerofrom-derive-0.1.7.bazel
rename to rust/bazel/crates/BUILD.zerofrom-derive-0.1.8.bazel
index 5438029bdb..b8636b87b3 100644
--- a/rust/bazel/crates/BUILD.zerofrom-derive-0.1.7.bazel
+++ b/rust/bazel/crates/BUILD.zerofrom-derive-0.1.8.bazel
@@ -58,11 +58,11 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.1.7",
+    version = "0.1.8",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
-        "@sdk_vendor__synstructure-0.13.2//:synstructure",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
+        "@sdk_vendor__synstructure-0.14.0//:synstructure",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.zeroize-1.8.2.bazel b/rust/bazel/crates/BUILD.zeroize-1.9.0.bazel
similarity index 97%
rename from rust/bazel/crates/BUILD.zeroize-1.8.2.bazel
rename to rust/bazel/crates/BUILD.zeroize-1.9.0.bazel
index 7bcecc5574..97d201b4d0 100644
--- a/rust/bazel/crates/BUILD.zeroize-1.8.2.bazel
+++ b/rust/bazel/crates/BUILD.zeroize-1.9.0.bazel
@@ -39,7 +39,7 @@ rust_library(
         "default",
     ],
     crate_root = "src/lib.rs",
-    edition = "2021",
+    edition = "2024",
     rustc_env_files = [
         ":cargo_toml_env_vars",
     ],
@@ -62,5 +62,5 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.8.2",
+    version = "1.9.0",
 )
diff --git a/rust/bazel/crates/BUILD.zerotrie-0.2.4.bazel b/rust/bazel/crates/BUILD.zerotrie-0.2.5.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.zerotrie-0.2.4.bazel
rename to rust/bazel/crates/BUILD.zerotrie-0.2.5.bazel
index 80206f87c7..ef2c74878c 100644
--- a/rust/bazel/crates/BUILD.zerotrie-0.2.4.bazel
+++ b/rust/bazel/crates/BUILD.zerotrie-0.2.5.bazel
@@ -41,7 +41,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__displaydoc-0.2.5//:displaydoc",
+        "@sdk_vendor__displaydoc-0.2.7//:displaydoc",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -65,9 +65,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.2.4",
+    version = "0.2.5",
     deps = [
-        "@sdk_vendor__yoke-0.8.2//:yoke",
-        "@sdk_vendor__zerofrom-0.1.7//:zerofrom",
+        "@sdk_vendor__yoke-0.8.3//:yoke",
+        "@sdk_vendor__zerofrom-0.1.8//:zerofrom",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.zerovec-0.11.6.bazel b/rust/bazel/crates/BUILD.zerovec-0.11.8.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.zerovec-0.11.6.bazel
rename to rust/bazel/crates/BUILD.zerovec-0.11.8.bazel
index 2a715b0038..dd47c9c370 100644
--- a/rust/bazel/crates/BUILD.zerovec-0.11.6.bazel
+++ b/rust/bazel/crates/BUILD.zerovec-0.11.8.bazel
@@ -41,7 +41,7 @@ rust_library(
     crate_root = "src/lib.rs",
     edition = "2021",
     proc_macro_deps = [
-        "@sdk_vendor__zerovec-derive-0.11.3//:zerovec_derive",
+        "@sdk_vendor__zerovec-derive-0.11.6//:zerovec_derive",
     ],
     rustc_env_files = [
         ":cargo_toml_env_vars",
@@ -65,9 +65,9 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.11.6",
+    version = "0.11.8",
     deps = [
-        "@sdk_vendor__yoke-0.8.2//:yoke",
-        "@sdk_vendor__zerofrom-0.1.7//:zerofrom",
+        "@sdk_vendor__yoke-0.8.3//:yoke",
+        "@sdk_vendor__zerofrom-0.1.8//:zerofrom",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.zerovec-derive-0.11.3.bazel b/rust/bazel/crates/BUILD.zerovec-derive-0.11.6.bazel
similarity index 91%
rename from rust/bazel/crates/BUILD.zerovec-derive-0.11.3.bazel
rename to rust/bazel/crates/BUILD.zerovec-derive-0.11.6.bazel
index c433eb9dc8..faf1c701aa 100644
--- a/rust/bazel/crates/BUILD.zerovec-derive-0.11.3.bazel
+++ b/rust/bazel/crates/BUILD.zerovec-derive-0.11.6.bazel
@@ -58,10 +58,10 @@ rust_proc_macro(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "0.11.3",
+    version = "0.11.6",
     deps = [
-        "@sdk_vendor__proc-macro2-1.0.106//:proc_macro2",
-        "@sdk_vendor__quote-1.0.45//:quote",
-        "@sdk_vendor__syn-2.0.117//:syn",
+        "@sdk_vendor__proc-macro2-1.0.107//:proc_macro2",
+        "@sdk_vendor__quote-1.0.47//:quote",
+        "@sdk_vendor__syn-3.0.6//:syn",
     ],
 )
diff --git a/rust/bazel/crates/BUILD.zip-2.4.2.bazel b/rust/bazel/crates/BUILD.zip-2.4.2.bazel
deleted file mode 100644
index 94185e634d..0000000000
--- a/rust/bazel/crates/BUILD.zip-2.4.2.bazel
+++ /dev/null
@@ -1,156 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-load(
-    "@rules_rust//cargo:defs.bzl",
-    "cargo_build_script",
-    "cargo_toml_env_vars",
-)
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cargo_toml_env_vars(
-    name = "cargo_toml_env_vars",
-    src = "Cargo.toml",
-)
-
-rust_library(
-    name = "zip",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "_deflate-any",
-        "deflate",
-        "deflate-flate2",
-        "deflate-zopfli",
-        "flate2",
-        "zopfli",
-    ],
-    crate_root = "src/lib.rs",
-    edition = "2021",
-    proc_macro_deps = [
-        "@sdk_vendor__displaydoc-0.2.5//:displaydoc",
-    ],
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=zip",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    target_compatible_with = select({
-        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
-        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
-        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
-        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
-        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
-        "//conditions:default": ["@platforms//:incompatible"],
-    }),
-    version = "2.4.2",
-    deps = [
-        ":build_script_build",
-        "@sdk_vendor__crc32fast-1.5.0//:crc32fast",
-        "@sdk_vendor__flate2-1.1.9//:flate2",
-        "@sdk_vendor__indexmap-2.14.0//:indexmap",
-        "@sdk_vendor__memchr-2.8.0//:memchr",
-        "@sdk_vendor__thiserror-2.0.18//:thiserror",
-        "@sdk_vendor__zopfli-0.8.3//:zopfli",
-    ],
-)
-
-cargo_build_script(
-    name = "_bs",
-    srcs = glob(
-        include = ["**/*.rs"],
-        allow_empty = True,
-    ),
-    build_script_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    compile_data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            "**/*.rs",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    crate_features = [
-        "_deflate-any",
-        "deflate",
-        "deflate-flate2",
-        "deflate-zopfli",
-        "flate2",
-        "zopfli",
-    ],
-    crate_name = "build_script_build",
-    crate_root = "src/build.rs",
-    data = glob(
-        include = ["**"],
-        allow_empty = True,
-        exclude = [
-            "**/* *",
-            ".tmp_git_root/**/*",
-            "BUILD",
-            "BUILD.bazel",
-            "WORKSPACE",
-            "WORKSPACE.bazel",
-        ],
-    ),
-    edition = "2021",
-    emit_warnings = False,
-    pkg_name = "zip",
-    rustc_env_files = [
-        ":cargo_toml_env_vars",
-    ],
-    rustc_flags = [
-        "--cap-lints=allow",
-    ],
-    tags = [
-        "cargo-bazel",
-        "crate-name=zip",
-        "manual",
-        "noclippy",
-        "norustfmt",
-    ],
-    version = "2.4.2",
-    visibility = ["//visibility:private"],
-)
-
-alias(
-    name = "build_script_build",
-    actual = ":_bs",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/BUILD.zip-7.2.0.bazel b/rust/bazel/crates/BUILD.zip-7.2.0.bazel
new file mode 100644
index 0000000000..455984a6cc
--- /dev/null
+++ b/rust/bazel/crates/BUILD.zip-7.2.0.bazel
@@ -0,0 +1,77 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "zip",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "_deflate-any",
+        "deflate",
+        "deflate-flate2",
+        "deflate-flate2-zlib-rs",
+        "deflate-zopfli",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=zip",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "7.2.0",
+    deps = [
+        "@sdk_vendor__crc32fast-1.5.2//:crc32fast",
+        "@sdk_vendor__flate2-1.1.10//:flate2",
+        "@sdk_vendor__indexmap-2.14.2//:indexmap",
+        "@sdk_vendor__memchr-2.8.3//:memchr",
+        "@sdk_vendor__typed-path-0.12.3//:typed_path",
+        "@sdk_vendor__zopfli-0.8.3//:zopfli",
+    ],
+)
diff --git a/rust/bazel/crates/BUILD.zlib-rs-0.6.8.bazel b/rust/bazel/crates/BUILD.zlib-rs-0.6.8.bazel
new file mode 100644
index 0000000000..8e647483da
--- /dev/null
+++ b/rust/bazel/crates/BUILD.zlib-rs-0.6.8.bazel
@@ -0,0 +1,66 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+load("@rules_rust//cargo:defs.bzl", "cargo_toml_env_vars")
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cargo_toml_env_vars(
+    name = "cargo_toml_env_vars",
+    src = "Cargo.toml",
+)
+
+rust_library(
+    name = "zlib_rs",
+    srcs = glob(
+        include = ["**/*.rs"],
+        allow_empty = True,
+    ),
+    compile_data = glob(
+        include = ["**"],
+        allow_empty = True,
+        exclude = [
+            "**/* *",
+            ".tmp_git_root/**/*",
+            "BUILD",
+            "BUILD.bazel",
+            "WORKSPACE",
+            "WORKSPACE.bazel",
+        ],
+    ),
+    crate_features = [
+        "rust-allocator",
+        "std",
+    ],
+    crate_root = "src/lib.rs",
+    edition = "2021",
+    rustc_env_files = [
+        ":cargo_toml_env_vars",
+    ],
+    rustc_flags = [
+        "--cap-lints=allow",
+    ],
+    tags = [
+        "cargo-bazel",
+        "crate-name=zlib-rs",
+        "manual",
+        "noclippy",
+        "norustfmt",
+    ],
+    target_compatible_with = select({
+        "@rules_rust//rust/platform:aarch64-apple-darwin": [],
+        "@rules_rust//rust/platform:aarch64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:aarch64-unknown-linux-gnu": [],
+        "@rules_rust//rust/platform:x86_64-apple-darwin": [],
+        "@rules_rust//rust/platform:x86_64-pc-windows-msvc": [],
+        "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    version = "0.6.8",
+)
diff --git a/rust/bazel/crates/BUILD.zmij-1.0.21.bazel b/rust/bazel/crates/BUILD.zmij-1.0.23.bazel
similarity index 98%
rename from rust/bazel/crates/BUILD.zmij-1.0.21.bazel
rename to rust/bazel/crates/BUILD.zmij-1.0.23.bazel
index 097256310b..152af74650 100644
--- a/rust/bazel/crates/BUILD.zmij-1.0.21.bazel
+++ b/rust/bazel/crates/BUILD.zmij-1.0.23.bazel
@@ -62,7 +62,7 @@ rust_library(
         "@rules_rust//rust/platform:x86_64-unknown-linux-gnu": [],
         "//conditions:default": ["@platforms//:incompatible"],
     }),
-    version = "1.0.21",
+    version = "1.0.23",
     deps = [
         ":build_script_build",
     ],
@@ -120,7 +120,7 @@ cargo_build_script(
         "noclippy",
         "norustfmt",
     ],
-    version = "1.0.21",
+    version = "1.0.23",
     visibility = ["//visibility:private"],
 )
 
diff --git a/rust/bazel/crates/BUILD.zopfli-0.8.3.bazel b/rust/bazel/crates/BUILD.zopfli-0.8.3.bazel
index c3be19ae72..fc3c323862 100644
--- a/rust/bazel/crates/BUILD.zopfli-0.8.3.bazel
+++ b/rust/bazel/crates/BUILD.zopfli-0.8.3.bazel
@@ -66,9 +66,9 @@ rust_library(
     }),
     version = "0.8.3",
     deps = [
-        "@sdk_vendor__bumpalo-3.20.2//:bumpalo",
-        "@sdk_vendor__crc32fast-1.5.0//:crc32fast",
-        "@sdk_vendor__log-0.4.29//:log",
-        "@sdk_vendor__simd-adler32-0.3.9//:simd_adler32",
+        "@sdk_vendor__bumpalo-3.20.3//:bumpalo",
+        "@sdk_vendor__crc32fast-1.5.2//:crc32fast",
+        "@sdk_vendor__log-0.4.34//:log",
+        "@sdk_vendor__simd-adler32-0.3.10//:simd_adler32",
     ],
 )
diff --git a/rust/bazel/crates/async-trait-0.1.89/BUILD.bazel b/rust/bazel/crates/async-trait-0.1.92/BUILD.bazel
similarity index 81%
rename from rust/bazel/crates/async-trait-0.1.89/BUILD.bazel
rename to rust/bazel/crates/async-trait-0.1.92/BUILD.bazel
index 8381190652..34c7709137 100644
--- a/rust/bazel/crates/async-trait-0.1.89/BUILD.bazel
+++ b/rust/bazel/crates/async-trait-0.1.92/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "async-trait-0.1.89",
-    actual = "@sdk_vendor__async-trait-0.1.89//:async_trait",
+    name = "async-trait-0.1.92",
+    actual = "@sdk_vendor__async-trait-0.1.92//:async_trait",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/async-trait/BUILD.bazel b/rust/bazel/crates/async-trait/BUILD.bazel
index af2d8c2aea..7bd8952aa6 100644
--- a/rust/bazel/crates/async-trait/BUILD.bazel
+++ b/rust/bazel/crates/async-trait/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "async-trait",
-    actual = "@sdk_vendor__async-trait-0.1.89//:async_trait",
+    actual = "@sdk_vendor__async-trait-0.1.92//:async_trait",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/base64-0.22.1/BUILD.bazel b/rust/bazel/crates/base64-0.23.1/BUILD.bazel
similarity index 84%
rename from rust/bazel/crates/base64-0.22.1/BUILD.bazel
rename to rust/bazel/crates/base64-0.23.1/BUILD.bazel
index 03be377473..131ee6ec1a 100644
--- a/rust/bazel/crates/base64-0.22.1/BUILD.bazel
+++ b/rust/bazel/crates/base64-0.23.1/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "base64-0.22.1",
-    actual = "@sdk_vendor__base64-0.22.1//:base64",
+    name = "base64-0.23.1",
+    actual = "@sdk_vendor__base64-0.23.1//:base64",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/base64/BUILD.bazel b/rust/bazel/crates/base64/BUILD.bazel
index f9bb56ed0c..811e906c66 100644
--- a/rust/bazel/crates/base64/BUILD.bazel
+++ b/rust/bazel/crates/base64/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "base64",
-    actual = "@sdk_vendor__base64-0.22.1//:base64",
+    actual = "@sdk_vendor__base64-0.23.1//:base64",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/regex-1.12.3/BUILD.bazel b/rust/bazel/crates/bytes-1.12.1/BUILD.bazel
similarity index 84%
rename from rust/bazel/crates/regex-1.12.3/BUILD.bazel
rename to rust/bazel/crates/bytes-1.12.1/BUILD.bazel
index af7d90615b..9b898a8636 100644
--- a/rust/bazel/crates/regex-1.12.3/BUILD.bazel
+++ b/rust/bazel/crates/bytes-1.12.1/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "regex-1.12.3",
-    actual = "@sdk_vendor__regex-1.12.3//:regex",
+    name = "bytes-1.12.1",
+    actual = "@sdk_vendor__bytes-1.12.1//:bytes",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/bytes/BUILD.bazel b/rust/bazel/crates/bytes/BUILD.bazel
index e441a36399..f2d3c979ef 100644
--- a/rust/bazel/crates/bytes/BUILD.bazel
+++ b/rust/bazel/crates/bytes/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "bytes",
-    actual = "@sdk_vendor__bytes-1.11.1//:bytes",
+    actual = "@sdk_vendor__bytes-1.12.1//:bytes",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/crates.bzl b/rust/bazel/crates/crates.bzl
index fb4cf237c2..d8513a460e 100644
--- a/rust/bazel/crates/crates.bzl
+++ b/rust/bazel/crates/crates.bzl
@@ -319,28 +319,28 @@ _CRATE_EDITIONS = {
 _NORMAL_DEPENDENCIES = {
     "src/sdk/rust": {
         _COMMON_CONDITION: {
-            "base64": Label("@sdk_vendor//base64-0.22.1"),
-            "bytes": Label("@sdk_vendor//bytes-1.11.1"),
+            "base64": Label("@sdk_vendor//base64-0.23.1"),
+            "bytes": Label("@sdk_vendor//bytes-1.12.1"),
             "dirs": Label("@sdk_vendor//dirs-5.0.1"),
-            "flate2": Label("@sdk_vendor//flate2-1.1.9"),
-            "futures-util": Label("@sdk_vendor//futures-util-0.3.32"),
-            "getrandom": Label("@sdk_vendor//getrandom-0.2.17"),
-            "http": Label("@sdk_vendor//http-1.4.2"),
-            "indexmap": Label("@sdk_vendor//indexmap-2.14.0"),
+            "flate2": Label("@sdk_vendor//flate2-1.1.10"),
+            "futures-util": Label("@sdk_vendor//futures-util-0.3.34"),
+            "getrandom": Label("@sdk_vendor//getrandom-0.4.3"),
+            "http": Label("@sdk_vendor//http-1.5.0"),
+            "indexmap": Label("@sdk_vendor//indexmap-2.14.2"),
             "parking_lot": Label("@sdk_vendor//parking_lot-0.12.5"),
-            "regex": Label("@sdk_vendor//regex-1.12.3"),
-            "reqwest": Label("@sdk_vendor//reqwest-0.12.28"),
-            "sdk_libloading": Label("@sdk_vendor//libloading-0.8.9"),
-            "serde": Label("@sdk_vendor//serde-1.0.228"),
-            "serde_json": Label("@sdk_vendor//serde_json-1.0.149"),
+            "regex": Label("@sdk_vendor//regex-1.13.1"),
+            "reqwest": Label("@sdk_vendor//reqwest-0.13.5"),
+            "sdk_libloading": Label("@sdk_vendor//libloading-0.9.0"),
+            "serde": Label("@sdk_vendor//serde-1.0.229"),
+            "serde_json": Label("@sdk_vendor//serde_json-1.0.151"),
             "tar": Label("@sdk_vendor//tar-0.4.46"),
-            "tokio": Label("@sdk_vendor//tokio-1.52.1"),
-            "tokio-stream": Label("@sdk_vendor//tokio-stream-0.1.18"),
-            "tokio-tungstenite": Label("@sdk_vendor//tokio-tungstenite-0.24.0"),
-            "tokio-util": Label("@sdk_vendor//tokio-util-0.7.18"),
+            "tokio": Label("@sdk_vendor//tokio-1.53.1"),
+            "tokio-stream": Label("@sdk_vendor//tokio-stream-0.1.19"),
+            "tokio-tungstenite": Label("@sdk_vendor//tokio-tungstenite-0.28.0"),
+            "tokio-util": Label("@sdk_vendor//tokio-util-0.7.19"),
             "tracing": Label("@sdk_vendor//tracing-0.1.44"),
-            "uuid": Label("@sdk_vendor//uuid-1.23.1"),
-            "zip": Label("@sdk_vendor//zip-2.4.2"),
+            "uuid": Label("@sdk_vendor//uuid-1.26.1"),
+            "zip": Label("@sdk_vendor//zip-7.2.0"),
         },
         "cfg(windows)": {
             "windows-sys": Label("@sdk_vendor//windows-sys-0.61.2"),
@@ -351,7 +351,7 @@ _NORMAL_DEPENDENCIES = {
 _NORMAL_ALIASES = {
     "src/sdk/rust": {
         _COMMON_CONDITION: {
-            Label("@sdk_vendor//libloading-0.8.9"): "sdk_libloading",
+            Label("@sdk_vendor//libloading-0.9.0"): "sdk_libloading",
         },
         "cfg(windows)": {
         },
@@ -362,9 +362,10 @@ _NORMAL_DEV_DEPENDENCIES = {
     "src/sdk/rust": {
         _COMMON_CONDITION: {
             "rusqlite": Label("@sdk_vendor//rusqlite-0.40.2"),
-            "schemars": Label("@sdk_vendor//schemars-1.2.1"),
-            "serial_test": Label("@sdk_vendor//serial_test-3.4.0"),
+            "schemars": Label("@sdk_vendor//schemars-1.2.2"),
+            "serial_test": Label("@sdk_vendor//serial_test-4.0.1"),
             "tempfile": Label("@sdk_vendor//tempfile-3.27.0"),
+            "ureq": Label("@sdk_vendor//ureq-3.4.2"),
         },
     },
 }
@@ -379,7 +380,7 @@ _NORMAL_DEV_ALIASES = {
 _PROC_MACRO_DEPENDENCIES = {
     "src/sdk/rust": {
         _COMMON_CONDITION: {
-            "async-trait": Label("@sdk_vendor//async-trait-0.1.89"),
+            "async-trait": Label("@sdk_vendor//async-trait-0.1.92"),
         },
     },
 }
@@ -405,13 +406,12 @@ _BUILD_DEPENDENCIES = {
     "src/sdk/rust": {
         _COMMON_CONDITION: {
             "dirs": Label("@sdk_vendor//dirs-5.0.1"),
-            "flate2": Label("@sdk_vendor//flate2-1.1.9"),
+            "flate2": Label("@sdk_vendor//flate2-1.1.10"),
             "native-tls": Label("@sdk_vendor//native-tls-0.2.18"),
-            "serde_json": Label("@sdk_vendor//serde_json-1.0.149"),
+            "serde_json": Label("@sdk_vendor//serde_json-1.0.151"),
             "sha2": Label("@sdk_vendor//sha2-0.10.9"),
             "tar": Label("@sdk_vendor//tar-0.4.46"),
-            "ureq": Label("@sdk_vendor//ureq-2.12.1"),
-            "zip": Label("@sdk_vendor//zip-2.4.2"),
+            "zip": Label("@sdk_vendor//zip-7.2.0"),
         },
     },
 }
@@ -451,8 +451,8 @@ _CONDITIONS = {
     "cfg(all(target_arch = \"aarch64\", target_os = \"linux\"))": ["@rules_rust//rust/platform:aarch64-unknown-linux-gnu"],
     "cfg(all(target_arch = \"aarch64\", target_vendor = \"apple\"))": ["@rules_rust//rust/platform:aarch64-apple-darwin"],
     "cfg(all(target_arch = \"loongarch64\", target_os = \"linux\"))": [],
+    "cfg(all(target_arch = \"wasm32\", any(target_os = \"unknown\", target_os = \"none\")))": [],
     "cfg(all(target_arch = \"wasm32\", target_os = \"wasi\", target_env = \"p2\"))": [],
-    "cfg(all(target_arch = \"wasm32\", target_os = \"wasi\", target_env = \"p3\"))": [],
     "cfg(all(target_arch = \"x86\", target_env = \"gnu\", not(target_abi = \"llvm\"), not(windows_raw_dylib)))": [],
     "cfg(all(target_arch = \"x86\", target_env = \"gnu\", not(windows_raw_dylib)))": [],
     "cfg(all(target_arch = \"x86\", target_env = \"msvc\", not(windows_raw_dylib)))": [],
@@ -460,7 +460,6 @@ _CONDITIONS = {
     "cfg(all(target_arch = \"x86_64\", target_env = \"msvc\", not(windows_raw_dylib)))": ["@rules_rust//rust/platform:x86_64-pc-windows-msvc"],
     "cfg(all(target_os = \"uefi\", getrandom_backend = \"efi_rng\"))": [],
     "cfg(any())": [],
-    "cfg(any(all(target_arch = \"arm\", target_pointer_width = \"32\"), target_arch = \"mips\", target_arch = \"powerpc\"))": [],
     "cfg(any(target_arch = \"aarch64\", target_arch = \"x86\", target_arch = \"x86_64\"))": ["@rules_rust//rust/platform:aarch64-apple-darwin", "@rules_rust//rust/platform:aarch64-pc-windows-msvc", "@rules_rust//rust/platform:aarch64-unknown-linux-gnu", "@rules_rust//rust/platform:x86_64-apple-darwin", "@rules_rust//rust/platform:x86_64-pc-windows-msvc", "@rules_rust//rust/platform:x86_64-unknown-linux-gnu"],
     "cfg(any(target_arch = \"aarch64\", target_arch = \"x86_64\", target_arch = \"x86\"))": ["@rules_rust//rust/platform:aarch64-apple-darwin", "@rules_rust//rust/platform:aarch64-pc-windows-msvc", "@rules_rust//rust/platform:aarch64-unknown-linux-gnu", "@rules_rust//rust/platform:x86_64-apple-darwin", "@rules_rust//rust/platform:x86_64-pc-windows-msvc", "@rules_rust//rust/platform:x86_64-unknown-linux-gnu"],
     "cfg(any(target_os = \"android\", target_os = \"linux\", target_os = \"macos\", target_os = \"hurd\"))": ["@rules_rust//rust/platform:aarch64-apple-darwin", "@rules_rust//rust/platform:aarch64-unknown-linux-gnu", "@rules_rust//rust/platform:x86_64-apple-darwin", "@rules_rust//rust/platform:x86_64-unknown-linux-gnu"],
@@ -471,10 +470,8 @@ _CONDITIONS = {
     "cfg(any(target_os = \"macos\", target_os = \"openbsd\", target_os = \"vita\", target_os = \"emscripten\"))": ["@rules_rust//rust/platform:aarch64-apple-darwin", "@rules_rust//rust/platform:x86_64-apple-darwin"],
     "cfg(any(unix, target_os = \"hermit\", target_os = \"wasi\"))": ["@rules_rust//rust/platform:aarch64-apple-darwin", "@rules_rust//rust/platform:aarch64-unknown-linux-gnu", "@rules_rust//rust/platform:x86_64-apple-darwin", "@rules_rust//rust/platform:x86_64-unknown-linux-gnu"],
     "cfg(any(unix, target_os = \"wasi\"))": ["@rules_rust//rust/platform:aarch64-apple-darwin", "@rules_rust//rust/platform:aarch64-unknown-linux-gnu", "@rules_rust//rust/platform:x86_64-apple-darwin", "@rules_rust//rust/platform:x86_64-unknown-linux-gnu"],
-    "cfg(fuzzing)": [],
+    "cfg(not(all(target_arch = \"wasm32\", any(target_os = \"unknown\", target_os = \"none\"))))": ["@rules_rust//rust/platform:aarch64-apple-darwin", "@rules_rust//rust/platform:aarch64-pc-windows-msvc", "@rules_rust//rust/platform:aarch64-unknown-linux-gnu", "@rules_rust//rust/platform:x86_64-apple-darwin", "@rules_rust//rust/platform:x86_64-pc-windows-msvc", "@rules_rust//rust/platform:x86_64-unknown-linux-gnu"],
     "cfg(not(any(target_os = \"windows\", target_vendor = \"apple\")))": ["@rules_rust//rust/platform:aarch64-unknown-linux-gnu", "@rules_rust//rust/platform:x86_64-unknown-linux-gnu"],
-    "cfg(not(target_arch = \"wasm32\"))": ["@rules_rust//rust/platform:aarch64-apple-darwin", "@rules_rust//rust/platform:aarch64-pc-windows-msvc", "@rules_rust//rust/platform:aarch64-unknown-linux-gnu", "@rules_rust//rust/platform:x86_64-apple-darwin", "@rules_rust//rust/platform:x86_64-pc-windows-msvc", "@rules_rust//rust/platform:x86_64-unknown-linux-gnu"],
-    "cfg(target_arch = \"wasm32\")": [],
     "cfg(target_os = \"hermit\")": [],
     "cfg(target_os = \"macos\")": ["@rules_rust//rust/platform:aarch64-apple-darwin", "@rules_rust//rust/platform:x86_64-apple-darwin"],
     "cfg(target_os = \"netbsd\")": [],
@@ -520,42 +517,22 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__aho-corasick-1.1.4",
-        sha256 = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301",
+        name = "sdk_vendor__aho-corasick-1.1.5",
+        sha256 = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/aho-corasick/1.1.4/download"],
-        strip_prefix = "aho-corasick-1.1.4",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.aho-corasick-1.1.4.bazel"),
+        urls = ["https://static.crates.io/crates/aho-corasick/1.1.5/download"],
+        strip_prefix = "aho-corasick-1.1.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.aho-corasick-1.1.5.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__anyhow-1.0.102",
-        sha256 = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c",
+        name = "sdk_vendor__async-trait-0.1.92",
+        sha256 = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/anyhow/1.0.102/download"],
-        strip_prefix = "anyhow-1.0.102",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.anyhow-1.0.102.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__arbitrary-1.4.2",
-        sha256 = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/arbitrary/1.4.2/download"],
-        strip_prefix = "arbitrary-1.4.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.arbitrary-1.4.2.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__async-trait-0.1.89",
-        sha256 = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/async-trait/0.1.89/download"],
-        strip_prefix = "async-trait-0.1.89",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.async-trait-0.1.89.bazel"),
+        urls = ["https://static.crates.io/crates/async-trait/0.1.92/download"],
+        strip_prefix = "async-trait-0.1.92",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.async-trait-0.1.92.bazel"),
     )
 
     maybe(
@@ -580,72 +557,82 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__bitflags-2.11.1",
-        sha256 = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3",
+        name = "sdk_vendor__base64-0.23.1",
+        sha256 = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/bitflags/2.11.1/download"],
-        strip_prefix = "bitflags-2.11.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.bitflags-2.11.1.bazel"),
+        urls = ["https://static.crates.io/crates/base64/0.23.1/download"],
+        strip_prefix = "base64-0.23.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.base64-0.23.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__block-buffer-0.10.4",
-        sha256 = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71",
+        name = "sdk_vendor__base64ct-1.8.3",
+        sha256 = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/block-buffer/0.10.4/download"],
-        strip_prefix = "block-buffer-0.10.4",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.block-buffer-0.10.4.bazel"),
+        urls = ["https://static.crates.io/crates/base64ct/1.8.3/download"],
+        strip_prefix = "base64ct-1.8.3",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.base64ct-1.8.3.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__bumpalo-3.20.2",
-        sha256 = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb",
+        name = "sdk_vendor__bitflags-2.13.2",
+        sha256 = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/bumpalo/3.20.2/download"],
-        strip_prefix = "bumpalo-3.20.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.bumpalo-3.20.2.bazel"),
+        urls = ["https://static.crates.io/crates/bitflags/2.13.2/download"],
+        strip_prefix = "bitflags-2.13.2",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.bitflags-2.13.2.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__byteorder-1.5.0",
-        sha256 = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b",
+        name = "sdk_vendor__block-buffer-0.10.4",
+        sha256 = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/byteorder/1.5.0/download"],
-        strip_prefix = "byteorder-1.5.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.byteorder-1.5.0.bazel"),
+        urls = ["https://static.crates.io/crates/block-buffer/0.10.4/download"],
+        strip_prefix = "block-buffer-0.10.4",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.block-buffer-0.10.4.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__bytes-1.11.1",
-        sha256 = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33",
+        name = "sdk_vendor__bumpalo-3.20.3",
+        sha256 = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/bytes/1.11.1/download"],
-        strip_prefix = "bytes-1.11.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.bytes-1.11.1.bazel"),
+        urls = ["https://static.crates.io/crates/bumpalo/3.20.3/download"],
+        strip_prefix = "bumpalo-3.20.3",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.bumpalo-3.20.3.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__cc-1.2.61",
-        sha256 = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d",
+        name = "sdk_vendor__bytes-1.12.1",
+        sha256 = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/cc/1.2.61/download"],
-        strip_prefix = "cc-1.2.61",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.cc-1.2.61.bazel"),
+        urls = ["https://static.crates.io/crates/bytes/1.12.1/download"],
+        strip_prefix = "bytes-1.12.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.bytes-1.12.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__cfg-if-1.0.4",
-        sha256 = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801",
+        name = "sdk_vendor__cc-1.4.7",
+        sha256 = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/cfg-if/1.0.4/download"],
-        strip_prefix = "cfg-if-1.0.4",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.cfg-if-1.0.4.bazel"),
+        urls = ["https://static.crates.io/crates/cc/1.4.7/download"],
+        strip_prefix = "cc-1.4.7",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.cc-1.4.7.bazel"),
+    )
+
+    maybe(
+        http_archive,
+        name = "sdk_vendor__cfg-if-1.0.5",
+        sha256 = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600",
+        type = "tar.gz",
+        urls = ["https://static.crates.io/crates/cfg-if/1.0.5/download"],
+        strip_prefix = "cfg-if-1.0.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.cfg-if-1.0.5.bazel"),
     )
 
     maybe(
@@ -680,22 +667,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__crc32fast-1.5.0",
-        sha256 = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/crc32fast/1.5.0/download"],
-        strip_prefix = "crc32fast-1.5.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.crc32fast-1.5.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__crossbeam-utils-0.8.21",
-        sha256 = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28",
+        name = "sdk_vendor__crc32fast-1.5.2",
+        sha256 = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/crossbeam-utils/0.8.21/download"],
-        strip_prefix = "crossbeam-utils-0.8.21",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.crossbeam-utils-0.8.21.bazel"),
+        urls = ["https://static.crates.io/crates/crc32fast/1.5.2/download"],
+        strip_prefix = "crc32fast-1.5.2",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.crc32fast-1.5.2.bazel"),
     )
 
     maybe(
@@ -710,22 +687,22 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__data-encoding-2.11.0",
-        sha256 = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8",
+        name = "sdk_vendor__data-encoding-2.11.1",
+        sha256 = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/data-encoding/2.11.0/download"],
-        strip_prefix = "data-encoding-2.11.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.data-encoding-2.11.0.bazel"),
+        urls = ["https://static.crates.io/crates/data-encoding/2.11.1/download"],
+        strip_prefix = "data-encoding-2.11.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.data-encoding-2.11.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__derive_arbitrary-1.4.2",
-        sha256 = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a",
+        name = "sdk_vendor__der-0.8.2",
+        sha256 = "a878c850e9e421b20262e9b41f9c860e4785fa07541c266b62ff9d1ef998a80a",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/derive_arbitrary/1.4.2/download"],
-        strip_prefix = "derive_arbitrary-1.4.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.derive_arbitrary-1.4.2.bazel"),
+        urls = ["https://static.crates.io/crates/der/0.8.2/download"],
+        strip_prefix = "der-0.8.2",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.der-0.8.2.bazel"),
     )
 
     maybe(
@@ -760,12 +737,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__displaydoc-0.2.5",
-        sha256 = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0",
+        name = "sdk_vendor__displaydoc-0.2.7",
+        sha256 = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/displaydoc/0.2.5/download"],
-        strip_prefix = "displaydoc-0.2.5",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.displaydoc-0.2.5.bazel"),
+        urls = ["https://static.crates.io/crates/displaydoc/0.2.7/download"],
+        strip_prefix = "displaydoc-0.2.7",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.displaydoc-0.2.7.bazel"),
     )
 
     maybe(
@@ -820,42 +797,42 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__fastrand-2.4.1",
-        sha256 = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6",
+        name = "sdk_vendor__fastrand-2.5.0",
+        sha256 = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/fastrand/2.4.1/download"],
-        strip_prefix = "fastrand-2.4.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.fastrand-2.4.1.bazel"),
+        urls = ["https://static.crates.io/crates/fastrand/2.5.0/download"],
+        strip_prefix = "fastrand-2.5.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.fastrand-2.5.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__filetime-0.2.27",
-        sha256 = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db",
+        name = "sdk_vendor__filetime-0.2.29",
+        sha256 = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/filetime/0.2.27/download"],
-        strip_prefix = "filetime-0.2.27",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.filetime-0.2.27.bazel"),
+        urls = ["https://static.crates.io/crates/filetime/0.2.29/download"],
+        strip_prefix = "filetime-0.2.29",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.filetime-0.2.29.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__find-msvc-tools-0.1.9",
-        sha256 = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582",
+        name = "sdk_vendor__find-msvc-tools-0.1.13",
+        sha256 = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/find-msvc-tools/0.1.9/download"],
-        strip_prefix = "find-msvc-tools-0.1.9",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.find-msvc-tools-0.1.9.bazel"),
+        urls = ["https://static.crates.io/crates/find-msvc-tools/0.1.13/download"],
+        strip_prefix = "find-msvc-tools-0.1.13",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.find-msvc-tools-0.1.13.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__flate2-1.1.9",
-        sha256 = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c",
+        name = "sdk_vendor__flate2-1.1.10",
+        sha256 = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/flate2/1.1.9/download"],
-        strip_prefix = "flate2-1.1.9",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.flate2-1.1.9.bazel"),
+        urls = ["https://static.crates.io/crates/flate2/1.1.10/download"],
+        strip_prefix = "flate2-1.1.10",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.flate2-1.1.10.bazel"),
     )
 
     maybe(
@@ -868,16 +845,6 @@ def crate_repositories():
         build_file = Label("//src/sdk/rust/bazel/crates:BUILD.fnv-1.0.7.bazel"),
     )
 
-    maybe(
-        http_archive,
-        name = "sdk_vendor__foldhash-0.1.5",
-        sha256 = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/foldhash/0.1.5/download"],
-        strip_prefix = "foldhash-0.1.5",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.foldhash-0.1.5.bazel"),
-    )
-
     maybe(
         http_archive,
         name = "sdk_vendor__foldhash-0.2.0",
@@ -920,82 +887,82 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__futures-channel-0.3.32",
-        sha256 = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d",
+        name = "sdk_vendor__futures-channel-0.3.34",
+        sha256 = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/futures-channel/0.3.32/download"],
-        strip_prefix = "futures-channel-0.3.32",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-channel-0.3.32.bazel"),
+        urls = ["https://static.crates.io/crates/futures-channel/0.3.34/download"],
+        strip_prefix = "futures-channel-0.3.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-channel-0.3.34.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__futures-core-0.3.32",
-        sha256 = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d",
+        name = "sdk_vendor__futures-core-0.3.34",
+        sha256 = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/futures-core/0.3.32/download"],
-        strip_prefix = "futures-core-0.3.32",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-core-0.3.32.bazel"),
+        urls = ["https://static.crates.io/crates/futures-core/0.3.34/download"],
+        strip_prefix = "futures-core-0.3.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-core-0.3.34.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__futures-executor-0.3.32",
-        sha256 = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d",
+        name = "sdk_vendor__futures-executor-0.3.34",
+        sha256 = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/futures-executor/0.3.32/download"],
-        strip_prefix = "futures-executor-0.3.32",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-executor-0.3.32.bazel"),
+        urls = ["https://static.crates.io/crates/futures-executor/0.3.34/download"],
+        strip_prefix = "futures-executor-0.3.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-executor-0.3.34.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__futures-io-0.3.32",
-        sha256 = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718",
+        name = "sdk_vendor__futures-io-0.3.34",
+        sha256 = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/futures-io/0.3.32/download"],
-        strip_prefix = "futures-io-0.3.32",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-io-0.3.32.bazel"),
+        urls = ["https://static.crates.io/crates/futures-io/0.3.34/download"],
+        strip_prefix = "futures-io-0.3.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-io-0.3.34.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__futures-macro-0.3.32",
-        sha256 = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b",
+        name = "sdk_vendor__futures-macro-0.3.34",
+        sha256 = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/futures-macro/0.3.32/download"],
-        strip_prefix = "futures-macro-0.3.32",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-macro-0.3.32.bazel"),
+        urls = ["https://static.crates.io/crates/futures-macro/0.3.34/download"],
+        strip_prefix = "futures-macro-0.3.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-macro-0.3.34.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__futures-sink-0.3.32",
-        sha256 = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893",
+        name = "sdk_vendor__futures-sink-0.3.34",
+        sha256 = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/futures-sink/0.3.32/download"],
-        strip_prefix = "futures-sink-0.3.32",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-sink-0.3.32.bazel"),
+        urls = ["https://static.crates.io/crates/futures-sink/0.3.34/download"],
+        strip_prefix = "futures-sink-0.3.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-sink-0.3.34.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__futures-task-0.3.32",
-        sha256 = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393",
+        name = "sdk_vendor__futures-task-0.3.34",
+        sha256 = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/futures-task/0.3.32/download"],
-        strip_prefix = "futures-task-0.3.32",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-task-0.3.32.bazel"),
+        urls = ["https://static.crates.io/crates/futures-task/0.3.34/download"],
+        strip_prefix = "futures-task-0.3.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-task-0.3.34.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__futures-util-0.3.32",
-        sha256 = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6",
+        name = "sdk_vendor__futures-util-0.3.34",
+        sha256 = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/futures-util/0.3.32/download"],
-        strip_prefix = "futures-util-0.3.32",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-util-0.3.32.bazel"),
+        urls = ["https://static.crates.io/crates/futures-util/0.3.34/download"],
+        strip_prefix = "futures-util-0.3.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.futures-util-0.3.34.bazel"),
     )
 
     maybe(
@@ -1020,32 +987,32 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__getrandom-0.4.2",
-        sha256 = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555",
+        name = "sdk_vendor__getrandom-0.3.4",
+        sha256 = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/getrandom/0.4.2/download"],
-        strip_prefix = "getrandom-0.4.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.getrandom-0.4.2.bazel"),
+        urls = ["https://static.crates.io/crates/getrandom/0.3.4/download"],
+        strip_prefix = "getrandom-0.3.4",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.getrandom-0.3.4.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__h2-0.4.15",
-        sha256 = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155",
+        name = "sdk_vendor__getrandom-0.4.3",
+        sha256 = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/h2/0.4.15/download"],
-        strip_prefix = "h2-0.4.15",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.h2-0.4.15.bazel"),
+        urls = ["https://static.crates.io/crates/getrandom/0.4.3/download"],
+        strip_prefix = "getrandom-0.4.3",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.getrandom-0.4.3.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__hashbrown-0.15.5",
-        sha256 = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1",
+        name = "sdk_vendor__h2-0.4.19",
+        sha256 = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/hashbrown/0.15.5/download"],
-        strip_prefix = "hashbrown-0.15.5",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.hashbrown-0.15.5.bazel"),
+        urls = ["https://static.crates.io/crates/h2/0.4.19/download"],
+        strip_prefix = "h2-0.4.19",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.h2-0.4.19.bazel"),
     )
 
     maybe(
@@ -1060,12 +1027,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__hashbrown-0.17.0",
-        sha256 = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51",
+        name = "sdk_vendor__hashbrown-0.17.1",
+        sha256 = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/hashbrown/0.17.0/download"],
-        strip_prefix = "hashbrown-0.17.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.hashbrown-0.17.0.bazel"),
+        urls = ["https://static.crates.io/crates/hashbrown/0.17.1/download"],
+        strip_prefix = "hashbrown-0.17.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.hashbrown-0.17.1.bazel"),
     )
 
     maybe(
@@ -1080,42 +1047,32 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__heck-0.5.0",
-        sha256 = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/heck/0.5.0/download"],
-        strip_prefix = "heck-0.5.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.heck-0.5.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__http-1.4.2",
-        sha256 = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425",
+        name = "sdk_vendor__http-1.5.0",
+        sha256 = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/http/1.4.2/download"],
-        strip_prefix = "http-1.4.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.http-1.4.2.bazel"),
+        urls = ["https://static.crates.io/crates/http/1.5.0/download"],
+        strip_prefix = "http-1.5.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.http-1.5.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__http-body-1.0.1",
-        sha256 = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184",
+        name = "sdk_vendor__http-body-1.1.0",
+        sha256 = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/http-body/1.0.1/download"],
-        strip_prefix = "http-body-1.0.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.http-body-1.0.1.bazel"),
+        urls = ["https://static.crates.io/crates/http-body/1.1.0/download"],
+        strip_prefix = "http-body-1.1.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.http-body-1.1.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__http-body-util-0.1.3",
-        sha256 = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a",
+        name = "sdk_vendor__http-body-util-0.1.5",
+        sha256 = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/http-body-util/0.1.3/download"],
-        strip_prefix = "http-body-util-0.1.3",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.http-body-util-0.1.3.bazel"),
+        urls = ["https://static.crates.io/crates/http-body-util/0.1.5/download"],
+        strip_prefix = "http-body-util-0.1.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.http-body-util-0.1.5.bazel"),
     )
 
     maybe(
@@ -1130,22 +1087,22 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__hyper-1.10.1",
-        sha256 = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498",
+        name = "sdk_vendor__hyper-1.11.1",
+        sha256 = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/hyper/1.10.1/download"],
-        strip_prefix = "hyper-1.10.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.hyper-1.10.1.bazel"),
+        urls = ["https://static.crates.io/crates/hyper/1.11.1/download"],
+        strip_prefix = "hyper-1.11.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.hyper-1.11.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__hyper-rustls-0.27.9",
-        sha256 = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f",
+        name = "sdk_vendor__hyper-rustls-0.27.10",
+        sha256 = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/hyper-rustls/0.27.9/download"],
-        strip_prefix = "hyper-rustls-0.27.9",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.hyper-rustls-0.27.9.bazel"),
+        urls = ["https://static.crates.io/crates/hyper-rustls/0.27.10/download"],
+        strip_prefix = "hyper-rustls-0.27.10",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.hyper-rustls-0.27.10.bazel"),
     )
 
     maybe(
@@ -1170,82 +1127,72 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__icu_collections-2.2.0",
-        sha256 = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/icu_collections/2.2.0/download"],
-        strip_prefix = "icu_collections-2.2.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_collections-2.2.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__icu_locale_core-2.2.0",
-        sha256 = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29",
+        name = "sdk_vendor__icu_collections-2.3.0",
+        sha256 = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/icu_locale_core/2.2.0/download"],
-        strip_prefix = "icu_locale_core-2.2.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_locale_core-2.2.0.bazel"),
+        urls = ["https://static.crates.io/crates/icu_collections/2.3.0/download"],
+        strip_prefix = "icu_collections-2.3.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_collections-2.3.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__icu_normalizer-2.2.0",
-        sha256 = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4",
+        name = "sdk_vendor__icu_locale_core-2.3.0",
+        sha256 = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/icu_normalizer/2.2.0/download"],
-        strip_prefix = "icu_normalizer-2.2.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_normalizer-2.2.0.bazel"),
+        urls = ["https://static.crates.io/crates/icu_locale_core/2.3.0/download"],
+        strip_prefix = "icu_locale_core-2.3.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_locale_core-2.3.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__icu_normalizer_data-2.2.0",
-        sha256 = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38",
+        name = "sdk_vendor__icu_normalizer-2.3.0",
+        sha256 = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/icu_normalizer_data/2.2.0/download"],
-        strip_prefix = "icu_normalizer_data-2.2.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_normalizer_data-2.2.0.bazel"),
+        urls = ["https://static.crates.io/crates/icu_normalizer/2.3.0/download"],
+        strip_prefix = "icu_normalizer-2.3.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_normalizer-2.3.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__icu_properties-2.2.0",
-        sha256 = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de",
+        name = "sdk_vendor__icu_normalizer_data-2.3.0",
+        sha256 = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/icu_properties/2.2.0/download"],
-        strip_prefix = "icu_properties-2.2.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_properties-2.2.0.bazel"),
+        urls = ["https://static.crates.io/crates/icu_normalizer_data/2.3.0/download"],
+        strip_prefix = "icu_normalizer_data-2.3.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_normalizer_data-2.3.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__icu_properties_data-2.2.0",
-        sha256 = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14",
+        name = "sdk_vendor__icu_properties-2.3.0",
+        sha256 = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/icu_properties_data/2.2.0/download"],
-        strip_prefix = "icu_properties_data-2.2.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_properties_data-2.2.0.bazel"),
+        urls = ["https://static.crates.io/crates/icu_properties/2.3.0/download"],
+        strip_prefix = "icu_properties-2.3.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_properties-2.3.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__icu_provider-2.2.0",
-        sha256 = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421",
+        name = "sdk_vendor__icu_properties_data-2.3.0",
+        sha256 = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/icu_provider/2.2.0/download"],
-        strip_prefix = "icu_provider-2.2.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_provider-2.2.0.bazel"),
+        urls = ["https://static.crates.io/crates/icu_properties_data/2.3.0/download"],
+        strip_prefix = "icu_properties_data-2.3.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_properties_data-2.3.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__id-arena-2.3.0",
-        sha256 = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954",
+        name = "sdk_vendor__icu_provider-2.3.1",
+        sha256 = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/id-arena/2.3.0/download"],
-        strip_prefix = "id-arena-2.3.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.id-arena-2.3.0.bazel"),
+        urls = ["https://static.crates.io/crates/icu_provider/2.3.1/download"],
+        strip_prefix = "icu_provider-2.3.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.icu_provider-2.3.1.bazel"),
     )
 
     maybe(
@@ -1270,22 +1217,22 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__indexmap-2.14.0",
-        sha256 = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9",
+        name = "sdk_vendor__indexmap-2.14.2",
+        sha256 = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/indexmap/2.14.0/download"],
-        strip_prefix = "indexmap-2.14.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.indexmap-2.14.0.bazel"),
+        urls = ["https://static.crates.io/crates/indexmap/2.14.2/download"],
+        strip_prefix = "indexmap-2.14.2",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.indexmap-2.14.2.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__ipnet-2.12.0",
-        sha256 = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2",
+        name = "sdk_vendor__ipnet-2.12.2",
+        sha256 = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/ipnet/2.12.0/download"],
-        strip_prefix = "ipnet-2.12.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ipnet-2.12.0.bazel"),
+        urls = ["https://static.crates.io/crates/ipnet/2.12.2/download"],
+        strip_prefix = "ipnet-2.12.2",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ipnet-2.12.2.bazel"),
     )
 
     maybe(
@@ -1300,52 +1247,42 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__js-sys-0.3.102",
-        sha256 = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/js-sys/0.3.102/download"],
-        strip_prefix = "js-sys-0.3.102",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.js-sys-0.3.102.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__leb128fmt-0.1.0",
-        sha256 = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2",
+        name = "sdk_vendor__js-sys-0.3.105",
+        sha256 = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/leb128fmt/0.1.0/download"],
-        strip_prefix = "leb128fmt-0.1.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.leb128fmt-0.1.0.bazel"),
+        urls = ["https://static.crates.io/crates/js-sys/0.3.105/download"],
+        strip_prefix = "js-sys-0.3.105",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.js-sys-0.3.105.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__libc-0.2.186",
-        sha256 = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66",
+        name = "sdk_vendor__libc-0.2.189",
+        sha256 = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/libc/0.2.186/download"],
-        strip_prefix = "libc-0.2.186",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.libc-0.2.186.bazel"),
+        urls = ["https://static.crates.io/crates/libc/0.2.189/download"],
+        strip_prefix = "libc-0.2.189",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.libc-0.2.189.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__libloading-0.8.9",
-        sha256 = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55",
+        name = "sdk_vendor__libloading-0.9.0",
+        sha256 = "754ca22de805bb5744484a5b151a9e1a8e837d5dc232c2d7d8c2e3492edc8b60",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/libloading/0.8.9/download"],
-        strip_prefix = "libloading-0.8.9",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.libloading-0.8.9.bazel"),
+        urls = ["https://static.crates.io/crates/libloading/0.9.0/download"],
+        strip_prefix = "libloading-0.9.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.libloading-0.9.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__libredox-0.1.16",
-        sha256 = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c",
+        name = "sdk_vendor__libredox-0.1.25",
+        sha256 = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/libredox/0.1.16/download"],
-        strip_prefix = "libredox-0.1.16",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.libredox-0.1.16.bazel"),
+        urls = ["https://static.crates.io/crates/libredox/0.1.25/download"],
+        strip_prefix = "libredox-0.1.25",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.libredox-0.1.25.bazel"),
     )
 
     maybe(
@@ -1370,12 +1307,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__litemap-0.8.2",
-        sha256 = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0",
+        name = "sdk_vendor__litemap-0.8.3",
+        sha256 = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/litemap/0.8.2/download"],
-        strip_prefix = "litemap-0.8.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.litemap-0.8.2.bazel"),
+        urls = ["https://static.crates.io/crates/litemap/0.8.3/download"],
+        strip_prefix = "litemap-0.8.3",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.litemap-0.8.3.bazel"),
     )
 
     maybe(
@@ -1390,42 +1327,42 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__log-0.4.29",
-        sha256 = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897",
+        name = "sdk_vendor__log-0.4.34",
+        sha256 = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/log/0.4.29/download"],
-        strip_prefix = "log-0.4.29",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.log-0.4.29.bazel"),
+        urls = ["https://static.crates.io/crates/log/0.4.34/download"],
+        strip_prefix = "log-0.4.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.log-0.4.34.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__memchr-2.8.0",
-        sha256 = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79",
+        name = "sdk_vendor__memchr-2.8.3",
+        sha256 = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/memchr/2.8.0/download"],
-        strip_prefix = "memchr-2.8.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.memchr-2.8.0.bazel"),
+        urls = ["https://static.crates.io/crates/memchr/2.8.3/download"],
+        strip_prefix = "memchr-2.8.3",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.memchr-2.8.3.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__miniz_oxide-0.8.9",
-        sha256 = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316",
+        name = "sdk_vendor__miniz_oxide-0.9.1",
+        sha256 = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/miniz_oxide/0.8.9/download"],
-        strip_prefix = "miniz_oxide-0.8.9",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.miniz_oxide-0.8.9.bazel"),
+        urls = ["https://static.crates.io/crates/miniz_oxide/0.9.1/download"],
+        strip_prefix = "miniz_oxide-0.9.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.miniz_oxide-0.9.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__mio-1.2.0",
-        sha256 = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1",
+        name = "sdk_vendor__mio-1.2.3",
+        sha256 = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/mio/1.2.0/download"],
-        strip_prefix = "mio-1.2.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.mio-1.2.0.bazel"),
+        urls = ["https://static.crates.io/crates/mio/1.2.3/download"],
+        strip_prefix = "mio-1.2.3",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.mio-1.2.3.bazel"),
     )
 
     maybe(
@@ -1518,6 +1455,16 @@ def crate_repositories():
         build_file = Label("//src/sdk/rust/bazel/crates:BUILD.parking_lot_core-0.9.12.bazel"),
     )
 
+    maybe(
+        http_archive,
+        name = "sdk_vendor__pem-rfc7468-1.0.0",
+        sha256 = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9",
+        type = "tar.gz",
+        urls = ["https://static.crates.io/crates/pem-rfc7468/1.0.0/download"],
+        strip_prefix = "pem-rfc7468-1.0.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.pem-rfc7468-1.0.0.bazel"),
+    )
+
     maybe(
         http_archive,
         name = "sdk_vendor__percent-encoding-2.3.2",
@@ -1540,32 +1487,22 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__pkg-config-0.3.33",
-        sha256 = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e",
+        name = "sdk_vendor__pkg-config-0.3.34",
+        sha256 = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/pkg-config/0.3.33/download"],
-        strip_prefix = "pkg-config-0.3.33",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.pkg-config-0.3.33.bazel"),
+        urls = ["https://static.crates.io/crates/pkg-config/0.3.34/download"],
+        strip_prefix = "pkg-config-0.3.34",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.pkg-config-0.3.34.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__plain-0.2.3",
-        sha256 = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6",
+        name = "sdk_vendor__potential_utf-0.1.6",
+        sha256 = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/plain/0.2.3/download"],
-        strip_prefix = "plain-0.2.3",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.plain-0.2.3.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__potential_utf-0.1.5",
-        sha256 = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/potential_utf/0.1.5/download"],
-        strip_prefix = "potential_utf-0.1.5",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.potential_utf-0.1.5.bazel"),
+        urls = ["https://static.crates.io/crates/potential_utf/0.1.6/download"],
+        strip_prefix = "potential_utf-0.1.6",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.potential_utf-0.1.6.bazel"),
     )
 
     maybe(
@@ -1580,32 +1517,32 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__prettyplease-0.2.37",
-        sha256 = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b",
+        name = "sdk_vendor__proc-macro2-1.0.107",
+        sha256 = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/prettyplease/0.2.37/download"],
-        strip_prefix = "prettyplease-0.2.37",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.prettyplease-0.2.37.bazel"),
+        urls = ["https://static.crates.io/crates/proc-macro2/1.0.107/download"],
+        strip_prefix = "proc-macro2-1.0.107",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.proc-macro2-1.0.107.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__proc-macro2-1.0.106",
-        sha256 = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934",
+        name = "sdk_vendor__quote-1.0.47",
+        sha256 = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/proc-macro2/1.0.106/download"],
-        strip_prefix = "proc-macro2-1.0.106",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.proc-macro2-1.0.106.bazel"),
+        urls = ["https://static.crates.io/crates/quote/1.0.47/download"],
+        strip_prefix = "quote-1.0.47",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.quote-1.0.47.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__quote-1.0.45",
-        sha256 = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924",
+        name = "sdk_vendor__r-efi-5.3.0",
+        sha256 = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/quote/1.0.45/download"],
-        strip_prefix = "quote-1.0.45",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.quote-1.0.45.bazel"),
+        urls = ["https://static.crates.io/crates/r-efi/5.3.0/download"],
+        strip_prefix = "r-efi-5.3.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.r-efi-5.3.0.bazel"),
     )
 
     maybe(
@@ -1620,32 +1557,32 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__rand-0.8.6",
-        sha256 = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a",
+        name = "sdk_vendor__rand-0.9.5",
+        sha256 = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/rand/0.8.6/download"],
-        strip_prefix = "rand-0.8.6",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rand-0.8.6.bazel"),
+        urls = ["https://static.crates.io/crates/rand/0.9.5/download"],
+        strip_prefix = "rand-0.9.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rand-0.9.5.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__rand_chacha-0.3.1",
-        sha256 = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88",
+        name = "sdk_vendor__rand_chacha-0.9.0",
+        sha256 = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/rand_chacha/0.3.1/download"],
-        strip_prefix = "rand_chacha-0.3.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rand_chacha-0.3.1.bazel"),
+        urls = ["https://static.crates.io/crates/rand_chacha/0.9.0/download"],
+        strip_prefix = "rand_chacha-0.9.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rand_chacha-0.9.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__rand_core-0.6.4",
-        sha256 = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c",
+        name = "sdk_vendor__rand_core-0.9.5",
+        sha256 = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/rand_core/0.6.4/download"],
-        strip_prefix = "rand_core-0.6.4",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rand_core-0.6.4.bazel"),
+        urls = ["https://static.crates.io/crates/rand_core/0.9.5/download"],
+        strip_prefix = "rand_core-0.9.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rand_core-0.9.5.bazel"),
     )
 
     maybe(
@@ -1658,16 +1595,6 @@ def crate_repositories():
         build_file = Label("//src/sdk/rust/bazel/crates:BUILD.redox_syscall-0.5.18.bazel"),
     )
 
-    maybe(
-        http_archive,
-        name = "sdk_vendor__redox_syscall-0.7.4",
-        sha256 = "f450ad9c3b1da563fb6948a8e0fb0fb9269711c9c73d9ea1de5058c79c8d643a",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/redox_syscall/0.7.4/download"],
-        strip_prefix = "redox_syscall-0.7.4",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.redox_syscall-0.7.4.bazel"),
-    )
-
     maybe(
         http_archive,
         name = "sdk_vendor__redox_users-0.4.6",
@@ -1680,62 +1607,62 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__ref-cast-1.0.25",
-        sha256 = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d",
+        name = "sdk_vendor__ref-cast-1.0.27",
+        sha256 = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/ref-cast/1.0.25/download"],
-        strip_prefix = "ref-cast-1.0.25",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ref-cast-1.0.25.bazel"),
+        urls = ["https://static.crates.io/crates/ref-cast/1.0.27/download"],
+        strip_prefix = "ref-cast-1.0.27",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ref-cast-1.0.27.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__ref-cast-impl-1.0.25",
-        sha256 = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da",
+        name = "sdk_vendor__ref-cast-impl-1.0.27",
+        sha256 = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/ref-cast-impl/1.0.25/download"],
-        strip_prefix = "ref-cast-impl-1.0.25",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ref-cast-impl-1.0.25.bazel"),
+        urls = ["https://static.crates.io/crates/ref-cast-impl/1.0.27/download"],
+        strip_prefix = "ref-cast-impl-1.0.27",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ref-cast-impl-1.0.27.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__regex-1.12.3",
-        sha256 = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276",
+        name = "sdk_vendor__regex-1.13.1",
+        sha256 = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/regex/1.12.3/download"],
-        strip_prefix = "regex-1.12.3",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.regex-1.12.3.bazel"),
+        urls = ["https://static.crates.io/crates/regex/1.13.1/download"],
+        strip_prefix = "regex-1.13.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.regex-1.13.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__regex-automata-0.4.14",
-        sha256 = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f",
+        name = "sdk_vendor__regex-automata-0.4.18",
+        sha256 = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/regex-automata/0.4.14/download"],
-        strip_prefix = "regex-automata-0.4.14",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.regex-automata-0.4.14.bazel"),
+        urls = ["https://static.crates.io/crates/regex-automata/0.4.18/download"],
+        strip_prefix = "regex-automata-0.4.18",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.regex-automata-0.4.18.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__regex-syntax-0.8.10",
-        sha256 = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a",
+        name = "sdk_vendor__regex-syntax-0.8.11",
+        sha256 = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/regex-syntax/0.8.10/download"],
-        strip_prefix = "regex-syntax-0.8.10",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.regex-syntax-0.8.10.bazel"),
+        urls = ["https://static.crates.io/crates/regex-syntax/0.8.11/download"],
+        strip_prefix = "regex-syntax-0.8.11",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.regex-syntax-0.8.11.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__reqwest-0.12.28",
-        sha256 = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147",
+        name = "sdk_vendor__reqwest-0.13.5",
+        sha256 = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/reqwest/0.12.28/download"],
-        strip_prefix = "reqwest-0.12.28",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.reqwest-0.12.28.bazel"),
+        urls = ["https://static.crates.io/crates/reqwest/0.13.5/download"],
+        strip_prefix = "reqwest-0.13.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.reqwest-0.13.5.bazel"),
     )
 
     maybe(
@@ -1770,72 +1697,52 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__rustix-1.1.4",
-        sha256 = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190",
+        name = "sdk_vendor__rustix-1.1.5",
+        sha256 = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/rustix/1.1.4/download"],
-        strip_prefix = "rustix-1.1.4",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustix-1.1.4.bazel"),
+        urls = ["https://static.crates.io/crates/rustix/1.1.5/download"],
+        strip_prefix = "rustix-1.1.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustix-1.1.5.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__rustls-0.23.40",
-        sha256 = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b",
+        name = "sdk_vendor__rustls-0.23.45",
+        sha256 = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/rustls/0.23.40/download"],
-        strip_prefix = "rustls-0.23.40",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustls-0.23.40.bazel"),
+        urls = ["https://static.crates.io/crates/rustls/0.23.45/download"],
+        strip_prefix = "rustls-0.23.45",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustls-0.23.45.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__rustls-pki-types-1.14.1",
-        sha256 = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9",
+        name = "sdk_vendor__rustls-pki-types-1.15.1",
+        sha256 = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/rustls-pki-types/1.14.1/download"],
-        strip_prefix = "rustls-pki-types-1.14.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustls-pki-types-1.14.1.bazel"),
+        urls = ["https://static.crates.io/crates/rustls-pki-types/1.15.1/download"],
+        strip_prefix = "rustls-pki-types-1.15.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustls-pki-types-1.15.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__rustls-webpki-0.103.13",
-        sha256 = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e",
+        name = "sdk_vendor__rustls-webpki-0.103.15",
+        sha256 = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/rustls-webpki/0.103.13/download"],
-        strip_prefix = "rustls-webpki-0.103.13",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustls-webpki-0.103.13.bazel"),
+        urls = ["https://static.crates.io/crates/rustls-webpki/0.103.15/download"],
+        strip_prefix = "rustls-webpki-0.103.15",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustls-webpki-0.103.15.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__rustversion-1.0.22",
-        sha256 = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d",
+        name = "sdk_vendor__rustversion-1.0.23",
+        sha256 = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/rustversion/1.0.22/download"],
-        strip_prefix = "rustversion-1.0.22",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustversion-1.0.22.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__ryu-1.0.23",
-        sha256 = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/ryu/1.0.23/download"],
-        strip_prefix = "ryu-1.0.23",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ryu-1.0.23.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__scc-2.4.0",
-        sha256 = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/scc/2.4.0/download"],
-        strip_prefix = "scc-2.4.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.scc-2.4.0.bazel"),
+        urls = ["https://static.crates.io/crates/rustversion/1.0.23/download"],
+        strip_prefix = "rustversion-1.0.23",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.rustversion-1.0.23.bazel"),
     )
 
     maybe(
@@ -1850,22 +1757,22 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__schemars-1.2.1",
-        sha256 = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc",
+        name = "sdk_vendor__schemars-1.2.2",
+        sha256 = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/schemars/1.2.1/download"],
-        strip_prefix = "schemars-1.2.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.schemars-1.2.1.bazel"),
+        urls = ["https://static.crates.io/crates/schemars/1.2.2/download"],
+        strip_prefix = "schemars-1.2.2",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.schemars-1.2.2.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__schemars_derive-1.2.1",
-        sha256 = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f",
+        name = "sdk_vendor__schemars_derive-1.2.2",
+        sha256 = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/schemars_derive/1.2.1/download"],
-        strip_prefix = "schemars_derive-1.2.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.schemars_derive-1.2.1.bazel"),
+        urls = ["https://static.crates.io/crates/schemars_derive/1.2.2/download"],
+        strip_prefix = "schemars_derive-1.2.2",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.schemars_derive-1.2.2.bazel"),
     )
 
     maybe(
@@ -1878,16 +1785,6 @@ def crate_repositories():
         build_file = Label("//src/sdk/rust/bazel/crates:BUILD.scopeguard-1.2.0.bazel"),
     )
 
-    maybe(
-        http_archive,
-        name = "sdk_vendor__sdd-3.0.10",
-        sha256 = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/sdd/3.0.10/download"],
-        strip_prefix = "sdd-3.0.10",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.sdd-3.0.10.bazel"),
-    )
-
     maybe(
         http_archive,
         name = "sdk_vendor__security-framework-3.7.0",
@@ -1910,102 +1807,82 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__semver-1.0.28",
-        sha256 = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/semver/1.0.28/download"],
-        strip_prefix = "semver-1.0.28",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.semver-1.0.28.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__serde-1.0.228",
-        sha256 = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/serde/1.0.228/download"],
-        strip_prefix = "serde-1.0.228",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde-1.0.228.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__serde_core-1.0.228",
-        sha256 = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad",
+        name = "sdk_vendor__serde-1.0.229",
+        sha256 = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/serde_core/1.0.228/download"],
-        strip_prefix = "serde_core-1.0.228",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde_core-1.0.228.bazel"),
+        urls = ["https://static.crates.io/crates/serde/1.0.229/download"],
+        strip_prefix = "serde-1.0.229",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde-1.0.229.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__serde_derive-1.0.228",
-        sha256 = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79",
+        name = "sdk_vendor__serde_core-1.0.229",
+        sha256 = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/serde_derive/1.0.228/download"],
-        strip_prefix = "serde_derive-1.0.228",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde_derive-1.0.228.bazel"),
+        urls = ["https://static.crates.io/crates/serde_core/1.0.229/download"],
+        strip_prefix = "serde_core-1.0.229",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde_core-1.0.229.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__serde_derive_internals-0.29.1",
-        sha256 = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711",
+        name = "sdk_vendor__serde_derive-1.0.229",
+        sha256 = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/serde_derive_internals/0.29.1/download"],
-        strip_prefix = "serde_derive_internals-0.29.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde_derive_internals-0.29.1.bazel"),
+        urls = ["https://static.crates.io/crates/serde_derive/1.0.229/download"],
+        strip_prefix = "serde_derive-1.0.229",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde_derive-1.0.229.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__serde_json-1.0.149",
-        sha256 = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86",
+        name = "sdk_vendor__serde_derive_internals-0.30.0",
+        sha256 = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/serde_json/1.0.149/download"],
-        strip_prefix = "serde_json-1.0.149",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde_json-1.0.149.bazel"),
+        urls = ["https://static.crates.io/crates/serde_derive_internals/0.30.0/download"],
+        strip_prefix = "serde_derive_internals-0.30.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde_derive_internals-0.30.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__serde_urlencoded-0.7.1",
-        sha256 = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd",
+        name = "sdk_vendor__serde_json-1.0.151",
+        sha256 = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/serde_urlencoded/0.7.1/download"],
-        strip_prefix = "serde_urlencoded-0.7.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde_urlencoded-0.7.1.bazel"),
+        urls = ["https://static.crates.io/crates/serde_json/1.0.151/download"],
+        strip_prefix = "serde_json-1.0.151",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serde_json-1.0.151.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__serial_test-3.4.0",
-        sha256 = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f",
+        name = "sdk_vendor__serial_test-4.0.1",
+        sha256 = "a6df5ed973ad8d834e09f824f9e9f449af6b9a3745f78dec7cc752770bd3bf11",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/serial_test/3.4.0/download"],
-        strip_prefix = "serial_test-3.4.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serial_test-3.4.0.bazel"),
+        urls = ["https://static.crates.io/crates/serial_test/4.0.1/download"],
+        strip_prefix = "serial_test-4.0.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serial_test-4.0.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__serial_test_derive-3.4.0",
-        sha256 = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9",
+        name = "sdk_vendor__serial_test_derive-4.0.1",
+        sha256 = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/serial_test_derive/3.4.0/download"],
-        strip_prefix = "serial_test_derive-3.4.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serial_test_derive-3.4.0.bazel"),
+        urls = ["https://static.crates.io/crates/serial_test_derive/4.0.1/download"],
+        strip_prefix = "serial_test_derive-4.0.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.serial_test_derive-4.0.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__sha1-0.10.6",
-        sha256 = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba",
+        name = "sdk_vendor__sha1-0.10.7",
+        sha256 = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/sha1/0.10.6/download"],
-        strip_prefix = "sha1-0.10.6",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.sha1-0.10.6.bazel"),
+        urls = ["https://static.crates.io/crates/sha1/0.10.7/download"],
+        strip_prefix = "sha1-0.10.7",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.sha1-0.10.7.bazel"),
     )
 
     maybe(
@@ -2020,12 +1897,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__shlex-1.3.0",
-        sha256 = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64",
+        name = "sdk_vendor__shlex-2.0.1",
+        sha256 = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/shlex/1.3.0/download"],
-        strip_prefix = "shlex-1.3.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.shlex-1.3.0.bazel"),
+        urls = ["https://static.crates.io/crates/shlex/2.0.1/download"],
+        strip_prefix = "shlex-2.0.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.shlex-2.0.1.bazel"),
     )
 
     maybe(
@@ -2040,12 +1917,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__simd-adler32-0.3.9",
-        sha256 = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214",
+        name = "sdk_vendor__simd-adler32-0.3.10",
+        sha256 = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/simd-adler32/0.3.9/download"],
-        strip_prefix = "simd-adler32-0.3.9",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.simd-adler32-0.3.9.bazel"),
+        urls = ["https://static.crates.io/crates/simd-adler32/0.3.10/download"],
+        strip_prefix = "simd-adler32-0.3.10",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.simd-adler32-0.3.10.bazel"),
     )
 
     maybe(
@@ -2060,22 +1937,22 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__smallvec-1.15.1",
-        sha256 = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03",
+        name = "sdk_vendor__smallvec-1.16.1",
+        sha256 = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/smallvec/1.15.1/download"],
-        strip_prefix = "smallvec-1.15.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.smallvec-1.15.1.bazel"),
+        urls = ["https://static.crates.io/crates/smallvec/1.16.1/download"],
+        strip_prefix = "smallvec-1.16.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.smallvec-1.16.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__socket2-0.6.3",
-        sha256 = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e",
+        name = "sdk_vendor__socket2-0.6.5",
+        sha256 = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/socket2/0.6.3/download"],
-        strip_prefix = "socket2-0.6.3",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.socket2-0.6.3.bazel"),
+        urls = ["https://static.crates.io/crates/socket2/0.6.5/download"],
+        strip_prefix = "socket2-0.6.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.socket2-0.6.5.bazel"),
     )
 
     maybe(
@@ -2110,12 +1987,22 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__syn-2.0.117",
-        sha256 = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99",
+        name = "sdk_vendor__syn-2.0.119",
+        sha256 = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297",
+        type = "tar.gz",
+        urls = ["https://static.crates.io/crates/syn/2.0.119/download"],
+        strip_prefix = "syn-2.0.119",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.syn-2.0.119.bazel"),
+    )
+
+    maybe(
+        http_archive,
+        name = "sdk_vendor__syn-3.0.6",
+        sha256 = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/syn/2.0.117/download"],
-        strip_prefix = "syn-2.0.117",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.syn-2.0.117.bazel"),
+        urls = ["https://static.crates.io/crates/syn/3.0.6/download"],
+        strip_prefix = "syn-3.0.6",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.syn-3.0.6.bazel"),
     )
 
     maybe(
@@ -2130,12 +2017,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__synstructure-0.13.2",
-        sha256 = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2",
+        name = "sdk_vendor__synstructure-0.14.0",
+        sha256 = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/synstructure/0.13.2/download"],
-        strip_prefix = "synstructure-0.13.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.synstructure-0.13.2.bazel"),
+        urls = ["https://static.crates.io/crates/synstructure/0.14.0/download"],
+        strip_prefix = "synstructure-0.14.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.synstructure-0.14.0.bazel"),
     )
 
     maybe(
@@ -2170,12 +2057,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__thiserror-2.0.18",
-        sha256 = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4",
+        name = "sdk_vendor__thiserror-2.0.20",
+        sha256 = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/thiserror/2.0.18/download"],
-        strip_prefix = "thiserror-2.0.18",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.thiserror-2.0.18.bazel"),
+        urls = ["https://static.crates.io/crates/thiserror/2.0.20/download"],
+        strip_prefix = "thiserror-2.0.20",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.thiserror-2.0.20.bazel"),
     )
 
     maybe(
@@ -2190,42 +2077,42 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__thiserror-impl-2.0.18",
-        sha256 = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5",
+        name = "sdk_vendor__thiserror-impl-2.0.20",
+        sha256 = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/thiserror-impl/2.0.18/download"],
-        strip_prefix = "thiserror-impl-2.0.18",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.thiserror-impl-2.0.18.bazel"),
+        urls = ["https://static.crates.io/crates/thiserror-impl/2.0.20/download"],
+        strip_prefix = "thiserror-impl-2.0.20",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.thiserror-impl-2.0.20.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__tinystr-0.8.3",
-        sha256 = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d",
+        name = "sdk_vendor__tinystr-0.8.4",
+        sha256 = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/tinystr/0.8.3/download"],
-        strip_prefix = "tinystr-0.8.3",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tinystr-0.8.3.bazel"),
+        urls = ["https://static.crates.io/crates/tinystr/0.8.4/download"],
+        strip_prefix = "tinystr-0.8.4",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tinystr-0.8.4.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__tokio-1.52.1",
-        sha256 = "b67dee974fe86fd92cc45b7a95fdd2f99a36a6d7b0d431a231178d3d670bbcc6",
+        name = "sdk_vendor__tokio-1.53.1",
+        sha256 = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/tokio/1.52.1/download"],
-        strip_prefix = "tokio-1.52.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-1.52.1.bazel"),
+        urls = ["https://static.crates.io/crates/tokio/1.53.1/download"],
+        strip_prefix = "tokio-1.53.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-1.53.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__tokio-macros-2.7.0",
-        sha256 = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496",
+        name = "sdk_vendor__tokio-macros-2.7.2",
+        sha256 = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/tokio-macros/2.7.0/download"],
-        strip_prefix = "tokio-macros-2.7.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-macros-2.7.0.bazel"),
+        urls = ["https://static.crates.io/crates/tokio-macros/2.7.2/download"],
+        strip_prefix = "tokio-macros-2.7.2",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-macros-2.7.2.bazel"),
     )
 
     maybe(
@@ -2240,42 +2127,42 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__tokio-rustls-0.26.4",
-        sha256 = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61",
+        name = "sdk_vendor__tokio-rustls-0.26.5",
+        sha256 = "b0c85f2c3ef0b1cd58b36682f4b17aaa995f0e5db534d85692b4903abce21f67",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/tokio-rustls/0.26.4/download"],
-        strip_prefix = "tokio-rustls-0.26.4",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-rustls-0.26.4.bazel"),
+        urls = ["https://static.crates.io/crates/tokio-rustls/0.26.5/download"],
+        strip_prefix = "tokio-rustls-0.26.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-rustls-0.26.5.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__tokio-stream-0.1.18",
-        sha256 = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70",
+        name = "sdk_vendor__tokio-stream-0.1.19",
+        sha256 = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/tokio-stream/0.1.18/download"],
-        strip_prefix = "tokio-stream-0.1.18",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-stream-0.1.18.bazel"),
+        urls = ["https://static.crates.io/crates/tokio-stream/0.1.19/download"],
+        strip_prefix = "tokio-stream-0.1.19",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-stream-0.1.19.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__tokio-tungstenite-0.24.0",
-        sha256 = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9",
+        name = "sdk_vendor__tokio-tungstenite-0.28.0",
+        sha256 = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/tokio-tungstenite/0.24.0/download"],
-        strip_prefix = "tokio-tungstenite-0.24.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-tungstenite-0.24.0.bazel"),
+        urls = ["https://static.crates.io/crates/tokio-tungstenite/0.28.0/download"],
+        strip_prefix = "tokio-tungstenite-0.28.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-tungstenite-0.28.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__tokio-util-0.7.18",
-        sha256 = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098",
+        name = "sdk_vendor__tokio-util-0.7.19",
+        sha256 = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/tokio-util/0.7.18/download"],
-        strip_prefix = "tokio-util-0.7.18",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-util-0.7.18.bazel"),
+        urls = ["https://static.crates.io/crates/tokio-util/0.7.19/download"],
+        strip_prefix = "tokio-util-0.7.19",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tokio-util-0.7.19.bazel"),
     )
 
     maybe(
@@ -2360,42 +2247,42 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__tungstenite-0.24.0",
-        sha256 = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a",
+        name = "sdk_vendor__tungstenite-0.28.0",
+        sha256 = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/tungstenite/0.24.0/download"],
-        strip_prefix = "tungstenite-0.24.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tungstenite-0.24.0.bazel"),
+        urls = ["https://static.crates.io/crates/tungstenite/0.28.0/download"],
+        strip_prefix = "tungstenite-0.28.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.tungstenite-0.28.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__typenum-1.20.0",
-        sha256 = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de",
+        name = "sdk_vendor__typed-path-0.12.3",
+        sha256 = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/typenum/1.20.0/download"],
-        strip_prefix = "typenum-1.20.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.typenum-1.20.0.bazel"),
+        urls = ["https://static.crates.io/crates/typed-path/0.12.3/download"],
+        strip_prefix = "typed-path-0.12.3",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.typed-path-0.12.3.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__unicode-ident-1.0.24",
-        sha256 = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75",
+        name = "sdk_vendor__typenum-1.20.1",
+        sha256 = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/unicode-ident/1.0.24/download"],
-        strip_prefix = "unicode-ident-1.0.24",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.unicode-ident-1.0.24.bazel"),
+        urls = ["https://static.crates.io/crates/typenum/1.20.1/download"],
+        strip_prefix = "typenum-1.20.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.typenum-1.20.1.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__unicode-xid-0.2.6",
-        sha256 = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853",
+        name = "sdk_vendor__unicode-ident-1.0.26",
+        sha256 = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/unicode-xid/0.2.6/download"],
-        strip_prefix = "unicode-xid-0.2.6",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.unicode-xid-0.2.6.bazel"),
+        urls = ["https://static.crates.io/crates/unicode-ident/1.0.26/download"],
+        strip_prefix = "unicode-ident-1.0.26",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.unicode-ident-1.0.26.bazel"),
     )
 
     maybe(
@@ -2410,12 +2297,22 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__ureq-2.12.1",
-        sha256 = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d",
+        name = "sdk_vendor__ureq-3.4.2",
+        sha256 = "9a7ac20be9b7726e0bbdbf974c059676d9acb1cd414961f570a4e8231cacd7fc",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/ureq/2.12.1/download"],
-        strip_prefix = "ureq-2.12.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ureq-2.12.1.bazel"),
+        urls = ["https://static.crates.io/crates/ureq/3.4.2/download"],
+        strip_prefix = "ureq-3.4.2",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ureq-3.4.2.bazel"),
+    )
+
+    maybe(
+        http_archive,
+        name = "sdk_vendor__ureq-proto-0.6.4",
+        sha256 = "f86fd172ccca569e458f61b6bdd6220965a9ef36e672a6852953b51a0e1583be",
+        type = "tar.gz",
+        urls = ["https://static.crates.io/crates/ureq-proto/0.6.4/download"],
+        strip_prefix = "ureq-proto-0.6.4",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.ureq-proto-0.6.4.bazel"),
     )
 
     maybe(
@@ -2438,6 +2335,16 @@ def crate_repositories():
         build_file = Label("//src/sdk/rust/bazel/crates:BUILD.utf-8-0.7.6.bazel"),
     )
 
+    maybe(
+        http_archive,
+        name = "sdk_vendor__utf8-zero-0.8.1",
+        sha256 = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e",
+        type = "tar.gz",
+        urls = ["https://static.crates.io/crates/utf8-zero/0.8.1/download"],
+        strip_prefix = "utf8-zero-0.8.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.utf8-zero-0.8.1.bazel"),
+    )
+
     maybe(
         http_archive,
         name = "sdk_vendor__utf8_iter-1.0.4",
@@ -2450,12 +2357,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__uuid-1.23.1",
-        sha256 = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76",
+        name = "sdk_vendor__uuid-1.26.1",
+        sha256 = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/uuid/1.23.1/download"],
-        strip_prefix = "uuid-1.23.1",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.uuid-1.23.1.bazel"),
+        urls = ["https://static.crates.io/crates/uuid/1.26.1/download"],
+        strip_prefix = "uuid-1.26.1",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.uuid-1.26.1.bazel"),
     )
 
     maybe(
@@ -2500,122 +2407,92 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wasip2-1.0.3-wasi-0.2.9",
-        sha256 = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6",
+        name = "sdk_vendor__wasip2-1.0.4-wasi-0.2.12",
+        sha256 = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasip2/1.0.3+wasi-0.2.9/download"],
-        strip_prefix = "wasip2-1.0.3+wasi-0.2.9",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasip2-1.0.3+wasi-0.2.9.bazel"),
+        urls = ["https://static.crates.io/crates/wasip2/1.0.4+wasi-0.2.12/download"],
+        strip_prefix = "wasip2-1.0.4+wasi-0.2.12",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasip2-1.0.4+wasi-0.2.12.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wasip3-0.4.0-wasi-0.3.0-rc-2026-01-06",
-        sha256 = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5",
+        name = "sdk_vendor__wasm-bindgen-0.2.128",
+        sha256 = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasip3/0.4.0+wasi-0.3.0-rc-2026-01-06/download"],
-        strip_prefix = "wasip3-0.4.0+wasi-0.3.0-rc-2026-01-06",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasip3-0.4.0+wasi-0.3.0-rc-2026-01-06.bazel"),
+        urls = ["https://static.crates.io/crates/wasm-bindgen/0.2.128/download"],
+        strip_prefix = "wasm-bindgen-0.2.128",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-0.2.128.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wasm-bindgen-0.2.125",
-        sha256 = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a",
+        name = "sdk_vendor__wasm-bindgen-futures-0.4.78",
+        sha256 = "6ef4c5d3d2cdf5c54f4231181768f5510842e350db025faf1f7163b1030ed928",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasm-bindgen/0.2.125/download"],
-        strip_prefix = "wasm-bindgen-0.2.125",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-0.2.125.bazel"),
+        urls = ["https://static.crates.io/crates/wasm-bindgen-futures/0.4.78/download"],
+        strip_prefix = "wasm-bindgen-futures-0.4.78",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-futures-0.4.78.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wasm-bindgen-futures-0.4.75",
-        sha256 = "503b14d284f2c8dac03b819967e155ea753f573586193b2b2c95990cb5d69280",
+        name = "sdk_vendor__wasm-bindgen-macro-0.2.128",
+        sha256 = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasm-bindgen-futures/0.4.75/download"],
-        strip_prefix = "wasm-bindgen-futures-0.4.75",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-futures-0.4.75.bazel"),
+        urls = ["https://static.crates.io/crates/wasm-bindgen-macro/0.2.128/download"],
+        strip_prefix = "wasm-bindgen-macro-0.2.128",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-macro-0.2.128.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wasm-bindgen-macro-0.2.125",
-        sha256 = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d",
+        name = "sdk_vendor__wasm-bindgen-macro-support-0.2.128",
+        sha256 = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasm-bindgen-macro/0.2.125/download"],
-        strip_prefix = "wasm-bindgen-macro-0.2.125",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-macro-0.2.125.bazel"),
+        urls = ["https://static.crates.io/crates/wasm-bindgen-macro-support/0.2.128/download"],
+        strip_prefix = "wasm-bindgen-macro-support-0.2.128",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-macro-support-0.2.128.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wasm-bindgen-macro-support-0.2.125",
-        sha256 = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd",
+        name = "sdk_vendor__wasm-bindgen-shared-0.2.128",
+        sha256 = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasm-bindgen-macro-support/0.2.125/download"],
-        strip_prefix = "wasm-bindgen-macro-support-0.2.125",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-macro-support-0.2.125.bazel"),
+        urls = ["https://static.crates.io/crates/wasm-bindgen-shared/0.2.128/download"],
+        strip_prefix = "wasm-bindgen-shared-0.2.128",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-shared-0.2.128.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wasm-bindgen-shared-0.2.125",
-        sha256 = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f",
+        name = "sdk_vendor__wasm-streams-0.5.0",
+        sha256 = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasm-bindgen-shared/0.2.125/download"],
-        strip_prefix = "wasm-bindgen-shared-0.2.125",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-bindgen-shared-0.2.125.bazel"),
+        urls = ["https://static.crates.io/crates/wasm-streams/0.5.0/download"],
+        strip_prefix = "wasm-streams-0.5.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-streams-0.5.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wasm-encoder-0.244.0",
-        sha256 = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319",
+        name = "sdk_vendor__web-sys-0.3.105",
+        sha256 = "9fbddc4a036f00ec4f18c83445bd3115cb306a91da554919a099d9222fe4a7f8",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasm-encoder/0.244.0/download"],
-        strip_prefix = "wasm-encoder-0.244.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-encoder-0.244.0.bazel"),
+        urls = ["https://static.crates.io/crates/web-sys/0.3.105/download"],
+        strip_prefix = "web-sys-0.3.105",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.web-sys-0.3.105.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wasm-metadata-0.244.0",
-        sha256 = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909",
+        name = "sdk_vendor__webpki-root-certs-1.0.9",
+        sha256 = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasm-metadata/0.244.0/download"],
-        strip_prefix = "wasm-metadata-0.244.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-metadata-0.244.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__wasm-streams-0.4.2",
-        sha256 = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasm-streams/0.4.2/download"],
-        strip_prefix = "wasm-streams-0.4.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasm-streams-0.4.2.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__wasmparser-0.244.0",
-        sha256 = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wasmparser/0.244.0/download"],
-        strip_prefix = "wasmparser-0.244.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wasmparser-0.244.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__web-sys-0.3.102",
-        sha256 = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/web-sys/0.3.102/download"],
-        strip_prefix = "web-sys-0.3.102",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.web-sys-0.3.102.bazel"),
+        urls = ["https://static.crates.io/crates/webpki-root-certs/1.0.9/download"],
+        strip_prefix = "webpki-root-certs-1.0.9",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.webpki-root-certs-1.0.9.bazel"),
     )
 
     maybe(
@@ -2828,16 +2705,6 @@ def crate_repositories():
         build_file = Label("//src/sdk/rust/bazel/crates:BUILD.windows_x86_64_msvc-0.52.6.bazel"),
     )
 
-    maybe(
-        http_archive,
-        name = "sdk_vendor__wit-bindgen-0.51.0",
-        sha256 = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wit-bindgen/0.51.0/download"],
-        strip_prefix = "wit-bindgen-0.51.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wit-bindgen-0.51.0.bazel"),
-    )
-
     maybe(
         http_archive,
         name = "sdk_vendor__wit-bindgen-0.57.1",
@@ -2850,62 +2717,12 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__wit-bindgen-core-0.51.0",
-        sha256 = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wit-bindgen-core/0.51.0/download"],
-        strip_prefix = "wit-bindgen-core-0.51.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wit-bindgen-core-0.51.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__wit-bindgen-rust-0.51.0",
-        sha256 = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wit-bindgen-rust/0.51.0/download"],
-        strip_prefix = "wit-bindgen-rust-0.51.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wit-bindgen-rust-0.51.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__wit-bindgen-rust-macro-0.51.0",
-        sha256 = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wit-bindgen-rust-macro/0.51.0/download"],
-        strip_prefix = "wit-bindgen-rust-macro-0.51.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wit-bindgen-rust-macro-0.51.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__wit-component-0.244.0",
-        sha256 = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wit-component/0.244.0/download"],
-        strip_prefix = "wit-component-0.244.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wit-component-0.244.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__wit-parser-0.244.0",
-        sha256 = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736",
+        name = "sdk_vendor__writeable-0.6.4",
+        sha256 = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/wit-parser/0.244.0/download"],
-        strip_prefix = "wit-parser-0.244.0",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.wit-parser-0.244.0.bazel"),
-    )
-
-    maybe(
-        http_archive,
-        name = "sdk_vendor__writeable-0.6.3",
-        sha256 = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4",
-        type = "tar.gz",
-        urls = ["https://static.crates.io/crates/writeable/0.6.3/download"],
-        strip_prefix = "writeable-0.6.3",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.writeable-0.6.3.bazel"),
+        urls = ["https://static.crates.io/crates/writeable/0.6.4/download"],
+        strip_prefix = "writeable-0.6.4",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.writeable-0.6.4.bazel"),
     )
 
     maybe(
@@ -2920,122 +2737,132 @@ def crate_repositories():
 
     maybe(
         http_archive,
-        name = "sdk_vendor__yoke-0.8.2",
-        sha256 = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca",
+        name = "sdk_vendor__yoke-0.8.3",
+        sha256 = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5",
+        type = "tar.gz",
+        urls = ["https://static.crates.io/crates/yoke/0.8.3/download"],
+        strip_prefix = "yoke-0.8.3",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.yoke-0.8.3.bazel"),
+    )
+
+    maybe(
+        http_archive,
+        name = "sdk_vendor__yoke-derive-0.8.3",
+        sha256 = "33811428bee40dbceb6d545e95754741d17a6aef9a4849f0fd62e2ba4f412a78",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/yoke/0.8.2/download"],
-        strip_prefix = "yoke-0.8.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.yoke-0.8.2.bazel"),
+        urls = ["https://static.crates.io/crates/yoke-derive/0.8.3/download"],
+        strip_prefix = "yoke-derive-0.8.3",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.yoke-derive-0.8.3.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__yoke-derive-0.8.2",
-        sha256 = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e",
+        name = "sdk_vendor__zerocopy-0.8.57",
+        sha256 = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/yoke-derive/0.8.2/download"],
-        strip_prefix = "yoke-derive-0.8.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.yoke-derive-0.8.2.bazel"),
+        urls = ["https://static.crates.io/crates/zerocopy/0.8.57/download"],
+        strip_prefix = "zerocopy-0.8.57",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerocopy-0.8.57.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zerocopy-0.8.52",
-        sha256 = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f",
+        name = "sdk_vendor__zerocopy-derive-0.8.57",
+        sha256 = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zerocopy/0.8.52/download"],
-        strip_prefix = "zerocopy-0.8.52",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerocopy-0.8.52.bazel"),
+        urls = ["https://static.crates.io/crates/zerocopy-derive/0.8.57/download"],
+        strip_prefix = "zerocopy-derive-0.8.57",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerocopy-derive-0.8.57.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zerocopy-derive-0.8.52",
-        sha256 = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930",
+        name = "sdk_vendor__zerofrom-0.1.8",
+        sha256 = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zerocopy-derive/0.8.52/download"],
-        strip_prefix = "zerocopy-derive-0.8.52",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerocopy-derive-0.8.52.bazel"),
+        urls = ["https://static.crates.io/crates/zerofrom/0.1.8/download"],
+        strip_prefix = "zerofrom-0.1.8",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerofrom-0.1.8.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zerofrom-0.1.7",
-        sha256 = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df",
+        name = "sdk_vendor__zerofrom-derive-0.1.8",
+        sha256 = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zerofrom/0.1.7/download"],
-        strip_prefix = "zerofrom-0.1.7",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerofrom-0.1.7.bazel"),
+        urls = ["https://static.crates.io/crates/zerofrom-derive/0.1.8/download"],
+        strip_prefix = "zerofrom-derive-0.1.8",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerofrom-derive-0.1.8.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zerofrom-derive-0.1.7",
-        sha256 = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1",
+        name = "sdk_vendor__zeroize-1.9.0",
+        sha256 = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zerofrom-derive/0.1.7/download"],
-        strip_prefix = "zerofrom-derive-0.1.7",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerofrom-derive-0.1.7.bazel"),
+        urls = ["https://static.crates.io/crates/zeroize/1.9.0/download"],
+        strip_prefix = "zeroize-1.9.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zeroize-1.9.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zeroize-1.8.2",
-        sha256 = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0",
+        name = "sdk_vendor__zerotrie-0.2.5",
+        sha256 = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zeroize/1.8.2/download"],
-        strip_prefix = "zeroize-1.8.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zeroize-1.8.2.bazel"),
+        urls = ["https://static.crates.io/crates/zerotrie/0.2.5/download"],
+        strip_prefix = "zerotrie-0.2.5",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerotrie-0.2.5.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zerotrie-0.2.4",
-        sha256 = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf",
+        name = "sdk_vendor__zerovec-0.11.8",
+        sha256 = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zerotrie/0.2.4/download"],
-        strip_prefix = "zerotrie-0.2.4",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerotrie-0.2.4.bazel"),
+        urls = ["https://static.crates.io/crates/zerovec/0.11.8/download"],
+        strip_prefix = "zerovec-0.11.8",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerovec-0.11.8.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zerovec-0.11.6",
-        sha256 = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239",
+        name = "sdk_vendor__zerovec-derive-0.11.6",
+        sha256 = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zerovec/0.11.6/download"],
-        strip_prefix = "zerovec-0.11.6",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerovec-0.11.6.bazel"),
+        urls = ["https://static.crates.io/crates/zerovec-derive/0.11.6/download"],
+        strip_prefix = "zerovec-derive-0.11.6",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerovec-derive-0.11.6.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zerovec-derive-0.11.3",
-        sha256 = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555",
+        name = "sdk_vendor__zip-7.2.0",
+        sha256 = "c42e33efc22a0650c311c2ef19115ce232583abbe80850bc8b66509ebef02de0",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zerovec-derive/0.11.3/download"],
-        strip_prefix = "zerovec-derive-0.11.3",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zerovec-derive-0.11.3.bazel"),
+        urls = ["https://static.crates.io/crates/zip/7.2.0/download"],
+        strip_prefix = "zip-7.2.0",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zip-7.2.0.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zip-2.4.2",
-        sha256 = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50",
+        name = "sdk_vendor__zlib-rs-0.6.8",
+        sha256 = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zip/2.4.2/download"],
-        strip_prefix = "zip-2.4.2",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zip-2.4.2.bazel"),
+        urls = ["https://static.crates.io/crates/zlib-rs/0.6.8/download"],
+        strip_prefix = "zlib-rs-0.6.8",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zlib-rs-0.6.8.bazel"),
     )
 
     maybe(
         http_archive,
-        name = "sdk_vendor__zmij-1.0.21",
-        sha256 = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa",
+        name = "sdk_vendor__zmij-1.0.23",
+        sha256 = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b",
         type = "tar.gz",
-        urls = ["https://static.crates.io/crates/zmij/1.0.21/download"],
-        strip_prefix = "zmij-1.0.21",
-        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zmij-1.0.21.bazel"),
+        urls = ["https://static.crates.io/crates/zmij/1.0.23/download"],
+        strip_prefix = "zmij-1.0.23",
+        build_file = Label("//src/sdk/rust/bazel/crates:BUILD.zmij-1.0.23.bazel"),
     )
 
     maybe(
@@ -3050,35 +2877,35 @@ def crate_repositories():
 
     return [
         struct(repo = "sdk_vendor", is_dev_dep = False),
-        struct(repo = "sdk_vendor__async-trait-0.1.89", is_dev_dep = False),
-        struct(repo = "sdk_vendor__base64-0.22.1", is_dev_dep = False),
-        struct(repo = "sdk_vendor__bytes-1.11.1", is_dev_dep = False),
+        struct(repo = "sdk_vendor__async-trait-0.1.92", is_dev_dep = False),
+        struct(repo = "sdk_vendor__base64-0.23.1", is_dev_dep = False),
+        struct(repo = "sdk_vendor__bytes-1.12.1", is_dev_dep = False),
         struct(repo = "sdk_vendor__dirs-5.0.1", is_dev_dep = False),
-        struct(repo = "sdk_vendor__flate2-1.1.9", is_dev_dep = False),
-        struct(repo = "sdk_vendor__futures-util-0.3.32", is_dev_dep = False),
-        struct(repo = "sdk_vendor__getrandom-0.2.17", is_dev_dep = False),
-        struct(repo = "sdk_vendor__http-1.4.2", is_dev_dep = False),
-        struct(repo = "sdk_vendor__indexmap-2.14.0", is_dev_dep = False),
-        struct(repo = "sdk_vendor__libloading-0.8.9", is_dev_dep = False),
+        struct(repo = "sdk_vendor__flate2-1.1.10", is_dev_dep = False),
+        struct(repo = "sdk_vendor__futures-util-0.3.34", is_dev_dep = False),
+        struct(repo = "sdk_vendor__getrandom-0.4.3", is_dev_dep = False),
+        struct(repo = "sdk_vendor__http-1.5.0", is_dev_dep = False),
+        struct(repo = "sdk_vendor__indexmap-2.14.2", is_dev_dep = False),
+        struct(repo = "sdk_vendor__libloading-0.9.0", is_dev_dep = False),
         struct(repo = "sdk_vendor__native-tls-0.2.18", is_dev_dep = False),
         struct(repo = "sdk_vendor__parking_lot-0.12.5", is_dev_dep = False),
-        struct(repo = "sdk_vendor__regex-1.12.3", is_dev_dep = False),
-        struct(repo = "sdk_vendor__reqwest-0.12.28", is_dev_dep = False),
-        struct(repo = "sdk_vendor__serde-1.0.228", is_dev_dep = False),
-        struct(repo = "sdk_vendor__serde_json-1.0.149", is_dev_dep = False),
+        struct(repo = "sdk_vendor__regex-1.13.1", is_dev_dep = False),
+        struct(repo = "sdk_vendor__reqwest-0.13.5", is_dev_dep = False),
+        struct(repo = "sdk_vendor__serde-1.0.229", is_dev_dep = False),
+        struct(repo = "sdk_vendor__serde_json-1.0.151", is_dev_dep = False),
         struct(repo = "sdk_vendor__sha2-0.10.9", is_dev_dep = False),
         struct(repo = "sdk_vendor__tar-0.4.46", is_dev_dep = False),
-        struct(repo = "sdk_vendor__tokio-1.52.1", is_dev_dep = False),
-        struct(repo = "sdk_vendor__tokio-stream-0.1.18", is_dev_dep = False),
-        struct(repo = "sdk_vendor__tokio-tungstenite-0.24.0", is_dev_dep = False),
-        struct(repo = "sdk_vendor__tokio-util-0.7.18", is_dev_dep = False),
+        struct(repo = "sdk_vendor__tokio-1.53.1", is_dev_dep = False),
+        struct(repo = "sdk_vendor__tokio-stream-0.1.19", is_dev_dep = False),
+        struct(repo = "sdk_vendor__tokio-tungstenite-0.28.0", is_dev_dep = False),
+        struct(repo = "sdk_vendor__tokio-util-0.7.19", is_dev_dep = False),
         struct(repo = "sdk_vendor__tracing-0.1.44", is_dev_dep = False),
-        struct(repo = "sdk_vendor__ureq-2.12.1", is_dev_dep = False),
-        struct(repo = "sdk_vendor__uuid-1.23.1", is_dev_dep = False),
+        struct(repo = "sdk_vendor__uuid-1.26.1", is_dev_dep = False),
         struct(repo = "sdk_vendor__windows-sys-0.61.2", is_dev_dep = False),
-        struct(repo = "sdk_vendor__zip-2.4.2", is_dev_dep = False),
+        struct(repo = "sdk_vendor__zip-7.2.0", is_dev_dep = False),
         struct(repo = "sdk_vendor__rusqlite-0.40.2", is_dev_dep = True),
-        struct(repo = "sdk_vendor__schemars-1.2.1", is_dev_dep = True),
-        struct(repo = "sdk_vendor__serial_test-3.4.0", is_dev_dep = True),
+        struct(repo = "sdk_vendor__schemars-1.2.2", is_dev_dep = True),
+        struct(repo = "sdk_vendor__serial_test-4.0.1", is_dev_dep = True),
         struct(repo = "sdk_vendor__tempfile-3.27.0", is_dev_dep = True),
+        struct(repo = "sdk_vendor__ureq-3.4.2", is_dev_dep = True),
     ]
diff --git a/rust/bazel/crates/flate2-1.1.10/BUILD.bazel b/rust/bazel/crates/flate2-1.1.10/BUILD.bazel
new file mode 100644
index 0000000000..8aae5fd098
--- /dev/null
+++ b/rust/bazel/crates/flate2-1.1.10/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "flate2-1.1.10",
+    actual = "@sdk_vendor__flate2-1.1.10//:flate2",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/flate2/BUILD.bazel b/rust/bazel/crates/flate2/BUILD.bazel
index 8d324e0ccf..34b2f87372 100644
--- a/rust/bazel/crates/flate2/BUILD.bazel
+++ b/rust/bazel/crates/flate2/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "flate2",
-    actual = "@sdk_vendor__flate2-1.1.9//:flate2",
+    actual = "@sdk_vendor__flate2-1.1.10//:flate2",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/futures-util-0.3.32/BUILD.bazel b/rust/bazel/crates/futures-util-0.3.32/BUILD.bazel
deleted file mode 100644
index 59f90bd5a3..0000000000
--- a/rust/bazel/crates/futures-util-0.3.32/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "futures-util-0.3.32",
-    actual = "@sdk_vendor__futures-util-0.3.32//:futures_util",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/futures-util-0.3.34/BUILD.bazel b/rust/bazel/crates/futures-util-0.3.34/BUILD.bazel
new file mode 100644
index 0000000000..98322f4b92
--- /dev/null
+++ b/rust/bazel/crates/futures-util-0.3.34/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "futures-util-0.3.34",
+    actual = "@sdk_vendor__futures-util-0.3.34//:futures_util",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/futures-util/BUILD.bazel b/rust/bazel/crates/futures-util/BUILD.bazel
index 281e1da323..8b7c7424ee 100644
--- a/rust/bazel/crates/futures-util/BUILD.bazel
+++ b/rust/bazel/crates/futures-util/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "futures-util",
-    actual = "@sdk_vendor__futures-util-0.3.32//:futures_util",
+    actual = "@sdk_vendor__futures-util-0.3.34//:futures_util",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/getrandom-0.4.3/BUILD.bazel b/rust/bazel/crates/getrandom-0.4.3/BUILD.bazel
new file mode 100644
index 0000000000..f56773ffb4
--- /dev/null
+++ b/rust/bazel/crates/getrandom-0.4.3/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "getrandom-0.4.3",
+    actual = "@sdk_vendor__getrandom-0.4.3//:getrandom",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/getrandom/BUILD.bazel b/rust/bazel/crates/getrandom/BUILD.bazel
index 3970a7c111..f35206cab0 100644
--- a/rust/bazel/crates/getrandom/BUILD.bazel
+++ b/rust/bazel/crates/getrandom/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "getrandom",
-    actual = "@sdk_vendor__getrandom-0.2.17//:getrandom",
+    actual = "@sdk_vendor__getrandom-0.4.3//:getrandom",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/http-1.4.2/BUILD.bazel b/rust/bazel/crates/http-1.5.0/BUILD.bazel
similarity index 85%
rename from rust/bazel/crates/http-1.4.2/BUILD.bazel
rename to rust/bazel/crates/http-1.5.0/BUILD.bazel
index f7cacb2bf5..413bc6b13f 100644
--- a/rust/bazel/crates/http-1.4.2/BUILD.bazel
+++ b/rust/bazel/crates/http-1.5.0/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "http-1.4.2",
-    actual = "@sdk_vendor__http-1.4.2//:http",
+    name = "http-1.5.0",
+    actual = "@sdk_vendor__http-1.5.0//:http",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/http/BUILD.bazel b/rust/bazel/crates/http/BUILD.bazel
index bd31d63bd8..108bc775b2 100644
--- a/rust/bazel/crates/http/BUILD.bazel
+++ b/rust/bazel/crates/http/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "http",
-    actual = "@sdk_vendor__http-1.4.2//:http",
+    actual = "@sdk_vendor__http-1.5.0//:http",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/indexmap-2.14.0/BUILD.bazel b/rust/bazel/crates/indexmap-2.14.0/BUILD.bazel
deleted file mode 100644
index 1f2bc87e2e..0000000000
--- a/rust/bazel/crates/indexmap-2.14.0/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "indexmap-2.14.0",
-    actual = "@sdk_vendor__indexmap-2.14.0//:indexmap",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/indexmap-2.14.2/BUILD.bazel b/rust/bazel/crates/indexmap-2.14.2/BUILD.bazel
new file mode 100644
index 0000000000..2cc5cb2816
--- /dev/null
+++ b/rust/bazel/crates/indexmap-2.14.2/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "indexmap-2.14.2",
+    actual = "@sdk_vendor__indexmap-2.14.2//:indexmap",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/indexmap/BUILD.bazel b/rust/bazel/crates/indexmap/BUILD.bazel
index b00ffa0589..027084b6b0 100644
--- a/rust/bazel/crates/indexmap/BUILD.bazel
+++ b/rust/bazel/crates/indexmap/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "indexmap",
-    actual = "@sdk_vendor__indexmap-2.14.0//:indexmap",
+    actual = "@sdk_vendor__indexmap-2.14.2//:indexmap",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/libloading-0.8.9/BUILD.bazel b/rust/bazel/crates/libloading-0.8.9/BUILD.bazel
deleted file mode 100644
index 0cb7b9f5ec..0000000000
--- a/rust/bazel/crates/libloading-0.8.9/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "libloading-0.8.9",
-    actual = "@sdk_vendor__libloading-0.8.9//:libloading",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/getrandom-0.2.17/BUILD.bazel b/rust/bazel/crates/libloading-0.9.0/BUILD.bazel
similarity index 82%
rename from rust/bazel/crates/getrandom-0.2.17/BUILD.bazel
rename to rust/bazel/crates/libloading-0.9.0/BUILD.bazel
index 652529669e..d8dfef791f 100644
--- a/rust/bazel/crates/getrandom-0.2.17/BUILD.bazel
+++ b/rust/bazel/crates/libloading-0.9.0/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "getrandom-0.2.17",
-    actual = "@sdk_vendor__getrandom-0.2.17//:getrandom",
+    name = "libloading-0.9.0",
+    actual = "@sdk_vendor__libloading-0.9.0//:libloading",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/bytes-1.11.1/BUILD.bazel b/rust/bazel/crates/regex-1.13.1/BUILD.bazel
similarity index 84%
rename from rust/bazel/crates/bytes-1.11.1/BUILD.bazel
rename to rust/bazel/crates/regex-1.13.1/BUILD.bazel
index a69a6c7d93..205ed43a80 100644
--- a/rust/bazel/crates/bytes-1.11.1/BUILD.bazel
+++ b/rust/bazel/crates/regex-1.13.1/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "bytes-1.11.1",
-    actual = "@sdk_vendor__bytes-1.11.1//:bytes",
+    name = "regex-1.13.1",
+    actual = "@sdk_vendor__regex-1.13.1//:regex",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/regex/BUILD.bazel b/rust/bazel/crates/regex/BUILD.bazel
index 1fef37d9b0..01bbf39801 100644
--- a/rust/bazel/crates/regex/BUILD.bazel
+++ b/rust/bazel/crates/regex/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "regex",
-    actual = "@sdk_vendor__regex-1.12.3//:regex",
+    actual = "@sdk_vendor__regex-1.13.1//:regex",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/reqwest-0.12.28/BUILD.bazel b/rust/bazel/crates/reqwest-0.12.28/BUILD.bazel
deleted file mode 100644
index f3975eca7d..0000000000
--- a/rust/bazel/crates/reqwest-0.12.28/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "reqwest-0.12.28",
-    actual = "@sdk_vendor__reqwest-0.12.28//:reqwest",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/reqwest-0.13.5/BUILD.bazel b/rust/bazel/crates/reqwest-0.13.5/BUILD.bazel
new file mode 100644
index 0000000000..b1913960a1
--- /dev/null
+++ b/rust/bazel/crates/reqwest-0.13.5/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "reqwest-0.13.5",
+    actual = "@sdk_vendor__reqwest-0.13.5//:reqwest",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/reqwest/BUILD.bazel b/rust/bazel/crates/reqwest/BUILD.bazel
index 4a93159869..6013a883ca 100644
--- a/rust/bazel/crates/reqwest/BUILD.bazel
+++ b/rust/bazel/crates/reqwest/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "reqwest",
-    actual = "@sdk_vendor__reqwest-0.12.28//:reqwest",
+    actual = "@sdk_vendor__reqwest-0.13.5//:reqwest",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/schemars-1.2.1/BUILD.bazel b/rust/bazel/crates/schemars-1.2.1/BUILD.bazel
deleted file mode 100644
index 5be539e10e..0000000000
--- a/rust/bazel/crates/schemars-1.2.1/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "schemars-1.2.1",
-    actual = "@sdk_vendor__schemars-1.2.1//:schemars",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/schemars-1.2.2/BUILD.bazel b/rust/bazel/crates/schemars-1.2.2/BUILD.bazel
new file mode 100644
index 0000000000..679b485ff1
--- /dev/null
+++ b/rust/bazel/crates/schemars-1.2.2/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "schemars-1.2.2",
+    actual = "@sdk_vendor__schemars-1.2.2//:schemars",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/schemars/BUILD.bazel b/rust/bazel/crates/schemars/BUILD.bazel
index 502bc713e5..20fb5a2199 100644
--- a/rust/bazel/crates/schemars/BUILD.bazel
+++ b/rust/bazel/crates/schemars/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "schemars",
-    actual = "@sdk_vendor__schemars-1.2.1//:schemars",
+    actual = "@sdk_vendor__schemars-1.2.2//:schemars",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/sdk_libloading-0.8.9/BUILD.bazel b/rust/bazel/crates/sdk_libloading-0.8.9/BUILD.bazel
deleted file mode 100644
index 69705725b1..0000000000
--- a/rust/bazel/crates/sdk_libloading-0.8.9/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "sdk_libloading-0.8.9",
-    actual = "@sdk_vendor__libloading-0.8.9//:libloading",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/sdk_libloading-0.9.0/BUILD.bazel b/rust/bazel/crates/sdk_libloading-0.9.0/BUILD.bazel
new file mode 100644
index 0000000000..07723d9bee
--- /dev/null
+++ b/rust/bazel/crates/sdk_libloading-0.9.0/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "sdk_libloading-0.9.0",
+    actual = "@sdk_vendor__libloading-0.9.0//:libloading",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/sdk_libloading/BUILD.bazel b/rust/bazel/crates/sdk_libloading/BUILD.bazel
index ecf16372fc..1eafd6c77a 100644
--- a/rust/bazel/crates/sdk_libloading/BUILD.bazel
+++ b/rust/bazel/crates/sdk_libloading/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "sdk_libloading",
-    actual = "@sdk_vendor__libloading-0.8.9//:libloading",
+    actual = "@sdk_vendor__libloading-0.9.0//:libloading",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/serde-1.0.228/BUILD.bazel b/rust/bazel/crates/serde-1.0.228/BUILD.bazel
deleted file mode 100644
index 2843eba8bf..0000000000
--- a/rust/bazel/crates/serde-1.0.228/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "serde-1.0.228",
-    actual = "@sdk_vendor__serde-1.0.228//:serde",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/flate2-1.1.9/BUILD.bazel b/rust/bazel/crates/serde-1.0.229/BUILD.bazel
similarity index 84%
rename from rust/bazel/crates/flate2-1.1.9/BUILD.bazel
rename to rust/bazel/crates/serde-1.0.229/BUILD.bazel
index b6d410fc6b..b2409ff93d 100644
--- a/rust/bazel/crates/flate2-1.1.9/BUILD.bazel
+++ b/rust/bazel/crates/serde-1.0.229/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "flate2-1.1.9",
-    actual = "@sdk_vendor__flate2-1.1.9//:flate2",
+    name = "serde-1.0.229",
+    actual = "@sdk_vendor__serde-1.0.229//:serde",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/serde/BUILD.bazel b/rust/bazel/crates/serde/BUILD.bazel
index 6705b15eda..fda6a3610f 100644
--- a/rust/bazel/crates/serde/BUILD.bazel
+++ b/rust/bazel/crates/serde/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "serde",
-    actual = "@sdk_vendor__serde-1.0.228//:serde",
+    actual = "@sdk_vendor__serde-1.0.229//:serde",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/serde_json-1.0.149/BUILD.bazel b/rust/bazel/crates/serde_json-1.0.149/BUILD.bazel
deleted file mode 100644
index 4c780b604c..0000000000
--- a/rust/bazel/crates/serde_json-1.0.149/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "serde_json-1.0.149",
-    actual = "@sdk_vendor__serde_json-1.0.149//:serde_json",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/serde_json-1.0.151/BUILD.bazel b/rust/bazel/crates/serde_json-1.0.151/BUILD.bazel
new file mode 100644
index 0000000000..39eaeada9f
--- /dev/null
+++ b/rust/bazel/crates/serde_json-1.0.151/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "serde_json-1.0.151",
+    actual = "@sdk_vendor__serde_json-1.0.151//:serde_json",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/serde_json/BUILD.bazel b/rust/bazel/crates/serde_json/BUILD.bazel
index bf18af14d3..fca1f43041 100644
--- a/rust/bazel/crates/serde_json/BUILD.bazel
+++ b/rust/bazel/crates/serde_json/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "serde_json",
-    actual = "@sdk_vendor__serde_json-1.0.149//:serde_json",
+    actual = "@sdk_vendor__serde_json-1.0.151//:serde_json",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/serial_test-3.4.0/BUILD.bazel b/rust/bazel/crates/serial_test-3.4.0/BUILD.bazel
deleted file mode 100644
index cbf8b04ce1..0000000000
--- a/rust/bazel/crates/serial_test-3.4.0/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "serial_test-3.4.0",
-    actual = "@sdk_vendor__serial_test-3.4.0//:serial_test",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/serial_test-4.0.1/BUILD.bazel b/rust/bazel/crates/serial_test-4.0.1/BUILD.bazel
new file mode 100644
index 0000000000..df257eadd6
--- /dev/null
+++ b/rust/bazel/crates/serial_test-4.0.1/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "serial_test-4.0.1",
+    actual = "@sdk_vendor__serial_test-4.0.1//:serial_test",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/serial_test/BUILD.bazel b/rust/bazel/crates/serial_test/BUILD.bazel
index aa6b0116c3..eb4668fb9e 100644
--- a/rust/bazel/crates/serial_test/BUILD.bazel
+++ b/rust/bazel/crates/serial_test/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "serial_test",
-    actual = "@sdk_vendor__serial_test-3.4.0//:serial_test",
+    actual = "@sdk_vendor__serial_test-4.0.1//:serial_test",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/tokio-1.52.1/BUILD.bazel b/rust/bazel/crates/tokio-1.53.1/BUILD.bazel
similarity index 84%
rename from rust/bazel/crates/tokio-1.52.1/BUILD.bazel
rename to rust/bazel/crates/tokio-1.53.1/BUILD.bazel
index 449b519859..bc800d26e9 100644
--- a/rust/bazel/crates/tokio-1.52.1/BUILD.bazel
+++ b/rust/bazel/crates/tokio-1.53.1/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "tokio-1.52.1",
-    actual = "@sdk_vendor__tokio-1.52.1//:tokio",
+    name = "tokio-1.53.1",
+    actual = "@sdk_vendor__tokio-1.53.1//:tokio",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/tokio-stream-0.1.18/BUILD.bazel b/rust/bazel/crates/tokio-stream-0.1.18/BUILD.bazel
deleted file mode 100644
index 5dbbb20ccc..0000000000
--- a/rust/bazel/crates/tokio-stream-0.1.18/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "tokio-stream-0.1.18",
-    actual = "@sdk_vendor__tokio-stream-0.1.18//:tokio_stream",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/tokio-stream-0.1.19/BUILD.bazel b/rust/bazel/crates/tokio-stream-0.1.19/BUILD.bazel
new file mode 100644
index 0000000000..5ac64a1e95
--- /dev/null
+++ b/rust/bazel/crates/tokio-stream-0.1.19/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "tokio-stream-0.1.19",
+    actual = "@sdk_vendor__tokio-stream-0.1.19//:tokio_stream",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/tokio-stream/BUILD.bazel b/rust/bazel/crates/tokio-stream/BUILD.bazel
index 543f4966dc..8673e6955f 100644
--- a/rust/bazel/crates/tokio-stream/BUILD.bazel
+++ b/rust/bazel/crates/tokio-stream/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "tokio-stream",
-    actual = "@sdk_vendor__tokio-stream-0.1.18//:tokio_stream",
+    actual = "@sdk_vendor__tokio-stream-0.1.19//:tokio_stream",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/tokio-tungstenite-0.24.0/BUILD.bazel b/rust/bazel/crates/tokio-tungstenite-0.28.0/BUILD.bazel
similarity index 80%
rename from rust/bazel/crates/tokio-tungstenite-0.24.0/BUILD.bazel
rename to rust/bazel/crates/tokio-tungstenite-0.28.0/BUILD.bazel
index afd5923e49..664067a612 100644
--- a/rust/bazel/crates/tokio-tungstenite-0.24.0/BUILD.bazel
+++ b/rust/bazel/crates/tokio-tungstenite-0.28.0/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "tokio-tungstenite-0.24.0",
-    actual = "@sdk_vendor__tokio-tungstenite-0.24.0//:tokio_tungstenite",
+    name = "tokio-tungstenite-0.28.0",
+    actual = "@sdk_vendor__tokio-tungstenite-0.28.0//:tokio_tungstenite",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/tokio-tungstenite/BUILD.bazel b/rust/bazel/crates/tokio-tungstenite/BUILD.bazel
index c6e9dace1e..fbdb6e93b4 100644
--- a/rust/bazel/crates/tokio-tungstenite/BUILD.bazel
+++ b/rust/bazel/crates/tokio-tungstenite/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "tokio-tungstenite",
-    actual = "@sdk_vendor__tokio-tungstenite-0.24.0//:tokio_tungstenite",
+    actual = "@sdk_vendor__tokio-tungstenite-0.28.0//:tokio_tungstenite",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/tokio-util-0.7.18/BUILD.bazel b/rust/bazel/crates/tokio-util-0.7.18/BUILD.bazel
deleted file mode 100644
index 7bc38d5134..0000000000
--- a/rust/bazel/crates/tokio-util-0.7.18/BUILD.bazel
+++ /dev/null
@@ -1,15 +0,0 @@
-###############################################################################
-# @generated
-# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
-# regenerate this file, run the following:
-#
-#     bazel run @@//src/sdk/rust/bazel:vendor
-###############################################################################
-
-package(default_visibility = ["//visibility:public"])
-
-alias(
-    name = "tokio-util-0.7.18",
-    actual = "@sdk_vendor__tokio-util-0.7.18//:tokio_util",
-    tags = ["manual"],
-)
diff --git a/rust/bazel/crates/tokio-util-0.7.19/BUILD.bazel b/rust/bazel/crates/tokio-util-0.7.19/BUILD.bazel
new file mode 100644
index 0000000000..9ac52fd3ef
--- /dev/null
+++ b/rust/bazel/crates/tokio-util-0.7.19/BUILD.bazel
@@ -0,0 +1,15 @@
+###############################################################################
+# @generated
+# DO NOT MODIFY: This file is auto-generated by a crate_universe tool. To
+# regenerate this file, run the following:
+#
+#     bazel run @@//src/sdk/rust/bazel:vendor
+###############################################################################
+
+package(default_visibility = ["//visibility:public"])
+
+alias(
+    name = "tokio-util-0.7.19",
+    actual = "@sdk_vendor__tokio-util-0.7.19//:tokio_util",
+    tags = ["manual"],
+)
diff --git a/rust/bazel/crates/tokio-util/BUILD.bazel b/rust/bazel/crates/tokio-util/BUILD.bazel
index c936dc18a0..71e7936275 100644
--- a/rust/bazel/crates/tokio-util/BUILD.bazel
+++ b/rust/bazel/crates/tokio-util/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "tokio-util",
-    actual = "@sdk_vendor__tokio-util-0.7.18//:tokio_util",
+    actual = "@sdk_vendor__tokio-util-0.7.19//:tokio_util",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/tokio/BUILD.bazel b/rust/bazel/crates/tokio/BUILD.bazel
index 24658073ec..8b826fb0ab 100644
--- a/rust/bazel/crates/tokio/BUILD.bazel
+++ b/rust/bazel/crates/tokio/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "tokio",
-    actual = "@sdk_vendor__tokio-1.52.1//:tokio",
+    actual = "@sdk_vendor__tokio-1.53.1//:tokio",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/ureq-2.12.1/BUILD.bazel b/rust/bazel/crates/ureq-3.4.2/BUILD.bazel
similarity index 85%
rename from rust/bazel/crates/ureq-2.12.1/BUILD.bazel
rename to rust/bazel/crates/ureq-3.4.2/BUILD.bazel
index a0a757f48a..bb4999bb6a 100644
--- a/rust/bazel/crates/ureq-2.12.1/BUILD.bazel
+++ b/rust/bazel/crates/ureq-3.4.2/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "ureq-2.12.1",
-    actual = "@sdk_vendor__ureq-2.12.1//:ureq",
+    name = "ureq-3.4.2",
+    actual = "@sdk_vendor__ureq-3.4.2//:ureq",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/ureq/BUILD.bazel b/rust/bazel/crates/ureq/BUILD.bazel
index 43172f6a38..1f6e75b9c2 100644
--- a/rust/bazel/crates/ureq/BUILD.bazel
+++ b/rust/bazel/crates/ureq/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "ureq",
-    actual = "@sdk_vendor__ureq-2.12.1//:ureq",
+    actual = "@sdk_vendor__ureq-3.4.2//:ureq",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/uuid-1.23.1/BUILD.bazel b/rust/bazel/crates/uuid-1.26.1/BUILD.bazel
similarity index 85%
rename from rust/bazel/crates/uuid-1.23.1/BUILD.bazel
rename to rust/bazel/crates/uuid-1.26.1/BUILD.bazel
index fcd748200b..70238dd0a4 100644
--- a/rust/bazel/crates/uuid-1.23.1/BUILD.bazel
+++ b/rust/bazel/crates/uuid-1.26.1/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "uuid-1.23.1",
-    actual = "@sdk_vendor__uuid-1.23.1//:uuid",
+    name = "uuid-1.26.1",
+    actual = "@sdk_vendor__uuid-1.26.1//:uuid",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/uuid/BUILD.bazel b/rust/bazel/crates/uuid/BUILD.bazel
index 0e5004532e..cc6afa8d48 100644
--- a/rust/bazel/crates/uuid/BUILD.bazel
+++ b/rust/bazel/crates/uuid/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "uuid",
-    actual = "@sdk_vendor__uuid-1.23.1//:uuid",
+    actual = "@sdk_vendor__uuid-1.26.1//:uuid",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/zip-2.4.2/BUILD.bazel b/rust/bazel/crates/zip-7.2.0/BUILD.bazel
similarity index 86%
rename from rust/bazel/crates/zip-2.4.2/BUILD.bazel
rename to rust/bazel/crates/zip-7.2.0/BUILD.bazel
index b013dba42f..8b220c6447 100644
--- a/rust/bazel/crates/zip-2.4.2/BUILD.bazel
+++ b/rust/bazel/crates/zip-7.2.0/BUILD.bazel
@@ -9,7 +9,7 @@
 package(default_visibility = ["//visibility:public"])
 
 alias(
-    name = "zip-2.4.2",
-    actual = "@sdk_vendor__zip-2.4.2//:zip",
+    name = "zip-7.2.0",
+    actual = "@sdk_vendor__zip-7.2.0//:zip",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates/zip/BUILD.bazel b/rust/bazel/crates/zip/BUILD.bazel
index 08ea2428d3..066b775b65 100644
--- a/rust/bazel/crates/zip/BUILD.bazel
+++ b/rust/bazel/crates/zip/BUILD.bazel
@@ -10,6 +10,6 @@ package(default_visibility = ["//visibility:public"])
 
 alias(
     name = "zip",
-    actual = "@sdk_vendor__zip-2.4.2//:zip",
+    actual = "@sdk_vendor__zip-7.2.0//:zip",
     tags = ["manual"],
 )
diff --git a/rust/bazel/crates_extension.bzl b/rust/bazel/crates_extension.bzl
index 11b23434eb..0a97aa2c37 100644
--- a/rust/bazel/crates_extension.bzl
+++ b/rust/bazel/crates_extension.bzl
@@ -9,6 +9,6 @@ def _crate_repositories_impl(module_ctx):
         root_module_direct_dev_deps = [],
     )
 
-sdk_crates = module_extension(
+sdk = module_extension(
     implementation = _crate_repositories_impl,
 )
diff --git a/rust/build/download.rs b/rust/build/download.rs
new file mode 100644
index 0000000000..93f93b7ef5
--- /dev/null
+++ b/rust/build/download.rs
@@ -0,0 +1,39 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+
+// ureq 3 has no per-read timeout; allow slow archives while bounding stalled transfers.
+pub(super) const BODY_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(15 * 60);
+
+pub(super) fn is_transient(error: &ureq::Error) -> bool {
+    match error {
+        ureq::Error::StatusCode(code) => (500..600).contains(code),
+        ureq::Error::BadUri(_)
+        | ureq::Error::Http(_)
+        | ureq::Error::InvalidProxyUrl
+        | ureq::Error::TooManyRedirects
+        | ureq::Error::RedirectFailed
+        | ureq::Error::RequireHttpsOnly(_)
+        | ureq::Error::TlsRequired
+        | ureq::Error::Tls(_)
+        | ureq::Error::NativeTls(_)
+        | ureq::Error::Pem(_)
+        | ureq::Error::Der(_)
+        | ureq::Error::BodyExceedsLimit(_)
+        | ureq::Error::LargeResponseHeader(..) => false,
+        _ => true,
+    }
+}
+
+pub(super) fn message(error: &ureq::Error) -> String {
+    match error {
+        ureq::Error::StatusCode(code) => {
+            let reason = ureq::http::StatusCode::from_u16(*code)
+                .ok()
+                .and_then(|status| status.canonical_reason());
+            match reason {
+                Some(reason) => format!("HTTP {code} {reason}"),
+                None => format!("HTTP {code}"),
+            }
+        }
+        _ => format!("download error: {error}"),
+    }
+}
diff --git a/rust/build/in_process.rs b/rust/build/in_process.rs
index ffbec98d50..8037daa22c 100644
--- a/rust/build/in_process.rs
+++ b/rust/build/in_process.rs
@@ -4,6 +4,9 @@ use std::time::Duration;
 
 use sha2::Digest;
 
+#[path = "download.rs"]
+mod download;
+
 #[path = "../src/cache_paths.rs"]
 mod cache_paths;
 
@@ -870,21 +873,29 @@ struct DownloadError {
 }
 
 fn try_download(url: &str) -> Result<Vec<u8>, DownloadError> {
-    let connector = native_tls::TlsConnector::new().map_err(|e| DownloadError {
+    native_tls::TlsConnector::new().map_err(|e| DownloadError {
         message: format!("native-tls init error: {e}"),
         transient: false,
     })?;
-    let agent = ureq::AgentBuilder::new()
-        .tls_connector(std::sync::Arc::new(connector))
-        .timeout_connect(Duration::from_secs(30))
-        .timeout_read(Duration::from_secs(120))
-        .build();
+    let agent = ureq::Agent::config_builder()
+        .tls_config(
+            ureq::tls::TlsConfig::builder()
+                .provider(ureq::tls::TlsProvider::NativeTls)
+                .root_certs(ureq::tls::RootCerts::PlatformVerifier)
+                .build(),
+        )
+        .timeout_connect(Some(Duration::from_secs(30)))
+        .timeout_recv_response(Some(Duration::from_secs(120)))
+        .timeout_recv_body(Some(download::BODY_TIMEOUT))
+        .build()
+        .new_agent();
 
     match agent.get(url).call() {
-        Ok(response) => {
+        Ok(mut response) => {
             let mut bytes = Vec::new();
             response
-                .into_reader()
+                .body_mut()
+                .as_reader()
                 .read_to_end(&mut bytes)
                 .map_err(|e| DownloadError {
                     message: format!("read error: {e}"),
@@ -892,22 +903,9 @@ fn try_download(url: &str) -> Result<Vec<u8>, DownloadError> {
                 })?;
             Ok(bytes)
         }
-        // 5xx — server-side, treat as transient.
-        Err(ureq::Error::Status(code, response)) if (500..600).contains(&code) => {
-            Err(DownloadError {
-                message: format!("HTTP {code} {}", response.status_text()),
-                transient: true,
-            })
-        }
-        // 4xx — client-side, fail fast.
-        Err(ureq::Error::Status(code, response)) => Err(DownloadError {
-            message: format!("HTTP {code} {}", response.status_text()),
-            transient: false,
-        }),
-        // Transport-layer (DNS, connect, TLS, read timeout) — treat as transient.
-        Err(ureq::Error::Transport(t)) => Err(DownloadError {
-            message: format!("transport error: {t}"),
-            transient: true,
+        Err(error) => Err(DownloadError {
+            message: download::message(&error),
+            transient: download::is_transient(&error),
         }),
     }
 }
diff --git a/rust/build/out_of_process.rs b/rust/build/out_of_process.rs
index 4d7ba889ea..89d4df3c1e 100644
--- a/rust/build/out_of_process.rs
+++ b/rust/build/out_of_process.rs
@@ -4,6 +4,9 @@ use std::time::Duration;
 
 use sha2::Digest;
 
+#[path = "download.rs"]
+mod download;
+
 pub(crate) fn main() {
     println!("cargo:rerun-if-env-changed=DOCS_RS");
     println!("cargo:rerun-if-env-changed=COPILOT_SKIP_CLI_DOWNLOAD");
@@ -586,21 +589,29 @@ struct DownloadError {
 }
 
 fn try_download(url: &str) -> Result<Vec<u8>, DownloadError> {
-    let connector = native_tls::TlsConnector::new().map_err(|e| DownloadError {
+    native_tls::TlsConnector::new().map_err(|e| DownloadError {
         message: format!("native-tls init error: {e}"),
         transient: false,
     })?;
-    let agent = ureq::AgentBuilder::new()
-        .tls_connector(std::sync::Arc::new(connector))
-        .timeout_connect(Duration::from_secs(30))
-        .timeout_read(Duration::from_secs(120))
-        .build();
+    let agent = ureq::Agent::config_builder()
+        .tls_config(
+            ureq::tls::TlsConfig::builder()
+                .provider(ureq::tls::TlsProvider::NativeTls)
+                .root_certs(ureq::tls::RootCerts::PlatformVerifier)
+                .build(),
+        )
+        .timeout_connect(Some(Duration::from_secs(30)))
+        .timeout_recv_response(Some(Duration::from_secs(120)))
+        .timeout_recv_body(Some(download::BODY_TIMEOUT))
+        .build()
+        .new_agent();
 
     match agent.get(url).call() {
-        Ok(response) => {
+        Ok(mut response) => {
             let mut bytes = Vec::new();
             response
-                .into_reader()
+                .body_mut()
+                .as_reader()
                 .read_to_end(&mut bytes)
                 .map_err(|e| DownloadError {
                     message: format!("read error: {e}"),
@@ -608,22 +619,9 @@ fn try_download(url: &str) -> Result<Vec<u8>, DownloadError> {
                 })?;
             Ok(bytes)
         }
-        // 5xx — server-side, treat as transient.
-        Err(ureq::Error::Status(code, response)) if (500..600).contains(&code) => {
-            Err(DownloadError {
-                message: format!("HTTP {code} {}", response.status_text()),
-                transient: true,
-            })
-        }
-        // 4xx — client-side, fail fast.
-        Err(ureq::Error::Status(code, response)) => Err(DownloadError {
-            message: format!("HTTP {code} {}", response.status_text()),
-            transient: false,
-        }),
-        // Transport-layer (DNS, connect, TLS, read timeout) — treat as transient.
-        Err(ureq::Error::Transport(t)) => Err(DownloadError {
-            message: format!("transport error: {t}"),
-            transient: true,
+        Err(error) => Err(DownloadError {
+            message: download::message(&error),
+            transient: download::is_transient(&error),
         }),
     }
 }
diff --git a/rust/sdk_targets.bzl b/rust/sdk_targets.bzl
index 550a07c407..eab7b8d5c1 100644
--- a/rust/sdk_targets.bzl
+++ b/rust/sdk_targets.bzl
@@ -2,25 +2,25 @@
 
 load("@rules_rust//cargo:defs.bzl", "cargo_build_script")
 load("@rules_rust//rust:defs.bzl", "rust_library")
-load("//src/sdk/rust/bazel/crates:defs.bzl", "aliases", "all_crate_deps")
+load("//src/sdk/rust/bazel/crates:defs.bzl", "aliases", "all_crate_deps", "crate_deps")
 
 _LOCAL_RUNTIME_DEPS = [
-    "@vendor__base64-0.22.1//:base64",
+    "@vendor__base64-0.23.1//:base64",
     "@vendor__bytes-1.12.1//:bytes",
     "@vendor__dirs-5.0.1//:dirs",
     "@vendor__futures-util-0.3.34//:futures_util",
-    "@vendor__getrandom-0.2.17//:getrandom",
+    "@vendor__getrandom-0.4.3//:getrandom",
     "@vendor__http-1.5.0//:http",
     "@vendor__indexmap-2.14.2//:indexmap",
-    "@vendor__libloading-0.8.9//:libloading",
+    "@vendor__libloading-0.9.0//:libloading",
     "@vendor__parking_lot-0.12.5//:parking_lot",
     "@vendor__regex-1.13.1//:regex",
-    "@vendor__reqwest-0.12.28//:reqwest",
+    "@vendor__reqwest-0.13.5//:reqwest",
     "@vendor__serde-1.0.229//:serde",
     "@vendor__serde_json-1.0.151//:serde_json",
     "@vendor__tokio-1.53.1//:tokio",
     "@vendor__tokio-stream-0.1.19//:tokio_stream",
-    "@vendor__tokio-tungstenite-0.24.0//:tokio_tungstenite",
+    "@vendor__tokio-tungstenite-0.28.0//:tokio_tungstenite",
     "@vendor__tokio-util-0.7.19//:tokio_util",
     "@vendor__tracing-0.1.44//:tracing",
     "@vendor__uuid-1.26.1//:uuid",
@@ -66,14 +66,15 @@ def sdk_targets():
         crate_features = sdk_features,
         crate_name = "build_script_build",
         crate_root = "build.rs",
-        deps = all_crate_deps(build = True),
+        # crate_universe classifies ureq as dev-only when it is also a build dependency.
+        deps = all_crate_deps(build = True) + crate_deps(["ureq"]),
     )
 
     rust_library(
         name = "github-copilot-sdk",
         srcs = native.glob(["src/**/*.rs"]),
         aliases = {
-            "@sdk_vendor//libloading-0.8.9": "libloading",
+            "@sdk_vendor//libloading-0.9.0": "libloading",
         },
         compile_data = ["README.md"],
         crate_features = sdk_features,
@@ -83,7 +84,7 @@ def sdk_targets():
         visibility = ["//visibility:public"],
         deps = [
             ":build_script",
-            "//src/sdk/rust/bazel/crates:schemars-1.2.1",
+            "//src/sdk/rust/bazel/crates:schemars-1.2.2",
         ] + all_crate_deps(),
     )
 
diff --git a/rust/src/copilot_request_handler.rs b/rust/src/copilot_request_handler.rs
index 3b6e9369ab..efd5c03466 100644
--- a/rust/src/copilot_request_handler.rs
+++ b/rust/src/copilot_request_handler.rs
@@ -490,13 +490,13 @@ impl CopilotWebSocketForwarderBuilder {
                     _ = loop_cancel.cancelled() => break,
                     msg = read.next() => match msg {
                         Some(Ok(Message::Text(text))) => {
-                            let message = CopilotWebSocketMessage::from_text(text);
+                            let message = CopilotWebSocketMessage { data: bytes::Bytes::from(text).into(), binary: false };
                             if let Some(out) = apply_transform(&on_response, message) {
                                 let _ = response.send_message(out).await;
                             }
                         }
                         Some(Ok(Message::Binary(data))) => {
-                            let message = CopilotWebSocketMessage { data, binary: true };
+                            let message = CopilotWebSocketMessage { data: data.into(), binary: true };
                             if let Some(out) = apply_transform(&on_response, message) {
                                 let _ = response.send_message(out).await;
                             }
@@ -553,13 +553,13 @@ impl CopilotWebSocketHandler for CopilotWebSocketForwarder {
             return Ok(());
         };
         let ws_message = if message.binary {
-            Message::Binary(message.data)
+            Message::Binary(message.data.into())
         } else {
             let text = match String::from_utf8(message.data) {
                 Ok(text) => text,
                 Err(err) => String::from_utf8_lossy(err.as_bytes()).into_owned(),
             };
-            Message::Text(text)
+            Message::Text(text.into())
         };
         let mut guard = self.write.lock().await;
         if let Some(write) = guard.as_mut() {
diff --git a/rust/src/generated/api_types.rs b/rust/src/generated/api_types.rs
index 17d500d7d0..7a4d3bde2b 100644
--- a/rust/src/generated/api_types.rs
+++ b/rust/src/generated/api_types.rs
@@ -32,6 +32,8 @@ pub mod rpc_methods {
     pub const MODELS_LIST: &str = "models.list";
     /// `models.getBuiltInCatalog`
     pub const MODELS_GETBUILTINCATALOG: &str = "models.getBuiltInCatalog";
+    /// `sandbox.getHostSupport`
+    pub const SANDBOX_GETHOSTSUPPORT: &str = "sandbox.getHostSupport";
     /// `tools.list`
     pub const TOOLS_LIST: &str = "tools.list";
     /// `account.getQuota`
@@ -411,6 +413,10 @@ pub mod rpc_methods {
     pub const SESSION_COMPLETIONS_REQUEST: &str = "session.completions.request";
     /// `session.instructions.getSources`
     pub const SESSION_INSTRUCTIONS_GETSOURCES: &str = "session.instructions.getSources";
+    /// `session.instructions.reload`
+    pub const SESSION_INSTRUCTIONS_RELOAD: &str = "session.instructions.reload";
+    /// `session.customizations.reload`
+    pub const SESSION_CUSTOMIZATIONS_RELOAD: &str = "session.customizations.reload";
     /// `session.fleet.start`
     pub const SESSION_FLEET_START: &str = "session.fleet.start";
     /// `session.agent.list`
@@ -533,6 +539,10 @@ pub mod rpc_methods {
     pub const SESSION_MCP_RESOURCES_LIST: &str = "session.mcp.resources.list";
     /// `session.mcp.resources.listTemplates`
     pub const SESSION_MCP_RESOURCES_LISTTEMPLATES: &str = "session.mcp.resources.listTemplates";
+    /// `session.diagnostics.configure`
+    pub const SESSION_DIAGNOSTICS_CONFIGURE: &str = "session.diagnostics.configure";
+    /// `session.diagnostics.read`
+    pub const SESSION_DIAGNOSTICS_READ: &str = "session.diagnostics.read";
     /// `session.connectors.getCapabilities`
     pub const SESSION_CONNECTORS_GETCAPABILITIES: &str = "session.connectors.getCapabilities";
     /// `session.connectors.getStatus`
@@ -5651,6 +5661,196 @@ pub struct DebugCollectLogsResult {
     pub skipped_entries: Option<Vec<DebugCollectLogsSkippedEntry>>,
 }
 
+/// MCP-specific detail for a source-discriminated diagnostic entry.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpDiagnosticDetails {
+    /// Fresh identifier for the MCP connection attempt, including failed starts.
+    pub connection_id: String,
+    /// Serialized diagnostic detail. Protocol and HTTP records use JSON when detail is present.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub data: Option<String>,
+    /// Protocol-frame direction when kind is protocol.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub direction: Option<McpDiagnosticDirection>,
+    /// Diagnostic record category.
+    pub kind: McpDiagnosticKind,
+    /// Configured MCP server name.
+    pub server_name: String,
+}
+
+/// One retained session-scoped diagnostic record. Potentially content-bearing diagnostic data is opt-in and must not be exported automatically as telemetry.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiagnosticEntry {
+    /// Agent identifier for a subagent host. Omitted for the root agent.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_id: Option<String>,
+    /// Typed MCP diagnostic detail.
+    pub details: McpDiagnosticDetails,
+    /// Severity of this emitted diagnostic record.
+    pub level: DiagnosticSeverity,
+    /// Human-readable diagnostic summary.
+    pub message: String,
+    /// Original byte count when a known-size message or data value was truncated.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub original_bytes: Option<i64>,
+    /// Diagnostic source identifying the typed details payload.
+    pub source: DiagnosticEntrySource,
+    /// UTC RFC 3339 timestamp captured at the diagnostic source.
+    pub timestamp: String,
+    /// Whether message or data was truncated to the record-size bound.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub truncated: Option<bool>,
+}
+
+/// MCP diagnostic source configuration.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct McpDiagnosticSourceConfiguration {
+    /// Threshold to apply to MCP diagnostic producers in this session.
+    pub level: DiagnosticLogLevel,
+}
+
+/// Typed diagnostic source configuration. At least one source is required by diagnostics configuration methods.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiagnosticSourcesConfiguration {
+    /// MCP diagnostic capture threshold. Omit to leave the current threshold unchanged.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mcp: Option<McpDiagnosticSourceConfiguration>,
+}
+
+/// Per-source session diagnostics configuration.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiagnosticsConfiguration {
+    /// Diagnostic thresholds keyed by supported source.
+    pub sources: DiagnosticSourcesConfiguration,
+}
+
+/// Patch session diagnostic thresholds for explicitly supplied sources.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiagnosticsConfigureRequest {
+    /// Sources to configure. At least one supported source must be supplied.
+    pub sources: DiagnosticSourcesConfiguration,
+}
+
+/// Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the default waitMs is zero (maximum 30000).
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiagnosticsReadRequest {
+    /// Opaque cursor returned by an earlier read. Omit to start at the oldest retained record.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<String>,
+    /// Maximum number of records to return, from 1 through 500. Omit for 100.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max: Option<i64>,
+    /// Nonempty selection of sources to read. Each source may be listed once.
+    pub sources: Vec<DiagnosticSource>,
+    /// Maximum time in milliseconds to wait for a new record, from 0 through 30000.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub wait_ms: Option<i32>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiagnosticsReadResultEntriesItem {
+    /// Agent identifier for a subagent host. Omitted for the root agent.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_id: Option<String>,
+    /// Typed MCP diagnostic detail.
+    pub details: McpDiagnosticDetails,
+    /// Severity of this emitted diagnostic record.
+    pub level: DiagnosticSeverity,
+    /// Human-readable diagnostic summary.
+    pub message: String,
+    /// Original byte count when a known-size message or data value was truncated.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub original_bytes: Option<i64>,
+    /// Diagnostic source identifying the typed details payload.
+    pub source: DiagnosticsReadResultEntriesItemSource,
+    /// UTC RFC 3339 timestamp captured at the diagnostic source.
+    pub timestamp: String,
+    /// Whether message or data was truncated to the record-size bound.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub truncated: Option<bool>,
+}
+
+/// One cursor-addressed page of retained session diagnostics.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DiagnosticsReadResult {
+    /// Opaque cursor for the next independent read.
+    pub cursor: String,
+    /// Whether the requested cursor remained within the retained buffer window.
+    pub cursor_status: DiagnosticCursorStatus,
+    /// Number of records lost before this page when known. Omitted when a buffer generation change makes the count unknowable.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub dropped_count: Option<i64>,
+    /// Retained records beginning at the requested cursor.
+    pub entries: Vec<DiagnosticsReadResultEntriesItem>,
+    /// Whether additional retained records follow this page.
+    pub has_more: bool,
+}
+
 /// Installed plugin that contributes a discovered extension.
 ///
 /// <div class="warning">
@@ -10985,6 +11185,9 @@ pub struct McpServerConfigHttp {
     /// Whether the configured OAuth client is public and does not require a client secret.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub oauth_public_client: Option<bool>,
+    /// Non-empty array of valid RFC 6749 scope-token strings to request for the statically configured OAuth client when the server challenge omits scope or provides an empty scope. Requires a non-empty oauthClientId. These scopes take precedence over protected-resource metadata.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub oauth_scopes: Option<Vec<String>>,
     /// Set to `true` to use defaults, or provide an object with additional auth or OIDC settings.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub oidc: Option<serde_json::Value>,
@@ -16148,6 +16351,9 @@ pub struct QueuePendingItems {
     /// Stable identity of the queued user message. Present for message rows and absent for slash commands and model changes.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub message_id: Option<String>,
+    /// Optional source tag associated with this pending queue entry. This is an open string, not authenticated authorship. In particular, `user` does not prove that a person typed the message. If the source is absent or unrecognized, consumers must not infer human or agent authorship and should handle the entry neutrally. Consumers should tolerate future source values.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source: Option<String>,
 }
 
 /// Snapshot of the session's pending queued items and immediate-steering messages.
@@ -16168,6 +16374,9 @@ pub struct QueuePendingItemsResult {
     pub items: Vec<QueuePendingItems>,
     /// Display text for messages currently in the immediate steering queue (interjections sent during a running turn).
     pub steering_messages: Vec<String>,
+    /// ID of the running turn's user message while the model has not answered it, so `withdrawMessage` can still take it back once nothing sent after it is pending. A message leaves `items` when its turn starts, before its `user.message` is recorded; this tells that message apart from one that was removed. Absent when no turn prompt can be taken back.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub withdrawable_turn_message_id: Option<String>,
 }
 
 /// Parameters for removing a queued item by stable id.
@@ -16321,7 +16530,7 @@ pub struct QueueUpdateTextResult {
     pub updated: bool,
 }
 
-/// Conditional withdrawal of a single user message, before the runtime claims it for delivery.
+/// Conditional withdrawal of a single user message, from its queue or from the running turn it started.
 ///
 /// <div class="warning">
 ///
@@ -16338,6 +16547,23 @@ pub struct QueueWithdrawMessageRequest {
     pub message_id: String,
 }
 
+/// Result of withdrawing a user message.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct QueueWithdrawMessageResult {
+    /// True when the running turn was interrupted to withdraw the message. With removed false, the turn was interrupted but its events could not be removed, for example because the model answered first, so the message stays in the interrupted turn.
+    pub interrupted: bool,
+    /// True when the message left the queue or, for a running turn, history.
+    pub removed: bool,
+}
+
 /// Event type to register consumer interest for, used by runtime gating logic.
 ///
 /// <div class="warning">
@@ -17012,6 +17238,46 @@ pub struct SandboxEnforcementStatus {
     pub required: bool,
 }
 
+/// Whether this host can run one sandbox policy feature. A session whose effective policy uses an unsupported feature fails each sandboxed command with `reason`.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SandboxHostCapability {
+    /// The policy feature, as an extensible string: ignore names you do not recognize. Known values: `network` (sandboxed commands can reach the network; on Linux this needs the tooling for Bubblewrap's private network namespace, such as slirp4netns), `network_filtering` (host rules and the sandbox proxy; on Linux this needs the same tooling as `network`; on Windows it needs Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set `network.allowLocalNetwork`), `denied_paths` (native enforcement of `filesystem.deniedPaths`), and `shell` (shell commands inside the sandbox; on Windows this needs Process Security Environment 1.1 filesystem enumeration support).
+    pub name: String,
+    /// Human-readable reason and remedy when the feature is unsupported, such as a package to install or an OS update. Present only when `supported` is false.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Whether this host can run the feature.
+    pub supported: bool,
+}
+
+/// Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SandboxHostSupport {
+    /// Sandbox policy features whose availability varies between hosts that can run the backend. Empty when `supported` is false, because no feature can run without a backend. Later runtimes can add entries; ignore an entry whose `name` you do not recognize.
+    pub capabilities: Vec<SandboxHostCapability>,
+    /// Human-readable reason the sandbox cannot run on this host. Present only when `supported` is false.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Whether a process-containment backend is usable on this host: Seatbelt on macOS, Bubblewrap on Linux, or ProcessContainer on Windows.
+    pub supported: bool,
+}
+
 /// Register an absolute-time scheduled prompt.
 ///
 /// <div class="warning">
@@ -25250,6 +25516,26 @@ pub struct ModelsGetBuiltInCatalogResult {
     pub models: Vec<BuiltInModelCatalogEntry>,
 }
 
+/// Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SandboxGetHostSupportResult {
+    /// Sandbox policy features whose availability varies between hosts that can run the backend. Empty when `supported` is false, because no feature can run without a backend. Later runtimes can add entries; ignore an entry whose `name` you do not recognize.
+    pub capabilities: Vec<SandboxHostCapability>,
+    /// Human-readable reason the sandbox cannot run on this host. Present only when `supported` is false.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+    /// Whether a process-containment backend is usable on this host: Seatbelt on macOS, Bubblewrap on Linux, or ProcessContainer on Windows.
+    pub supported: bool,
+}
+
 /// Built-in tools available for the requested model, with their parameters and instructions.
 ///
 /// <div class="warning">
@@ -28202,6 +28488,53 @@ pub struct SessionInstructionsGetSourcesResult {
     pub sources: Vec<InstructionSource>,
 }
 
+/// Identifies the target session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionInstructionsReloadParams {
+    /// Target session identifier
+    pub session_id: SessionId,
+}
+
+/// Identifies the target session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionCustomizationsReloadParams {
+    /// Target session identifier
+    pub session_id: SessionId,
+}
+
+/// Diagnostics from reloading skill definitions, with warnings and errors as separate lists.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionCustomizationsReloadResult {
+    /// Errors emitted while loading skills (e.g. skills that failed to load entirely)
+    pub errors: Vec<String>,
+    /// Warnings emitted while loading skills (e.g. skills that loaded but had issues)
+    pub warnings: Vec<String>,
+}
+
 /// Indicates whether fleet mode was successfully activated.
 ///
 /// <div class="warning">
@@ -29120,6 +29453,69 @@ pub struct SessionMcpResourcesListTemplatesResult {
     pub resource_templates: Vec<McpResourceTemplate>,
 }
 
+/// Per-source session diagnostics configuration.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionDiagnosticsConfigureResult {
+    /// Diagnostic thresholds keyed by supported source.
+    pub sources: DiagnosticSourcesConfiguration,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionDiagnosticsReadResultEntriesItem {
+    /// Agent identifier for a subagent host. Omitted for the root agent.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_id: Option<String>,
+    /// Typed MCP diagnostic detail.
+    pub details: McpDiagnosticDetails,
+    /// Severity of this emitted diagnostic record.
+    pub level: DiagnosticSeverity,
+    /// Human-readable diagnostic summary.
+    pub message: String,
+    /// Original byte count when a known-size message or data value was truncated.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub original_bytes: Option<i64>,
+    /// Diagnostic source identifying the typed details payload.
+    pub source: SessionDiagnosticsReadResultEntriesItemSource,
+    /// UTC RFC 3339 timestamp captured at the diagnostic source.
+    pub timestamp: String,
+    /// Whether message or data was truncated to the record-size bound.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub truncated: Option<bool>,
+}
+
+/// One cursor-addressed page of retained session diagnostics.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionDiagnosticsReadResult {
+    /// Opaque cursor for the next independent read.
+    pub cursor: String,
+    /// Whether the requested cursor remained within the retained buffer window.
+    pub cursor_status: DiagnosticCursorStatus,
+    /// Number of records lost before this page when known. Omitted when a buffer generation change makes the count unknowable.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub dropped_count: Option<i64>,
+    /// Retained records beginning at the requested cursor.
+    pub entries: Vec<SessionDiagnosticsReadResultEntriesItem>,
+    /// Whether additional retained records follow this page.
+    pub has_more: bool,
+}
+
 /// Identifies the target session.
 ///
 /// <div class="warning">
@@ -31281,6 +31677,9 @@ pub struct SessionQueuePendingItemsResult {
     pub items: Vec<QueuePendingItems>,
     /// Display text for messages currently in the immediate steering queue (interjections sent during a running turn).
     pub steering_messages: Vec<String>,
+    /// ID of the running turn's user message while the model has not answered it, so `withdrawMessage` can still take it back once nothing sent after it is pending. A message leaves `items` when its turn starts, before its `user.message` is recorded; this tells that message apart from one that was removed. Absent when no turn prompt can be taken back.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub withdrawable_turn_message_id: Option<String>,
 }
 
 /// Identifies the target session.
@@ -31384,7 +31783,7 @@ pub struct SessionQueueUpdateTextResult {
     pub updated: bool,
 }
 
-/// Result of removing a queued item.
+/// Result of withdrawing a user message.
 ///
 /// <div class="warning">
 ///
@@ -31395,7 +31794,9 @@ pub struct SessionQueueUpdateTextResult {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SessionQueueWithdrawMessageResult {
-    /// True when the addressed item was removed.
+    /// True when the running turn was interrupted to withdraw the message. With removed false, the turn was interrupted but its events could not be removed, for example because the model answered first, so the message stays in the interrupted turn.
+    pub interrupted: bool,
+    /// True when the message left the queue or, for a running turn, history.
     pub removed: bool,
 }
 
@@ -32217,6 +32618,16 @@ pub type McpExecuteSamplingResult = HashMap<String, serde_json::Value>;
 /// </div>
 pub type McpPlanSecretReference = String;
 
+/// Extensible identifier of a sandbox policy feature whose availability varies between hosts. A plain string, so an older client decodes a name added by a newer runtime; ignore names you do not recognize. Known values: `network` — sandboxed commands can reach the network (`network.allowOutbound`, on by default); on Linux this needs the tooling for Bubblewrap's private network namespace, such as slirp4netns. `network_filtering` — host rules and the sandbox proxy (`network.allowedHosts`, `network.blockedHosts`, `network.proxy`); on Linux this needs the same tooling as `network`; on Windows it needs a version with Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set `network.allowLocalNetwork`, because Windows reaches the local proxy only together with private-network access. `denied_paths` — native enforcement of `filesystem.deniedPaths`; on Windows this needs a version whose sandbox contract reports denied-path support. `shell` — shell commands inside the sandbox: bash on macOS and Linux, PowerShell on Windows; on Windows this needs a version with Process Security Environment 1.1 filesystem enumeration support.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+pub type SandboxHostCapabilityName = String;
+
 /// Ordered client metadata outcomes for the requested local sessions.
 ///
 /// <div class="warning">
@@ -34741,6 +35152,177 @@ pub enum DebugCollectLogsResultKind {
     Unknown,
 }
 
+/// Whether the supplied diagnostic cursor remained within the retained buffer window.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum DiagnosticCursorStatus {
+    /// The cursor is valid for the current retained window.
+    #[serde(rename = "ok")]
+    Ok,
+    /// The cursor no longer addresses retained records; reading resumes at the oldest retained record.
+    #[serde(rename = "expired")]
+    Expired,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Direction of an observed MCP protocol frame.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpDiagnosticDirection {
+    /// Frame emitted by the Copilot MCP client.
+    #[serde(rename = "client-to-server")]
+    ClientToServer,
+    /// Frame received from the MCP server.
+    #[serde(rename = "server-to-client")]
+    ServerToClient,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Category for an MCP diagnostic record.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum McpDiagnosticKind {
+    /// Connection lifecycle transition or failure.
+    #[serde(rename = "lifecycle")]
+    Lifecycle,
+    /// JSON-RPC protocol frame.
+    #[serde(rename = "protocol")]
+    Protocol,
+    /// HTTP request or response metadata.
+    #[serde(rename = "http")]
+    Http,
+    /// Local MCP server standard-error output.
+    #[serde(rename = "stderr")]
+    Stderr,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Severity of an emitted diagnostic record.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum DiagnosticSeverity {
+    /// Failure that prevented or interrupted communication.
+    #[serde(rename = "error")]
+    Error,
+    /// A recoverable warning or server standard-error output.
+    #[serde(rename = "warning")]
+    Warning,
+    /// Lifecycle transition.
+    #[serde(rename = "info")]
+    Info,
+    /// Protocol-frame or launch diagnostic.
+    #[serde(rename = "debug")]
+    Debug,
+    /// HTTP metadata diagnostic.
+    #[serde(rename = "trace")]
+    Trace,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Diagnostic source identifying the typed details payload.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum DiagnosticEntrySource {
+    #[serde(rename = "mcp")]
+    #[default]
+    Mcp,
+}
+
+/// Session-scoped diagnostic threshold. Capture is disabled by default and is never persisted with the session.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum DiagnosticLogLevel {
+    /// Disable capture and clear retained diagnostics.
+    #[serde(rename = "off")]
+    Off,
+    /// Capture failures only.
+    #[serde(rename = "error")]
+    Error,
+    /// Capture failures, warnings, and stderr.
+    #[serde(rename = "warning")]
+    Warning,
+    /// Capture lifecycle diagnostics.
+    #[serde(rename = "info")]
+    Info,
+    /// Capture protocol frames and launch diagnostics.
+    #[serde(rename = "debug")]
+    Debug,
+    /// Capture HTTP metadata in addition to debug diagnostics.
+    #[serde(rename = "trace")]
+    Trace,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// A supported diagnostic source.
+///
+/// <div class="warning">
+///
+/// **Experimental.** This type is part of an experimental wire-protocol surface
+/// and may change or be removed in future SDK or CLI releases.
+///
+/// </div>
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum DiagnosticSource {
+    #[serde(rename = "mcp")]
+    Mcp,
+    /// Unknown variant for forward compatibility.
+    #[default]
+    #[serde(other)]
+    Unknown,
+}
+
+/// Diagnostic source identifying the typed details payload.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum DiagnosticsReadResultEntriesItemSource {
+    #[serde(rename = "mcp")]
+    #[default]
+    Mcp,
+}
+
 /// Persisted extension discovery source
 ///
 /// <div class="warning">
@@ -40095,3 +40677,11 @@ pub enum WorkspacesWorkspaceDetailsHostType {
     #[serde(other)]
     Unknown,
 }
+
+/// Diagnostic source identifying the typed details payload.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum SessionDiagnosticsReadResultEntriesItemSource {
+    #[serde(rename = "mcp")]
+    #[default]
+    Mcp,
+}
diff --git a/rust/src/generated/rpc.rs b/rust/src/generated/rpc.rs
index 71ac6fbd6b..5f9e03c499 100644
--- a/rust/src/generated/rpc.rs
+++ b/rust/src/generated/rpc.rs
@@ -120,6 +120,13 @@ impl<'a> ClientRpc<'a> {
         }
     }
 
+    /// `sandbox.*` sub-namespace.
+    pub fn sandbox(&self) -> ClientRpcSandbox<'a> {
+        ClientRpcSandbox {
+            client: self.client,
+        }
+    }
+
     /// `secrets.*` sub-namespace.
     pub fn secrets(&self) -> ClientRpcSecrets<'a> {
         ClientRpcSecrets {
@@ -1729,6 +1736,38 @@ impl<'a> ClientRpcRuntime<'a> {
     }
 }
 
+/// `sandbox.*` RPCs.
+#[derive(Clone, Copy)]
+pub struct ClientRpcSandbox<'a> {
+    pub(crate) client: &'a Client,
+}
+
+impl<'a> ClientRpcSandbox<'a> {
+    /// Reports whether the host running this runtime can run the command sandbox, without starting a session or spawning a sandboxed command.
+    ///
+    /// Wire method: `sandbox.getHostSupport`.
+    ///
+    /// # Returns
+    ///
+    /// Whether the host running this runtime can run the command sandbox. The runtime checks `supported` once per process. A capability answer can change while the process runs, for example after the user installs a missing package.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This API is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases. Pin both the
+    /// SDK and CLI versions if your code depends on it.
+    ///
+    /// </div>
+    pub async fn get_host_support(&self) -> Result<SandboxHostSupport, Error> {
+        let wire_params = serde_json::json!({});
+        let _value = self
+            .client
+            .call(rpc_methods::SANDBOX_GETHOSTSUPPORT, Some(wire_params))
+            .await?;
+        Ok(serde_json::from_value(_value)?)
+    }
+}
+
 /// `secrets.*` RPCs.
 #[derive(Clone, Copy)]
 pub struct ClientRpcSecrets<'a> {
@@ -3170,6 +3209,13 @@ impl<'a> SessionRpc<'a> {
         }
     }
 
+    /// `session.customizations.*` sub-namespace.
+    pub fn customizations(&self) -> SessionRpcCustomizations<'a> {
+        SessionRpcCustomizations {
+            session: self.session,
+        }
+    }
+
     /// `session.debug.*` sub-namespace.
     pub fn debug(&self) -> SessionRpcDebug<'a> {
         SessionRpcDebug {
@@ -3177,6 +3223,13 @@ impl<'a> SessionRpc<'a> {
         }
     }
 
+    /// `session.diagnostics.*` sub-namespace.
+    pub fn diagnostics(&self) -> SessionRpcDiagnostics<'a> {
+        SessionRpcDiagnostics {
+            session: self.session,
+        }
+    }
+
     /// `session.eventLog.*` sub-namespace.
     pub fn event_log(&self) -> SessionRpcEventLog<'a> {
         SessionRpcEventLog {
@@ -4905,6 +4958,42 @@ impl<'a> SessionRpcContentExclusion<'a> {
     }
 }
 
+/// `session.customizations.*` RPCs.
+#[derive(Clone, Copy)]
+pub struct SessionRpcCustomizations<'a> {
+    pub(crate) session: &'a Session,
+}
+
+impl<'a> SessionRpcCustomizations<'a> {
+    /// Reloads all repository and user customizations for the active session: instructions, plugins and their MCP servers and hooks, custom agents, extensions, and skills. Returns diagnostics from the final skill reload.
+    ///
+    /// Wire method: `session.customizations.reload`.
+    ///
+    /// # Returns
+    ///
+    /// Diagnostics from reloading skill definitions, with warnings and errors as separate lists.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This API is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases. Pin both the
+    /// SDK and CLI versions if your code depends on it.
+    ///
+    /// </div>
+    pub async fn reload(&self) -> Result<SkillsLoadDiagnostics, Error> {
+        let wire_params = serde_json::json!({ "sessionId": self.session.id() });
+        let _value = self
+            .session
+            .client()
+            .call(
+                rpc_methods::SESSION_CUSTOMIZATIONS_RELOAD,
+                Some(wire_params),
+            )
+            .await?;
+        Ok(serde_json::from_value(_value)?)
+    }
+}
+
 /// `session.debug.*` RPCs.
 #[derive(Clone, Copy)]
 pub struct SessionRpcDebug<'a> {
@@ -4946,6 +5035,83 @@ impl<'a> SessionRpcDebug<'a> {
     }
 }
 
+/// `session.diagnostics.*` RPCs.
+#[derive(Clone, Copy)]
+pub struct SessionRpcDiagnostics<'a> {
+    pub(crate) session: &'a Session,
+}
+
+impl<'a> SessionRpcDiagnostics<'a> {
+    /// Patches configured session diagnostic sources without restarting their producers. Setting a source level to off clears its retained diagnostics and invalidates cursors selecting that source.
+    ///
+    /// Wire method: `session.diagnostics.configure`.
+    ///
+    /// # Parameters
+    ///
+    /// * `params` - Patch session diagnostic thresholds for explicitly supplied sources.
+    ///
+    /// # Returns
+    ///
+    /// Per-source session diagnostics configuration.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This API is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases. Pin both the
+    /// SDK and CLI versions if your code depends on it.
+    ///
+    /// </div>
+    pub async fn configure(
+        &self,
+        params: DiagnosticsConfigureRequest,
+    ) -> Result<DiagnosticsConfiguration, Error> {
+        let mut wire_params = serde_json::to_value(params)?;
+        wire_params["sessionId"] = serde_json::Value::String(self.session.id().to_string());
+        let _value = self
+            .session
+            .client()
+            .call(
+                rpc_methods::SESSION_DIAGNOSTICS_CONFIGURE,
+                Some(wire_params),
+            )
+            .await?;
+        Ok(serde_json::from_value(_value)?)
+    }
+
+    /// Reads a bounded batch of retained session diagnostics for the selected sources. Records are never consumed and each reader advances independently through its opaque cursor.
+    ///
+    /// Wire method: `session.diagnostics.read`.
+    ///
+    /// # Parameters
+    ///
+    /// * `params` - Cursor-based request for session diagnostics. The default limit is 100 (maximum 500); the default waitMs is zero (maximum 30000).
+    ///
+    /// # Returns
+    ///
+    /// One cursor-addressed page of retained session diagnostics.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This API is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases. Pin both the
+    /// SDK and CLI versions if your code depends on it.
+    ///
+    /// </div>
+    pub async fn read(
+        &self,
+        params: DiagnosticsReadRequest,
+    ) -> Result<DiagnosticsReadResult, Error> {
+        let mut wire_params = serde_json::to_value(params)?;
+        wire_params["sessionId"] = serde_json::Value::String(self.session.id().to_string());
+        let _value = self
+            .session
+            .client()
+            .call(rpc_methods::SESSION_DIAGNOSTICS_READ, Some(wire_params))
+            .await?;
+        Ok(serde_json::from_value(_value)?)
+    }
+}
+
 /// `session.eventLog.*` RPCs.
 #[derive(Clone, Copy)]
 pub struct SessionRpcEventLog<'a> {
@@ -6410,6 +6576,27 @@ impl<'a> SessionRpcInstructions<'a> {
             .await?;
         Ok(serde_json::from_value(_value)?)
     }
+
+    /// Invalidates cached custom-instruction discovery so subsequent turns and source reads observe instruction files currently on disk.
+    ///
+    /// Wire method: `session.instructions.reload`.
+    ///
+    /// <div class="warning">
+    ///
+    /// **Experimental.** This API is part of an experimental wire-protocol surface
+    /// and may change or be removed in future SDK or CLI releases. Pin both the
+    /// SDK and CLI versions if your code depends on it.
+    ///
+    /// </div>
+    pub async fn reload(&self) -> Result<(), Error> {
+        let wire_params = serde_json::json!({ "sessionId": self.session.id() });
+        let _value = self
+            .session
+            .client()
+            .call(rpc_methods::SESSION_INSTRUCTIONS_RELOAD, Some(wire_params))
+            .await?;
+        Ok(())
+    }
 }
 
 /// `session.limitPrediction.*` RPCs.
@@ -10135,17 +10322,17 @@ impl<'a> SessionRpcQueue<'a> {
         Ok(serde_json::from_value(_value)?)
     }
 
-    /// Atomically withdraws an unchanged, unconsumed user message from the local queued or steering lane. A client retaining the original draft may restore it only when removed is true. Does not interrupt the running turn.
+    /// Atomically withdraws an unchanged user message of a local session: from the queued or steering lane while unconsumed, or from the running turn it started while the model has not answered it and nothing the user sent after it is pending. Withdrawing from the running turn interrupts that turn and removes its events from history. A client retaining the original draft may restore it only when removed is true.
     ///
     /// Wire method: `session.queue.withdrawMessage`.
     ///
     /// # Parameters
     ///
-    /// * `params` - Conditional withdrawal of a single user message, before the runtime claims it for delivery.
+    /// * `params` - Conditional withdrawal of a single user message, from its queue or from the running turn it started.
     ///
     /// # Returns
     ///
-    /// Result of removing a queued item.
+    /// Result of withdrawing a user message.
     ///
     /// <div class="warning">
     ///
@@ -10157,7 +10344,7 @@ impl<'a> SessionRpcQueue<'a> {
     pub async fn withdraw_message(
         &self,
         params: QueueWithdrawMessageRequest,
-    ) -> Result<QueueRemoveAtResult, Error> {
+    ) -> Result<QueueWithdrawMessageResult, Error> {
         let mut wire_params = serde_json::to_value(params)?;
         wire_params["sessionId"] = serde_json::Value::String(self.session.id().to_string());
         let _value = self
diff --git a/rust/src/generated/session_events.rs b/rust/src/generated/session_events.rs
index f186055484..6cc0534f8b 100644
--- a/rust/src/generated/session_events.rs
+++ b/rust/src/generated/session_events.rs
@@ -1738,9 +1738,12 @@ pub struct SessionTruncationData {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SessionSnapshotRewindData {
+    /// The removed events, starting with `upToEventId`. Later events not listed were kept, such as a background agent's events that interleaved with a withdrawn turn
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub event_ids: Option<Vec<String>>,
     /// Number of events that were removed by the rewind
     pub events_removed: i64,
-    /// Event ID that was rewound to; this event and all after it were removed
+    /// First removed event. Without `eventIds`, it and every event after it were removed
     pub up_to_event_id: String,
 }
 
@@ -2102,7 +2105,7 @@ pub struct CompactionCompleteCompactionTokensUsed {
     pub output_tokens: Option<i64>,
 }
 
-/// Original request-level and effective conversation reasoning effort for a Responses history boundary
+/// Original request-level and effective conversation reasoning effort for a provider history boundary; the historical type name is retained for compatibility
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ResponsesReasoning {
@@ -2622,7 +2625,7 @@ pub struct UserMessageData {
     /// Parent agent task ID for background telemetry correlated to this user turn
     #[serde(skip_serializing_if = "Option::is_none")]
     pub parent_agent_task_id: Option<String>,
-    /// Responses reasoning settings anchored before this model-facing message, for cache-stable history replay
+    /// Provider reasoning settings anchored before this model-facing message for cache-stable replay; the historical responsesReasoning name is retained for compatibility
     #[serde(skip_serializing_if = "Option::is_none")]
     pub responses_reasoning: Option<ResponsesReasoning>,
     /// Origin of this message, used for timeline filtering and attribution (e.g., `skill-pdf` for hidden skill injection or `agent-<agent-id>` for an inter-agent prompt)
@@ -3076,6 +3079,9 @@ pub struct FusionAttribution {
     pub conversation_scope: Option<String>,
     /// Stable identifier for the HydraFusion turn that produced the event.
     pub fusion_id: String,
+    /// Whether this model request consumed a user steering message rather than only internal Fusion work.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub has_user_steering: Option<bool>,
     /// HydraFusion orchestration pattern selected for the turn.
     pub pattern: String,
     /// Identifier of the concrete phase that produced the event.
@@ -5188,7 +5194,7 @@ pub struct SystemNotificationData {
     pub content: String,
     /// Structured metadata identifying what triggered this notification
     pub kind: serde_json::Value,
-    /// Responses reasoning settings anchored before this model-facing message, for cache-stable history replay
+    /// Provider reasoning settings anchored before this model-facing message for cache-stable replay; the historical responsesReasoning name is retained for compatibility
     #[serde(skip_serializing_if = "Option::is_none")]
     pub responses_reasoning: Option<ResponsesReasoning>,
 }
@@ -6851,6 +6857,9 @@ pub struct McpOauthRequiredStaticClientConfig {
     /// Whether this is a public OAuth client
     #[serde(skip_serializing_if = "Option::is_none")]
     pub public_client: Option<bool>,
+    /// Configured OAuth scope string used when the server challenge omits scope or provides an empty scope
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub scope: Option<String>,
 }
 
 /// OAuth WWW-Authenticate parameters parsed from an MCP auth challenge
diff --git a/rust/src/lib.rs b/rust/src/lib.rs
index 21add4b7cf..d4c3510839 100644
--- a/rust/src/lib.rs
+++ b/rust/src/lib.rs
@@ -1073,7 +1073,7 @@ fn validate_session_fs_config(cfg: &SessionFsConfig) -> Result<()> {
 /// this is opaque random data, not an identifier).
 fn generate_connection_token() -> String {
     let mut bytes = [0u8; 16];
-    getrandom::getrandom(&mut bytes)
+    getrandom::fill(&mut bytes)
         .expect("OS CSPRNG (getrandom) is unavailable; cannot generate connection token");
     let mut hex = String::with_capacity(32);
     for byte in bytes {
diff --git a/rust/src/session.rs b/rust/src/session.rs
index 4c39a084a2..97eb111156 100644
--- a/rust/src/session.rs
+++ b/rust/src/session.rs
@@ -161,6 +161,10 @@ fn is_structured_output_event(event: &SessionEvent) -> bool {
     )
 }
 
+fn is_root_agent_event(event: &SessionEvent) -> bool {
+    event.agent_id.as_deref().is_none_or(str::is_empty)
+}
+
 struct StructuredOutputState {
     message_id: String,
     started: bool,
@@ -169,7 +173,7 @@ struct StructuredOutputState {
 
 impl StructuredOutputState {
     fn observe(&mut self, event: SessionEvent) -> Result<Option<SessionEvent>, Error> {
-        if event.agent_id.as_deref().is_some_and(|id| !id.is_empty()) {
+        if !is_root_agent_event(&event) {
             return Ok(None);
         }
         match event.parsed_type() {
@@ -359,6 +363,130 @@ impl Drop for PendingSessionRegistration {
     }
 }
 
+type EventLoopSpawner = Box<
+    dyn FnOnce(
+            SessionId,
+            crate::router::SessionChannels,
+            Option<Arc<StartupTasks>>,
+        ) -> JoinHandle<()>
+        + Send,
+>;
+
+struct StartupTasks {
+    state: ParkingLotMutex<StartupTaskState>,
+}
+
+enum StartupTaskState {
+    Pending {
+        tasks: Vec<JoinHandle<()>>,
+        nested: Vec<tokio::task::AbortHandle>,
+    },
+    Disarmed,
+    Aborted,
+}
+
+impl Default for StartupTasks {
+    fn default() -> Self {
+        Self {
+            state: ParkingLotMutex::new(StartupTaskState::Pending {
+                tasks: Vec::new(),
+                nested: Vec::new(),
+            }),
+        }
+    }
+}
+
+impl StartupTasks {
+    fn track(&self, task: JoinHandle<()>) {
+        match &mut *self.state.lock() {
+            StartupTaskState::Pending { tasks, .. } => tasks.push(task),
+            StartupTaskState::Disarmed => {}
+            StartupTaskState::Aborted => task.abort(),
+        }
+    }
+
+    fn track_nested<T>(&self, task: &JoinHandle<T>) {
+        match &mut *self.state.lock() {
+            StartupTaskState::Pending { nested, .. } => nested.push(task.abort_handle()),
+            StartupTaskState::Disarmed => {}
+            StartupTaskState::Aborted => task.abort(),
+        }
+    }
+
+    fn abort(&self) {
+        if let StartupTaskState::Pending { tasks, nested } =
+            std::mem::replace(&mut *self.state.lock(), StartupTaskState::Aborted)
+        {
+            for handle in nested {
+                handle.abort();
+            }
+            for handle in tasks {
+                handle.abort();
+            }
+        }
+    }
+
+    fn disarm(&self) {
+        *self.state.lock() = StartupTaskState::Disarmed;
+    }
+}
+
+fn spawn_startup_tracked(
+    future: impl std::future::Future<Output = ()> + Send + 'static,
+    startup_tasks: Option<&Arc<StartupTasks>>,
+) {
+    let task = tokio::spawn(future);
+    if let Some(startup_tasks) = startup_tasks {
+        startup_tasks.track(task);
+    }
+}
+
+struct RunningCreateLoop {
+    event_loop: Option<JoinHandle<()>>,
+    startup_tasks: Arc<StartupTasks>,
+}
+
+impl RunningCreateLoop {
+    fn into_handle(mut self) -> JoinHandle<()> {
+        self.event_loop
+            .take()
+            .expect("running create loop has a handle")
+    }
+}
+
+impl Drop for RunningCreateLoop {
+    fn drop(&mut self) {
+        if let Some(event_loop) = self.event_loop.take() {
+            self.startup_tasks.abort();
+            event_loop.abort();
+        }
+    }
+}
+
+/// A create loop starts before the RPC when the client knows the session ID.
+/// Server-assigned IDs require waiting for the response to register the loop.
+enum CreateEventLoop {
+    Running {
+        running: RunningCreateLoop,
+        token: crate::router::RegistrationToken,
+    },
+    Deferred(EventLoopSpawner),
+}
+
+impl CreateEventLoop {
+    async fn cleanup(self, pending_registration: PendingSessionRegistration) {
+        match self {
+            Self::Running { running, .. } => {
+                pending_registration.shutdown.cancel();
+                // User handlers may not terminate; abort them without waiting on their futures.
+                running.startup_tasks.abort();
+                pending_registration.cleanup(running.into_handle()).await;
+            }
+            Self::Deferred(_) => drop(pending_registration),
+        }
+    }
+}
+
 /// A session on a GitHub Copilot CLI server.
 ///
 /// Created via [`Client::create_session`] or [`Client::resume_session`].
@@ -412,6 +540,9 @@ pub struct Session {
     open_canvases: Arc<parking_lot::RwLock<Vec<OpenCanvasInstance>>>,
     /// Broadcast channel for runtime event subscribers — see [`Session::subscribe`].
     event_tx: tokio::sync::broadcast::Sender<SessionEvent>,
+    /// Resume-only queue retained until the first post-resume subscriber
+    /// catches up and switches to bounded live delivery.
+    resume_bootstrap: Option<Arc<crate::subscription::ResumeBootstrap>>,
     github_token_registration:
         ParkingLotMutex<Option<crate::github_token::GitHubTokenRegistration>>,
     /// Identity of this session's router registration.
@@ -503,8 +634,24 @@ impl Session {
     /// loop or any combinator from `tokio_stream::StreamExt` /
     /// `futures::StreamExt`.
     ///
-    /// Each subscriber maintains its own queue. If a consumer cannot keep
-    /// up, the oldest events are dropped and `recv` returns
+    /// If resume started with no active [`PreparedSession`] subscriber, the
+    /// first subscription receives all retained routed startup events, durable
+    /// and ephemeral, in order before live delivery. Ownership is assigned
+    /// synchronously by the first `subscribe()` call, not by the first poll.
+    /// Later subscribers receive newly dispatched live events immediately,
+    /// even while the first subscriber is catching up.
+    ///
+    /// Bootstrap retention is unbounded until its owner catches up. Callers
+    /// that never subscribe or cannot catch up can retain arbitrarily many
+    /// events, so subscribe and drain promptly. Dropping the owner discards
+    /// its unread backlog; stopping the event loop releases an unclaimed
+    /// backlog. A claimed backlog can still be drained after shutdown.
+    /// This guarantee covers events routed to this session, not events lost
+    /// to overflow in the bounded client-global notification router.
+    ///
+    /// After the atomic bootstrap handoff, each subscriber maintains its own
+    /// finite queue. If a consumer cannot keep up, the oldest live events are
+    /// dropped and `recv` returns
     /// [`RecvErrorKind::Lagged`](crate::subscription::RecvErrorKind::Lagged)
     /// reporting the count of skipped events. Slow consumers do not block
     /// the session's event loop.
@@ -522,7 +669,10 @@ impl Session {
     /// # }
     /// ```
     pub fn subscribe(&self) -> crate::subscription::EventSubscription {
-        crate::subscription::EventSubscription::new(self.event_tx.subscribe())
+        match &self.resume_bootstrap {
+            Some(bootstrap) => bootstrap.subscribe(&self.event_tx),
+            None => crate::subscription::EventSubscription::new(self.event_tx.subscribe()),
+        }
     }
 
     /// The underlying Client (for advanced use cases).
@@ -666,6 +816,12 @@ impl Session {
     /// returning the last `assistant.message` event captured during streaming.
     /// Times out after `MessageOptions::wait_timeout` (default 60 seconds).
     ///
+    /// Child events with a non-empty `agentId` are still delivered to
+    /// [`subscribe`](Self::subscribe) but cannot supply the reply or complete
+    /// the wait. Root-agent events have no `agentId` (or an empty one).
+    /// The terminal event is queued to existing subscriptions before this wait
+    /// completes; subscribers need not have consumed it yet.
+    ///
     /// Only one unformatted `send_and_wait` may be active per session. Calling
     /// [`send`](Self::send) during that wait also returns an error. Schema-bearing
     /// waits instead correlate by originating message ID and support concurrency.
@@ -774,7 +930,8 @@ impl Session {
 
     async fn send_and_wait_structured(&self, opts: MessageOptions) -> Result<SessionEvent, Error> {
         let duration = opts.wait_timeout.unwrap_or(Duration::from_secs(60));
-        let mut events = self.subscribe();
+        // Internal request observers must not claim the caller's resume backlog.
+        let mut events = crate::subscription::EventSubscription::new(self.event_tx.subscribe());
         let wait = async {
             let mut admission = Box::pin(self.send(opts));
             let mut pending = Vec::new();
@@ -1326,11 +1483,16 @@ impl Client {
     ///
     /// # Event delivery
     ///
-    /// Equivalent to `prepare_resume_session(config)?.start().await`, and
-    /// carries the same startup-event caveat documented on
-    /// [`create_session`](Self::create_session). Use
-    /// [`prepare_resume_session`](Self::prepare_resume_session) when
-    /// startup events matter.
+    /// Equivalent to `prepare_resume_session(config)?.start().await`. With no
+    /// active prepared subscriber at startup, routed events are retained in an
+    /// ordered, unbounded bootstrap queue. The first [`Session::subscribe`]
+    /// call claims that complete prefix and switches atomically to bounded
+    /// live delivery once caught up. Later subscriptions are live-only.
+    /// See [`Session::subscribe`] for ownership, cleanup, and router limits.
+    ///
+    /// Use [`prepare_resume_session`](Self::prepare_resume_session) when the
+    /// consumer must be installed before protocol activity begins or when
+    /// multiple startup observers are required.
     pub async fn resume_session(&self, config: ResumeSessionConfig) -> Result<Session, Error> {
         self.prepare_resume_session(config)?.start().await
     }
@@ -1342,13 +1504,10 @@ impl Client {
         shutdown: CancellationToken,
     ) -> Result<Session, Error> {
         let total_start = Instant::now();
-        // For cloud sessions, let the CLI/server assign the session id and
-        // register the session lazily once the response arrives. For non-cloud
-        // sessions we generate the id client-side (when the caller didn't
-        // supply one) so the session can be registered BEFORE the RPC — the
-        // CLI may issue session-scoped requests (e.g. sessionFs.writeFile for
-        // workspace metadata) during session.create processing, before it has
-        // sent the response.
+        // Non-cloud IDs are generated locally when omitted by the caller.
+        // Start the loop before the RPC: session.create may issue
+        // sessionFs.writeFile for workspace metadata before its response.
+        // Cloud sessions without a caller-supplied ID must wait for the reply.
         let caller_session_id = config.session_id.clone();
         let use_server_generated_id = config.cloud.is_some() && caller_session_id.is_none();
         let local_session_id: Option<SessionId> = if use_server_generated_id {
@@ -1483,96 +1642,149 @@ impl Client {
         let open_canvases = Arc::new(parking_lot::RwLock::new(Vec::new()));
         let external_tools_shutdown = self.inner.rpc.connection_closed_token();
 
-        // For cloud sessions (use_server_generated_id), defer session
-        // registration to the inline callback so the read task registers
-        // the session synchronously the instant the response arrives.
-        // For non-cloud sessions, register up-front so the CLI can issue
-        // session-scoped requests during session.create processing.
-        let inline_stash: Arc<
-            ParkingLotMutex<Option<(SessionId, crate::router::SessionRegistration)>>,
-        > = Arc::new(ParkingLotMutex::new(None));
-
-        let inline_callback: Option<crate::jsonrpc::InlineResponseCallback> = if let Some(ref sid) =
-            local_session_id
-        {
-            let channels = self.register_session(sid);
-            *inline_stash.lock() = Some((sid.clone(), channels));
-            None
-        } else {
+        let spawn_loop: EventLoopSpawner = {
             let client = self.clone();
-            let stash = inline_stash.clone();
-            let expected = caller_session_id.clone();
-            Some(Box::new(move |response| {
-                let result = response.result.as_ref().ok_or_else(|| {
-                    Error::with_message(ErrorKind::Json, "session.create response had no result")
-                })?;
-                let parsed: CreateSessionResult =
-                    serde_json::from_value(result.clone()).map_err(Error::from)?;
-                if let Some(requested) = expected.as_ref()
-                    && parsed.session_id != *requested
-                {
-                    return Err(ErrorKind::Session(SessionErrorKind::SessionIdMismatch {
-                        requested: requested.clone(),
-                        returned: parsed.session_id,
-                    })
-                    .into());
-                }
-                // Register and stash under a single stash-lock hold. The
-                // cancellation guard identifies the session to unregister by
-                // peeking this stash, so registering outside the lock would
-                // leave a window where a concurrent guard drop (caller
-                // cancellation) sees `None` and leaks the registration.
-                // `register_session` takes the router lock, never the stash
-                // lock, so there is no lock-order inversion here.
-                let mut stashed = stash.lock();
-                let registration = client.register_session(&parsed.session_id);
-                *stashed = Some((parsed.session_id, registration));
-                Ok(())
-            }))
+            let idle_waiter = idle_waiter.clone();
+            let capabilities = capabilities.clone();
+            let open_canvases = open_canvases.clone();
+            let event_tx = event_tx.clone();
+            let shutdown = shutdown.clone();
+            let external_tools_shutdown = external_tools_shutdown.clone();
+            Box::new(
+                move |session_id: SessionId,
+                      channels: crate::router::SessionChannels,
+                      startup_tasks: Option<Arc<StartupTasks>>| {
+                    spawn_event_loop(
+                        session_id,
+                        client,
+                        handlers,
+                        hooks,
+                        transforms,
+                        command_handlers,
+                        canvas_handler,
+                        session_fs_provider,
+                        bearer_token_providers,
+                        channels,
+                        idle_waiter,
+                        capabilities,
+                        open_canvases,
+                        event_tx,
+                        None,
+                        shutdown,
+                        external_tools_shutdown,
+                        startup_tasks,
+                    )
+                },
+            )
         };
 
-        // Armed for the whole startup sequence: any early return, and any
-        // drop of this future (caller cancellation), cancels the session
-        // token and unregisters whatever was registered on the router. For
-        // the cloud path the ID is only known once the inline callback has
-        // run, so the guard reads the stash at cleanup time.
-        let mut pending_registration = match local_session_id {
-            Some(ref sid) => {
-                let token = inline_stash
-                    .lock()
-                    .as_ref()
-                    .expect("session registration must exist")
-                    .1
-                    .token;
-                PendingSessionRegistration::new(
+        // The guard owns the registration through every error and caller
+        // cancellation path, including the deferred cloud callback.
+        let (inline_callback, mut pending_registration, event_loop, inline_stash) =
+            if let Some(ref sid) = local_session_id {
+                let registration = self.register_session(sid);
+                let token = registration.token;
+                let startup_tasks = Arc::new(StartupTasks::default());
+                let event_loop = spawn_loop(
+                    sid.clone(),
+                    registration.channels,
+                    Some(startup_tasks.clone()),
+                );
+                let guard = PendingSessionRegistration::new(
                     self.clone(),
                     sid.clone(),
                     token,
                     shutdown.clone(),
                     external_tools_shutdown.clone(),
+                );
+                (
+                    None,
+                    guard,
+                    CreateEventLoop::Running {
+                        running: RunningCreateLoop {
+                            event_loop: Some(event_loop),
+                            startup_tasks,
+                        },
+                        token,
+                    },
+                    None,
                 )
-            }
-            None => PendingSessionRegistration::deferred(
-                self.clone(),
-                inline_stash.clone(),
-                shutdown.clone(),
-                external_tools_shutdown.clone(),
-            ),
-        };
+            } else {
+                let inline_stash = Arc::new(ParkingLotMutex::new(None));
+                let client = self.clone();
+                let stash = inline_stash.clone();
+                let expected = caller_session_id.clone();
+                let callback: crate::jsonrpc::InlineResponseCallback = Box::new(move |response| {
+                    let result = response.result.as_ref().ok_or_else(|| {
+                        Error::with_message(
+                            ErrorKind::Json,
+                            "session.create response had no result",
+                        )
+                    })?;
+                    let parsed: CreateSessionResult =
+                        serde_json::from_value(result.clone()).map_err(Error::from)?;
+                    if let Some(requested) = expected.as_ref()
+                        && parsed.session_id != *requested
+                    {
+                        return Err(ErrorKind::Session(SessionErrorKind::SessionIdMismatch {
+                            requested: requested.clone(),
+                            returned: parsed.session_id,
+                        })
+                        .into());
+                    }
+                    // Register and stash under a single stash-lock hold. The
+                    // cancellation guard identifies the session to unregister by
+                    // peeking this stash, so registering outside the lock would
+                    // leave a window where a concurrent guard drop (caller
+                    // cancellation) sees `None` and leaks the registration.
+                    // `register_session` takes the router lock, never the stash
+                    // lock, so there is no lock-order inversion here.
+                    let mut stashed = stash.lock();
+                    let registration = client.register_session(&parsed.session_id);
+                    *stashed = Some((parsed.session_id, registration));
+                    Ok(())
+                });
+                let guard = PendingSessionRegistration::deferred(
+                    self.clone(),
+                    inline_stash.clone(),
+                    shutdown.clone(),
+                    external_tools_shutdown.clone(),
+                );
+                (
+                    Some(callback),
+                    guard,
+                    CreateEventLoop::Deferred(spawn_loop),
+                    Some(inline_stash),
+                )
+            };
 
         let rpc_start = Instant::now();
-        let result = self
+        let result = match self
             .call_with_inline_callback("session.create", Some(params), inline_callback)
-            .await?;
+            .await
+        {
+            Ok(result) => result,
+            Err(error) => {
+                event_loop.cleanup(pending_registration).await;
+                return Err(error);
+            }
+        };
         tracing::debug!(
             elapsed_ms = rpc_start.elapsed().as_millis(),
             "Client::create_session session creation request completed successfully"
         );
-        let create_result: CreateSessionResult = serde_json::from_value(result)?;
+        let create_result: CreateSessionResult = match serde_json::from_value(result) {
+            Ok(result) => result,
+            Err(error) => {
+                event_loop.cleanup(pending_registration).await;
+                return Err(error.into());
+            }
+        };
 
         if let Some(ref requested) = local_session_id
             && create_result.session_id != *requested
         {
+            event_loop.cleanup(pending_registration).await;
             return Err(ErrorKind::Session(SessionErrorKind::SessionIdMismatch {
                 requested: requested.clone(),
                 returned: create_result.session_id.clone(),
@@ -1580,31 +1792,26 @@ impl Client {
             .into());
         }
 
-        let (session_id, registration) = inline_stash
-            .lock()
-            .take()
-            .expect("session registration must have populated stash on success");
-        let channels = registration.channels;
-        let registration_token = registration.token;
-        pending_registration.resolve_to(session_id.clone(), registration_token);
-        let event_loop = spawn_event_loop(
-            session_id.clone(),
-            self.clone(),
-            handlers,
-            hooks,
-            transforms,
-            command_handlers,
-            canvas_handler,
-            session_fs_provider,
-            bearer_token_providers,
-            channels,
-            idle_waiter.clone(),
-            capabilities.clone(),
-            open_canvases.clone(),
-            event_tx.clone(),
-            shutdown.clone(),
-            external_tools_shutdown.clone(),
-        );
+        let (session_id, event_loop, registration_token) = match event_loop {
+            CreateEventLoop::Running { running, token } => {
+                running.startup_tasks.disarm();
+                (
+                    create_result.session_id.clone(),
+                    running.into_handle(),
+                    token,
+                )
+            }
+            CreateEventLoop::Deferred(spawn_loop) => {
+                let (session_id, registration) = inline_stash
+                    .expect("deferred create has a response stash")
+                    .lock()
+                    .take()
+                    .expect("session registration must have populated stash on success");
+                pending_registration.resolve_to(session_id.clone(), registration.token);
+                let event_loop = spawn_loop(session_id.clone(), registration.channels, None);
+                (session_id, event_loop, registration.token)
+            }
+        };
         tracing::debug!(
             elapsed_ms = setup_start.elapsed().as_millis(),
             session_id = %session_id,
@@ -1640,6 +1847,7 @@ impl Client {
             capabilities,
             open_canvases,
             event_tx,
+            resume_bootstrap: None,
             github_token_registration: ParkingLotMutex::new(github_token_registration),
             registration_token,
         };
@@ -1798,6 +2006,9 @@ impl Client {
 
         let capabilities = Arc::new(parking_lot::RwLock::new(SessionCapabilities::default()));
         let setup_start = Instant::now();
+        // Active prepared subscribers retain their existing bounded delivery.
+        let resume_bootstrap = (event_tx.receiver_count() == 0)
+            .then(|| crate::subscription::ResumeBootstrap::new(&event_tx));
         let registration = self.register_session(&session_id);
         let registration_token = registration.token;
         let channels = registration.channels;
@@ -1819,8 +2030,10 @@ impl Client {
             capabilities.clone(),
             open_canvases.clone(),
             event_tx.clone(),
+            resume_bootstrap.clone(),
             shutdown.clone(),
             external_tools_shutdown.clone(),
+            None,
         );
         let mut registration = PendingSessionRegistration::new(
             self.clone(),
@@ -1931,6 +2144,7 @@ impl Client {
             capabilities,
             open_canvases,
             event_tx,
+            resume_bootstrap,
             github_token_registration: ParkingLotMutex::new(github_token_registration),
             registration_token,
         };
@@ -1989,8 +2203,8 @@ impl Client {
 ///
 /// # Buffering
 ///
-/// The broadcast buffer is finite —
-/// [`DEFAULT_EVENT_BUFFER_CAPACITY`] unless
+/// Subscriptions taken directly from this prepared handle use the finite
+/// broadcast buffer — [`DEFAULT_EVENT_BUFFER_CAPACITY`] unless
 /// [`SessionConfig::event_buffer_capacity`] /
 /// [`ResumeSessionConfig::event_buffer_capacity`] overrides it. Subscribers
 /// that fall behind observe
@@ -1999,6 +2213,10 @@ impl Client {
 /// startup burst must either configure a capacity that covers it or drain
 /// the subscription concurrently with [`start`](Self::start).
 ///
+/// If a resume starts with no active prepared subscription, the eventual
+/// [`Session`] instead retains routed startup events in the unbounded,
+/// one-shot bootstrap queue documented on [`Session::subscribe`].
+///
 /// # Server-assigned session IDs
 ///
 /// For cloud sessions without a caller-supplied session ID, the CLI assigns
@@ -2060,9 +2278,9 @@ impl PreparedSession {
     /// Create or resume the session on the CLI.
     ///
     /// This is where all protocol activity happens: config validation,
-    /// router registration, the `session.create` / `session.resume` RPC,
-    /// and the event loop spawn. Nothing observable occurs until this
-    /// future is first polled.
+    /// router registration, the event loop spawn (before the RPC when the ID
+    /// is known), and the `session.create` / `session.resume` RPC.
+    /// Nothing observable occurs until this future is first polled.
     ///
     /// # Errors
     ///
@@ -2227,8 +2445,10 @@ fn spawn_event_loop(
     capabilities: Arc<parking_lot::RwLock<SessionCapabilities>>,
     open_canvases: Arc<parking_lot::RwLock<Vec<OpenCanvasInstance>>>,
     event_tx: tokio::sync::broadcast::Sender<SessionEvent>,
+    resume_bootstrap: Option<Arc<crate::subscription::ResumeBootstrap>>,
     shutdown: CancellationToken,
     external_tools_shutdown: CancellationToken,
+    startup_tasks: Option<Arc<StartupTasks>>,
 ) -> JoinHandle<()> {
     let crate::router::SessionChannels {
         mut notifications,
@@ -2236,10 +2456,16 @@ fn spawn_event_loop(
     } = channels;
     let pending_external_tools: PendingExternalTools =
         Arc::new(ParkingLotMutex::new(HashMap::new()));
+    // Capture cleanup before spawning so even cancellation before the first
+    // task poll releases an unclaimed backlog.
+    let bootstrap_cleanup = resume_bootstrap
+        .as_ref()
+        .map(|bootstrap| bootstrap.cleanup_guard());
 
     let span = tracing::error_span!("session_event_loop", session_id = %session_id);
     tokio::spawn(
         async move {
+            let _bootstrap_cleanup = bootstrap_cleanup;
             loop {
                 // `mpsc::UnboundedReceiver::recv` and
                 // `CancellationToken::cancelled` are both cancel-safe per
@@ -2268,7 +2494,7 @@ fn spawn_event_loop(
                     _ = shutdown.cancelled() => break,
                     Some(notification) = notifications.recv() => {
                         handle_notification(
-                            &session_id, &client, &handlers, &command_handlers, notification, &idle_waiter, &capabilities, &open_canvases, &event_tx, &shutdown, &external_tools_shutdown, &pending_external_tools,
+                            &session_id, &client, &handlers, &command_handlers, notification, &idle_waiter, &capabilities, &open_canvases, &event_tx, resume_bootstrap.as_ref(), &shutdown, &external_tools_shutdown, &pending_external_tools, startup_tasks.as_ref(),
                         ).await;
                     }
                     Some(request) = requests.recv() => {
@@ -2286,7 +2512,7 @@ fn spawn_event_loop(
                         let bearer_token_providers = bearer_token_providers.clone();
                         let request_id = request.id;
                         let method = request.method.clone();
-                        tokio::spawn(
+                        spawn_startup_tracked(
                             async move {
                                 let ctx = RequestDispatchContext {
                                     client: &client,
@@ -2312,6 +2538,7 @@ fn spawn_event_loop(
                                 }
                             }
                             .instrument(span),
+                            startup_tasks.as_ref(),
                         );
                     }
                     else => break,
@@ -2434,9 +2661,11 @@ async fn handle_notification(
     capabilities: &Arc<parking_lot::RwLock<SessionCapabilities>>,
     open_canvases: &Arc<parking_lot::RwLock<Vec<OpenCanvasInstance>>>,
     event_tx: &tokio::sync::broadcast::Sender<SessionEvent>,
+    resume_bootstrap: Option<&Arc<crate::subscription::ResumeBootstrap>>,
     shutdown: &CancellationToken,
     external_tools_shutdown: &CancellationToken,
     pending_external_tools: &PendingExternalTools,
+    startup_tasks: Option<&Arc<StartupTasks>>,
 ) {
     let dispatch_start = Instant::now();
     let event = &notification.event;
@@ -2451,10 +2680,13 @@ async fn handle_notification(
 
     // Signal send_and_wait if active. The lock is only contended when
     // a send_and_wait call is in flight (idle_waiter is Some).
+    let mut completion = None;
     match event_type {
         SessionEventType::AssistantMessage
         | SessionEventType::SessionIdle
-        | SessionEventType::SessionError => {
+        | SessionEventType::SessionError
+            if is_root_agent_event(event) =>
+        {
             let mut guard = idle_waiter.lock();
             if let Some(waiter) = guard.as_mut() {
                 match event_type {
@@ -2478,7 +2710,7 @@ async fn handle_notification(
                                     session_id = %session_id,
                                     "Session::send_and_wait idle received"
                                 );
-                                let _ = waiter.tx.send(Ok(waiter.last_assistant_message));
+                                completion = Some((waiter.tx, Ok(waiter.last_assistant_message)));
                             } else {
                                 let error_msg = event
                                     .typed_data::<SessionErrorData>()
@@ -2491,10 +2723,13 @@ async fn handle_notification(
                                             .map(|s| s.to_string())
                                     })
                                     .unwrap_or_else(|| "session error".to_string());
-                                let _ = waiter.tx.send(Err(Error::with_message(
-                                    ErrorKind::Session(SessionErrorKind::AgentError),
-                                    error_msg,
-                                )));
+                                completion = Some((
+                                    waiter.tx,
+                                    Err(Error::with_message(
+                                        ErrorKind::Session(SessionErrorKind::AgentError),
+                                        error_msg,
+                                    )),
+                                ));
                             }
                         }
                     }
@@ -2535,10 +2770,15 @@ async fn handle_notification(
         }
     }
 
-    // Fan out the event to runtime subscribers (`Session::subscribe`). `send`
-    // only errors when there are no receivers, which is the normal case
-    // before any consumer subscribes.
-    let _ = event_tx.send(event.clone());
+    if let Some(bootstrap) = resume_bootstrap {
+        bootstrap.publish(event_tx, event.clone());
+    } else {
+        // No receivers is normal before any consumer subscribes.
+        let _ = event_tx.send(event.clone());
+    }
+    if let Some((tx, result)) = completion {
+        let _ = tx.send(result);
+    }
 
     tracing::debug!(
         elapsed_ms = dispatch_start.elapsed().as_millis(),
@@ -2591,7 +2831,7 @@ async fn handle_notification(
                 session_id = %sid,
                 request_id = %request_id
             );
-            tokio::spawn(
+            spawn_startup_tracked(
                 async move {
                     let handler_start = Instant::now();
                     let result = permission_handler
@@ -2646,6 +2886,7 @@ async fn handle_notification(
                     }
                 }
                 .instrument(span),
+                startup_tasks,
             );
         }
         SessionEventType::ExternalToolRequested => {
@@ -2664,7 +2905,7 @@ async fn handle_notification(
                             session_id = %sid,
                             request_id = %request_id
                         );
-                        tokio::spawn(
+                        spawn_startup_tracked(
                             async move {
                                 let rpc_start = Instant::now();
                                 let _ = client
@@ -2685,6 +2926,7 @@ async fn handle_notification(
                                 );
                             }
                             .instrument(span),
+                            startup_tasks,
                         );
                         return;
                     }
@@ -2718,7 +2960,7 @@ async fn handle_notification(
                 session_id = %sid,
                 request_id = %request_id
             );
-            tokio::spawn(
+            spawn_startup_tracked(
                 async move {
                     let guard = PendingExternalToolGuard {
                         request_id: guard_request_id,
@@ -2837,6 +3079,7 @@ async fn handle_notification(
                     );
                 }
                 .instrument(span),
+                startup_tasks,
             );
         }
         SessionEventType::UserInputRequested => {
@@ -2889,7 +3132,8 @@ async fn handle_notification(
                 session_id = %sid,
                 request_id = %request_id
             );
-            tokio::spawn(
+            let nested_startup_tasks = startup_tasks.cloned();
+            spawn_startup_tracked(
                 async move {
                     let cancel = ElicitationResult {
                         action: "cancel".to_string(),
@@ -2919,6 +3163,9 @@ async fn handle_notification(
                         }
                         .instrument(span)
                     });
+                    if let Some(tasks) = nested_startup_tasks.as_ref() {
+                        tasks.track_nested(&handler_task);
+                    }
                     let result = match handler_task.await {
                         Ok(r) => r,
                         Err(_) => cancel.clone(),
@@ -2957,6 +3204,7 @@ async fn handle_notification(
                     }
                 }
                 .instrument(span),
+                startup_tasks,
             );
         }
         SessionEventType::McpOauthRequired => {
@@ -2995,7 +3243,8 @@ async fn handle_notification(
                 session_id = %sid,
                 request_id = %request_id
             );
-            tokio::spawn(
+            let nested_startup_tasks = startup_tasks.cloned();
+            spawn_startup_tracked(
                 async move {
                     let cancel = McpAuthResult::Cancelled;
                     let handler_task = tokio::spawn({
@@ -3021,6 +3270,9 @@ async fn handle_notification(
                         }
                         .instrument(span)
                     });
+                    if let Some(tasks) = nested_startup_tasks.as_ref() {
+                        tasks.track_nested(&handler_task);
+                    }
                     let result = match handler_task.await {
                         Ok(result) => result,
                         Err(_) => cancel,
@@ -3042,6 +3294,7 @@ async fn handle_notification(
                     );
                 }
                 .instrument(span),
+                startup_tasks,
             );
         }
         SessionEventType::CommandExecute => {
@@ -3057,7 +3310,7 @@ async fn handle_notification(
             let command_handlers = command_handlers.clone();
             let sid = session_id.clone();
             let span = tracing::error_span!("command_handler", session_id = %sid);
-            tokio::spawn(
+            spawn_startup_tracked(
                 async move {
                     let request_id = data.request_id;
                     let ack_error = match command_handlers.get(&data.command_name).cloned() {
@@ -3104,6 +3357,7 @@ async fn handle_notification(
                     );
                 }
                 .instrument(span),
+                startup_tasks,
             );
         }
         _ => {}
diff --git a/rust/src/subscription.rs b/rust/src/subscription.rs
index c3fc83b8b9..d4f989c107 100644
--- a/rust/src/subscription.rs
+++ b/rust/src/subscription.rs
@@ -19,18 +19,27 @@
 //! also works for callers who don't need the [`Stream`](tokio_stream::Stream)
 //! surface.
 //!
-//! # Lag policy
+//! # Resume bootstrap and lag policy
 //!
-//! Each subscriber maintains its own internal queue. If a consumer cannot
-//! keep up, the oldest events are dropped and the next call yields
+//! The first subscription on a resumed session may begin with a lossless,
+//! ordered bootstrap prefix. Once its owner catches up, delivery switches
+//! atomically to the bounded live stream. See
+//! [`Session::subscribe`](crate::session::Session::subscribe) for the
+//! unbounded retention, eager ownership, cleanup, and router limits.
+//!
+//! Each live subscriber maintains its own finite queue. If a consumer cannot
+//! keep up, the oldest live events are dropped and the next call yields
 //! [`Lagged`](crate::subscription::Lagged) reporting how many events were skipped.
 //! Slow subscribers do not block the producer.
 
+use std::collections::VecDeque;
 use std::fmt;
 use std::pin::Pin;
+use std::sync::Arc;
 use std::task::{Context, Poll};
 
-use tokio::sync::broadcast::Receiver;
+use parking_lot::Mutex;
+use tokio::sync::broadcast::{Receiver, Sender, WeakSender};
 use tokio_stream::wrappers::BroadcastStream;
 use tokio_stream::wrappers::errors::BroadcastStreamRecvError;
 use tokio_stream::{Stream, StreamExt as _};
@@ -135,154 +144,245 @@ impl From<Lagged> for RecvError {
     }
 }
 
-macro_rules! define_subscription {
-    (
-        $(#[$meta:meta])*
-        $name:ident, $item:ty $(,)?
-    ) => {
-        $(#[$meta])*
-        #[must_use = "subscriptions are inert until polled"]
-        pub struct $name {
-            inner: BroadcastStream<$item>,
-        }
+enum ResumeBootstrapState {
+    Unclaimed(VecDeque<SessionEvent>),
+    Claimed(VecDeque<SessionEvent>),
+    Disabled,
+}
 
-        impl $name {
-            pub(crate) fn new(rx: Receiver<$item>) -> Self {
-                Self {
-                    inner: BroadcastStream::new(rx),
-                }
-            }
+/// Publication, ownership, and the empty-queue handoff share one lock so
+/// the bootstrap owner observes an exact prefix without gaps or duplicates.
+pub(crate) struct ResumeBootstrap {
+    state: Mutex<ResumeBootstrapState>,
+    live: WeakSender<SessionEvent>,
+}
 
-            /// Receive the next event.
-            ///
-            /// Returns:
-            ///
-            /// - `Ok(event)` for the next delivered event.
-            /// - `Err(`[`RecvError`]`)` with [`RecvError::kind()`] [`RecvErrorKind::Lagged`] if the subscriber fell behind;
-            ///   call `recv` again to continue from the next live event.
-            /// - `Err(`[`RecvError`]`)` with [`RecvError::kind()`] [`RecvErrorKind::Closed`] once the producer is gone.
-            ///
-            /// # Cancel safety
-            ///
-            /// **Cancel-safe.** Wraps a `tokio::sync::broadcast::Receiver`
-            /// via `BroadcastStream`; both are cancel-safe by design.
-            /// Dropping the future before completion is harmless — events
-            /// already buffered for this subscriber remain available on
-            /// the next `recv` call.
-            pub async fn recv(&mut self) -> Result<$item, RecvError> {
-                match self.inner.next().await {
-                    Some(Ok(event)) => Ok(event),
-                    Some(Err(BroadcastStreamRecvError::Lagged(n))) => {
-                        Err(Lagged(n).into())
-                    }
-                    None => Err(RecvErrorKind::Closed.into()),
-                }
+/// Releases only unclaimed events when the publishing task exits or unwinds.
+pub(crate) struct ResumeBootstrapCleanup(Arc<ResumeBootstrap>);
+
+impl Drop for ResumeBootstrapCleanup {
+    fn drop(&mut self) {
+        self.0.release_unclaimed();
+    }
+}
+
+impl ResumeBootstrap {
+    pub(crate) fn new(event_tx: &Sender<SessionEvent>) -> Arc<Self> {
+        Arc::new(Self {
+            state: Mutex::new(ResumeBootstrapState::Unclaimed(VecDeque::new())),
+            live: event_tx.downgrade(),
+        })
+    }
+
+    pub(crate) fn cleanup_guard(self: &Arc<Self>) -> ResumeBootstrapCleanup {
+        ResumeBootstrapCleanup(self.clone())
+    }
+
+    pub(crate) fn publish(&self, event_tx: &Sender<SessionEvent>, event: SessionEvent) {
+        let mut state = self.state.lock();
+        match &mut *state {
+            ResumeBootstrapState::Unclaimed(events) | ResumeBootstrapState::Claimed(events) => {
+                events.push_back(event.clone());
             }
+            ResumeBootstrapState::Disabled => {}
         }
+        // Other observers stay live while the bootstrap owner catches up.
+        let _ = event_tx.send(event);
+    }
 
-        impl Stream for $name {
-            type Item = Result<$item, Lagged>;
-
-            fn poll_next(
-                mut self: Pin<&mut Self>,
-                cx: &mut Context<'_>,
-            ) -> Poll<Option<Self::Item>> {
-                match Pin::new(&mut self.inner).poll_next(cx) {
-                    Poll::Ready(Some(Ok(event))) => Poll::Ready(Some(Ok(event))),
-                    Poll::Ready(Some(Err(BroadcastStreamRecvError::Lagged(n)))) => {
-                        Poll::Ready(Some(Err(Lagged(n))))
-                    }
-                    Poll::Ready(None) => Poll::Ready(None),
-                    Poll::Pending => Poll::Pending,
+    pub(crate) fn subscribe(
+        self: &Arc<Self>,
+        event_tx: &Sender<SessionEvent>,
+    ) -> EventSubscription {
+        let mut state = self.state.lock();
+        match &mut *state {
+            ResumeBootstrapState::Unclaimed(events) => {
+                let events = std::mem::take(events);
+                *state = ResumeBootstrapState::Claimed(events);
+                EventSubscription {
+                    inner: None,
+                    bootstrap: Some(self.clone()),
                 }
             }
+            ResumeBootstrapState::Claimed(_) | ResumeBootstrapState::Disabled => {
+                EventSubscription::new(event_tx.subscribe())
+            }
         }
-    };
+    }
+
+    fn pop(&self, live: &mut Option<BroadcastStream<SessionEvent>>) -> Option<SessionEvent> {
+        let mut state = self.state.lock();
+        let ResumeBootstrapState::Claimed(events) = &mut *state else {
+            return None;
+        };
+        if let Some(event) = events.pop_front() {
+            return Some(event);
+        }
+        // Subscribe under the publication lock, never replaying the broadcast
+        // copy of an event already delivered from the bootstrap queue.
+        *live = self
+            .live
+            .upgrade()
+            .map(|sender| BroadcastStream::new(sender.subscribe()));
+        *state = ResumeBootstrapState::Disabled;
+        None
+    }
+
+    pub(crate) fn release_unclaimed(&self) {
+        let mut state = self.state.lock();
+        if matches!(*state, ResumeBootstrapState::Unclaimed(_)) {
+            *state = ResumeBootstrapState::Disabled;
+        }
+    }
+
+    fn abandon(&self) {
+        let mut state = self.state.lock();
+        if matches!(*state, ResumeBootstrapState::Claimed(_)) {
+            *state = ResumeBootstrapState::Disabled;
+        }
+    }
 }
 
-define_subscription! {
-    /// Subscription to runtime events for a single
-    /// [`Session`](crate::session::Session).
-    ///
-    /// Created by [`Session::subscribe`](crate::session::Session::subscribe).
-    /// Implements [`Stream`] yielding `Result<SessionEvent, Lagged>`.
-    /// Drop the value to unsubscribe; there is no separate cancel handle.
-    EventSubscription, SessionEvent
+/// Subscription to runtime events for a single
+/// [`Session`](crate::session::Session).
+///
+/// Created by [`Session::subscribe`](crate::session::Session::subscribe).
+/// Implements [`Stream`] yielding `Result<SessionEvent, Lagged>`.
+/// Drop the value to unsubscribe; there is no separate cancel handle.
+/// A resume bootstrap is claimed at construction, not on the first poll.
+/// Dropping its owner discards any unread bootstrap events.
+#[must_use = "dropping the subscription unsubscribes and discards any owned resume bootstrap backlog"]
+pub struct EventSubscription {
+    inner: Option<BroadcastStream<SessionEvent>>,
+    bootstrap: Option<Arc<ResumeBootstrap>>,
 }
 
-define_subscription! {
-    /// Subscription to lifecycle events on a [`Client`](crate::Client).
+impl EventSubscription {
+    pub(crate) fn new(rx: Receiver<SessionEvent>) -> Self {
+        Self {
+            inner: Some(BroadcastStream::new(rx)),
+            bootstrap: None,
+        }
+    }
+
+    fn next_bootstrap_event(&mut self) -> Option<SessionEvent> {
+        let event = self
+            .bootstrap
+            .as_ref()
+            .and_then(|bootstrap| bootstrap.pop(&mut self.inner));
+        if event.is_none() {
+            self.bootstrap = None;
+        }
+        event
+    }
+
+    /// Receive the next event.
+    ///
+    /// Returns:
+    ///
+    /// - `Ok(event)` for the next delivered event.
+    /// - [`RecvErrorKind::Lagged`] if live delivery fell behind; call again
+    ///   to continue from the next available live event.
+    /// - [`RecvErrorKind::Closed`] once the producer is gone and any retained
+    ///   events have been drained.
     ///
-    /// Created by
-    /// [`Client::subscribe_lifecycle`](crate::Client::subscribe_lifecycle).
-    /// Implements [`Stream`] yielding `Result<SessionLifecycleEvent, Lagged>`.
-    /// Drop the value to unsubscribe; there is no separate cancel handle.
-    LifecycleSubscription, SessionLifecycleEvent
+    /// # Cancel safety
+    ///
+    /// **Cancel-safe.** Bootstrap events are removed before the future's
+    /// first suspension point. Once live delivery begins, this wraps a
+    /// cancel-safe `tokio::sync::broadcast::Receiver` via `BroadcastStream`.
+    pub async fn recv(&mut self) -> Result<SessionEvent, RecvError> {
+        match self.next().await {
+            Some(Ok(event)) => Ok(event),
+            Some(Err(lagged)) => Err(lagged.into()),
+            None => Err(RecvErrorKind::Closed.into()),
+        }
+    }
 }
 
-#[cfg(test)]
-mod tests {
-    use tokio::sync::broadcast;
-
-    use super::*;
-
-    fn make_event(id: &str) -> SessionEvent {
-        SessionEvent {
-            id: id.into(),
-            timestamp: "2025-01-01T00:00:00Z".into(),
-            parent_id: None,
-            ephemeral: None,
-            agent_id: None,
-            debug_cli_received_at_ms: None,
-            debug_ws_forwarded_at_ms: None,
-            event_type: "noop".into(),
-            data: serde_json::json!({}),
+impl Stream for EventSubscription {
+    type Item = Result<SessionEvent, Lagged>;
+
+    fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+        if let Some(event) = self.next_bootstrap_event() {
+            return Poll::Ready(Some(Ok(event)));
+        }
+        let Some(inner) = self.inner.as_mut() else {
+            return Poll::Ready(None);
+        };
+        match Pin::new(inner).poll_next(cx) {
+            Poll::Ready(Some(Ok(event))) => Poll::Ready(Some(Ok(event))),
+            Poll::Ready(Some(Err(BroadcastStreamRecvError::Lagged(n)))) => {
+                Poll::Ready(Some(Err(Lagged(n))))
+            }
+            Poll::Ready(None) => Poll::Ready(None),
+            Poll::Pending => Poll::Pending,
+        }
+    }
+}
+
+impl Drop for EventSubscription {
+    fn drop(&mut self) {
+        if let Some(bootstrap) = &self.bootstrap {
+            bootstrap.abandon();
         }
     }
+}
 
-    #[tokio::test]
-    async fn recv_yields_then_closes_on_drop_sender() {
-        let (tx, rx) = broadcast::channel(8);
-        let mut sub = EventSubscription::new(rx);
-        tx.send(make_event("a")).unwrap();
-        tx.send(make_event("b")).unwrap();
-        drop(tx);
-
-        assert_eq!(sub.recv().await.unwrap().id, "a");
-        assert_eq!(sub.recv().await.unwrap().id, "b");
-        assert!(matches!(
-            sub.recv().await.unwrap_err().kind(),
-            RecvErrorKind::Closed
-        ));
+/// Subscription to lifecycle events on a [`Client`](crate::Client).
+///
+/// Created by [`Client::subscribe_lifecycle`](crate::Client::subscribe_lifecycle).
+/// Implements [`Stream`] yielding `Result<SessionLifecycleEvent, Lagged>`.
+/// Drop the value to unsubscribe; there is no separate cancel handle.
+#[must_use = "dropping the subscription unsubscribes"]
+pub struct LifecycleSubscription {
+    inner: BroadcastStream<SessionLifecycleEvent>,
+}
+
+impl LifecycleSubscription {
+    pub(crate) fn new(rx: Receiver<SessionLifecycleEvent>) -> Self {
+        Self {
+            inner: BroadcastStream::new(rx),
+        }
     }
 
-    #[tokio::test]
-    async fn recv_surfaces_lag() {
-        let (tx, rx) = broadcast::channel(2);
-        let mut sub = EventSubscription::new(rx);
-        for id in ["a", "b", "c", "d"] {
-            tx.send(make_event(id)).unwrap();
+    /// Receive the next event.
+    ///
+    /// Returns:
+    ///
+    /// - `Ok(event)` for the next delivered event.
+    /// - [`RecvErrorKind::Lagged`] if the subscriber fell behind; call again
+    ///   to continue from the next available event.
+    /// - [`RecvErrorKind::Closed`] once the producer is gone.
+    ///
+    /// # Cancel safety
+    ///
+    /// **Cancel-safe.** Wraps a `tokio::sync::broadcast::Receiver` via
+    /// `BroadcastStream`; both are cancel-safe by design. Dropping the future
+    /// before completion leaves buffered events available for the next call.
+    pub async fn recv(&mut self) -> Result<SessionLifecycleEvent, RecvError> {
+        match self.next().await {
+            Some(Ok(event)) => Ok(event),
+            Some(Err(lagged)) => Err(lagged.into()),
+            None => Err(RecvErrorKind::Closed.into()),
         }
-        let err = sub.recv().await.expect_err("expected a Lagged error");
-        let RecvErrorKind::Lagged(l) = err.kind() else {
-            panic!("expected Lagged, got {:?}", err.kind());
-        };
-        assert_eq!(l.skipped(), 2);
-        // Subscription continues with the live tail.
-        assert_eq!(sub.recv().await.unwrap().id, "c");
-        assert_eq!(sub.recv().await.unwrap().id, "d");
     }
+}
+
+impl Stream for LifecycleSubscription {
+    type Item = Result<SessionLifecycleEvent, Lagged>;
 
-    #[tokio::test]
-    async fn stream_impl_matches_recv_semantics() {
-        let (tx, rx) = broadcast::channel(8);
-        let mut sub = EventSubscription::new(rx);
-        tx.send(make_event("a")).unwrap();
-        drop(tx);
-
-        // poll_next path
-        let next = sub.next().await;
-        assert_eq!(next.unwrap().unwrap().id, "a");
-        assert!(sub.next().await.is_none());
+    fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+        match Pin::new(&mut self.inner).poll_next(cx) {
+            Poll::Ready(Some(Ok(event))) => Poll::Ready(Some(Ok(event))),
+            Poll::Ready(Some(Err(BroadcastStreamRecvError::Lagged(n)))) => {
+                Poll::Ready(Some(Err(Lagged(n))))
+            }
+            Poll::Ready(None) => Poll::Ready(None),
+            Poll::Pending => Poll::Pending,
+        }
     }
 }
+
+#[cfg(test)]
+mod tests;
diff --git a/rust/src/subscription/tests.rs b/rust/src/subscription/tests.rs
new file mode 100644
index 0000000000..be8a076f0b
--- /dev/null
+++ b/rust/src/subscription/tests.rs
@@ -0,0 +1,371 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+
+#![cfg(test)]
+
+use std::sync::Barrier;
+use std::time::Duration;
+
+use futures_util::FutureExt;
+use tokio::sync::broadcast;
+use tokio::time::timeout;
+
+use super::*;
+
+#[track_caller]
+fn recv_ready(events: &mut EventSubscription) -> Result<SessionEvent, RecvError> {
+    events
+        .recv()
+        .now_or_never()
+        .expect("expected receive to complete on its first poll")
+}
+
+#[track_caller]
+fn next_ready(events: &mut EventSubscription) -> Option<Result<SessionEvent, Lagged>> {
+    events
+        .next()
+        .now_or_never()
+        .expect("expected stream item or closure on its first poll")
+}
+
+fn make_event(id: &str) -> SessionEvent {
+    SessionEvent {
+        id: id.into(),
+        timestamp: "2025-01-01T00:00:00Z".into(),
+        parent_id: None,
+        ephemeral: None,
+        agent_id: None,
+        debug_cli_received_at_ms: None,
+        debug_ws_forwarded_at_ms: None,
+        event_type: "noop".into(),
+        data: serde_json::json!({}),
+    }
+}
+
+#[tokio::test]
+async fn recv_yields_then_closes_on_drop_sender() {
+    let (tx, rx) = broadcast::channel(8);
+    let mut sub = EventSubscription::new(rx);
+    tx.send(make_event("a")).unwrap();
+    tx.send(make_event("b")).unwrap();
+    drop(tx);
+
+    assert_eq!(recv_ready(&mut sub).unwrap().id, "a");
+    assert_eq!(recv_ready(&mut sub).unwrap().id, "b");
+    assert!(matches!(
+        recv_ready(&mut sub).unwrap_err().kind(),
+        RecvErrorKind::Closed
+    ));
+}
+
+#[tokio::test]
+async fn recv_surfaces_lag() {
+    let (tx, rx) = broadcast::channel(2);
+    let mut sub = EventSubscription::new(rx);
+    for id in ["a", "b", "c", "d"] {
+        tx.send(make_event(id)).unwrap();
+    }
+    let err = recv_ready(&mut sub).expect_err("expected a Lagged error");
+    let RecvErrorKind::Lagged(l) = err.kind() else {
+        panic!("expected Lagged, got {:?}", err.kind());
+    };
+    assert_eq!(l.skipped(), 2);
+    assert_eq!(recv_ready(&mut sub).unwrap().id, "c");
+    assert_eq!(recv_ready(&mut sub).unwrap().id, "d");
+}
+
+#[tokio::test]
+async fn stream_impl_matches_recv_semantics() {
+    let (tx, rx) = broadcast::channel(8);
+    let mut sub = EventSubscription::new(rx);
+    tx.send(make_event("a")).unwrap();
+    drop(tx);
+
+    let next = next_ready(&mut sub);
+    assert_eq!(next.unwrap().unwrap().id, "a");
+    assert!(next_ready(&mut sub).is_none());
+}
+
+#[tokio::test]
+async fn resume_bootstrap_is_lossless_before_and_during_catchup() {
+    let (tx, _) = broadcast::channel(1);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    for index in 0..600 {
+        bootstrap.publish(&tx, make_event(&format!("event-{index}")));
+    }
+    let mut events = bootstrap.subscribe(&tx);
+    for index in 0..300 {
+        assert_eq!(
+            recv_ready(&mut events).unwrap().id,
+            format!("event-{index}")
+        );
+    }
+    for index in 600..1200 {
+        bootstrap.publish(&tx, make_event(&format!("event-{index}")));
+    }
+    for index in 300..1200 {
+        assert_eq!(
+            recv_ready(&mut events).unwrap().id,
+            format!("event-{index}")
+        );
+    }
+    assert!(events.recv().now_or_never().is_none());
+    bootstrap.publish(&tx, make_event("live"));
+    assert_eq!(recv_ready(&mut events).unwrap().id, "live");
+    assert!(events.recv().now_or_never().is_none());
+}
+
+#[tokio::test]
+async fn first_subscription_claims_before_polling_while_later_observers_stay_live() {
+    let (tx, _) = broadcast::channel(8);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    bootstrap.publish(&tx, make_event("bootstrap"));
+
+    let mut first = bootstrap.subscribe(&tx);
+    let mut second = bootstrap.subscribe(&tx);
+    assert!(second.recv().now_or_never().is_none());
+    bootstrap.publish(&tx, make_event("during-catchup"));
+    assert_eq!(recv_ready(&mut second).unwrap().id, "during-catchup");
+    assert_eq!(recv_ready(&mut first).unwrap().id, "bootstrap");
+    assert_eq!(recv_ready(&mut first).unwrap().id, "during-catchup");
+    assert!(first.recv().now_or_never().is_none());
+    bootstrap.publish(&tx, make_event("live"));
+    for sub in [&mut first, &mut second] {
+        assert_eq!(recv_ready(sub).unwrap().id, "live");
+        assert!(sub.recv().now_or_never().is_none());
+    }
+}
+
+#[tokio::test]
+async fn concurrent_subscribers_claim_bootstrap_exactly_once() {
+    let (tx, _) = broadcast::channel(8);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    bootstrap.publish(&tx, make_event("bootstrap"));
+    let barrier = Barrier::new(2);
+    let mut subscriptions = std::thread::scope(|scope| {
+        let subscribe = || {
+            barrier.wait();
+            bootstrap.subscribe(&tx)
+        };
+        let first = scope.spawn(subscribe);
+        let second = scope.spawn(subscribe);
+        [first.join().unwrap(), second.join().unwrap()]
+    });
+
+    let mut owners = 0;
+    for sub in &mut subscriptions {
+        if let Some(event) = sub.recv().now_or_never() {
+            assert_eq!(event.unwrap().id, "bootstrap");
+            owners += 1;
+        }
+    }
+    assert_eq!(owners, 1);
+    for id in ["during-catchup", "live"] {
+        bootstrap.publish(&tx, make_event(id));
+        for sub in &mut subscriptions {
+            assert_eq!(recv_ready(sub).unwrap().id, id);
+            assert!(sub.recv().now_or_never().is_none());
+        }
+    }
+}
+
+#[tokio::test]
+async fn claimed_bootstrap_drains_after_shutdown_without_retaining_sender() {
+    let (tx, _) = broadcast::channel(1);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    bootstrap.publish(&tx, make_event("first"));
+    let mut events = bootstrap.subscribe(&tx);
+    bootstrap.publish(&tx, make_event("second"));
+    drop(bootstrap.cleanup_guard());
+    assert_eq!(tx.strong_count(), 1);
+    drop(tx);
+
+    assert_eq!(next_ready(&mut events).unwrap().unwrap().id, "first");
+    assert_eq!(next_ready(&mut events).unwrap().unwrap().id, "second");
+    assert!(next_ready(&mut events).is_none());
+    assert!(matches!(
+        recv_ready(&mut events).unwrap_err().kind(),
+        RecvErrorKind::Closed
+    ));
+}
+
+#[tokio::test]
+async fn bootstrap_handoff_is_cancel_safe_and_preserves_live_lag() {
+    let (tx, _) = broadcast::channel(1);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    bootstrap.publish(&tx, make_event("bootstrap"));
+    let mut events = bootstrap.subscribe(&tx);
+    // A buffered event must return Ready on the first poll, never be removed
+    // and held across a suspension that cancellation could discard.
+    assert_eq!(recv_ready(&mut events).unwrap().id, "bootstrap");
+    // Cancel the pending receive after it installs bounded live delivery.
+    assert!(events.recv().now_or_never().is_none());
+    bootstrap.publish(&tx, make_event("overwritten"));
+    bootstrap.publish(&tx, make_event("live"));
+    let error = recv_ready(&mut events).unwrap_err();
+    let RecvErrorKind::Lagged(lag) = error.kind() else {
+        panic!("expected live lag, got {error:?}");
+    };
+    assert_eq!(lag.skipped(), 1);
+    assert_eq!(recv_ready(&mut events).unwrap().id, "live");
+    assert!(events.next().now_or_never().is_none());
+    bootstrap.publish(&tx, make_event("stream-overwritten"));
+    bootstrap.publish(&tx, make_event("stream-live"));
+    assert_eq!(next_ready(&mut events).unwrap().unwrap_err().skipped(), 1);
+    assert_eq!(next_ready(&mut events).unwrap().unwrap().id, "stream-live");
+}
+
+#[tokio::test]
+async fn publication_racing_empty_queue_handoff_has_no_gap_or_duplicate() {
+    for _ in 0..32 {
+        let (tx, _) = broadcast::channel(1024);
+        let bootstrap = ResumeBootstrap::new(&tx);
+        bootstrap.publish(&tx, make_event("prefix"));
+        let mut events = bootstrap.subscribe(&tx);
+        assert_eq!(recv_ready(&mut events).unwrap().id, "prefix");
+
+        let barrier = Arc::new(Barrier::new(2));
+        let producer = std::thread::spawn({
+            let barrier = barrier.clone();
+            let bootstrap = bootstrap.clone();
+            move || {
+                barrier.wait();
+                for index in 0..600 {
+                    bootstrap.publish(&tx, make_event(&format!("event-{index}")));
+                }
+            }
+        });
+        barrier.wait();
+        for index in 0..600 {
+            let event = timeout(Duration::from_secs(5), events.recv())
+                .await
+                .unwrap()
+                .unwrap();
+            assert_eq!(event.id, format!("event-{index}"));
+        }
+        producer.join().unwrap();
+        assert!(
+            timeout(Duration::from_secs(5), events.next())
+                .await
+                .unwrap()
+                .is_none()
+        );
+    }
+}
+
+#[tokio::test]
+async fn shutdown_discards_unclaimed_bootstrap() {
+    let (tx, _) = broadcast::channel(1);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    bootstrap.publish(&tx, make_event("unclaimed"));
+    bootstrap.release_unclaimed();
+    assert!(matches!(
+        *bootstrap.state.lock(),
+        ResumeBootstrapState::Disabled
+    ));
+    let mut events = bootstrap.subscribe(&tx);
+    assert!(events.recv().now_or_never().is_none());
+    bootstrap.publish(&tx, make_event("live"));
+    assert_eq!(recv_ready(&mut events).unwrap().id, "live");
+}
+
+#[tokio::test]
+async fn dropping_unpolled_bootstrap_owner_discards_backlog_without_transfer() {
+    let (tx, _) = broadcast::channel(8);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    bootstrap.publish(&tx, make_event("discarded"));
+    let first = bootstrap.subscribe(&tx);
+    let mut second = bootstrap.subscribe(&tx);
+    drop(first);
+    assert!(matches!(
+        *bootstrap.state.lock(),
+        ResumeBootstrapState::Disabled
+    ));
+    let mut third = bootstrap.subscribe(&tx);
+    for sub in [&mut second, &mut third] {
+        assert!(sub.recv().now_or_never().is_none());
+    }
+    bootstrap.publish(&tx, make_event("live"));
+    for sub in [&mut second, &mut third] {
+        assert_eq!(recv_ready(sub).unwrap().id, "live");
+    }
+}
+
+#[tokio::test]
+async fn ordinary_subscription_does_not_replay_events_without_a_receiver() {
+    let (tx, _) = broadcast::channel(8);
+    assert!(tx.send(make_event("before-subscribe")).is_err());
+    let mut sub = EventSubscription::new(tx.subscribe());
+    tx.send(make_event("live")).unwrap();
+    assert_eq!(recv_ready(&mut sub).unwrap().id, "live");
+}
+
+#[tokio::test]
+async fn dropping_partially_drained_owner_discards_remaining_backlog() {
+    let (tx, _) = broadcast::channel(1);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    for id in ["consumed", "discarded"] {
+        bootstrap.publish(&tx, make_event(id));
+    }
+    let mut owner = bootstrap.subscribe(&tx);
+    assert_eq!(recv_ready(&mut owner).unwrap().id, "consumed");
+    bootstrap.publish(&tx, make_event("also-discarded"));
+    drop(owner);
+    assert!(matches!(
+        *bootstrap.state.lock(),
+        ResumeBootstrapState::Disabled
+    ));
+    let mut observer = bootstrap.subscribe(&tx);
+    assert!(observer.recv().now_or_never().is_none());
+    bootstrap.publish(&tx, make_event("live"));
+    assert_eq!(recv_ready(&mut observer).unwrap().id, "live");
+    assert!(matches!(
+        *bootstrap.state.lock(),
+        ResumeBootstrapState::Disabled
+    ));
+}
+
+#[tokio::test]
+async fn cleanup_releases_backlog_when_task_is_aborted_before_first_poll() {
+    let (tx, _) = broadcast::channel(1);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    bootstrap.publish(&tx, make_event("unclaimed"));
+    let cleanup = bootstrap.cleanup_guard();
+    let task = tokio::spawn(async move {
+        let _cleanup = cleanup;
+        std::future::pending::<()>().await;
+    });
+    // This current-thread runtime cannot poll the spawned task before we yield.
+    task.abort();
+    let error = timeout(Duration::from_secs(5), task)
+        .await
+        .unwrap()
+        .unwrap_err();
+    assert!(error.is_cancelled(), "expected cancellation, got {error:?}");
+    assert!(matches!(
+        *bootstrap.state.lock(),
+        ResumeBootstrapState::Disabled
+    ));
+    assert_eq!(Arc::strong_count(&bootstrap), 1);
+}
+
+#[tokio::test]
+async fn cleanup_releases_backlog_when_task_panics() {
+    let (tx, _) = broadcast::channel(1);
+    let bootstrap = ResumeBootstrap::new(&tx);
+    bootstrap.publish(&tx, make_event("unclaimed"));
+    let cleanup = bootstrap.cleanup_guard();
+    let task = tokio::spawn(async move {
+        let _cleanup = cleanup;
+        panic!("simulated event-loop unwind");
+    });
+    let error = timeout(Duration::from_secs(5), task)
+        .await
+        .unwrap()
+        .unwrap_err();
+    assert!(error.is_panic(), "expected panic, got {error:?}");
+    assert!(matches!(
+        *bootstrap.state.lock(),
+        ResumeBootstrapState::Disabled
+    ));
+    assert_eq!(Arc::strong_count(&bootstrap), 1);
+}
diff --git a/rust/src/types.rs b/rust/src/types.rs
index b3dd113948..5c5d5b17b6 100644
--- a/rust/src/types.rs
+++ b/rust/src/types.rs
@@ -21,6 +21,10 @@ pub use crate::copilot_request_handler::{
     CopilotWebSocketResponse, WebSocketTransform, forward_http,
 };
 use crate::generated::api_types::{CurrentToolMetadata, OpenCanvasInstance};
+pub use crate::generated::api_types::{
+    DiagnosticLogLevel, DiagnosticSourcesConfiguration, DiagnosticsConfiguration,
+    McpDiagnosticSourceConfiguration,
+};
 /// Acknowledgement and Auto preference snapshot returned by an Auto tier switch.
 pub use crate::generated::api_types::{ModelSwitchAutoTierResult, ModelSwitchAutoTierStatus};
 /// Routing tier for the `auto` model with Auto mode V2.
@@ -2010,6 +2014,11 @@ pub struct SessionConfig {
     pub included_builtin_skills: Option<Vec<String>>,
     /// MCP server configurations passed through to the CLI.
     pub mcp_servers: Option<IndexMap<String, McpServerConfig>>,
+    /// Enables session-scoped MCP diagnostic capture. Diagnostics are off by
+    /// default. Debug and trace entries can contain MCP payloads, tool arguments,
+    /// paths, and server stderr, so hosts must not upload or export them
+    /// automatically.
+    pub diagnostics: Option<DiagnosticsConfiguration>,
     /// Controls how MCP OAuth tokens are stored for this session.
     ///
     /// - `"persistent"` — tokens are stored in the OS keychain (shared across sessions).
@@ -2036,6 +2045,13 @@ pub struct SessionConfig {
     pub embedding_cache_storage: Option<String>,
     /// Organization-level custom instructions to apply to this session.
     pub organization_custom_instructions: Option<String>,
+    /// Invalidate the runtime process-wide instruction discovery cache before
+    /// constructing this new session. `None` or `Some(false)` retains cache reuse.
+    ///
+    /// Available only on creation configs, not resume configs. Other sessions in
+    /// this runtime may observe updated instructions on later turns or discovery.
+    /// This does not watch files or override instruction-loading policy.
+    pub refresh_custom_instructions: Option<bool>,
     /// When true, enables on-demand instruction discovery for this session.
     pub enable_on_demand_instruction_discovery: Option<bool>,
     /// When true, enables file hooks for this session.
@@ -2334,6 +2350,7 @@ impl std::fmt::Debug for SessionConfig {
             .field("excluded_builtin_agents", &self.excluded_builtin_agents)
             .field("included_builtin_skills", &self.included_builtin_skills)
             .field("mcp_servers", &self.mcp_servers)
+            .field("diagnostics", &self.diagnostics)
             .field("mcp_oauth_token_storage", &self.mcp_oauth_token_storage)
             .field(
                 "auth_client_id_metadata_url",
@@ -2349,6 +2366,10 @@ impl std::fmt::Debug for SessionConfig {
                     .as_ref()
                     .map(|_| "<redacted>"),
             )
+            .field(
+                "refresh_custom_instructions",
+                &self.refresh_custom_instructions,
+            )
             .field(
                 "enable_on_demand_instruction_discovery",
                 &self.enable_on_demand_instruction_discovery,
@@ -2479,11 +2500,13 @@ impl Default for SessionConfig {
             excluded_builtin_agents: None,
             included_builtin_skills: None,
             mcp_servers: None,
+            diagnostics: None,
             mcp_oauth_token_storage: None,
             auth_client_id_metadata_url: None,
             enable_config_discovery: None,
             skip_embedding_retrieval: None,
             organization_custom_instructions: None,
+            refresh_custom_instructions: None,
             enable_on_demand_instruction_discovery: None,
             enable_file_hooks: None,
             enable_host_git_operations: None,
@@ -2650,6 +2673,7 @@ impl SessionConfig {
             excluded_builtin_agents: self.excluded_builtin_agents,
             tool_filter_precedence: "excluded",
             mcp_servers: self.mcp_servers,
+            diagnostics: self.diagnostics,
             mcp_oauth_token_storage: self.mcp_oauth_token_storage,
             auth_client_id_metadata_url: self.auth_client_id_metadata_url,
             embedding_cache_storage: self.embedding_cache_storage,
@@ -2657,6 +2681,7 @@ impl SessionConfig {
             enable_config_discovery: self.enable_config_discovery,
             skip_embedding_retrieval: self.skip_embedding_retrieval,
             organization_custom_instructions: self.organization_custom_instructions,
+            refresh_custom_instructions: self.refresh_custom_instructions,
             enable_on_demand_instruction_discovery: self.enable_on_demand_instruction_discovery,
             enable_file_hooks: self.enable_file_hooks,
             enable_host_git_operations: self.enable_host_git_operations,
@@ -2994,6 +3019,12 @@ impl SessionConfig {
         self
     }
 
+    /// Set the session-scoped MCP diagnostic level.
+    pub fn with_diagnostics(mut self, diagnostics: DiagnosticsConfiguration) -> Self {
+        self.diagnostics = Some(diagnostics);
+        self
+    }
+
     /// Set MCP OAuth token storage mode.
     ///
     /// - `"persistent"` — tokens stored in the OS keychain.
@@ -3043,6 +3074,12 @@ impl SessionConfig {
         self
     }
 
+    /// Set [`Self::refresh_custom_instructions`] for this new session.
+    pub fn with_refresh_custom_instructions(mut self, refresh: bool) -> Self {
+        self.refresh_custom_instructions = Some(refresh);
+        self
+    }
+
     /// Set [`Self::enable_on_demand_instruction_discovery`].
     pub fn with_enable_on_demand_instruction_discovery(mut self, value: bool) -> Self {
         self.enable_on_demand_instruction_discovery = Some(value);
@@ -3490,6 +3527,9 @@ pub struct ResumeSessionConfig {
     pub included_builtin_skills: Option<Vec<String>>,
     /// Re-supply MCP servers so they remain available after app restart.
     pub mcp_servers: Option<IndexMap<String, McpServerConfig>>,
+    /// Updates session-scoped MCP diagnostics. Leave this unset on a resident
+    /// resume to preserve the current diagnostic level.
+    pub diagnostics: Option<DiagnosticsConfiguration>,
     /// Controls how MCP OAuth tokens are stored for this session.
     /// See [`SessionConfig::mcp_oauth_token_storage`] for details.
     pub mcp_oauth_token_storage: Option<String>,
@@ -3726,6 +3766,7 @@ impl std::fmt::Debug for ResumeSessionConfig {
             .field("excluded_builtin_agents", &self.excluded_builtin_agents)
             .field("included_builtin_skills", &self.included_builtin_skills)
             .field("mcp_servers", &self.mcp_servers)
+            .field("diagnostics", &self.diagnostics)
             .field("mcp_oauth_token_storage", &self.mcp_oauth_token_storage)
             .field(
                 "auth_client_id_metadata_url",
@@ -3913,6 +3954,7 @@ impl ResumeSessionConfig {
             excluded_builtin_agents: self.excluded_builtin_agents,
             tool_filter_precedence: "excluded",
             mcp_servers: self.mcp_servers,
+            diagnostics: self.diagnostics,
             mcp_oauth_token_storage: self.mcp_oauth_token_storage,
             auth_client_id_metadata_url: self.auth_client_id_metadata_url,
             embedding_cache_storage: self.embedding_cache_storage,
@@ -4024,6 +4066,7 @@ impl ResumeSessionConfig {
             excluded_builtin_agents: None,
             included_builtin_skills: None,
             mcp_servers: None,
+            diagnostics: None,
             mcp_oauth_token_storage: None,
             auth_client_id_metadata_url: None,
             enable_config_discovery: None,
@@ -4345,6 +4388,12 @@ impl ResumeSessionConfig {
         self
     }
 
+    /// Set the session-scoped MCP diagnostic level on resume.
+    pub fn with_diagnostics(mut self, diagnostics: DiagnosticsConfiguration) -> Self {
+        self.diagnostics = Some(diagnostics);
+        self
+    }
+
     /// Set MCP OAuth token storage mode on resume.
     /// See [`SessionConfig::with_mcp_oauth_token_storage`] for details.
     pub fn with_mcp_oauth_token_storage(mut self, mode: impl Into<String>) -> Self {
@@ -8504,3 +8553,6 @@ mod is_terminal_tests {
         assert!(format!("{plain:?}").contains("is_terminal: false"));
     }
 }
+
+#[cfg(test)]
+mod refresh_custom_instructions_tests;
diff --git a/rust/src/types/refresh_custom_instructions_tests.rs b/rust/src/types/refresh_custom_instructions_tests.rs
new file mode 100644
index 0000000000..64ff2d03df
--- /dev/null
+++ b/rust/src/types/refresh_custom_instructions_tests.rs
@@ -0,0 +1,20 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+
+#![cfg(test)]
+
+use super::SessionConfig;
+
+#[test]
+fn refresh_custom_instructions_builder_default_and_debug() {
+    let config = SessionConfig::default();
+    assert_eq!(config.refresh_custom_instructions, None);
+    assert!(format!("{config:?}").contains("refresh_custom_instructions: None"));
+
+    let config = config.with_refresh_custom_instructions(true);
+    assert_eq!(config.refresh_custom_instructions, Some(true));
+    assert!(format!("{config:?}").contains("refresh_custom_instructions: Some(true)"));
+
+    let config = config.with_refresh_custom_instructions(false);
+    assert_eq!(config.refresh_custom_instructions, Some(false));
+    assert!(format!("{config:?}").contains("refresh_custom_instructions: Some(false)"));
+}
diff --git a/rust/src/wire.rs b/rust/src/wire.rs
index 1bd368ff18..8bb8f76d3e 100644
--- a/rust/src/wire.rs
+++ b/rust/src/wire.rs
@@ -94,6 +94,8 @@ pub(crate) struct SessionCreateWire {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub mcp_servers: Option<IndexMap<String, McpServerConfig>>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub diagnostics: Option<crate::generated::api_types::DiagnosticsConfiguration>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub mcp_oauth_token_storage: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub auth_client_id_metadata_url: Option<String>,
@@ -107,6 +109,8 @@ pub(crate) struct SessionCreateWire {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub organization_custom_instructions: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub refresh_custom_instructions: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub enable_on_demand_instruction_discovery: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub enable_file_hooks: Option<bool>,
@@ -257,6 +261,8 @@ pub(crate) struct SessionResumeWire {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub mcp_servers: Option<IndexMap<String, McpServerConfig>>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub diagnostics: Option<crate::generated::api_types::DiagnosticsConfiguration>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub mcp_oauth_token_storage: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub auth_client_id_metadata_url: Option<String>,
diff --git a/rust/tests/api_types_test.rs b/rust/tests/api_types_test.rs
index 546adaa510..b8a0eafb9a 100644
--- a/rust/tests/api_types_test.rs
+++ b/rust/tests/api_types_test.rs
@@ -4,12 +4,13 @@
 #![allow(clippy::unwrap_used)]
 
 use github_copilot_sdk::rpc::{
-    AcceptedEnqueueCommandResult, EnqueueCommandResult, Extension, ExtensionList, ExtensionSource,
-    ExtensionStatus, ExtensionsDisableRequest, ExtensionsEnableRequest, FleetStartRequest,
-    FleetStartResult, ModelSetAllowedModelsRequest, ModelSetAllowedModelsResult,
-    ModelSwitchAutoTierRequest, ModelSwitchAutoTierResult, ModelSwitchAutoTierStatus,
-    QueuePendingItems, QueuePendingItemsKind, SandboxConfig, SendAgentMode, TasksStartAgentRequest,
-    UnsupportedEnqueueCommandResult,
+    AcceptedEnqueueCommandResult, ConnectorAccountRequest, ConnectorCatalogStatus,
+    ConnectorConnectRequest, ConnectorContinueRequest, ConnectorReconcileRequest,
+    EnqueueCommandResult, Extension, ExtensionList, ExtensionSource, ExtensionStatus,
+    ExtensionsDisableRequest, ExtensionsEnableRequest, FleetStartRequest, FleetStartResult,
+    ModelSetAllowedModelsRequest, ModelSetAllowedModelsResult, ModelSwitchAutoTierRequest,
+    ModelSwitchAutoTierResult, ModelSwitchAutoTierStatus, QueuePendingItems, QueuePendingItemsKind,
+    SandboxConfig, SendAgentMode, TasksStartAgentRequest, UnsupportedEnqueueCommandResult,
 };
 use github_copilot_sdk::session_events::{
     PermissionRequest, PermissionRequestedData, SessionEventData, TypedSessionEvent,
@@ -131,6 +132,68 @@ fn tasks_start_agent_request_fields_are_accessible() {
     assert_eq!(request.description.as_deref(), Some("SDK task agent"));
 }
 
+#[test]
+fn connector_request_dtos_use_public_camel_case_wire_fields() {
+    let account = ConnectorAccountRequest {
+        account_id: "account-1".to_string(),
+    };
+    assert_eq!(
+        serde_json::to_value(account).unwrap(),
+        serde_json::json!({ "accountId": "account-1" })
+    );
+
+    let connector = ConnectorConnectRequest {
+        account_id: "account-1".to_string(),
+        connector_name: "github".to_string(),
+    };
+    assert_eq!(
+        serde_json::to_value(connector).unwrap(),
+        serde_json::json!({
+            "accountId": "account-1",
+            "connectorName": "github",
+        })
+    );
+
+    let continuation = ConnectorContinueRequest {
+        continuation_id: "continuation-1".to_string(),
+        deadline_ms: 30_000,
+        max_attempts: 5,
+        poll_interval_ms: 1_000,
+    };
+    assert_eq!(
+        serde_json::to_value(continuation).unwrap(),
+        serde_json::json!({
+            "continuationId": "continuation-1",
+            "deadlineMs": 30_000,
+            "maxAttempts": 5,
+            "pollIntervalMs": 1_000,
+        })
+    );
+
+    let reconcile = ConnectorReconcileRequest {
+        account_id: "account-1".to_string(),
+        refresh_catalog: Some(true),
+    };
+    assert_eq!(
+        serde_json::to_value(reconcile).unwrap(),
+        serde_json::json!({
+            "accountId": "account-1",
+            "refreshCatalog": true,
+        })
+    );
+}
+
+#[test]
+fn connector_catalog_unknown_wire_value_has_a_distinct_variant() {
+    let service_unknown: ConnectorCatalogStatus =
+        serde_json::from_value(serde_json::json!("unknown")).unwrap();
+    let future_status: ConnectorCatalogStatus =
+        serde_json::from_value(serde_json::json!("future_status")).unwrap();
+
+    assert_eq!(service_unknown, ConnectorCatalogStatus::UnknownValue);
+    assert_eq!(future_status, ConnectorCatalogStatus::Unknown);
+}
+
 #[test]
 fn model_allowed_models_request_and_result_preserve_contract_fields() {
     let replace = ModelSetAllowedModelsRequest {
@@ -187,21 +250,24 @@ fn permission_event_exposes_managed_approval_required() {
 }
 
 #[test]
-fn queue_pending_message_id_uses_camel_case_wire_name() {
+fn queue_pending_item_metadata_uses_camel_case_wire_names() {
     let item = QueuePendingItems {
         agent_mode: SendAgentMode::Interactive,
         display_text: "second message".to_string(),
         id: "batch-1".to_string(),
         kind: QueuePendingItemsKind::Message,
         message_id: Some("message-2".to_string()),
+        source: Some("api".to_string()),
     };
 
     let serialized = serde_json::to_value(&item).unwrap();
     assert_eq!(serialized["id"], "batch-1");
     assert_eq!(serialized["messageId"], "message-2");
+    assert_eq!(serialized["source"], "api");
 
     let deserialized: QueuePendingItems = serde_json::from_value(serialized).unwrap();
     assert_eq!(deserialized.message_id.as_deref(), Some("message-2"));
+    assert_eq!(deserialized.source.as_deref(), Some("api"));
 }
 
 #[test]
@@ -215,12 +281,10 @@ fn queue_pending_message_id_is_optional_for_older_hosts() {
     .unwrap();
 
     assert_eq!(item.message_id, None);
-    assert!(
-        serde_json::to_value(item)
-            .unwrap()
-            .get("messageId")
-            .is_none()
-    );
+    assert_eq!(item.source, None);
+    let serialized = serde_json::to_value(item).unwrap();
+    assert!(serialized.get("messageId").is_none());
+    assert!(serialized.get("source").is_none());
 }
 
 #[test]
diff --git a/rust/tests/build_download.rs b/rust/tests/build_download.rs
new file mode 100644
index 0000000000..a99832ffe1
--- /dev/null
+++ b/rust/tests/build_download.rs
@@ -0,0 +1,42 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+
+#[path = "../build/download.rs"]
+mod download;
+
+#[test]
+fn retries_server_and_connection_failures() {
+    assert!(download::is_transient(&ureq::Error::StatusCode(503)));
+    assert!(download::is_transient(&ureq::Error::Io(
+        std::io::Error::other("disconnected")
+    )));
+    assert!(download::is_transient(&ureq::Error::HostNotFound));
+    assert!(download::is_transient(&ureq::Error::BodyStalled));
+}
+
+#[test]
+fn rejects_client_and_configuration_failures() {
+    assert!(!download::is_transient(&ureq::Error::StatusCode(407)));
+    assert!(!download::is_transient(&ureq::Error::BadUri(
+        "invalid".into()
+    )));
+    assert!(!download::is_transient(&ureq::Error::InvalidProxyUrl));
+    assert!(!download::is_transient(&ureq::Error::TooManyRedirects));
+    assert!(!download::is_transient(&ureq::Error::TlsRequired));
+}
+
+#[test]
+fn reports_http_reason_and_distinguishes_other_errors() {
+    assert_eq!(
+        download::message(&ureq::Error::StatusCode(407)),
+        "HTTP 407 Proxy Authentication Required"
+    );
+    assert_eq!(
+        download::message(&ureq::Error::InvalidProxyUrl),
+        "download error: invalid proxy url"
+    );
+}
+
+#[test]
+fn body_deadline_exceeds_prior_two_minute_limit() {
+    assert!(download::BODY_TIMEOUT > std::time::Duration::from_secs(120));
+}
diff --git a/rust/tests/e2e/copilot_request_handler.rs b/rust/tests/e2e/copilot_request_handler.rs
index 08a7d3ce0a..4e4004b9cf 100644
--- a/rust/tests/e2e/copilot_request_handler.rs
+++ b/rust/tests/e2e/copilot_request_handler.rs
@@ -486,7 +486,7 @@ async fn start_ws_upstream(counters: HandlerCounters) -> String {
                             counters.upstream_ws_requests.fetch_add(1, Ordering::SeqCst);
                             for event in responses_events(HANDLER_WS_TEXT, "resp_stub_ws") {
                                 let raw = serde_json::to_string(&event).unwrap();
-                                if write.send(Message::Text(raw)).await.is_err() {
+                                if write.send(Message::Text(raw.into())).await.is_err() {
                                     return;
                                 }
                             }
diff --git a/rust/tests/e2e/pending_work_resume.rs b/rust/tests/e2e/pending_work_resume.rs
index f218d84c9a..317e5308f3 100644
--- a/rust/tests/e2e/pending_work_resume.rs
+++ b/rust/tests/e2e/pending_work_resume.rs
@@ -38,9 +38,18 @@ async fn should_continue_pending_external_tool_request_after_resume() {
         "should_continue_pending_external_tool_request_after_resume",
         |ctx| {
             Box::pin(async move {
+                let started = Instant::now();
+                let phase = |name| {
+                    eprintln!(
+                        "pending_work_resume/should_continue_pending_external_tool_request_after_resume [{:?}]: {name}",
+                        started.elapsed()
+                    );
+                };
                 ctx.set_default_copilot_user();
                 let port = free_tcp_port();
+                phase("start managed TCP server");
                 let server = start_tcp_server(ctx, port).await;
+                phase("start first external client");
                 let suspended_client = start_external_client(ctx, port).await;
                 let (started_tx, mut started_rx) = mpsc::unbounded_channel();
                 let (_release_tx, release_rx) = oneshot::channel();
@@ -48,6 +57,7 @@ async fn should_continue_pending_external_tool_request_after_resume() {
                     started_tx,
                     release_rx: Mutex::new(Some(release_rx)),
                 });
+                phase("create first session");
                 let session1 = suspended_client
                     .create_session(
                         SessionConfig::default()
@@ -68,21 +78,27 @@ async fn should_continue_pending_external_tool_request_after_resume() {
                                 .typed_data::<ExternalToolRequestedData>()
                                 .is_some_and(|data| data.tool_name == "resume_external_tool")
                     });
+                phase("send pending tool prompt");
                 session1
                     .send("Use resume_external_tool with value 'beta', then reply with the result.")
                     .await
                     .expect("send pending tool prompt");
+                phase("wait for pending tool");
                 assert_eq!(
                     recv_with_timeout(&mut started_rx, "pending tool started").await,
                     "beta"
                 );
+                phase("wait for tool request event");
                 let tool_event = tool_requested
                     .await
                     .typed_data::<ExternalToolRequestedData>()
                     .expect("tool request data");
+                phase("force-stop first external client");
                 suspended_client.force_stop();
 
+                phase("start resumed external client");
                 let resumed_client = start_external_client(ctx, port).await;
+                phase("resume pending session");
                 let session2 = resumed_client
                     .resume_session(resume_config(session_id).with_continue_pending_work(true))
                     .await
@@ -96,6 +112,7 @@ async fn should_continue_pending_external_tool_request_after_resume() {
                             .typed_data::<AssistantMessageData>()
                             .is_some_and(|data| data.content.contains("EXTERNAL_RESUMED_BETA"))
                     });
+                phase("complete pending tool");
                 let result = session2
                     .rpc()
                     .tools()
@@ -107,14 +124,18 @@ async fn should_continue_pending_external_tool_request_after_resume() {
                     .await
                     .expect("complete pending tool");
                 assert!(result.success);
+                phase("wait for resumed assistant answer");
                 assistant.await;
 
+                phase("disconnect resumed session");
                 session2
                     .disconnect()
                     .await
                     .expect("disconnect resumed session");
                 resumed_client.force_stop();
+                phase("stop managed TCP server");
                 server.stop().await.expect("stop server client");
+                phase("completed");
             })
         },
     )
diff --git a/rust/tests/e2e/rpc_event_log.rs b/rust/tests/e2e/rpc_event_log.rs
index b116f3e504..cb367ed8a9 100644
--- a/rust/tests/e2e/rpc_event_log.rs
+++ b/rust/tests/e2e/rpc_event_log.rs
@@ -85,27 +85,102 @@ async fn should_return_tail_cursor_and_read_empty_when_no_new_events() {
                     .await
                     .expect("create session");
 
-                let tail = session.rpc().event_log().tail().await.expect("tail");
-                assert!(!tail.cursor.trim().is_empty());
-                let read = session
+                session
+                    .rpc()
+                    .plan()
+                    .update(github_copilot_sdk::rpc::PlanUpdateRequest {
+                        content: "# tail cursor plan".to_string(),
+                    })
+                    .await
+                    .expect("write plan");
+                client
+                    .rpc()
+                    .sessions()
+                    .save(github_copilot_sdk::rpc::SessionsSaveRequest {
+                        session_id: session.id().clone(),
+                    })
+                    .await
+                    .expect("save session");
+                let before_tail = session
                     .rpc()
                     .event_log()
                     .read(EventLogReadRequest {
                         agent_ids: None,
                         agent_scope: None,
-                        cursor: Some(tail.cursor),
+                        cursor: None,
                         direction: None,
                         include_ephemeral: None,
-                        max: Some(10),
-                        types: Some(json!("*")),
+                        max: Some(100),
+                        types: Some(json!(["session.plan_changed"])),
                         wait_ms: Some(0),
                     })
                     .await
+                    .expect("read persisted plan event");
+                assert!(
+                    before_tail
+                        .events
+                        .iter()
+                        .any(|event| event.parsed_type() == SessionEventType::SessionPlanChanged)
+                );
+
+                let tail = session.rpc().event_log().tail().await.expect("tail");
+                assert!(!tail.cursor.trim().is_empty());
+                let request = EventLogReadRequest {
+                    agent_ids: None,
+                    agent_scope: None,
+                    cursor: Some(tail.cursor),
+                    direction: None,
+                    include_ephemeral: Some(false),
+                    max: Some(10),
+                    // Startup events can arrive after the tail; only the plan update is controlled here.
+                    types: Some(json!(["session.plan_changed"])),
+                    wait_ms: Some(0),
+                };
+                let read = session
+                    .rpc()
+                    .event_log()
+                    .read(request.clone())
+                    .await
                     .expect("read from tail");
                 assert_eq!(read.cursor_status, EventsCursorStatus::Ok);
-                assert!(read.events.is_empty());
+                assert!(
+                    read.events.is_empty(),
+                    "unexpected events after tail: {:?}",
+                    read.events
+                );
                 assert!(!read.has_more);
 
+                session
+                    .rpc()
+                    .plan()
+                    .update(github_copilot_sdk::rpc::PlanUpdateRequest {
+                        content: "# durable event after tail".to_string(),
+                    })
+                    .await
+                    .expect("write plan");
+                client
+                    .rpc()
+                    .sessions()
+                    .save(github_copilot_sdk::rpc::SessionsSaveRequest {
+                        session_id: session.id().clone(),
+                    })
+                    .await
+                    .expect("save session");
+                let read = session
+                    .rpc()
+                    .event_log()
+                    .read(request)
+                    .await
+                    .expect("read new durable event from tail");
+                assert_eq!(read.cursor_status, EventsCursorStatus::Ok);
+                assert!(
+                    read.events
+                        .iter()
+                        .any(|event| event.parsed_type() == SessionEventType::SessionPlanChanged),
+                    "new durable event missing after tail: {:?}",
+                    read.events
+                );
+
                 session.disconnect().await.expect("disconnect session");
                 client.stop().await.expect("stop client");
             })
@@ -177,7 +252,7 @@ async fn should_longpoll_with_types_filter_for_titlechanged_event() {
                     .expect("create session");
                 let tail = session.rpc().event_log().tail().await.expect("tail");
                 let event_log = session.rpc().event_log();
-                let read_future = event_log.read(EventLogReadRequest {
+                let mut request = EventLogReadRequest {
                     agent_ids: None,
                     agent_scope: None,
                     cursor: Some(tail.cursor),
@@ -186,27 +261,60 @@ async fn should_longpoll_with_types_filter_for_titlechanged_event() {
                     max: Some(10),
                     types: Some(json!(["session.title_changed"])),
                     wait_ms: Some(5_000),
-                });
+                };
+                let read_future = event_log.read(request.clone());
                 let write_future = async {
-                    tokio::time::sleep(std::time::Duration::from_millis(100)).await;
                     session
                         .rpc()
-                        .name()
-                        .set(github_copilot_sdk::rpc::NameSetRequest {
-                            name: "Rust event log title".to_string(),
+                        .plan()
+                        .update(github_copilot_sdk::rpc::PlanUpdateRequest {
+                            content: "# Unrelated event during a filtered read".to_string(),
                         })
                         .await
-                        .expect("set title");
+                        .expect("write unrelated plan");
                 };
                 let (read, _) = tokio::join!(read_future, write_future);
-                let read = read.expect("long-poll event log");
-                assert_eq!(read.cursor_status, EventsCursorStatus::Ok);
-                assert!(read.events.iter().any(|event| {
-                    event.parsed_type() == SessionEventType::SessionTitleChanged
-                        && event
-                            .typed_data::<SessionTitleChangedData>()
-                            .is_some_and(|data| data.title == "Rust event log title")
-                }));
+                let mut read = read.expect("long-poll event log");
+                assert!(
+                    read.events.is_empty(),
+                    "unexpected events after unrelated plan update: {:?}",
+                    read.events
+                );
+                session
+                    .rpc()
+                    .name()
+                    .set(github_copilot_sdk::rpc::NameSetRequest {
+                        name: "Rust event log title".to_string(),
+                    })
+                    .await
+                    .expect("set title");
+                tokio::time::timeout(std::time::Duration::from_secs(10), async {
+                    loop {
+                        assert_eq!(read.cursor_status, EventsCursorStatus::Ok);
+                        assert!(read.events.iter().all(|event| {
+                            event.parsed_type() == SessionEventType::SessionTitleChanged
+                        }));
+                        if read.events.iter().any(|event| {
+                            event
+                                .typed_data::<SessionTitleChangedData>()
+                                .is_some_and(|data| data.title == "Rust event log title")
+                        }) {
+                            break;
+                        }
+                        request.cursor = Some(read.cursor.clone());
+                        read = event_log
+                            .read(request.clone())
+                            .await
+                            .expect("continue filtered event log read");
+                    }
+                })
+                .await
+                .unwrap_or_else(|_| {
+                    panic!(
+                        "timed out waiting for filtered title event; last batch: {:?}",
+                        read.events
+                    )
+                });
 
                 session.disconnect().await.expect("disconnect session");
                 client.stop().await.expect("stop client");
diff --git a/rust/tests/e2e/rpc_surface_coverage.rs b/rust/tests/e2e/rpc_surface_coverage.rs
index fda704eca6..20a56e6882 100644
--- a/rust/tests/e2e/rpc_surface_coverage.rs
+++ b/rust/tests/e2e/rpc_surface_coverage.rs
@@ -567,6 +567,7 @@ async fn session_mcp_metadata_model_and_permission_rpc_surface_is_typed() {
     results.insert_default::<PermissionsUrlsSetUnrestrictedModeResult>(
         "session.permissions.urls.setUnrestrictedMode",
     );
+    results.insert_default::<SkillsLoadDiagnostics>("session.customizations.reload");
     results.insert(
         "session.provider.getEndpoint",
         ProviderEndpoint {
@@ -800,6 +801,8 @@ async fn session_mcp_metadata_model_and_permission_rpc_surface_is_typed() {
             .urls()
             .set_unrestricted_mode(PermissionUrlsSetUnrestrictedModeParams::default())
     );
+    rpc_ok!(session.rpc().instructions().reload());
+    rpc_ok!(session.rpc().customizations().reload());
     rpc_ok!(
         session
             .rpc()
@@ -849,6 +852,8 @@ async fn session_mcp_metadata_model_and_permission_rpc_surface_is_typed() {
         "session.permissions.paths.isPathWithinAllowedDirectories",
         "session.permissions.paths.isPathWithinWorkspace",
         "session.permissions.urls.setUnrestrictedMode",
+        "session.instructions.reload",
+        "session.customizations.reload",
         "session.plugins.reload",
         "session.provider.getEndpoint",
     ]);
diff --git a/rust/tests/e2e/session.rs b/rust/tests/e2e/session.rs
index 619fabc1c3..b3a9e4e8fd 100644
--- a/rust/tests/e2e/session.rs
+++ b/rust/tests/e2e/session.rs
@@ -2,6 +2,7 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
 
+use futures_util::FutureExt;
 use github_copilot_sdk::handler::{
     ApproveAllHandler, McpAuthHandler, McpAuthRequest, McpAuthResult,
 };
@@ -65,11 +66,9 @@ async fn shouldcreateanddisconnectsessions() {
 
 #[tokio::test]
 async fn sendandwait_throws_operationcanceledexception_when_token_cancelled() {
-    let cancelled = tokio::time::timeout(
-        Duration::from_millis(1),
-        tokio::time::sleep(Duration::from_millis(50)),
-    )
-    .await;
+    // A delayed poll can observe both a finite sleep and its timeout ready.
+    let cancelled =
+        tokio::time::timeout(Duration::from_millis(1), std::future::pending::<()>()).await;
 
     assert!(cancelled.is_err());
 }
@@ -842,7 +841,7 @@ async fn sendandwait_blocks_until_session_idle_and_returns_final_assistant_messa
                     .create_session(ctx.approve_all_session_config())
                     .await
                     .expect("create session");
-                let events = session.subscribe();
+                let mut events = session.subscribe();
 
                 let response = session
                     .send_and_wait("What is 2+2?")
@@ -852,7 +851,20 @@ async fn sendandwait_blocks_until_session_idle_and_returns_final_assistant_messa
                 assert_eq!(response.parsed_type(), SessionEventType::AssistantMessage);
                 assert!(assistant_message_content(&response).contains('4'));
 
-                let observed = collect_until_idle(events).await;
+                let mut observed = Vec::new();
+                loop {
+                    let event = events
+                        .recv()
+                        .now_or_never()
+                        .expect("terminal event must already be queued when send_and_wait returns")
+                        .expect("receive queued event");
+                    let is_idle = event.parsed_type() == SessionEventType::SessionIdle
+                        && event.agent_id.as_deref().is_none_or(str::is_empty);
+                    observed.push(event);
+                    if is_idle {
+                        break;
+                    }
+                }
                 let types = event_types(&observed);
                 assert!(types.contains(&"assistant.message"));
                 assert!(types.contains(&"session.idle"));
diff --git a/rust/tests/e2e/subagent_hooks.rs b/rust/tests/e2e/subagent_hooks.rs
index 616829ebcc..32fdc71d02 100644
--- a/rust/tests/e2e/subagent_hooks.rs
+++ b/rust/tests/e2e/subagent_hooks.rs
@@ -12,6 +12,7 @@ use github_copilot_sdk::{
     CopilotRequestHandler, forward_http,
 };
 use parking_lot::Mutex;
+use tokio::sync::watch;
 
 use super::support::{assistant_message_content, wait_for_event, with_e2e_context};
 
@@ -34,6 +35,7 @@ async fn should_invoke_pretooluse_and_posttooluse_hooks_for_sub_agent_tool_calls
 
                 let hook_log = Arc::new(Mutex::new(Vec::<HookEntry>::new()));
                 let request_log = Arc::new(RecordingRequestHandler::default());
+                let (parent_reply, parent_reply_observed) = watch::channel(false);
 
                 let client = ctx
                     .start_llm_client(
@@ -46,6 +48,7 @@ async fn should_invoke_pretooluse_and_posttooluse_hooks_for_sub_agent_tool_calls
                     .create_session(ctx.approve_all_session_config().with_hooks(Arc::new(
                         RecordingHooks {
                             log: Arc::clone(&hook_log),
+                            parent_reply_observed,
                         },
                     )))
                     .await
@@ -54,10 +57,15 @@ async fn should_invoke_pretooluse_and_posttooluse_hooks_for_sub_agent_tool_calls
                 let saw_final_response = Cell::new(false);
                 let completion = wait_for_event(
                     session.subscribe(),
-                    "parent's subagent result followed by session.idle",
+                    "parent waiting reply and subagent result followed by session.idle",
                     |event| {
                         if event.parsed_type() == SessionEventType::AssistantMessage {
                             let content = assistant_message_content(event);
+                            if content.contains("Waiting for it to complete...") {
+                                parent_reply
+                                    .send(true)
+                                    .expect("sub-agent hook should await the parent reply");
+                            }
                             if content.contains("Hello from subagent test!") {
                                 saw_final_response.set(true);
                             }
@@ -214,6 +222,28 @@ fn assert_subagent_request_metadata(records: &[RequestEntry]) {
 
 struct RecordingHooks {
     log: Arc<Mutex<Vec<HookEntry>>>,
+    parent_reply_observed: watch::Receiver<bool>,
+}
+
+fn is_subagent_view(tool_name: &str, session_id: &str, log: &[HookEntry]) -> bool {
+    tool_name == "view"
+        && log
+            .iter()
+            .find(|entry| entry.kind == "pre" && entry.tool_name == "task")
+            .is_some_and(|entry| entry.session_id != session_id)
+}
+
+#[test]
+fn only_child_view_waits_for_parent_reply() {
+    let parent_task = [HookEntry {
+        kind: "pre".to_string(),
+        tool_name: "task".to_string(),
+        session_id: "parent".to_string(),
+    }];
+    assert!(!is_subagent_view("view", "parent", &[]));
+    assert!(!is_subagent_view("view", "parent", &parent_task));
+    assert!(!is_subagent_view("task", "child", &parent_task));
+    assert!(is_subagent_view("view", "child", &parent_task));
 }
 
 #[async_trait]
@@ -223,11 +253,24 @@ impl SessionHooks for RecordingHooks {
         input: PreToolUseInput,
         _ctx: HookContext,
     ) -> Option<PreToolUseOutput> {
-        self.log.lock().push(HookEntry {
-            kind: "pre".to_string(),
-            tool_name: input.tool_name,
-            session_id: input.session_id,
-        });
+        let is_subagent_view = {
+            let mut log = self.log.lock();
+            let is_subagent_view = is_subagent_view(&input.tool_name, &input.session_id, &log);
+            log.push(HookEntry {
+                kind: "pre".to_string(),
+                tool_name: input.tool_name,
+                session_id: input.session_id,
+            });
+            is_subagent_view
+        };
+        if is_subagent_view {
+            // Keep the background agent from completing before the parent's waiting reply.
+            let mut parent_reply = self.parent_reply_observed.clone();
+            parent_reply
+                .wait_for(|observed| *observed)
+                .await
+                .expect("parent waiting reply should arrive before sub-agent view");
+        }
         Some(PreToolUseOutput {
             permission_decision: Some("allow".to_string()),
             ..PreToolUseOutput::default()
diff --git a/rust/tests/prepared_session_test.rs b/rust/tests/prepared_session_test.rs
index 56698bac92..f3102d7f40 100644
--- a/rust/tests/prepared_session_test.rs
+++ b/rust/tests/prepared_session_test.rs
@@ -12,12 +12,15 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use async_trait::async_trait;
-use github_copilot_sdk::handler::{McpAuthHandler, McpAuthRequest, McpAuthResult};
+use futures_util::FutureExt;
+use github_copilot_sdk::handler::{
+    McpAuthHandler, McpAuthRequest, McpAuthResult, PermissionHandler, PermissionResult,
+};
 use github_copilot_sdk::session::PreparedSession;
 use github_copilot_sdk::subscription::{EventSubscription, RecvErrorKind};
 use github_copilot_sdk::types::{
-    CloudSessionOptions, CloudSessionRepository, RequestId, ResumeSessionConfig, SessionConfig,
-    SessionId,
+    CloudSessionOptions, CloudSessionRepository, MessageOptions, PermissionRequestData, RequestId,
+    ResumeSessionConfig, SessionConfig, SessionId,
 };
 use github_copilot_sdk::{Client, ErrorKind, SessionErrorKind};
 use serde_json::{Value, json};
@@ -156,6 +159,41 @@ impl FakeServer {
         assert_eq!(request["method"], "session.skills.reload");
         self.respond(&request, json!({})).await;
     }
+
+    /// The permission callback runs after publication on the session loop,
+    /// proving preceding events were dispatched without claiming a subscription.
+    async fn await_publication(&mut self, session_id: &str, published: &tokio::sync::Notify) {
+        let notification = json!({
+            "jsonrpc": "2.0",
+            "method": "session.event",
+            "params": {
+                "sessionId": session_id,
+                "event": {
+                    "id": "publication-fence",
+                    "timestamp": "2025-01-01T00:00:00Z",
+                    "type": "permission.requested",
+                    "data": { "requestId": "publication-fence", "kind": "read" },
+                },
+            },
+        });
+        write_framed(&mut self.write, &serde_json::to_vec(&notification).unwrap()).await;
+        timeout(TIMEOUT, published.notified()).await.unwrap();
+    }
+}
+
+struct PublicationFence(Arc<tokio::sync::Notify>);
+
+#[async_trait]
+impl PermissionHandler for PublicationFence {
+    async fn handle(
+        &self,
+        _session_id: SessionId,
+        _request_id: RequestId,
+        _request: PermissionRequestData,
+    ) -> PermissionResult {
+        self.0.notify_one();
+        PermissionResult::no_result()
+    }
 }
 
 /// Minimal MCP-auth handler: its presence is what makes the SDK register
@@ -305,6 +343,14 @@ async fn expect_startup_burst(events: &mut EventSubscription) {
     assert_eq!(idle.ephemeral, Some(true));
 }
 
+async fn expect_event_id(events: &mut EventSubscription, id: &str) {
+    let event = timeout(TIMEOUT, events.recv())
+        .await
+        .unwrap_or_else(|_| panic!("timed out waiting for {id}"))
+        .unwrap_or_else(|error| panic!("expected {id}, got {error}"));
+    assert_eq!(event.id, id);
+}
+
 /// Unwrap the error arm of a result whose `Ok` type is not `Debug`.
 fn expect_error<T>(result: Result<T, github_copilot_sdk::Error>) -> github_copilot_sdk::Error {
     match result {
@@ -457,6 +503,14 @@ async fn prepared_resume_delivers_pre_response_burst() {
 
     let session = timeout(TIMEOUT, start).await.unwrap().unwrap().unwrap();
     expect_startup_burst(&mut events).await;
+    let mut late = session.subscribe();
+    assert!(late.recv().now_or_never().is_none());
+    server
+        .send_event(session_id.as_str(), "live", "assistant.message", false)
+        .await;
+    for subscription in [&mut events, &mut late] {
+        expect_event_id(subscription, "live").await;
+    }
     drop(session);
 }
 
@@ -704,6 +758,27 @@ async fn create_rpc_error_preserves_kind_and_cleans_up() {
     expect_closed(&mut events).await;
 }
 
+#[tokio::test]
+async fn create_result_parse_error_preserves_kind_and_cleans_up() {
+    let (client, mut server) = make_client();
+    let session_id = SessionId::new("prepared-create-parse-error");
+    let prepared = client
+        .prepare_session(SessionConfig::default().with_session_id(session_id))
+        .unwrap();
+    let mut events = prepared.subscribe();
+    let start = tokio::spawn(prepared.start());
+
+    let create_req = server.read_request().await;
+    server
+        .respond(&create_req, json!({ "sessionId": 42 }))
+        .await;
+
+    let error = expect_error(timeout(TIMEOUT, start).await.unwrap().unwrap());
+    assert!(matches!(error.kind(), ErrorKind::Json), "{error}");
+    await_no_registrations(&client).await;
+    expect_closed(&mut events).await;
+}
+
 #[tokio::test]
 async fn create_session_id_mismatch_preserves_kind_and_cleans_up() {
     let (client, mut server) = make_client();
@@ -1002,6 +1077,414 @@ async fn resume_session_wrapper_keeps_rpc_sequence() {
     drop(session);
 }
 
+#[tokio::test]
+async fn resume_bootstrap_retains_all_startup_phases_and_keeps_later_subscribers_live() {
+    let (client, mut server) = make_client();
+    let session_id = SessionId::new("resume-bootstrap-phases");
+    let published = Arc::new(tokio::sync::Notify::new());
+    let start = tokio::spawn({
+        let client = client.clone();
+        let session_id = session_id.clone();
+        let published = published.clone();
+        async move {
+            client
+                .resume_session(
+                    ResumeSessionConfig::new(session_id)
+                        .with_event_buffer_capacity(1)
+                        .with_permission_handler(Arc::new(PublicationFence(published)))
+                        .with_mcp_auth_handler(Arc::new(CancelMcpAuthHandler)),
+                )
+                .await
+        }
+    });
+
+    let resume = server.read_request().await;
+    assert_eq!(resume["method"], "session.resume");
+    server
+        .send_event(
+            session_id.as_str(),
+            "pre-durable",
+            "session.model_change",
+            false,
+        )
+        .await;
+    server
+        .send_event(session_id.as_str(), "pre-ephemeral", "session.idle", true)
+        .await;
+    server
+        .await_publication(session_id.as_str(), &published)
+        .await;
+    server
+        .respond(&resume, json!({ "sessionId": session_id.as_str() }))
+        .await;
+
+    let interest = server.read_request().await;
+    assert_eq!(interest["method"], "session.eventLog.registerInterest");
+    server.send_startup_burst(session_id.as_str()).await;
+    server
+        .await_publication(session_id.as_str(), &published)
+        .await;
+    server.respond(&interest, json!({})).await;
+
+    let reload = server.read_request().await;
+    assert_eq!(reload["method"], "session.skills.reload");
+    server
+        .send_event(session_id.as_str(), "during-reload", "session.idle", true)
+        .await;
+    server
+        .await_publication(session_id.as_str(), &published)
+        .await;
+    server.respond(&reload, json!({})).await;
+    let session = timeout(TIMEOUT, start).await.unwrap().unwrap().unwrap();
+
+    server
+        .send_event(
+            session_id.as_str(),
+            "post-setup",
+            "assistant.message",
+            false,
+        )
+        .await;
+    server
+        .await_publication(session_id.as_str(), &published)
+        .await;
+    let mut first = session.subscribe();
+    let mut second = session.subscribe();
+    server
+        .send_event(session_id.as_str(), "during-catchup", "session.idle", true)
+        .await;
+    expect_event_id(&mut second, "during-catchup").await;
+
+    for (id, ephemeral) in [
+        ("pre-durable", Some(false)),
+        ("pre-ephemeral", Some(true)),
+        ("publication-fence", None),
+    ] {
+        let event = timeout(TIMEOUT, first.recv()).await.unwrap().unwrap();
+        assert_eq!(event.id, id);
+        assert_eq!(event.ephemeral, ephemeral);
+    }
+    expect_startup_burst(&mut first).await;
+    for id in [
+        "publication-fence",
+        "during-reload",
+        "publication-fence",
+        "post-setup",
+        "publication-fence",
+        "during-catchup",
+    ] {
+        expect_event_id(&mut first, id).await;
+    }
+    // Poll past the retained prefix, installing live delivery, then cancel.
+    assert!(first.recv().now_or_never().is_none());
+    assert!(second.recv().now_or_never().is_none());
+    server
+        .send_event(session_id.as_str(), "live", "assistant.message", false)
+        .await;
+    for events in [&mut first, &mut second] {
+        expect_event_id(events, "live").await;
+        assert!(events.recv().now_or_never().is_none());
+    }
+    timeout(TIMEOUT, session.stop_event_loop()).await.unwrap();
+    drop(session);
+    expect_closed(&mut first).await;
+    expect_closed(&mut second).await;
+}
+
+#[tokio::test]
+async fn structured_output_completion_preserves_resume_bootstrap_for_first_observer() {
+    check_structured_output_preserves_bootstrap(false).await;
+}
+
+#[tokio::test]
+async fn structured_output_cancellation_preserves_resume_bootstrap_for_first_observer() {
+    check_structured_output_preserves_bootstrap(true).await;
+}
+
+async fn check_structured_output_preserves_bootstrap(cancel: bool) {
+    let (client, mut server) = make_client();
+    let session_id = SessionId::new("resume-structured-output");
+    let published = Arc::new(tokio::sync::Notify::new());
+    let start = tokio::spawn({
+        let client = client.clone();
+        let session_id = session_id.clone();
+        let published = published.clone();
+        async move {
+            client
+                .resume_session(
+                    ResumeSessionConfig::new(session_id)
+                        .with_permission_handler(Arc::new(PublicationFence(published))),
+                )
+                .await
+        }
+    });
+    let resume = server.read_request().await;
+    server
+        .send_event(session_id.as_str(), "startup-idle", "session.idle", true)
+        .await;
+    server
+        .await_publication(session_id.as_str(), &published)
+        .await;
+    server
+        .respond(&resume, json!({ "sessionId": session_id.as_str() }))
+        .await;
+    server.answer_skills_reload().await;
+    let session = Arc::new(timeout(TIMEOUT, start).await.unwrap().unwrap().unwrap());
+    let waiting = tokio::spawn({
+        let session = session.clone();
+        async move {
+            session
+                .send_and_wait(
+                    MessageOptions::new("structured")
+                        .with_response_schema(json!({ "type": "object" })),
+                )
+                .await
+        }
+    });
+    let request = server.read_request().await;
+    assert_eq!(request["method"], "session.send");
+    if cancel {
+        waiting.abort();
+        let error = timeout(TIMEOUT, waiting).await.unwrap().unwrap_err();
+        assert!(error.is_cancelled(), "expected cancellation, got {error:?}");
+    } else {
+        server
+            .respond(&request, json!({ "messageId": "structured-user" }))
+            .await;
+        let notification = json!({
+            "jsonrpc": "2.0", "method": "session.event",
+            "params": { "sessionId": session_id.as_str(), "event": {
+                "id": "structured-answer", "timestamp": "2025-01-01T00:00:00Z",
+                "type": "assistant.message", "data": {
+                    "messageId": "structured-answer", "originatingMessageId": "structured-user",
+                    "content": "{\"ok\":true}"
+                }
+            } }
+        });
+        write_framed(
+            &mut server.write,
+            &serde_json::to_vec(&notification).unwrap(),
+        )
+        .await;
+        server
+            .send_event(session_id.as_str(), "structured-idle", "session.idle", true)
+            .await;
+        let result = timeout(TIMEOUT, waiting)
+            .await
+            .unwrap()
+            .unwrap()
+            .unwrap()
+            .unwrap();
+        assert_eq!(result.id, "structured-answer");
+    }
+
+    let mut observer = session.subscribe();
+    expect_event_id(&mut observer, "startup-idle").await;
+    expect_event_id(&mut observer, "publication-fence").await;
+    if !cancel {
+        expect_event_id(&mut observer, "structured-answer").await;
+        expect_event_id(&mut observer, "structured-idle").await;
+    }
+    assert!(observer.recv().now_or_never().is_none());
+    timeout(TIMEOUT, session.stop_event_loop()).await.unwrap();
+    drop(session);
+    expect_closed(&mut observer).await;
+}
+
+#[tokio::test]
+async fn populated_resume_bootstrap_cleans_up_after_setup_failure() {
+    check_populated_resume_cleanup(false).await;
+}
+
+#[tokio::test]
+async fn populated_resume_bootstrap_cleans_up_after_setup_cancellation() {
+    check_populated_resume_cleanup(true).await;
+}
+
+async fn check_populated_resume_cleanup(cancel: bool) {
+    let (client, mut server) = make_client();
+    let session_id = SessionId::new("resume-bootstrap-cleanup");
+    let published = Arc::new(tokio::sync::Notify::new());
+    let start = tokio::spawn({
+        let client = client.clone();
+        let session_id = session_id.clone();
+        let published = published.clone();
+        async move {
+            client
+                .resume_session(
+                    ResumeSessionConfig::new(session_id)
+                        .with_permission_handler(Arc::new(PublicationFence(published)))
+                        .with_mcp_auth_handler(Arc::new(CancelMcpAuthHandler)),
+                )
+                .await
+        }
+    });
+    let resume = server.read_request().await;
+    assert_eq!(resume["method"], "session.resume");
+    server
+        .respond(&resume, json!({ "sessionId": session_id.as_str() }))
+        .await;
+    let interest = server.read_request().await;
+    assert_eq!(interest["method"], "session.eventLog.registerInterest");
+    server.send_startup_burst(session_id.as_str()).await;
+    server
+        .await_publication(session_id.as_str(), &published)
+        .await;
+    if cancel {
+        start.abort();
+        let error = timeout(TIMEOUT, start)
+            .await
+            .unwrap()
+            .err()
+            .expect("cancelled resume task unexpectedly completed");
+        assert!(error.is_cancelled(), "expected cancellation, got {error:?}");
+    } else {
+        server
+            .respond_error(&interest, -32004, "interest registration failed")
+            .await;
+        let error = expect_error(timeout(TIMEOUT, start).await.unwrap().unwrap());
+        assert!(matches!(error.kind(), ErrorKind::Rpc { code: -32004 }));
+    }
+    await_no_registrations(&client).await;
+    server.expect_quiet().await;
+
+    let retry = tokio::spawn({
+        let client = client.clone();
+        let session_id = session_id.clone();
+        async move {
+            client
+                .resume_session(ResumeSessionConfig::new(session_id))
+                .await
+        }
+    });
+    let request = server.read_request().await;
+    assert_eq!(request["method"], "session.resume");
+    server
+        .respond(&request, json!({ "sessionId": session_id.as_str() }))
+        .await;
+    server.answer_skills_reload().await;
+    let session = timeout(TIMEOUT, retry).await.unwrap().unwrap().unwrap();
+    let mut events = session.subscribe();
+    server
+        .send_event(session_id.as_str(), "after-retry", "session.idle", true)
+        .await;
+    expect_event_id(&mut events, "after-retry").await;
+    timeout(TIMEOUT, session.stop_event_loop()).await.unwrap();
+    drop(session);
+    expect_closed(&mut events).await;
+    await_no_registrations(&client).await;
+}
+
+#[tokio::test]
+async fn stopping_resume_releases_unclaimed_bootstrap() {
+    check_stopping_resume_bootstrap(false).await;
+}
+
+#[tokio::test]
+async fn claimed_bootstrap_drains_after_stopping_and_dropping_session() {
+    check_stopping_resume_bootstrap(true).await;
+}
+
+async fn check_stopping_resume_bootstrap(claim: bool) {
+    let (client, mut server) = make_client();
+    let session_id = SessionId::new("resume-bootstrap-stop");
+    let published = Arc::new(tokio::sync::Notify::new());
+    let start = tokio::spawn({
+        let client = client.clone();
+        let session_id = session_id.clone();
+        let published = published.clone();
+        async move {
+            let prepared = client
+                .prepare_resume_session(
+                    ResumeSessionConfig::new(session_id)
+                        .with_event_buffer_capacity(1)
+                        .with_permission_handler(Arc::new(PublicationFence(published))),
+                )
+                .unwrap();
+            // A dropped prepared observer is not active at startup.
+            drop(prepared.subscribe());
+            prepared.start().await
+        }
+    });
+    let resume = server.read_request().await;
+    server.send_startup_burst(session_id.as_str()).await;
+    server
+        .await_publication(session_id.as_str(), &published)
+        .await;
+    server
+        .respond(&resume, json!({ "sessionId": session_id.as_str() }))
+        .await;
+    server.answer_skills_reload().await;
+    let session = timeout(TIMEOUT, start).await.unwrap().unwrap().unwrap();
+    let claimed = claim.then(|| session.subscribe());
+
+    timeout(TIMEOUT, session.stop_event_loop()).await.unwrap();
+    let mut events = claimed.unwrap_or_else(|| session.subscribe());
+    if claim {
+        drop(session);
+        expect_startup_burst(&mut events).await;
+        expect_event_id(&mut events, "publication-fence").await;
+    } else {
+        assert!(
+            events.recv().now_or_never().is_none(),
+            "unclaimed backlog was replayed"
+        );
+        drop(session);
+    }
+    assert!(matches!(
+        timeout(TIMEOUT, events.recv())
+            .await
+            .unwrap()
+            .unwrap_err()
+            .kind(),
+        RecvErrorKind::Closed
+    ));
+    await_no_registrations(&client).await;
+}
+
+#[tokio::test]
+async fn active_prepared_resume_subscription_remains_bounded() {
+    let (client, mut server) = make_client();
+    let session_id = SessionId::new("prepared-resume-bounded");
+    let published = Arc::new(tokio::sync::Notify::new());
+    let prepared = client
+        .prepare_resume_session(
+            ResumeSessionConfig::new(session_id.clone())
+                .with_event_buffer_capacity(1)
+                .with_permission_handler(Arc::new(PublicationFence(published.clone()))),
+        )
+        .unwrap();
+    let mut events = prepared.subscribe();
+    let start = tokio::spawn(prepared.start());
+    let resume = server.read_request().await;
+    server.send_startup_burst(session_id.as_str()).await;
+    server
+        .await_publication(session_id.as_str(), &published)
+        .await;
+    server
+        .respond(&resume, json!({ "sessionId": session_id.as_str() }))
+        .await;
+    server.answer_skills_reload().await;
+    let session = timeout(TIMEOUT, start).await.unwrap().unwrap().unwrap();
+    let error = timeout(TIMEOUT, events.recv()).await.unwrap().unwrap_err();
+    let RecvErrorKind::Lagged(lag) = error.kind() else {
+        panic!("expected bounded prepared delivery to lag, got {error:?}");
+    };
+    assert_eq!(lag.skipped(), (BURST + 1) as u64);
+    expect_event_id(&mut events, "publication-fence").await;
+    let mut late = session.subscribe();
+    server
+        .send_event(session_id.as_str(), "live", "session.idle", true)
+        .await;
+    for subscription in [&mut events, &mut late] {
+        expect_event_id(subscription, "live").await;
+    }
+    timeout(TIMEOUT, session.stop_event_loop()).await.unwrap();
+    drop(session);
+    expect_closed(&mut events).await;
+    expect_closed(&mut late).await;
+}
+
 // ---------------------------------------------------------------------------
 // 11. Type-level guarantees
 // ---------------------------------------------------------------------------
diff --git a/rust/tests/session_test.rs b/rust/tests/session_test.rs
index 920eed4561..bca042b634 100644
--- a/rust/tests/session_test.rs
+++ b/rust/tests/session_test.rs
@@ -19,7 +19,11 @@ use github_copilot_sdk::handler::{
 };
 use github_copilot_sdk::rpc::{
     CanvasProviderInvokeActionRequest, CanvasProviderOpenRequest, CanvasProviderOpenResult,
-    ModelSetAllowedModelsRequest, OpenCanvasInstance, SendAgentMode, SendMode, SendRequest,
+    ConnectorAccountRequest, ConnectorAvailability, ConnectorCapabilities, ConnectorCatalogResult,
+    ConnectorCatalogStatus, ConnectorConnectRequest, ConnectorConnectResult,
+    ConnectorContinueRequest, ConnectorDisconnectResult, ConnectorMcpStatus,
+    ConnectorReconcileRequest, ConnectorStatus, ModelSetAllowedModelsRequest, OpenCanvasInstance,
+    SendAgentMode, SendMode, SendRequest, SessionRpcConnectors,
 };
 use github_copilot_sdk::session_events::{
     ManagedSettingsResolvedSource, McpOauthRequiredData, ReasoningSummary, SessionLimitsConfig,
@@ -27,11 +31,13 @@ use github_copilot_sdk::session_events::{
 };
 use github_copilot_sdk::types::{
     AskUserVariant, CanvasProviderIdentity, CloudSessionOptions, CloudSessionRepository,
-    CommandContext, CommandDefinition, CommandHandler, DeliveryMode, DisableBypassPermissionsModes,
+    CommandContext, CommandDefinition, CommandHandler, DeliveryMode, DiagnosticLogLevel,
+    DiagnosticSourcesConfiguration, DiagnosticsConfiguration, DisableBypassPermissionsModes,
     ElicitationRequest, ElicitationResult, ExitPlanModeData, ExtensionInfo, ManagedSettings,
-    ManagedSettingsPermissions, MessageOptions, PermissionDecisionContext,
-    PermissionDecisionOutcome, PermissionDecisionSource, PermissionDecisionSurface, RequestId,
-    SessionConfig, SessionId, SetModelOptions, Tool, ToolInvocation, ToolResult,
+    ManagedSettingsPermissions, McpDiagnosticSourceConfiguration, MessageOptions,
+    PermissionDecisionContext, PermissionDecisionOutcome, PermissionDecisionSource,
+    PermissionDecisionSurface, RequestId, SessionConfig, SessionId, SetModelOptions, Tool,
+    ToolInvocation, ToolResult,
 };
 use github_copilot_sdk::{
     AgentMode, Attachment, Client, ContextTier, ErrorKind, MessageSource, ProtocolErrorKind, tool,
@@ -195,6 +201,33 @@ struct GatedApproveHandler {
     release: Arc<Notify>,
 }
 
+struct PendingPermissionHandler {
+    entered: Arc<Notify>,
+    dropped: Arc<Notify>,
+}
+
+struct NotifyOnDrop(Arc<Notify>);
+
+impl Drop for NotifyOnDrop {
+    fn drop(&mut self) {
+        self.0.notify_one();
+    }
+}
+
+#[async_trait]
+impl PermissionHandler for PendingPermissionHandler {
+    async fn handle(
+        &self,
+        _session_id: SessionId,
+        _request_id: RequestId,
+        _data: github_copilot_sdk::PermissionRequestData,
+    ) -> PermissionResult {
+        let _on_drop = NotifyOnDrop(self.dropped.clone());
+        self.entered.notify_one();
+        std::future::pending().await
+    }
+}
+
 #[async_trait]
 impl PermissionHandler for GatedApproveHandler {
     async fn handle(
@@ -358,6 +391,23 @@ impl FakeServer {
         .await;
     }
 
+    async fn send_event_from_agent(&mut self, event_type: &str, data: Value, agent_id: &str) {
+        self.send_notification(
+            "session.event",
+            serde_json::json!({
+                "sessionId": self.session_id,
+                "event": {
+                    "id": format!("evt-{}", rand_id()),
+                    "timestamp": "2025-01-01T00:00:00Z",
+                    "agentId": agent_id,
+                    "type": event_type,
+                    "data": data,
+                },
+            }),
+        )
+        .await;
+    }
+
     async fn send_request(&mut self, id: u64, method: &str, params: Value) {
         let request = serde_json::json!({
             "jsonrpc": "2.0",
@@ -1408,6 +1458,39 @@ async fn create_session_sends_new_session_options() {
     timeout(TIMEOUT, create_handle).await.unwrap().unwrap();
 }
 
+#[tokio::test]
+async fn create_session_forwards_refresh_custom_instructions_only_when_set() {
+    for refresh in [Some(true), Some(false), None] {
+        let (client, mut server_read, mut server_write) = make_client();
+        let mut config = SessionConfig::default();
+        if let Some(refresh) = refresh {
+            config = config.with_refresh_custom_instructions(refresh);
+        }
+        let create = client.create_session(config);
+        let server = async {
+            let request = read_framed(&mut server_read).await;
+            assert_eq!(request["method"], "session.create");
+            assert_eq!(
+                request["params"].get("refreshCustomInstructions"),
+                refresh.map(Value::Bool).as_ref(),
+                "refresh_custom_instructions = {refresh:?}"
+            );
+            let session_id = requested_session_id(&request);
+            let response = serde_json::json!({
+                "jsonrpc": "2.0",
+                "id": request["id"],
+                "result": { "sessionId": session_id },
+            });
+            write_framed(&mut server_write, &serde_json::to_vec(&response).unwrap()).await;
+        };
+
+        let (session, ()) = timeout(TIMEOUT, async { tokio::join!(create, server) })
+            .await
+            .unwrap();
+        session.unwrap();
+    }
+}
+
 #[tokio::test]
 async fn create_session_forwards_ask_user_variant() {
     let (client, mut server_read, mut server_write) = make_client();
@@ -1462,6 +1545,125 @@ async fn cold_resume_session_forwards_ask_user_variant() {
     timeout(TIMEOUT, resume_handle).await.unwrap().unwrap();
 }
 
+fn diagnostics_configuration(level: DiagnosticLogLevel) -> DiagnosticsConfiguration {
+    DiagnosticsConfiguration {
+        sources: DiagnosticSourcesConfiguration {
+            mcp: Some(McpDiagnosticSourceConfiguration { level }),
+        },
+    }
+}
+
+#[tokio::test]
+async fn create_session_forwards_diagnostics() {
+    let (client, mut server_read, mut server_write) = make_client();
+
+    let create_handle = tokio::spawn({
+        let client = client.clone();
+        async move {
+            client
+                .create_session(
+                    SessionConfig::default()
+                        .with_diagnostics(diagnostics_configuration(DiagnosticLogLevel::Debug)),
+                )
+                .await
+                .unwrap()
+        }
+    });
+
+    let request = read_framed(&mut server_read).await;
+    assert_eq!(request["method"], "session.create");
+    assert_eq!(
+        request["params"]["diagnostics"]["sources"]["mcp"]["level"],
+        "debug"
+    );
+
+    let session_id = requested_session_id(&request).to_string();
+    server_respond_create(&mut server_write, &request, &session_id).await;
+    timeout(TIMEOUT, create_handle).await.unwrap().unwrap();
+}
+
+#[tokio::test]
+async fn cold_resume_session_forwards_diagnostics() {
+    use github_copilot_sdk::types::ResumeSessionConfig;
+
+    let (client, mut server_read, mut server_write) = make_client();
+
+    let resume_handle = tokio::spawn({
+        let client = client.clone();
+        async move {
+            client
+                .resume_session(
+                    ResumeSessionConfig::new(SessionId::from("diagnostics"))
+                        .with_diagnostics(diagnostics_configuration(DiagnosticLogLevel::Trace)),
+                )
+                .await
+                .unwrap()
+        }
+    });
+
+    let request = read_framed(&mut server_read).await;
+    assert_eq!(request["method"], "session.resume");
+    assert_eq!(request["params"]["sessionId"], "diagnostics");
+    assert_eq!(
+        request["params"]["diagnostics"]["sources"]["mcp"]["level"],
+        "trace"
+    );
+
+    server_respond_create(&mut server_write, &request, "diagnostics").await;
+    respond_to_reload(&mut server_read, &mut server_write).await;
+    timeout(TIMEOUT, resume_handle).await.unwrap().unwrap();
+}
+
+#[tokio::test]
+async fn create_session_omits_unset_diagnostics() {
+    let (client, mut server_read, mut server_write) = make_client();
+
+    let create_handle = tokio::spawn({
+        let client = client.clone();
+        async move {
+            client
+                .create_session(SessionConfig::default())
+                .await
+                .unwrap()
+        }
+    });
+
+    let request = read_framed(&mut server_read).await;
+    assert_eq!(request["method"], "session.create");
+    assert!(request["params"].get("diagnostics").is_none());
+
+    let session_id = requested_session_id(&request).to_string();
+    server_respond_create(&mut server_write, &request, &session_id).await;
+    timeout(TIMEOUT, create_handle).await.unwrap().unwrap();
+}
+
+#[tokio::test]
+async fn cold_resume_session_omits_unset_diagnostics() {
+    use github_copilot_sdk::types::ResumeSessionConfig;
+
+    let (client, mut server_read, mut server_write) = make_client();
+
+    let resume_handle = tokio::spawn({
+        let client = client.clone();
+        async move {
+            client
+                .resume_session(ResumeSessionConfig::new(SessionId::from(
+                    "diagnostics-default",
+                )))
+                .await
+                .unwrap()
+        }
+    });
+
+    let request = read_framed(&mut server_read).await;
+    assert_eq!(request["method"], "session.resume");
+    assert!(request["params"].get("diagnostics").is_none());
+
+    server_respond_create(&mut server_write, &request, "diagnostics-default").await;
+    respond_to_reload(&mut server_read, &mut server_write).await;
+    timeout(TIMEOUT, resume_handle).await.unwrap().unwrap();
+}
+
 #[tokio::test]
 async fn resume_session_sends_new_session_options() {
     use github_copilot_sdk::types::ResumeSessionConfig;
@@ -1496,6 +1698,7 @@ async fn resume_session_sends_new_session_options() {
     assert_eq!(request["params"]["enableCitations"], false);
     assert_eq!(request["params"]["enableFileChangeTracking"], false);
     assert_eq!(request["params"]["sessionLimits"]["maxAiCredits"], 15.0);
+    assert!(request["params"].get("refreshCustomInstructions").is_none());
 
     server_respond_create(&mut server_write, &request, "session-options").await;
     respond_to_reload(&mut server_read, &mut server_write).await;
@@ -4513,6 +4716,186 @@ async fn send_and_wait_returns_error_on_session_error() {
     );
 }
 
+#[tokio::test]
+async fn send_and_wait_queues_terminal_event_before_waking_caller() {
+    use std::future::Future;
+    use std::sync::atomic::AtomicBool;
+    use std::task::{Context, Wake, Waker};
+
+    use futures_util::FutureExt;
+    use github_copilot_sdk::subscription::EventSubscription;
+
+    struct InspectQueueOnWake {
+        events: std::sync::Mutex<EventSubscription>,
+        armed: AtomicBool,
+        queued_at_completion: std::sync::Mutex<Option<bool>>,
+        woke: Notify,
+    }
+
+    impl Wake for InspectQueueOnWake {
+        fn wake(self: Arc<Self>) {
+            self.wake_by_ref();
+        }
+
+        fn wake_by_ref(self: &Arc<Self>) {
+            if self.armed.load(Ordering::SeqCst) {
+                // Inspect synchronously so a later broadcast cannot hide premature completion.
+                let mut queued = self.queued_at_completion.lock().unwrap();
+                if queued.is_some() {
+                    self.woke.notify_one();
+                    return;
+                }
+                let event = self.events.lock().unwrap().recv().now_or_never();
+                *queued = Some(matches!(
+                    event,
+                    Some(Ok(event)) if matches!(event.event_type.as_str(), "session.idle" | "session.error")
+                ));
+            }
+            self.woke.notify_one();
+        }
+    }
+
+    for terminal in ["session.idle", "session.error"] {
+        let (session, mut server) = create_session_pair().await;
+        let probe = Arc::new(InspectQueueOnWake {
+            events: std::sync::Mutex::new(session.subscribe()),
+            armed: AtomicBool::new(false),
+            queued_at_completion: std::sync::Mutex::new(None),
+            woke: Notify::new(),
+        });
+        let waker = Waker::from(probe.clone());
+        let mut waiting = Box::pin(session.send_and_wait("hello"));
+        assert!(
+            waiting
+                .as_mut()
+                .poll(&mut Context::from_waker(&waker))
+                .is_pending()
+        );
+        let request = server.read_request().await;
+        let mut response_processed = session.subscribe();
+        server.respond(&request, serde_json::json!({})).await;
+        // This following event proves the send response was processed before arming the probe.
+        server
+            .send_event(
+                "assistant.message",
+                serde_json::json!({ "content": "hello" }),
+            )
+            .await;
+        timeout(TIMEOUT, response_processed.recv())
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(matches!(
+            probe.events.lock().unwrap().recv().now_or_never(),
+            Some(Ok(_))
+        ));
+        assert!(
+            waiting
+                .as_mut()
+                .poll(&mut Context::from_waker(&waker))
+                .is_pending()
+        );
+
+        while probe.woke.notified().now_or_never().is_some() {}
+        probe.armed.store(true, Ordering::SeqCst);
+        server
+            .send_event(terminal, serde_json::json!({ "message": "failed" }))
+            .await;
+        timeout(TIMEOUT, probe.woke.notified()).await.unwrap();
+        assert_eq!(
+            *probe.queued_at_completion.lock().unwrap(),
+            Some(true),
+            "{terminal} must be queued before waking send_and_wait"
+        );
+        assert_eq!(waiting.await.is_err(), terminal == "session.error");
+    }
+}
+
+#[tokio::test]
+async fn send_and_wait_ignores_child_events_even_when_child_was_not_announced() {
+    let (session, mut server) = create_session_pair().await;
+    let session = Arc::new(session);
+    let mut events = session.subscribe();
+    let handle = tokio::spawn({
+        let session = session.clone();
+        async move {
+            session
+                .send_and_wait(
+                    MessageOptions::new("delegate").with_wait_timeout(Duration::from_secs(5)),
+                )
+                .await
+        }
+    });
+
+    let request = server.read_request().await;
+    assert_eq!(request["method"], "session.send");
+    server.respond(&request, serde_json::json!({})).await;
+
+    server
+        .send_event_from_agent(
+            "subagent.started",
+            serde_json::json!({ "agentName": "first" }),
+            "known-child",
+        )
+        .await;
+    server
+        .send_event_from_agent(
+            "assistant.message",
+            serde_json::json!({ "content": "known child reply" }),
+            "known-child",
+        )
+        .await;
+    server
+        .send_event_from_agent(
+            "session.error",
+            serde_json::json!({ "message": "known child failed" }),
+            "known-child",
+        )
+        .await;
+    server
+        .send_event_from_agent(
+            "assistant.message",
+            serde_json::json!({ "content": "child reply" }),
+            "unknown-child",
+        )
+        .await;
+    server
+        .send_event_from_agent(
+            "session.error",
+            serde_json::json!({ "message": "child failed" }),
+            "unknown-child",
+        )
+        .await;
+    server
+        .send_event_from_agent("session.idle", serde_json::json!({}), "unknown-child")
+        .await;
+
+    for expected in [
+        "subagent.started",
+        "assistant.message",
+        "session.error",
+        "assistant.message",
+        "session.error",
+        "session.idle",
+    ] {
+        let event = timeout(TIMEOUT, events.recv()).await.unwrap().unwrap();
+        assert_eq!(event.event_type, expected);
+    }
+    assert!(
+        !handle.is_finished(),
+        "child events must not end the parent wait"
+    );
+
+    server
+        .send_event("session.idle", serde_json::json!({}))
+        .await;
+    let result = timeout(TIMEOUT, handle).await.unwrap().unwrap().unwrap();
+    assert!(
+        result.is_none(),
+        "child replies must not supply the root reply"
+    );
+}
+
 #[tokio::test]
 async fn send_and_wait_times_out() {
     let (session, mut server) = create_session_pair().await;
@@ -6156,6 +6539,235 @@ async fn rpc_namespace_session_tasks_list_dispatches_correctly() {
     assert!(result.tasks.is_empty());
 }
 
+#[tokio::test]
+async fn rpc_namespace_session_connectors_dispatches_all_methods() {
+    let (session, mut server) = create_session_pair().await;
+    let session_id = server.session_id.clone();
+    let catalog = serde_json::json!({
+        "connectors": [{
+            "description": "Source control",
+            "displayName": "GitHub",
+            "name": "github",
+            "runtimeServerIds": ["connector-github"],
+            "status": "connected"
+        }],
+        "refreshedAtMs": 1_726_668_000_000_i64,
+        "revision": 4
+    });
+    let status = serde_json::json!({
+        "accountId": "account-1",
+        "apiVersion": 1,
+        "availability": "enabled",
+        "catalog": catalog.clone(),
+        "pendingConnections": 0,
+        "runtimeServers": [{
+            "connectorName": "github",
+            "runtimeServerId": "connector-github",
+            "status": "connected"
+        }]
+    });
+    let capabilities = serde_json::json!({
+        "apiVersion": 1,
+        "availability": "enabled",
+        "consentContinuation": true,
+        "maxDeadlineMs": 60_000,
+        "maxPollAttempts": 10,
+        "maxPollIntervalMs": 5_000,
+        "opaqueAccountSelection": true
+    });
+
+    let server_handle = tokio::spawn(async move {
+        let expectations = [
+            (
+                "session.connectors.getCapabilities",
+                serde_json::json!({ "sessionId": session_id }),
+                capabilities,
+            ),
+            (
+                "session.connectors.getStatus",
+                serde_json::json!({ "sessionId": session_id }),
+                status.clone(),
+            ),
+            (
+                "session.connectors.list",
+                serde_json::json!({
+                    "accountId": "account-1",
+                    "sessionId": session_id
+                }),
+                catalog.clone(),
+            ),
+            (
+                "session.connectors.refresh",
+                serde_json::json!({
+                    "accountId": "account-1",
+                    "sessionId": session_id
+                }),
+                catalog,
+            ),
+            (
+                "session.connectors.connect",
+                serde_json::json!({
+                    "accountId": "account-1",
+                    "connectorName": "github",
+                    "sessionId": session_id
+                }),
+                serde_json::json!({
+                    "kind": "connected",
+                    "status": status.clone()
+                }),
+            ),
+            (
+                "session.connectors.reconnect",
+                serde_json::json!({
+                    "accountId": "account-1",
+                    "connectorName": "github",
+                    "sessionId": session_id
+                }),
+                serde_json::json!({
+                    "consentUrl": "https://example.test/consent",
+                    "continuationId": "continuation-1",
+                    "kind": "consent_required"
+                }),
+            ),
+            (
+                "session.connectors.continueConnection",
+                serde_json::json!({
+                    "continuationId": "continuation-1",
+                    "deadlineMs": 60_000,
+                    "maxAttempts": 10,
+                    "pollIntervalMs": 1_000,
+                    "sessionId": session_id
+                }),
+                serde_json::json!({
+                    "continuationId": "continuation-2",
+                    "kind": "pending"
+                }),
+            ),
+            (
+                "session.connectors.disconnect",
+                serde_json::json!({
+                    "accountId": "account-1",
+                    "connectorName": "github",
+                    "sessionId": session_id
+                }),
+                serde_json::json!({
+                    "disconnected": true,
+                    "status": status.clone()
+                }),
+            ),
+            (
+                "session.connectors.reconcile",
+                serde_json::json!({
+                    "accountId": "account-1",
+                    "refreshCatalog": true,
+                    "sessionId": session_id
+                }),
+                status,
+            ),
+        ];
+
+        for (method, params, result) in expectations {
+            let request = server.read_request().await;
+            assert_eq!(request["method"], method);
+            assert_eq!(request["params"], params);
+            server.respond(&request, result).await;
+        }
+    });
+
+    let connectors: SessionRpcConnectors<'_> = session.rpc().connectors();
+
+    let capabilities: ConnectorCapabilities = connectors.get_capabilities().await.unwrap();
+    assert_eq!(capabilities.availability, ConnectorAvailability::Enabled);
+    assert_eq!(capabilities.max_poll_attempts, 10);
+
+    let status: ConnectorStatus = connectors.get_status().await.unwrap();
+    assert_eq!(status.account_id.as_deref(), Some("account-1"));
+    assert_eq!(
+        status.runtime_servers[0].status,
+        ConnectorMcpStatus::Connected
+    );
+
+    let catalog: ConnectorCatalogResult = connectors
+        .list(ConnectorAccountRequest {
+            account_id: "account-1".to_string(),
+        })
+        .await
+        .unwrap();
+    assert_eq!(
+        catalog.connectors[0].status,
+        ConnectorCatalogStatus::Connected
+    );
+
+    let refreshed: ConnectorCatalogResult = connectors
+        .refresh(ConnectorAccountRequest {
+            account_id: "account-1".to_string(),
+        })
+        .await
+        .unwrap();
+    assert_eq!(refreshed.revision, 4);
+
+    let connected: ConnectorConnectResult = connectors
+        .connect(ConnectorConnectRequest {
+            account_id: "account-1".to_string(),
+            connector_name: "github".to_string(),
+        })
+        .await
+        .unwrap();
+    let ConnectorConnectResult::Connected(connected) = connected else {
+        panic!("expected connected result");
+    };
+    assert_eq!(
+        connected.status.availability,
+        ConnectorAvailability::Enabled
+    );
+
+    let reconnect: ConnectorConnectResult = connectors
+        .reconnect(ConnectorConnectRequest {
+            account_id: "account-1".to_string(),
+            connector_name: "github".to_string(),
+        })
+        .await
+        .unwrap();
+    let ConnectorConnectResult::ConsentRequired(consent) = reconnect else {
+        panic!("expected consent-required result");
+    };
+    assert_eq!(consent.continuation_id, "continuation-1");
+
+    let continuation: ConnectorConnectResult = connectors
+        .continue_connection(ConnectorContinueRequest {
+            continuation_id: "continuation-1".to_string(),
+            deadline_ms: 60_000,
+            max_attempts: 10,
+            poll_interval_ms: 1_000,
+        })
+        .await
+        .unwrap();
+    let ConnectorConnectResult::Pending(pending) = continuation else {
+        panic!("expected pending result");
+    };
+    assert_eq!(pending.continuation_id, "continuation-2");
+
+    let disconnected: ConnectorDisconnectResult = connectors
+        .disconnect(ConnectorConnectRequest {
+            account_id: "account-1".to_string(),
+            connector_name: "github".to_string(),
+        })
+        .await
+        .unwrap();
+    assert!(disconnected.disconnected);
+
+    let reconciled: ConnectorStatus = connectors
+        .reconcile(ConnectorReconcileRequest {
+            account_id: "account-1".to_string(),
+            refresh_catalog: Some(true),
+        })
+        .await
+        .unwrap();
+    assert_eq!(reconciled.catalog.unwrap().revision, 4);
+
+    timeout(TIMEOUT, server_handle).await.unwrap().unwrap();
+}
+
 #[tokio::test]
 async fn rpc_namespace_client_models_list_dispatches_correctly() {
     let (session, mut server) = create_session_pair().await;
@@ -6574,15 +7186,22 @@ use github_copilot_sdk::session_fs::{
 
 struct RecordingFsProvider {
     files: parking_lot::Mutex<std::collections::HashMap<String, String>>,
+    blocked_stat: Option<(Arc<Notify>, Arc<Notify>)>,
 }
 
 impl RecordingFsProvider {
     fn new() -> Self {
         Self {
             files: parking_lot::Mutex::new(std::collections::HashMap::new()),
+            blocked_stat: None,
         }
     }
 
+    fn with_blocked_stat(mut self, entered: Arc<Notify>, dropped: Arc<Notify>) -> Self {
+        self.blocked_stat = Some((entered, dropped));
+        self
+    }
+
     fn with_file(self, path: &str, content: &str) -> Self {
         self.files
             .lock()
@@ -6614,6 +7233,11 @@ impl SessionFsProvider for RecordingFsProvider {
     }
 
     async fn stat(&self, path: &str) -> Result<FileInfo, FsError> {
+        if let Some((entered, dropped)) = &self.blocked_stat {
+            let _on_drop = NotifyOnDrop(dropped.clone());
+            entered.notify_one();
+            std::future::pending::<()>().await;
+        }
         let files = self.files.lock();
         let content = files
             .get(path)
@@ -6752,6 +7376,185 @@ async fn create_session_pair_with_fs_provider(
     (session, server)
 }
 
+#[tokio::test]
+async fn session_fs_request_during_create_is_served_before_create_response() {
+    let provider = Arc::new(RecordingFsProvider::new().with_file("/workspace/.copilot", "meta"));
+    let (client, server_read, server_write) = make_client();
+    let mut server = FakeServer {
+        read: server_read,
+        write: server_write,
+        session_id: String::new(),
+    };
+    let create_handle = tokio::spawn({
+        let client = client.clone();
+        async move {
+            client
+                .create_session(SessionConfig::default().with_session_fs_provider(provider))
+                .await
+        }
+    });
+
+    let create_req = timeout(TIMEOUT, server.read_request()).await.unwrap();
+    assert_eq!(create_req["method"], "session.create");
+    server.session_id = requested_session_id(&create_req).to_string();
+    server
+        .send_request(
+            7,
+            "sessionFs.stat",
+            serde_json::json!({ "sessionId": server.session_id, "path": "/workspace/.copilot" }),
+        )
+        .await;
+    let response = timeout(TIMEOUT, server.read_response())
+        .await
+        .expect("sessionFs.stat must be served before session.create returns");
+    assert_eq!(response["id"], 7);
+    assert_eq!(response["result"]["isFile"], true);
+
+    server
+        .respond(
+            &create_req,
+            serde_json::json!({
+                "sessionId": server.session_id,
+                "workspacePath": "/tmp/workspace"
+            }),
+        )
+        .await;
+    let session = timeout(TIMEOUT, create_handle)
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    assert_eq!(session.id().as_str(), server.session_id);
+}
+
+#[tokio::test]
+async fn failed_create_cancels_pre_response_permission_handler() {
+    let entered = Arc::new(Notify::new());
+    let dropped = Arc::new(Notify::new());
+    let handler = Arc::new(PendingPermissionHandler {
+        entered: entered.clone(),
+        dropped: dropped.clone(),
+    });
+    let (client, server_read, server_write) = make_client();
+    let mut server = FakeServer {
+        read: server_read,
+        write: server_write,
+        session_id: String::new(),
+    };
+    let create_handle = tokio::spawn(async move {
+        client
+            .create_session(SessionConfig::default().with_permission_handler(handler))
+            .await
+    });
+
+    let create_req = timeout(TIMEOUT, server.read_request()).await.unwrap();
+    server.session_id = requested_session_id(&create_req).to_string();
+    server
+        .send_event(
+            "permission.requested",
+            serde_json::json!({
+                "requestId": "during-create",
+                "sessionId": server.session_id,
+                "permissionRequest": { "kind": "shell" },
+            }),
+        )
+        .await;
+    timeout(TIMEOUT, entered.notified()).await.unwrap();
+    server
+        .respond_error(&create_req, -32000, "creation rejected")
+        .await;
+    assert!(
+        timeout(TIMEOUT, create_handle)
+            .await
+            .unwrap()
+            .unwrap()
+            .is_err()
+    );
+    timeout(TIMEOUT, dropped.notified()).await.unwrap();
+}
+
+#[tokio::test]
+async fn cancelled_create_cancels_pre_response_permission_handler() {
+    let entered = Arc::new(Notify::new());
+    let dropped = Arc::new(Notify::new());
+    let handler = Arc::new(PendingPermissionHandler {
+        entered: entered.clone(),
+        dropped: dropped.clone(),
+    });
+    let (client, server_read, server_write) = make_client();
+    let mut server = FakeServer {
+        read: server_read,
+        write: server_write,
+        session_id: String::new(),
+    };
+    let create_handle = tokio::spawn(async move {
+        client
+            .create_session(SessionConfig::default().with_permission_handler(handler))
+            .await
+    });
+
+    let create_req = timeout(TIMEOUT, server.read_request()).await.unwrap();
+    server.session_id = requested_session_id(&create_req).to_string();
+    server
+        .send_event(
+            "permission.requested",
+            serde_json::json!({
+                "requestId": "during-cancelled-create",
+                "sessionId": server.session_id,
+                "permissionRequest": { "kind": "shell" },
+            }),
+        )
+        .await;
+    timeout(TIMEOUT, entered.notified()).await.unwrap();
+    create_handle.abort();
+    match create_handle.await {
+        Err(error) => assert!(error.is_cancelled()),
+        Ok(_) => panic!("create must be cancelled"),
+    }
+    timeout(TIMEOUT, dropped.notified()).await.unwrap();
+}
+
+#[tokio::test]
+async fn failed_create_cancels_pre_response_session_fs_request() {
+    let entered = Arc::new(Notify::new());
+    let dropped = Arc::new(Notify::new());
+    let provider =
+        Arc::new(RecordingFsProvider::new().with_blocked_stat(entered.clone(), dropped.clone()));
+    let (client, server_read, server_write) = make_client();
+    let mut server = FakeServer {
+        read: server_read,
+        write: server_write,
+        session_id: String::new(),
+    };
+    let create_handle = tokio::spawn(async move {
+        client
+            .create_session(SessionConfig::default().with_session_fs_provider(provider))
+            .await
+    });
+
+    let create_req = timeout(TIMEOUT, server.read_request()).await.unwrap();
+    server.session_id = requested_session_id(&create_req).to_string();
+    server
+        .send_request(
+            7,
+            "sessionFs.stat",
+            serde_json::json!({ "sessionId": server.session_id, "path": "/workspace/.copilot" }),
+        )
+        .await;
+    timeout(TIMEOUT, entered.notified()).await.unwrap();
+    server
+        .respond_error(&create_req, -32000, "creation rejected")
+        .await;
+    assert!(
+        timeout(TIMEOUT, create_handle)
+            .await
+            .unwrap()
+            .unwrap()
+            .is_err()
+    );
+    timeout(TIMEOUT, dropped.notified()).await.unwrap();
+}
+
 #[tokio::test]
 async fn session_fs_dispatches_read_file_to_provider() {
     let provider = Arc::new(RecordingFsProvider::new().with_file("/foo.txt", "hello world"));
diff --git a/scripts/ci/runtime-artifact-isolation.test.mjs b/scripts/ci/runtime-artifact-isolation.test.mjs
new file mode 100644
index 0000000000..d38cd37bbe
--- /dev/null
+++ b/scripts/ci/runtime-artifact-isolation.test.mjs
@@ -0,0 +1,33 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+await test("runtime artifact fixtures do not modify the inherited Actions environment file", (t) => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "sdk-runtime-artifact-isolation-"));
+    t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+    const environmentFile = path.join(root, "environment");
+    const originalContents = "EXISTING_VALUE=preserved\n";
+    fs.writeFileSync(environmentFile, originalContents);
+
+    const result = spawnSync(
+        process.execPath,
+        [fileURLToPath(new URL("./runtime-artifact.test.mjs", import.meta.url))],
+        {
+            encoding: "utf8",
+            env: { ...process.env, GITHUB_ENV: environmentFile },
+            timeout: 30_000,
+        },
+    );
+
+    assert.equal(result.error, undefined);
+    assert.equal(result.status, 0, result.stdout + result.stderr);
+    assert.equal(fs.readFileSync(environmentFile, "utf8"), originalContents);
+});
diff --git a/scripts/ci/runtime-artifact.test.mjs b/scripts/ci/runtime-artifact.test.mjs
index 94003be3b2..bee71a0c29 100644
--- a/scripts/ci/runtime-artifact.test.mjs
+++ b/scripts/ci/runtime-artifact.test.mjs
@@ -88,7 +88,7 @@ await test("preserves complete checked-in Rust release pins", (t) => {
         sdkRoot,
         target,
         outputDirectory: path.join(root, "output"),
-        environmentFile: undefined,
+        environmentFile: path.join(root, "environment"),
     });
 
     assert.equal(fs.readFileSync(path.join(rustDirectory, "cli-version.txt"), "utf8"), releasePin);
@@ -111,7 +111,7 @@ await test("selects an explicit musl target without falling back to the GNU arti
         sdkRoot,
         target,
         outputDirectory,
-        environmentFile: undefined,
+        environmentFile: path.join(root, "environment"),
     });
 
     assert.match(values.COPILOT_CLI_PATH, /prebuilds\/linuxmusl-arm64\/copilot-runtime$/);
@@ -142,7 +142,7 @@ await test("rejects a GNU artifact when a musl target is requested", (t) => {
                 sdkRoot: path.join(runtimeRoot, "src/sdk"),
                 target: "linuxmusl-arm64",
                 outputDirectory: path.join(root, "out"),
-                environmentFile: undefined,
+                environmentFile: path.join(root, "environment"),
             }),
         /dist-bin[/\\]linuxmusl-arm64[/\\]copilot/,
     );
@@ -230,6 +230,7 @@ await test("rejects an incomplete runtime artifact", (t) => {
                 runtimeRoot: root,
                 sdkRoot: path.join(root, "src/sdk"),
                 outputDirectory: path.join(root, "out"),
+                environmentFile: path.join(root, "environment"),
             }),
         /CLI executable not found/,
     );
@@ -246,7 +247,11 @@ await test("prepares artifacts from an exported SDK layout", (t) => {
 
     const result = spawnSync(process.execPath, [script, "prepare"], {
         encoding: "utf8",
-        env: { ...process.env, GITHUB_ENV: path.join(root, "environment") },
+        env: {
+            ...process.env,
+            COPILOT_RUNTIME_OUTPUT_DIRECTORY: path.join(root, "output"),
+            GITHUB_ENV: path.join(root, "environment"),
+        },
     });
 
     assert.equal(result.status, 0, result.stderr);
diff --git a/scripts/codegen/csharp.ts b/scripts/codegen/csharp.ts
index aa7399290a..0b2620b093 100644
--- a/scripts/codegen/csharp.ts
+++ b/scripts/codegen/csharp.ts
@@ -578,7 +578,7 @@ const COPYRIGHT = `/*-----------------------------------------------------------
  *  Copyright (c) Microsoft Corporation. All rights reserved.
  *--------------------------------------------------------------------------------------------*/`;
 
-const EXPERIMENTAL_ATTRIBUTE = "[Experimental(Diagnostics.Experimental)]";
+const EXPERIMENTAL_ATTRIBUTE = "[Experimental(global::GitHub.Copilot.Diagnostics.Experimental)]";
 const EDITOR_BROWSABLE_NEVER_ATTRIBUTE = "[EditorBrowsable(EditorBrowsableState.Never)]";
 const OBSOLETE_ATTRIBUTE = `#if NET5_0_OR_GREATER
 [Obsolete("This member is deprecated and will be removed in a future version.", DiagnosticId = "GHCP001")]
diff --git a/scripts/codegen/python.ts b/scripts/codegen/python.ts
index f10110c490..74bee76eb6 100644
--- a/scripts/codegen/python.ts
+++ b/scripts/codegen/python.ts
@@ -1423,6 +1423,57 @@ function removeShadowedSessionEventEnumsForPython(
         .replace(/\n{3,}/g, "\n\n");
 }
 
+function makePythonDataclassFieldKeywordOnly(
+    code: string,
+    className: string,
+    fieldName: string
+): string {
+    const classPattern = new RegExp(
+        `(@dataclass\\r?\\nclass ${escapeRegExp(className)}:[\\s\\S]*?)(?=^@dataclass|^class\\s+\\w|^def\\s+\\w|(?![\\s\\S]))`,
+        "gm"
+    );
+    let foundClass = false;
+    const updated = code.replace(classPattern, (block: string) => {
+        foundClass = true;
+        const fieldPattern = new RegExp(
+            `^(    ${escapeRegExp(fieldName)}: .+) = None$`,
+            "m"
+        );
+        if (!fieldPattern.test(block)) {
+            throw new Error(`Missing optional field ${className}.${fieldName}`);
+        }
+        let updatedBlock = block.replace(fieldPattern, "$1 = field(default=None, kw_only=True)");
+
+        const constructorPattern = new RegExp(
+            `^(        return ${escapeRegExp(className)}\\()([^\\n]*)(\\))$`,
+            "m"
+        );
+        let foundConstructor = false;
+        updatedBlock = updatedBlock.replace(
+            constructorPattern,
+            (_match: string, prefix: string, args: string, suffix: string) => {
+                foundConstructor = true;
+                const constructorArgs = args.split(", ");
+                const fieldIndex = constructorArgs.indexOf(fieldName);
+                if (fieldIndex < 0) {
+                    throw new Error(`Missing constructor argument ${className}.${fieldName}`);
+                }
+                constructorArgs.splice(fieldIndex, 1);
+                constructorArgs.push(`${fieldName}=${fieldName}`);
+                return `${prefix}${constructorArgs.join(", ")}${suffix}`;
+            }
+        );
+        if (!foundConstructor) {
+            throw new Error(`Missing from_dict constructor for ${className}`);
+        }
+        return updatedBlock;
+    });
+    if (!foundClass) {
+        throw new Error(`Missing dataclass ${className}`);
+    }
+    return updated;
+}
+
 function reorderPythonDataclassFields(code: string): string {
     const fieldRe =
         /^    \w+: (?:Any|bool|int|float|str|dict|list|ClassVar|[A-Z_]\w*|['"][A-Z_]\w*)(?:[^=]*)?(?: = .*)?$/;
@@ -3244,6 +3295,11 @@ async function generateRpc(schemaPath?: string, sessionEventsSchema?: JSONSchema
     // Reorder class/enum definitions to resolve forward references.
     // Quicktype may emit classes before their dependencies are defined.
     typesCode = reorderPythonForwardRefs(typesCode);
+    typesCode = makePythonDataclassFieldKeywordOnly(
+        typesCode,
+        "MCPServerConfigHTTP",
+        "oauth_scopes"
+    );
 
     // Strip quicktype's import block and preamble — we provide our own unified header.
     // The preamble ends just before the first helper function (e.g. "def from_str")
@@ -3384,7 +3440,7 @@ if TYPE_CHECKING:
     from .._jsonrpc import JsonRpcClient
 
 from collections.abc import Callable
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import datetime
 from enum import Enum
 from typing import Any, Protocol, TypeVar, cast
diff --git a/test/harness/subagentHooksReplay.test.ts b/test/harness/subagentHooksReplay.test.ts
index f2ce348eac..904e4b95a9 100644
--- a/test/harness/subagentHooksReplay.test.ts
+++ b/test/harness/subagentHooksReplay.test.ts
@@ -195,6 +195,9 @@ for (const timing of ["before", "after"] as const) {
           notification,
         ],
         continuation,
+        ...(timing === "before"
+          ? [[...prefix, notification, readAgent, toolResult]]
+          : []),
         [
           ...continuation,
           {
@@ -287,7 +290,7 @@ test("timing and wording alternatives retain the full result and final continuat
         }
         if (
           message.tool_calls?.some(
-            (call) => call.function.name === "read_agent",
+            (call) => call.function?.name === "read_agent",
           )
         ) {
           return { ...message, tool_calls: shortReadAgent.tool_calls };
diff --git a/test/harness/test-mcp-server.mjs b/test/harness/test-mcp-server.mjs
index a3a84b42b3..ab17776900 100644
--- a/test/harness/test-mcp-server.mjs
+++ b/test/harness/test-mcp-server.mjs
@@ -22,6 +22,7 @@ function getArgument(name) {
 }
 
 const startupMarkerPath = getArgument("--startup-marker");
+const diagnosticStderr = getArgument("--diagnostic-stderr");
 const serverName = getArgument("--server-name") ?? "env-echo";
 const server = new McpServer({ name: serverName, version: "1.0.0" });
 
@@ -38,4 +39,7 @@ const transport = new StdioServerTransport();
 if (startupMarkerPath) {
     await appendFile(startupMarkerPath, `${serverName}\n`);
 }
+if (diagnosticStderr) {
+    console.error(diagnosticStderr);
+}
 await server.connect(transport);
diff --git a/test/snapshots/skills/discovers_a_new_skill_on_the_next_turn_and_makes_it_available_to_a_subagent.yaml b/test/snapshots/skills/discovers_a_new_skill_on_the_next_turn_and_makes_it_available_to_a_subagent.yaml
new file mode 100644
index 0000000000..49ec0ac7af
--- /dev/null
+++ b/test/snapshots/skills/discovers_a_new_skill_on_the_next_turn_and_makes_it_available_to_a_subagent.yaml
@@ -0,0 +1,126 @@
+models:
+  - claude-sonnet-5
+conversations:
+  - messages:
+      - role: system
+        content: ${system}
+      - role: user
+        content: Reply with READY.
+      - role: assistant
+        content: READY
+      - role: user
+        content: >-
+          <tools_changed_notice>
+
+          New tools available: skill
+
+          </tools_changed_notice>
+
+
+          Use the skill tool to load late-skill, then use the task tool to ask a task agent to load late-skill with the skill tool and report its verification word. Report the agent's word.
+      - role: assistant
+        tool_calls:
+          - id: toolcall_0
+            type: function
+            function:
+              name: skill
+              arguments: '{"skill":"late-skill"}'
+      - role: tool
+        tool_call_id: toolcall_0
+        content: Skill "late-skill" loaded successfully. Follow the instructions in the skill context.
+      - role: user
+        content: >-
+          <skill-context name="late-skill">
+
+          Base directory for this skill: ${workdir}/.late_skills/late-skill
+
+
+          The verification word is ORCHID_SAPPHIRE_73.
+
+
+          </skill-context>
+      - role: assistant
+        tool_calls:
+          - id: toolcall_1
+            type: function
+            function:
+              name: task
+              arguments: '{"agent_type":"task","name":"check-late-skill","description":"Reading verification word","prompt":"Use the skill tool to load late-skill and report its verification word.","mode":"sync"}'
+  - messages:
+      - role: system
+        content: ${system}
+      - role: user
+        content: Use the skill tool to load late-skill and report its verification word.
+      - role: assistant
+        tool_calls:
+          - id: toolcall_0
+            type: function
+            function:
+              name: skill
+              arguments: '{"skill":"late-skill"}'
+      - role: tool
+        tool_call_id: toolcall_0
+        content: Skill "late-skill" loaded successfully. Follow the instructions in the skill context.
+      - role: user
+        content: >-
+          <skill-context name="late-skill">
+
+          Base directory for this skill: ${workdir}/.late_skills/late-skill
+
+
+          The verification word is ORCHID_SAPPHIRE_73.
+
+
+          </skill-context>
+      - role: assistant
+        content: ORCHID_SAPPHIRE_73
+  - messages:
+      - role: system
+        content: ${system}
+      - role: user
+        content: Reply with READY.
+      - role: assistant
+        content: READY
+      - role: user
+        content: >-
+          <tools_changed_notice>
+
+          New tools available: skill
+
+          </tools_changed_notice>
+
+
+          Use the skill tool to load late-skill, then use the task tool to ask a task agent to load late-skill with the skill tool and report its verification word. Report the agent's word.
+      - role: assistant
+        tool_calls:
+          - id: toolcall_0
+            type: function
+            function:
+              name: skill
+              arguments: '{"skill":"late-skill"}'
+      - role: tool
+        tool_call_id: toolcall_0
+        content: Skill "late-skill" loaded successfully. Follow the instructions in the skill context.
+      - role: user
+        content: >-
+          <skill-context name="late-skill">
+
+          Base directory for this skill: ${workdir}/.late_skills/late-skill
+
+
+          The verification word is ORCHID_SAPPHIRE_73.
+
+
+          </skill-context>
+      - role: assistant
+        tool_calls:
+          - id: toolcall_1
+            type: function
+            function:
+              name: task
+              arguments: '{"agent_type":"task","name":"check-late-skill","description":"Reading verification word","prompt":"Use the skill tool to load late-skill and report its verification word.","mode":"sync"}'
+      - role: tool
+        tool_call_id: toolcall_1
+        content: ORCHID_SAPPHIRE_73
+      - role: assistant
+        content: The agent reported ORCHID_SAPPHIRE_73.